wiki-formant 0.27.1 → 0.29.0

package/dist/dom.js

@@ -322,3 +322,60 @@ export function scrollTables(html) {
         return hadBox ? tag : SCROLL_BOX + tag;
     });
 }
+// ---- analytics beacon -------------------------------------------------------
+let beaconEndpoint = '/api/view';
+let beaconStarted = false;
+const sendBeacon = (body) => navigator.sendBeacon?.(beaconEndpoint, JSON.stringify(body));
+/**
+ * Report each page view to the site's own `endpoint`, whose route hands it to
+ * `collect` (`wiki-formant/analytics`). Same-origin, so no third-party script
+ * runs and no blocklist names the request.
+ *
+ * A client-side router moves between pages with `history.pushState`, which no
+ * load event marks, so both history writes are wrapped and a view is sent
+ * whenever the path changes; a change to the query or hash alone is not a page.
+ * A click on a link to another host is sent as an "Outbound Link: Click" event
+ * carrying its `url`. Starts once per page load however often it is called, so
+ * React's doubled effects in development send one view, not two.
+ */
+export function startBeacon(endpoint = '/api/view') {
+    if (beaconStarted || typeof window === 'undefined')
+        return;
+    beaconStarted = true;
+    beaconEndpoint = endpoint;
+    let last = '';
+    let first = true;
+    const view = () => {
+        if (location.pathname === last)
+            return;
+        last = location.pathname;
+        // document.referrer belongs to the page load, so only its first view carries it.
+        sendBeacon({
+            path: last,
+            referrer: first ? document.referrer : undefined,
+            utm: new URLSearchParams(location.search).get('utm_source') ?? undefined,
+        });
+        first = false;
+    };
+    for (const method of ['pushState', 'replaceState']) {
+        const write = history[method];
+        history[method] = function (...args) {
+            write.apply(this, args);
+            view();
+        };
+    }
+    addEventListener('popstate', view);
+    document.addEventListener('click', e => {
+        const a = e.target?.closest?.('a[href]');
+        if (a instanceof HTMLAnchorElement && /^https?:$/.test(a.protocol) && a.host !== location.host) {
+            track('Outbound Link: Click', { url: a.href });
+        }
+    }, { capture: true });
+    view();
+}
+/** Record a named event from the browser, on the endpoint `startBeacon` was given. */
+export function track(name, props) {
+    if (typeof window === 'undefined')
+        return;
+    sendBeacon({ name, path: location.pathname, props });
+}

package/dist/feed.d.ts

@@ -53,7 +53,6 @@ export interface FeedChannel {
  * exist to prevent. An empty feed has no build date rather than a fictional one.
  */
 export declare function renderFeed(channel: FeedChannel, items: readonly FeedItem[]): string;
-export declare const FEED_HEADERS: Record<string, string>;
 /**
  * The feed as a response, with the validators a poller revalidates against.
  *

package/dist/feed.js

@@ -89,7 +89,7 @@ export function renderFeed(channel, items) {
     ].join('\n');
 }
 const lastBuild = (channel, items) => channel.lastBuild ?? items.reduce((max, item) => (!max || item.date > max ? item.date : max), null);
-export const FEED_HEADERS = {
+const FEED_HEADERS = {
     'Content-Type': 'application/rss+xml; charset=utf-8',
     'Cache-Control': 'public, s-maxage=3600, stale-while-revalidate=86400',
 };

package/dist/freshness.d.ts

@@ -39,8 +39,13 @@ type When = Date | string | number;
  * timestamp formatted in the server's zone, or the browser's, lands on the
  * previous day for half the world, and the server and the hydrating client
  * disagree about which day it is.
+ *
+ * `locale` defaults to `en-US`; `{ locale: 'en-GB', month: 'long' }` reads
+ * `19 September 2026`.
  */
-export declare function formatDay(date: When, options?: Intl.DateTimeFormatOptions): string;
+export declare function formatDay(date: When, options?: Intl.DateTimeFormatOptions & {
+    locale?: string;
+}): string;
 /**
  * - `compact`: `now`, `2m`, `3h`, `5d`, `2mo`, `1y` — for dense rows.
  * - `short`: `just now`, `2m ago` … `1y ago`.

package/dist/freshness.js

@@ -60,14 +60,18 @@ const toMs = (d) => (typeof d === 'number' ? d : d instanceof Date ? d.getTime()
  * timestamp formatted in the server's zone, or the browser's, lands on the
  * previous day for half the world, and the server and the hydrating client
  * disagree about which day it is.
+ *
+ * `locale` defaults to `en-US`; `{ locale: 'en-GB', month: 'long' }` reads
+ * `19 September 2026`.
  */
-export function formatDay(date, options) {
-    return new Date(toMs(date)).toLocaleDateString('en-US', {
+export function formatDay(date, options = {}) {
+    const { locale = 'en-US', ...format } = options;
+    return new Date(toMs(date)).toLocaleDateString(locale, {
         year: 'numeric',
         month: 'short',
         day: 'numeric',
         timeZone: 'UTC',
-        ...options,
+        ...format,
     });
 }
 const plural = (n, unit) => `${n} ${unit}${n === 1 ? '' : 's'} ago`;

package/dist/http.d.ts

@@ -123,6 +123,16 @@ export interface CorpusValidators {
     etag: string;
     lastModified: string;
 }
+/**
+ * The validators for an aggregate: the ETag seeded from `seed` (the depth or
+ * scope, then the row count) with the newest stamp appended, and that stamp as
+ * Last-Modified. A corpus with no rows, or stamps all null, dates from the
+ * epoch, so an empty corpus still revalidates rather than throwing.
+ *
+ * Every wiki here wrote this after its `aggregate` call: newest of the `_max`
+ * columns, `?? new Date(0)`, then the same two lines.
+ */
+export declare function corpusValidatorsFrom(seed: ReadonlyArray<string | number | null | undefined>, stamps: ReadonlyArray<Date | null | undefined>): CorpusValidators;
 /**
  * A GET handler serving `build()` under corpus validators — or a 304 instead.
  *

package/dist/http.js

@@ -191,6 +191,19 @@ export function pageLine(opts) {
     const stamp = opts.updated ? isoDate(opts.updated) : '';
     return `- [${opts.title}](${opts.url})${excerpt}${stamp ? ` _(updated ${stamp})_` : ''}`;
 }
+/**
+ * The validators for an aggregate: the ETag seeded from `seed` (the depth or
+ * scope, then the row count) with the newest stamp appended, and that stamp as
+ * Last-Modified. A corpus with no rows, or stamps all null, dates from the
+ * epoch, so an empty corpus still revalidates rather than throwing.
+ *
+ * Every wiki here wrote this after its `aggregate` call: newest of the `_max`
+ * columns, `?? new Date(0)`, then the same two lines.
+ */
+export function corpusValidatorsFrom(seed, stamps) {
+    const newest = stamps.reduce((max, d) => (d instanceof Date && d.getTime() > max.getTime() ? d : max), new Date(0));
+    return { etag: corpusEtag([...seed, newest]), lastModified: newest.toUTCString() };
+}
 /**
  * A GET handler serving `build()` under corpus validators — or a 304 instead.
  *

package/dist/link-check.d.ts

@@ -42,30 +42,6 @@ export declare function probeUrlFor(url: string): string;
  * exactly as a hand re-probe does it.
  */
 export declare function perHost<T>(url: string, fn: () => Promise<T>): Promise<T>;
-/**
- * Probe one URL, honestly.
- *
- * A timeout is not a death and neither is a dropped connection: slow replays —
- * web.archive.org above all, which a sweep leans on to rescue dying citations —
- * exceed the ordinary budget and land as status 0. So a status-0 result with a
- * transient code earns one more attempt on the longer budget before it is
- * reported. A 404 does not: it is an answer.
- */
-export declare function probeUrl(url: string, opts?: ProbeOptions): Promise<Probe>;
-export declare const YOUTUBE_EMBED: RegExp;
-/**
- * A YouTube `/embed/<id>` URL answers 200 for private, deleted and
- * playback-restricted videos alike, so HEADing it can never spot a dead hero
- * video. oEmbed can:
- *
- *   200 → public and embeddable | 404 → deleted | 401/403 → private or embedding off
- */
-export declare function probeYouTube(videoId: string, opts?: ProbeOptions): Promise<{
-    status: number;
-    ok: boolean;
-    reason?: string;
-    error?: string;
-}>;
 /** An external anchor, with a video treated as a video. */
 export declare function probeExternal(url: string, opts?: ProbeOptions): Promise<Probe & {
     videoId?: string;

package/dist/link-check.js

@@ -134,7 +134,7 @@ async function attempt(url, budgetMs) {
  * transient code earns one more attempt on the longer budget before it is
  * reported. A 404 does not: it is an answer.
  */
-export async function probeUrl(url, opts = {}) {
+async function probeUrl(url, opts = {}) {
     const { timeoutMs, slowTimeoutMs } = { ...DEFAULTS, ...opts };
     const target = probeUrlFor(url);
     const first = await perHost(target, () => attempt(target, timeoutMs));
@@ -145,7 +145,7 @@ export async function probeUrl(url, opts = {}) {
     return { ...second, url };
 }
 // ---- YouTube ----------------------------------------------------------------
-export const YOUTUBE_EMBED = /^https?:\/\/(?:www\.)?(?:youtube-nocookie\.com|youtube\.com)\/embed\/([\w-]+)/;
+const YOUTUBE_EMBED = /^https?:\/\/(?:www\.)?(?:youtube-nocookie\.com|youtube\.com)\/embed\/([\w-]+)/;
 /**
  * The same video cited as a LINK rather than an iframe. `youtu.be/<id>` 303s and
  * `youtube.com/watch?v=<id>` 200s for deleted and private videos alike, so an
@@ -160,7 +160,7 @@ const YOUTUBE_WATCH = /^https?:\/\/(?:(?:www\.)?youtube\.com\/(?:watch\?(?:[^#]*
  *
  *   200 → public and embeddable | 404 → deleted | 401/403 → private or embedding off
  */
-export async function probeYouTube(videoId, opts = {}) {
+async function probeYouTube(videoId, opts = {}) {
     const { timeoutMs } = { ...DEFAULTS, ...opts };
     const oembed = `https://www.youtube.com/oembed?url=https%3A//www.youtube.com/watch%3Fv%3D${videoId}&format=json`;
     try {

package/dist/mcp.d.ts

@@ -10,7 +10,7 @@ export declare const MCP_MODERN_VERSIONS: readonly ["2026-07-28"];
  * endpoint speak both, and a legacy client meeting a dual-era server works;
  * going modern-only would fail the handshake of every client in the field.
  */
-export declare const MCP_LEGACY_VERSIONS: readonly ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
+declare const MCP_LEGACY_VERSIONS: readonly ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
 /**
  * Every version this transport speaks, newest first. It is the `supported` list
  * a `-32022` names and the `supportedVersions` of `server/discover`, so a modern
@@ -239,8 +239,8 @@ export declare const withAdjustments: <T extends object>(args: {
 }, result: T) => T | (T & {
     adjustments: readonly ArgAdjustment[];
 });
-/** One entry in a JSON-RPC envelope. Exported because `wiki-formant/x402`
- *  gates the envelope before `handleMcp` ever sees it. */
+/** One entry in a JSON-RPC envelope. Exported for an `McpServerConfig.gate`,
+ *  which rewrites the envelope before `handleMcp` sees it (acuiq2's x402 gate). */
 export type RpcRequest = {
     jsonrpc: '2.0';
     id: string | number | null;
@@ -250,8 +250,9 @@ export type RpcRequest = {
 /** How many entries one JSON-RPC batch may carry. Quoted by the conformance suite. */
 export declare const DEFAULT_MAX_BATCH = 20;
 /**
- * A tool result envelope. Exported because `x402.ts` builds the same shape when
- * it withholds a paid call, and had grown two more copies of it doing so.
+ * A tool result envelope. Exported for an envelope gate, which builds the same
+ * shape when it withholds a call: acuiq2's x402 gate had grown two more copies
+ * of it doing so.
  */
 export declare const toolText: (id: RpcRequest["id"], text: string, isError?: boolean, extra?: Record<string, unknown>) => {
     jsonrpc: "2.0";

package/dist/mcp.js

@@ -25,7 +25,7 @@ export const MCP_MODERN_VERSIONS = ['2026-07-28'];
  * endpoint speak both, and a legacy client meeting a dual-era server works;
  * going modern-only would fail the handshake of every client in the field.
  */
-export const MCP_LEGACY_VERSIONS = ['2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05'];
+const MCP_LEGACY_VERSIONS = ['2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05'];
 /**
  * Every version this transport speaks, newest first. It is the `supported` list
  * a `-32022` names and the `supportedVersions` of `server/discover`, so a modern
@@ -157,8 +157,9 @@ const rpcError = (id, code, message, data) => ({
     error: { code, message, ...(data ? { data } : {}) },
 });
 /**
- * A tool result envelope. Exported because `x402.ts` builds the same shape when
- * it withholds a paid call, and had grown two more copies of it doing so.
+ * A tool result envelope. Exported for an envelope gate, which builds the same
+ * shape when it withholds a call: acuiq2's x402 gate had grown two more copies
+ * of it doing so.
  */
 export const toolText = (id, text, isError = false, extra = {}) => ({
     jsonrpc: '2.0',

package/dist/rate-limit.d.ts

@@ -3,19 +3,38 @@ export interface RateLimitOptions {
     capacity: number;
     /** Tokens added per second: the sustained rate. */
     refillPerSec: number;
+    /**
+     * Running dry blocks `blockKey` outright for this long, rather than letting
+     * the bucket refill a token at a time. For a caller already established as
+     * abusive, the trickle the refill allows is the wrong answer.
+     */
+    blockMs?: number;
+    /**
+     * What a block shuts out. Default the bucket's own key; pass the bare
+     * address (`rest:1.2.3.4`) to lock a caller out of every endpoint that names
+     * the same `blockKey` once it blows one endpoint's budget.
+     */
+    blockKey?: string;
 }
 export type RateLimitResult = {
     ok: true;
     remaining: number;
-} | {
+}
+/** `blocked` is true when an earlier block refused the call, rather than this one's bucket. */
+ | {
     ok: false;
     retryAfterSec: number;
+    blocked?: boolean;
 };
 /**
  * Spend one token against `key`.
  *
  * Keys are namespaced by the caller (`"mcp:1.2.3.4"`, `"write:page:17"`), so
  * one map backs every limiter in a process without them colliding.
+ *
+ * With `blockMs`, a block on `blockKey` is checked before any token is spent,
+ * and running the bucket dry starts one; the refusal then states the block's
+ * length as its wait.
  */
 export declare function rateLimit(key: string, opts: RateLimitOptions): RateLimitResult;
 /** Anything with a header getter: a `Request`'s headers, or Next's `headers()`. */
@@ -23,7 +42,14 @@ export interface HeaderReader {
     get(name: string): string | null | undefined;
 }
 /**
- * The caller's address, from the proxy header the edge sets.
+ * The caller's address, from the header the edge sets.
+ *
+ * `x-real-ip` first: Vercel sets it to the connecting client and overwrites any
+ * inbound copy, so a client cannot choose it. The leftmost `x-forwarded-for`
+ * entry is only as trustworthy as every proxy in front of the app — one that
+ * appends rather than replaces hands the client the first slot, and with it a
+ * fresh bucket and a fresh visitor per request. It stays as the fallback for a
+ * host that sets no `x-real-ip`.
  *
  * Falls back to a single shared bucket rather than to per-caller buckets, so an
  * unidentifiable caller is still limited — collectively, but limited. Keying on

package/dist/rate-limit.js

@@ -14,14 +14,53 @@
 const buckets = new Map();
 /** Bounds memory under high-cardinality keying — one bucket per attacker IP. */
 const MAX_KEYS = 10_000;
+/**
+ * Blocks, held as an expiry timestamp rather than a setTimeout: a pending timer
+ * keeps a serverless instance's event loop alive for no reason.
+ */
+const blocks = new Map();
+/** Seconds left on a block, or 0. An expired block is dropped on the way past. */
+function blockedFor(key, now) {
+    const until = blocks.get(key);
+    if (until === undefined)
+        return 0;
+    if (now < until)
+        return Math.ceil((until - now) / 1000);
+    blocks.delete(key);
+    return 0;
+}
+function block(key, until, now) {
+    if (blocks.size >= MAX_KEYS) {
+        for (const [k, expiry] of blocks)
+            if (expiry <= now)
+                blocks.delete(k);
+        // Still full of live blocks: the oldest goes, as with buckets.
+        if (blocks.size >= MAX_KEYS) {
+            const oldest = blocks.keys().next().value;
+            if (oldest !== undefined)
+                blocks.delete(oldest);
+        }
+    }
+    blocks.set(key, until);
+}
 /**
  * Spend one token against `key`.
  *
  * Keys are namespaced by the caller (`"mcp:1.2.3.4"`, `"write:page:17"`), so
  * one map backs every limiter in a process without them colliding.
+ *
+ * With `blockMs`, a block on `blockKey` is checked before any token is spent,
+ * and running the bucket dry starts one; the refusal then states the block's
+ * length as its wait.
  */
 export function rateLimit(key, opts) {
     const now = Date.now();
+    const blockKey = opts.blockKey ?? key;
+    if (opts.blockMs) {
+        const blockedSec = blockedFor(blockKey, now);
+        if (blockedSec)
+            return { ok: false, retryAfterSec: blockedSec, blocked: true };
+    }
     const existing = buckets.get(key);
     if (!existing && buckets.size >= MAX_KEYS) {
         // Map iteration is insertion-ordered, so this evicts the oldest key.
@@ -35,13 +74,24 @@ export function rateLimit(key, opts) {
     bucket.updatedAt = now;
     buckets.set(key, bucket);
     if (bucket.tokens < 1) {
+        if (opts.blockMs) {
+            block(blockKey, now + opts.blockMs, now);
+            return { ok: false, retryAfterSec: Math.ceil(opts.blockMs / 1000) };
+        }
         return { ok: false, retryAfterSec: Math.ceil((1 - bucket.tokens) / opts.refillPerSec) };
     }
     bucket.tokens -= 1;
     return { ok: true, remaining: Math.floor(bucket.tokens) };
 }
 /**
- * The caller's address, from the proxy header the edge sets.
+ * The caller's address, from the header the edge sets.
+ *
+ * `x-real-ip` first: Vercel sets it to the connecting client and overwrites any
+ * inbound copy, so a client cannot choose it. The leftmost `x-forwarded-for`
+ * entry is only as trustworthy as every proxy in front of the app — one that
+ * appends rather than replaces hands the client the first slot, and with it a
+ * fresh bucket and a fresh visitor per request. It stays as the fallback for a
+ * host that sets no `x-real-ip`.
  *
  * Falls back to a single shared bucket rather than to per-caller buckets, so an
  * unidentifiable caller is still limited — collectively, but limited. Keying on
@@ -50,8 +100,9 @@ export function rateLimit(key, opts) {
  * meant to catch.
  */
 export function clientIp(headers) {
-    const forwarded = headers.get('x-forwarded-for');
-    return forwarded?.split(',')[0]?.trim() || headers.get('x-real-ip')?.trim() || 'anon';
+    return (headers.get('x-real-ip')?.trim() ||
+        headers.get('x-forwarded-for')?.split(',')[0]?.trim() ||
+        'anon');
 }
 /** `prefix:ip` — the key `rateLimit` expects for a per-IP gate. */
 export function clientKey(prefix, headers) {
@@ -109,6 +160,7 @@ export function withRateLimit(res, result, opts) {
 /** Test seam: the bucket map is module state and outlives a single test. */
 export function resetRateLimits() {
     buckets.clear();
+    blocks.clear();
 }
 // ---- the MCP budget ---------------------------------------------------------
 /**

package/dist/react.d.ts

@@ -444,3 +444,10 @@ export type { WikiLinkComponent, WikiLinkProps } from './react-server.js';
 export declare function useArticlePasses(ref: RefObject<HTMLElement | null>, deps: DependencyList): void;
 /** Tweet placeholders hydrated, and their iframes kept sized to the posted height. */
 export declare function useTweetEmbeds(ref: RefObject<HTMLElement | null>, deps: DependencyList): void;
+/**
+ * Counts the page views of the app it is mounted in: place it once, in the root
+ * layout. `endpoint` is the route that hands the beacon to `collect`.
+ */
+export declare function Beacon({ endpoint }: {
+    endpoint?: string;
+}): null;

package/dist/react.js

@@ -27,7 +27,7 @@ import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-run
 //      state on <html> before first paint. The hook keeps that attribute in
 //      sync afterwards, so CSS has one source of truth either side of hydration.
 import { railBreakpointMismatch, readRailFloating, resolveSidebarOpen, SIDEBAR_ATTRIBUTE, } from './sidebar.js';
-import { activateTabGroups, addCopyButtons, hydrateTweetEmbeds, onTweetResize, sizeTweetEmbeds, sortTables } from './dom.js';
+import { activateTabGroups, addCopyButtons, hydrateTweetEmbeds, onTweetResize, sizeTweetEmbeds, sortTables, startBeacon } from './dom.js';
 import { comboboxAria } from './combobox.js';
 import { Component, createContext, createElement, useCallback, useContext, useEffect, useId, useMemo, useRef, useState, } from 'react';
 const readStored = (key) => {
@@ -820,3 +820,11 @@ export function useTweetEmbeds(ref, deps) {
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, deps);
 }
+/**
+ * Counts the page views of the app it is mounted in: place it once, in the root
+ * layout. `endpoint` is the route that hands the beacon to `collect`.
+ */
+export function Beacon({ endpoint = '/api/view' }) {
+    useEffect(() => startBeacon(endpoint), [endpoint]);
+    return null;
+}

package/dist/validation.d.ts

@@ -19,6 +19,35 @@ export declare function validateLinkGroups(groups: unknown): boolean;
 export declare function validateCodeTabs(tabs: unknown): boolean;
 /** `[{ value, label, suffix? }]` — a stats block's cards. */
 export declare function validateStatItems(items: unknown): boolean;
+/**
+ * The most rows an author-supplied count may ask for. Every `limit` and every
+ * `pageIds` list ends up in a database `take:` or `in:`, so the bound belongs
+ * between the editor and the query: a fractional `take` is a validation error
+ * against an Int column and an unbounded one is a table scan on every render.
+ */
+export declare const MAX_BLOCK_ROWS = 100;
+/** Clamp an author-supplied row count to a positive integer within the cap. The read-side twin of the check below. */
+export declare function blockLimit(value: unknown, fallback: number, max?: number): number;
+export interface CoreAtomicValidatorOptions {
+    /**
+     * Whether one `pageIds` entry is an id this wiki can look up. The format is
+     * each wiki's own — a cuid, an Int read back with `Number()`, a
+     * `section/slug` — so the default accepts any string.
+     */
+    pageId?: (id: string) => boolean;
+    /** Default `MAX_BLOCK_ROWS`. */
+    maxRows?: number;
+}
+/**
+ * The leaf checks for the core types, as one function a repo's `validateAtomic`
+ * falls through to: `default: return core(b)`. False for any type outside the
+ * core, so the repo's own cases still decide its native types.
+ *
+ * `recentPages.limit` must be a whole number within the cap and `pageIds` no
+ * longer than it — caper's rule, which the other two lacked. A scope field
+ * (`tagPath`, `section`) is a string when present.
+ */
+export declare function coreAtomicValidator(opts?: CoreAtomicValidatorOptions): (block: Record<string, unknown>) => boolean;
 export interface BlockValidatorOptions {
     /** True for a type this wiki knows at all. */
     isKnownType: (type: string) => boolean;

package/dist/validation.js

@@ -72,6 +72,57 @@ export function validateStatItems(items) {
             (typeof s.value === 'string' || typeof s.value === 'number') &&
             (s.suffix === undefined || s.suffix === null || typeof s.suffix === 'string')));
 }
+// ---- the core leaf set ------------------------------------------------------
+/**
+ * The most rows an author-supplied count may ask for. Every `limit` and every
+ * `pageIds` list ends up in a database `take:` or `in:`, so the bound belongs
+ * between the editor and the query: a fractional `take` is a validation error
+ * against an Int column and an unbounded one is a table scan on every render.
+ */
+export const MAX_BLOCK_ROWS = 100;
+/** Clamp an author-supplied row count to a positive integer within the cap. The read-side twin of the check below. */
+export function blockLimit(value, fallback, max = MAX_BLOCK_ROWS) {
+    const n = typeof value === 'number' && Number.isFinite(value) ? Math.floor(value) : fallback;
+    return Math.min(Math.max(n, 1), max);
+}
+const okLimit = (value, max) => Number.isSafeInteger(value) && value > 0 && value <= max;
+const optionalString = (v) => v === undefined || typeof v === 'string';
+/**
+ * The leaf checks for the core types, as one function a repo's `validateAtomic`
+ * falls through to: `default: return core(b)`. False for any type outside the
+ * core, so the repo's own cases still decide its native types.
+ *
+ * `recentPages.limit` must be a whole number within the cap and `pageIds` no
+ * longer than it — caper's rule, which the other two lacked. A scope field
+ * (`tagPath`, `section`) is a string when present.
+ */
+export function coreAtomicValidator(opts = {}) {
+    const { pageId = () => true, maxRows = MAX_BLOCK_ROWS } = opts;
+    return b => {
+        switch (b.type) {
+            case 'content':
+                return typeof b.text === 'string';
+            case 'recentPages':
+                return okLimit(b.limit, maxRows) && optionalString(b.tagPath) && optionalString(b.section);
+            case 'pageList':
+                return (Array.isArray(b.pageIds) &&
+                    b.pageIds.length <= maxRows &&
+                    b.pageIds.every(id => typeof id === 'string' && pageId(id)));
+            case 'codeTabs':
+                return validateCodeTabs(b.tabs);
+            case 'stats':
+                return validateStatItems(b.items);
+            case 'banner':
+                return typeof b.variant === 'string';
+            case 'references':
+                return validateReferenceItems(b.items);
+            case 'linkGrid':
+                return validateLinkGroups(b.groups);
+            default:
+                return false;
+        }
+    };
+}
 /**
  * The block-tree walk, with one wiki's leaf switch plugged into it. The caller
  * keeps its own type parameter, so this stays free of any repo's types while