wiki-formant 0.51.0 → 0.52.1

package/bin/prisma-models.mjs

@@ -16,21 +16,56 @@
 //   npx prisma-models --check           # exit 1 if either is missing or differs
 //   npx prisma-models analytics         # only the ones named
 //   npx prisma-models --dir db/schema   # another folder
+//
+// An app that keeps one schema file and hand-writes the models into it, with a
+// relation the shipped ones cannot carry, checks them in place instead.
+// `--tenant` lets each model's `siteId` drop its default and gain a relation:
+//
+//   npx prisma-models analytics --check --in prisma/schema.prisma --tenant
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { arg } from './_cli.mjs';
 
 const MODELS = ['analytics', 'passkey'];
 const args = process.argv.slice(2);
 const check = args.includes('--check');
-const at = args.indexOf('--dir');
-const dir = at >= 0 ? args[at + 1] : 'prisma/schema';
-const named = args.filter((a, i) => !a.startsWith('--') && args[i - 1] !== '--dir');
+const dir = arg('--dir') ?? 'prisma/schema';
+const into = arg('--in');
+const tenant = args.includes('--tenant');
+const named = args.filter((a, i) => !a.startsWith('--') && !['--dir', '--in'].includes(args[i - 1]));
 const unknown = named.filter(n => !MODELS.includes(n));
 
-if (unknown.length || !dir) {
-  console.error(`usage: prisma-models [${MODELS.join('|')}…] [--dir <folder>] [--check]`);
+if (unknown.length || !dir || (into !== undefined && !check)) {
+  console.error(`usage: prisma-models [${MODELS.join('|')}…] [--dir <folder>] [--check [--in <schema file> [--tenant]]]`);
   process.exit(2);
 }
+
+// A model as `name → its lines`, comments, blank lines and spacing dropped.
+const models = text =>
+  new Map(
+    [...text.matchAll(/^model\s+(\w+)\s*\{[ \t]*$([\s\S]*?)^\}/gm)].map(([, name, body]) => [
+      name,
+      body
+        .split('\n')
+        .map(l => l.replace(/\/\/.*/, '').trim().replace(/\s+/g, ' '))
+        .filter(l => l && !(tenant && /^\w+ \w+ @relation\(fields: \[siteId\]/.test(l)))
+        .map(l => (tenant ? l.replace(/^siteId String @default\(""\)$/, 'siteId String') : l))
+        .join('\n'),
+    ]),
+  );
+
+if (into !== undefined) {
+  const local = models(readFileSync(into, 'utf8'));
+  let drift = 0;
+  for (const name of named.length ? named : MODELS) {
+    for (const [model, body] of models(readFileSync(new URL(`../prisma/${name}.prisma`, import.meta.url), 'utf8'))) {
+      if (local.get(model) === body) continue;
+      drift++;
+      console.error(`${into}: model ${model} ${local.has(model) ? 'differs from' : 'is missing from'} wiki-formant's prisma/${name}.prisma`);
+    }
+  }
+  process.exit(drift ? 1 : 0);
+}
 if (!existsSync(dir)) {
   console.error(`prisma-models: no ${dir}/ here. Move prisma/schema.prisma into it and point prisma.config.ts's schema at the folder.`);
   process.exit(2);

package/dist/base.css

@@ -40,6 +40,31 @@
   .columns-layout > .column-view { align-self: stretch; }
 }
 
+/* ---- layout primitives ------------------------------------------------------
+   A column, a row and a row with its ends pushed apart. radix-wiki and caper
+   wrote these with the same gaps, and acuiq2 the column; a site that meant
+   something else by a name renamed its own. The gaps are the ones all of them
+   used, so they stay here rather than going back to every stylesheet. */
+.stack, .stack-xs, .stack-sm, .stack-lg { display: flex; flex-direction: column; gap: 1rem; }
+.stack-xs { gap: 0.25rem; }
+.stack-sm { gap: 0.5rem; }
+.stack-lg { gap: 1.5rem; }
+.row, .row-xs, .row-md, .row-lg { display: flex; align-items: center; gap: 0.5rem; }
+.row-xs { gap: 0.25rem; }
+.row-md { gap: 0.75rem; }
+.row-lg { gap: 1rem; }
+.spread { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 1rem; }
+.badge { display: inline-flex; align-items: center; border-radius: 9999px; }
+
+/* A page whose first block is an infobox, one column with the infobox on top.
+   Where it splits into prose and a rail is the site's: a viewport width on one,
+   its column's width on another. Both items need `min-width: 0`, or the one
+   shared track sizes to the widest item's min-content and the other inherits
+   the overflow. */
+.page-with-infobox { display: grid; grid-template-columns: minmax(0, 1fr); grid-template-areas: "infobox" "content"; }
+.page-with-infobox > .page-main-content { grid-area: content; min-width: 0; }
+.page-with-infobox > .infobox { grid-area: infobox; min-width: 0; }
+
 /* ---- the block views and the infobox ---------------------------------------
    The structure three or four sites had each restated around this markup;
    padding, gaps, radii and colour stay theirs. A stats block is two columns,

package/dist/block-views.js

@@ -2,9 +2,8 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 // block-views.tsx — the block leaves the wikis share.
 //
-// Behind its own subpath for the reason `react.tsx` is: React is an OPTIONAL
-// peer, so a consumer that only wants the taxonomy or the MCP transport still
-// installs a package with no runtime dependencies.
+// Behind its own subpath for the reason `react.tsx` is: React is an optional
+// peer, so a consumer that only wants the taxonomy or the MCP transport needs no React.
 //
 // WHY THESE FIVE AND NOT THE SWITCH. The block union is per-repo and staying
 // that way (see the Block Model note in the workspace CLAUDE.md) — a closed

package/dist/crawlers.d.ts

@@ -14,8 +14,8 @@ export interface AiCrawler {
 }
 /**
  * Structurally what Next's `MetadataRoute.Robots['rules']` wants, without
- * importing Next: this package has no runtime dependencies and is not going to
- * grow one for a shape that is three optional string fields.
+ * importing Next: this package does not depend on Next and is not going to for
+ * a shape that is three optional string fields.
  */
 export interface RobotsGroup {
     userAgent: string;

package/dist/db.d.ts

@@ -19,3 +19,28 @@ export interface PgPoolConfig {
  * a page that fans out more than three queries in thirty seconds.
  */
 export declare function pgPoolConfig(url: string | undefined): PgPoolConfig;
+/**
+ * What every app's prisma.config.ts hands `defineConfig`, from the folder the
+ * file sits in: `defineConfig(prismaConfig(import.meta.dirname))`. Four apps
+ * carried the file, three of them byte for byte.
+ *
+ * Read only by the Prisma CLI, never by the app, so the URL prefers DIRECT_URL:
+ * every CLI operation that connects (db push, migrate diff, studio) needs a
+ * session connection, and Supabase's transaction pooler on 6543, which
+ * DATABASE_URL names, hangs on them rather than failing. A placeholder stands
+ * in where neither is set, as on a Vercel build: `prisma generate` reads the
+ * schema and never connects, and anything that does connect fails loudly.
+ *
+ * `schema` is a folder of .prisma files (`prisma-models` writes beside the
+ * app's own) or a single file. Paths resolve against `root`, so the CLI works
+ * from a subdirectory.
+ */
+export declare function prismaConfig(root: string, schema?: string): {
+    schema: string;
+    migrations: {
+        path: string;
+    };
+    datasource: {
+        url: string;
+    };
+};

package/dist/db.js

@@ -1,4 +1,4 @@
-// db.ts — the pool settings every app here hands to `pg`.
+// db.ts — the pool settings every app here hands to `pg`, and the config its prisma.config.ts hands the Prisma CLI.
 //
 // Four Prisma client modules carried the same block, comment and all. It is a
 // value, not a client: the app still owns `new pg.Pool(...)`, the adapter and
@@ -25,3 +25,34 @@ export function pgPoolConfig(url) {
         connectionTimeoutMillis: 30_000,
     };
 }
+/**
+ * What every app's prisma.config.ts hands `defineConfig`, from the folder the
+ * file sits in: `defineConfig(prismaConfig(import.meta.dirname))`. Four apps
+ * carried the file, three of them byte for byte.
+ *
+ * Read only by the Prisma CLI, never by the app, so the URL prefers DIRECT_URL:
+ * every CLI operation that connects (db push, migrate diff, studio) needs a
+ * session connection, and Supabase's transaction pooler on 6543, which
+ * DATABASE_URL names, hangs on them rather than failing. A placeholder stands
+ * in where neither is set, as on a Vercel build: `prisma generate` reads the
+ * schema and never connects, and anything that does connect fails loudly.
+ *
+ * `schema` is a folder of .prisma files (`prisma-models` writes beside the
+ * app's own) or a single file. Paths resolve against `root`, so the CLI works
+ * from a subdirectory.
+ */
+export function prismaConfig(root, schema = 'prisma/schema') {
+    try {
+        process.loadEnvFile(`${root}/.env`);
+    }
+    catch {
+        // A Vercel build has no .env and needs none.
+    }
+    return {
+        schema: `${root}/${schema}`,
+        migrations: { path: `${root}/prisma/migrations` },
+        datasource: {
+            url: process.env.DIRECT_URL ?? process.env.DATABASE_URL ?? 'postgresql://placeholder:placeholder@localhost:5432/placeholder',
+        },
+    };
+}

package/dist/editor.d.ts

@@ -15,6 +15,9 @@ export type { StarterKitOptions } from '@tiptap/starter-kit';
 export type { LinkOptions } from '@tiptap/extension-link';
 export type { ImageOptions } from '@tiptap/extension-image';
 export type { TableOptions } from '@tiptap/extension-table';
+/** The view and the editor's type, so a consumer imports nothing from `@tiptap/*` itself. */
+export { EditorContent } from '@tiptap/react';
+export type { Editor } from '@tiptap/core';
 export interface WikiEditorExtensionOptions {
     /** Empty-document prompt. */
     placeholder?: string;

package/dist/editor.js

@@ -33,6 +33,8 @@ import { useEditor } from '@tiptap/react';
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { toMapEmbedUrl } from './maps.js';
 import { cx } from './html.js';
+/** The view and the editor's type, so a consumer imports nothing from `@tiptap/*` itself. */
+export { EditorContent } from '@tiptap/react';
 // ---- paste scrubbing --------------------------------------------------------
 /**
  * Reduce pasted HTML to structure plus the three attributes that carry meaning.

package/dist/headers.d.ts

@@ -25,3 +25,31 @@ export declare function contentSecurityPolicy(directives?: Partial<Record<CspDir
  * sets its policy per request (a nonce) passes none.
  */
 export declare function securityHeaders(csp?: string | null): HeaderEntry[];
+/** The parts of a Next config `withWikiDefaults` fills in. */
+interface WikiNextConfig {
+    distDir?: string;
+    experimental?: object;
+    images?: object;
+    headers?: () => Promise<unknown[]> | unknown[];
+}
+/**
+ * An app's Next config with the settings every app here wrote out the same way:
+ *
+ * - `distDir` from `STUDIO_DIST_DIR`, set only by radix-studio's renders, which
+ *   boot a second dev server beside the running one, and Next allows one per
+ *   distDir.
+ * - `turbopackFileSystemCacheForBuild: false`. Next 16.3 turns Turbopack's
+ *   build cache on and Vercel restores it from the last deployment; caper
+ *   shipped a stylesheet two commits stale that way in October 2026.
+ * - AVIF before WebP from the image optimiser.
+ * - `securityHeaders` on every route, with `csp` enforced in production only:
+ *   Next's dev runtime is inline and `eval`. An origin that sets its policy
+ *   per request (a nonce) passes none.
+ *
+ * Anything the app sets wins, and its own `headers()` follow these. Pass
+ * `NextConfig` as `T` so the object is typed as Next's own config.
+ */
+export declare function withWikiDefaults<T extends WikiNextConfig>(config: T, { csp }?: {
+    csp?: string;
+}): T;
+export {};

package/dist/headers.js

@@ -11,7 +11,8 @@
 // `youtube-nocookie.com` its sanitiser kept, so those embeds survived cleaning
 // and then rendered blank.
 //
-// Zero imports, so a config pays for nothing it does not use.
+// Zero imports, so a config pays for nothing it does not use. `withWikiDefaults`
+// is here for the same reason: next.config.ts is its only caller.
 /**
  * The embed hosts the editor's iframe, YouTube, tweet and map nodes produce:
  * the sanitiser's default `iframeHosts` and the default `frame-src`, so an
@@ -78,3 +79,34 @@ export function securityHeaders(csp) {
         { key: 'X-DNS-Prefetch-Control', value: 'on' },
     ];
 }
+/**
+ * An app's Next config with the settings every app here wrote out the same way:
+ *
+ * - `distDir` from `STUDIO_DIST_DIR`, set only by radix-studio's renders, which
+ *   boot a second dev server beside the running one, and Next allows one per
+ *   distDir.
+ * - `turbopackFileSystemCacheForBuild: false`. Next 16.3 turns Turbopack's
+ *   build cache on and Vercel restores it from the last deployment; caper
+ *   shipped a stylesheet two commits stale that way in October 2026.
+ * - AVIF before WebP from the image optimiser.
+ * - `securityHeaders` on every route, with `csp` enforced in production only:
+ *   Next's dev runtime is inline and `eval`. An origin that sets its policy
+ *   per request (a nonce) passes none.
+ *
+ * Anything the app sets wins, and its own `headers()` follow these. Pass
+ * `NextConfig` as `T` so the object is typed as Next's own config.
+ */
+export function withWikiDefaults(config, { csp } = {}) {
+    return {
+        ...(process.env.STUDIO_DIST_DIR ? { distDir: process.env.STUDIO_DIST_DIR } : {}),
+        ...config,
+        experimental: { turbopackFileSystemCacheForBuild: false, ...config.experimental },
+        images: { formats: ['image/avif', 'image/webp'], ...config.images },
+        async headers() {
+            return [
+                { source: '/:path*', headers: securityHeaders(process.env.NODE_ENV === 'production' ? csp : null) },
+                ...((await config.headers?.()) ?? []),
+            ];
+        },
+    };
+}

package/dist/headings.d.ts

@@ -1,3 +1,4 @@
+import { type NormaliseLinkOptions } from './links.js';
 /** A heading found in a page's HTML, in document order. */
 export interface Heading {
     id: string;
@@ -84,3 +85,12 @@ export interface OutlineIssue {
  * single `noH1` and nothing else, since every later rule would restate it.
  */
 export declare function outlineIssues(html: string): OutlineIssue[];
+/**
+ * The pass every app runs over a content block's stored HTML before it renders:
+ * heading ids, a scroll box round each table, and, given `links`, every anchor
+ * tagged internal or external. Four apps wrote the same chain in three orders.
+ * Pass one `used` set (and one `links.citedRefs`) across a page's blocks.
+ */
+export declare function articleHtml(html: string, { links, ...headings }?: HeadingIdOptions & {
+    links?: NormaliseLinkOptions;
+}): string;

package/dist/headings.js

@@ -14,6 +14,8 @@
 // that with a fresh set each time, so a "Notes" in two blocks shipped two
 // `id="notes"`. One `used` set per page is what makes the dedupe hold.
 import { getAttr, stripTags } from './html.js';
+import { scrollTables } from './dom.js';
+import { normaliseLinks } from './links.js';
 /** The default slug rule: lowercase words joined by hyphens. */
 export function slugifyHeading(text) {
     return text
@@ -131,3 +133,13 @@ export function outlineIssues(html) {
         issues.push({ fault: 'noSubheading', level: 1 });
     return issues;
 }
+/**
+ * The pass every app runs over a content block's stored HTML before it renders:
+ * heading ids, a scroll box round each table, and, given `links`, every anchor
+ * tagged internal or external. Four apps wrote the same chain in three orders.
+ * Pass one `used` set (and one `links.citedRefs`) across a page's blocks.
+ */
+export function articleHtml(html, { links, ...headings } = {}) {
+    const out = scrollTables(injectHeadingIds(html, headings));
+    return links ? normaliseLinks(out, links) : out;
+}

package/dist/history.js

@@ -3,7 +3,7 @@
 // `revisions.ts` decides which bump a save asks for and stays free of
 // dependencies, because every write path imports it. This is the reading half:
 // the same walk, turned into what a reviewer is shown. It needs a text diff, so
-// it needs `fast-diff`, an optional peer; hence its own subpath.
+// it needs `fast-diff`; hence its own subpath.
 //
 // radix-wiki had it first and shipped both HTML bodies of every modified block
 // to the browser to diff there: 887 KB of payload for a 13-revision page whose

package/dist/http.d.ts

@@ -42,8 +42,12 @@ export declare function textHeaders(etag: string, lastModified: string, maxAge?:
  *
  * `lastModified` is optional because not every corpus has a row timestamp to
  * offer, and a twin that stamps the epoch is worse than one that stamps
- * nothing. `extra` carries whatever the mount needs on top — an `X-Robots-Tag`
- * where the twin is a second public URL with no canonical of its own.
+ * nothing. `extra` carries whatever the mount needs on top.
+ *
+ * `noindex` is for a twin of an HTML page: a search engine that reads the twin
+ * has the page already, and Google indexed `.md` beside the HTML until four
+ * routes each set `X-Robots-Tag` by hand. A document with no HTML page, such
+ * as AGENTS.md, leaves it off.
  *
  * Pass `etag`. The twin is the single most recrawled URL a page has, and a
  * response with no validator is a full render on every pass forever — the same
@@ -55,6 +59,7 @@ export declare function textHeaders(etag: string, lastModified: string, maxAge?:
 export declare function markdownHeaders(lastModified?: string | null, opts?: {
     maxAge?: number;
     etag?: string;
+    noindex?: boolean;
     extra?: Record<string, string>;
 }): Record<string, string>;
 /**

package/dist/http.js

@@ -100,8 +100,12 @@ export function textHeaders(etag, lastModified, maxAge = 3600) {
  *
  * `lastModified` is optional because not every corpus has a row timestamp to
  * offer, and a twin that stamps the epoch is worse than one that stamps
- * nothing. `extra` carries whatever the mount needs on top — an `X-Robots-Tag`
- * where the twin is a second public URL with no canonical of its own.
+ * nothing. `extra` carries whatever the mount needs on top.
+ *
+ * `noindex` is for a twin of an HTML page: a search engine that reads the twin
+ * has the page already, and Google indexed `.md` beside the HTML until four
+ * routes each set `X-Robots-Tag` by hand. A document with no HTML page, such
+ * as AGENTS.md, leaves it off.
  *
  * Pass `etag`. The twin is the single most recrawled URL a page has, and a
  * response with no validator is a full render on every pass forever — the same
@@ -117,6 +121,7 @@ export function markdownHeaders(lastModified, opts = {}) {
         'Cache-Control': `public, s-maxage=${maxAge}, stale-while-revalidate=${maxAge * 24}`,
         ...(opts.etag ? { ETag: opts.etag } : {}),
         ...(lastModified ? { 'Last-Modified': lastModified } : {}),
+        ...(opts.noindex ? { 'X-Robots-Tag': 'noindex' } : {}),
         ...opts.extra,
     };
 }

package/dist/indexnow.d.ts

@@ -7,6 +7,13 @@ export interface IndexNowEntry {
 }
 /** The `<loc>` and `<lastmod>` of every `<url>` in a sitemap. */
 export declare function sitemapEntries(xml: string): IndexNowEntry[];
+/**
+ * Every entry of the sitemap at `url`, following a sitemap index one level down
+ * to at most 20 children. The `indexnow` and `check-pages` bins each parsed
+ * sitemaps, and only one of them read an index. Throws when `url` itself does
+ * not answer 200; a child that fails is skipped.
+ */
+export declare function readSitemap(url: string, fetchImpl?: typeof fetch): Promise<IndexNowEntry[]>;
 /**
  * The URLs modified at or after `since`. An entry with no `lastModified` is
  * left out: nothing says it changed, and the protocol asks for changed pages

package/dist/indexnow.js

@@ -12,11 +12,10 @@
 // The key is not a secret. An engine verifies a submission by fetching
 // `/<key>.txt` from the origin, so the key is public by design, and the file in
 // each app's `public/` is the only copy.
+import { decodeEntities } from './markdown.js';
 export const INDEXNOW_ENDPOINT = 'https://api.indexnow.org/indexnow';
 /** The protocol's cap on the URLs in one POST. */
 export const INDEXNOW_BATCH = 10_000;
-const XML_ENTITIES = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" };
-const unescapeXml = (s) => s.trim().replace(/&(amp|lt|gt|quot|apos);/g, (_, e) => XML_ENTITIES[e]);
 /** The `<loc>` and `<lastmod>` of every `<url>` in a sitemap. */
 export function sitemapEntries(xml) {
     const entries = [];
@@ -25,10 +24,30 @@ export function sitemapEntries(xml) {
         if (!loc)
             continue;
         const lastmod = /<lastmod>([\s\S]*?)<\/lastmod>/.exec(body)?.[1];
-        entries.push(lastmod ? { url: unescapeXml(loc), lastModified: lastmod.trim() } : { url: unescapeXml(loc) });
+        const url = decodeEntities(loc.trim());
+        entries.push(lastmod ? { url, lastModified: lastmod.trim() } : { url });
     }
     return entries;
 }
+/**
+ * Every entry of the sitemap at `url`, following a sitemap index one level down
+ * to at most 20 children. The `indexnow` and `check-pages` bins each parsed
+ * sitemaps, and only one of them read an index. Throws when `url` itself does
+ * not answer 200; a child that fails is skipped.
+ */
+export async function readSitemap(url, fetchImpl = fetch) {
+    const res = await fetchImpl(url);
+    if (!res.ok)
+        throw new Error(`${url} answered ${res.status}`);
+    const xml = await res.text();
+    if (!/<sitemapindex/i.test(xml))
+        return sitemapEntries(xml);
+    const children = [...xml.matchAll(/<loc>([\s\S]*?)<\/loc>/g)].slice(0, 20).map(m => decodeEntities(m[1].trim()));
+    const entries = [];
+    for (const child of children)
+        entries.push(...(await readSitemap(child, fetchImpl).catch(() => [])));
+    return entries;
+}
 /**
  * The URLs modified at or after `since`. An entry with no `lastModified` is
  * left out: nothing says it changed, and the protocol asks for changed pages

package/dist/maintenance.js

@@ -17,6 +17,7 @@
 // which is what lets an audit spend no probes on its flag list.
 //
 // No subpath exports this: the bins and the tests import it from dist.
+import { escXml } from './feed.js';
 /** Held in state. */
 const MAX = { backlog: 60, runs: 30, feedback: 40, sources: 150 };
 /** Shown on the page. What a reader pays is words, and the entries run long. */
@@ -63,7 +64,7 @@ export function addBacklog(state, items, today) {
     }
     return added;
 }
-const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+const esc = (s) => escXml(String(s ?? ''));
 const more = (shown, total, what) => total > shown ? `<p><em>${total - shown} older ${what} held in state.</em></p>` : '';
 const table = (head, rows) => `<table><tbody><tr>${head.map(h => `<td><strong>${h}</strong></td>`).join('')}</tr>` +
     (rows.join('') || `<tr>${head.map(() => '<td>–</td>').join('')}</tr>`) +

package/dist/react.d.ts

@@ -171,7 +171,7 @@ export interface TypeaheadState<T> {
  *     per mount, not module-level, so a stale result cannot outlive the page.
  *
  * The debounce is inlined rather than pulled from a package: this one is nine
- * lines, and the point of the package is to have no runtime dependencies.
+ * lines, and a dependency for nine lines is not worth one.
  */
 export declare function useTypeahead<T>({ fetch, onPick, onEscape, delay, minLength, cache, }: TypeaheadOptions<T>): TypeaheadState<T>;
 export interface LinkPreviewOptions<T> {

package/dist/react.js

@@ -3,9 +3,8 @@ import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-run
 // react.tsx — the collapsible wiki sidebar, and the table of contents inside it.
 //
 // This is the one part of the package that needs React, so it is the one part
-// behind its own subpath: `wiki-formant/react`. React is an OPTIONAL PEER
-// dependency, so a consumer that only wants the taxonomy or the MCP transport
-// still installs a package with no runtime dependencies at all.
+// behind its own subpath: `wiki-formant/react`. React is an optional peer, so a
+// consumer that only wants the taxonomy or the MCP transport needs no React.
 //
 // What is shared here is behaviour, not appearance. Every class name is passed
 // in, because the three wikis style their rails differently and always will;
@@ -292,7 +291,7 @@ export function useClickOutside(onClose) {
  *     per mount, not module-level, so a stale result cannot outlive the page.
  *
  * The debounce is inlined rather than pulled from a package: this one is nine
- * lines, and the point of the package is to have no runtime dependencies.
+ * lines, and a dependency for nine lines is not worth one.
  */
 export function useTypeahead({ fetch, onPick, onEscape, delay = 200, minLength = 1, cache = true, }) {
     const [query, setQuery] = useState('');

package/dist/sanitize.js

@@ -11,7 +11,7 @@
 // Everything is an allowlist: unknown tags, unknown attributes (every on*
 // handler among them) and non-http(s) URLs are dropped, not escaped. Run it
 // server-side, on the render path, so it covers rows written before it existed
-// and no sanitiser ships to the client. `sanitize-html` is an optional peer.
+// and no sanitiser ships to the client.
 import sanitizeHtml from 'sanitize-html';
 import { DEFAULT_IFRAME_HOSTS } from './headers.js';
 // Inline SVG, presentational elements only. The infographics pipeline embeds

package/dist/stats.d.ts

@@ -1,4 +1,6 @@
+import type { ReactNode } from 'react';
 import { type Digest, type StatsFilter } from './analytics.js';
+import type { PasskeyGate } from './passkey.js';
 export interface StatsProps {
     /** One window's figures, from `digest` in `wiki-formant/analytics`. */
     digest: Digest;
@@ -26,3 +28,29 @@ export declare function statsQuery(params: Record<string, string | string[] | un
  * until the importing stylesheet gives them a colour.
  */
 export declare function Stats({ digest: d, days, filter, ranges }: StatsProps): import("react").JSX.Element;
+export interface StatsGateProps {
+    gate: PasskeyGate;
+    /** The gate's cookie from the request: `(await cookies()).get(gate.cookie)?.value`. */
+    session: string | undefined;
+    /** `?invite=` from the link, when there is one. */
+    invite?: string | undefined;
+    /** The site's host, named in the prompt. */
+    host: string;
+    /** The route that serves `gate.route`. */
+    endpoint?: string;
+    /** What a signed-in reader sees, rendered only for one. */
+    children: () => ReactNode | Promise<ReactNode>;
+    classNames?: {
+        text?: string;
+        actions?: string;
+        button?: string;
+        error?: string;
+    };
+}
+/**
+ * A stats page's door: `children` for a signed-in reader, else a line saying
+ * what the passkey prompt will do and the button that does it. With an invite
+ * it saves a passkey, as it does while the site has none; otherwise it signs
+ * in. Three apps wrote this branch and its three sentences.
+ */
+export declare function StatsGate({ gate, session, invite, host, endpoint, children, classNames: c }: StatsGateProps): Promise<string | number | bigint | boolean | Iterable<ReactNode> | import("react").JSX.Element | null | undefined>;

package/dist/stats.js

@@ -1,5 +1,6 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { STATS_FILTERS } from './analytics.js';
+import { PasskeyButton } from './passkey-button.js';
 import { StatsFigures } from './stats-figures.js';
 /** The windows the stats page offers, in days; `Infinity` is all time. */
 const STATS_RANGES = [1, 7, 30, 90, 365, Infinity];
@@ -74,3 +75,19 @@ export function Stats({ digest: d, days, filter = {}, ranges = STATS_RANGES }) {
     const windows = (_jsx("div", { role: "group", "aria-label": "Window", children: ranges.map(n => (_jsx("a", { href: href(n, filter), "aria-current": n === days ? 'page' : undefined, children: windowLabel(n) }, n))) }));
     return (_jsxs("div", { className: "stats", children: [narrowed.length > 0 && (_jsxs("div", { className: "stats-filters", children: [_jsx("ul", { "aria-label": "Narrowed to", children: narrowed.map(k => (_jsx("li", { children: _jsxs("a", { href: href(days, { ...filter, [k]: undefined }), title: "Remove", children: [NAMES[k], ": ", k === 'country' ? country(filter[k]) : filter[k], " \u00D7"] }) }, k))) }), start < counted && d.counted_from && (_jsxs("p", { children: ["Narrowed figures start on ", d.counted_from, ", the first day this site counted its own visits."] }))] })), _jsx(StatsFigures, { digest: d, first: first, windows: windows }), _jsxs("div", { className: "stats-lists", children: [_jsx(StatsList, { title: "Pages", rows: rows(d.top_pages, 'page', 'visitors'), to: to('page') }), _jsx(StatsList, { title: "Entry pages", rows: rows(d.entry_pages, 'page', 'visitors'), to: to('entry') }), _jsx(StatsList, { title: "Sources", rows: rows(d.top_sources, 'source', 'visitors'), to: to('source') }), _jsx(StatsList, { title: "From X posts", rows: rows(d.from_posts, 'page', 'visitors'), to: v => href(days, { ...filter, source: 'x', entry: v }) }), _jsx(StatsList, { title: "Sibling sites", rows: rows(d.sibling_referrals, 'source', 'visitors'), to: to('source') }), _jsx(StatsList, { title: "Countries", rows: rows(d.countries, 'country', 'visitors'), label: country, to: to('country') }), _jsx(StatsList, { title: "Devices", rows: rows(d.devices, 'device', 'visitors'), to: to('device') }), _jsx(StatsList, { title: "Agent tool calls", rows: rows(d.agent_tool_calls, 'tool', 'events') }), _jsx(StatsList, { title: "Searches that found nothing", rows: rows(d.gaps, 'query', 'events') })] })] }));
 }
+/**
+ * A stats page's door: `children` for a signed-in reader, else a line saying
+ * what the passkey prompt will do and the button that does it. With an invite
+ * it saves a passkey, as it does while the site has none; otherwise it signs
+ * in. Three apps wrote this branch and its three sentences.
+ */
+export async function StatsGate({ gate, session, invite, host, endpoint = '/api/passkey', children, classNames: c = {} }) {
+    if (!invite && (await gate.signedIn(session)))
+        return children();
+    const open = !invite && (await gate.open());
+    return (_jsxs(_Fragment, { children: [_jsx("p", { className: c.text, children: invite
+                    ? `Save a passkey on this device to open ${host}'s stats.`
+                    : open
+                        ? `No passkey is saved for ${host} yet. Save the first one here; any after that needs an invite.`
+                        : 'Sign in with a passkey saved for this site.' }), _jsx("div", { className: c.actions, children: _jsx(PasskeyButton, { endpoint: endpoint, invite: invite, create: open, className: c.button, errorClassName: c.error }) })] }));
+}

package/dist/tiptap.js

@@ -2,10 +2,8 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // tiptap.tsx — the custom editor nodes the wikis share.
 //
-// Behind its own subpath for the same reason `react.tsx` is: the four
-// `@tiptap/*` packages are OPTIONAL peer dependencies, so a consumer that only
-// wants the taxonomy or the MCP transport still installs a package with no
-// runtime dependencies at all.
+// Behind its own subpath so a module that only wants the taxonomy or the MCP
+// transport never loads the `@tiptap/*` packages.
 //
 // What is shared is the node schema and its behaviour, never appearance. Class
 // names and icons are injected, which is what lets one wiki keep `text-jupiter`