wiki-formant 0.47.1 → 0.49.0

package/dist/text.js

@@ -24,6 +24,38 @@ export function stripHtml(html) {
         .replace(/\n{3,}/g, '\n\n')
         .trim();
 }
+/**
+ * HTML as one plain line: tags become spaces, entities are decoded, and the
+ * space a tag left before punctuation is closed up again, or prose that wrapped
+ * a link around the word before a comma reads "the Radix network ." Unlike
+ * `stripHtml`, links keep no href: this is for a description, not evidence.
+ */
+export function plainText(html) {
+    return decodeEntities(html.replace(/<[^>]+>/g, ' '))
+        .replace(/\s+/g, ' ')
+        .replace(/\s+([,.;:!?%)\]])/g, '$1')
+        .replace(/([(\[])\s+/g, '$1')
+        .trim();
+}
+const HEADINGS = /<h[1-6][^>]*>[\s\S]*?<\/h[1-6]>/gi;
+/**
+ * How a page opens: the first top-level `content` block that has prose once
+ * its headings are out, as plain text. Wiki pages open with an infobox far more
+ * often than not, so the first characters of the whole page are a flattened
+ * metadata table, which is what two wikis' descriptions said until both
+ * switched to this rule. `''` when no block has prose; a wiki with other
+ * prose-bearing types falls back to its own extractor.
+ */
+export function openingText(blocks) {
+    for (const block of Array.isArray(blocks) ? blocks : []) {
+        if (block?.type !== 'content' || typeof block.text !== 'string')
+            continue;
+        const text = plainText(block.text.replace(HEADINGS, ''));
+        if (text)
+            return text;
+    }
+    return '';
+}
 /**
  * Display labels for the maintenance banners. Canonical: the prose extractor,
  * the markdown twin and the MDX export all render the same six strings.
@@ -54,15 +86,15 @@ export const BANNER_VARIANTS = Object.keys(BANNER_LABELS).map(value => ({
 export function bannerVariant(variant) {
     return Object.hasOwn(BANNER_LABELS, variant) ? variant : 'cleanup';
 }
-/** A maintenance notice, inline: `[Notice: Needs citations] …`. */
+/** A maintenance notice, inline: `[Notice: Needs citations] …`. @internal */
 export function bannerToText(label, text) {
     return `[Notice: ${label}]${text ? ' ' + stripHtml(text) : ''}`;
 }
-/** Each tab under its label, tags stripped — highlighted markup is noise here. */
+/** Each tab under its label, tags stripped — highlighted markup is noise here. @internal */
 export function codeTabsToText(tabs) {
     return tabs.map(t => `[${t.label}]\n${t.code}`).join('\n');
 }
-/** Metric cards, one per line: `99% Uptime`. */
+/** Metric cards, one per line: `99% Uptime`. @internal */
 export function statsToText(items) {
     return items.map(s => `${s.value}${s.suffix ?? ''} ${s.label}`).join('\n');
 }
@@ -73,6 +105,8 @@ export function statsToText(items) {
  * Two of the three wikis extracted nothing from a link grid, or from stats or
  * page lists, so a hub page read to an agent as far emptier than it is. The
  * third had its own three bodies. These are those bodies.
+ *
+ * @internal
  */
 export function linkGridToText(groups, intro) {
     return [
@@ -84,11 +118,11 @@ export function linkGridToText(groups, intro) {
         ].join('\n')),
     ].join('\n\n');
 }
-/** A resolved page list: one title per line. */
+/** A resolved page list: one title per line. @internal */
 export function pageListToText(pages) {
     return pages.map(p => p.title).join('\n');
 }
-/** A numbered reference list, or `''` when there are none. */
+/** A numbered reference list, or `''` when there are none. @internal */
 export function referencesToText(items) {
     if (!items.length)
         return '';

package/dist/tiptap.d.ts

@@ -34,9 +34,10 @@ export interface CodeBlockClassNames {
     optionActive?: string;
 }
 export interface CodeBlockOptions {
-    /** Selectable languages. Each wiki's own list, from its block-utils. */
-    langs: readonly string[];
-    defaultLang: string;
+    /** Selectable languages. Default `CODE_LANGS`. */
+    langs?: readonly string[];
+    /** Default `DEFAULT_LANG`. */
+    defaultLang?: string;
     classNames?: CodeBlockClassNames;
     icons?: {
         lang?: ReactNode;
@@ -46,7 +47,7 @@ export interface CodeBlockOptions {
     };
 }
 /** A code block whose language is pickable from a dropdown. */
-export declare function createCodeBlock({ langs, defaultLang, classNames, icons, }: CodeBlockOptions): TiptapNode<import("@tiptap/extension-code-block").CodeBlockOptions, any>;
+export declare function createCodeBlock({ langs, defaultLang, classNames, icons, }?: CodeBlockOptions): TiptapNode<import("@tiptap/extension-code-block").CodeBlockOptions, any>;
 export interface TabsClassNames {
     editor?: string;
     list?: string;

package/dist/tiptap.js

@@ -23,6 +23,7 @@ import { toMapEmbedUrl } from './maps.js';
 import { useClickOutside } from './react.js';
 import { cx } from './html.js';
 import { slugifyHeading, uniqueHeadingId } from './headings.js';
+import { CODE_LANGS, DEFAULT_LANG } from './blocks.js';
 /** Local `cn`. Both wikis import one; the package will not depend on one. */
 // ---- iframe -----------------------------------------------------------------
 export const Iframe = TiptapNode.create({
@@ -216,7 +217,7 @@ export function createMapEmbed({ resolveMapUrl }) {
     });
 }
 /** A code block whose language is pickable from a dropdown. */
-export function createCodeBlock({ langs, defaultLang, classNames = {}, icons = {}, }) {
+export function createCodeBlock({ langs = CODE_LANGS, defaultLang = DEFAULT_LANG, classNames = {}, icons = {}, } = {}) {
     function CodeBlockView({ node, updateAttributes, }) {
         const [open, setOpen] = useState(false);
         const close = useCallback(() => setOpen(false), []);

package/dist/upload.d.ts

@@ -0,0 +1,31 @@
+import { type Sharp } from 'sharp';
+import { type RateLimitOptions } from './rate-limit.js';
+export type ImageFormat = 'jpg' | 'png' | 'gif' | 'webp' | 'avif';
+export interface UploadOptions {
+    /** The uploader's id, which keys the rate limit, or the response that turns them away. */
+    authorize: (request: Request) => Promise<string | Response>;
+    /** Default 4 MB. */
+    maxBytes?: number;
+    /** Decoded pixels, default 40 million: a phone camera's full resolution. */
+    maxPixels?: number;
+    /** Default a burst of 20, then one every five seconds. */
+    rateLimit?: RateLimitOptions;
+    /**
+     * How the upright image is written. Default the format it arrived in. A wiki
+     * with an image standard resizes and converts here.
+     */
+    encode?: (image: Sharp, source: {
+        format: ImageFormat;
+        width: number;
+        height: number;
+    }) => {
+        image: Sharp;
+        format: ImageFormat;
+    };
+    /** Prepended to the stored name, e.g. `wiki/`. */
+    prefix?: string;
+    /** Stores the bytes and resolves to their public URL. Default Vercel Blob, public. */
+    store?: (path: string, body: Buffer, contentType: string) => Promise<string>;
+}
+/** The POST handler: a multipart `file` in, `{ url }` out. */
+export declare function uploadHandler({ authorize, maxBytes, maxPixels, rateLimit, encode, prefix, store, }: UploadOptions): (request: Request) => Promise<Response>;

package/dist/upload.js

@@ -0,0 +1,91 @@
+// upload.ts — the route an editor's image upload posts to.
+//
+// radix-wiki and caper had each written it, and their limits had drifted apart:
+// one took 25 MB with no cap on decoded pixels and trusted the client's
+// Content-Type, the other 4 MB, 40 megapixels and the file's own leading bytes.
+// This is the second, with the first one's re-encode as an option.
+//
+// - **The bytes say what the file is.** The Content-Type and the name are the
+//   caller's to choose, and trusting them stores arbitrary bytes under an image
+//   URL, served with a spoofed type. SVG is not accepted: it is markup.
+// - **Pixels are capped as well as bytes.** A PNG well under the byte limit can
+//   decode to gigabytes.
+// - **Every image is re-encoded, never stored as sent.** Re-encoding writes
+//   none of the source's metadata, and with it no GPS position from a phone's
+//   EXIF; the orientation that metadata carried is applied first.
+// - **Each uploader has a budget**, keyed on who they are and where from.
+//
+// `sharp` and `@vercel/blob` are optional peers. Run the route on Node, never
+// the edge: sharp is native.
+import sharp, {} from 'sharp';
+import { put } from '@vercel/blob';
+import { errors, handleRoute, json } from './http.js';
+import { limitClient } from './rate-limit.js';
+const CONTENT_TYPE = {
+    jpg: 'image/jpeg',
+    png: 'image/png',
+    gif: 'image/gif',
+    webp: 'image/webp',
+    avif: 'image/avif',
+};
+/** The format the leading bytes declare, or null for anything not an accepted image. */
+function sniffImage(buf) {
+    const ascii = (from, to) => String.fromCharCode(...buf.subarray(from, to));
+    if (buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff)
+        return 'jpg';
+    if (buf[0] === 0x89 && ascii(1, 4) === 'PNG')
+        return 'png';
+    if (/^GIF8[79]a$/.test(ascii(0, 6)))
+        return 'gif';
+    if (ascii(0, 4) === 'RIFF' && ascii(8, 12) === 'WEBP')
+        return 'webp';
+    if (ascii(4, 8) === 'ftyp' && ['avif', 'avis'].includes(ascii(8, 12)))
+        return 'avif';
+    return null;
+}
+const vercelBlob = async (path, body, contentType) => (await put(path, body, { access: 'public', addRandomSuffix: false, contentType })).url;
+/** The POST handler: a multipart `file` in, `{ url }` out. */
+export function uploadHandler({ authorize, maxBytes = 4 * 1024 * 1024, maxPixels = 40_000_000, rateLimit = { capacity: 20, refillPerSec: 0.2 }, encode = (image, { format }) => ({ image: image.toFormat(format === 'jpg' ? 'jpeg' : format), format }), prefix = '', store = vercelBlob, }) {
+    const megabytes = Math.round((maxBytes / 1024 / 1024) * 10) / 10;
+    const megapixels = Math.round(maxPixels / 1_000_000);
+    return request => handleRoute(async () => {
+        const who = await authorize(request);
+        if (who instanceof Response)
+            return who;
+        const limit = limitClient(`upload:${who}`, request.headers, rateLimit);
+        if (!limit.ok) {
+            return errors.tooManyRequests(limit.retryAfterSec, `Too many uploads. Try again in ${limit.retryAfterSec}s.`);
+        }
+        const file = (await request.formData()).get('file');
+        if (!(file instanceof File))
+            return errors.badRequest('No file provided');
+        if (file.size > maxBytes)
+            return errors.badRequest(`File too large (max ${megabytes}MB)`);
+        const bytes = Buffer.from(await file.arrayBuffer());
+        const format = sniffImage(bytes);
+        if (!format)
+            return errors.badRequest('Invalid file. Allowed: JPEG, PNG, GIF, WebP, AVIF');
+        let out;
+        try {
+            const meta = await sharp(bytes, { limitInputPixels: maxPixels }).metadata();
+            const width = meta.width ?? 0;
+            const height = meta.pageHeight ?? meta.height ?? 0;
+            if (!width || !height)
+                throw new Error('no dimensions');
+            if (width * height > maxPixels)
+                return errors.badRequest(`Image too large (max ${megapixels} megapixels)`);
+            const upright = sharp(bytes, { animated: (meta.pages ?? 1) > 1, limitInputPixels: maxPixels }).rotate();
+            const encoded = encode(upright, { format, width, height });
+            out = { buffer: await encoded.image.toBuffer(), format: encoded.format };
+        }
+        catch (e) {
+            // Never fall back to the bytes as sent: storing them is what leaks the location.
+            const tooBig = e instanceof Error && e.message.includes('pixel limit');
+            return errors.badRequest(tooBig
+                ? `Image too large (max ${megapixels} megapixels)`
+                : 'Could not read this image. Save it as PNG or JPEG and try again.');
+        }
+        const url = await store(`${prefix}${crypto.randomUUID()}.${out.format}`, out.buffer, CONTENT_TYPE[out.format]);
+        return json({ url });
+    }, 'Upload failed');
+}

package/dist/validation.d.ts

@@ -9,16 +9,10 @@
  * better rejected than stored.
  */
 export declare function safeLinkHref(raw: string | null | undefined): string | null;
-/** An author-supplied URL is fine iff it is empty (unset) or resolves safely. */
-export declare const okUrl: (u: unknown) => boolean;
 /** `[{ id, text, url? }]` — the shape a references block stores. */
 export declare function validateReferenceItems(items: unknown): boolean;
 /** `[{ id, heading, links: [{ label, href }] }]` — a link-grid block's groups. */
 export declare function validateLinkGroups(groups: unknown): boolean;
-/** `[{ label, language?, code }]` — a code-tabs block's tabs. `code` renders as HTML. */
-export declare function validateCodeTabs(tabs: unknown): boolean;
-/** `[{ value, label, suffix? }]` — a stats block's cards. */
-export declare function validateStatItems(items: unknown): boolean;
 /**
  * The most rows an author-supplied count may ask for. Every `limit` and every
  * `pageIds` list ends up in a database `take:` or `in:`, so the bound belongs

package/dist/validation.js

@@ -36,7 +36,7 @@ export function safeLinkHref(raw) {
     }
     return href;
 }
-/** An author-supplied URL is fine iff it is empty (unset) or resolves safely. */
+/** An author-supplied URL is fine iff it is empty (unset) or resolves safely. @internal */
 export const okUrl = (u) => typeof u === 'string' && (u === '' || safeLinkHref(u) !== null);
 const isRecord = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 /** `[{ id, text, url? }]` — the shape a references block stores. */
@@ -56,7 +56,7 @@ export function validateLinkGroups(groups) {
             Array.isArray(g.links) &&
             g.links.every(l => isRecord(l) && typeof l.label === 'string' && okUrl(l.href))));
 }
-/** `[{ label, language?, code }]` — a code-tabs block's tabs. `code` renders as HTML. */
+/** `[{ label, language?, code }]` — a code-tabs block's tabs. `code` renders as HTML. @internal */
 export function validateCodeTabs(tabs) {
     return (Array.isArray(tabs) &&
         tabs.every(t => isRecord(t) &&
@@ -64,7 +64,7 @@ export function validateCodeTabs(tabs) {
             typeof t.code === 'string' &&
             (t.language === undefined || typeof t.language === 'string')));
 }
-/** `[{ value, label, suffix? }]` — a stats block's cards. */
+/** `[{ value, label, suffix? }]` — a stats block's cards. @internal */
 export function validateStatItems(items) {
     return (Array.isArray(items) &&
         items.every(s => isRecord(s) &&

package/dist/well-known.d.ts

@@ -4,25 +4,6 @@ export interface RegistryAuthRecord {
     contentType: string;
     cacheControl: string;
 }
-/**
- * The `v=MCPv1` record the official MCP registry fetches from
- * `/.well-known/mcp-registry-auth` to prove domain ownership. `mcp-publisher
- * login http --domain=<host>` checks the key here against the private key
- * signing the login, which is what grants publish rights over the reversed-
- * domain namespace the server's name sits in.
- *
- * Returns null when no key is configured, so the caller can 404 rather than
- * serve a malformed record — a missing key should read as "not configured",
- * not as a verification failure nobody can explain.
- *
- * The key material belongs in an env var rather than the repo: the public half
- * is harmless to serve but pointless to commit, and keeping it out gives the
- * private half an obvious home too (a keychain, never git).
- *
- *   openssl genpkey -algorithm Ed25519 -out key.pem
- *   openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64
- */
-export declare function registryAuthRecord(publicKey?: string, keyType?: string): RegistryAuthRecord | null;
 /** A day at the edge, a week stale-while-revalidate. A card changes rarely. */
 export declare const AGENT_CARD_CACHE_CONTROL = "public, s-maxage=86400, stale-while-revalidate=604800";
 export interface AgentSkill {
@@ -86,7 +67,6 @@ export interface ServerManifest {
     websiteUrl?: string;
     remotes?: ReadonlyArray<Record<string, unknown>>;
 }
-export declare const SERVER_CARD_SCHEMA = "https://static.modelcontextprotocol.io/schemas/draft/server-card.schema.json";
 /**
  * The card served at `<mcp-url>/server-card`.
  *

package/dist/well-known.js

@@ -29,6 +29,8 @@ import { descriptorResponse } from './http.js';
  *
  *   openssl genpkey -algorithm Ed25519 -out key.pem
  *   openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64
+ *
+ * @internal
  */
 export function registryAuthRecord(publicKey, keyType) {
     if (!publicKey)
@@ -105,6 +107,7 @@ export function agentCard(config) {
         defaultOutputModes: ['text/plain', 'application/json', 'text/markdown'],
     };
 }
+/** @internal */
 export const SERVER_CARD_SCHEMA = 'https://static.modelcontextprotocol.io/schemas/draft/server-card.schema.json';
 /**
  * The card served at `<mcp-url>/server-card`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wiki-formant",
-  "version": "0.47.1",
+  "version": "0.49.0",
   "description": "The portable half of a wiki: derived taxonomy and facet controls, a version-negotiating MCP transport, markdown twins, block rendering, a rich-text editor engine, conditional-GET plumbing, and the headers and CSP every origin sends.",
   "type": "module",
   "license": "MIT",
@@ -82,6 +82,11 @@
       "import": "./dist/passkey-button.js",
       "default": "./dist/passkey-button.js"
     },
+    "./rola": {
+      "types": "./dist/rola.d.ts",
+      "import": "./dist/rola.js",
+      "default": "./dist/rola.js"
+    },
     "./blocks": {
       "types": "./dist/blocks.d.ts",
       "import": "./dist/blocks.js",
@@ -92,11 +97,6 @@
       "import": "./dist/combobox.js",
       "default": "./dist/combobox.js"
     },
-    "./indexnow": {
-      "types": "./dist/indexnow.d.ts",
-      "import": "./dist/indexnow.js",
-      "default": "./dist/indexnow.js"
-    },
     "./crawlers": {
       "types": "./dist/crawlers.d.ts",
       "import": "./dist/crawlers.js",
@@ -223,6 +223,11 @@
       "import": "./dist/sanitize.js",
       "default": "./dist/sanitize.js"
     },
+    "./upload": {
+      "types": "./dist/upload.d.ts",
+      "import": "./dist/upload.js",
+      "default": "./dist/upload.js"
+    },
     "./corpus": {
       "types": "./dist/corpus.d.ts",
       "import": "./dist/corpus.js",
@@ -246,11 +251,15 @@
     "analytics-digest": "bin/analytics-digest.mjs",
     "passkey-invite": "bin/passkey-invite.mjs",
     "fts-ddl": "bin/fts-ddl.mjs",
-    "indexnow": "bin/indexnow.mjs"
+    "indexnow": "bin/indexnow.mjs",
+    "prisma-models": "bin/prisma-models.mjs",
+    "mark-verified": "bin/mark-verified.mjs",
+    "maintenance-log": "bin/maintenance-log.mjs"
   },
   "files": [
     "dist",
     "bin",
+    "prisma",
     "tsconfig.base.json"
   ],
   "engines": {
@@ -262,6 +271,7 @@
     "prepare": "git config core.hooksPath .githooks || true"
   },
   "devDependencies": {
+    "@radixdlt/rola": "^2.1.0",
     "@simplewebauthn/browser": "^14.0.0",
     "@simplewebauthn/server": "^14.0.3",
     "@tiptap/core": "^2.10.0",
@@ -280,11 +290,14 @@
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
     "@types/sanitize-html": "^2.16.1",
+    "@vercel/blob": "^2.8.2",
     "fast-diff": "^1.3.0",
+    "jose": "^6.2.12",
     "jsdom": "^30.1.0",
     "lightweight-charts": "^5.2.1",
     "react": "^19.2.4",
     "sanitize-html": "^2.17.7",
+    "sharp": "^0.35.5",
     "typescript": "^5.9.0"
   },
   "peerDependencies": {
@@ -304,10 +317,14 @@
     "@tiptap/react": ">=2.10",
     "@tiptap/starter-kit": ">=2.10",
     "fast-diff": ">=1.3",
+    "lightweight-charts": ">=5",
     "pg": ">=8",
     "react": ">=18",
     "sanitize-html": ">=2",
-    "lightweight-charts": ">=5"
+    "jose": ">=6",
+    "@radixdlt/rola": ">=2",
+    "sharp": ">=0.33",
+    "@vercel/blob": ">=2"
   },
   "peerDependenciesMeta": {
     "react": {
@@ -369,6 +386,18 @@
     },
     "lightweight-charts": {
       "optional": true
+    },
+    "jose": {
+      "optional": true
+    },
+    "@radixdlt/rola": {
+      "optional": true
+    },
+    "sharp": {
+      "optional": true
+    },
+    "@vercel/blob": {
+      "optional": true
     }
   }
 }

package/prisma/analytics.prisma

@@ -0,0 +1,57 @@
+// Shipped by wiki-formant (`npx prisma-models`). Edit it there, not here:
+// `prisma-models --check` fails on a copy that has drifted.
+//
+// Page views and events, counted by wiki-formant/analytics. Its SQL names these
+// tables as written, so they carry no @@map. A visitor is a hash under the day's
+// Salt, which is replaced daily; rows older than 400 days are deleted. `siteId`
+// is "" in an app that serves one site.
+
+model View {
+  id        BigInt   @id @default(autoincrement())
+  siteId    String   @default("")
+  path      String
+  source    String?
+  country   String?
+  device    String
+  visitor   String
+  createdAt DateTime @default(now()) @db.Timestamptz(3)
+
+  @@index([siteId, createdAt])
+}
+
+model Event {
+  id        BigInt   @id @default(autoincrement())
+  siteId    String   @default("")
+  name      String
+  path      String?
+  props     Json     @default("{}")
+  visitor   String?
+  createdAt DateTime @default(now()) @db.Timestamptz(3)
+
+  @@index([siteId, name, createdAt])
+}
+
+model Salt {
+  day   String @id
+  value String
+}
+
+// Days a site counted somewhere else before it counted its own, one row a day
+// with each breakdown as { value: visitors }. Nothing writes or deletes it:
+// the app loads it once, and digest adds the days in a window to the views.
+model ViewDay {
+  siteId     String   @default("")
+  day        DateTime @db.Date
+  visitors   Int
+  pageviews  Int
+  visits     Int
+  bounces    Int
+  seconds    Int
+  pages      Json     @default("{}")
+  entryPages Json     @default("{}")
+  sources    Json     @default("{}")
+  countries  Json     @default("{}")
+  devices    Json     @default("{}")
+
+  @@id([siteId, day])
+}

package/prisma/passkey.prisma

@@ -0,0 +1,21 @@
+// Shipped by wiki-formant (`npx prisma-models`). Edit it there, not here:
+// `prisma-models --check` fails on a copy that has drifted.
+//
+// The passkey door to a site's admin pages. wiki-formant/passkey owns the SQL
+// and names these tables as written, so they carry no @@map. Every token is
+// stored as its hash; `npx passkey-invite <url>` prints the link that saves a
+// passkey.
+
+model Passkey {
+  id         String   @id // the credential id, base64url
+  publicKey  String // base64url
+  counter    Int
+  transports String[]
+  createdAt  DateTime @default(now()) @db.Timestamptz(3)
+}
+
+model PasskeyToken {
+  hash      String   @id // sha-256 of the token, base64url
+  kind      String // session | invite | challenge
+  expiresAt DateTime @db.Timestamptz(3)
+}