wiki-formant 0.51.0 → 0.52.0

package/dist/block-views.js

@@ -2,9 +2,8 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 // block-views.tsx — the block leaves the wikis share.
 //
-// Behind its own subpath for the reason `react.tsx` is: React is an OPTIONAL
-// peer, so a consumer that only wants the taxonomy or the MCP transport still
-// installs a package with no runtime dependencies.
+// Behind its own subpath for the reason `react.tsx` is: React is an optional
+// peer, so a consumer that only wants the taxonomy or the MCP transport needs no React.
 //
 // WHY THESE FIVE AND NOT THE SWITCH. The block union is per-repo and staying
 // that way (see the Block Model note in the workspace CLAUDE.md) — a closed

package/dist/crawlers.d.ts

@@ -14,8 +14,8 @@ export interface AiCrawler {
 }
 /**
  * Structurally what Next's `MetadataRoute.Robots['rules']` wants, without
- * importing Next: this package has no runtime dependencies and is not going to
- * grow one for a shape that is three optional string fields.
+ * importing Next: this package does not depend on Next and is not going to for
+ * a shape that is three optional string fields.
  */
 export interface RobotsGroup {
     userAgent: string;

package/dist/db.d.ts

@@ -19,3 +19,28 @@ export interface PgPoolConfig {
  * a page that fans out more than three queries in thirty seconds.
  */
 export declare function pgPoolConfig(url: string | undefined): PgPoolConfig;
+/**
+ * What every app's prisma.config.ts hands `defineConfig`, from the folder the
+ * file sits in: `defineConfig(prismaConfig(import.meta.dirname))`. Four apps
+ * carried the file, three of them byte for byte.
+ *
+ * Read only by the Prisma CLI, never by the app, so the URL prefers DIRECT_URL:
+ * every CLI operation that connects (db push, migrate diff, studio) needs a
+ * session connection, and Supabase's transaction pooler on 6543, which
+ * DATABASE_URL names, hangs on them rather than failing. A placeholder stands
+ * in where neither is set, as on a Vercel build: `prisma generate` reads the
+ * schema and never connects, and anything that does connect fails loudly.
+ *
+ * `schema` is a folder of .prisma files (`prisma-models` writes beside the
+ * app's own) or a single file. Paths resolve against `root`, so the CLI works
+ * from a subdirectory.
+ */
+export declare function prismaConfig(root: string, schema?: string): {
+    schema: string;
+    migrations: {
+        path: string;
+    };
+    datasource: {
+        url: string;
+    };
+};

package/dist/db.js

@@ -1,4 +1,4 @@
-// db.ts — the pool settings every app here hands to `pg`.
+// db.ts — the pool settings every app here hands to `pg`, and the config its prisma.config.ts hands the Prisma CLI.
 //
 // Four Prisma client modules carried the same block, comment and all. It is a
 // value, not a client: the app still owns `new pg.Pool(...)`, the adapter and
@@ -25,3 +25,34 @@ export function pgPoolConfig(url) {
         connectionTimeoutMillis: 30_000,
     };
 }
+/**
+ * What every app's prisma.config.ts hands `defineConfig`, from the folder the
+ * file sits in: `defineConfig(prismaConfig(import.meta.dirname))`. Four apps
+ * carried the file, three of them byte for byte.
+ *
+ * Read only by the Prisma CLI, never by the app, so the URL prefers DIRECT_URL:
+ * every CLI operation that connects (db push, migrate diff, studio) needs a
+ * session connection, and Supabase's transaction pooler on 6543, which
+ * DATABASE_URL names, hangs on them rather than failing. A placeholder stands
+ * in where neither is set, as on a Vercel build: `prisma generate` reads the
+ * schema and never connects, and anything that does connect fails loudly.
+ *
+ * `schema` is a folder of .prisma files (`prisma-models` writes beside the
+ * app's own) or a single file. Paths resolve against `root`, so the CLI works
+ * from a subdirectory.
+ */
+export function prismaConfig(root, schema = 'prisma/schema') {
+    try {
+        process.loadEnvFile(`${root}/.env`);
+    }
+    catch {
+        // A Vercel build has no .env and needs none.
+    }
+    return {
+        schema: `${root}/${schema}`,
+        migrations: { path: `${root}/prisma/migrations` },
+        datasource: {
+            url: process.env.DIRECT_URL ?? process.env.DATABASE_URL ?? 'postgresql://placeholder:placeholder@localhost:5432/placeholder',
+        },
+    };
+}

package/dist/editor.d.ts

@@ -15,6 +15,9 @@ export type { StarterKitOptions } from '@tiptap/starter-kit';
 export type { LinkOptions } from '@tiptap/extension-link';
 export type { ImageOptions } from '@tiptap/extension-image';
 export type { TableOptions } from '@tiptap/extension-table';
+/** The view and the editor's type, so a consumer imports nothing from `@tiptap/*` itself. */
+export { EditorContent } from '@tiptap/react';
+export type { Editor } from '@tiptap/core';
 export interface WikiEditorExtensionOptions {
     /** Empty-document prompt. */
     placeholder?: string;

package/dist/editor.js

@@ -33,6 +33,8 @@ import { useEditor } from '@tiptap/react';
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { toMapEmbedUrl } from './maps.js';
 import { cx } from './html.js';
+/** The view and the editor's type, so a consumer imports nothing from `@tiptap/*` itself. */
+export { EditorContent } from '@tiptap/react';
 // ---- paste scrubbing --------------------------------------------------------
 /**
  * Reduce pasted HTML to structure plus the three attributes that carry meaning.

package/dist/headers.d.ts

@@ -25,3 +25,30 @@ export declare function contentSecurityPolicy(directives?: Partial<Record<CspDir
  * sets its policy per request (a nonce) passes none.
  */
 export declare function securityHeaders(csp?: string | null): HeaderEntry[];
+/** The parts of a Next config `withWikiDefaults` fills in. */
+interface WikiNextConfig {
+    distDir?: string;
+    experimental?: object;
+    images?: object;
+    headers?: () => Promise<unknown[]>;
+}
+/**
+ * An app's Next config with the settings every app here wrote out the same way:
+ *
+ * - `distDir` from `STUDIO_DIST_DIR`, set only by radix-studio's renders, which
+ *   boot a second dev server beside the running one, and Next allows one per
+ *   distDir.
+ * - `turbopackFileSystemCacheForBuild: false`. Next 16.3 turns Turbopack's
+ *   build cache on and Vercel restores it from the last deployment; caper
+ *   shipped a stylesheet two commits stale that way in October 2026.
+ * - AVIF before WebP from the image optimiser.
+ * - `securityHeaders` on every route, with `csp` enforced in production only:
+ *   Next's dev runtime is inline and `eval`. An origin that sets its policy
+ *   per request (a nonce) passes none.
+ *
+ * Anything the app sets wins, and its own `headers()` follow these.
+ */
+export declare function withWikiDefaults<T extends WikiNextConfig>(config: T, { csp }?: {
+    csp?: string;
+}): T;
+export {};

package/dist/headers.js

@@ -11,7 +11,8 @@
 // `youtube-nocookie.com` its sanitiser kept, so those embeds survived cleaning
 // and then rendered blank.
 //
-// Zero imports, so a config pays for nothing it does not use.
+// Zero imports, so a config pays for nothing it does not use. `withWikiDefaults`
+// is here for the same reason: next.config.ts is its only caller.
 /**
  * The embed hosts the editor's iframe, YouTube, tweet and map nodes produce:
  * the sanitiser's default `iframeHosts` and the default `frame-src`, so an
@@ -78,3 +79,33 @@ export function securityHeaders(csp) {
         { key: 'X-DNS-Prefetch-Control', value: 'on' },
     ];
 }
+/**
+ * An app's Next config with the settings every app here wrote out the same way:
+ *
+ * - `distDir` from `STUDIO_DIST_DIR`, set only by radix-studio's renders, which
+ *   boot a second dev server beside the running one, and Next allows one per
+ *   distDir.
+ * - `turbopackFileSystemCacheForBuild: false`. Next 16.3 turns Turbopack's
+ *   build cache on and Vercel restores it from the last deployment; caper
+ *   shipped a stylesheet two commits stale that way in October 2026.
+ * - AVIF before WebP from the image optimiser.
+ * - `securityHeaders` on every route, with `csp` enforced in production only:
+ *   Next's dev runtime is inline and `eval`. An origin that sets its policy
+ *   per request (a nonce) passes none.
+ *
+ * Anything the app sets wins, and its own `headers()` follow these.
+ */
+export function withWikiDefaults(config, { csp } = {}) {
+    return {
+        ...(process.env.STUDIO_DIST_DIR ? { distDir: process.env.STUDIO_DIST_DIR } : {}),
+        ...config,
+        experimental: { turbopackFileSystemCacheForBuild: false, ...config.experimental },
+        images: { formats: ['image/avif', 'image/webp'], ...config.images },
+        async headers() {
+            return [
+                { source: '/:path*', headers: securityHeaders(process.env.NODE_ENV === 'production' ? csp : null) },
+                ...((await config.headers?.()) ?? []),
+            ];
+        },
+    };
+}

package/dist/headings.d.ts

@@ -1,3 +1,4 @@
+import { type NormaliseLinkOptions } from './links.js';
 /** A heading found in a page's HTML, in document order. */
 export interface Heading {
     id: string;
@@ -84,3 +85,12 @@ export interface OutlineIssue {
  * single `noH1` and nothing else, since every later rule would restate it.
  */
 export declare function outlineIssues(html: string): OutlineIssue[];
+/**
+ * The pass every app runs over a content block's stored HTML before it renders:
+ * heading ids, a scroll box round each table, and, given `links`, every anchor
+ * tagged internal or external. Four apps wrote the same chain in three orders.
+ * Pass one `used` set (and one `links.citedRefs`) across a page's blocks.
+ */
+export declare function articleHtml(html: string, { links, ...headings }?: HeadingIdOptions & {
+    links?: NormaliseLinkOptions;
+}): string;

package/dist/headings.js

@@ -14,6 +14,8 @@
 // that with a fresh set each time, so a "Notes" in two blocks shipped two
 // `id="notes"`. One `used` set per page is what makes the dedupe hold.
 import { getAttr, stripTags } from './html.js';
+import { scrollTables } from './dom.js';
+import { normaliseLinks } from './links.js';
 /** The default slug rule: lowercase words joined by hyphens. */
 export function slugifyHeading(text) {
     return text
@@ -131,3 +133,13 @@ export function outlineIssues(html) {
         issues.push({ fault: 'noSubheading', level: 1 });
     return issues;
 }
+/**
+ * The pass every app runs over a content block's stored HTML before it renders:
+ * heading ids, a scroll box round each table, and, given `links`, every anchor
+ * tagged internal or external. Four apps wrote the same chain in three orders.
+ * Pass one `used` set (and one `links.citedRefs`) across a page's blocks.
+ */
+export function articleHtml(html, { links, ...headings } = {}) {
+    const out = scrollTables(injectHeadingIds(html, headings));
+    return links ? normaliseLinks(out, links) : out;
+}

package/dist/history.js

@@ -3,7 +3,7 @@
 // `revisions.ts` decides which bump a save asks for and stays free of
 // dependencies, because every write path imports it. This is the reading half:
 // the same walk, turned into what a reviewer is shown. It needs a text diff, so
-// it needs `fast-diff`, an optional peer; hence its own subpath.
+// it needs `fast-diff`; hence its own subpath.
 //
 // radix-wiki had it first and shipped both HTML bodies of every modified block
 // to the browser to diff there: 887 KB of payload for a 13-revision page whose

package/dist/http.d.ts

@@ -42,8 +42,12 @@ export declare function textHeaders(etag: string, lastModified: string, maxAge?:
  *
  * `lastModified` is optional because not every corpus has a row timestamp to
  * offer, and a twin that stamps the epoch is worse than one that stamps
- * nothing. `extra` carries whatever the mount needs on top — an `X-Robots-Tag`
- * where the twin is a second public URL with no canonical of its own.
+ * nothing. `extra` carries whatever the mount needs on top.
+ *
+ * `noindex` is for a twin of an HTML page: a search engine that reads the twin
+ * has the page already, and Google indexed `.md` beside the HTML until four
+ * routes each set `X-Robots-Tag` by hand. A document with no HTML page, such
+ * as AGENTS.md, leaves it off.
  *
  * Pass `etag`. The twin is the single most recrawled URL a page has, and a
  * response with no validator is a full render on every pass forever — the same
@@ -55,6 +59,7 @@ export declare function textHeaders(etag: string, lastModified: string, maxAge?:
 export declare function markdownHeaders(lastModified?: string | null, opts?: {
     maxAge?: number;
     etag?: string;
+    noindex?: boolean;
     extra?: Record<string, string>;
 }): Record<string, string>;
 /**

package/dist/http.js

@@ -100,8 +100,12 @@ export function textHeaders(etag, lastModified, maxAge = 3600) {
  *
  * `lastModified` is optional because not every corpus has a row timestamp to
  * offer, and a twin that stamps the epoch is worse than one that stamps
- * nothing. `extra` carries whatever the mount needs on top — an `X-Robots-Tag`
- * where the twin is a second public URL with no canonical of its own.
+ * nothing. `extra` carries whatever the mount needs on top.
+ *
+ * `noindex` is for a twin of an HTML page: a search engine that reads the twin
+ * has the page already, and Google indexed `.md` beside the HTML until four
+ * routes each set `X-Robots-Tag` by hand. A document with no HTML page, such
+ * as AGENTS.md, leaves it off.
  *
  * Pass `etag`. The twin is the single most recrawled URL a page has, and a
  * response with no validator is a full render on every pass forever — the same
@@ -117,6 +121,7 @@ export function markdownHeaders(lastModified, opts = {}) {
         'Cache-Control': `public, s-maxage=${maxAge}, stale-while-revalidate=${maxAge * 24}`,
         ...(opts.etag ? { ETag: opts.etag } : {}),
         ...(lastModified ? { 'Last-Modified': lastModified } : {}),
+        ...(opts.noindex ? { 'X-Robots-Tag': 'noindex' } : {}),
         ...opts.extra,
     };
 }

package/dist/indexnow.d.ts

@@ -7,6 +7,13 @@ export interface IndexNowEntry {
 }
 /** The `<loc>` and `<lastmod>` of every `<url>` in a sitemap. */
 export declare function sitemapEntries(xml: string): IndexNowEntry[];
+/**
+ * Every entry of the sitemap at `url`, following a sitemap index one level down
+ * to at most 20 children. The `indexnow` and `check-pages` bins each parsed
+ * sitemaps, and only one of them read an index. Throws when `url` itself does
+ * not answer 200; a child that fails is skipped.
+ */
+export declare function readSitemap(url: string, fetchImpl?: typeof fetch): Promise<IndexNowEntry[]>;
 /**
  * The URLs modified at or after `since`. An entry with no `lastModified` is
  * left out: nothing says it changed, and the protocol asks for changed pages

package/dist/indexnow.js

@@ -12,11 +12,10 @@
 // The key is not a secret. An engine verifies a submission by fetching
 // `/<key>.txt` from the origin, so the key is public by design, and the file in
 // each app's `public/` is the only copy.
+import { decodeEntities } from './markdown.js';
 export const INDEXNOW_ENDPOINT = 'https://api.indexnow.org/indexnow';
 /** The protocol's cap on the URLs in one POST. */
 export const INDEXNOW_BATCH = 10_000;
-const XML_ENTITIES = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" };
-const unescapeXml = (s) => s.trim().replace(/&(amp|lt|gt|quot|apos);/g, (_, e) => XML_ENTITIES[e]);
 /** The `<loc>` and `<lastmod>` of every `<url>` in a sitemap. */
 export function sitemapEntries(xml) {
     const entries = [];
@@ -25,10 +24,30 @@ export function sitemapEntries(xml) {
         if (!loc)
             continue;
         const lastmod = /<lastmod>([\s\S]*?)<\/lastmod>/.exec(body)?.[1];
-        entries.push(lastmod ? { url: unescapeXml(loc), lastModified: lastmod.trim() } : { url: unescapeXml(loc) });
+        const url = decodeEntities(loc.trim());
+        entries.push(lastmod ? { url, lastModified: lastmod.trim() } : { url });
     }
     return entries;
 }
+/**
+ * Every entry of the sitemap at `url`, following a sitemap index one level down
+ * to at most 20 children. The `indexnow` and `check-pages` bins each parsed
+ * sitemaps, and only one of them read an index. Throws when `url` itself does
+ * not answer 200; a child that fails is skipped.
+ */
+export async function readSitemap(url, fetchImpl = fetch) {
+    const res = await fetchImpl(url);
+    if (!res.ok)
+        throw new Error(`${url} answered ${res.status}`);
+    const xml = await res.text();
+    if (!/<sitemapindex/i.test(xml))
+        return sitemapEntries(xml);
+    const children = [...xml.matchAll(/<loc>([\s\S]*?)<\/loc>/g)].slice(0, 20).map(m => decodeEntities(m[1].trim()));
+    const entries = [];
+    for (const child of children)
+        entries.push(...(await readSitemap(child, fetchImpl).catch(() => [])));
+    return entries;
+}
 /**
  * The URLs modified at or after `since`. An entry with no `lastModified` is
  * left out: nothing says it changed, and the protocol asks for changed pages

package/dist/maintenance.js

@@ -17,6 +17,7 @@
 // which is what lets an audit spend no probes on its flag list.
 //
 // No subpath exports this: the bins and the tests import it from dist.
+import { escXml } from './feed.js';
 /** Held in state. */
 const MAX = { backlog: 60, runs: 30, feedback: 40, sources: 150 };
 /** Shown on the page. What a reader pays is words, and the entries run long. */
@@ -63,7 +64,7 @@ export function addBacklog(state, items, today) {
     }
     return added;
 }
-const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+const esc = (s) => escXml(String(s ?? ''));
 const more = (shown, total, what) => total > shown ? `<p><em>${total - shown} older ${what} held in state.</em></p>` : '';
 const table = (head, rows) => `<table><tbody><tr>${head.map(h => `<td><strong>${h}</strong></td>`).join('')}</tr>` +
     (rows.join('') || `<tr>${head.map(() => '<td>–</td>').join('')}</tr>`) +

package/dist/react.d.ts

@@ -171,7 +171,7 @@ export interface TypeaheadState<T> {
  *     per mount, not module-level, so a stale result cannot outlive the page.
  *
  * The debounce is inlined rather than pulled from a package: this one is nine
- * lines, and the point of the package is to have no runtime dependencies.
+ * lines, and a dependency for nine lines is not worth one.
  */
 export declare function useTypeahead<T>({ fetch, onPick, onEscape, delay, minLength, cache, }: TypeaheadOptions<T>): TypeaheadState<T>;
 export interface LinkPreviewOptions<T> {

package/dist/react.js

@@ -3,9 +3,8 @@ import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-run
 // react.tsx — the collapsible wiki sidebar, and the table of contents inside it.
 //
 // This is the one part of the package that needs React, so it is the one part
-// behind its own subpath: `wiki-formant/react`. React is an OPTIONAL PEER
-// dependency, so a consumer that only wants the taxonomy or the MCP transport
-// still installs a package with no runtime dependencies at all.
+// behind its own subpath: `wiki-formant/react`. React is an optional peer, so a
+// consumer that only wants the taxonomy or the MCP transport needs no React.
 //
 // What is shared here is behaviour, not appearance. Every class name is passed
 // in, because the three wikis style their rails differently and always will;
@@ -292,7 +291,7 @@ export function useClickOutside(onClose) {
  *     per mount, not module-level, so a stale result cannot outlive the page.
  *
  * The debounce is inlined rather than pulled from a package: this one is nine
- * lines, and the point of the package is to have no runtime dependencies.
+ * lines, and a dependency for nine lines is not worth one.
  */
 export function useTypeahead({ fetch, onPick, onEscape, delay = 200, minLength = 1, cache = true, }) {
     const [query, setQuery] = useState('');

package/dist/sanitize.js

@@ -11,7 +11,7 @@
 // Everything is an allowlist: unknown tags, unknown attributes (every on*
 // handler among them) and non-http(s) URLs are dropped, not escaped. Run it
 // server-side, on the render path, so it covers rows written before it existed
-// and no sanitiser ships to the client. `sanitize-html` is an optional peer.
+// and no sanitiser ships to the client.
 import sanitizeHtml from 'sanitize-html';
 import { DEFAULT_IFRAME_HOSTS } from './headers.js';
 // Inline SVG, presentational elements only. The infographics pipeline embeds

package/dist/stats.d.ts

@@ -1,4 +1,6 @@
+import type { ReactNode } from 'react';
 import { type Digest, type StatsFilter } from './analytics.js';
+import type { PasskeyGate } from './passkey.js';
 export interface StatsProps {
     /** One window's figures, from `digest` in `wiki-formant/analytics`. */
     digest: Digest;
@@ -26,3 +28,29 @@ export declare function statsQuery(params: Record<string, string | string[] | un
  * until the importing stylesheet gives them a colour.
  */
 export declare function Stats({ digest: d, days, filter, ranges }: StatsProps): import("react").JSX.Element;
+export interface StatsGateProps {
+    gate: PasskeyGate;
+    /** The gate's cookie from the request: `(await cookies()).get(gate.cookie)?.value`. */
+    session: string | undefined;
+    /** `?invite=` from the link, when there is one. */
+    invite?: string | undefined;
+    /** The site's host, named in the prompt. */
+    host: string;
+    /** The route that serves `gate.route`. */
+    endpoint?: string;
+    /** What a signed-in reader sees, rendered only for one. */
+    children: () => ReactNode | Promise<ReactNode>;
+    classNames?: {
+        text?: string;
+        actions?: string;
+        button?: string;
+        error?: string;
+    };
+}
+/**
+ * A stats page's door: `children` for a signed-in reader, else a line saying
+ * what the passkey prompt will do and the button that does it. With an invite
+ * it saves a passkey, as it does while the site has none; otherwise it signs
+ * in. Three apps wrote this branch and its three sentences.
+ */
+export declare function StatsGate({ gate, session, invite, host, endpoint, children, classNames: c }: StatsGateProps): Promise<string | number | bigint | boolean | Iterable<ReactNode> | import("react").JSX.Element | null | undefined>;

package/dist/stats.js

@@ -1,5 +1,6 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { STATS_FILTERS } from './analytics.js';
+import { PasskeyButton } from './passkey-button.js';
 import { StatsFigures } from './stats-figures.js';
 /** The windows the stats page offers, in days; `Infinity` is all time. */
 const STATS_RANGES = [1, 7, 30, 90, 365, Infinity];
@@ -74,3 +75,19 @@ export function Stats({ digest: d, days, filter = {}, ranges = STATS_RANGES }) {
     const windows = (_jsx("div", { role: "group", "aria-label": "Window", children: ranges.map(n => (_jsx("a", { href: href(n, filter), "aria-current": n === days ? 'page' : undefined, children: windowLabel(n) }, n))) }));
     return (_jsxs("div", { className: "stats", children: [narrowed.length > 0 && (_jsxs("div", { className: "stats-filters", children: [_jsx("ul", { "aria-label": "Narrowed to", children: narrowed.map(k => (_jsx("li", { children: _jsxs("a", { href: href(days, { ...filter, [k]: undefined }), title: "Remove", children: [NAMES[k], ": ", k === 'country' ? country(filter[k]) : filter[k], " \u00D7"] }) }, k))) }), start < counted && d.counted_from && (_jsxs("p", { children: ["Narrowed figures start on ", d.counted_from, ", the first day this site counted its own visits."] }))] })), _jsx(StatsFigures, { digest: d, first: first, windows: windows }), _jsxs("div", { className: "stats-lists", children: [_jsx(StatsList, { title: "Pages", rows: rows(d.top_pages, 'page', 'visitors'), to: to('page') }), _jsx(StatsList, { title: "Entry pages", rows: rows(d.entry_pages, 'page', 'visitors'), to: to('entry') }), _jsx(StatsList, { title: "Sources", rows: rows(d.top_sources, 'source', 'visitors'), to: to('source') }), _jsx(StatsList, { title: "From X posts", rows: rows(d.from_posts, 'page', 'visitors'), to: v => href(days, { ...filter, source: 'x', entry: v }) }), _jsx(StatsList, { title: "Sibling sites", rows: rows(d.sibling_referrals, 'source', 'visitors'), to: to('source') }), _jsx(StatsList, { title: "Countries", rows: rows(d.countries, 'country', 'visitors'), label: country, to: to('country') }), _jsx(StatsList, { title: "Devices", rows: rows(d.devices, 'device', 'visitors'), to: to('device') }), _jsx(StatsList, { title: "Agent tool calls", rows: rows(d.agent_tool_calls, 'tool', 'events') }), _jsx(StatsList, { title: "Searches that found nothing", rows: rows(d.gaps, 'query', 'events') })] })] }));
 }
+/**
+ * A stats page's door: `children` for a signed-in reader, else a line saying
+ * what the passkey prompt will do and the button that does it. With an invite
+ * it saves a passkey, as it does while the site has none; otherwise it signs
+ * in. Three apps wrote this branch and its three sentences.
+ */
+export async function StatsGate({ gate, session, invite, host, endpoint = '/api/passkey', children, classNames: c = {} }) {
+    if (!invite && (await gate.signedIn(session)))
+        return children();
+    const open = !invite && (await gate.open());
+    return (_jsxs(_Fragment, { children: [_jsx("p", { className: c.text, children: invite
+                    ? `Save a passkey on this device to open ${host}'s stats.`
+                    : open
+                        ? `No passkey is saved for ${host} yet. Save the first one here; any after that needs an invite.`
+                        : 'Sign in with a passkey saved for this site.' }), _jsx("div", { className: c.actions, children: _jsx(PasskeyButton, { endpoint: endpoint, invite: invite, create: open, className: c.button, errorClassName: c.error }) })] }));
+}

package/dist/tiptap.js

@@ -2,10 +2,8 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // tiptap.tsx — the custom editor nodes the wikis share.
 //
-// Behind its own subpath for the same reason `react.tsx` is: the four
-// `@tiptap/*` packages are OPTIONAL peer dependencies, so a consumer that only
-// wants the taxonomy or the MCP transport still installs a package with no
-// runtime dependencies at all.
+// Behind its own subpath so a module that only wants the taxonomy or the MCP
+// transport never loads the `@tiptap/*` packages.
 //
 // What is shared is the node schema and its behaviour, never appearance. Class
 // names and icons are injected, which is what lets one wiki keep `text-jupiter`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wiki-formant",
-  "version": "0.51.0",
+  "version": "0.52.0",
   "description": "The portable half of a wiki: derived taxonomy and facet controls, a version-negotiating MCP transport, markdown twins, block rendering, a rich-text editor engine, conditional-GET plumbing, and the headers and CSP every origin sends.",
   "type": "module",
   "license": "MIT",
@@ -275,12 +275,11 @@
     "test": "npm run build && node --test 'test/*.test.js'",
     "prepare": "git config core.hooksPath .githooks || true"
   },
-  "devDependencies": {
-    "@radixdlt/rola": "^2.1.0",
+  "dependencies": {
     "@simplewebauthn/browser": "^14.0.0",
     "@simplewebauthn/server": "^14.0.3",
-    "@tiptap/core": "^2.10.0",
-    "@tiptap/extension-code-block": "^2.10.0",
+    "@tiptap/core": "^2.27.3",
+    "@tiptap/extension-code-block": "^2.27.3",
     "@tiptap/extension-image": "^2.27.3",
     "@tiptap/extension-link": "^2.27.3",
     "@tiptap/extension-placeholder": "^2.27.3",
@@ -288,44 +287,29 @@
     "@tiptap/extension-table-cell": "^2.27.3",
     "@tiptap/extension-table-header": "^2.27.3",
     "@tiptap/extension-table-row": "^2.27.3",
-    "@tiptap/extension-youtube": "^2.10.0",
-    "@tiptap/pm": "^2.10.0",
-    "@tiptap/react": "^2.10.0",
+    "@tiptap/extension-youtube": "^2.27.3",
+    "@tiptap/pm": "^2.27.3",
+    "@tiptap/react": "^2.27.3",
     "@tiptap/starter-kit": "^2.27.3",
+    "fast-diff": "^1.3.0",
+    "lightweight-charts": "^5.2.1",
+    "sanitize-html": "^2.17.7"
+  },
+  "devDependencies": {
+    "@radixdlt/rola": "^2.1.0",
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
     "@types/sanitize-html": "^2.16.1",
     "@vercel/blob": "^2.8.2",
-    "fast-diff": "^1.3.0",
     "jose": "^6.2.12",
     "jsdom": "^30.1.0",
-    "lightweight-charts": "^5.2.1",
     "react": "^19.2.4",
-    "sanitize-html": "^2.17.7",
     "sharp": "^0.35.5",
     "typescript": "^5.9.0"
   },
   "peerDependencies": {
-    "@simplewebauthn/browser": ">=13",
-    "@simplewebauthn/server": ">=13",
-    "@tiptap/core": ">=2.10",
-    "@tiptap/extension-code-block": ">=2.10",
-    "@tiptap/extension-image": ">=2.10",
-    "@tiptap/extension-link": ">=2.10",
-    "@tiptap/extension-placeholder": ">=2.10",
-    "@tiptap/extension-table": ">=2.10",
-    "@tiptap/extension-table-cell": ">=2.10",
-    "@tiptap/extension-table-header": ">=2.10",
-    "@tiptap/extension-table-row": ">=2.10",
-    "@tiptap/extension-youtube": ">=2.10",
-    "@tiptap/pm": ">=2.10",
-    "@tiptap/react": ">=2.10",
-    "@tiptap/starter-kit": ">=2.10",
-    "fast-diff": ">=1.3",
-    "lightweight-charts": ">=5",
     "pg": ">=8",
     "react": ">=18",
-    "sanitize-html": ">=2",
     "jose": ">=6",
     "@radixdlt/rola": ">=2",
     "sharp": ">=0.33",
@@ -335,63 +319,9 @@
     "react": {
       "optional": true
     },
-    "@tiptap/core": {
-      "optional": true
-    },
-    "@tiptap/react": {
-      "optional": true
-    },
-    "@tiptap/extension-youtube": {
-      "optional": true
-    },
-    "@tiptap/extension-code-block": {
-      "optional": true
-    },
-    "@tiptap/starter-kit": {
-      "optional": true
-    },
-    "@tiptap/extension-link": {
-      "optional": true
-    },
-    "@tiptap/extension-image": {
-      "optional": true
-    },
-    "@tiptap/extension-table": {
-      "optional": true
-    },
-    "@tiptap/extension-table-row": {
-      "optional": true
-    },
-    "@tiptap/extension-table-cell": {
-      "optional": true
-    },
-    "@tiptap/extension-table-header": {
-      "optional": true
-    },
-    "@tiptap/extension-placeholder": {
-      "optional": true
-    },
-    "sanitize-html": {
-      "optional": true
-    },
-    "@tiptap/pm": {
-      "optional": true
-    },
-    "fast-diff": {
-      "optional": true
-    },
     "pg": {
       "optional": true
     },
-    "@simplewebauthn/server": {
-      "optional": true
-    },
-    "@simplewebauthn/browser": {
-      "optional": true
-    },
-    "lightweight-charts": {
-      "optional": true
-    },
     "jose": {
       "optional": true
     },