wiki-formant 0.48.0 → 0.50.0

package/dist/upload.js

@@ -0,0 +1,106 @@
+// upload.ts — the route an editor's image upload posts to.
+//
+// radix-wiki and caper had each written it, and their limits had drifted apart:
+// one took 25 MB with no cap on decoded pixels and trusted the client's
+// Content-Type, the other 4 MB, 40 megapixels and the file's own leading bytes.
+// This is the second, with the first one's re-encode as an option.
+//
+// - **The bytes say what the file is.** The Content-Type and the name are the
+//   caller's to choose, and trusting them stores arbitrary bytes under an image
+//   URL, served with a spoofed type. SVG is not accepted: it is markup.
+// - **Pixels are capped as well as bytes.** A PNG well under the byte limit can
+//   decode to gigabytes.
+// - **Every image is re-encoded, never stored as sent.** Re-encoding writes
+//   none of the source's metadata, and with it no GPS position from a phone's
+//   EXIF; the orientation that metadata carried is applied first.
+// - **Each uploader has a budget**, keyed on who they are and where from.
+//
+// `normalizeImage` is the sniff, the pixel cap and the re-encode without the
+// route, for an app whose images arrive another way: a server action, or a
+// picture copied in from another site.
+//
+// `sharp` and `@vercel/blob` are optional peers. Run the route on Node, never
+// the edge: sharp is native.
+import sharp, {} from 'sharp';
+import { put } from '@vercel/blob';
+import { errors, handleRoute, json } from './http.js';
+import { limitClient } from './rate-limit.js';
+const CONTENT_TYPE = {
+    jpg: 'image/jpeg',
+    png: 'image/png',
+    gif: 'image/gif',
+    webp: 'image/webp',
+    avif: 'image/avif',
+};
+/** The format the leading bytes declare, or null for anything not an accepted image. */
+function sniffImage(buf) {
+    const ascii = (from, to) => String.fromCharCode(...buf.subarray(from, to));
+    if (buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff)
+        return 'jpg';
+    if (buf[0] === 0x89 && ascii(1, 4) === 'PNG')
+        return 'png';
+    if (/^GIF8[79]a$/.test(ascii(0, 6)))
+        return 'gif';
+    if (ascii(0, 4) === 'RIFF' && ascii(8, 12) === 'WEBP')
+        return 'webp';
+    if (ascii(4, 8) === 'ftyp' && ['avif', 'avis'].includes(ascii(8, 12)))
+        return 'avif';
+    return null;
+}
+/**
+ * The image re-encoded upright with no metadata, in the format `encode` chose.
+ * Throws, with a message fit to show the uploader, for bytes that are not an
+ * accepted image or decode to more than `maxPixels`.
+ */
+export async function normalizeImage(bytes, { maxPixels = 40_000_000, encode = (image, { format }) => ({ image: image.toFormat(format === 'jpg' ? 'jpeg' : format), format }), } = {}) {
+    const megapixels = Math.round(maxPixels / 1_000_000);
+    const format = sniffImage(bytes);
+    if (!format)
+        throw new Error('Invalid file. Allowed: JPEG, PNG, GIF, WebP, AVIF');
+    try {
+        const meta = await sharp(bytes, { limitInputPixels: maxPixels }).metadata();
+        const width = meta.width ?? 0;
+        const height = meta.pageHeight ?? meta.height ?? 0;
+        if (!width || !height)
+            throw new Error('no dimensions');
+        if (width * height > maxPixels)
+            throw new Error('pixel limit');
+        const upright = sharp(bytes, { animated: (meta.pages ?? 1) > 1, limitInputPixels: maxPixels }).rotate();
+        const encoded = encode(upright, { format, width, height });
+        return { buffer: await encoded.image.toBuffer(), format: encoded.format, contentType: CONTENT_TYPE[encoded.format] };
+    }
+    catch (e) {
+        // Never fall back to the bytes as sent: storing them is what leaks the location.
+        throw new Error(e instanceof Error && e.message.includes('pixel limit')
+            ? `Image too large (max ${megapixels} megapixels)`
+            : 'Could not read this image. Save it as PNG or JPEG and try again.');
+    }
+}
+const vercelBlob = async (path, body, contentType) => (await put(path, body, { access: 'public', addRandomSuffix: false, contentType })).url;
+/** The POST handler: a multipart `file` in, `{ url }` out. */
+export function uploadHandler({ authorize, maxBytes = 4 * 1024 * 1024, maxPixels, rateLimit = { capacity: 20, refillPerSec: 0.2 }, encode, prefix = '', store = vercelBlob, }) {
+    const megabytes = Math.round((maxBytes / 1024 / 1024) * 10) / 10;
+    return request => handleRoute(async () => {
+        const who = await authorize(request);
+        if (who instanceof Response)
+            return who;
+        const limit = limitClient(`upload:${who}`, request.headers, rateLimit);
+        if (!limit.ok) {
+            return errors.tooManyRequests(limit.retryAfterSec, `Too many uploads. Try again in ${limit.retryAfterSec}s.`);
+        }
+        const file = (await request.formData()).get('file');
+        if (!(file instanceof File))
+            return errors.badRequest('No file provided');
+        if (file.size > maxBytes)
+            return errors.badRequest(`File too large (max ${megabytes}MB)`);
+        let out;
+        try {
+            out = await normalizeImage(Buffer.from(await file.arrayBuffer()), { maxPixels, encode });
+        }
+        catch (e) {
+            return errors.badRequest(e.message);
+        }
+        const url = await store(`${prefix}${crypto.randomUUID()}.${out.format}`, out.buffer, out.contentType);
+        return json({ url });
+    }, 'Upload failed');
+}

package/dist/validation.d.ts

@@ -9,16 +9,10 @@
  * better rejected than stored.
  */
 export declare function safeLinkHref(raw: string | null | undefined): string | null;
-/** An author-supplied URL is fine iff it is empty (unset) or resolves safely. */
-export declare const okUrl: (u: unknown) => boolean;
 /** `[{ id, text, url? }]` — the shape a references block stores. */
 export declare function validateReferenceItems(items: unknown): boolean;
 /** `[{ id, heading, links: [{ label, href }] }]` — a link-grid block's groups. */
 export declare function validateLinkGroups(groups: unknown): boolean;
-/** `[{ label, language?, code }]` — a code-tabs block's tabs. `code` renders as HTML. */
-export declare function validateCodeTabs(tabs: unknown): boolean;
-/** `[{ value, label, suffix? }]` — a stats block's cards. */
-export declare function validateStatItems(items: unknown): boolean;
 /**
  * The most rows an author-supplied count may ask for. Every `limit` and every
  * `pageIds` list ends up in a database `take:` or `in:`, so the bound belongs

package/dist/validation.js

@@ -36,7 +36,7 @@ export function safeLinkHref(raw) {
     }
     return href;
 }
-/** An author-supplied URL is fine iff it is empty (unset) or resolves safely. */
+/** An author-supplied URL is fine iff it is empty (unset) or resolves safely. @internal */
 export const okUrl = (u) => typeof u === 'string' && (u === '' || safeLinkHref(u) !== null);
 const isRecord = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 /** `[{ id, text, url? }]` — the shape a references block stores. */
@@ -56,7 +56,7 @@ export function validateLinkGroups(groups) {
             Array.isArray(g.links) &&
             g.links.every(l => isRecord(l) && typeof l.label === 'string' && okUrl(l.href))));
 }
-/** `[{ label, language?, code }]` — a code-tabs block's tabs. `code` renders as HTML. */
+/** `[{ label, language?, code }]` — a code-tabs block's tabs. `code` renders as HTML. @internal */
 export function validateCodeTabs(tabs) {
     return (Array.isArray(tabs) &&
         tabs.every(t => isRecord(t) &&
@@ -64,7 +64,7 @@ export function validateCodeTabs(tabs) {
             typeof t.code === 'string' &&
             (t.language === undefined || typeof t.language === 'string')));
 }
-/** `[{ value, label, suffix? }]` — a stats block's cards. */
+/** `[{ value, label, suffix? }]` — a stats block's cards. @internal */
 export function validateStatItems(items) {
     return (Array.isArray(items) &&
         items.every(s => isRecord(s) &&

package/dist/well-known.d.ts

@@ -4,25 +4,6 @@ export interface RegistryAuthRecord {
     contentType: string;
     cacheControl: string;
 }
-/**
- * The `v=MCPv1` record the official MCP registry fetches from
- * `/.well-known/mcp-registry-auth` to prove domain ownership. `mcp-publisher
- * login http --domain=<host>` checks the key here against the private key
- * signing the login, which is what grants publish rights over the reversed-
- * domain namespace the server's name sits in.
- *
- * Returns null when no key is configured, so the caller can 404 rather than
- * serve a malformed record — a missing key should read as "not configured",
- * not as a verification failure nobody can explain.
- *
- * The key material belongs in an env var rather than the repo: the public half
- * is harmless to serve but pointless to commit, and keeping it out gives the
- * private half an obvious home too (a keychain, never git).
- *
- *   openssl genpkey -algorithm Ed25519 -out key.pem
- *   openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64
- */
-export declare function registryAuthRecord(publicKey?: string, keyType?: string): RegistryAuthRecord | null;
 /** A day at the edge, a week stale-while-revalidate. A card changes rarely. */
 export declare const AGENT_CARD_CACHE_CONTROL = "public, s-maxage=86400, stale-while-revalidate=604800";
 export interface AgentSkill {
@@ -86,7 +67,6 @@ export interface ServerManifest {
     websiteUrl?: string;
     remotes?: ReadonlyArray<Record<string, unknown>>;
 }
-export declare const SERVER_CARD_SCHEMA = "https://static.modelcontextprotocol.io/schemas/draft/server-card.schema.json";
 /**
  * The card served at `<mcp-url>/server-card`.
  *

package/dist/well-known.js

@@ -29,6 +29,8 @@ import { descriptorResponse } from './http.js';
  *
  *   openssl genpkey -algorithm Ed25519 -out key.pem
  *   openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64
+ *
+ * @internal
  */
 export function registryAuthRecord(publicKey, keyType) {
     if (!publicKey)
@@ -105,6 +107,7 @@ export function agentCard(config) {
         defaultOutputModes: ['text/plain', 'application/json', 'text/markdown'],
     };
 }
+/** @internal */
 export const SERVER_CARD_SCHEMA = 'https://static.modelcontextprotocol.io/schemas/draft/server-card.schema.json';
 /**
  * The card served at `<mcp-url>/server-card`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wiki-formant",
-  "version": "0.48.0",
+  "version": "0.50.0",
   "description": "The portable half of a wiki: derived taxonomy and facet controls, a version-negotiating MCP transport, markdown twins, block rendering, a rich-text editor engine, conditional-GET plumbing, and the headers and CSP every origin sends.",
   "type": "module",
   "license": "MIT",
@@ -82,6 +82,11 @@
       "import": "./dist/passkey-button.js",
       "default": "./dist/passkey-button.js"
     },
+    "./rola": {
+      "types": "./dist/rola.d.ts",
+      "import": "./dist/rola.js",
+      "default": "./dist/rola.js"
+    },
     "./blocks": {
       "types": "./dist/blocks.d.ts",
       "import": "./dist/blocks.js",
@@ -92,11 +97,6 @@
       "import": "./dist/combobox.js",
       "default": "./dist/combobox.js"
     },
-    "./indexnow": {
-      "types": "./dist/indexnow.d.ts",
-      "import": "./dist/indexnow.js",
-      "default": "./dist/indexnow.js"
-    },
     "./crawlers": {
       "types": "./dist/crawlers.d.ts",
       "import": "./dist/crawlers.js",
@@ -223,6 +223,11 @@
       "import": "./dist/sanitize.js",
       "default": "./dist/sanitize.js"
     },
+    "./upload": {
+      "types": "./dist/upload.d.ts",
+      "import": "./dist/upload.js",
+      "default": "./dist/upload.js"
+    },
     "./corpus": {
       "types": "./dist/corpus.d.ts",
       "import": "./dist/corpus.js",
@@ -246,11 +251,15 @@
     "analytics-digest": "bin/analytics-digest.mjs",
     "passkey-invite": "bin/passkey-invite.mjs",
     "fts-ddl": "bin/fts-ddl.mjs",
-    "indexnow": "bin/indexnow.mjs"
+    "indexnow": "bin/indexnow.mjs",
+    "prisma-models": "bin/prisma-models.mjs",
+    "mark-verified": "bin/mark-verified.mjs",
+    "maintenance-log": "bin/maintenance-log.mjs"
   },
   "files": [
     "dist",
     "bin",
+    "prisma",
     "tsconfig.base.json"
   ],
   "engines": {
@@ -262,6 +271,7 @@
     "prepare": "git config core.hooksPath .githooks || true"
   },
   "devDependencies": {
+    "@radixdlt/rola": "^2.1.0",
     "@simplewebauthn/browser": "^14.0.0",
     "@simplewebauthn/server": "^14.0.3",
     "@tiptap/core": "^2.10.0",
@@ -280,11 +290,14 @@
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
     "@types/sanitize-html": "^2.16.1",
+    "@vercel/blob": "^2.8.2",
     "fast-diff": "^1.3.0",
+    "jose": "^6.2.12",
     "jsdom": "^30.1.0",
     "lightweight-charts": "^5.2.1",
     "react": "^19.2.4",
     "sanitize-html": "^2.17.7",
+    "sharp": "^0.35.5",
     "typescript": "^5.9.0"
   },
   "peerDependencies": {
@@ -304,10 +317,14 @@
     "@tiptap/react": ">=2.10",
     "@tiptap/starter-kit": ">=2.10",
     "fast-diff": ">=1.3",
+    "lightweight-charts": ">=5",
     "pg": ">=8",
     "react": ">=18",
     "sanitize-html": ">=2",
-    "lightweight-charts": ">=5"
+    "jose": ">=6",
+    "@radixdlt/rola": ">=2",
+    "sharp": ">=0.33",
+    "@vercel/blob": ">=2"
   },
   "peerDependenciesMeta": {
     "react": {
@@ -369,6 +386,18 @@
     },
     "lightweight-charts": {
       "optional": true
+    },
+    "jose": {
+      "optional": true
+    },
+    "@radixdlt/rola": {
+      "optional": true
+    },
+    "sharp": {
+      "optional": true
+    },
+    "@vercel/blob": {
+      "optional": true
     }
   }
 }

package/prisma/analytics.prisma

@@ -0,0 +1,57 @@
+// Shipped by wiki-formant (`npx prisma-models`). Edit it there, not here:
+// `prisma-models --check` fails on a copy that has drifted.
+//
+// Page views and events, counted by wiki-formant/analytics. Its SQL names these
+// tables as written, so they carry no @@map. A visitor is a hash under the day's
+// Salt, which is replaced daily; rows older than 400 days are deleted. `siteId`
+// is "" in an app that serves one site.
+
+model View {
+  id        BigInt   @id @default(autoincrement())
+  siteId    String   @default("")
+  path      String
+  source    String?
+  country   String?
+  device    String
+  visitor   String
+  createdAt DateTime @default(now()) @db.Timestamptz(3)
+
+  @@index([siteId, createdAt])
+}
+
+model Event {
+  id        BigInt   @id @default(autoincrement())
+  siteId    String   @default("")
+  name      String
+  path      String?
+  props     Json     @default("{}")
+  visitor   String?
+  createdAt DateTime @default(now()) @db.Timestamptz(3)
+
+  @@index([siteId, name, createdAt])
+}
+
+model Salt {
+  day   String @id
+  value String
+}
+
+// Days a site counted somewhere else before it counted its own, one row a day
+// with each breakdown as { value: visitors }. Nothing writes or deletes it:
+// the app loads it once, and digest adds the days in a window to the views.
+model ViewDay {
+  siteId     String   @default("")
+  day        DateTime @db.Date
+  visitors   Int
+  pageviews  Int
+  visits     Int
+  bounces    Int
+  seconds    Int
+  pages      Json     @default("{}")
+  entryPages Json     @default("{}")
+  sources    Json     @default("{}")
+  countries  Json     @default("{}")
+  devices    Json     @default("{}")
+
+  @@id([siteId, day])
+}

package/prisma/passkey.prisma

@@ -0,0 +1,21 @@
+// Shipped by wiki-formant (`npx prisma-models`). Edit it there, not here:
+// `prisma-models --check` fails on a copy that has drifted.
+//
+// The passkey door to a site's admin pages. wiki-formant/passkey owns the SQL
+// and names these tables as written, so they carry no @@map. Every token is
+// stored as its hash; `npx passkey-invite <url>` prints the link that saves a
+// passkey.
+
+model Passkey {
+  id         String   @id // the credential id, base64url
+  publicKey  String // base64url
+  counter    Int
+  transports String[]
+  createdAt  DateTime @default(now()) @db.Timestamptz(3)
+}
+
+model PasskeyToken {
+  hash      String   @id // sha-256 of the token, base64url
+  kind      String // session | invite | challenge
+  expiresAt DateTime @db.Timestamptz(3)
+}