tosijs-ui 1.16.28 → 1.16.30

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 1.16.30
+
+### Tunnel
+
+- **A dev-server restart no longer costs a key holder their next save.** `bun start` restarts
+  the server whenever a file in its import graph changes, and that includes every component
+  source, so editing an example restarts it. Save to source writes such a file, so the save
+  itself restarted the server, and the NEXT save from the same page was told "This workspace
+  needs an invite link". Reloading recovered the session but lost the unsaved edit. Now a
+  request from the workspace's own page that holds the global key cookie is given a fresh
+  session in place, and the haltija agent bridge's reconnection is too. "Own page" means
+  `Sec-Fetch-Site: same-origin` or an `Origin` that is this host; a sibling workspace's page,
+  which receives the same cookie, gets nothing, nor does a request with neither header. A
+  session opened from a plain `--link` holds no key, so a restart still ends it.
+- **For a key holder, the key cookie now bounds access, not the session.** A key opens a
+  one-day session, but the cookie renews it, so access lasts as long as the cookie (30 days for
+  the edit key) or until you rotate the key and restart the dev servers.
+
+## 1.16.29
+
+### Doc system
+
+- **A wikilink can name a page by its title.** `[[The feature registry]]` now reaches the page
+  at `/registry/`. Before, a target was only ever slugified, so it went to
+  `/the-feature-registry/` and 404'd. The slug (file name) still wins when a page has one, so
+  no link that worked changes target. A title two pages share reaches neither.
+  Reported by tosijs-3d-ensemble (#234).
+- **The build reports a wikilink that reaches no doc page**, naming the file and the target,
+  and fails under `strict`. One site had nine of these, live 404s from as far back as its 0.3,
+  and no build had said a word. **If you build with `strict: true`:** a wikilink to something
+  that is not a doc page, such as a hand-written page in your static folder, now fails the
+  build even though the link works. Write it as an ordinary `[label](/path/)`.
+- **The test-status widget sits in the header bar.** It was fixed at the bottom left over the
+  page, so a full-page component's last list row lost clicks to it (#233). A page with
+  `{"header": false}` still floats it there, having nowhere else to put it.
+
+### Tunnel
+
+- **The "needs an invite link" page offers the lasting link too.** When the dev server takes
+  the preview box's global keys, it now names `tosijs-tunnel --link --global` beside the
+  per-visit `--link`. That link keeps the browser in for 30 days across restarts (#232).
+
 ## 1.16.28
 
 ### Tunnel

package/dist/doc-browser.js

@@ -95,7 +95,7 @@ history, for a browser embedded in another page: drive it with `initialRoute`,
 */
 /*{ "parent": "Documentation System", "order": 50 }*/
 import { elements, vars, varDefault, bindings, touch, getListItem, debounce, tosi, StyleSheet, } from 'tosijs';
-import { buildSlugMap, pathForSlug, filenameForPath, homeDoc, } from './doc-system/routing.js';
+import { buildSlugMap, pathForSlug, filenameForPath, homeDoc, wikilinkTargets, } from './doc-system/routing.js';
 import { buildNavTree } from './doc-system/nav-tree.js';
 import { renderDocMarkdown } from './doc-system/render.js';
 import { pageTitle } from './doc-system/doc-title.js';
@@ -202,21 +202,28 @@ const testIndicatorStyleSpec = {
         background: testColor.fail,
         animation: 'test-pulse 2s ease-in-out infinite',
     },
-    // Floating widget - position and colors only, inherits button structure.
-    // Bottom-LEFT: bottom-right is where the injected haltija dev widget sits, and it
-    // was overlaying this.
+    /*
+    The widget sits in the header bar, not over the page (GitHub #233).
+  
+    It used to be `position: fixed` at the bottom left, on top of whatever the page drew there:
+    a full-page component's list ran under it and a click on its last row landed on the widget
+    instead. Only a page with no header (`{"header": false}`) still floats it, because there is
+    nowhere else to put it. Bottom-LEFT, because the haltija dev widget takes bottom-right.
+    */
     '.test-widget': {
         _testBg: testColor.running,
         _testFg: testTextColor.running,
-        position: 'fixed',
-        bottom: vars.spacing,
-        left: vars.spacing,
-        zIndex: '1000',
         background: vars.testBg,
         // Paired with the background, not fixed to white — see testTextColor above.
         color: vars.testFg,
         gap: vars.spacing50,
     },
+    '.test-widget.-floating': {
+        position: 'fixed',
+        bottom: vars.spacing,
+        left: vars.spacing,
+        zIndex: '1000',
+    },
     '.test-widget[hidden]': { display: 'none' },
     '.test-widget.-running': {
         _testBg: testColor.running,
@@ -368,6 +375,7 @@ export function createDocBrowser(options) {
     // while letting <tosi-doc-system> drive clean `/slug/` URLs off the same docs.
     // Both path and memory routing key off slugs; only legacy query routing doesn't.
     const slugMap = routing === 'query' ? {} : buildSlugMap(docs);
+    const wikilinks = wikilinkTargets(docs);
     const slugFor = (filename) => slugMap[filename] ?? filename;
     const filenameForSlug = (slug) => {
         for (const d of docs)
@@ -974,6 +982,7 @@ export function createDocBrowser(options) {
             // without loading the tjs transpiler. See self-contained-examples-plan.md.
             docContent.innerHTML = renderDocMarkdown(doc.text, {
                 bakes: doc.bakes ? new Map(doc.bakes) : undefined,
+                wikilinks,
             });
         }
         /*
@@ -1029,6 +1038,7 @@ export function createDocBrowser(options) {
             // to follow the doc, so this does not ride on that path succeeding.
             refreshNavToggle();
         }
+        placeTestWidget(doc);
         rewriteContentLinks();
         // Stamp each example with its source file (for the source↔doc map). doc.path
         // is the extracted file (.md, or a source file with doc comments).
@@ -1262,7 +1272,7 @@ export function createDocBrowser(options) {
             return;
         editUI.view = view;
         if (view === 'preview') {
-            docContent.innerHTML = renderDocMarkdown(docMarkdownFromSource(editUI.editor.value, editUI.doc.path));
+            docContent.innerHTML = renderDocMarkdown(docMarkdownFromSource(editUI.editor.value, editUI.doc.path), { wikilinks });
             rewriteContentLinks();
             LiveExample.insertExamples(docContent, context, editUI.doc.path || undefined);
         }
@@ -1615,6 +1625,21 @@ export function createDocBrowser(options) {
             height: '100%',
         },
     }, docContent)));
+    // Test status widget
+    const testWidget = button({
+        class: 'test-widget',
+        hidden: true,
+        onClick: showTestMenu,
+    }, span({ part: 'label' }, 'Tests'), span({ class: 'count', part: 'count' }, '0'));
+    const headerBar = container.querySelector('header');
+    // In the header unless this doc hides the header; see `.test-widget` in the styles.
+    const placeTestWidget = (doc) => {
+        const floating = doc.header === false;
+        testWidget.classList.toggle('-floating', floating);
+        const home = floating ? container : headerBar;
+        if (testWidget.parentElement !== home)
+            home.appendChild(testWidget);
+    };
     // Render the landing doc (adopts pre-rendered HTML when hydrating).
     showDoc(currentDoc);
     // Inject test indicator styles
@@ -1622,13 +1647,6 @@ export function createDocBrowser(options) {
     // Header brand-mark sizing (icon / <img> / inline-<svg>), one CSS var each.
     StyleSheet('doc-logo-mark', logoMarkStyleSpec);
     StyleSheet('doc-nav-search', navSearchStyleSpec);
-    // Floating widget for test status
-    const testWidget = button({
-        class: 'test-widget',
-        hidden: true,
-        onClick: showTestMenu,
-    }, span({ part: 'label' }, 'Tests'), span({ class: 'count', part: 'count' }, '0'));
-    container.appendChild(testWidget);
     /*
     The far end has something to tell you.
   

package/dist/doc-system/book-html.js

@@ -7,7 +7,7 @@ Node-only APIs — so it bundles into the iife. Live examples are pretty-printed
 force-wrapped code listings, not executed.
 */
 import { renderDocMarkdown } from './render.js';
-import { buildSlugMap } from './routing.js';
+import { buildSlugMap, wikilinkTargets } from './routing.js';
 import { buildNavTree } from './nav-tree.js';
 import { bookTextOf } from './book-target.js';
 // Clean book typography; force-wraps code so listings never overflow a page.
@@ -149,10 +149,13 @@ function tocHtml(nodes) {
 export function buildBookHtml(docs, opts) {
     const visible = docs.filter((d) => !d.hidden);
     const slugMap = buildSlugMap(visible);
+    const wikilinks = wikilinkTargets(visible);
     const roots = buildNavTree(visible, slugMap);
     const css = opts.css ?? `${DEFAULT_BOOK_CSS}\n${PRINT_CSS}`;
     const chapters = flatten(roots)
-        .map((node) => `<section class="chapter" id="${slugify(node.doc.filename)}">\n${renderDocMarkdown(stripDocMeta(bookTextOf(node.doc)))}\n</section>`)
+        .map((node) => `<section class="chapter" id="${slugify(node.doc.filename)}">\n${renderDocMarkdown(stripDocMeta(bookTextOf(node.doc)), {
+        wikilinks,
+    })}\n</section>`)
         .join('\n');
     return `<!DOCTYPE html>
 <html lang="${opts.lang ?? 'en'}">

package/dist/doc-system/render.d.ts

@@ -6,6 +6,8 @@ export type ExampleBakes = Map<string, ExampleBake>;
 export declare function unwrapLoneCustomElements(html: string): string;
 export declare function renderDocMarkdown(text: string, opts?: {
     bakes?: ExampleBakes;
+    /** the corpus's `wikilinkTargets`; without it a `[[target]]` is slugified as written */
+    wikilinks?: Map<string, string>;
 }): string;
 /**
  * Derive a clean <meta name="description"> from a doc's first prose paragraph.

package/dist/doc-system/render.js

@@ -11,8 +11,10 @@ give that example a stable anchor — see the docMarked renderer below.
 import { Marked, Renderer } from 'marked';
 import { parseFenceInfo } from './example-policy.js';
 import { HeadingIds, headingSlug } from './heading-id.js';
+import { pathForSlug, slugify } from './routing.js';
 const baseRenderer = new Renderer();
 let currentBakes;
+let currentWikilinks;
 // Per-parse, reset in `preprocess` below (same pattern as the footnote state).
 let headingIds = new HeadingIds();
 const docMarked = new Marked();
@@ -69,12 +71,6 @@ docMarked.use({
 // Enabled by default because each activates ONLY on its own syntax ([[…]] /
 // [^id]) — a doc that doesn't use them renders byte-identically (tosijs-ui's own
 // docs use neither). marked core supports neither; both are common in prose.
-function slugify(s) {
-    return s
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, '-')
-        .replace(/^-+|-+$/g, '');
-}
 function escapeHtml(s) {
     return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 }
@@ -112,7 +108,9 @@ docMarked.use({
     extensions: [
         {
             // [[slug]] / [[slug|label]] → link to /slug/. Not matched inside code spans
-            // (Marked tokenizes those first). Resolves by slugifying the target.
+            // (Marked tokenizes those first). Given the corpus's `wikilinkTargets`, a target is
+            // looked up there (by slug, then title) and one that reaches no page is marked
+            // `-missing` for the build to report; without them it is slugified as written.
             name: 'wikilink',
             level: 'inline',
             start(src) {
@@ -130,7 +128,12 @@ docMarked.use({
                 };
             },
             renderer(token) {
-                return `<a href="/${slugify(token.target)}/" class="wikilink">${escapeHtml(token.label)}</a>`;
+                const key = slugify(token.target);
+                const slug = currentWikilinks ? currentWikilinks.get(key) : key;
+                const missing = slug === undefined
+                    ? ` -missing" data-target="${escapeAttr(token.target)}`
+                    : '';
+                return `<a href="${pathForSlug(slug ?? key)}" class="wikilink${missing}">${escapeHtml(token.label)}</a>`;
             },
         },
         {
@@ -205,11 +208,13 @@ export function unwrapLoneCustomElements(html) {
 }
 export function renderDocMarkdown(text, opts = {}) {
     currentBakes = opts.bakes;
+    currentWikilinks = opts.wikilinks;
     try {
         return unwrapLoneCustomElements(docMarked.parse(text));
     }
     finally {
         currentBakes = undefined;
+        currentWikilinks = undefined;
     }
 }
 /**

package/dist/doc-system/routing.d.ts

@@ -19,6 +19,18 @@ export declare function homeDoc(docs: DocLike[]): string | null;
  * on array order.
  */
 export declare function buildSlugMap(docs: DocLike[]): Record<string, string>;
+/**
+ * What each `[[target]]` in a corpus can reach: { slugify(target) -> slug }.
+ *
+ * A page is reached by its slug, and also by its title when no page has that slug and no
+ * other page has the same title (GitHub #234). Authors write a page's TITLE —
+ * `[[The feature registry]]` — while the page lives at its file name, `/registry/`; before
+ * this, every such link went to `/the-feature-registry/` and 404'd without a word. A slug
+ * always wins over a title, so no link that already worked changes target.
+ */
+export declare function wikilinkTargets(docs: Array<DocLike & {
+    title?: string;
+}>): Map<string, string>;
 /** site-root-relative path for a slug: '' -> '/', 'button' -> '/button/' */
 export declare function pathForSlug(slug: string): string;
 /**

package/dist/doc-system/routing.js

@@ -56,6 +56,36 @@ export function buildSlugMap(docs) {
     }
     return map;
 }
+/**
+ * What each `[[target]]` in a corpus can reach: { slugify(target) -> slug }.
+ *
+ * A page is reached by its slug, and also by its title when no page has that slug and no
+ * other page has the same title (GitHub #234). Authors write a page's TITLE —
+ * `[[The feature registry]]` — while the page lives at its file name, `/registry/`; before
+ * this, every such link went to `/the-feature-registry/` and 404'd without a word. A slug
+ * always wins over a title, so no link that already worked changes target.
+ */
+export function wikilinkTargets(docs) {
+    const slugs = buildSlugMap(docs);
+    const targets = new Map();
+    for (const doc of docs) {
+        const slug = slugs[doc.filename];
+        if (slug !== '')
+            targets.set(slugify(slug), slug);
+    }
+    const byTitle = new Map();
+    for (const doc of docs) {
+        const key = doc.title ? slugify(doc.title) : '';
+        if (!key || targets.has(key))
+            continue;
+        // Two pages with one title: neither is reachable by it, so the link is reported.
+        byTitle.set(key, byTitle.has(key) ? null : slugs[doc.filename]);
+    }
+    for (const [key, slug] of byTitle)
+        if (slug !== null)
+            targets.set(key, slug);
+    return targets;
+}
 /** site-root-relative path for a slug: '' -> '/', 'button' -> '/button/' */
 export function pathForSlug(slug) {
     return slug === '' ? '/' : `/${slug}/`;

package/dist/doc-system/site/build-warnings.d.ts

@@ -32,3 +32,11 @@ export declare function deadInPageAnchors(html: string): string[];
  * (`diagram.svg`, `img/x.png`) is left alone. The fix is the root-relative `/value-renderer/`.
  */
 export declare function bareNameLinks(html: string): string[];
+/**
+ * The `[[wikilinks]]` in a RENDERED page that reach no page, as their authors wrote them.
+ *
+ * The renderer marks one `-missing` (with its target in `data-target`) when it was given the
+ * corpus's `wikilinkTargets` and neither a slug nor a title matched. Nine of these sat in one
+ * site for five releases, every one a live 404, because nothing said so (GitHub #234).
+ */
+export declare function missingWikilinks(html: string): string[];

package/dist/doc-system/site/build-warnings.js

@@ -128,3 +128,30 @@ export function bareNameLinks(html) {
     }
     return [...found];
 }
+/**
+ * The `[[wikilinks]]` in a RENDERED page that reach no page, as their authors wrote them.
+ *
+ * The renderer marks one `-missing` (with its target in `data-target`) when it was given the
+ * corpus's `wikilinkTargets` and neither a slug nor a title matched. Nine of these sat in one
+ * site for five releases, every one a live 404, because nothing said so (GitHub #234).
+ */
+export function missingWikilinks(html) {
+    const found = new Set();
+    for (const tag of html.matchAll(START_TAG)) {
+        if (tag[1].toLowerCase() !== 'a')
+            continue;
+        let missing = false;
+        let target = '';
+        for (const attr of tag[2].matchAll(ATTRIBUTE)) {
+            const key = attr[1].toLowerCase();
+            const value = unescapeAttr(attr[2] ?? attr[3] ?? attr[4] ?? '');
+            if (key === 'class')
+                missing = value.split(/\s+/).includes('-missing');
+            else if (key === 'data-target')
+                target = value;
+        }
+        if (missing && target)
+            found.add(target);
+    }
+    return [...found];
+}

package/dist/doc-system/site/dev-auth.d.ts

@@ -422,13 +422,16 @@ export declare const GLOBAL_EDIT_COOKIE = "tosi_edit";
 export declare const GLOBAL_KEY_MIN_LENGTH = 24;
 /**
  * A session minted from a global key lasts a day, or until this dev server stops (sessions
- * live in memory). The key is NOT re-checked while the session lives, so rotating a key ends
- * the sessions it already opened only when each workspace restarts.
+ * live in memory). While the key cookie lasts, the next page load or same-origin request mints
+ * another, so for a key holder it is the COOKIE's lifetime that ends access, not this. The key
+ * is NOT re-checked while a session lives, so rotating a key ends the sessions it already opened
+ * only when each workspace restarts.
  */
 export declare const GLOBAL_KEY_SESSION_TTL_MS: number;
 /**
  * The most live sessions one server holds; past it the oldest goes. Only a key holder can mint
- * one per page load, so this bounds a browser stuck reloading, not an attacker.
+ * one: per page load, and per request from a page left open across a restart until its first
+ * renewed cookie lands. So this bounds a browser stuck reloading, not an attacker.
  */
 export declare const MAX_SESSIONS = 1000;
 export interface GlobalKeys {
@@ -483,6 +486,41 @@ export declare function globalKeyExchange(request: {
     keys: GlobalKeys;
     now: number;
 }): 'edit' | 'view' | null;
+/**
+ * Should a request from this workspace's OWN page, that is not a page load, trade a global key
+ * for a session in place?
+ *
+ * Sessions live in memory, and `bun start` restarts the process whenever a file in its import
+ * graph changes, which includes every component source and so every doc-comment example. Save
+ * to source writes exactly such a file. So the save restarts the server, and the next save from
+ * the same page arrived holding a dead session and was told "This workspace needs an invite
+ * link". A reload would have exchanged the key, and lost the unsaved edit (the maintainer,
+ * 2026-10-20: a restart must not reset a key holder).
+ *
+ * The answer is the page-load exchange's, with two extra conditions, because no redirect is
+ * involved: the session is issued and used on this same request.
+ * - Positive evidence that the request comes from this origin: `Sec-Fetch-Site: same-origin`,
+ *   or, from a browser that sends no fetch metadata, an `Origin` that is this host. Absence of
+ *   both is NOT enough here (unlike `isSameOriginRequest`, which allows it for curl and our
+ *   own CLI, whose requests are not a browser spending an ambient cookie): every host under the preview domain
+ *   is the same site and receives the key cookie, so a sibling workspace's page must not be
+ *   able to spend it here.
+ *
+ * A WebSocket upgrade (the haltija bridge) qualifies too; browsers send `Origin` and
+ * `Sec-Fetch-Site` on the handshake, and the 101 carries the cookie.
+ */
+export declare function globalKeyRefresh(request: {
+    method: string;
+    headers: {
+        get(name: string): string | null;
+    };
+}, opts: {
+    viaTunnel: boolean;
+    host: string;
+    auth: AuthState;
+    keys: GlobalKeys;
+    now: number;
+}): 'edit' | 'view' | null;
 /**
  * The origin allowed to read this workspace's liveness answer: the box's own list.
  *

package/dist/doc-system/site/dev-auth.js

@@ -867,13 +867,16 @@ export const GLOBAL_EDIT_COOKIE = 'tosi_edit';
 export const GLOBAL_KEY_MIN_LENGTH = 24;
 /**
  * A session minted from a global key lasts a day, or until this dev server stops (sessions
- * live in memory). The key is NOT re-checked while the session lives, so rotating a key ends
- * the sessions it already opened only when each workspace restarts.
+ * live in memory). While the key cookie lasts, the next page load or same-origin request mints
+ * another, so for a key holder it is the COOKIE's lifetime that ends access, not this. The key
+ * is NOT re-checked while a session lives, so rotating a key ends the sessions it already opened
+ * only when each workspace restarts.
  */
 export const GLOBAL_KEY_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
 /**
  * The most live sessions one server holds; past it the oldest goes. Only a key holder can mint
- * one per page load, so this bounds a browser stuck reloading, not an attacker.
+ * one: per page load, and per request from a page left open across a restart until its first
+ * renewed cookie lands. So this bounds a browser stuck reloading, not an attacker.
  */
 export const MAX_SESSIONS = 1000;
 /**
@@ -944,7 +947,10 @@ export function isNavigation(request) {
 export function globalKeyExchange(request, opts) {
     if (!opts.viaTunnel || !isNavigation(request))
         return null;
-    const header = request.headers.get('cookie');
+    return keyAddsAccess(request.headers.get('cookie'), opts);
+}
+/** What a global key would add to this request's session: nothing, or a session of a kind. */
+function keyAddsAccess(header, opts) {
     const access = globalKeyAccess(header, opts.keys);
     if (!access)
         return null;
@@ -955,6 +961,41 @@ export function globalKeyExchange(request, opts) {
     }
     return access;
 }
+/**
+ * Should a request from this workspace's OWN page, that is not a page load, trade a global key
+ * for a session in place?
+ *
+ * Sessions live in memory, and `bun start` restarts the process whenever a file in its import
+ * graph changes, which includes every component source and so every doc-comment example. Save
+ * to source writes exactly such a file. So the save restarts the server, and the next save from
+ * the same page arrived holding a dead session and was told "This workspace needs an invite
+ * link". A reload would have exchanged the key, and lost the unsaved edit (the maintainer,
+ * 2026-10-20: a restart must not reset a key holder).
+ *
+ * The answer is the page-load exchange's, with two extra conditions, because no redirect is
+ * involved: the session is issued and used on this same request.
+ * - Positive evidence that the request comes from this origin: `Sec-Fetch-Site: same-origin`,
+ *   or, from a browser that sends no fetch metadata, an `Origin` that is this host. Absence of
+ *   both is NOT enough here (unlike `isSameOriginRequest`, which allows it for curl and our
+ *   own CLI, whose requests are not a browser spending an ambient cookie): every host under the preview domain
+ *   is the same site and receives the key cookie, so a sibling workspace's page must not be
+ *   able to spend it here.
+ *
+ * A WebSocket upgrade (the haltija bridge) qualifies too; browsers send `Origin` and
+ * `Sec-Fetch-Site` on the handshake, and the 101 carries the cookie.
+ */
+export function globalKeyRefresh(request, opts) {
+    if (!opts.viaTunnel || isNavigation(request))
+        return null;
+    const site = request.headers.get('sec-fetch-site');
+    const origin = request.headers.get('origin');
+    const ours = site !== null
+        ? site === 'same-origin'
+        : origin !== null && origin === `https://${opts.host.toLowerCase()}`;
+    if (!ours)
+        return null;
+    return keyAddsAccess(request.headers.get('cookie'), opts);
+}
 /**
  * The origin allowed to read this workspace's liveness answer: the box's own list.
  *

package/dist/doc-system/site/dev-server.d.ts

@@ -150,6 +150,22 @@ export declare function haltijaTunnelLoaderSnippet(): string;
 /** Same-origin paths the tunnel bridge serves. One place, so the loader and the routes agree. */
 export declare const HALTIJA_BRIDGE_PREFIX = "/__haltija/";
 export declare const HALTIJA_BRIDGE_WS = "/__haltija/ws";
+/** The slice of a `Bun.Server` the request handler uses. */
+export type Upgrader = {
+    requestIP?: (r: Request) => {
+        address?: string;
+    } | null;
+    upgrade?: (r: Request, opts?: {
+        data?: unknown;
+        headers?: Record<string, string>;
+    }) => boolean;
+};
+/**
+ * The same server, except that an accepted WebSocket upgrade also sets `setCookie` on its 101.
+ * How a renewed session reaches a browser whose request was a handshake (the haltija bridge),
+ * which has no Response of ours to carry it.
+ */
+export declare function upgraderSettingCookie(srv: Upgrader, setCookie: string): Upgrader;
 export declare const HALTIJA_BRIDGE_COMPONENT = "/__haltija/component.js";
 /** br if the client takes it, else gzip, else nothing. */
 export declare function negotiateEncoding(accept: string | null): 'br' | 'gzip' | null;

package/dist/doc-system/site/dev-server.js

@@ -22,7 +22,7 @@ import { resolveTunnelLocalPort } from './site-config.js';
 import { acquireBuildLock, describeHolder } from './build-lock.js';
 import { sinkPathFor, appendToSink } from './debug-sink.js';
 import { invitePageHtml } from './invite-page.js';
-import { TUNNEL_LINK_CMD, resolveLinkArrival, isLockedDown, hasTunnel, isLoopbackAddressForAuth as isLoopbackAddress, mayReadSite, shouldInterceptLinkToken, createAuthState, issueLink, globalKeyCookie, grantDomainFor, takeSessionGrant, outstandingGrants, MAX_OUTSTANDING_GRANTS, resolveShareTtlMs, readCookie, redeemThroughGate, createRedemptionGate, resolveLinkSettings, sessionCookie, urlWithoutToken, sameOriginPath, isSameOriginRequest, validSessionCookie, sessionRejection, haltijaBridgeAdmission, isProxiedRequest, sourceRequestAdmission, trustLanRefusalHint, trustLanWriteRecord, resolveLanTrust, describeLanTrust, resolveGlobalKeys, globalKeyAccess, globalKeyExchange, liveProbeOrigin, issueSession, cookieMayWrite, GLOBAL_KEY_SESSION_TTL_MS, SESSION_COOKIE, } from './dev-auth.js';
+import { TUNNEL_LINK_CMD, resolveLinkArrival, isLockedDown, hasTunnel, isLoopbackAddressForAuth as isLoopbackAddress, mayReadSite, shouldInterceptLinkToken, createAuthState, issueLink, globalKeyCookie, grantDomainFor, takeSessionGrant, outstandingGrants, MAX_OUTSTANDING_GRANTS, resolveShareTtlMs, readCookie, redeemThroughGate, createRedemptionGate, resolveLinkSettings, sessionCookie, urlWithoutToken, sameOriginPath, isSameOriginRequest, validSessionCookie, sessionRejection, haltijaBridgeAdmission, isProxiedRequest, sourceRequestAdmission, trustLanRefusalHint, trustLanWriteRecord, resolveLanTrust, describeLanTrust, resolveGlobalKeys, globalKeyAccess, globalKeyExchange, globalKeyRefresh, liveProbeOrigin, issueSession, cookieMayWrite, GLOBAL_KEY_SESSION_TTL_MS, SESSION_COOKIE, } from './dev-auth.js';
 import { readLocalSecret } from './local-secrets.js';
 import { resolveDataStore, resolveDataFile, dataContentProblem, listDataFiles, saveDataFile, dataHistory, readDataAt, isGitWorkTree, } from './data-store.js';
 import { SOURCE_ACCESS_HEADER, SOURCE_ENDPOINT_SNIPPET, } from '../../live-example/source-access.js';
@@ -361,6 +361,20 @@ export function haltijaTunnelLoaderSnippet() {
 /** Same-origin paths the tunnel bridge serves. One place, so the loader and the routes agree. */
 export const HALTIJA_BRIDGE_PREFIX = '/__haltija/';
 export const HALTIJA_BRIDGE_WS = '/__haltija/ws';
+/**
+ * The same server, except that an accepted WebSocket upgrade also sets `setCookie` on its 101.
+ * How a renewed session reaches a browser whose request was a handshake (the haltija bridge),
+ * which has no Response of ours to carry it.
+ */
+export function upgraderSettingCookie(srv, setCookie) {
+    return {
+        requestIP: (r) => srv.requestIP?.(r) ?? null,
+        upgrade: (r, opts) => srv.upgrade?.(r, {
+            ...opts,
+            headers: { ...opts?.headers, 'Set-Cookie': setCookie },
+        }) ?? false,
+    };
+}
 export const HALTIJA_BRIDGE_COMPONENT = '/__haltija/component.js';
 /**
  * Reclaim the port we are about to bind, from the process LISTENING on it.
@@ -1725,6 +1739,46 @@ export async function devServer(config, opts = {}) {
     outright. Source and data writes check same-origin on both paths (sourceRequestAdmission).
     */
     const csrfOk = (request, viaTunnel) => viaTunnel || isSameOriginRequest(request);
+    /*
+    A request from this workspace's own page that holds a global key but a dead session (the
+    server restarted under it) is served with a fresh session, which its response hands back.
+    See `globalKeyRefresh`. The session goes into the request's cookie header, so every gate in
+    handleRequest sees a session and none of them has to know about keys. A WebSocket upgrade
+    (the haltija bridge) carries the cookie on its 101, through `upgrade`'s headers.
+    */
+    // Said once per process: a page left open across a restart renews on every request it makes.
+    let renewalLogged = false;
+    const withKeySession = async (request, srv, handle) => {
+        const grant = globalKeyRefresh(request, {
+            viaTunnel: true,
+            host: request.headers.get('host') ?? '',
+            auth,
+            keys: globalKeys.keys,
+            now: Date.now(),
+        });
+        if (!grant)
+            return handle(request, srv);
+        const session = issueSession(auth, Date.now(), GLOBAL_KEY_SESSION_TTL_MS, grant === 'view');
+        const setCookie = sessionCookie(session, GLOBAL_KEY_SESSION_TTL_MS);
+        const headers = new Headers(request.headers);
+        const others = (headers.get('cookie') ?? '')
+            .split(';')
+            .map((c) => c.trim())
+            .filter((c) => c && !c.startsWith(`${SESSION_COOKIE}=`));
+        // The `name=value` pair the browser will send from now on.
+        headers.set('cookie', [...others, setCookie.split(';')[0]].join('; '));
+        if (!renewalLogged) {
+            renewalLogged = true;
+            console.log(`🔓 global ${grant} key — session renewed after a restart`);
+        }
+        const response = await handle(new Request(request, { headers }), srv && upgraderSettingCookie(srv, setCookie));
+        // An accepted upgrade answers with nothing; its cookie went out on the 101.
+        if (!response)
+            return response;
+        const refreshed = new Response(response.body, response);
+        refreshed.headers.append('Set-Cookie', setCookie);
+        return refreshed;
+    };
     const handleRequest = async (request, srv, viaTunnel) => {
         /*
         A REQUEST is activity. This was lost in the two-listener refactor, leaving the only
@@ -1904,7 +1958,7 @@ export async function devServer(config, opts = {}) {
                 sentence differs, and that sentence was the entire report.
                 */
                 const rejection = sessionRejection(readCookie(request.headers.get('cookie'), SESSION_COOKIE), Date.now());
-                return new Response(invitePageHtml(rejection, TUNNEL_LINK_CMD), {
+                return new Response(invitePageHtml(rejection, TUNNEL_LINK_CMD, globalKeys.keys.edit ? `${TUNNEL_LINK_CMD} --global` : undefined), {
                     status: 401,
                     headers: {
                         'Content-Type': 'text/html; charset=utf-8',
@@ -2490,7 +2544,7 @@ export async function devServer(config, opts = {}) {
                 // Same reasoning as the main listener — a tunnelled load is slower, not faster.
                 idleTimeout: DEV_IDLE_TIMEOUT_SECONDS,
                 hostname: '127.0.0.1',
-                fetch: (request, srv) => handleRequest(request, srv, true),
+                fetch: (request, srv) => withKeySession(request, srv, (r, s) => handleRequest(r, s, true)),
                 websocket: haltijaWebSocketHandlers,
             });
             console.log(`Tunnel listener on http://127.0.0.1:${tunnelPort} (loopback only; writes require a session)`);

package/dist/doc-system/site/epub.js

@@ -18,7 +18,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { renderDocMarkdown } from '../render.js';
 import { highlightHtml } from '../highlight.js';
-import { buildSlugMap, pathForSlug, resolveParent, slugForPath, withBase, } from '../routing.js';
+import { buildSlugMap, pathForSlug, resolveParent, slugForPath, withBase, wikilinkTargets, } from '../routing.js';
 import { buildNavTree } from '../nav-tree.js';
 import { partitionByBook, placeInBook, bookTextOf, DEFAULT_BOOK, } from '../book-target.js';
 import { COVER_MEDIA_TYPES, coverStem, epubVolumeIdentity, } from './epub-volumes.js';
@@ -621,6 +621,7 @@ export async function buildEpub(config, opts = {}) {
     into the default one just by not naming a book.
     */
     const siteSlugs = buildSlugMap(corpus);
+    const wikilinks = wikilinkTargets(corpus);
     const volumes = partitionByBook(corpus, siteSlugs);
     const visible = volumes.get(opts.bookTarget ?? DEFAULT_BOOK) ?? [];
     /*
@@ -750,7 +751,7 @@ export async function buildEpub(config, opts = {}) {
         `injectExampleLinks` matches on the `language-*` class, never on the code text, so
         highlighting cannot break the "Run this example live" links.
         */
-        await highlightHtml(renderDocMarkdown(stripDocMeta(bookTextOf(doc))), 'none'), bookFiles, slugMap, config.basePath);
+        await highlightHtml(renderDocMarkdown(stripDocMeta(bookTextOf(doc)), { wikilinks }), 'none'), bookFiles, slugMap, config.basePath);
         // happy-dom occasionally throws on exotic content (e.g. an internal selector
         // bug); fall back to the regex pass for that doc rather than aborting.
         let bodyHtml;