@accelflow/space-content 0.0.0-stage → 0.1.0-beta.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Accelflow Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,84 @@
-# Temporary Holding Version
+# Space build content SDK (unpublished)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Node 24+ build-time content synchronization for Space Headless CMS, with optional browser-safe table-of-contents presentation. Licensed under MIT.
+
+The initial npm release is being prepared; the commands below apply once it is published.
+
+```sh
+npm install @accelflow/space-content@beta
+```
+
+```js
+import { syncContent } from '@accelflow/space-content/node';
+```
+
+Run content synchronization before your site's build. The `/node` entry is server-only; never include it or a Workspace token in a browser bundle.
+
+Use `SPACE_API_URL`, `SPACE_DOWNLOAD_ORIGIN`, `SPACE_ACCOUNT_ID`,
+`SPACE_WORKSPACE_ID`, `SPACE_BUILD_TOKEN` as server-only environment variables.
+IDs are stable account/workspace IDs, not slugs. `.space-cache`, `.space-build`,
+`.generated` must be ignored by Git and excluded from public deployment except
+for the intentionally generated content consumed by the site.
+
+`syncContent()` returns a fresh `snapshotDir` with `content.json` and
+`space-assets/<sha256>`. `content.json` contains selected HTML **or** structured
+JSON, title, slug, article metadata and an attachment ID/hash/MIME mapping.
+HTML attachment references use `/space-assets/<sha256>`; serve these files with
+the indicated MIME types. JSON rendering must resolve attachment IDs through
+that mapping. Internal article links retain published paths; the site's route
+mapping must match or transform them. Place static assets at the domain root,
+or rewrite those URLs for a subpath deployment.
+
+Vite integration: run sync as the first build script, import the generated JSON,
+and render it using the site's SSG/prerender tool. Vite alone does not create
+article HTML pages. Next.js integration: import generated JSON in server build
+code, use its article slugs in `generateStaticParams`, metadata in
+`generateMetadata`, and render the chosen body format. Plain Node integration
+keeps both frameworks independent of SDK-specific runtime plugins.
+
+The cache directory must be private and trusted, with no untrusted ancestor
+symlinks. Share it only among trusted builds for this environment. Content is
+hash-verified on every reuse and namespaced by account/workspace/format/schema.
+Each build gets a new output generation; removed articles/assets are excluded.
+Do not glob the cache as public content. Cache/output cleanup is the CI owner's
+responsibility and must not remove running jobs' files.
+
+A build and each new batch connection are authorized. An admitted stream may
+finish after token deletion, up to its deadline. Reconnecting requires current
+authorization. Verified complete objects survive a transport retry; partial
+objects restart. Missing terminal markers, checksum failures, foreign objects,
+or schema errors fail the build. No stale/offline fallback is used.
+
+Current limits: 4,096 unique objects per batch, 64 MiB per object, 1 GiB total;
+API publication adapter additionally limits assets to 16 MiB each. Retry count
+is bounded (default 2). Larger manifest sharding, partial-object resume,
+framework-specific adapters, cache GC and npm publication are follow-up work.
+
+Tests: `npm test` from this repository root (no dependencies required).
+Server, Worker and real-cloud integration tests remain in the Space service
+repository; the tests here exercise the client with synthetic protocol fixtures.
+
+## Full framework examples
+
+See [Vite and Next.js examples](examples/README.md) for complete static builds,
+CI cache handling, HTML rendering, asset headers and deployment boundaries.
+
+## Table of contents
+
+The browser-safe entry is separate from the authenticated Node client:
+
+```js
+import { mountTableOfContents } from '@accelflow/space-content/toc';
+import '@accelflow/space-content/toc.css';
+
+const cleanup = mountTableOfContents(articleElement, { locale: 'ja' });
+// Call cleanup when replacing the article or unmounting the component.
+```
+
+The default presentation is expanded on desktop and collapsed on mobile. Clicking a mobile link closes it. Titles are localized and omitted from their own entries. Use `title`, `maxLevel`, `desktopOpen`, `mobileOpen`, `mobileQuery`, or `render` to customize it. Styles are optional; see `toc.d.mts` for the complete interface.
+
+In Next.js, use this browser entry in a client component effect and return the cleanup function. Keep `syncContent` in build/server code. Both Vite and Next.js use the same package.
+
+## Release preparation
+
+See [RELEASING.md](RELEASING.md) for packaging checks, initial publication and OIDC setup.

package/node.d.mts

@@ -0,0 +1,14 @@
+export interface BuildManifest {
+ version: 1; accountId: string; workspaceId: string; format: 'html'|'json'; snapshotId: string;
+ objects: Array<{hash:string;size:number}>;
+ articles: Array<{id:string;slug:string;title:string;metadataHash:string;bodyHash:string}>;
+ assets: Array<{id:string;hash:string;contentType:string;filename:string}>;
+}
+export interface SyncOptions {
+ apiUrl: string; downloadOrigin: string; accountId: string; workspaceId: string; token: string;
+ cacheDir: string; outputDir: string; fetch?: typeof globalThis.fetch; maxRetries?: number;
+}
+export function syncContent(options: SyncOptions): Promise<{
+ snapshotDir:string; manifest:BuildManifest;
+ diagnostics:{downloadedObjects:number;cacheHits:number};
+}>;

package/node.mjs

@@ -0,0 +1,209 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, writeFile, rename, rm, lstat } from 'node:fs/promises';
+import { resolve, join } from 'node:path';
+const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+const hashPattern = /^[a-f0-9]{64}$/;
+function validateManifest(m, accountId, workspaceId) {
+    if (m.version !== 1 || m.accountId !== accountId || m.workspaceId !== workspaceId || !['html', 'json'].includes(m.format) || !hashPattern.test(m.snapshotId) || !Array.isArray(m.objects) || m.objects.length > 4096 || !Array.isArray(m.articles) || !Array.isArray(m.assets))
+        throw Error('invalid_manifest');
+    const { snapshotId, ...fixed } = m;
+    if (sha(JSON.stringify(fixed)) !== snapshotId)
+        throw Error('manifest_checksum_mismatch');
+    const objects = new Map();
+    let total = 0;
+    for (const o of m.objects) {
+        if (!hashPattern.test(o.hash) || !Number.isSafeInteger(o.size) || o.size < 0 || o.size > 64 * 1024 * 1024 || objects.has(o.hash))
+            throw Error('invalid_manifest');
+        objects.set(o.hash, o);
+        total += o.size;
+    }
+    if (total > 1024 * 1024 * 1024)
+        throw Error('manifest_too_large');
+    for (const a of m.articles)
+        if (typeof a.id !== 'string' || typeof a.slug !== 'string' || typeof a.title !== 'string' || !objects.has(a.bodyHash) || !objects.has(a.metadataHash))
+            throw Error('invalid_manifest');
+    for (const a of m.assets)
+        if (typeof a.id !== 'string' || typeof a.contentType !== 'string' || typeof a.filename !== 'string' || !objects.has(a.hash))
+            throw Error('invalid_manifest');
+    return objects;
+}
+async function limitedText(response, max) {
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw Error('missing_response');
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.length;
+            if (size > max)
+                throw Error('manifest_too_large');
+            chunks.push(Buffer.from(value));
+        }
+        return Buffer.concat(chunks).toString();
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+    }
+}
+class Reader {
+    constructor(stream) { if (!stream)
+        throw Error('missing_stream'); this.reader = stream.getReader(); this.buffer = new Uint8Array(); }
+    async take(max) { if (!this.buffer.length) {
+        const r = await this.reader.read();
+        if (r.done)
+            return null;
+        this.buffer = r.value;
+    } const n = Math.min(max, this.buffer.length), v = this.buffer.subarray(0, n); this.buffer = this.buffer.subarray(n); return v; }
+    async line() { const chunks = []; for (let n = 0; n < 4096; n++) {
+        const b = await this.take(1);
+        if (!b)
+            throw Error('truncated_stream');
+        if (b[0] === 10)
+            return JSON.parse(Buffer.from(chunks).toString());
+        chunks.push(b[0]);
+    } throw Error('frame_too_large'); }
+}
+async function cacheRead(path, o) { try {
+    if (!(await lstat(path)).isFile() || (await lstat(path)).isSymbolicLink())
+        return null;
+    const b = await readFile(path);
+    return b.length === o.size && sha(b) === o.hash ? b : null;
+}
+catch (e) {
+    if (e.code === 'ENOENT')
+        return null;
+    throw e;
+} }
+async function save(path, data) { const temp = path + '.' + randomUUID() + '.partial'; try {
+    await writeFile(temp, data, { flag: 'wx', mode: 0o600 });
+    await rename(temp, path);
+}
+finally {
+    await rm(temp, { force: true });
+} }
+async function safeDirectory(path) { await mkdir(path, { recursive: true, mode: 0o700 }); const s = await lstat(path); if (s.isSymbolicLink() || !s.isDirectory())
+    throw Error('unsafe_cache_directory'); }
+/** Build-time only. cacheDir must be a private, trusted directory; never expose it to untrusted PRs. */
+export async function syncContent({ apiUrl, downloadOrigin, accountId, workspaceId, token, cacheDir, outputDir, fetch: fetcher = globalThis.fetch, maxRetries = 2 }) {
+    const api = new URL(apiUrl), allowed = new URL(downloadOrigin);
+    if (api.protocol !== 'https:' || allowed.protocol !== 'https:' || api.username || api.password || allowed.username || allowed.password)
+        throw Error('https_required');
+    if (!Number.isInteger(maxRetries) || maxRetries < 0 || maxRetries > 3)
+        throw Error('invalid_retry_limit');
+    const start = await fetcher(new URL(`/v1/build/accounts/${encodeURIComponent(accountId)}/workspaces/${encodeURIComponent(workspaceId)}/sessions`, api), { method: 'POST', headers: { Authorization: `Bearer ${token}` }, redirect: 'error', signal: AbortSignal.timeout(120000) });
+    if (!start.ok)
+        throw Error(`headless_session_${start.status}`);
+    const raw = await limitedText(start, 1100000);
+    const { session, manifest, downloadUrl, expiresAt } = JSON.parse(raw);
+    if (typeof session !== 'string' || session.length > 4096 || !Number.isFinite(expiresAt) || expiresAt <= Date.now())
+        throw Error('invalid_session');
+    const objects = validateManifest(manifest, accountId, workspaceId), url = new URL(downloadUrl);
+    if (url.origin !== allowed.origin || url.protocol !== 'https:' || url.username || url.password)
+        throw Error('untrusted_download_url');
+    const cache = resolve(cacheDir), output = resolve(outputDir);
+    if (output === cache || output.startsWith(cache + '/') || cache.startsWith(output + '/'))
+        throw Error('overlapping_directories');
+    await safeDirectory(cache);
+    const namespace = join(cache, sha(JSON.stringify([accountId, workspaceId, manifest.format, manifest.version])));
+    await safeDirectory(namespace);
+    const missing = [];
+    for (const o of objects.values())
+        if (!await cacheRead(join(namespace, o.hash), o))
+            missing.push(o.hash);
+    let pending = missing, downloads = 0;
+    for (let attempt = 0; pending.length; attempt++) {
+        if (attempt > maxRetries || Date.now() >= expiresAt)
+            throw Error('headless_transfer_incomplete');
+        let response;
+        try {
+            response = await fetcher(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ session, hashes: pending }), redirect: 'error', signal: AbortSignal.timeout(Math.max(1, Math.min(1800000, expiresAt - Date.now()))) });
+        }
+        catch (error) {
+            if (attempt >= maxRetries)
+                throw error;
+            continue;
+        }
+        if ([429, 502, 503, 504].includes(response.status) && attempt < maxRetries) {
+            await response.body?.cancel();
+            await new Promise(resolve => setTimeout(resolve, Math.min(1000 * 2 ** attempt, 5000)));
+            continue;
+        }
+        if (!response.ok)
+            throw Error(`headless_download_${response.status}`);
+        const reader = new Reader(response.body);
+        let complete = false;
+        try {
+            const header = await reader.line();
+            if (header.version !== 1 || header.snapshotId !== manifest.snapshotId || header.count !== pending.length)
+                throw Error('invalid_stream_header');
+            const remaining = new Set(pending);
+            for (let i = 0; i < header.count; i++) {
+                const item = await reader.line(), expected = objects.get(item.hash);
+                if (!remaining.has(item.hash) || !expected || item.size !== expected.size)
+                    throw Error('unexpected_object');
+                const data = Buffer.alloc(item.size);
+                let offset = 0;
+                while (offset < data.length) {
+                    const chunk = await reader.take(data.length - offset);
+                    if (!chunk)
+                        throw Error('truncated_stream');
+                    data.set(chunk, offset);
+                    offset += chunk.length;
+                }
+                if (sha(data) !== item.hash)
+                    throw Error('object_checksum_mismatch');
+                await save(join(namespace, item.hash), data);
+                remaining.delete(item.hash);
+                downloads++;
+            }
+            const end = await reader.line();
+            if (end.end !== true || end.snapshotId !== manifest.snapshotId || end.count !== header.count || await reader.take(1) !== null)
+                throw Error('invalid_stream_end');
+            complete = true;
+        }
+        catch (error) {
+            if (error.message !== 'truncated_stream' && !['TypeError', 'AbortError', 'TimeoutError'].includes(error.name) && error.message !== 'transfer_failed')
+                throw error;
+        }
+        finally {
+            await reader.reader.cancel().catch(() => { });
+        }
+        pending = [];
+        for (const o of missing.map(h => objects.get(h)))
+            if (!await cacheRead(join(namespace, o.hash), o))
+                pending.push(o.hash);
+        // A missing terminal marker is never accepted even when every object arrived.
+        if (!complete && !pending.length)
+            throw Error('missing_stream_end');
+    }
+    // Fresh generation, never merge with previous output (deleted articles/assets stay excluded).
+    await safeDirectory(output);
+    const generation = join(output, randomUUID());
+    await safeDirectory(generation);
+    try {
+        const articles = [];
+        for (const a of manifest.articles) {
+            const body = await cacheRead(join(namespace, a.bodyHash), objects.get(a.bodyHash)), metadata = await cacheRead(join(namespace, a.metadataHash), objects.get(a.metadataHash));
+            if (!body || !metadata)
+                throw Error('cache_corrupt');
+            articles.push({ ...a, metadata: JSON.parse(metadata), body: JSON.parse(body) });
+        }
+        await safeDirectory(join(generation, 'space-assets'));
+        for (const a of manifest.assets) {
+            const data = await cacheRead(join(namespace, a.hash), objects.get(a.hash));
+            if (!data)
+                throw Error('cache_corrupt');
+            await writeFile(join(generation, 'space-assets', a.hash), data);
+        }
+        await writeFile(join(generation, 'content.json'), JSON.stringify({ snapshotId: manifest.snapshotId, format: manifest.format, articles, assets: manifest.assets }));
+        return { snapshotDir: generation, manifest, diagnostics: { downloadedObjects: downloads, cacheHits: objects.size - missing.length } };
+    }
+    catch (e) {
+        await rm(generation, { recursive: true, force: true });
+        throw e;
+    }
+}

package/package.json

@@ -1,6 +1,47 @@
 {
   "name": "@accelflow/space-content",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0-beta.1",
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "exports": {
+    "./node": {
+      "types": "./node.d.mts",
+      "import": "./node.mjs"
+    },
+    "./toc": {
+      "types": "./toc.d.mts",
+      "import": "./toc.mjs"
+    },
+    "./toc.css": "./toc.css"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "prepack": "npm test",
+    "verify:package": "node scripts/verify-package.mjs"
+  },
+  "files": [
+    "node.mjs",
+    "node.d.mts",
+    "README.md",
+    "toc.mjs",
+    "toc.d.mts",
+    "toc.css",
+    "LICENSE"
+  ],
+  "description": "Build-time Headless CMS content sync and customizable table of contents for Accelflow Space",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Accelflow/space-content-sdk.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Accelflow/space-content-sdk/issues"
+  },
+  "homepage": "https://github.com/Accelflow/space-content-sdk#readme",
+  "publishConfig": {
+    "access": "public",
+    "tag": "beta"
+  }
+}

package/toc.css

@@ -0,0 +1,22 @@
+/* Optional marketing-derived responsive theme. Override variables or omit this file. */
+.space-toc { margin: 36px 0 42px; border: 1px solid var(--space-toc-border, #d9e5d8); border-radius: 0; padding: 24px 28px; background: var(--space-toc-background, #f5f9f0); }
+[data-space-toc] > summary { display: flex; align-items: center; justify-content: space-between; margin: 0 0 14px; color: var(--space-toc-color, #26352b); cursor: pointer; font-family: Manrope, sans-serif; font-size: 18px; font-weight: 700; list-style: none; }
+[data-space-toc] > summary::-webkit-details-marker { display: none; }
+[data-space-toc] > summary::after { content: "−"; margin-left: 20px; font-size: 22px; font-weight: 500; line-height: 1; }
+.space-toc:not([open]) { padding-block: 5px; }
+.space-toc:not([open]) > summary { margin-bottom: 0; }
+.space-toc:not([open]) > summary::after { content: "+"; }
+.space-toc ol { display: grid; gap: 8px; margin: 0; padding: 0; list-style: none; counter-reset: blog-toc-h2; }
+.space-toc li { margin: 0; line-height: 1.45; }
+.space-toc li[data-level="2"] { display: grid; grid-template-columns: 1.5em minmax(0, 1fr); column-gap: .45em; align-items: baseline; counter-increment: blog-toc-h2; }
+.space-toc li[data-level="2"]::before { content: counter(blog-toc-h2) ". "; color: #74836f; font-weight: 700; text-align: right; }
+.space-toc li[data-level="3"] { padding-left: 1.25em; font-size: .94em; }
+.space-toc a { color: var(--space-toc-link, #405f31); text-decoration: none; }
+.space-toc a:hover { color: #65a511; text-decoration: underline; }
+@media (max-width: 620px) {
+  .space-toc { position: sticky; top: calc(var(--space-toc-header-height, 64px) + 12px); z-index: 10; padding: 20px; }
+  .space-toc.is-stuck:not([open]) { width: 44px; height: 44px; margin-left: auto; padding: 0; background: #fff; border-radius: 50%; box-shadow: 0 4px 16px rgba(0, 0, 0, .14); }
+  .space-toc.is-stuck:not([open]) > summary { width: 42px; height: 42px; justify-content: center; margin: 0; font-size: 0; }
+  .space-toc.is-stuck:not([open]) > summary::before { content: ""; display: block; flex: 0 0 20px; width: 20px; height: 20px; background: currentColor; -webkit-mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath d='M3 5h2v2H3zM7 5h14v2H7zM3 11h2v2H3zM7 11h14v2H7zM3 17h2v2H3zM7 17h14v2H7z'/%3E%3C/svg%3E") center / contain no-repeat; mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath d='M3 5h2v2H3zM7 5h14v2H7zM3 11h2v2H3zM7 11h14v2H7zM3 17h2v2H3zM7 17h14v2H7z'/%3E%3C/svg%3E") center / contain no-repeat; }
+  .space-toc.is-stuck:not([open]) > summary::after { content: none; margin: 0; }
+}

package/toc.d.mts

@@ -0,0 +1,10 @@
+export type TocHeading = {id: string; text: string; level: number};
+export type TocOptions = {
+  locale?: 'ja' | 'en'; title?: string; maxLevel?: 2 | 3; className?: string;
+  /** Trusted application renderer; escape data if returning custom HTML. */
+  render?: (data: {title: string; entries: (TocHeading & {href: string})[]}) => string;
+  mobileQuery?: string; mobileOpen?: boolean; desktopOpen?: boolean;
+};
+export function isTocTitle(text: string): boolean;
+export function renderTableOfContents(headings: TocHeading[], options?: TocOptions): string;
+export function mountTableOfContents(root: HTMLElement, options?: TocOptions): () => void;

package/toc.mjs

@@ -0,0 +1,52 @@
+/** Framework-independent TOC presentation. Pass trusted CMS HTML to the host
+ * renderer; this module only creates text/fragment links, never executes content. */
+const escape = value => String(value).replace(/[&<>"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
+export const isTocTitle = text => /^(?:目次|table\s+of\s+contents)$/i.test(String(text).replace(/[【】［］\[\]]/g, '').trim());
+export function renderTableOfContents(headings, {locale = 'ja', title = locale === 'en' ? 'Table of contents' : '目次', maxLevel = 3, className = '', render} = {}) {
+  const entries = headings.filter(h => h.level >= 2 && h.level <= maxLevel && h.text.trim() && !isTocTitle(h.text)).map(h => ({...h, href: '#' + encodeURIComponent(h.id)}));
+  if (render) return render({title, entries});
+  return `<details class="space-toc ${escape(className)}" data-space-toc open><summary>${escape(title)}</summary><ol>${entries.map(h => `<li data-level="${h.level}"><a href="${escape(h.href)}">${escape(h.text)}</a></li>`).join('')}</ol></details>`;
+}
+/** Upgrade CMS nav blocks and install responsive behavior. Returns cleanup for
+ * React effects / client navigation. Custom render output must use data-space-toc
+ * on a details element to opt into the standard behavior. */
+export function mountTableOfContents(root, options = {}) {
+  const win = root.ownerDocument.defaultView;
+  const originals = [];
+  for (const nav of root.querySelectorAll('nav[data-table-of-contents]')) {
+    const headings = [...nav.querySelectorAll('a[href^="#"]')].map(a => {
+      const fragment = a.getAttribute('href').slice(1);
+      let id; try { id = decodeURIComponent(fragment); } catch { id = fragment; }
+      return {id, text: a.textContent ?? '', level: Number(a.dataset.level ?? 2)};
+    });
+    const template = root.ownerDocument.createElement('template');
+    template.innerHTML = renderTableOfContents(headings, {maxLevel: Number(nav.dataset.maxLevel) === 2 ? 2 : 3, ...options});
+    const nodes = [...template.content.childNodes];
+    nav.replaceWith(...nodes); originals.push({nav, nodes});
+  }
+  const tocs = [...root.querySelectorAll('details[data-space-toc]')];
+  const media = win.matchMedia(options.mobileQuery ?? '(max-width: 620px)');
+  let frame = null;
+  const sticky = () => {
+    if (frame !== null) return;
+    frame = win.requestAnimationFrame(() => {
+      frame = null;
+      for (const toc of tocs) {
+        const top = parseFloat(win.getComputedStyle(toc).top) || 0;
+        toc.classList.toggle('is-stuck', media.matches && toc.getBoundingClientRect().top <= top + 1);
+      }
+    });
+  };
+  const sync = () => { for (const toc of tocs) toc.open = media.matches ? (options.mobileOpen ?? false) : (options.desktopOpen ?? true); sticky(); };
+  const click = e => {
+    const link = e.target.closest?.('a[href^="#"]');
+    const toc = link?.closest('details[data-space-toc]');
+    if (toc && root.contains(toc) && media.matches) { toc.open = false; sticky(); }
+  };
+  sync(); media.addEventListener('change', sync); win.addEventListener('scroll', sticky, {passive:true}); root.addEventListener('click', click);
+  return () => {
+    media.removeEventListener('change', sync); win.removeEventListener('scroll', sticky); root.removeEventListener('click', click);
+    if (frame !== null) win.cancelAnimationFrame(frame);
+    for (const {nav, nodes} of originals) { if (nodes[0]?.parentNode) nodes[0].before(nav); for (const node of nodes) node.remove(); }
+  };
+}