@panaversity/ksor 0.0.27 → 0.0.29

package/templates/scaffold/.claude/skills/format-checker/check.mjs

@@ -35,6 +35,35 @@ const REQUIRED_KEYS = ["title", "status"]; // level 0 — the ladder, not a gate
 const STATUS_VALUES = new Set(["draft", "review", "approved", "superseded"]);
 const ASSET_EXTENSIONS = new Set([".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp"]);
 
+// Study attachments: `x.summary.md` and `x.flashcards.yaml` belong to `x.md`.
+// An attachment is PART OF its parent — no route, no stable id, no governance
+// of its own — so it is neither a document nor an asset, and gets its own
+// rules below. This mirrors packages/content/src/lib/attachment-rule.ts, which
+// this dependency-free file cannot import; ATTACHMENT_CASES there is the table
+// both are held to.
+const ATTACHMENT_SUFFIXES = [".summary.md", ".summary.mdx", ".flashcards.yaml"];
+// One character off a real attachment, refused BY NAME: `.yml` reaches the
+// site bundler's `Unknown file type` throw, which names the path and nothing
+// about the rule.
+const ATTACHMENT_NEAR_MISSES = [
+  [".flashcards.yml", ".flashcards.yaml"],
+  [".flashcards.json", ".flashcards.yaml"],
+  [".summary.markdown", ".summary.md"],
+];
+
+/** The attachment suffix this name carries, or null. A dotfile has no stem. */
+function attachmentSuffixOf(base) {
+  return ATTACHMENT_SUFFIXES.find((s) => base.length > s.length && base.endsWith(s)) ?? null;
+}
+function isAttachment(base) {
+  return attachmentSuffixOf(base) !== null;
+}
+/** The document an attachment belongs to: always `<stem>.md`. */
+function parentDocumentOf(base) {
+  const suffix = attachmentSuffixOf(base);
+  return suffix === null ? null : `${base.slice(0, -suffix.length)}.md`;
+}
+
 // PNG integrity, dependency-free: signature + per-chunk CRC-32. A damaged
 // image beside a document is a check-time problem with the file named, never
 // a build-time 500 with no filename in it.
@@ -381,7 +410,9 @@ if (!existsSync(knowledgeDir)) {
   }
   const dirs = walkDirs(knowledgeDir);
   const all = [...files, ...dirs];
-  const mdFiles = files.filter((p) => p.endsWith(".md"));
+  // Attachments are never documents: they carry no frontmatter, own no route,
+  // and are checked by their own rules instead.
+  const mdFiles = files.filter((p) => p.endsWith(".md") && !isAttachment(path.basename(p)));
 
   if (mdFiles.length === 0) {
     problem(
@@ -446,7 +477,12 @@ if (!existsSync(knowledgeDir)) {
       );
     }
     seenLower.set(lower, rel);
-    if (files.includes(p) && !p.endsWith(".md") && !ASSET_EXTENSIONS.has(path.extname(p))) {
+    if (
+      files.includes(p) &&
+      !p.endsWith(".md") &&
+      !isAttachment(base) &&
+      !ASSET_EXTENSIONS.has(path.extname(p))
+    ) {
       problem(
         rel,
         `unexpected file type "${path.extname(p) || base}"`,
@@ -486,6 +522,51 @@ if (!existsSync(knowledgeDir)) {
     }
   }
 
+  // Study attachments: bound to a parent, carrying no governance of their own.
+  for (const p of files) {
+    const base = path.basename(p);
+    const rel = path.relative(root, p);
+
+    const nearMiss = ATTACHMENT_NEAR_MISSES.find(
+      ([wrong]) => base.length > wrong.length && base.endsWith(wrong),
+    );
+    if (nearMiss && !isAttachment(base)) {
+      problem(
+        rel,
+        `${nearMiss[0]} is not an attachment extension`,
+        "the site reads decks as YAML and accepts only .yaml — a near miss is not picked up as a deck, and fails the build naming the path but not the rule",
+        `rename it to ${base.slice(0, -nearMiss[0].length)}${nearMiss[1]}`,
+      );
+      continue;
+    }
+
+    if (!isAttachment(base)) continue;
+
+    const parent = parentDocumentOf(base);
+    if (parent && !existsSync(path.join(path.dirname(p), parent))) {
+      problem(
+        rel,
+        `attachment of ${parent}, which is not in the record`,
+        "an attachment inherits its parent's governance — with no parent there is nothing to inherit, so it would be published under no tier and covered by no takedown",
+        `add ${path.join(path.dirname(rel), parent)}, or remove ${rel}`,
+      );
+    }
+
+    if (base.endsWith(".md") || base.endsWith(".mdx")) {
+      const text = readFileSync(p, "utf8")
+        .replace(/^\uFEFF/, "")
+        .replaceAll("\r\n", "\n");
+      if (text.startsWith("---\n")) {
+        problem(
+          rel,
+          "attachment declares frontmatter",
+          "an attachment is part of its parent and carries none of its own governance — a key here would look like it governs something and would govern nothing (a visibility: on a summary of a restricted document is the shape that matters)",
+          `remove the frontmatter block; ${parent ?? "its parent"} is what carries the governance`,
+        );
+      }
+    }
+  }
+
   // foo.md vs foo/index.md route collisions
   for (const p of mdFiles) {
     const sibling = p.replace(/\.md$/, "");

package/templates/scaffold/AGENTS.md

@@ -96,7 +96,7 @@ Stand it up in this order (each step's errors explain how to fix themselves):
    - `KSOR_DB_URL` — the Postgres store named by `instance.md`'s `dsn_env`. It
      needs the pgvector extension: `CREATE EXTENSION vector;`
    - `GEMINI_API_KEY` — the embedding provider key.
-   - `KSOR_AUTH_DISABLED=1` — **required for a local run.** `ksor serve`
+   - `KSOR_AUTH=disabled-local` — **required for a local run.** `ksor serve`
      refuses to boot unauthenticated without it, deliberately, so a server is
      never left open by accident. It binds loopback, where auth off is the
      intended dev shape. A PUBLIC deployment configures the SSO door instead —
@@ -228,11 +228,11 @@ abandoned ones.
 ### Serving safely (fail-closed posture)
 
 `pnpm serve` **refuses to boot unauthenticated** — there is no auth-off
-default. A local run says so deliberately with `KSOR_AUTH_DISABLED=1` and binds
+default. A local run says so deliberately with `KSOR_AUTH=disabled-local` and binds
 loopback, which is the intended dev shape. A **public**
 bind refuses to boot unless auth is configured (`KSOR_SSO_URL` +
 `KSOR_MCP_RESOURCE_URL` + `KSOR_JWT_ALLOWED_AUDIENCES`, making it an OAuth
-Resource Server) OR you deliberately set `KSOR_ALLOW_PUBLIC_UNAUTHENTICATED=1`.
+Resource Server) OR you deliberately set `KSOR_AUTH=disabled-public`.
 Never let a dropped auth variable silently ship an open door. On a non-loopback
 bind, set `KSOR_ALLOWED_HOSTS` / `KSOR_ALLOWED_ORIGINS`; on more than one
 replica, set a shared `KSOR_SNAPSHOT_KEYS` (unset ⇒ a per-process key, so a
@@ -240,7 +240,7 @@ search token minted by one replica fails on another).
 
 Three things worth being deliberate about:
 
-- **`KSOR_ALLOW_PUBLIC_UNAUTHENTICATED=1` serves your whole record to anyone
+- **`KSOR_AUTH=disabled-public` serves your whole record to anyone
   who can reach the port.** It exists for deployments fronted by your own
   gateway or network policy. If nothing else is in front, do not set it.
 - **Set `KSOR_SSO_ISSUER` when your SSO stamps a stable `iss`.** Audience is
@@ -261,7 +261,7 @@ Once the SSO door is configured (the three variables above), the server is an
 OAuth **Resource Server**, which means a client is not told the authorization
 server — it discovers it. Nothing here needs configuring beyond those variables;
 this is what your agents will experience, and what to check when one cannot
-connect. With `KSOR_AUTH_DISABLED=1` — the local default `.env.example` ships —
+connect. With `KSOR_AUTH=disabled-local` — the local default `.env.example` ships —
 none of it applies: there is no challenge and the metadata document answers 404,
 because there is no authorization server to point at.
 
@@ -448,6 +448,12 @@ CI — and a first deploy without it serves an empty record. Full walkthrough:
   publishes that as fact) and `superseded` (a legacy marker — prefer `status`)
   are available. No other keys; never
   `id:` or `name:` — the path is the identity.
+- **Each page says how long it takes to read**, just above the body, counted from the
+  document's own words when the site is built. Fenced code and frontmatter do
+  not count toward it, so a short page carrying a long example is not reported
+  as a long read. Nothing to author — it is derived. A document with a summary
+  shows the figure on both tabs, so a reader can see at a glance how much the
+  summary saves them.
 - **The governance keys are rendered, so they are worth filling in.** Each
   page shows its owner and effective date under the title, lists every
   `provenance` entry separately at the foot, and — for a superseded document —
@@ -500,6 +506,49 @@ CI — and a first deploy without it serves an empty record. Full walkthrough:
   refused.
 - Images and assets live in `knowledge/` beside the document that uses them,
   referenced by relative links. A relative link must never leave `knowledge/`.
+- **Study attachments.** A document may carry two optional companions named
+  after it, in the same folder: `<doc>.summary.md` (a short précis) and
+  `<doc>.flashcards.yaml` (a recall deck). The summary appears as a second tab
+  beside the document's own words; the deck appears at the END of that
+  document's page. Both appear nowhere else in the site.
+
+  An attachment is **part of its document**, not a document. It has no URL of
+  its own, no sidebar row, no line in `llms.txt`, and no identity an agent can
+  cite — so it carries **no frontmatter at all** (the checker refuses any), and
+  it takes its `visibility:` and any takedown from its parent. Restrict the
+  document and its summary and deck go with it; there is no way to publish a
+  summary more widely than the document it summarises. An attachment whose
+  document is missing is refused, by `pnpm check` and by `pnpm build` alike.
+
+  A deck is YAML, and the extension is exactly `.flashcards.yaml` — `.yml` is
+  refused by name:
+
+  ```yaml
+  deck:
+    title: Expense approvals
+    description: Recall checks for the approvals policy.
+  cards:
+    - front: Who approves a purchase above the threshold?
+      back: A second approver, independent of the requester.
+      why: Optional — a prompt shown before the answer.
+  ```
+
+  No `id:` anywhere, on the deck or a card: the path is the deck's identity,
+  and a card's identity is its own text. Edit a card and only that card's
+  review progress starts again; the rest is untouched.
+
+  **A card may only say what its document says.** The summary and the deck are
+  ways of rehearsing the record, never a second source — a card asserting
+  something its document does not is a claim nothing governs and no agent can
+  cite. Ask your coding agent to write them from a document and to check every
+  answer back against it.
+
+  Review scheduling uses a simple interval ladder (an SM-2 variant): a missed
+  card returns in about a minute, a recalled card's interval grows by roughly
+  2.5x each time. It is not FSRS and makes no retention guarantee. Progress is
+  kept in the reader's own browser, so it is per-person and per-device, and it
+  is not part of the record.
+
 - Copy load-bearing values (numbers, thresholds, dates) exactly from their
   source, and name the source in `provenance`.
 

package/templates/scaffold/README.md

@@ -5,8 +5,9 @@ project's people and AI agents operate from.
 
 Two worlds live here:
 
-- **`knowledge/` — the record.** Plain governed markdown. Yours forever,
-  readable anywhere, portable without this repository's code.
+- **`knowledge/` — the record.** Plain governed markdown (plus the optional
+  study attachments a document may carry). Yours forever, readable anywhere,
+  portable without this repository's code.
 - **`system/` — the system.** The site (and later, services) that serve the
   record. Replaceable machinery.
 
@@ -30,13 +31,13 @@ Postgres store (with pgvector) and an embedding provider key, so it is not
 part of `pnpm dev`. The ordered path is:
 
 ```sh
-cp .env.example .env    # fill in KSOR_DB_URL, GEMINI_API_KEY, KSOR_AUTH_DISABLED=1
+cp .env.example .env    # fill in KSOR_DB_URL, GEMINI_API_KEY, KSOR_AUTH=disabled-local
 pnpm provision         # once: apply the schema, authorize ingest
 pnpm refresh           # ingest the record, collect retired generations
 pnpm serve             # the MCP server
 ```
 
-`ksor` reads `.env` automatically — nothing to export. `KSOR_AUTH_DISABLED=1`
+`ksor` reads `.env` automatically — nothing to export. `KSOR_AUTH=disabled-local`
 is required for a local run: serve refuses to boot unauthenticated on purpose,
 so a server is never open by accident.
 
@@ -55,7 +56,7 @@ effect of starting a process. A rerun on an unchanged record
 costs nothing: no new generation, no embedding, no rows. Edit a document and
 the next run picks up exactly that change. `AGENTS.md` → "Serving to agents" is the
 full runbook; your coding agent reads it first. `pnpm serve` refuses to boot
-unauthenticated: a local run declares `KSOR_AUTH_DISABLED=1` (already in
+unauthenticated: a local run declares `KSOR_AUTH=disabled-local` (already in
 `.env.example`) and binds loopback, so a server is never left open by accident;
 a public bind needs a configured SSO door instead. Any other operation is
 `pnpm exec ksor <verb>`.

package/templates/scaffold/env.example

@@ -12,11 +12,23 @@ KSOR_DB_URL=postgresql://user:password@host:5432/dbname
 # The embedding provider key. instance.md defaults to gemini-embedding-001.
 GEMINI_API_KEY=
 
-# Local development posture. `ksor serve` REFUSES to boot unauthenticated
-# without this — deliberately, so a server is never open by accident. It binds
-# loopback, where auth off is the intended dev shape.
+# ── Who may ask ─────────────────────────────────────────────────────────────
+# ONE variable, and its VALUE is the decision. `ksor serve` refuses to boot
+# without either this or a configured SSO door — a server is never open by
+# accident.
 #
-# For a PUBLIC deployment, delete this line and configure the SSO door instead:
+#   disabled-local   no auth, loopback only. A PUBLIC bind REFUSES, so copying
+#                    this file into a hosting dashboard cannot quietly open your
+#                    record to the internet. This is the dev posture.
+#   disabled-public  no auth, and serve the whole record to anyone who can reach
+#                    the port. A deliberate choice, correct for a genuinely
+#                    public record or behind your own gateway. NOT a way to make
+#                    a deploy go green.
+#
+# A container sets $PORT, so the door binds 0.0.0.0 — that is a public bind, and
+# `disabled-local` will refuse there. That refusal is the point.
+#
+# For a real deployment, delete this line and configure the SSO door instead:
 #   KSOR_SSO_URL=https://your-sso.example.com
 #   KSOR_MCP_RESOURCE_URL=https://your-host.example.com/mcp
 #   KSOR_JWT_ALLOWED_AUDIENCES=https://your-host.example.com/mcp
@@ -27,15 +39,19 @@ GEMINI_API_KEY=
 # answered and where the keys came from.
 # Set this only to override discovery, or when your SSO publishes no metadata:
 #   KSOR_JWKS_URL=https://your-sso.example.com/.well-known/jwks.json
-# Serving a public bind with auth off additionally requires
-# KSOR_ALLOW_PUBLIC_UNAUTHENTICATED=1, which serves your whole record to anyone
-# who can reach the port.
-KSOR_AUTH_DISABLED=1
+KSOR_AUTH=disabled-local
 
 # ── Production knobs ────────────────────────────────────────────────────────
 # Unset is fine for a local run; each one matters once this serves for real.
 
 # Snapshot-token signing keys, "kid=secret[,kid2=secret2]" (first is active).
+# SET THIS ON ANY CONTAINER HOST. Unset mints an EPHEMERAL per-process key, so a
+# generation pin issued by one instance is unverifiable by the next: `read`
+# silently drops to the active generation and reports "refreshed (invalid)".
+# It fails SOFT, so nothing errors and nothing logs — the only symptom is an
+# agent reading a generation it did not search. Generate one with
+# `openssl rand -hex 32`; the secret is used as literal text, never hex-decoded,
+# and must be IDENTICAL across every replica.
 # WITHOUT this the key is generated per PROCESS. Two deployments need it, not
 # just one: any MULTI-REPLICA deploy (a token minted by one replica is refused
 # by another), and any SCALE-TO-ZERO host, where a single replica mints a new

package/templates/scaffold/knowledge/what-is-a-ksor.flashcards.yaml

@@ -0,0 +1,25 @@
+# A recall deck for what-is-a-ksor.md.
+#
+# Every card states only what its parent document states — a deck is a way of
+# rehearsing the record, never a second source. Ask your coding agent to write
+# one of these from a document, and to check each answer against it.
+deck:
+  title: What a KSoR is
+  description: Recall checks for the record's own definition of itself.
+cards:
+  - front: When a spreadsheet disagrees with the ledger, which one wins?
+    back: The ledger. A system of record is the copy that governs.
+    why: Which copy would your organization's agents trust today?
+
+  - front: A traditional system of record settles the state of a business. What does a KSoR settle?
+    back: What the organization knows and how it should operate — which policies apply, which thresholds are approved, what a term means here.
+
+  - front: What problem does a KSoR solve?
+    back: Scatter. Knowledge spread across wikis, decks, PDFs, prompts and someone's memory, with no authoritative answer to which knowledge an agent should trust.
+
+  - front: Why can an assistant not tell you which of its sentences were checked?
+    back: Because it answers from everything it has ever read. Nothing in that process distinguishes a checked claim from an unchecked one.
+    why: This is the gap the record exists to close.
+
+  - front: Does provenance prove that a document is correct?
+    back: No. Provenance proves who said what, and when. Whether the source is any good is a separate matter, and the record never claims otherwise.

package/templates/scaffold/knowledge/what-is-a-ksor.summary.md

@@ -0,0 +1,15 @@
+A Knowledge System of Record settles **which copy governs**. When a wiki page, a
+slide or a model's memory disagrees with it, this record wins.
+
+- A traditional system of record settles the _state_ of a business — the ledger
+  for transactions, the HRIS for employee records. A KSoR settles what the
+  organization _knows_ and how it should operate.
+- The problem it solves is scatter: knowledge spread across wikis, decks, PDFs,
+  prompts and memory, with no authoritative answer to the question an agent has
+  to ask — which knowledge should I trust?
+- An assistant cannot answer that question, because it answers from everything
+  it has ever read and cannot tell you which of its sentences were checked.
+- Every answer here traces to a document that names who stands behind it and
+  when it took effect.
+- It does **not** settle whether that document is right. Provenance proves who
+  said what and when; whether the source is any good is a separate matter.

package/templates/scaffold/system/site/app/docs/[[...slug]]/page.tsx

@@ -15,6 +15,11 @@ import {
 import { predecessorsOf, readGovernance, resolveSuccessorUrl } from "@/lib/governance";
 import { showGovernance } from "@/lib/shared";
 import { RecordToc, TocItems } from "@/components/record-toc";
+import { RecordViews } from "@/components/record-views";
+import { Flashcards } from "@/components/flashcards";
+import { StudyAids } from "@/components/study-aids";
+import { deckFor, summaryFor } from "@/lib/attachments";
+import { readingMinutes } from "@/lib/reading-time";
 
 export default async function Page(props: PageProps<"/docs/[[...slug]]">) {
   const params = await props.params;
@@ -22,6 +27,18 @@ export default async function Page(props: PageProps<"/docs/[[...slug]]">) {
   if (!page) notFound();
 
   const MDX = page.data.body;
+  // Attachments of THIS document, found by suffix on its own path. Null is the
+  // ordinary case, not an error.
+  const summary = summaryFor(page.path);
+  const Summary = summary?.body ?? null;
+  const deck = deckFor(page.path);
+  // Counted at BUILD time from the document's own markdown, so the figure is in
+  // the shipped HTML for a reader with a failed bundle, a crawler and an agent
+  // alike. The predecessor measured the rendered DOM after paint, which put it
+  // out of reach of all three.
+  const minutes = readingMinutes(await page.data.getText("processed"));
+  const summaryMinutes =
+    summary === null ? null : readingMinutes(await summary.getText("processed"));
   // What the record says about this document. The page renders it; it never
   // supplies it — an undeclared key shows nothing (specs/ksor/site-governance).
   const governance = readGovernance(page.data, page.path);
@@ -112,14 +129,35 @@ export default async function Page(props: PageProps<"/docs/[[...slug]]">) {
           describes (measured, 2026-08-21). Short documents now end where their
           text ends. */}
         <DocsBody style={{ flexGrow: 0 }}>
-          <MDX
-            components={getMDXComponents({
-              // relative links between documents in knowledge/ resolve to
-              // their rendered pages
-              a: createRelativeLink(source, page),
-            })}
-          />
+          {/* The summary panel is built HERE, on the server, and handed to the
+            client tab strip as a prop — so it is in the shipped HTML whether or
+            not the bundle runs, which is what an agent parsing the page and a
+            reader with a failed bundle both depend on. Presence-driven: with no
+            summary, RecordViews renders the body alone and no tab strip exists
+            (specs/ksor/study-attachments C3, C20). */}
+          <RecordViews
+            documentMinutes={minutes}
+            summaryMinutes={summaryMinutes ?? undefined}
+            summary={
+              Summary === null ? null : (
+                <Summary components={getMDXComponents({ a: createRelativeLink(source, page) })} />
+              )
+            }
+          >
+            <MDX
+              components={getMDXComponents({
+                // relative links between documents in knowledge/ resolve to
+                // their rendered pages
+                a: createRelativeLink(source, page),
+              })}
+            />
+          </RecordViews>
         </DocsBody>
+        {/* What a reader DOES with this document once they have read it. One
+          region, so the quiz that will sit beside the deck is a child here and
+          not a new argument about where it goes. Renders nothing at all when
+          the document has no study aids. */}
+        <StudyAids>{deck === null ? null : <Flashcards deck={deck} />}</StudyAids>
         {/* A folder's index page lists what the folder holds. Without it the
           page ended at its own sentence and the documents below it were
           reachable only from the sidebar (research/site-design.md F5). Empty

package/templates/scaffold/system/site/components/document-actions.tsx

@@ -0,0 +1,106 @@
+"use client";
+
+import { Check, ChevronDown, Copy, Download, FileText } from "lucide-react";
+import { useCallback, useEffect, useRef, useState, type ReactElement } from "react";
+
+import { Button } from "@/components/ui/button";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu";
+
+/**
+ * What a reader can DO with this document, behind one control.
+ *
+ * Opening the markdown twin and handing it to an agent are different acts, and
+ * a reader who wants the second should not have to perform the first — but two
+ * bare controls sitting on a row of read-only facts made the row look half
+ * clickable. One trigger says "there are actions here" once, and the menu says
+ * what they are.
+ *
+ * Putting the markdown LINK behind a click is safe for the audience that reads
+ * bytes: `generateMetadata` already advertises the twin as
+ * `<link rel="alternate" type="text/markdown">` in the head, so a crawler and
+ * an agent find the address without opening anything. Verified in the built
+ * HTML before this moved.
+ */
+export function DocumentActions({ href }: { readonly href: string }): ReactElement {
+  const [failed, setFailed] = useState(false);
+  const [copied, setCopied] = useState(false);
+  const timer = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+  // The shell ships `useCopyButton`, which owns this timing — but it hands back
+  // a MouseEventHandler, and a menu item reports selection as a CustomEvent.
+  // Casting one to the other to reuse six lines is worse than the six lines.
+  useEffect(
+    () => () => {
+      if (timer.current !== null) clearTimeout(timer.current);
+    },
+    [],
+  );
+
+  const onCopy = useCallback(async () => {
+    try {
+      const markdown = await fetch(href).then((response) => response.text());
+      await navigator.clipboard.writeText(markdown);
+      setFailed(false);
+      setCopied(true);
+      if (timer.current !== null) clearTimeout(timer.current);
+      timer.current = setTimeout(() => setCopied(false), 1600);
+    } catch {
+      // A refused clipboard or a failed fetch is not an error where a document
+      // should be: the menu says so, and View markdown still works.
+      setFailed(true);
+    }
+  }, [href]);
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <Button
+          variant="ghost"
+          size="sm"
+          className="h-auto gap-1.5 px-2 py-1 font-mono text-[0.6875rem] tracking-[0.14em] text-fd-muted-foreground uppercase hover:text-fd-foreground"
+        >
+          {/* "Export", not "Markdown": the word appeared three times in one
+            small control, and naming the FORMAT locks the trigger to it — a
+            later Download or Cite would make it wrong. Not "Source", which
+            collides with the provenance block below. Not "Share", which in a
+            record where `visibility:` decides who may read a document is the
+            wrong verb entirely. */}
+          <Download aria-hidden className="size-3.5" />
+          Export
+          <ChevronDown aria-hidden className="size-3 opacity-60" />
+        </Button>
+      </DropdownMenuTrigger>
+
+      <DropdownMenuContent align="start" className="w-52">
+        <DropdownMenuItem asChild>
+          <a href={href}>
+            <FileText aria-hidden className="size-4" />
+            View markdown
+          </a>
+        </DropdownMenuItem>
+
+        {/* onSelect is prevented so the menu stays open long enough to show
+          that the copy landed — closing on the click would take the only
+          feedback away with it. */}
+        <DropdownMenuItem
+          onSelect={(event) => {
+            event.preventDefault();
+            void onCopy();
+          }}
+        >
+          {copied ? (
+            <Check aria-hidden className="size-4 text-fd-primary" />
+          ) : (
+            <Copy aria-hidden className="size-4" />
+          )}
+          {failed ? "Copy failed — open it instead" : copied ? "Copied" : "Copy markdown"}
+        </DropdownMenuItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+}