wiki-formant 0.30.0 → 0.33.0

package/dist/headers.js

@@ -0,0 +1,78 @@
+// headers.ts — the response headers every origin sends, and the CSP they share.
+//
+// Four `next.config.ts` files carried the same six headers and four
+// hand-written policies, on the stated grounds that the config could not import
+// this package. It could not because no subpath had a `default` condition, and
+// Next resolves a config's imports the way `require` does; with one, Node 24
+// loads the ESM module there unchanged. So the headers live here now, and the
+// pairing the sanitiser's comment asked readers to keep by hand — `frame-src`
+// against `DEFAULT_IFRAME_HOSTS` — is one list read twice. While it was kept by
+// hand, one origin's policy dropped the bare `youtube.com` and
+// `youtube-nocookie.com` its sanitiser kept, so those embeds survived cleaning
+// and then rendered blank.
+//
+// Zero imports, so a config pays for nothing it does not use.
+/**
+ * The embed hosts the editor's iframe, YouTube, tweet and map nodes produce:
+ * the sanitiser's default `iframeHosts` and the default `frame-src`, so an
+ * embed that clears one clears the other.
+ */
+export const DEFAULT_IFRAME_HOSTS = [
+    'www.youtube.com', 'youtube.com',
+    'www.youtube-nocookie.com', 'youtube-nocookie.com',
+    'platform.twitter.com',
+    'www.google.com', 'maps.google.com',
+    'embed.apple.com', 'maps.apple.com',
+];
+/** `frame-src` sources for a host list — the one a sanitiser was given. */
+export const frameSources = (hosts = DEFAULT_IFRAME_HOSTS) => hosts.length ? hosts.map(h => `https://${h}`) : ["'none'"];
+/**
+ * The policy all four origins shared line for line. Everything a site adds is
+ * a source list it hands `contentSecurityPolicy`, which replaces the default
+ * for that directive rather than appending, so a reader sees the whole list.
+ */
+export const BASE_CSP = {
+    'default-src': ["'self'"],
+    'base-uri': ["'self'"],
+    'object-src': ["'none'"],
+    'frame-ancestors': ["'none'"],
+    'form-action': ["'self'"],
+    // Next's hydration scripts are inline. A nonce removes this, and a nonce
+    // makes every page it covers render per request — caper takes it on its
+    // dynamic routes only.
+    'script-src': ["'self'", "'unsafe-inline'"],
+    'style-src': ["'self'", "'unsafe-inline'"],
+    'font-src': ["'self'", 'data:'],
+    'img-src': ["'self'", 'data:'],
+    'connect-src': ["'self'"],
+    'frame-src': frameSources(),
+};
+/**
+ * The policy string: `BASE_CSP` with each directive in `directives` replacing
+ * its default. An empty list drops the directive.
+ */
+export function contentSecurityPolicy(directives = {}) {
+    return Object.entries({ ...BASE_CSP, ...directives })
+        .filter(([, sources]) => sources?.length)
+        .map(([name, sources]) => `${name} ${sources.join(' ')}`)
+        .join('; ');
+}
+/**
+ * The six headers every route sends, plus the policy when one is given.
+ *
+ * Pass the policy only where it is enforced — production. Next's dev runtime
+ * is inline and `eval`, so every origin here exempts dev, and the switch is the
+ * caller's because only the caller knows what dev means for it. An origin that
+ * sets its policy per request (a nonce) passes none.
+ */
+export function securityHeaders(csp) {
+    return [
+        ...(csp ? [{ key: 'Content-Security-Policy', value: csp }] : []),
+        { key: 'X-Frame-Options', value: 'DENY' },
+        { key: 'X-Content-Type-Options', value: 'nosniff' },
+        { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+        { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },
+        { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
+        { key: 'X-DNS-Prefetch-Control', value: 'on' },
+    ];
+}

package/dist/http.d.ts

@@ -148,3 +148,41 @@ export declare function corpusValidatorsFrom(seed: ReadonlyArray<string | number
  * in the corpus changed.
  */
 export declare function corpusRoute(validators: () => Promise<CorpusValidators> | CorpusValidators, build: () => Promise<string> | string, headers?: (etag: string, lastModified: string) => Record<string, string>): (request: Request) => Promise<Response>;
+/** JSON with a status or a full init, as a web-standard `Response`. */
+export declare function json(data: unknown, init?: number | ResponseInit): Response;
+/**
+ * The error answers every route handler gives, as `{ error, ...extra }`.
+ *
+ * One repo had these, one had a second convention with a third copy inside a
+ * single route, and two answered with whatever `Response.json` call was nearest
+ * — so the same mistake came back as `Unauthorized`, `Not authorized.` or a
+ * bare status depending on which origin an agent asked. `extra` carries what a
+ * surface adds to the body (a machine-readable `code`, a hint) without a fourth
+ * shape.
+ */
+export declare const errors: {
+    readonly badRequest: (message: string, extra?: Record<string, unknown>) => Response;
+    readonly unauthorized: (message?: string, extra?: Record<string, unknown>) => Response;
+    readonly forbidden: (message?: string, extra?: Record<string, unknown>) => Response;
+    readonly notFound: (message?: string, extra?: Record<string, unknown>) => Response;
+    /** States its own wait: a 429 without `Retry-After` is retried immediately, extending the block. */
+    readonly tooManyRequests: (retryAfterSec: number, message?: string, extra?: Record<string, unknown>) => Response;
+    readonly internal: (message?: string, extra?: Record<string, unknown>) => Response;
+};
+/**
+ * A caller-fixable failure thrown from deep inside a handler, answered with
+ * its own status and message by `handleRoute`. Anything else thrown is a bug,
+ * answered with a generic 500 so its message never reaches the caller.
+ */
+export declare class HttpError extends Error {
+    status: number;
+    extra?: Record<string, unknown> | undefined;
+    constructor(status: number, message: string, extra?: Record<string, unknown> | undefined);
+}
+/**
+ * Run a handler; a thrown `HttpError` becomes its own answer, anything else a
+ * logged 500 that names nothing internal. One handler here echoed every
+ * exception's message to the caller, which is how a database error's text
+ * becomes public.
+ */
+export declare function handleRoute(fn: () => Promise<Response>, errorMsg?: string): Promise<Response>;

package/dist/http.js

@@ -1,4 +1,5 @@
-// http.ts — conditional-GET plumbing for text corpus endpoints.
+// http.ts — conditional-GET plumbing for text corpus endpoints, and the error
+// answers every route handler gives (at the foot).
 //
 // The three llms depths (llms.txt / llms-index.txt / llms-full.txt) are the
 // most-recrawled URLs a wiki serves and the most expensive to render. With a
@@ -225,3 +226,58 @@ export function corpusRoute(validators, build, headers = textHeaders) {
         return notModified(request, etag, lastModified, sent) ?? new Response(await build(), { headers: sent });
     };
 }
+// ---- route errors -----------------------------------------------------------
+/** JSON with a status or a full init, as a web-standard `Response`. */
+export function json(data, init) {
+    return Response.json(data, typeof init === 'number' ? { status: init } : init);
+}
+/**
+ * The error answers every route handler gives, as `{ error, ...extra }`.
+ *
+ * One repo had these, one had a second convention with a third copy inside a
+ * single route, and two answered with whatever `Response.json` call was nearest
+ * — so the same mistake came back as `Unauthorized`, `Not authorized.` or a
+ * bare status depending on which origin an agent asked. `extra` carries what a
+ * surface adds to the body (a machine-readable `code`, a hint) without a fourth
+ * shape.
+ */
+export const errors = {
+    badRequest: (message, extra) => json({ error: message, ...extra }, 400),
+    unauthorized: (message = 'Unauthorized', extra) => json({ error: message, ...extra }, 401),
+    forbidden: (message = 'Forbidden', extra) => json({ error: message, ...extra }, 403),
+    notFound: (message = 'Not found', extra) => json({ error: message, ...extra }, 404),
+    /** States its own wait: a 429 without `Retry-After` is retried immediately, extending the block. */
+    tooManyRequests: (retryAfterSec, message = 'Rate limit exceeded', extra) => json({ error: message, ...extra }, { status: 429, headers: { 'Retry-After': String(Math.max(1, Math.ceil(retryAfterSec))) } }),
+    internal: (message = 'Internal server error', extra) => json({ error: message, ...extra }, 500),
+};
+/**
+ * A caller-fixable failure thrown from deep inside a handler, answered with
+ * its own status and message by `handleRoute`. Anything else thrown is a bug,
+ * answered with a generic 500 so its message never reaches the caller.
+ */
+export class HttpError extends Error {
+    status;
+    extra;
+    constructor(status, message, extra) {
+        super(message);
+        this.status = status;
+        this.extra = extra;
+    }
+}
+/**
+ * Run a handler; a thrown `HttpError` becomes its own answer, anything else a
+ * logged 500 that names nothing internal. One handler here echoed every
+ * exception's message to the caller, which is how a database error's text
+ * becomes public.
+ */
+export async function handleRoute(fn, errorMsg = 'Internal server error') {
+    try {
+        return await fn();
+    }
+    catch (error) {
+        if (error instanceof HttpError)
+            return json({ error: error.message, ...error.extra }, error.status);
+        console.error(errorMsg, error);
+        return errors.internal(errorMsg);
+    }
+}

package/dist/metadata.d.ts

@@ -175,3 +175,85 @@ export declare function fittingTitle(variants: readonly string[], opts?: {
     suffix?: string;
     limit?: number;
 }): string;
+/**
+ * `pageMetadata` bound to a site's name, locale and handle, the three fields
+ * Next drops from every page that sets its own card. Two wikis wrapped it to
+ * restate them; the third passed them by hand at six call sites and forgot the
+ * locale at all of them.
+ */
+export declare function sitePageMetadata(site: {
+    siteName: string;
+    locale?: string;
+    handle?: string;
+}): (o: Omit<PageMetadataOptions, "siteName" | "locale" | "handle">) => {
+    openGraph: {
+        publishedTime?: string;
+        modifiedTime?: string;
+        section?: string;
+        tags?: string[];
+        images?: {
+            alt: string;
+            width: number;
+            height: number;
+            url: string;
+        }[] | undefined;
+        locale?: string | undefined;
+        siteName?: string | undefined;
+        url?: string | undefined;
+        description?: string | undefined;
+        type: "article" | "website";
+        title: string;
+    };
+    twitter: {
+        images?: string[] | undefined;
+        site?: string | undefined;
+        creator?: string | undefined;
+        description?: string | undefined;
+        card: "summary_large_image";
+        title: string;
+    };
+    alternates?: {
+        types?: {
+            'text/markdown': string;
+        } | undefined;
+        canonical: string;
+    } | undefined;
+};
+/** The `@id` references a page's own node points at for `publisher` and `isPartOf`. */
+export declare function siteRefs(url: string): {
+    organization: LdNode;
+    website: LdNode;
+};
+export interface SiteGraphOptions {
+    name: string;
+    /** The canonical origin, no trailing slash needed. */
+    url: string;
+    description?: string;
+    /** Absolute URL of the logo. */
+    logo?: string;
+    /** Public profiles. */
+    sameAs?: readonly string[];
+    /** Site search, with `{search_term_string}` where the query goes. */
+    searchUrl?: string;
+    /** The machine surface, as a `WebAPI` the Organization provides. */
+    api?: {
+        name?: string;
+        description: string;
+        url: string;
+        documentation?: string;
+    };
+    /** What only this site states about itself — `knowsAbout`, `publishingPrinciples`. */
+    organizationExtra?: LdNode;
+    websiteExtra?: LdNode;
+}
+/**
+ * The Organization, WebSite and (optionally) WebAPI nodes as one `@graph`,
+ * rendered once in the root layout.
+ *
+ * Each node carries an `@id`, and `siteRefs` hands out the same ids for every
+ * page's `publisher` and `isPartOf`. The three wikis built these three ways —
+ * separate nodes, a graph, inline copies — and the inline copies were where
+ * they disagreed: one site wrote its publisher four times and one of the four
+ * had a different URL.
+ */
+export declare function siteGraphLd(o: SiteGraphOptions): LdNode;

package/dist/metadata.js

@@ -167,3 +167,77 @@ export function fittingTitle(variants, opts = {}) {
         return '';
     return usable.find(v => v.length + suffix.length <= limit) ?? usable[usable.length - 1];
 }
+// ---- the site's own identity ----------------------------------------------------
+/**
+ * `pageMetadata` bound to a site's name, locale and handle, the three fields
+ * Next drops from every page that sets its own card. Two wikis wrapped it to
+ * restate them; the third passed them by hand at six call sites and forgot the
+ * locale at all of them.
+ */
+export function sitePageMetadata(site) {
+    const bound = { locale: 'en_US', ...site };
+    return (o) => pageMetadata({ ...o, ...bound });
+}
+/** The `@id` references a page's own node points at for `publisher` and `isPartOf`. */
+export function siteRefs(url) {
+    const base = url.replace(/\/$/, '');
+    return { organization: { '@id': `${base}/#organization` }, website: { '@id': `${base}/#website` } };
+}
+/**
+ * The Organization, WebSite and (optionally) WebAPI nodes as one `@graph`,
+ * rendered once in the root layout.
+ *
+ * Each node carries an `@id`, and `siteRefs` hands out the same ids for every
+ * page's `publisher` and `isPartOf`. The three wikis built these three ways —
+ * separate nodes, a graph, inline copies — and the inline copies were where
+ * they disagreed: one site wrote its publisher four times and one of the four
+ * had a different URL.
+ */
+export function siteGraphLd(o) {
+    const url = o.url.replace(/\/$/, '');
+    const { organization, website } = siteRefs(url);
+    return {
+        '@context': 'https://schema.org',
+        '@graph': [
+            {
+                '@type': 'Organization',
+                ...organization,
+                name: o.name,
+                url,
+                ...(o.logo ? { logo: { '@type': 'ImageObject', url: o.logo } } : {}),
+                ...(o.description ? { description: o.description } : {}),
+                ...(o.sameAs?.length ? { sameAs: [...o.sameAs] } : {}),
+                ...o.organizationExtra,
+            },
+            {
+                '@type': 'WebSite',
+                ...website,
+                name: o.name,
+                url,
+                ...(o.description ? { description: o.description } : {}),
+                publisher: organization,
+                ...(o.searchUrl
+                    ? {
+                        potentialAction: {
+                            '@type': 'SearchAction',
+                            target: { '@type': 'EntryPoint', urlTemplate: o.searchUrl },
+                            'query-input': 'required name=search_term_string',
+                        },
+                    }
+                    : {}),
+                ...o.websiteExtra,
+            },
+            ...(o.api
+                ? [{
+                        '@type': 'WebAPI',
+                        '@id': `${url}/#api`,
+                        name: o.api.name ?? `${o.name} API`,
+                        description: o.api.description,
+                        url: o.api.url,
+                        ...(o.api.documentation ? { documentation: o.api.documentation } : {}),
+                        provider: organization,
+                    }]
+                : []),
+        ],
+    };
+}

package/dist/passkey-button.d.ts

@@ -3,7 +3,9 @@ export interface PasskeyButtonProps {
     endpoint: string;
     /** The invite token from the link, when there is one. */
     invite?: string | undefined;
+    /** Save a passkey without an invite: pass `await gate.open()`. */
+    create?: boolean;
     className?: string;
     errorClassName?: string;
 }
-export declare function PasskeyButton({ endpoint, invite, className, errorClassName }: PasskeyButtonProps): import("react").JSX.Element;
+export declare function PasskeyButton({ endpoint, invite, create, className, errorClassName }: PasskeyButtonProps): import("react").JSX.Element;

package/dist/passkey-button.js

@@ -3,9 +3,10 @@ import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-run
 // passkey-button.tsx – the browser half of `wiki-formant/passkey`.
 //
 // Its own subpath because it imports `@simplewebauthn/browser`, an optional
-// peer that only an app with a passkey door installs. With an invite it saves a
-// new passkey; without one it signs in with a saved one. Either way, success
-// reloads the page without the invite, and the server sees the new cookie.
+// peer that only an app with a passkey door installs. With an invite, or with
+// `create` while the site has no passkey (`gate.open()`), it saves a new
+// passkey; otherwise it signs in with a saved one. Either way, success reloads
+// the page without the invite, and the server sees the new cookie.
 import { startAuthentication, startRegistration } from '@simplewebauthn/browser';
 import { useState } from 'react';
 async function post(endpoint, body) {
@@ -14,7 +15,8 @@ async function post(endpoint, body) {
         throw new Error((await res.json().catch(() => null))?.error ?? 'Sign-in failed.');
     return res.status === 204 ? null : res.json();
 }
-export function PasskeyButton({ endpoint, invite, className, errorClassName }) {
+export function PasskeyButton({ endpoint, invite, create, className, errorClassName }) {
+    const saving = !!invite || !!create;
     const [busy, setBusy] = useState(false);
     const [error, setError] = useState(null);
     async function go() {
@@ -22,7 +24,7 @@ export function PasskeyButton({ endpoint, invite, className, errorClassName }) {
         setError(null);
         try {
             const optionsJSON = await post(endpoint, { invite });
-            const response = invite ? await startRegistration({ optionsJSON }) : await startAuthentication({ optionsJSON });
+            const response = saving ? await startRegistration({ optionsJSON }) : await startAuthentication({ optionsJSON });
             await post(endpoint, { invite, response });
             location.replace(location.pathname + location.search.replace(/([?&])invite=[^&]*&?/, '$1').replace(/[?&]$/, ''));
         }
@@ -32,5 +34,5 @@ export function PasskeyButton({ endpoint, invite, className, errorClassName }) {
             setBusy(false);
         }
     }
-    return (_jsxs(_Fragment, { children: [_jsx("button", { type: "button", className: className, onClick: go, disabled: busy, children: invite ? 'Save a passkey' : 'Sign in with a passkey' }), error && (_jsx("p", { role: "alert", className: errorClassName, children: error }))] }));
+    return (_jsxs(_Fragment, { children: [_jsx("button", { type: "button", className: className, onClick: go, disabled: busy, children: saving ? 'Save a passkey' : 'Sign in with a passkey' }), error && (_jsx("p", { role: "alert", className: errorClassName, children: error }))] }));
 }

package/dist/passkey.d.ts

@@ -14,13 +14,15 @@ export interface PasskeyGate {
     cookie: string;
     /** Whether a session cookie's value is a live session. */
     signedIn(session: string | undefined): Promise<boolean>;
+    /** True while no passkey is saved, when the page offers to save the first one. */
+    open(): Promise<boolean>;
     /** A single-use invite token, good for `days`. The bin turns it into a link. */
     invite(days?: number): Promise<string>;
     /**
      * The whole sign-in route: `export const POST = gate.route`. The body is
      * `{ invite?, response? }`: without `response` it answers with the options
      * for the browser's prompt, with one it verifies it and sets the cookie. An
-     * invite turns the prompt into saving a new passkey.
+     * invite, or a site with no passkey yet, turns the prompt into saving one.
      */
     route(request: Request): Promise<Response>;
 }

package/dist/passkey.js

@@ -1,10 +1,10 @@
 // passkey.ts – the door to a site's own admin pages: a passkey, and nothing else.
 //
 // No account, no password, no email. Whoever holds a passkey saved for the
-// site is in. The first one is saved from an invite link that the
-// `passkey-invite` bin prints from a machine holding the database URL, and any
-// passkey after that comes from another invite. So the only way in is through
-// someone who can already reach the database.
+// site is in. While none is saved, the page saves the first one without asking
+// for anything, so the owner opens it from the deployed site the way they would
+// any other. Every passkey after that needs an invite link, which the
+// `passkey-invite` bin prints from a machine holding the database URL.
 //
 // A passkey is bound to the host it was saved on. One saved on localhost does
 // not open the deployed site, and one saved on the site does not open localhost.
@@ -28,7 +28,9 @@
 //
 // Every token is stored as its hash, so a read of the table opens nothing. A
 // challenge is spent the moment a response quotes it, and an invite the moment
-// a passkey is saved with it.
+// a passkey is saved with it. The first passkey without an invite is checked
+// against an empty table in the insert itself, so two people racing to it
+// cannot both win.
 import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
 import { clientKey, rateLimit, rateLimitedResponse } from './rate-limit.js';
 const MINUTE = 60_000;
@@ -62,9 +64,11 @@ export function createPasskeyGate({ sql, rpName, cookie = 'passkey_session', ses
             attrs.push('Secure');
         return new Response(null, { status: 204, headers: { 'set-cookie': attrs.join('; ') } });
     }
+    const open = async () => (await sql(`SELECT 1 FROM "Passkey" LIMIT 1`)).length === 0;
     return {
         cookie,
         signedIn: async (value) => !!value && live(sql, 'session', value),
+        open,
         invite: (days = 1) => issue(sql, 'invite', days * DAY),
         async route(request) {
             const limited = rateLimit(clientKey('passkey', request.headers), { capacity: 10, refillPerSec: 0.2 });
@@ -80,7 +84,7 @@ export function createPasskeyGate({ sql, rpName, cookie = 'passkey_session', ses
             if (!response) {
                 if (invite && !(await live(sql, 'invite', invite)))
                     return refuse(403, 'This invite has expired.');
-                const options = invite
+                const options = invite || (await open())
                     ? await generateRegistrationOptions({
                         rpName,
                         rpID,
@@ -93,7 +97,7 @@ export function createPasskeyGate({ sql, rpName, cookie = 'passkey_session', ses
                 await issue(sql, 'challenge', CHALLENGE_MS, options.challenge);
                 return Response.json(options);
             }
-            if (invite) {
+            if (invite || (await open())) {
                 const result = await verifyRegistrationResponse({
                     response,
                     expectedChallenge,
@@ -104,10 +108,13 @@ export function createPasskeyGate({ sql, rpName, cookie = 'passkey_session', ses
                 if (!result?.verified)
                     return refuse(400, 'That passkey could not be saved.');
                 // Spent after the check, so a failed prompt leaves the invite to try again.
-                if (!(await spend(sql, 'invite', invite)))
+                if (invite && !(await spend(sql, 'invite', invite)))
                     return refuse(403, 'This invite has expired.');
                 const { credential } = result.registrationInfo;
-                await sql(`INSERT INTO "Passkey" (id, "publicKey", counter, transports) VALUES ($1, $2, $3, $4::text[])`, credential.id, b64url(credential.publicKey), credential.counter, credential.transports ?? []);
+                const saved = (await sql(`INSERT INTO "Passkey" (id, "publicKey", counter, transports)
+           SELECT $1, $2, $3, $4::text[] WHERE $5::boolean OR NOT EXISTS (SELECT 1 FROM "Passkey") RETURNING id`, credential.id, b64url(credential.publicKey), credential.counter, credential.transports ?? [], !!invite));
+                if (!saved.length)
+                    return refuse(403, 'This site already has a passkey. Adding another takes an invite.');
                 return session(protocol === 'https:');
             }
             const [passkey] = (await sql(`SELECT id, "publicKey", counter, transports FROM "Passkey" WHERE id = $1`, String(response.id)));

package/dist/react.d.ts

@@ -349,6 +349,31 @@ export declare function useCopy<K extends string = string>(revertAfter?: number)
     copied: K | null;
     copy: (text: string, key?: K) => Promise<boolean>;
 };
+export interface SnapRow<T extends HTMLElement> {
+    /** The row: give it `overflow-x: auto` and `scroll-snap-type: x mandatory`, and its children `scroll-snap-align: start`. */
+    ref: RefObject<T | null>;
+    /** The row's `onScroll`, which keeps `at` current. */
+    onScroll: () => void;
+    /** The item in view, or the last once the row is scrolled to its end: for a counter or dots. */
+    at: number;
+    /** Most of a view along, as an arrow or an arrow key moves it, wrapping round from either end. */
+    step: (dir: 1 | -1) => void;
+    /** Item `i` to the start of the row, as a dot moves it; `smooth: false` to open on it. */
+    go: (i: number, smooth?: boolean) => void;
+}
+/**
+ * A carousel as a row scrolled sideways and snapping into place. A finger
+ * swipes it with no script at all, which a carousel that swaps one item for
+ * the next in state cannot do: AcuiQ's protocol card moved only by its
+ * buttons. This is the rest, with no markup and no class names, since what the
+ * row holds differs from one use to the next.
+ *
+ * `step` scrolls by most of a view and lets the snap settle it, so a row of
+ * items narrower than itself pages a screenful at a time and a row of full-width
+ * ones moves one. It wraps at either end, because an arrow that does nothing
+ * there reads as broken. Motion honours `prefers-reduced-motion`.
+ */
+export declare function useSnapRow<T extends HTMLElement = HTMLDivElement>(): SnapRow<T>;
 /**
  * The one thing hooks cannot express, so it is worth owning once.
  *

package/dist/react.js

@@ -698,6 +698,52 @@ export function useCopy(revertAfter = 2000) {
     }, [revertAfter]);
     return { copied, copy };
 }
+/**
+ * A carousel as a row scrolled sideways and snapping into place. A finger
+ * swipes it with no script at all, which a carousel that swaps one item for
+ * the next in state cannot do: AcuiQ's protocol card moved only by its
+ * buttons. This is the rest, with no markup and no class names, since what the
+ * row holds differs from one use to the next.
+ *
+ * `step` scrolls by most of a view and lets the snap settle it, so a row of
+ * items narrower than itself pages a screenful at a time and a row of full-width
+ * ones moves one. It wraps at either end, because an arrow that does nothing
+ * there reads as broken. Motion honours `prefers-reduced-motion`.
+ */
+export function useSnapRow() {
+    const ref = useRef(null);
+    const [at, setAt] = useState(0);
+    const onScroll = useCallback(() => {
+        const row = ref.current;
+        if (!row)
+            return;
+        const items = [...row.children];
+        const left = row.getBoundingClientRect().left;
+        const offsets = items.map(el => Math.abs(el.getBoundingClientRect().left - left));
+        setAt(row.scrollLeft >= snapEnd(row) - 1 ? items.length - 1 : offsets.indexOf(Math.min(...offsets)));
+    }, []);
+    const go = useCallback((i, smooth = true) => {
+        const row = ref.current;
+        const n = row?.children.length ?? 0;
+        const el = row?.children[((i % n) + n) % n];
+        if (row && el)
+            snapTo(row, row.scrollLeft + el.getBoundingClientRect().left - row.getBoundingClientRect().left, smooth);
+    }, []);
+    const step = useCallback((dir) => {
+        const row = ref.current;
+        if (!row)
+            return;
+        if (dir > 0 && row.scrollLeft >= snapEnd(row) - 1)
+            snapTo(row, 0);
+        else if (dir < 0 && row.scrollLeft <= 1)
+            snapTo(row, snapEnd(row));
+        else
+            snapTo(row, row.scrollLeft + dir * row.clientWidth * 0.8);
+    }, []);
+    return { ref, onScroll, at, step, go };
+}
+const snapEnd = (row) => row.scrollWidth - row.clientWidth;
+const snapTo = (row, left, smooth = true) => row.scrollTo({ left, behavior: smooth && !matchMedia('(prefers-reduced-motion: reduce)').matches ? 'smooth' : 'auto' });
 // ---- error boundary ---------------------------------------------------------
 /**
  * The one thing hooks cannot express, so it is worth owning once.

package/dist/sanitize.d.ts

@@ -1,9 +1,3 @@
-/**
- * The embed hosts the editor's iframe, YouTube, tweet and map nodes produce.
- * This is half of a pair: the CSP `frame-src` in each `next.config.ts` must
- * allow the same hosts, or an iframe survives sanitising and is then blocked.
- */
-export declare const DEFAULT_IFRAME_HOSTS: readonly string[];
 export interface HtmlSanitizerOptions {
     /** Hosts an `<iframe src>` may point at. Defaults to `DEFAULT_IFRAME_HOSTS`. */
     iframeHosts?: readonly string[];

package/dist/sanitize.js

@@ -13,6 +13,7 @@
 // server-side, on the render path, so it covers rows written before it existed
 // and no sanitiser ships to the client. `sanitize-html` is an optional peer.
 import sanitizeHtml from 'sanitize-html';
+import { DEFAULT_IFRAME_HOSTS } from './headers.js';
 // Inline SVG, presentational elements only. The infographics pipeline embeds
 // diagrams as inline SVG in two of the wikis, so a prose-only list would erase
 // them. `foreignObject` (arbitrary HTML), `use`/`image` (external refs),
@@ -33,18 +34,6 @@ const SVG_ATTRS = [
     'dominant-baseline', 'offset', 'stop-color', 'stop-opacity', 'gradientUnits',
     'gradientTransform', 'clip-path', 'mask', 'role', 'aria-label', 'style',
 ];
-/**
- * The embed hosts the editor's iframe, YouTube, tweet and map nodes produce.
- * This is half of a pair: the CSP `frame-src` in each `next.config.ts` must
- * allow the same hosts, or an iframe survives sanitising and is then blocked.
- */
-export const DEFAULT_IFRAME_HOSTS = [
-    'www.youtube.com', 'youtube.com',
-    'www.youtube-nocookie.com', 'youtube-nocookie.com',
-    'platform.twitter.com',
-    'www.google.com', 'maps.google.com',
-    'embed.apple.com', 'maps.apple.com',
-];
 // Layout and paint only. `position`, `z-index` and friends are left out so a
 // page cannot lay a fake signing prompt over the site's chrome.
 const STYLE_PROPS = [