wiki-formant 0.17.1 → 0.19.0

package/dist/mcp.js

@@ -1,5 +1,6 @@
 // mcp.ts — a minimal Model Context Protocol server over Streamable HTTP
-// (JSON-RPC). Spec: https://modelcontextprotocol.io/specification/2025-06-18
+// (JSON-RPC), serving both protocol eras from one endpoint.
+// Spec: https://modelcontextprotocol.io/specification/2026-07-28
 //
 // Web-standard `Request`/`Response` only, so this runs unchanged on Next route
 // handlers (NextResponse extends Response), Hono, Bun, Deno and workers.
@@ -13,31 +14,58 @@
 // A caller-fixable mistake is a tool result with `isError`, never a -32603.
 // That split is the one most implementations get wrong.
 /**
- * The versions this transport speaks, newest first.
+ * The modern era: every request carries its own version and client
+ * capabilities in `params._meta`. No handshake, no session, no `ping`, no batch.
+ */
+export const MCP_MODERN_VERSIONS = ['2026-07-28'];
+/**
+ * The legacy era, negotiated by an `initialize` handshake.
  *
- * This was a constant answered unconditionally, which is legal and still wrong:
- * a client asking for 2025-06-18 was told 2025-03-26 and silently gave up tool
- * titles, structured output and `_meta`. The last one is where a payment
- * receipt rides, so the one surface that needed it rebuilt this module's HTTP
- * shell by hand to reach it.
+ * Served beside the modern era rather than replaced by it. The spec lets one
+ * endpoint speak both, and a legacy client meeting a dual-era server works;
+ * going modern-only would fail the handshake of every client in the field.
+ */
+export const MCP_LEGACY_VERSIONS = ['2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05'];
+/**
+ * Every version this transport speaks, newest first. It is the `supported` list
+ * a `-32022` names and the `supportedVersions` of `server/discover`, so a modern
+ * client that cannot use the newest still learns a legacy fallback exists.
  */
-export const MCP_PROTOCOL_VERSIONS = ['2025-06-18', '2025-03-26', '2024-11-05'];
-/** The newest version spoken here, and what an unrecognised ask falls back to. */
+export const MCP_PROTOCOL_VERSIONS = [...MCP_MODERN_VERSIONS, ...MCP_LEGACY_VERSIONS];
+/** The newest version spoken here. */
 export const MCP_PROTOCOL_VERSION = MCP_PROTOCOL_VERSIONS[0];
-/** What a request carrying no `MCP-Protocol-Version` header means, per the spec. */
+/**
+ * The newest version `initialize` can negotiate, and what an unrecognised ask is
+ * offered. A handshake cannot land on a modern version — the modern era has no
+ * handshake — so this, not `MCP_PROTOCOL_VERSION`, is what a legacy client gets.
+ */
+export const MCP_LEGACY_PROTOCOL_VERSION = MCP_LEGACY_VERSIONS[0];
+/** The reserved `_meta` keys the modern era is spelled in. */
+export const MCP_META = {
+    protocolVersion: 'io.modelcontextprotocol/protocolVersion',
+    clientCapabilities: 'io.modelcontextprotocol/clientCapabilities',
+    serverInfo: 'io.modelcontextprotocol/serverInfo',
+};
+/** What a legacy request carrying no `MCP-Protocol-Version` header means, per the spec. */
 const ASSUMED_VERSION = '2025-03-26';
-const speaks = (v) => MCP_PROTOCOL_VERSIONS.includes(v);
-/** Echo the client's version when it is one we speak, else offer the newest. */
-export function negotiateProtocol(requested) {
-    return speaks(requested) ? requested : MCP_PROTOCOL_VERSION;
+const member = (list) => (v) => list.includes(v);
+const speaksLegacy = member(MCP_LEGACY_VERSIONS);
+const speaksModern = member(MCP_MODERN_VERSIONS);
+/**
+ * Echo the client's version when it is one we speak, else offer the newest.
+ * Answering a constant instead is legal and still wrong: it silently held every
+ * caller below the version that carries structured output and `_meta`.
+ */
+function negotiateProtocol(requested) {
+    return speaksLegacy(requested) ? requested : MCP_LEGACY_PROTOCOL_VERSION;
 }
 /** The version a post-initialize request is operating under. */
-export function requestProtocol(request) {
+function requestProtocol(request) {
     const header = request.headers.get('mcp-protocol-version');
-    return speaks(header) ? header : ASSUMED_VERSION;
+    return speaksLegacy(header) ? header : ASSUMED_VERSION;
 }
-/** JSON-RPC batching was removed in 2025-06-18; it stays legal below that. */
-const allowsBatch = (v) => v !== '2025-06-18';
+/** JSON-RPC batching was removed in 2025-06-18 and stays removed; it is legal only below that. */
+const allowsBatch = (v) => v === '2025-03-26' || v === '2024-11-05';
 import { clientKey, rateLimit, rateLimitHeaders, withRateLimit } from './rate-limit.js';
 /**
  * A caller-fixable failure inside a handler (page not found, empty input).
@@ -137,15 +165,19 @@ function validateArgs(tool, args) {
         `Expected schema: ${JSON.stringify(tool.inputSchema)}`,
     ].join('\n');
 }
-const BASE_METHODS = ['initialize', 'ping', 'tools/list', 'tools/call'];
-function methodsFor(config) {
+/** The methods one era has and the other does not. Everything else is shared. */
+const ERA_METHODS = {
+    legacy: ['initialize', 'ping'],
+    modern: ['server/discover'],
+};
+function methodsFor(config, era) {
     return [
-        ...BASE_METHODS,
+        ...ERA_METHODS[era],
+        'tools/list',
+        'tools/call',
         // The list methods answer whether or not anything is registered: an empty
         // list is a better answer to a client that asked than a -32601 it has to
-        // interpret. This enumeration used to omit them while the dispatch below
-        // answered them, so the error message contradicted the server describing
-        // itself.
+        // interpret.
         'resources/list',
         'resources/templates/list',
         'prompts/list',
@@ -153,11 +185,30 @@ function methodsFor(config) {
         ...(config.prompts?.length ? ['prompts/get'] : []),
     ];
 }
+const methodNotFound = (id, method, config, era) => {
+    const methods = methodsFor(config, era);
+    return rpcError(id, -32601, `Method not found: "${method}". This server implements: ${quote(methods)}.`, { supportedMethods: methods });
+};
+/**
+ * Only the capabilities the config actually populates — an advertised
+ * `resources` whose list comes back empty reads as a bug to a client, not as
+ * honesty. One function, so `initialize` and `server/discover` cannot disagree.
+ */
+const capabilitiesOf = (config) => ({
+    tools: {},
+    ...(config.resources?.length ? { resources: {} } : {}),
+    ...(config.prompts?.length ? { prompts: {} } : {}),
+});
 async function handleRpc(req, config, dispatch) {
     const { id, method, params } = req;
     const p = (params ?? {});
     const resources = config.resources ?? [];
     const prompts = config.prompts ?? [];
+    // A method the other era owns is not found in this one, however well the
+    // server knows it: a modern `ping` is a removed method, not a pong.
+    const foreign = ERA_METHODS[dispatch.era === 'modern' ? 'legacy' : 'modern'];
+    if (foreign.includes(method))
+        return methodNotFound(id, method, config, dispatch.era);
     try {
         switch (method) {
             case 'initialize':
@@ -165,21 +216,24 @@ async function handleRpc(req, config, dispatch) {
                     jsonrpc: '2.0',
                     id,
                     result: {
-                        // Echo what the client asked for when we speak it. Answering a
-                        // constant is what silently held every caller at 2025-03-26.
                         protocolVersion: negotiateProtocol(p.protocolVersion),
-                        // Only advertise capabilities the config actually populates — an
-                        // advertised `resources` whose list comes back empty reads as a bug
-                        // to a client, not as honesty.
-                        capabilities: {
-                            tools: {},
-                            ...(resources.length ? { resources: {} } : {}),
-                            ...(prompts.length ? { prompts: {} } : {}),
-                        },
+                        capabilities: capabilitiesOf(config),
                         serverInfo: config.serverInfo,
                         instructions: config.instructions,
                     },
                 };
+            // What `initialize` tells a legacy client, asked the modern way. The
+            // transport adds `resultType`, the cache hints and `_meta` serverInfo.
+            case 'server/discover':
+                return {
+                    jsonrpc: '2.0',
+                    id,
+                    result: {
+                        supportedVersions: [...MCP_PROTOCOL_VERSIONS],
+                        capabilities: capabilitiesOf(config),
+                        instructions: config.instructions,
+                    },
+                };
             // Notifications have no response at all.
             case 'notifications/initialized':
             case 'notifications/cancelled':
@@ -286,13 +340,12 @@ async function handleRpc(req, config, dispatch) {
                 try {
                     const data = await tool.handler(args, ctx);
                     const text = typeof data === 'string' ? data : JSON.stringify(data, null, 2);
-                    // Every object answer, not only the schema-bearing ones. Gating this
-                    // on `outputSchema` meant that across four live servers and thirty-two
-                    // tools — every one of them returning JSON — not a single result ever
-                    // carried `structuredContent`, and every agent parsed prose to reach
-                    // data the server already had in hand. A declared `outputSchema` is
-                    // still the stronger contract (a client validates against it); it is
-                    // no longer the price of admission. The text block stays regardless:
+                    // Every object answer, not only the schema-bearing ones. Gated on
+                    // `outputSchema`, a JSON-returning tool without one would carry no
+                    // `structuredContent`, and agents would parse prose to reach data the
+                    // server has in hand. A declared `outputSchema` is the stronger
+                    // contract (a client validates against it), not the price of
+                    // admission. The text block stays regardless:
                     // the spec asks for the serialised twin, and a client that reads only
                     // content still has to be able to read the answer.
                     const structured = data !== null && typeof data === 'object' && !Array.isArray(data)
@@ -309,10 +362,8 @@ async function handleRpc(req, config, dispatch) {
                     return toolText(id, JSON.stringify({ error: err.message, ...err.details }, null, 2), true);
                 }
             }
-            default: {
-                const methods = methodsFor(config);
-                return rpcError(id, -32601, `Method not found: "${method}". This server implements: ${quote(methods)}.`, { supportedMethods: methods });
-            }
+            default:
+                return methodNotFound(id, method, config, dispatch.era);
         }
     }
     catch (err) {
@@ -321,7 +372,7 @@ async function handleRpc(req, config, dispatch) {
     }
 }
 /** Dispatch a parsed body. `null` means notification-only — answer 202, not 200. */
-export async function handleMcp(body, config, dispatch = { protocolVersion: ASSUMED_VERSION }) {
+export async function handleMcp(body, config, dispatch = { protocolVersion: ASSUMED_VERSION, era: 'legacy' }) {
     const maxBatch = config.maxBatch ?? DEFAULT_MAX_BATCH;
     const isBatch = Array.isArray(body);
     if (isBatch && body.length > maxBatch) {
@@ -340,12 +391,13 @@ export async function handleMcp(body, config, dispatch = { protocolVersion: ASSU
 // the spec's Origin-validation MUST exists to protect localhost servers from
 // DNS rebinding, which is the opposite situation. The allow-headers list
 // matters more than it looks — MCP clients preflight with `Accept` and
-// `Mcp-Protocol-Version`, and one missing entry fails the preflight, not the
-// POST, which reads as "the server is down".
+// `Mcp-Protocol-Version` — and a modern client adds `Mcp-Method` and `Mcp-Name`
+// on every call — and one missing entry fails the preflight, not the POST,
+// which reads as "the server is down".
 export const MCP_CORS = {
     'Access-Control-Allow-Origin': '*',
     'Access-Control-Allow-Methods': 'POST, OPTIONS',
-    'Access-Control-Allow-Headers': 'Content-Type, Accept, Authorization, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID',
+    'Access-Control-Allow-Headers': 'Content-Type, Accept, Authorization, Mcp-Session-Id, Mcp-Protocol-Version, Mcp-Method, Mcp-Name, Last-Event-ID',
     // Allow-Headers governs what a browser may send; without Expose-Headers it
     // may read none of what comes back. A browser client could not see the
     // negotiated version, and could not see `Retry-After` on the 429 telling it
@@ -389,7 +441,6 @@ export function mcpRateLimited(retryAfterSec, message) {
 }
 /** The whole POST leg: parse, gate, track, dispatch, and answer with the right status. */
 export async function mcpResponse(request, config) {
-    const protocolVersion = requestProtocol(request);
     // Before `request.json()`: an unparsed body must not cost a query, which is
     // also why the refusal carries a null id.
     let headroom = {};
@@ -400,12 +451,10 @@ export async function mcpResponse(request, config) {
         }
         headroom = rateLimitHeaders(verdict, config.rateLimit);
     }
-    // Echoed on every response so a client can see which version it is actually
-    // being answered under, rather than inferring it from the initialize it sent
-    // some requests ago. The headroom rides alongside on every answer, not only
-    // on the 429 — a budget discoverable only by exceeding it is one an agent
-    // meets when it is least able to act on it.
-    const headers = { ...MCP_CORS, 'MCP-Protocol-Version': protocolVersion, ...headroom };
+    // The headroom rides on every answer, not only on the 429 — a budget
+    // discoverable only by exceeding it is one an agent meets when it is least
+    // able to act on it.
+    const base = { ...MCP_CORS, ...headroom };
     let body;
     try {
         body = await request.json();
@@ -413,20 +462,49 @@ export async function mcpResponse(request, config) {
     catch {
         return Response.json(rpcError(null, -32700, 'Parse error: request body is not valid JSON.'), {
             status: 400,
-            headers,
+            headers: { ...base, 'MCP-Protocol-Version': requestProtocol(request) },
         });
     }
+    // Tracked before either era refuses anything: a probe the server turns away,
+    // and a call an agent walked away from behind a gate, are exactly the ones
+    // worth counting.
+    config.onCall?.(request, body);
+    return isModern(request, body)
+        ? modernResponse(request, body, config, base)
+        : legacyResponse(request, body, config, base);
+}
+/**
+ * Which era a POST belongs to. The spec's rule: modern `_meta` selects the modern
+ * era and `initialize` selects the legacy one. A modern version header and
+ * `server/discover` can only mean one thing too. Anything else is legacy,
+ * because a body without `_meta` is exactly what every client in the field sends.
+ */
+function isModern(request, body) {
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return false;
+    const { method, params } = body;
+    if (method === 'initialize')
+        return false;
+    const meta = params?._meta;
+    return ((!!meta && typeof meta === 'object' && MCP_META.protocolVersion in meta) ||
+        method === 'server/discover' ||
+        speaksModern(request.headers.get('mcp-protocol-version')));
+}
+async function dispatchThroughGate(body, config, dispatch) {
+    const gate = await config.gate?.(body);
+    const dispatched = gate?.empty ? null : await handleMcp(gate ? gate.body : body, config, dispatch);
+    return gate ? gate.finish(dispatched) : dispatched;
+}
+async function legacyResponse(request, body, config, base) {
+    const protocolVersion = requestProtocol(request);
+    // Echoed on every response so a client can see which version it is actually
+    // being answered under, rather than inferring it from the initialize it sent
+    // some requests ago.
+    const headers = { ...base, 'MCP-Protocol-Version': protocolVersion };
     if (Array.isArray(body) && !allowsBatch(protocolVersion)) {
         return Response.json(rpcError(null, -32600, `JSON-RPC batching was removed in MCP ${protocolVersion}. Send one request per POST, or negotiate ${ASSUMED_VERSION} to keep batching.`), { status: 400, headers });
     }
-    // Tracked on the original body, before a gate withholds anything: a call an
-    // agent walked away from is exactly the one worth counting.
-    config.onCall?.(request, body);
-    const gate = await config.gate?.(body);
-    const dispatched = gate?.empty
-        ? null
-        : await handleMcp(gate ? gate.body : body, config, { protocolVersion, request });
-    const result = gate ? await gate.finish(dispatched) : dispatched;
+    const result = await dispatchThroughGate(body, config, { protocolVersion, era: 'legacy', request });
     // Notification-only input produces no response bodies; the spec requires a
     // bare 202 there, not a 200 carrying a JSON `null`.
     if (result == null || (Array.isArray(result) && !result.length)) {
@@ -434,3 +512,125 @@ export async function mcpResponse(request, config) {
     }
     return Response.json(result, { headers });
 }
+/** The modern era maps a protocol error to an HTTP status; the legacy era answered 200. */
+const MODERN_STATUS = {
+    [-32601]: 404,
+    [-32602]: 400,
+    [-32020]: 400,
+    [-32021]: 400,
+    [-32022]: 400,
+};
+/** The results a modern client may cache. A call or a prompt is never among them. */
+const CACHEABLE = new Set([
+    'server/discover',
+    'tools/list',
+    'prompts/list',
+    'resources/list',
+    'resources/templates/list',
+    'resources/read',
+]);
+const DEFAULT_CACHE_TTL_MS = 300_000;
+/** `Mcp-Name` carries the target of the three calls that have one, for a gateway to route on. */
+const NAME_PARAM = {
+    'tools/call': 'name',
+    'prompts/get': 'name',
+    'resources/read': 'uri',
+};
+/** A header value, decoded from the `=?base64?…?=` form a client uses for non-ASCII. */
+function headerValue(raw) {
+    const encoded = raw?.match(/^=\?base64\?(.*)\?=$/i)?.[1];
+    if (encoded === undefined)
+        return raw;
+    try {
+        return new TextDecoder().decode(Uint8Array.from(atob(encoded), c => c.charCodeAt(0)));
+    }
+    catch {
+        return null;
+    }
+}
+/** The first routing header that disagrees with the body, described. */
+function headerMismatch(request, method, params, version) {
+    const expected = [
+        ['MCP-Protocol-Version', version],
+        ['Mcp-Method', method],
+    ];
+    const nameKey = NAME_PARAM[method];
+    // A call missing its name is reported by the dispatcher, which can list the names.
+    if (nameKey && typeof params[nameKey] === 'string')
+        expected.push(['Mcp-Name', params[nameKey]]);
+    for (const [name, want] of expected) {
+        const got = headerValue(request.headers.get(name));
+        if (got !== want) {
+            return `Header ${name} must equal ${JSON.stringify(want)}; received ${got === null ? 'none' : JSON.stringify(got)}.`;
+        }
+    }
+    return null;
+}
+/**
+ * A modern result: `resultType` on every one, cache hints on the cacheable ones,
+ * and serverInfo in `_meta` now that no handshake carries it. Applied after the
+ * gate, so an answer a gate builds in place of a call is shaped the same way.
+ */
+function modernResult(response, method, config) {
+    if (!('result' in response))
+        return response;
+    const result = response.result;
+    return {
+        ...response,
+        result: {
+            resultType: 'complete',
+            ...result,
+            ...(CACHEABLE.has(method)
+                ? {
+                    ttlMs: config.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS,
+                    // Nothing here varies by caller, except a read a gate may have
+                    // charged for, which a shared cache must not hand to the next one.
+                    cacheScope: method === 'resources/read' ? 'private' : 'public',
+                }
+                : {}),
+            _meta: { ...result._meta, [MCP_META.serverInfo]: config.serverInfo },
+        },
+    };
+}
+async function modernResponse(request, body, config, base) {
+    const params = (body.params ?? {});
+    const meta = (params._meta ?? {});
+    const requested = meta[MCP_META.protocolVersion];
+    const headers = {
+        ...base,
+        'MCP-Protocol-Version': speaksModern(requested) ? requested : MCP_MODERN_VERSIONS[0],
+    };
+    const refuse = (code, message, data) => Response.json(rpcError(body.id ?? null, code, message, data), {
+        status: MODERN_STATUS[code] ?? 400,
+        headers,
+    });
+    if (typeof requested !== 'string') {
+        return refuse(-32602, `Missing params._meta["${MCP_META.protocolVersion}"]. A ${MCP_MODERN_VERSIONS[0]} request carries its version and client capabilities on every call; to use ${MCP_LEGACY_PROTOCOL_VERSION} instead, send "initialize".`);
+    }
+    if (!speaksModern(requested)) {
+        return refuse(-32022, 'Unsupported protocol version', {
+            supported: [...MCP_PROTOCOL_VERSIONS],
+            requested,
+        });
+    }
+    const capabilities = meta[MCP_META.clientCapabilities];
+    if (!capabilities || typeof capabilities !== 'object' || Array.isArray(capabilities)) {
+        return refuse(-32602, `Missing params._meta["${MCP_META.clientCapabilities}"]. Send {} when the client declares none.`);
+    }
+    const mismatch = headerMismatch(request, body.method, params, requested);
+    if (mismatch)
+        return refuse(-32020, mismatch);
+    const result = await dispatchThroughGate(body, config, {
+        protocolVersion: requested,
+        era: 'modern',
+        request,
+    });
+    if (result == null)
+        return new Response(null, { status: 202, headers });
+    const response = modernResult(result, body.method, config);
+    const code = response.error?.code;
+    return Response.json(response, {
+        status: (code !== undefined && MODERN_STATUS[code]) || 200,
+        headers,
+    });
+}

package/dist/pagination.d.ts

@@ -7,8 +7,6 @@ export interface PaginatedResponse<T> extends Pagination {
     total: number;
     totalPages: number;
 }
-export declare const MAX_PAGE_SIZE = 100;
-export declare const DEFAULT_PAGE_SIZE = 20;
 /**
  * `page` clamped to ≥1, `pageSize` clamped to 1–`max`. Never trust either.
  *
@@ -55,14 +53,12 @@ export declare function toOffset({ page, pageSize }: Pagination): {
  * The ordering is the caller's, deliberately — it is the one thing here that is
  * never portable. A wiki's sequence is its section's configured sort, a
  * knowledge base's is a taxonomy walk, and a company log's is `updatedAt` desc.
- * What both wikis had written twice is this scan, not the sort.
  *
  * `null` on both sides when the page is not in the list, so a page reached by a
  * URL its own section does not list renders no nav rather than a wrong one.
  *
- * No query. Both callers already hold the ordered siblings for something else —
- * a related-pages panel, a section listing — and the two indexed lookups the
- * neighbours used to cost were the reason one wiki dropped the control.
+ * No query. Callers already hold the ordered siblings for something else, a
+ * related-pages panel or a section listing, so the neighbours cost no lookups.
  */
 export declare function adjacentPages<T>(ordered: readonly T[], isCurrent: (page: T) => boolean): {
     prev: T | null;

package/dist/pagination.js

@@ -3,8 +3,8 @@
 // Forked three ways once: a re-typed clamp that dropped `totalPages`, and an
 // offset redone by hand in raw SQL. The response shape is the contract a client
 // codes against, so reshaping it per repo is a breaking change nobody declared.
-export const MAX_PAGE_SIZE = 100;
-export const DEFAULT_PAGE_SIZE = 20;
+const MAX_PAGE_SIZE = 100;
+const DEFAULT_PAGE_SIZE = 20;
 /**
  * `page` clamped to ≥1, `pageSize` clamped to 1–`max`. Never trust either.
  *
@@ -62,14 +62,12 @@ export function toOffset({ page, pageSize }) {
  * The ordering is the caller's, deliberately — it is the one thing here that is
  * never portable. A wiki's sequence is its section's configured sort, a
  * knowledge base's is a taxonomy walk, and a company log's is `updatedAt` desc.
- * What both wikis had written twice is this scan, not the sort.
  *
  * `null` on both sides when the page is not in the list, so a page reached by a
  * URL its own section does not list renders no nav rather than a wrong one.
  *
- * No query. Both callers already hold the ordered siblings for something else —
- * a related-pages panel, a section listing — and the two indexed lookups the
- * neighbours used to cost were the reason one wiki dropped the control.
+ * No query. Callers already hold the ordered siblings for something else, a
+ * related-pages panel or a section listing, so the neighbours cost no lookups.
  */
 export function adjacentPages(ordered, isCurrent) {
     const i = ordered.findIndex(isCurrent);

package/dist/rate-limit.d.ts

@@ -69,10 +69,9 @@ export declare function resetRateLimits(): void;
  * `.well-known/mcp.json`, the OpenAPI spec, agents.md, llms.txt and the
  * `initialize` instructions all quote this, so the endpoint enforces exactly
  * what the documents claim. It is a cross-surface contract, which is why it
- * lives here rather than three times over: it had already drifted to 200 on one
- * surface with nothing recorded about why, and that is the state that makes a
- * number impossible to change safely later — nobody can tell a considered
- * difference from a stale one.
+ * lives here rather than three times over. A second copy is how a number
+ * becomes impossible to change safely: nobody can tell a considered difference
+ * from a stale one.
  *
  * A surface with a genuine reason to differ passes its own `RateLimitOptions`.
  * What it must not do is restate this one.

package/dist/rate-limit.js

@@ -117,10 +117,9 @@ export function resetRateLimits() {
  * `.well-known/mcp.json`, the OpenAPI spec, agents.md, llms.txt and the
  * `initialize` instructions all quote this, so the endpoint enforces exactly
  * what the documents claim. It is a cross-surface contract, which is why it
- * lives here rather than three times over: it had already drifted to 200 on one
- * surface with nothing recorded about why, and that is the state that makes a
- * number impossible to change safely later — nobody can tell a considered
- * difference from a stale one.
+ * lives here rather than three times over. A second copy is how a number
+ * becomes impossible to change safely: nobody can tell a considered difference
+ * from a stale one.
  *
  * A surface with a genuine reason to differ passes its own `RateLimitOptions`.
  * What it must not do is restate this one.

package/dist/react-server.d.ts

@@ -54,7 +54,7 @@ export interface FacetBarProps {
  * dropping the active facets — and the A–Z row leads with the reset control.
  *
  * `aria-current`, not `aria-pressed`: a link is not a toggle button and does not
- * take that attribute. Two of the three copies this replaces had it wrong.
+ * take that attribute.
  */
 export declare function FacetBar({ link: Link, facets, letters, alphaLabel, classNames, }: FacetBarProps): import("react").JSX.Element | null;
 export interface BreadcrumbItem {
@@ -114,7 +114,7 @@ export declare function Breadcrumbs({ items, base, className, link: Link, lastAs
  * The standard page-top row: the trail, plus optional right-aligned actions.
  *
  * The column it sits in is the one its route declares — the row reads the
- * page's own max-width by inheritance, so a trail can no longer disagree with
+ * page's own max-width by inheritance, so a trail cannot disagree with
  * the content it titles.
  */
 export declare function BreadcrumbsRow({ actions, className, ...props }: BreadcrumbsProps & {
@@ -146,15 +146,11 @@ export interface PageNavProps {
  * lateral links do not cover.
  *
  * Ordering is entirely the caller's; pair this with `adjacentPages` from
- * `wiki-formant/pagination` over a list you already hold. Both wikis had this
- * markup and had already drifted on the parts that matter rather than the parts
- * that show: one carried `rel="prev"`/`rel="next"` and an `aria-label` and the
- * other carried neither, and the one without expressed its right-hand alignment
- * as two inline utilities instead of the modifier its own stylesheet defines.
+ * `wiki-formant/pagination` over a list you already hold.
  *
- * The `page-nav__*` class names are NOT props, for the reason `WikiRail`'s are
- * not: they are the convention both stylesheets already implement, and making
- * them configurable is how a convention forks. The empty `<div>` holds the
- * first article's left column so the next link stays in the right one.
+ * The `page-nav__*` class names are NOT props: they are the convention every
+ * stylesheet implements, and making them configurable is how a convention
+ * forks. The empty `<div>` holds the first article's left column so the next
+ * link stays in the right one.
  */
 export declare function PageNav({ prev, next, link: Link, label, prevLabel, nextLabel, prevGlyph, nextGlyph, }: PageNavProps): import("react").JSX.Element | null;

package/dist/react-server.js

@@ -34,7 +34,7 @@ export const Anchor = ({ href, className, children }) => _jsx("a", { href: href,
  * dropping the active facets — and the A–Z row leads with the reset control.
  *
  * `aria-current`, not `aria-pressed`: a link is not a toggle button and does not
- * take that attribute. Two of the three copies this replaces had it wrong.
+ * take that attribute.
  */
 export function FacetBar({ link: Link, facets, letters, alphaLabel = 'A–Z', classNames = {}, }) {
     if (!facets.length && !letters.length)
@@ -85,7 +85,7 @@ export function Breadcrumbs({ items, base, className = '', link: Link = Anchor,
  * The standard page-top row: the trail, plus optional right-aligned actions.
  *
  * The column it sits in is the one its route declares — the row reads the
- * page's own max-width by inheritance, so a trail can no longer disagree with
+ * page's own max-width by inheritance, so a trail cannot disagree with
  * the content it titles.
  */
 export function BreadcrumbsRow({ actions, className = '', ...props }) {
@@ -96,16 +96,12 @@ export function BreadcrumbsRow({ actions, className = '', ...props }) {
  * lateral links do not cover.
  *
  * Ordering is entirely the caller's; pair this with `adjacentPages` from
- * `wiki-formant/pagination` over a list you already hold. Both wikis had this
- * markup and had already drifted on the parts that matter rather than the parts
- * that show: one carried `rel="prev"`/`rel="next"` and an `aria-label` and the
- * other carried neither, and the one without expressed its right-hand alignment
- * as two inline utilities instead of the modifier its own stylesheet defines.
+ * `wiki-formant/pagination` over a list you already hold.
  *
- * The `page-nav__*` class names are NOT props, for the reason `WikiRail`'s are
- * not: they are the convention both stylesheets already implement, and making
- * them configurable is how a convention forks. The empty `<div>` holds the
- * first article's left column so the next link stays in the right one.
+ * The `page-nav__*` class names are NOT props: they are the convention every
+ * stylesheet implements, and making them configurable is how a convention
+ * forks. The empty `<div>` holds the first article's left column so the next
+ * link stays in the right one.
  */
 export function PageNav({ prev, next, link: Link = Anchor, label = 'Article navigation', prevLabel = 'Previous', nextLabel = 'Next', prevGlyph = '\u2190', nextGlyph = '\u2192', }) {
     if (!prev && !next)

package/dist/react.d.ts

@@ -22,14 +22,6 @@ export interface SidebarState {
      */
     ready: boolean;
 }
-/**
- * Collapse state for a wiki rail: remembered across loads, defaulted from the
- * viewport only when the reader has never chosen.
- *
- * The reader's choice outranks the breakpoint. Someone who collapses the rail
- * on a laptop and then narrows the window has still collapsed the rail.
- */
-export declare function useCollapsibleSidebar(options?: SidebarOptions): SidebarState;
 export interface SidebarProviderProps extends SidebarOptions {
     children: ReactNode;
 }
@@ -286,8 +278,7 @@ export declare class ErrorBoundary extends Component<{
     children: ReactNode;
     /**
      * `error` is passed as well as `retry` because a fallback that cannot see
-     * what failed can only say "something went wrong" — which is what one of
-     * the copies this replaced said, while the other had the message and used it.
+     * what failed can only say "something went wrong".
      */
     fallback: (retry: () => void, error: unknown) => ReactNode;
     onError?: (error: unknown) => void;

package/dist/react.js

@@ -47,7 +47,7 @@ const readStored = (key) => {
  * The reader's choice outranks the breakpoint. Someone who collapses the rail
  * on a laptop and then narrows the window has still collapsed the rail.
  */
-export function useCollapsibleSidebar(options = {}) {
+function useCollapsibleSidebar(options = {}) {
     const { storageKey = 'wiki:sidebar', breakpoint = 1024 } = options;
     // Start open on the server and on the first client paint. SSR has no viewport
     // and no storage, so any other guess is a guaranteed mismatch on some loads.