@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/examples/wiki/routes/pages.js

@@ -0,0 +1,266 @@
+"use strict";
+// Public page routes — landing, group/page lookups, search.
+// Uses b.cache for rendered-HTML cache, b.render.html for SSR,
+// b.template (mounted by createApp), and b.db.prepare for lookups.
+
+var b = require("@blamejs/core");
+var nav = require("../lib/nav");
+var site = require("../site.config");
+
+// Layout-data shape shared by both the per-request render path and the
+// cacheable render path. The cspNonce field is the only thing that
+// differs: live paths get the real nonce, cacheable paths get the
+// framework's stable placeholder (substituted at serve time via
+// b.middleware.cspNonce's substitute helper).
+var DEFAULT_DESCRIPTION =
+  "blamejs — the Node framework that owns its stack. Post-quantum crypto, " +
+  "audit chain, sealed storage, zero npm dependencies.";
+
+function _layoutData(req, ctx, nonce) {
+  var siteUrl = (ctx && ctx.siteUrl) || "https://blamejs.com";
+  var pathname = (req.url || "/").split("?")[0];
+  return {
+    cspNonce:    nonce,
+    locale:      req.locale || "en",
+    dir:         req.dir ? req.dir() : "ltr",
+    user:        req.user || null,
+    csrfToken:   req.csrfToken || "",
+    searchQuery: "",
+    title:       "",
+    assets:      (ctx && ctx.assets) || {},
+    siteUrl:     siteUrl,
+    canonical:   siteUrl + pathname,
+    description: DEFAULT_DESCRIPTION,
+    ogImage:     siteUrl + "/img/blamejs-logo.png",
+    ogType:      "website",
+    // Sidebar nav: data-driven via NAV_GROUPS so the partial renders
+    // a {% for %} loop with <details open> on the section containing
+    // the current page. groupForPath returns null for routes outside
+    // the wiki nav (admin, login, etc.) — every section starts
+    // collapsed in that case.
+    nav:          nav.NAV_GROUPS,
+    currentGroup: nav.groupForPath(pathname),
+    currentPath:  pathname,
+  };
+}
+function _layoutDataLive(req, ctx) {
+  return _layoutData(req, ctx, req.cspNonce || (req.res && req.res.locals && req.res.locals.cspNonce) || "");
+}
+function _layoutDataForCache(req, ctx) {
+  return _layoutData(req, ctx, ctx.nonceMw.PLACEHOLDER);
+}
+
+// Pull a meta-description from a page body — the first <p>..</p>'s
+// text, tags stripped, normalised whitespace, capped at 160 chars
+// (the Google SERP truncation point). Falls back to the site default
+// when the body has no <p>.
+function _synthDescription(body, fallback) {
+  if (typeof body !== "string") return fallback;
+  var m = body.match(/<p[^>]*>([\s\S]*?)<\/p>/i);
+  if (!m) return fallback;
+  var text = m[1].replace(/<[^>]+>/g, "").replace(/&[a-z0-9#]+;/gi, " ").replace(/\s+/g, " ").trim();
+  if (!text) return fallback;
+  var maxLen = b.constants.BYTES.bytes(160);
+  if (text.length > maxLen) text = text.slice(0, maxLen - 3).trimEnd() + "...";
+  return text;
+}
+
+// Specific routes (literal paths, registered FIRST so they match before
+// the /:group catch-all). The catch-all `/:group` would otherwise
+// intercept /login, /admin, /logout, etc. — operator-supplied paths
+// must register between the specifics and the catch-all.
+function registerSpecific(router, ctx) {
+  var db = ctx.db;
+  var template = ctx.template;
+
+  // ---- Landing ----
+  router.get("/", function (req, res) {
+    var data = Object.assign(_layoutDataLive(req, ctx), {
+      title:     "blamejs",
+      homeCards: site.homeCards(),
+    });
+    var html = template.render("home", data);
+    b.render.htmlString(res, html);
+  });
+
+  // /healthz / /readyz / /startupz are handled by b.middleware.health
+  // mounted at the top of the chain; no route registered here.
+
+  // ---- Symbol-index manifest (JSON) ----
+  // The sidebar's autocomplete fetches /symbols.json. The path lives
+  // OUTSIDE /dist/ so the static-serve handler (which is mounted
+  // first in the chain and refuses unknown MIME types by default)
+  // doesn't intercept it. The file is generated at boot by buildApp
+  // into public/dist/symbol-index.json — this route just serves it
+  // with the correct Content-Type.
+  router.get("/symbols.json", function (req, res) {
+    var fs = require("node:fs");
+    var path = require("node:path");
+    var manifestPath = path.join(__dirname, "..", "public", "dist", "symbol-index.json");
+    try {
+      var body = fs.readFileSync(manifestPath, "utf8");
+      res.setHeader("Content-Type", "application/json; charset=utf-8");
+      res.setHeader("Cache-Control", "public, max-age=300");
+      res.end(body);
+    } catch (_e) {
+      res.statusCode = 404;
+      res.setHeader("Content-Type", "application/json");
+      res.end("[]");
+    }
+  });
+
+  // ---- robots.txt ----
+  router.get("/robots.txt", function (req, res) {
+    var siteUrl = ctx.siteUrl || "https://blamejs.com";
+    var body =
+      "User-agent: *\n" +
+      "Allow: /\n" +
+      "Disallow: /admin\n" +
+      "Disallow: /admin/\n" +
+      "Disallow: /login\n" +
+      "Disallow: /logout\n" +
+      "\n" +
+      "Sitemap: " + siteUrl + "/sitemap.xml\n";
+    res.setHeader("Content-Type", "text/plain; charset=utf-8");
+    res.setHeader("Cache-Control", "public, max-age=3600");
+    res.end(body);
+  });
+
+  // ---- sitemap.xml ----
+  router.get("/sitemap.xml", function (req, res) {
+    var siteUrl = ctx.siteUrl || "https://blamejs.com";
+    var rows = db.prepare(
+      "SELECT groupName, slug, updatedAt FROM pages ORDER BY groupName, slug"
+    ).all();
+    var lines = [];
+    lines.push('<?xml version="1.0" encoding="UTF-8"?>');
+    lines.push('<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">');
+    // Home page
+    var homeMod = (rows[0] && rows[0].updatedAt)
+      ? new Date(rows[0].updatedAt).toISOString().slice(0, 10)
+      : new Date().toISOString().slice(0, 10);
+    lines.push("  <url>");
+    lines.push("    <loc>" + siteUrl + "/</loc>");
+    lines.push("    <lastmod>" + homeMod + "</lastmod>");
+    lines.push("    <changefreq>weekly</changefreq>");
+    lines.push("    <priority>1.0</priority>");
+    lines.push("  </url>");
+    rows.forEach(function (r) {
+      // Each group's index is served at /<group>; non-index pages at /<group>/<slug>.
+      var loc = r.slug === "index"
+        ? siteUrl + "/" + r.groupName
+        : siteUrl + "/" + r.groupName + "/" + r.slug;
+      var mod = new Date(r.updatedAt).toISOString().slice(0, 10);
+      lines.push("  <url>");
+      lines.push("    <loc>" + loc + "</loc>");
+      lines.push("    <lastmod>" + mod + "</lastmod>");
+      lines.push("    <changefreq>weekly</changefreq>");
+      lines.push("    <priority>0.8</priority>");
+      lines.push("  </url>");
+    });
+    lines.push("</urlset>");
+    res.setHeader("Content-Type", "application/xml; charset=utf-8");
+    res.setHeader("Cache-Control", "public, max-age=3600");
+    res.end(lines.join("\n"));
+  });
+
+  // ---- Search (FTS5 — operator-side recipe) ----
+  router.get("/search", async function (req, res) {
+    // req.url is a path-relative form (`/search?q=…`); safeUrl.parse
+    // requires an absolute URL, so synthesize a localhost origin before
+    // parsing. The host is discarded — only the query string matters.
+    var url = b.safeUrl.parse("http://localhost" + req.url, {
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+    });
+    var q = (url.searchParams.get("q") || "").trim();
+    var hits = [];
+    if (q.length > 0 && q.length < 200) {
+      try {
+        // FTS5 MATCH; snippet() builds a contextual excerpt around hits.
+        // Operator-supplied query is bound via parameter; FTS5 escapes
+        // its own MATCH grammar, but we still cap length to bound work.
+        hits = db.prepare(
+          "SELECT groupName, slug, title, snippet(pages_fts, 3, '<mark>', '</mark>', '…', 16) AS snippet " +
+          "FROM pages_fts WHERE pages_fts MATCH ? LIMIT 50"
+        ).all(q);
+      } catch (_e) {
+        // FTS5 throws on malformed MATCH expressions (operator typed
+        // raw operators). Fall back to empty hits — user-friendly.
+        hits = [];
+      }
+    }
+    var data = Object.assign(_layoutDataLive(req, ctx), {
+      title:       "Search",
+      searchQuery: q,
+      hits:        hits,
+    });
+    var html = template.render("search", data);
+    b.render.htmlString(res, html);
+  });
+}
+
+// Catch-all routes (parameterized paths). Register LAST after every
+// specific path is in place; the router matches in registration order.
+function registerCatchAll(router, ctx) {
+  var pageCache = ctx.pageCache;
+  var db = ctx.db;
+  var template = ctx.template;
+
+  // ---- Group/page lookup ----
+  // Convention: each group has a landing page stored at slug "index".
+  // /<group>          serves the group's index directly (no redirect).
+  // /<group>/<slug>   serves the named page within the group.
+  // /<group>/index    301-redirects to /<group> so there's one canonical URL.
+  async function _renderPage(req, res, group, slug) {
+    var cacheKey = group + "/" + slug;
+    var html = await pageCache.wrap(cacheKey, async function () {
+      var row = db.prepare(
+        "SELECT groupName, slug, title, body, updatedAt, updatedBy " +
+        "FROM pages WHERE groupName = ? AND slug = ?"
+      ).get(group, slug);
+      if (!row) return null;
+      var base = _layoutDataForCache(req, ctx);
+      var data = Object.assign(base, {
+        title:        row.title,
+        groupName:    row.groupName,
+        slug:         row.slug,
+        body:         row.body,
+        updatedAtIso: new Date(row.updatedAt).toISOString(),
+        updatedBy:    row.updatedBy || "unknown",
+        description:  _synthDescription(row.body, base.description),
+        ogType:       "article",
+      });
+      return template.render("page", data);
+    });
+    if (!html) {
+      return b.render.htmlString(res, "<h1>Not found</h1><p>No such page.</p>", { status: 404 });
+    }
+    b.render.htmlString(res, ctx.nonceMw.substitute(html, req));
+  }
+
+  router.get("/:group", async function (req, res) {
+    var group = req.params.group;
+    if (!/^[a-z0-9-]+$/.test(group)) {
+      return b.render.htmlString(res, "Not found", { status: 404 });
+    }
+    return _renderPage(req, res, group, "index");
+  });
+
+  router.get("/:group/:slug", async function (req, res) {
+    var group = req.params.group;
+    var slug = req.params.slug;
+    if (!/^[a-z0-9-]+$/.test(group) || !/^[a-z0-9-]+$/.test(slug)) {
+      return b.render.htmlString(res, "Not found", { status: 404 });
+    }
+    // Canonicalize: /<group>/index permanently redirects to /<group>.
+    if (slug === "index") {
+      return b.render.redirect(res, "/" + group, { status: 301 });
+    }
+    return _renderPage(req, res, group, slug);
+  });
+}
+
+module.exports = {
+  registerSpecific: registerSpecific,
+  registerCatchAll: registerCatchAll,
+};

package/lib/vendor/blamejs/examples/wiki/scripts/backfill-module-metadata.js

@@ -0,0 +1,214 @@
+"use strict";
+// backfill-module-metadata - one-shot script to add @nav / @title /
+// @card lines to every @module block in lib/ that's missing them.
+//
+// Strategy:
+//   - Walk lib/ for files with `@module b.X` blocks.
+//   - For each module, look up its namespace in NAV_HINTS to get a
+//     @nav group; derive a @title from a humanizer + override table;
+//     derive a @card description from the first sentence of the
+//     existing @intro block.
+//   - Edit the source file in-place: insert @nav / @title above the
+//     @intro block; append @card last.
+//
+// Run: node examples/wiki/scripts/backfill-module-metadata.js
+// Run with --dry-run to print what would change without writing.
+
+var fs   = require("node:fs");
+var path = require("node:path");
+
+var REPO_ROOT = path.join(__dirname, "..", "..", "..");
+var LIB_DIR   = path.join(REPO_ROOT, "lib");
+var DRY       = process.argv.indexOf("--dry-run") !== -1;
+
+var NAV_HINTS = {
+  db: "Data", externalDb: "Data", storage: "Data", objectStore: "Data",
+  queue: "Data", cache: "Data", session: "Data", atomicFile: "Data",
+  auth: "Identity", permissions: "Identity", apiKey: "Identity",
+  breakGlass: "Identity", dualControl: "Identity", subject: "Identity",
+  consent: "Identity", credentialHash: "Identity", honeytoken: "Identity",
+  authBotChallenge: "Identity",
+  crypto: "Crypto", vault: "Crypto", cryptoField: "Crypto",
+  pqcGate: "Crypto", pqcAgent: "Crypto", pqcSoftware: "Crypto",
+  mtlsCa: "Crypto", tlsExporter: "Crypto", auditSign: "Crypto",
+  keychain: "Crypto",
+  router: "HTTP", middleware: "HTTP", httpClient: "HTTP",
+  websocket: "HTTP", websocketChannels: "HTTP", sse: "HTTP",
+  webhook: "Communication", render: "HTTP", staticServe: "HTTP",
+  template: "HTTP", errorPage: "HTTP", forms: "HTTP",
+  fileUpload: "HTTP", ssrfGuard: "HTTP", requestHelpers: "HTTP",
+  cookies: "HTTP", authHeader: "HTTP",
+  safeJson: "Validation", safeBuffer: "Validation", safeUrl: "Validation",
+  safeSql: "Validation", safeSchema: "Validation", safeRedirect: "Validation",
+  safeAsync: "Validation", safeJsonpath: "Validation", safeEnv: "Validation",
+  parsers: "Validation", fileType: "Validation",
+  csv: "Tools", uuid: "Tools", slug: "Tools", time: "Tools",
+  archive: "Tools", pagination: "Tools", i18n: "Tools",
+  format: "Tools", config: "Tools", flag: "Tools",
+  htmlBalance: "Tools", bundler: "Tools", dev: "Tools",
+  mail: "Communication", mailBounce: "Communication",
+  notify: "Communication", pubsub: "Communication", cloudEvents: "Communication",
+  compliance: "Compliance", retention: "Compliance", legalHold: "Compliance",
+  dsr: "Compliance", incident: "Compliance",
+  dora: "Compliance", nis2: "Compliance", cra: "Compliance",
+  fapi2: "Compliance", fdx: "Compliance", secCyber: "Compliance",
+  iabTcf: "Compliance", iabMspa: "Compliance", darkPatterns: "Compliance",
+  fda21cfr11: "Compliance", tcpa10dlc: "Compliance",
+  auditDailyReview: "Compliance", ddlChangeControl: "Compliance",
+  drRunbook: "Compliance",
+  audit: "Observability", metrics: "Observability", tracing: "Observability",
+  log: "Observability", logStream: "Observability", redact: "Observability",
+  otelExport: "Observability", observability: "Observability",
+  testing: "Observability", configDrift: "Observability",
+  auditChain: "Observability", auditTools: "Observability",
+  chainWriter: "Observability",
+  cluster: "Production", scheduler: "Production", jobs: "Production",
+  backup: "Production", restore: "Production",
+  resourceAccessLock: "Production", outbox: "Production", inbox: "Production",
+  clusterStorage: "Production", deprecate: "Production",
+  ntpCheck: "Production", restoreBundle: "Production",
+  budr: "Production", cliHelpers: "Production", appShutdown: "Production",
+  retry: "Production", selfUpdate: "Production", tenantQuota: "Production",
+  argParser: "Production", circuitBreaker: "Production",
+  daemon: "Production", processSpawn: "Production", frameworkSchema: "Production",
+  network: "Network", acme: "Network",
+  guardCsv: "Guards", guardHtml: "Guards", guardSvg: "Guards",
+  guardJson: "Guards", guardYaml: "Guards", guardXml: "Guards",
+  guardMarkdown: "Guards", guardEmail: "Guards", guardArchive: "Guards",
+  guardImage: "Guards", guardPdf: "Guards", guardJwt: "Guards",
+  guardOauth: "Guards", guardGraphql: "Guards", guardShell: "Guards",
+  guardRegex: "Guards", guardJsonpath: "Guards", guardTemplate: "Guards",
+  guardFilename: "Guards", guardDomain: "Guards", guardUuid: "Guards",
+  guardCidr: "Guards", guardTime: "Guards", guardMime: "Guards",
+  guardAuth: "Guards", guardAll: "Guards", gateContract: "Guards",
+  mcp: "AI", a2a: "AI", graphqlFederation: "AI", aiPref: "AI",
+  contentCredentials: "AI",
+};
+
+function _humanizeTitle(ns) {
+  var spaced = ns.replace(/[A-Z]/g, function (c) { return " " + c; }).replace(/^\s/, "");
+  return spaced.replace(/\b\w/g, function (c) { return c.toUpperCase(); });
+}
+
+var TITLE_OVERRIDES = {
+  csv: "CSV", uuid: "UUID", slug: "Slug",
+  i18n: "i18n", html: "HTML", url: "URL", json: "JSON", xml: "XML",
+  acme: "ACME", mcp: "Model Context Protocol", a2a: "Agent-to-Agent",
+  ai: "AI", iabTcf: "IAB TCF", iabMspa: "IAB MSPA",
+  fapi2: "FAPI 2.0", fdx: "FDX", dora: "DORA", gdpr: "GDPR", hipaa: "HIPAA",
+  ntpCheck: "NTP Check", apiKey: "API Keys", apiSnapshot: "API Snapshot",
+  budr: "BC/DR", drRunbook: "DR Runbook", mtlsCa: "mTLS CA",
+  pqcSoftware: "PQC Software", tlsExporter: "TLS Exporter",
+  ssrfGuard: "SSRF Guard", cliHelpers: "CLI Helpers", argParser: "Arg Parser",
+  authHeader: "Auth Headers", authBotChallenge: "Auth Bot Challenge",
+  ddlChangeControl: "DDL Change Control", chainWriter: "Chain Writer",
+  auditDailyReview: "Audit Daily Review", auditChain: "Audit Chain Primitives",
+  auditTools: "Audit Tools", auditSign: "Audit Signing",
+  cryptoField: "Field-Level Crypto", clusterStorage: "Cluster Storage",
+  configDrift: "Config Drift", contentCredentials: "Content Credentials",
+  darkPatterns: "Dark Patterns", graphqlFederation: "GraphQL Federation",
+  htmlBalance: "HTML Balance",
+  logStream: "Log Stream", restoreRollback: "Restore Rollback",
+  restoreBundle: "Restore Bundle", processSpawn: "Process Spawn",
+  frameworkSchema: "Framework Schema", mailBounce: "Mail Bounce",
+  cloudEvents: "CloudEvents", appShutdown: "App Shutdown",
+  selfUpdate: "Self Update", tenantQuota: "Tenant Quota",
+  circuitBreaker: "Circuit Breaker", externalDb: "External Database",
+  atomicFile: "Atomic File", breakGlass: "Break Glass",
+  credentialHash: "Credential Hash", requestHelpers: "Request Helpers",
+  fileUpload: "File Upload", fileType: "File Type",
+};
+
+function _firstSentence(intro) {
+  if (!intro) return "";
+  var s = intro.replace(/\n/g, " ").replace(/\s+/g, " ").replace(/^\s+|\s+$/g, "");
+  var dot = s.indexOf(". ");
+  if (dot !== -1 && dot < 280) return s.slice(0, dot + 1);
+  if (s.length > 280) return s.slice(0, 277) + "...";
+  return s;
+}
+
+function _processFile(file) {
+  var src = fs.readFileSync(file, "utf8");
+  var blockRe = /\/\*\*([\s\S]*?)\*\//g;
+  var m;
+  var changed = false;
+  var summary = [];
+  while ((m = blockRe.exec(src)) !== null) {
+    var body = m[1];
+    if (!/@module\s+b\./.test(body)) continue;
+    var nsMatch = body.match(/@module\s+b\.([a-zA-Z0-9_]+)/);
+    if (!nsMatch) continue;
+    var ns = nsMatch[1];
+    var nav = NAV_HINTS[ns] || "Other";
+    var title = TITLE_OVERRIDES[ns] || _humanizeTitle(ns);
+    var hasNav   = /\n\s*\*\s*@nav\b/.test(body);
+    var hasTitle = /\n\s*\*\s*@title\b/.test(body);
+    var hasCard  = /\n\s*\*\s*@card\b/.test(body);
+    if (hasNav && hasTitle && hasCard) continue;
+    var introMatch = body.match(/\n\s*\*\s*@intro\s*\n([\s\S]*?)(?=\n\s*\*\s*@\w|\*\/|$)/);
+    var introBody = introMatch ? introMatch[1].split("\n").map(function (l) {
+      return l.replace(/^\s*\*\s?/, "");
+    }).join("\n").replace(/^\s+|\s+$/g, "") : "";
+    var card = _firstSentence(introBody);
+    var moduleLineRe = /(\n)(\s*\*\s*@module\s+b\.[a-zA-Z0-9_]+)([^\n]*)/;
+    var insertion = "";
+    if (!hasNav)   insertion += "\n * @nav    " + nav;
+    if (!hasTitle) insertion += "\n * @title  " + title;
+    var newBody = body.replace(moduleLineRe, function (_a, lf, line, rest) {
+      return lf + line + rest + insertion;
+    });
+    if (!hasCard && card) {
+      var trimmed = newBody.replace(/\s+$/, "");
+      var cardBlock = "\n *\n * @card\n *   " + card;
+      newBody = trimmed + cardBlock + "\n ";
+    }
+    if (newBody !== body) {
+      src = src.slice(0, m.index + 3) + newBody + src.slice(m.index + 3 + body.length);
+      changed = true;
+      summary.push({ ns: ns, file: path.relative(REPO_ROOT, file), addedNav: !hasNav, addedTitle: !hasTitle, addedCard: !hasCard });
+      blockRe.lastIndex = m.index + 3 + newBody.length;
+    }
+  }
+  if (changed && !DRY) fs.writeFileSync(file, src);
+  return summary;
+}
+
+function _walk(dir, out) {
+  var entries;
+  try { entries = fs.readdirSync(dir); } catch (_e) { return; }
+  entries.forEach(function (name) {
+    if (name === "vendor" || name === "node_modules") return;
+    var full = path.join(dir, name);
+    var stat;
+    try { stat = fs.statSync(full); } catch (_e) { return; }
+    if (stat.isDirectory()) { _walk(full, out); return; }
+    if (!/\.js$/.test(name)) return;
+    out.push(full);
+  });
+}
+
+if (require.main === module) {
+  var files = [];
+  _walk(LIB_DIR, files);
+  var totalEdits = 0;
+  var perFile = [];
+  files.forEach(function (f) {
+    var summary = _processFile(f);
+    if (summary.length > 0) {
+      totalEdits += summary.length;
+      perFile.push.apply(perFile, summary);
+    }
+  });
+  console.log("[backfill-module-metadata] " + (DRY ? "DRY-RUN - would update " : "updated ") + totalEdits + " @module blocks");
+  perFile.slice(0, 30).forEach(function (s) {
+    var added = [];
+    if (s.addedNav)   added.push("@nav");
+    if (s.addedTitle) added.push("@title");
+    if (s.addedCard)  added.push("@card");
+    console.log("  " + s.file + " :: b." + s.ns + " - added " + added.join(" + "));
+  });
+  if (perFile.length > 30) console.log("  ... " + (perFile.length - 30) + " more");
+}
+
+module.exports = { NAV_HINTS: NAV_HINTS, TITLE_OVERRIDES: TITLE_OVERRIDES };

package/lib/vendor/blamejs/examples/wiki/seeders/prod/0001-default-pages.js

@@ -0,0 +1,35 @@
+"use strict";
+
+// Default wiki content. Per-page bodies live under ./pages/ — one file
+// per page, each exporting { slug, title, body }. The ordered list at
+// ./pages/_index.js drives both the seeder loop and the home-page nav
+// (the latter via examples/wiki/views/home.html, which is hand-edited
+// to match — adding a new page touches both files).
+
+var PAGES = require("./pages/_index");
+
+module.exports = {
+  description: "Default wiki content",
+  envs:        ["prod", "dev"],
+  rerunnable:  true,
+  run: async function (db, ctx) {
+    var now = ctx.clock();
+    for (var i = 0; i < PAGES.length; i++) {
+      var p = PAGES[i];
+      db.prepare(
+        "INSERT INTO pages (groupName, slug, title, body, updatedAt, updatedBy) " +
+        "VALUES (?, ?, ?, ?, ?, ?) " +
+        "ON CONFLICT (groupName, slug) DO UPDATE SET " +
+        "  title = excluded.title, body = excluded.body, " +
+        "  updatedAt = excluded.updatedAt, updatedBy = excluded.updatedBy"
+      ).run(
+        p.slug,             // groupName === slug for landing pages
+        "index",
+        p.title,
+        p.body,
+        now,
+        "seeder"
+      );
+    }
+  },
+};

package/lib/vendor/blamejs/examples/wiki/seeders/prod/pages/_index.js

@@ -0,0 +1,34 @@
+"use strict";
+// Ordered list of wiki pages.
+//
+// Hand-authored seeders have been removed. The wiki is now driven
+// entirely by:
+//   1. ./api.js         — auto-generated symbol index (require'd
+//                         here so it lands first and can harvest
+//                         every other page's body)
+//   2. _generatedPages() — every entry in examples/wiki/wiki.config.js
+//                          (which itself derives from
+//                          examples/wiki/site.config.js).
+//
+// Adding a new page is one edit to site.config.js. The validators
+// (validate-site-coverage / validate-source-comment-blocks /
+// validate-nav-coverage) gate every consistency invariant.
+
+var path = require("node:path");
+var pageGenerator = require("../../../lib/page-generator");
+var curation = require("../../../wiki.config");
+var LIB_DIR = path.join(__dirname, "..", "..", "..", "..", "..", "lib");
+
+function _generatedPages() {
+  try {
+    return pageGenerator.generateAll(curation, LIB_DIR);
+  } catch (e) {
+     
+    console.warn("[seeders] page-generator failed:", e && e.message);
+    return [];
+  }
+}
+
+module.exports = [
+  require("./" + "api"),
+].concat(_generatedPages());

package/lib/vendor/blamejs/examples/wiki/seeders/prod/pages/api.js

@@ -0,0 +1,76 @@
+"use strict";
+// Auto-generated API index. The body is built at seeder-load time by
+// walking every other page's body for primitive headings via
+// lib/symbol-index. Page seeders are loaded in order, so this file
+// imports the rest of the seeder list (minus itself) before computing.
+//
+// The page renders: a one-line summary, an alphabetical primitive
+// table grouped by namespace, and a JSON snapshot accessible at
+// /dist/symbol-index.json (written by buildApp at boot).
+
+var symbolIndex = require("../../../lib/symbol-index");
+
+// Lazy-load every other seeder. require() the index module so we get
+// the same array routes/seeders use; filter ourselves out so we don't
+// recursively try to harvest our own (empty) signatures.
+function _harvest() {
+  var allPages = require("./_index");
+  var others = allPages.filter(function (p) { return p && p.slug !== "api"; });
+  return symbolIndex.build(others);
+}
+
+function _renderBody() {
+  var manifest = _harvest();
+  var groups = symbolIndex.groupByNamespace(manifest);
+  var nsList = Object.keys(groups).sort();
+
+  var lines = [
+    '<h1>API index</h1>',
+    '<p>Every operator-facing primitive documented in this wiki, alphabetical by namespace. Use the search box in the sidebar (or <kbd>/</kbd> + start typing) for fuzzy autocomplete.</p>',
+    '<p class="muted">Auto-generated from <code>&lt;h2&gt;</code> / <code>&lt;h3&gt;</code> headings on every wiki page. ' + manifest.length + ' primitives across ' + nsList.length + ' namespaces.</p>',
+    '<aside class="callout callout-tip">',
+    '<p class="callout-title">JSON manifest</p>',
+    '<p>The same data is served as JSON at <code><a href="/symbols.json">/symbols.json</a></code> for tooling that wants to consume the index programmatically.</p>',
+    '</aside>',
+  ];
+
+  for (var i = 0; i < nsList.length; i++) {
+    var ns = nsList[i];
+    var entries = groups[ns];
+    lines.push('<h2 id="ns-' + ns + '">b.' + ns + '</h2>');
+    lines.push('<table>');
+    lines.push('<thead><tr><th>Primitive</th><th>Documented in</th></tr></thead>');
+    lines.push('<tbody>');
+    for (var j = 0; j < entries.length; j++) {
+      var e = entries[j];
+      lines.push(
+        '<tr>' +
+        '<td><a href="/' + e.page + '#' + e.anchor + '"><code>' + e.sigBare + '</code></a></td>' +
+        '<td><a href="/' + e.page + '">' + e.title + '</a></td>' +
+        '</tr>'
+      );
+    }
+    lines.push('</tbody>');
+    lines.push('</table>');
+  }
+  return lines.join("\n");
+}
+
+// Compute body lazily — _index.js requires every page module; api.js
+// is in that same require()-on-load chain. Resolving symbol harvest
+// at module-load time would create a circular dependency. Instead, the
+// migrations seeder calls the body function at seed time (post all
+// modules loaded). Page consumers (route handler) read .body as a
+// string directly from the DB column the migrations populate.
+//
+// To keep the contract identical to other pages — { slug, title, body:string } —
+// we expose body as a getter that materializes on first access.
+var _bodyCache = null;
+module.exports = {
+  slug:  "api",
+  title: "API index",
+  get body() {
+    if (_bodyCache === null) _bodyCache = _renderBody();
+    return _bodyCache;
+  },
+};