wiki-formant 0.27.1 → 0.29.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wiki-formant",
-  "version": "0.27.1",
+  "version": "0.29.0",
   "description": "The portable half of a wiki: derived taxonomy and facet controls, a version-negotiating MCP transport, markdown twins, block rendering, a rich-text editor engine, and conditional-GET plumbing.",
   "type": "module",
   "license": "MIT",
@@ -22,10 +22,6 @@
     "*.css"
   ],
   "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    },
     "./taxonomy": {
       "types": "./dist/taxonomy.d.ts",
       "import": "./dist/taxonomy.js"
@@ -58,6 +54,10 @@
       "types": "./dist/rate-limit.d.ts",
       "import": "./dist/rate-limit.js"
     },
+    "./db": {
+      "types": "./dist/db.d.ts",
+      "import": "./dist/db.js"
+    },
     "./analytics": {
       "types": "./dist/analytics.d.ts",
       "import": "./dist/analytics.js"
@@ -142,14 +142,6 @@
       "types": "./dist/tiptap.d.ts",
       "import": "./dist/tiptap.js"
     },
-    "./rola": {
-      "types": "./dist/rola.d.ts",
-      "import": "./dist/rola.js"
-    },
-    "./x402": {
-      "types": "./dist/x402.d.ts",
-      "import": "./dist/x402.js"
-    },
     "./base.css": "./dist/base.css",
     "./block-views": {
       "types": "./dist/block-views.d.ts",
@@ -182,7 +174,8 @@
   },
   "bin": {
     "check-classes": "bin/check-classes.mjs",
-    "check-pages": "bin/check-pages.mjs"
+    "check-pages": "bin/check-pages.mjs",
+    "analytics-digest": "bin/analytics-digest.mjs"
   },
   "files": [
     "dist",
@@ -197,7 +190,6 @@
     "prepare": "git config core.hooksPath .githooks || true"
   },
   "devDependencies": {
-    "@radixdlt/rola": "^2.1.0",
     "@tiptap/core": "^2.10.0",
     "@tiptap/extension-code-block": "^2.10.0",
     "@tiptap/extension-image": "^2.27.3",
@@ -215,14 +207,12 @@
     "@types/react": "^19.0.0",
     "@types/sanitize-html": "^2.16.1",
     "fast-diff": "^1.3.0",
-    "jose": "^6.2.10",
     "jsdom": "^30.1.0",
     "react": "^19.2.4",
     "sanitize-html": "^2.17.7",
     "typescript": "^5.9.0"
   },
   "peerDependencies": {
-    "@radixdlt/rola": ">=2",
     "@tiptap/core": ">=2.10",
     "@tiptap/extension-code-block": ">=2.10",
     "@tiptap/extension-image": ">=2.10",
@@ -237,9 +227,9 @@
     "@tiptap/react": ">=2.10",
     "@tiptap/starter-kit": ">=2.10",
     "fast-diff": ">=1.3",
-    "jose": ">=5",
     "react": ">=18",
-    "sanitize-html": ">=2"
+    "sanitize-html": ">=2",
+    "pg": ">=8"
   },
   "peerDependenciesMeta": {
     "react": {
@@ -257,12 +247,6 @@
     "@tiptap/extension-code-block": {
       "optional": true
     },
-    "jose": {
-      "optional": true
-    },
-    "@radixdlt/rola": {
-      "optional": true
-    },
     "@tiptap/starter-kit": {
       "optional": true
     },
@@ -295,6 +279,9 @@
     },
     "fast-diff": {
       "optional": true
+    },
+    "pg": {
+      "optional": true
     }
   }
 }

package/dist/index.d.ts

@@ -1,22 +0,0 @@
-export * from './taxonomy.js';
-export * from './mcp.js';
-export * from './headings.js';
-export * from './links.js';
-export * from './markdown.js';
-export * from './markdown.js';
-export * from './http.js';
-export * from './pagination.js';
-export * from './versioning.js';
-export * from './rate-limit.js';
-export * from './analytics.js';
-export * from './blocks.js';
-export * from './text.js';
-export * from './maps.js';
-export * from './freshness.js';
-export * from './combobox.js';
-export * from './crawlers.js';
-export * from './revisions.js';
-export * from './feed.js';
-export * from './license.js';
-export * from './seeded.js';
-export * from './metadata.js';

package/dist/index.js

@@ -1,27 +0,0 @@
-// wiki-formant — the portable half of a wiki.
-//
-// Nothing here touches a database, a framework or a design system. Those are
-// the parts every wiki must own; these are the parts every wiki rebuilds and
-// then lets drift.
-export * from './taxonomy.js';
-export * from './mcp.js';
-export * from './headings.js';
-export * from './links.js';
-export * from './markdown.js';
-export * from './markdown.js';
-export * from './http.js';
-export * from './pagination.js';
-export * from './versioning.js';
-export * from './rate-limit.js';
-export * from './analytics.js';
-export * from './blocks.js';
-export * from './text.js';
-export * from './maps.js';
-export * from './freshness.js';
-export * from './combobox.js';
-export * from './crawlers.js';
-export * from './revisions.js';
-export * from './feed.js';
-export * from './license.js';
-export * from './seeded.js';
-export * from './metadata.js';

package/dist/rola.d.ts

@@ -1,127 +0,0 @@
-export interface AuthSession {
-    userId: string;
-    radixAddress: string;
-    personaAddress?: string;
-    displayName?: string;
-    expiresAt: Date;
-}
-export interface SignedChallenge {
-    challenge: string;
-    address: string;
-    proof: {
-        publicKey: string;
-        signature: string;
-        curve: 'curve25519' | 'secp256k1';
-    };
-}
-/**
- * The two Prisma delegates this needs, structurally. Both wikis' `Session` and
- * `Challenge` models already satisfy it, so the binding is
- * `{ session: prisma.session, challenge: prisma.challenge }`.
- */
-export interface RolaStore {
-    session: {
-        create(args: {
-            data: {
-                userId: string;
-                token: string;
-                expiresAt: Date;
-            };
-        }): Promise<unknown>;
-        findUnique(args: {
-            where: {
-                token: string;
-            };
-        }): Promise<{
-            id: string;
-            expiresAt: Date;
-        } | null>;
-        delete(args: {
-            where: {
-                id: string;
-            };
-        }): Promise<unknown>;
-        deleteMany(args: {
-            where: {
-                token: string;
-            };
-        }): Promise<unknown>;
-    };
-    challenge: {
-        create(args: {
-            data: {
-                challenge: string;
-                expiresAt: Date;
-            };
-        }): Promise<unknown>;
-        findUnique(args: {
-            where: {
-                challenge: string;
-            };
-        }): Promise<{
-            id: string;
-            expiresAt: Date;
-        } | null>;
-        delete(args: {
-            where: {
-                id: string;
-            };
-        }): Promise<unknown>;
-    };
-}
-/** What `await cookies()` already gives you, narrowed to what this uses. */
-export interface CookieJar {
-    get(name: string): {
-        value: string;
-    } | undefined;
-    set(name: string, value: string, options: {
-        httpOnly: boolean;
-        secure: boolean;
-        sameSite: 'lax';
-        expires: Date;
-        path: string;
-    }): void;
-    delete(name: string): void;
-}
-export interface RolaAuthConfig {
-    /** This wiki's session cookie. The one thing the two copies actually differed in. */
-    cookieName: string;
-    jwtSecret: Uint8Array;
-    store: RolaStore;
-    cookies: () => Promise<CookieJar>;
-    rola: {
-        expectedOrigin: string;
-        dAppDefinitionAddress: string;
-        networkId: number;
-        applicationName: string;
-    };
-    sessionDurationMs?: number;
-    challengeTtlSec?: number;
-    /** Defaults to `process.env.NODE_ENV === 'production'`. */
-    secureCookies?: boolean;
-}
-/**
- * A wallet address tells you which proof type it is, and getting it wrong is a
- * silent rejection: the ROLA library verifies an `identity_*` proof only under
- * `type: 'persona'`. One of the two copies this replaces hardcoded `'account'`
- * and so could never accept a persona login at all.
- */
-export declare function proofType(address: string): 'account' | 'persona' | null;
-export interface RolaAuth {
-    createSession(userId: string, radixAddress: string, personaAddress?: string, displayName?: string): Promise<string>;
-    getSession(request?: {
-        headers: {
-            get(name: string): string | null;
-        };
-    }): Promise<AuthSession | null>;
-    destroySession(): Promise<void>;
-    generateChallenge(): Promise<{
-        challenge: string;
-        expiresAt: Date;
-    }>;
-    verifySignedChallenge(signed: SignedChallenge): Promise<{
-        isValid: boolean;
-        error?: string;
-    }>;
-}
-export declare function createRolaAuth(config: RolaAuthConfig): RolaAuth;

package/dist/rola.js

@@ -1,150 +0,0 @@
-// rola.ts — Radix On-Ledger Authentication: challenge, proof, session.
-//
-// Parameterised on the two things a second wiki would differ in: the cookie
-// name and its dApp identity. It verifies persona (identity_*) proofs as well
-// as account proofs, and logs a failed verification so it is diagnosable.
-//
-// **One consumer.** caper's wallet auth never used this stack and acuiq gates
-// only its wiki editor, on a shared secret. Keep it — the
-// persona-proof fix and the error logging are worth not losing, and the ports
-// below are what make it reusable at all — but do not mistake it for a proven
-// shared abstraction. It is radix-wiki's auth that happens to live in a package.
-//
-// Storage and cookies are ports rather than imports. A Prisma client is
-// generated per repo and cannot be shared, and taking `next/headers` here would
-// bind the package to a framework it otherwise knows nothing about. Both ports
-// are shaped so the caller passes what it already has — the delegate and the
-// cookie jar — with no adapter to write.
-//
-// `jose` and `@radixdlt/rola` are optional peers: only a repo importing this
-// subpath needs them installed.
-import { SignJWT, jwtVerify } from 'jose';
-import { Rola } from '@radixdlt/rola';
-const DEFAULT_SESSION_MS = 7 * 24 * 60 * 60 * 1000;
-const DEFAULT_CHALLENGE_TTL_SEC = 300;
-const bytesToHex = (bytes) => Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
-/**
- * A wallet address tells you which proof type it is, and getting it wrong is a
- * silent rejection: the ROLA library verifies an `identity_*` proof only under
- * `type: 'persona'`. One of the two copies this replaces hardcoded `'account'`
- * and so could never accept a persona login at all.
- */
-export function proofType(address) {
-    if (address.startsWith('account_'))
-        return 'account';
-    if (address.startsWith('identity_'))
-        return 'persona';
-    return null;
-}
-export function createRolaAuth(config) {
-    const { cookieName, jwtSecret, store, cookies, sessionDurationMs = DEFAULT_SESSION_MS, challengeTtlSec = DEFAULT_CHALLENGE_TTL_SEC, secureCookies = process.env.NODE_ENV === 'production', } = config;
-    const rola = Rola(config.rola);
-    async function verifyToken(token) {
-        try {
-            const { payload } = await jwtVerify(token, jwtSecret);
-            const session = await store.session.findUnique({ where: { token } });
-            if (!session || session.expiresAt < new Date()) {
-                if (session)
-                    await store.session.delete({ where: { id: session.id } }).catch(() => { });
-                return null;
-            }
-            return {
-                userId: payload.userId,
-                radixAddress: payload.radixAddress,
-                personaAddress: payload.personaAddress,
-                displayName: payload.displayName,
-                expiresAt: new Date(payload.exp * 1000),
-            };
-        }
-        catch {
-            return null;
-        }
-    }
-    /** Consumes the challenge: a replayed one must not verify twice. */
-    async function validateChallenge(challenge) {
-        const stored = await store.challenge.findUnique({ where: { challenge } });
-        if (!stored || stored.expiresAt < new Date()) {
-            if (stored)
-                await store.challenge.delete({ where: { id: stored.id } });
-            return false;
-        }
-        await store.challenge.delete({ where: { id: stored.id } });
-        return true;
-    }
-    return {
-        async createSession(userId, radixAddress, personaAddress, displayName) {
-            const expiresAt = new Date(Date.now() + sessionDurationMs);
-            const token = await new SignJWT({ userId, radixAddress, personaAddress, displayName })
-                .setProtectedHeader({ alg: 'HS256' })
-                .setIssuedAt()
-                .setExpirationTime(expiresAt)
-                .setJti(crypto.randomUUID())
-                .sign(jwtSecret);
-            await store.session.create({ data: { userId, token, expiresAt } });
-            const jar = await cookies();
-            jar.set(cookieName, token, {
-                httpOnly: true,
-                secure: secureCookies,
-                sameSite: 'lax',
-                expires: expiresAt,
-                path: '/',
-            });
-            return token;
-        },
-        async getSession(request) {
-            const jar = await cookies();
-            const cookieToken = jar.get(cookieName)?.value;
-            if (cookieToken) {
-                const session = await verifyToken(cookieToken);
-                if (session)
-                    return session;
-            }
-            // Agents authenticate per-request with a Bearer token rather than a
-            // cookie, so the header is a second, equal route in — not a fallback.
-            if (request) {
-                const authHeader = request.headers.get('Authorization');
-                const bearerToken = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null;
-                if (bearerToken)
-                    return verifyToken(bearerToken);
-            }
-            return null;
-        },
-        async destroySession() {
-            const jar = await cookies();
-            const token = jar.get(cookieName)?.value;
-            if (token)
-                await store.session.deleteMany({ where: { token } });
-            jar.delete(cookieName);
-        },
-        async generateChallenge() {
-            const array = new Uint8Array(32);
-            crypto.getRandomValues(array);
-            const challenge = bytesToHex(array);
-            const expiresAt = new Date(Date.now() + challengeTtlSec * 1000);
-            await store.challenge.create({ data: { challenge, expiresAt } });
-            return { challenge, expiresAt };
-        },
-        async verifySignedChallenge(signedChallenge) {
-            try {
-                if (!(await validateChallenge(signedChallenge.challenge))) {
-                    console.error('ROLA: challenge validation failed', signedChallenge.challenge.slice(0, 16) + '...');
-                    return { isValid: false, error: 'Invalid or expired challenge' };
-                }
-                const type = proofType(signedChallenge.address);
-                if (!type) {
-                    throw new Error(`ROLA: unrecognized address prefix (expected account_* or identity_*): ${signedChallenge.address}`);
-                }
-                const result = await rola.verifySignedChallenge({ ...signedChallenge, type });
-                if (result.isErr()) {
-                    console.error('ROLA: verification failed', result.error.reason, result.error);
-                    return { isValid: false, error: result.error.reason };
-                }
-                return { isValid: true };
-            }
-            catch (error) {
-                console.error('ROLA verification error:', error);
-                return { isValid: false, error: 'Verification failed' };
-            }
-        },
-    };
-}

package/dist/x402.d.ts

@@ -1,95 +0,0 @@
-import type { EnvelopeGate, RpcRequest } from './mcp.js';
-/**
- * The slice of `@x402/core`'s `x402ResourceServer` this module calls.
- *
- * Method syntax, not properties: the real methods carry the library's own
- * `PaymentPayload` / `PaymentRequirements` types, and bivariant method
- * parameters are what lets a real server satisfy a port written in `unknown`.
- */
-export interface X402ServerPort {
-    buildPaymentRequirements(spec: {
-        scheme: 'exact';
-        network: string;
-        payTo: string;
-        price: string;
-        maxTimeoutSeconds: number;
-    }): Promise<unknown>;
-    createPaymentRequiredResponse(accepts: unknown, resource: {
-        url: string;
-        description: string;
-        mimeType: string;
-        serviceName: string;
-        tags: string[];
-    }, error: string, extensions: unknown, context: unknown, payload?: unknown): Promise<unknown>;
-    findMatchingRequirements(accepts: unknown, payload: unknown): unknown;
-    verifyPayment(payload: unknown, requirements: unknown, extensions: unknown, context: unknown): Promise<{
-        isValid: boolean;
-        invalidReason?: string;
-    }>;
-    settlePayment(payload: unknown, requirements: unknown, extensions: unknown, context: unknown): Promise<{
-        success?: boolean;
-    }>;
-}
-/** One priced surface, as the caller describes it. All of this is policy. */
-export interface PaidSurface {
-    /**
-     * Which envelope slot the challenge can travel in. A tool result carries
-     * `structuredContent`; a `resources/read` has no such shape and takes a
-     * JSON-RPC error instead.
-     */
-    kind: 'tool' | 'resource';
-    /** Canonical URL of the thing being sold, for the 402 body and the catalogue. */
-    resource: string;
-    price: string;
-    mimeType: string;
-    description: string;
-    /** The sentence an unpaid caller reads. Say what else is free. */
-    unpaidMessage: string;
-    /**
-     * Bazaar's MCP discovery shape, so an agent that would pay can find this in
-     * the catalogue instead of finding it by being refused. The shape is defined
-     * for tools, not resources — a `resources/read` has no tool name or input
-     * schema to catalogue — so leave it undefined there rather than describing it
-     * as something it is not. Declared through `GateOptions.declareDiscovery`,
-     * and only for an entry that has actually been asked for.
-     */
-    discovery?: Record<string, unknown>;
-    /** Passed through to the facilitator as call context, verbatim. */
-    context: unknown;
-}
-export interface GateOptions {
-    /**
-     * Built lazily, and allowed to throw. An unreachable facilitator throws out
-     * of `initialize()` rather than returning anything, and the gate turns that
-     * into a withheld paid entry instead of a 500 that would take the free tools
-     * in the same batch down with it.
-     */
-    server: () => Promise<X402ServerPort>;
-    /** Which paid surface, if any, an envelope entry addresses. */
-    resolve: (entry: RpcRequest) => PaidSurface | null;
-    network: string;
-    payTo: string;
-    maxTimeoutSeconds: number;
-    serviceName: string;
-    tags: string[];
-    /** Must match the cap `handleMcp` will apply. See the passthrough below. */
-    maxBatch: number;
-    /** False when this deployment charges for nothing. Everything passes through. */
-    enabled?: boolean;
-    /**
-     * `@x402/extensions/bazaar`'s `declareDiscoveryExtension`, reached however
-     * the caller reaches it — this package does not import @x402 and will not
-     * start. Keep it a lazy `import()` on that side: it is only ever called for a
-     * surface somebody has actually requested, so the free path never loads it.
-     */
-    declareDiscovery?: (discovery: Record<string, unknown>) => Promise<unknown>;
-}
-/**
- * Verify payment for every paid entry, withhold the unpaid ones, and return a
- * `finish` that reassembles the response.
- *
- * The ordering mirrors `withX402`: verify BEFORE dispatch, settle only AFTER
- * the handler produced something that is not an error. A tool that raises
- * cancels rather than settles — the caller pays for an answer, not an attempt.
- */
-export declare function gatePaidCalls(raw: unknown, options: GateOptions): Promise<EnvelopeGate>;