wiki-formant 0.52.1 → 0.56.0

package/README.md

@@ -392,7 +392,7 @@ different lists.
 ```ts
 import { trackAiBot, crawlerRules } from 'wiki-formant/crawlers';
 
-trackAiBot(request, event, () => import('@/lib/track'));   // in proxy.ts: label, or null
+trackAiBot(request, event, () => import('@/lib/track'));   // in proxy.ts: whether it counted
 const rules = crawlerRules({ allow: '/', disallow, aiAllow });
 ```
 
@@ -408,11 +408,11 @@ Every agent group also allows the agent surface — `/api/mcp`, the three `llms`
 
 `crawlerRules` returns every group robots.txt needs: the wildcard, one per AI crawler, and one for each search engine. Search engines get the HTML site and none of its twins — `/*.md$` always, plus `searchDisallow` — because the `*` group keeps the machine surface open to agents, and for Google a twin is a page it already has. Two origins wrote that group by hand and the third never did, so Google crawled its twins. The `<Link>` prefetch payload (`?_rsc=`) is refused in every group.
 
-`trackAiBot(request, event, load)` counts an `AI Bot Visit` inside `event.waitUntil`. `load` is a dynamic import because the tracker pulls in a database client, which a static import would load for every request the proxy sees.
+`trackAiBot(request, event, load)` counts an `AI Bot Visit` inside `event.waitUntil`: a crawler on the roster wherever it goes, and anything but a search engine that asks for what only agents read (a `.md` twin or `Accept: text/markdown`, the `llms` exports, `/openapi.json`, `/.well-known/`), since most agents are on no roster. Its user agent is kept, so `digest` can name it. `load` is a dynamic import because the tracker pulls in a database client, which a static import would load for every request the proxy sees.
 
 ## IndexNow
 
-Bing, Yandex, Seznam, Naver and Yep take a POST of changed URLs instead of waiting to recrawl. The `indexnow` bin reads an origin's live sitemap and posts the rows whose `lastModified` falls inside the window, so the editor, the MCP write tools and the sweep scripts that write straight to the database are all covered with no hook in any of them. It runs where the sweeps run, never as a cron on the host: a submission costs the origin one cached sitemap fetch and no function time.
+Bing, Yandex, Seznam, Naver and Yep take a POST of changed URLs instead of waiting to recrawl. The `indexnow` bin reads an origin's live sitemap and posts the rows whose `lastModified` falls inside the window, so the editor, the MCP write tools and the sweep scripts that write straight to the database are all covered with no hook in any of them. It runs where the sweeps run, never as a cron on the host: a submission costs the origin one sitemap render and no scheduled function. The sitemap must render per request. A cached one froze at the last deploy and listed none of the pages edited since, so this bin submitted nothing.
 
 The key is public by design, since an engine checks it by fetching `/<key>.txt`. The file in the app's `public/` is the only copy, and the bin finds it there, so run it from the app's root. It checks that the live origin serves the key before posting anything.
 
@@ -535,6 +535,20 @@ export const GET = async (request: Request) => feedResponse(request, channel, aw
 had not — the recrawl the conditional-GET helpers exist to prevent. An empty feed
 carries no build date rather than a fictional one.
 
+## Sitemaps
+
+`treeSitemap(pages, { sections, sectionRow, pageRow })` returns the rows a wiki's tree adds to its sitemap: a row per section, dated by the newest page at or beneath it, then a row per page, dated by its own `updatedAt`. All three wikis listed their sections, and each dated them differently. One used the newest page beneath, one did the same from a derived tree, and one used no date at all. A section with no page beneath it carries no date rather than an invented one.
+
+```ts
+...treeSitemap(pages, {
+  sections: tagPrefixes(pages.map(p => p.tagPath)),
+  sectionRow: path => ({ url: `${SITE_URL}/wiki/${path}`, changeFrequency: 'weekly', priority: 0.6 }),
+  pageRow: p => ({ url: pageUrl(p), changeFrequency: 'weekly', priority: 0.7 }),
+}),
+```
+
+Every URL appears once. An empty-slug page is its section's own article, so it dates the section and gets no row of its own. A section whose URL a page already holds is served as that page, so the section row is dropped. `tagPrefixes` lists every path at or above the given ones, for a wiki whose sections are wherever its pages sit rather than a configured list. Which sections exist, the URLs, and each row's frequency and priority stay with the caller.
+
 ## Licence declarations
 
 
@@ -657,11 +671,11 @@ export const POST = uploadHandler({
 });
 ```
 
-The bytes say what the file is, never the name or type, and SVG is refused. Every image is re-encoded, upright, so nothing from the source's metadata is kept, a phone's GPS position included; the bytes as sent are never stored. `encode` is the re-encode, the sniffed format by default; a wiki with an image standard resizes and converts there. Each uploader has a budget, keyed on `authorize`'s id and address. `maxBytes`, `maxPixels` and `rateLimit` take other limits, and `store` replaces Vercel Blob. `sharp` and `@vercel/blob` are optional peers. `normalizeImage(bytes, { maxPixels, encode })` is the same sniff, cap and re-encode without the route, for images that arrive another way – a server action, or a picture copied in from another site; it resolves to `{ buffer, format, contentType }` and throws a message fit to show the uploader.
+The bytes say what the file is, never the name or type, and SVG is refused. Every image is re-encoded, upright, so nothing from the source's metadata is kept, a phone's GPS position included; the bytes as sent are never stored. `encode` is the re-encode, the sniffed format by default; a wiki with an image standard resizes and converts there. Each uploader has a budget keyed on `authorize`'s id and address, and each address one of its own, so an id minted fresh per burst (a self-signed wallet) refills nothing. `maxBytes`, `maxPixels` and `rateLimit` take other limits, and `store` replaces Vercel Blob. `sharp` and `@vercel/blob` are optional peers. `normalizeImage(bytes, { maxPixels, encode })` is the same sniff, cap and re-encode without the route, for images that arrive another way – a server action, or a picture copied in from another site; it resolves to `{ buffer, format, contentType }` and throws a message fit to show the uploader.
 
 ## Editor nodes
 
-`wiki-formant/tiptap` carries the custom nodes both wiki editors had written twice: `Iframe`, `YouTube` (the stock extension plus the paste rule it does not ship with), `TwitterEmbed`, `createMapEmbed`, `createCodeBlock` and `createTabs`.
+`wiki-formant/tiptap` carries the custom nodes both wiki editors had written twice: `Iframe`, `YouTube` (the stock extension plus the paste rule it does not ship with), `TwitterEmbed`, `createMapEmbed`, `createCodeBlock` and `createTabs`. `Iframe` and `createMapEmbed` draw a frame only for an https src on `DEFAULT_IFRAME_HOSTS` (`embedSrc`), since an editor draws stored HTML where its author is signed in, and a `javascript:` src runs there under any CSP that allows inline script.
 
 ```ts
 const CodeBlock = createCodeBlock({
@@ -778,10 +792,13 @@ and may be a batch; `trackSearch` normalises a search box's free text so
 the same question aggregates as one row, and drops an empty one. Pass the request's headers and the
 event joins whoever sent it, person or agent.
 
-`digest(sql, { days })` reads a site back as one JSON object: visitors, page
-views, bounce rate, visit length, sources (a link's `utm_source`, else the
-referring host), top and entry pages, countries, devices, visitors by day, MCP
-tool calls, and the searches that found nothing. A visit is a run of one
+`digest(sql, { days })` reads a site back as one JSON object: visitors, agents,
+page views, bounce rate, visit length, sources (a link's `utm_source`, else the
+referring host), top and entry pages, countries, devices, visitors and agents by
+day, the agents by name, MCP tool calls, and the searches that found nothing.
+An agent is counted as a visitor is, one address and user agent a day, from its
+`AI Bot Visit` and `MCP Call` events; it runs no page script, so it is never
+among the visitors. `ownAgents` leaves the site's own out. A visit is a run of one
 visitor's views with no gap over 30 minutes. A multi-tenant app passes a `site`
 key to every call and a `site` resolver to `collect`.
 
@@ -794,16 +811,17 @@ its readers asked for. The queries that return zero rows are the valuable ones
 
 `wiki-formant/passkey` is the door to a site's own admin pages: a passkey and
 nothing else, no account, password or email. `createPasskeyGate({ sql, rpName })`
-returns the whole of it. `gate.route` is the sign-in route,
-`gate.signedIn(cookieValue)` is the check a page makes, `gate.open()` is true
-while no passkey is saved, and `gate.cookie` is the cookie's name. The two tables (`Passkey`, `PasskeyToken`) ship as Prisma
+returns the whole of it. `gate.route` is the sign-in route, `gate.signOut` the
+sign-out route, `gate.signedIn(cookieValue)` is the check a page makes, and
+`gate.cookie` is the cookie's name. The two tables (`Passkey`, `PasskeyToken`) ship as Prisma
 models in `prisma/passkey.prisma`, and every token is kept only as its hash.
 
-There is no sign-up. While no passkey is saved, the page saves the first one
-from whoever opens it, so the owner should do that as soon as the door ships.
-Every passkey after that is saved from a single-use link that the
-`passkey-invite` bin prints from a machine holding `DATABASE_URL`. A passkey is
-bound to the host it was saved on, so localhost needs its own.
+There is no sign-up. Every passkey, the first among them, is saved from a
+single-use link that the `passkey-invite` bin prints from a machine holding
+`DATABASE_URL`, so a fresh deployment cannot be claimed by whoever reaches it
+first. A passkey is bound to the host it was saved on, so localhost needs its
+own. A session names the passkey that signed in: deleting a `Passkey` row signs
+out every session it opened.
 
 ```ts
 // src/lib/admin.ts
@@ -811,6 +829,7 @@ export const gate = createPasskeyGate({ sql, rpName: 'Caper' });
 
 // src/app/api/passkey/route.ts
 export const POST = gate.route;
+export const DELETE = gate.signOut;
 
 // src/app/stats/page.tsx
 const q = statsQuery(params); // ?days= (1, 7, 30, 90, 365 or all, else 30) and the filters
@@ -821,7 +840,7 @@ return (
 );
 ```
 
-`StatsGate` (`wiki-formant/stats`) renders `children` for a signed-in reader and, for anyone else, the line saying what the prompt will do and the `PasskeyButton` that does it; `classNames` places the text, the button's box, the button and its error.
+`StatsGate` (`wiki-formant/stats`) renders `children` and a sign-out button (`PasskeySignOut`) for a signed-in reader and, for anyone else, the line saying what the prompt will do and the `PasskeyButton` that does it; `classNames` places the text, the button's box, the button and its error.
 
 `PasskeyButton` (`wiki-formant/passkey-button`) is the browser half and has its
 own subpath, because it imports `@simplewebauthn/browser`.
@@ -831,8 +850,8 @@ headline figures, each with its change from the window before
 site's stylesheet to colour), one of them per day, every non-empty
 ranked list, and `?days=` links between windows, all time among them, pinned in
 the chart's frame as its own buttons are (`TimeChart`'s `controls`). Each
-figure is a button that charts it: visitors, page views, bounce rate, visit
-length, visitors with agents and clicks to X. `digest`'s `by_day` carries every
+figure is a button that charts it: visitors, agents, page views, bounce rate,
+visit length and clicks to X. `digest`'s `by_day` carries every
 one of those per UTC day, a visit on the day it began, so the days add up to the
 totals. A day with no visits has no bounce rate or visit length and is left out
 of those charts rather than drawn as zero. Everything but the figures and the
@@ -983,7 +1002,7 @@ npx analytics-digest --days 30 --handle radixwiki --siblings caper.network,acuiq
 npx analytics-digest --days 7 --gap "Symptom Miss:term"   # adds an event to the search gaps
 ```
 
-`passkey-invite` prints a single-use link that saves another passkey for the page it names, good for a day (`--days n` for longer). No routine calls it: the site's owner runs it by hand, from an app's checkout, when a second device or a second person needs into the stats page. Run it the same way:
+`passkey-invite` prints a single-use link that saves a passkey for the page it names, good for a day (`--days n` for longer). No routine calls it: the site's owner runs it by hand, from an app's checkout, for the first passkey and whenever another device or person needs into the stats page. Run it the same way:
 
 ```sh
 npx passkey-invite https://caper.network/stats
@@ -1008,7 +1027,7 @@ npx prisma-models analytics --check --in prisma/schema.prisma --tenant   # miow
 npx fts-ddl pages
 ```
 
-`mark-verified` stamps `last_verified_at` on pages a sweep checked and found current, so `freshnessBanner` stops calling them outdated, and `maintenance-log` is the state I/O of a wiki-sweep routine whose memory lives in one page's `metadata.state`: `read`, `write` (the whole state, or `-` for stdin), `compact` and `backlog-add`, which appends under a row lock so another routine's item cannot be lost to a concurrent `write`. Every write compacts and re-renders the page; a revision is written at most once a day. Two wikis carried both scripts against their own tables, so the tables are arguments. Run them from the app's root, like `passkey-invite`:
+`mark-verified` stamps `last_verified_at` on pages a sweep checked and found current, so `freshnessBanner` stops calling them outdated, and `maintenance-log` is the state I/O of a wiki-sweep routine whose memory lives in one page's `metadata.state`: `read`, `write` (the whole state, or `-` for stdin), `compact` and `backlog-add`, which appends under a row lock so another routine's item cannot be lost to a concurrent `write`. Every write compacts and re-renders the page, holding at most as many FLAG FOR A HUMAN items as the page shows; a revision is written at most once a day. `write` refuses a state whose `totalRuns` is below the stored one, which is a state read before another run wrote. Two wikis carried both scripts against their own tables, so the tables are arguments. Run them from the app's root, like `passkey-invite`:
 
 ```sh
 npx mark-verified contents/tech/radix-engine scrypto       # one page

package/bin/maintenance-log.mjs

@@ -26,13 +26,15 @@
 // `write` takes the whole new state: read, change, write back. A revision is
 // written at most once a day, and on every `compact`; other writes edit the
 // page in place, because a full copy per run is what made radix-wiki's log
-// over half its revisions table. `backlog-add` is how another routine files an
+// over half its revisions table. `write` refuses a state whose totalRuns is
+// below the stored one: that state was read before another run wrote.
+// `backlog-add` is how another routine files an
 // item: `write` replaces the whole state, so an append through it could lose a
 // concurrent run's, and the row lock serialises the two. A revision's version
 // is the page's `version` column bumped a minor where the table has one, else
 // the latest revision's.
 import { randomUUID } from 'node:crypto';
-import { addBacklog, compact, ident, render, scopeSql } from '../dist/maintenance.js';
+import { PINNED, addBacklog, compact, ident, render, scopeSql, staleWrite } from '../dist/maintenance.js';
 import { bump } from '../dist/versioning.js';
 import { arg, connect, invalidate } from './_cli.mjs';
 
@@ -105,6 +107,8 @@ try {
       const text = payload === undefined || payload === '-' ? await readStdin() : payload;
       if (!text.trim()) throw new Error('write needs the state as JSON, as an argument or on stdin with `write -`');
       input = JSON.parse(text);
+      const stale = staleWrite(page.metadata?.state ?? {}, input);
+      if (stale) throw new Error(stale);
     }
     const state = compact(input);
     const content = render(state, routine);
@@ -121,6 +125,13 @@ try {
       const [before, after] = [(input[key] ?? []).length, state[key].length];
       if (before !== after) console.log(`  ${key}: ${before} → ${after}`);
     }
+    const kept = new Set(state.backlog.map(b => b.item));
+    for (const b of input.backlog ?? []) {
+      const item = typeof b === 'string' ? b : b.item;
+      if (PINNED.test(item ?? '') && (typeof b === 'string' || (b.status ?? 'open') === 'open') && !kept.has(item)) {
+        console.log(`  flag dropped over the cap: ${item}`);
+      }
+    }
     console.log(
       `  ${dry ? '[dry] ' : ''}state ${JSON.stringify(input).length} → ${JSON.stringify(state).length} B, ` +
         `content ${JSON.stringify(content).length} B${revise ? `, revision v${version}` : ', no revision today'}`,

package/dist/analytics.d.ts

@@ -67,8 +67,9 @@ export interface DigestOptions {
     siblings?: string[];
     gaps?: Gap[];
     /**
-     * MCP callers left out of `agent_tool_calls`, matched inside the user agent.
-     * The default is the conformance suites (`<repo>-mcp-test`) and the studio's own tools.
+     * The site's own agents, left out of `agents`, `top_agents` and
+     * `agent_tool_calls`, matched inside the user agent. The default is the
+     * conformance suites (`<repo>-mcp-test`) and the studio's own tools.
      */
     ownAgents?: string[];
     /**
@@ -89,6 +90,7 @@ export interface DigestDay {
     bounces: number;
     /** Seconds from each visit's first view to its last, summed. */
     seconds: number;
+    agents: number;
     visitors_incl_agents: number;
     /** Clicks on links to the site's X handle; zero without a handle. */
     follow_clicks: number;
@@ -100,6 +102,13 @@ export interface Digest {
     bounce_rate: number | null;
     /** Mean seconds from a visit's first view to its last; null with no visits. */
     visit_duration: number | null;
+    /**
+     * Agents, counted as visitors are: an AI crawler, an MCP client, or anything
+     * else reading the machine surface (`trackAiBot`), one per address and user
+     * agent a day, the site's own left out. They run no page script, so they are
+     * never among `visitors`.
+     */
+    agents: number;
     /** Visitors plus every agent that sent an event, such as an MCP call. */
     visitors_incl_agents: number;
     /**
@@ -108,7 +117,7 @@ export interface Digest {
      * the archive cannot stand in for it: event figures always, all of them
      * when filtered.
      */
-    previous: Record<'visitors' | 'pageviews' | 'bounce_rate' | 'visit_duration' | 'visitors_incl_agents' | 'follow_clicks', number | null>;
+    previous: Record<'visitors' | 'pageviews' | 'bounce_rate' | 'visit_duration' | 'agents' | 'visitors_incl_agents' | 'follow_clicks', number | null>;
     /** The first UTC day this site counted itself, before which only `ViewDay` speaks; null with no views. */
     counted_from: string | null;
     top_sources: Ranked<'source', 'visitors'>;
@@ -125,6 +134,8 @@ export interface Digest {
         events: number;
         visitors: number;
     } | null;
+    /** Each agent by name: the roster's label, else what its user agent calls itself. */
+    top_agents: Ranked<'agent', 'visitors'>;
     agent_tool_calls: Ranked<'tool', 'events'>;
     gaps: Ranked<'query', 'events'>;
 }

package/dist/analytics.js

@@ -160,6 +160,11 @@ const VISIT_TEST = {
     country: v => `bool_or(country = ${v})`,
     device: v => `bool_or(device = ${v})`,
 };
+/**
+ * An agent's name from its event: the roster's label, else what its user agent
+ * calls itself, `compatible; X` or the first product token.
+ */
+const AGENT_NAME = `coalesce(props->>'bot', substring(props->>'ua' from 'compatible; ?([^/;) ]+)'), nullif(split_part(split_part(props->>'ua', '/', 1), ' ', 1), ''), '(unknown)')`;
 /**
  * Everything a report needs about one site's last `days` days, in one query.
  * Visitor figures count distinct visitors, so a person who comes back on
@@ -181,6 +186,8 @@ export async function digest(sql, { site = '', days, handle, siblings = [], gaps
     const follows = handle && `name = 'Outbound Link: Click' AND props->>'url' ILIKE ANY(${$([`%x.com/${handle}%`, `%twitter.com/${handle}%`])}::text[])`;
     const tests = STATS_FILTERS.flatMap(k => (filter[k] ? [VISIT_TEST[k]($(filter[k]))] : []));
     const day = (at) => `to_char(${at} AT TIME ZONE 'UTC', 'YYYY-MM-DD')`;
+    /** The site's own agents, as a test on an event's user agent. */
+    const ours = `coalesce(props->>'ua', '') ILIKE ANY(${$(ownAgents.map(a => `%${a}%`))}::text[])`;
     const gapSelects = gaps.map(g => {
         const prop = $(g.prop);
         return `(SELECT props->>${prop} AS query, count(*) AS events FROM e
@@ -210,6 +217,9 @@ export async function digest(sql, { site = '', days, handle, siblings = [], gaps
     ), e${s} AS (
       SELECT name, props, visitor, "createdAt" AS at FROM "Event" WHERE "siteId" = $1 AND ${at}
       ${tests.length ? `AND visitor IN (SELECT visitor FROM v${s})` : ''}
+    ), ag${s} AS (
+      SELECT visitor, at, ${AGENT_NAME} AS agent FROM e${s}
+      WHERE name IN ('AI Bot Visit', 'MCP Call') AND visitor IS NOT NULL AND NOT ${ours}
     ), a${s} AS (
       SELECT * FROM "ViewDay" WHERE "siteId" = $1 AND day >= ${dayAgo(back + 1)}${back ? ` AND day < ${dayAgo(back)}` : ''}${tests.length ? ' AND false' : ''}
     ), sessions${s} AS (
@@ -226,6 +236,7 @@ export async function digest(sql, { site = '', days, handle, siblings = [], gaps
       'pageviews', (SELECT count(*) FROM v${s}) + (SELECT pageviews FROM archived${s}),
       'bounce_rate', (SELECT round(100.0 * bounces / nullif(visits, 0)) FROM sessions${s}),
       'visit_duration', (SELECT round(seconds / nullif(visits, 0)) FROM sessions${s}),
+      'agents', (SELECT count(DISTINCT visitor) FROM ag${s}),
       'visitors_incl_agents', (SELECT count(DISTINCT visitor) FROM (SELECT visitor FROM v${s} UNION SELECT visitor FROM e${s}) u) + (SELECT visitors FROM archived${s})`;
     const [row] = (await sql(`WITH ${chain('', 0)}, ${chain('_p', 1)}, src AS (
       SELECT coalesce(source, '(none)') AS source, count(DISTINCT visitor) AS visitors FROM visits GROUP BY 1
@@ -243,17 +254,18 @@ export async function digest(sql, { site = '', days, handle, siblings = [], gaps
       'countries', ${list(merged('country', 'countries', 'SELECT country, count(DISTINCT visitor) FROM v WHERE country IS NOT NULL GROUP BY 1'), 10)},
       'devices', ${list(merged('device', 'devices', 'SELECT device, count(DISTINCT visitor) FROM v GROUP BY 1'))},
       'by_day', ${list(`SELECT date, sum(visitors) AS visitors, sum(pageviews) AS pageviews, sum(visits) AS visits, sum(bounces) AS bounces,
-          sum(seconds) AS seconds, sum(agents) AS visitors_incl_agents, sum(follows) AS follow_clicks FROM (
-          SELECT ${day('at')}, count(DISTINCT visitor), count(*), 0, 0, 0, 0, 0 FROM v GROUP BY 1
-          UNION ALL SELECT ${day('at')}, 0, 0, count(*), count(*) FILTER (WHERE views = 1), coalesce(sum(seconds), 0), 0, 0 FROM visits GROUP BY 1
-          UNION ALL SELECT ${day('at')}, 0, 0, 0, 0, 0, count(DISTINCT visitor), 0 FROM (SELECT at, visitor FROM v UNION ALL SELECT at, visitor FROM e) u GROUP BY 1
-          ${follows ? `UNION ALL SELECT ${day('at')}, 0, 0, 0, 0, 0, 0, count(*) FROM e WHERE ${follows} GROUP BY 1` : ''}
-          UNION ALL SELECT to_char(day, 'YYYY-MM-DD'), visitors, pageviews, visits, bounces, seconds, visitors, 0 FROM a
-        ) t(date, visitors, pageviews, visits, bounces, seconds, agents, follows) GROUP BY 1`, undefined, '1')},
+          sum(seconds) AS seconds, sum(agents) AS agents, sum(everyone) AS visitors_incl_agents, sum(follows) AS follow_clicks FROM (
+          SELECT ${day('at')}, count(DISTINCT visitor), count(*), 0, 0, 0, 0, 0, 0 FROM v GROUP BY 1
+          UNION ALL SELECT ${day('at')}, 0, 0, count(*), count(*) FILTER (WHERE views = 1), coalesce(sum(seconds), 0), 0, 0, 0 FROM visits GROUP BY 1
+          UNION ALL SELECT ${day('at')}, 0, 0, 0, 0, 0, count(DISTINCT visitor), 0, 0 FROM ag GROUP BY 1
+          UNION ALL SELECT ${day('at')}, 0, 0, 0, 0, 0, 0, count(DISTINCT visitor), 0 FROM (SELECT at, visitor FROM v UNION ALL SELECT at, visitor FROM e) u GROUP BY 1
+          ${follows ? `UNION ALL SELECT ${day('at')}, 0, 0, 0, 0, 0, 0, 0, count(*) FROM e WHERE ${follows} GROUP BY 1` : ''}
+          UNION ALL SELECT to_char(day, 'YYYY-MM-DD'), visitors, pageviews, visits, bounces, seconds, 0, visitors, 0 FROM a
+        ) t(date, visitors, pageviews, visits, bounces, seconds, agents, everyone, follows) GROUP BY 1`, undefined, '1')},
       'follow_clicks', ${follows ? `(SELECT json_build_object('events', count(*), 'visitors', count(DISTINCT visitor)) FROM e WHERE ${follows})` : 'NULL'},
+      'top_agents', ${list('SELECT agent, count(DISTINCT visitor) AS visitors FROM ag GROUP BY 1', 10)},
       'agent_tool_calls', ${list(`SELECT coalesce(props->>'tool', '(none)') AS tool, count(*) AS events FROM e
-         WHERE name = 'MCP Call' AND props->>'method' = 'tools/call'
-           AND NOT coalesce(props->>'ua', '') ILIKE ANY(${$(ownAgents.map(a => `%${a}%`))}::text[])
+         WHERE name = 'MCP Call' AND props->>'method' = 'tools/call' AND NOT ${ours}
          GROUP BY 1`, 10)},
       'gaps', ${gapSelects.length ? `(SELECT coalesce(json_agg(t), '[]') FROM (${gapSelects.join(' UNION ALL ')}) t)` : `'[]'::json`}
     ) AS digest`, ...values));
@@ -267,7 +279,7 @@ export async function digest(sql, { site = '', days, handle, siblings = [], gaps
             for (const k of Object.keys(p))
                 p[k] = null;
         else
-            p.visitors_incl_agents = p.follow_clicks = null;
+            p.agents = p.visitors_incl_agents = p.follow_clicks = null;
     }
     return d;
 }

package/dist/block-views.d.ts

@@ -112,11 +112,14 @@ export declare function StatsView({ items, columns, }: {
  * The fallback `message` arrives as a prop because it is the wiki's editorial
  * voice — "You can help RADIX Wiki by expanding it" has a name in it. `icon`
  * is optional: a component library that hardcoded an icon set would make its
- * consumers install that icon set.
+ * consumers install that icon set. `policy` is the wiki's page for the
+ * standard the notice enforces; given, the label links to it, so a reader who
+ * meets "Needs citations" can find out what a citation has to be.
  */
-export declare function BannerView({ variant, text, message, icon, }: {
+export declare function BannerView({ variant, text, message, icon, policy, }: {
     variant: string;
     text?: string | null;
     message: string;
     icon?: ReactNode;
+    policy?: string;
 }): import("react").JSX.Element;

package/dist/block-views.js

@@ -123,9 +123,12 @@ export function StatsView({ items, columns = 4, }) {
  * The fallback `message` arrives as a prop because it is the wiki's editorial
  * voice — "You can help RADIX Wiki by expanding it" has a name in it. `icon`
  * is optional: a component library that hardcoded an icon set would make its
- * consumers install that icon set.
+ * consumers install that icon set. `policy` is the wiki's page for the
+ * standard the notice enforces; given, the label links to it, so a reader who
+ * meets "Needs citations" can find out what a citation has to be.
  */
-export function BannerView({ variant, text, message, icon, }) {
+export function BannerView({ variant, text, message, icon, policy, }) {
     const known = bannerVariant(variant);
-    return (_jsxs("div", { className: cx('editorial-banner', `editorial-banner-${known}`), role: "note", children: [icon, _jsxs("p", { className: "editorial-banner-body", children: [_jsxs("strong", { children: [BANNER_LABELS[known], "."] }), " ", text?.trim() || message] })] }));
+    const label = BANNER_LABELS[known];
+    return (_jsxs("div", { className: cx('editorial-banner', `editorial-banner-${known}`), role: "note", children: [icon, _jsxs("p", { className: "editorial-banner-body", children: [_jsxs("strong", { children: [policy ? _jsx("a", { href: policy, children: label }) : label, "."] }), " ", text?.trim() || message] })] }));
 }

package/dist/crawlers.d.ts

@@ -46,16 +46,20 @@ export declare function crawlerRules(opts: {
     searchDisallow?: string | string[];
 }): RobotsGroup[];
 /**
- * Count an AI crawler's visit from a proxy, without holding up its response.
+ * Count an agent's visit from a proxy, without holding up its response: a
+ * crawler on the roster wherever it goes, and anything but a search engine
+ * that asks for what only agents read, since most agents are on no roster.
+ * The user agent is kept beside the label, so `digest` can name an agent the
+ * roster does not know and leave out the site's own.
  *
  * `load` is a dynamic import of the module that records it, because that
  * module pulls in a database client, and a static import would load it for
  * every request the proxy sees, bots or not. Three proxies wrote these lines.
- * Returns the bot's label, or null.
+ * Returns whether the request was counted.
  */
 export declare function trackAiBot(request: {
     url: string;
     headers: HeaderReader;
 }, event: {
     waitUntil(promise: Promise<unknown>): void;
-}, load: () => Promise<Pick<Tracker, 'trackEvent'>>): string | null;
+}, load: () => Promise<Pick<Tracker, 'trackEvent'>>): boolean;

package/dist/crawlers.js

@@ -1,7 +1,8 @@
 // crawlers.ts — one roster of AI crawler tokens, for both surfaces that need it.
 //
 // The proxy counts an "AI Bot Visit" by user-agent substring, and `robots.ts`
-// gives each agent its own group. Both read this one roster.
+// gives each agent its own group. Both read this one roster. The proxy also
+// counts any agent reading the machine surface, roster or not.
 //
 // One difference between the two uses is deliberate. `Applebot-Extended`
 // never fetches a page: it is a robots.txt-only token that Applebot consults
@@ -11,6 +12,7 @@
 // Every other token appears in both, because a crawler obeys only its
 // most-specific matching group: an agent with no group of its own falls through
 // to `*` and is granted whatever that grants.
+import { wantsMarkdown } from './http.js';
 /**
  * Order is significant: `detectAiBot` returns the first token the user agent
  * contains, so a token that is a substring of another must come after it.
@@ -113,16 +115,30 @@ export function crawlerRules(opts) {
     ];
 }
 /**
- * Count an AI crawler's visit from a proxy, without holding up its response.
+ * What only an agent asks for: a markdown twin, an `llms` export, the OpenAPI
+ * document, a well-known descriptor. MCP is left out, since "MCP Call" counts it.
+ */
+const AGENT_ONLY = /\.md$|^\/llms[\w-]*\.txt$|^\/openapi\.json$|^\/\.well-known\//;
+/**
+ * Count an agent's visit from a proxy, without holding up its response: a
+ * crawler on the roster wherever it goes, and anything but a search engine
+ * that asks for what only agents read, since most agents are on no roster.
+ * The user agent is kept beside the label, so `digest` can name an agent the
+ * roster does not know and leave out the site's own.
  *
  * `load` is a dynamic import of the module that records it, because that
  * module pulls in a database client, and a static import would load it for
  * every request the proxy sees, bots or not. Three proxies wrote these lines.
- * Returns the bot's label, or null.
+ * Returns whether the request was counted.
  */
 export function trackAiBot(request, event, load) {
-    const bot = detectAiBot(request.headers.get('user-agent'));
-    if (bot)
-        event.waitUntil(load().then(m => m.trackEvent('AI Bot Visit', request.url, { bot }, request.headers)));
-    return bot;
+    const ua = request.headers.get('user-agent') ?? '';
+    const bot = detectAiBot(ua);
+    const agent = bot !== null ||
+        (!!ua && !SEARCH_ENGINES.some(s => ua.includes(s)) && (AGENT_ONLY.test(new URL(request.url).pathname) || wantsMarkdown(request)));
+    if (agent) {
+        const props = { ...(bot ? { bot } : {}), ua: ua.slice(0, 80) };
+        event.waitUntil(load().then(m => m.trackEvent('AI Bot Visit', request.url, props, request.headers)));
+    }
+    return agent;
 }

package/dist/http.d.ts

@@ -74,7 +74,7 @@ export declare function markdownHeaders(lastModified?: string | null, opts?: {
 export declare function wantsMarkdown(request: {
     url: string;
     headers: {
-        get(name: string): string | null;
+        get(name: string): string | null | undefined;
     };
 }): boolean;
 /** The header every response from a content-negotiated URL carries. */

package/dist/indexnow.js

@@ -4,7 +4,9 @@
 // The `indexnow` bin reads an origin's live sitemap, keeps the rows whose
 // `lastModified` falls inside the window, and posts them. It runs on the machine
 // that runs the sweeps, not as a cron on the host: a submission costs the origin
-// one cached sitemap fetch and no function time. The sitemap is the one place
+// one sitemap render and no scheduled function. The sitemap renders per request,
+// because one Vercel served from cache froze at the last deploy and listed none
+// of the pages edited since. The sitemap is the one place
 // every writer shows up — the editor, the MCP write tools, and the sweep scripts
 // that write to the database without passing through the app — so reading it
 // covers all of them with no hook in any.

package/dist/maintenance.d.ts

@@ -40,6 +40,13 @@ export interface LogState {
 }
 /** Drops what is closed or a diary entry, and caps what is append-only. Newest first. */
 export declare function compact(state: LogState): LogState;
+/**
+ * Why a `write` of `next` over `stored` would lose runs, or null. A run that
+ * writes back a state it read before another run wrote (a copy left in /tmp, a
+ * stale variable) carries a lower `totalRuns`, and replacing the whole state
+ * with it silently erases what the later run recorded.
+ */
+export declare function staleWrite(stored: LogState, next: LogState): string | null;
 /** New backlog items, deduplicated against what is there, dated today unless they carry a date. */
 export declare function addBacklog(state: LogState, items: readonly BacklogEntry[], today: string): BacklogEntry[];
 /** The page's content blocks, re-rendered from state on every write. `routine` names who keeps it. */

package/dist/maintenance.js

@@ -14,17 +14,21 @@
 // its revisions table. Two kinds of entry are pinned against the caps because
 // a run cannot recreate them: a backlog item flagged for a human, and a
 // watermark that banks a verdict on a whole class of site (a bot wall, a 403),
-// which is what lets an audit spend no probes on its flag list.
+// which is what lets an audit spend no probes on its flag list. Flags have a
+// cap of their own, the page's backlog window: pinned without one, they grew to
+// 48 on radix-wiki's log and held most of the backlog's sixty slots, and a flag
+// that no longer fits on the page is one no human reads.
 //
 // No subpath exports this: the bins and the tests import it from dist.
 import { escXml } from './feed.js';
-/** Held in state. */
-const MAX = { backlog: 60, runs: 30, feedback: 40, sources: 150 };
 /** Shown on the page. What a reader pays is words, and the entries run long. */
 const SHOWN = { backlog: 15, runs: 5, feedback: 8, sources: 15 };
+/** Held in state. */
+const MAX = { backlog: 60, flags: SHOWN.backlog, runs: 30, feedback: 40, sources: 150 };
 /** "run 214 (ecosystem): link audit CLEAN…" is a diary entry, not a work item. */
 const JOURNAL = /^run\s+\d+\b/i;
-const PINNED = /FLAG FOR A HUMAN/i;
+/** @internal The bin names the flags a write drops. */
+export const PINNED = /FLAG FOR A HUMAN/i;
 const BANKED = /\bbanked\b|bot[- ]?(wall|block)|\b(403|429|999)\b|cloudflare/i;
 const itemOf = (b) => (typeof b === 'string' ? b : b.item);
 const recency = (a, b) => String(b[1]?.lastChecked ?? '').localeCompare(String(a[1]?.lastChecked ?? ''));
@@ -35,7 +39,7 @@ export function compact(state) {
         .map((b, i) => ({ status: 'open', ...(typeof b === 'string' ? { date: '', item: b } : b), i }))
         .filter(b => b.status === 'open' && b.item && (PINNED.test(b.item) || !JOURNAL.test(b.item)))
         .sort((a, b) => String(b.date ?? '').localeCompare(String(a.date ?? '')) || b.i - a.i);
-    const backlog = [...open.filter(b => PINNED.test(b.item)), ...open.filter(b => !PINNED.test(b.item))]
+    const backlog = [...open.filter(b => PINNED.test(b.item)).slice(0, MAX.flags), ...open.filter(b => !PINNED.test(b.item))]
         .slice(0, MAX.backlog)
         .map(({ i: _i, ...b }) => b);
     // Most source keys are one-off verdicts on a single site. Sorting by
@@ -51,6 +55,18 @@ export function compact(state) {
         runHistory: (state.runHistory ?? []).slice(-MAX.runs),
     };
 }
+/**
+ * Why a `write` of `next` over `stored` would lose runs, or null. A run that
+ * writes back a state it read before another run wrote (a copy left in /tmp, a
+ * stale variable) carries a lower `totalRuns`, and replacing the whole state
+ * with it silently erases what the later run recorded.
+ */
+export function staleWrite(stored, next) {
+    const [had, has] = [stored.totalRuns ?? 0, next.totalRuns ?? 0];
+    return has < had
+        ? `refusing a state with totalRuns ${has} over the stored ${had}: it predates a run that has already written. Read the log again and reapply this run's changes.`
+        : null;
+}
 /** New backlog items, deduplicated against what is there, dated today unless they carry a date. */
 export function addBacklog(state, items, today) {
     const seen = new Set((state.backlog ?? []).map(itemOf));

package/dist/passkey-button.d.ts

@@ -3,9 +3,12 @@ export interface PasskeyButtonProps {
     endpoint: string;
     /** The invite token from the link, when there is one. */
     invite?: string | undefined;
-    /** Save a passkey without an invite: pass `await gate.open()`. */
-    create?: boolean;
     className?: string;
     errorClassName?: string;
 }
-export declare function PasskeyButton({ endpoint, invite, create, className, errorClassName }: PasskeyButtonProps): import("react").JSX.Element;
+export declare function PasskeyButton({ endpoint, invite, className, errorClassName }: PasskeyButtonProps): import("react").JSX.Element;
+/** Ends the session at `endpoint` (`gate.signOut` as DELETE) and reloads the page. */
+export declare function PasskeySignOut({ endpoint, className }: {
+    endpoint: string;
+    className?: string;
+}): import("react").JSX.Element;

package/dist/passkey-button.js

@@ -3,10 +3,10 @@ import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-run
 // passkey-button.tsx – the browser half of `wiki-formant/passkey`.
 //
 // Its own subpath because it imports `@simplewebauthn/browser`, an optional
-// peer that only an app with a passkey door installs. With an invite, or with
-// `create` while the site has no passkey (`gate.open()`), it saves a new
-// passkey; otherwise it signs in with a saved one. Either way, success reloads
-// the page without the invite, and the server sees the new cookie.
+// peer that only an app with a passkey door installs. With an invite it saves a
+// new passkey; otherwise it signs in with a saved one. Either way, success
+// reloads the page without the invite, and the server sees the new cookie.
+// `PasskeySignOut` calls the route's DELETE (`gate.signOut`) and reloads.
 import { startAuthentication, startRegistration } from '@simplewebauthn/browser';
 import { useState } from 'react';
 async function post(endpoint, body) {
@@ -15,8 +15,8 @@ async function post(endpoint, body) {
         throw new Error((await res.json().catch(() => null))?.error ?? 'Sign-in failed.');
     return res.status === 204 ? null : res.json();
 }
-export function PasskeyButton({ endpoint, invite, create, className, errorClassName }) {
-    const saving = !!invite || !!create;
+export function PasskeyButton({ endpoint, invite, className, errorClassName }) {
+    const saving = !!invite;
     const [busy, setBusy] = useState(false);
     const [error, setError] = useState(null);
     async function go() {
@@ -36,3 +36,10 @@ export function PasskeyButton({ endpoint, invite, create, className, errorClassN
     }
     return (_jsxs(_Fragment, { children: [_jsx("button", { type: "button", className: className, onClick: go, disabled: busy, children: saving ? 'Save a passkey' : 'Sign in with a passkey' }), error && (_jsx("p", { role: "alert", className: errorClassName, children: error }))] }));
 }
+/** Ends the session at `endpoint` (`gate.signOut` as DELETE) and reloads the page. */
+export function PasskeySignOut({ endpoint, className }) {
+    return (_jsx("button", { type: "button", className: className, onClick: async () => {
+            await fetch(endpoint, { method: 'DELETE' }).catch(() => null);
+            location.reload();
+        }, children: "Sign out" }));
+}

package/dist/passkey.d.ts

@@ -12,18 +12,18 @@ export interface PasskeyGateOptions {
 export interface PasskeyGate {
     /** The session cookie's name, for the app to read it with. */
     cookie: string;
-    /** Whether a session cookie's value is a live session. */
+    /** Whether a session cookie's value is a live session whose passkey is still saved. */
     signedIn(session: string | undefined): Promise<boolean>;
-    /** True while no passkey is saved, when the page offers to save the first one. */
-    open(): Promise<boolean>;
     /** A single-use invite token, good for `days`. The bin turns it into a link. */
     invite(days?: number): Promise<string>;
     /**
      * The whole sign-in route: `export const POST = gate.route`. The body is
      * `{ invite?, response? }`: without `response` it answers with the options
      * for the browser's prompt, with one it verifies it and sets the cookie. An
-     * invite, or a site with no passkey yet, turns the prompt into saving one.
+     * invite turns the prompt into saving one.
      */
     route(request: Request): Promise<Response>;
+    /** The sign-out route: `export const DELETE = gate.signOut`. Ends the session and clears the cookie. */
+    signOut(request: Request): Promise<Response>;
 }
 export declare function createPasskeyGate({ sql, rpName, cookie, sessionDays }: PasskeyGateOptions): PasskeyGate;

package/dist/passkey.js

@@ -1,10 +1,10 @@
 // passkey.ts – the door to a site's own admin pages: a passkey, and nothing else.
 //
 // No account, no password, no email. Whoever holds a passkey saved for the
-// site is in. While none is saved, the page saves the first one without asking
-// for anything, so the owner opens it from the deployed site the way they would
-// any other. Every passkey after that needs an invite link, which the
-// `passkey-invite` bin prints from a machine holding the database URL.
+// site is in. Every passkey, the first among them, is saved from an invite
+// link, which the `passkey-invite` bin prints from a machine holding the
+// database URL. A fresh deployment once saved the first passkey from whoever
+// opened the page, so a stranger who got there before the owner held the door.
 //
 // A passkey is bound to the host it was saved on. One saved on localhost does
 // not open the deployed site, and one saved on the site does not open localhost.
@@ -14,10 +14,10 @@
 // `prisma-models` bin copies into the app's schema folder.
 //
 // Every token is stored as its hash, so a read of the table opens nothing. A
-// challenge is spent the moment a response quotes it, and an invite the moment
-// a passkey is saved with it. The first passkey without an invite is checked
-// against an empty table in the insert itself, so two people racing to it
-// cannot both win.
+// challenge is spent the moment a response quotes it, and only by the ceremony
+// it was issued for; an invite the moment a passkey is saved with it. A session
+// names the passkey that signed in, and lives only as long as that passkey's
+// row: deleting a passkey signs out everyone who signed in with it.
 import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
 import { clientKey, rateLimit, rateLimitedResponse } from './rate-limit.js';
 const MINUTE = 60_000;
@@ -27,9 +27,9 @@ const b64url = (bytes) => Buffer.from(bytes).toString('base64url');
 const token = () => b64url(crypto.getRandomValues(new Uint8Array(32)));
 const hash = async (value) => b64url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value))));
 /** Store a token's hash; the token is returned and kept nowhere else. */
-async function issue(sql, kind, ms, value = token()) {
+async function issue(sql, kind, ms, value = token(), passkeyId = null) {
     await sql(`DELETE FROM "PasskeyToken" WHERE "expiresAt" < now()`);
-    await sql(`INSERT INTO "PasskeyToken" (hash, kind, "expiresAt") VALUES ($1, $2, now() + make_interval(secs => $3::int))`, await hash(value), kind, Math.round(ms / 1000));
+    await sql(`INSERT INTO "PasskeyToken" (hash, kind, "expiresAt", "passkeyId") VALUES ($1, $2, now() + make_interval(secs => $3::int), $4)`, await hash(value), kind, Math.round(ms / 1000), passkeyId);
     return value;
 }
 /** True once for a live token of this kind; it is gone either way. */
@@ -44,19 +44,32 @@ async function live(sql, kind, value) {
 /** Any request that fails is told only that it failed. */
 const refuse = (status, error) => Response.json({ error }, { status });
 export function createPasskeyGate({ sql, rpName, cookie = 'passkey_session', sessionDays = 90 }) {
-    async function session(secure) {
-        const value = await issue(sql, 'session', sessionDays * DAY);
-        const attrs = [`${cookie}=${value}`, 'Path=/', 'HttpOnly', 'SameSite=Lax', `Max-Age=${sessionDays * 86_400}`];
+    const setCookie = (value, maxAge, secure) => {
+        const attrs = [`${cookie}=${value}`, 'Path=/', 'HttpOnly', 'SameSite=Lax', `Max-Age=${maxAge}`];
         if (secure)
             attrs.push('Secure');
         return new Response(null, { status: 204, headers: { 'set-cookie': attrs.join('; ') } });
+    };
+    async function session(passkeyId, secure) {
+        const value = await issue(sql, 'session', sessionDays * DAY, undefined, passkeyId);
+        return setCookie(value, sessionDays * 86_400, secure);
     }
-    const open = async () => (await sql(`SELECT 1 FROM "Passkey" LIMIT 1`)).length === 0;
     return {
         cookie,
-        signedIn: async (value) => !!value && live(sql, 'session', value),
-        open,
+        signedIn: async (value) => !!value &&
+            (await sql(`SELECT 1 FROM "PasskeyToken" t JOIN "Passkey" p ON p.id = t."passkeyId"
+         WHERE t.hash = $1 AND t.kind = 'session' AND t."expiresAt" > now()`, await hash(value))).length > 0,
         invite: (days = 1) => issue(sql, 'invite', days * DAY),
+        async signOut(request) {
+            const value = request.headers
+                .get('cookie')
+                ?.split(/;\s*/)
+                .find(c => c.startsWith(`${cookie}=`))
+                ?.slice(cookie.length + 1);
+            if (value)
+                await spend(sql, 'session', value);
+            return setCookie('', 0, new URL(request.url).protocol === 'https:');
+        },
         async route(request) {
             const limited = rateLimit(clientKey('passkey', request.headers), { capacity: 10, refillPerSec: 0.2 });
             if (!limited.ok)
@@ -67,11 +80,12 @@ export function createPasskeyGate({ sql, rpName, cookie = 'passkey_session', ses
             const body = (await request.json().catch(() => null));
             const invite = typeof body?.invite === 'string' ? body.invite : undefined;
             const response = body?.response;
-            const expectedChallenge = (challenge) => spend(sql, 'challenge', challenge);
+            const ceremony = invite ? 'registration' : 'authentication';
+            const expectedChallenge = (challenge) => spend(sql, ceremony, challenge);
             if (!response) {
                 if (invite && !(await live(sql, 'invite', invite)))
                     return refuse(403, 'This invite has expired.');
-                const options = invite || (await open())
+                const options = invite
                     ? await generateRegistrationOptions({
                         rpName,
                         rpID,
@@ -81,10 +95,10 @@ export function createPasskeyGate({ sql, rpName, cookie = 'passkey_session', ses
                         authenticatorSelection: { residentKey: 'required', userVerification: 'preferred' },
                     })
                     : await generateAuthenticationOptions({ rpID, userVerification: 'preferred' });
-                await issue(sql, 'challenge', CHALLENGE_MS, options.challenge);
+                await issue(sql, ceremony, CHALLENGE_MS, options.challenge);
                 return Response.json(options);
             }
-            if (invite || (await open())) {
+            if (invite) {
                 const result = await verifyRegistrationResponse({
                     response,
                     expectedChallenge,
@@ -95,14 +109,11 @@ export function createPasskeyGate({ sql, rpName, cookie = 'passkey_session', ses
                 if (!result?.verified)
                     return refuse(400, 'That passkey could not be saved.');
                 // Spent after the check, so a failed prompt leaves the invite to try again.
-                if (invite && !(await spend(sql, 'invite', invite)))
+                if (!(await spend(sql, 'invite', invite)))
                     return refuse(403, 'This invite has expired.');
                 const { credential } = result.registrationInfo;
-                const saved = (await sql(`INSERT INTO "Passkey" (id, "publicKey", counter, transports)
-           SELECT $1, $2, $3, $4::text[] WHERE $5::boolean OR NOT EXISTS (SELECT 1 FROM "Passkey") RETURNING id`, credential.id, b64url(credential.publicKey), credential.counter, credential.transports ?? [], !!invite));
-                if (!saved.length)
-                    return refuse(403, 'This site already has a passkey. Adding another takes an invite.');
-                return session(protocol === 'https:');
+                await sql(`INSERT INTO "Passkey" (id, "publicKey", counter, transports) VALUES ($1, $2, $3, $4::text[])`, credential.id, b64url(credential.publicKey), credential.counter, credential.transports ?? []);
+                return session(credential.id, protocol === 'https:');
             }
             const [passkey] = (await sql(`SELECT id, "publicKey", counter, transports FROM "Passkey" WHERE id = $1`, String(response.id)));
             if (!passkey)
@@ -118,7 +129,7 @@ export function createPasskeyGate({ sql, rpName, cookie = 'passkey_session', ses
             if (!result?.verified)
                 return refuse(403, 'Sign-in failed.');
             await sql(`UPDATE "Passkey" SET counter = $2 WHERE id = $1`, passkey.id, result.authenticationInfo.newCounter);
-            return session(protocol === 'https:');
+            return session(passkey.id, protocol === 'https:');
         },
     };
 }

package/dist/rola.js

@@ -30,6 +30,12 @@ export function createRola({ challenges, challengeTtlSec = 300, ...identity }) {
         },
         async verifySignedChallenge(signed) {
             try {
+                // Anything but a string is a filter, not a challenge: an absent one
+                // matches every row, so one bad request would spend every pending
+                // sign-in's challenge.
+                if (typeof signed?.challenge !== 'string' || typeof signed.address !== 'string') {
+                    return { isValid: false, error: 'Invalid or expired challenge' };
+                }
                 const { count } = await challenges.deleteMany({
                     where: { challenge: signed.challenge, expiresAt: { gt: new Date() } },
                 });

package/dist/sitemap.d.ts

@@ -0,0 +1,31 @@
+export type ChangeFrequency = 'always' | 'hourly' | 'daily' | 'weekly' | 'monthly' | 'yearly' | 'never';
+export interface SitemapRow {
+    url: string;
+    lastModified?: Date;
+    changeFrequency?: ChangeFrequency;
+    priority?: number;
+}
+/** The minimum a page must be to date its sections and earn a row. */
+export interface TreePage {
+    tagPath: string;
+    slug: string;
+    updatedAt: Date;
+}
+export interface TreeSitemapOptions<P extends TreePage> {
+    /** Section tag paths to list, in order. A path with no page beneath it is listed undated. */
+    sections: Iterable<string>;
+    sectionRow: (tagPath: string) => Omit<SitemapRow, 'lastModified'>;
+    pageRow: (page: P) => Omit<SitemapRow, 'lastModified'>;
+}
+/**
+ * One row per section, dated by the newest page at or beneath it, then one row
+ * per page, dated by its own `updatedAt`.
+ *
+ * Every URL appears once. An empty-slug page is its section's own article (a
+ * category hub): it dates the section and gets no row of its own, since its URL
+ * is the section's. A section whose URL a page row already holds is served as
+ * that page, so the section's row is dropped.
+ */
+export declare function treeSitemap<P extends TreePage>(pages: readonly P[], o: TreeSitemapOptions<P>): SitemapRow[];
+/** Every tag path at or above the given ones, each once: `a/b` yields `a` and `a/b`. */
+export declare function tagPrefixes(tagPaths: Iterable<string>): string[];

package/dist/sitemap.js

@@ -0,0 +1,50 @@
+// sitemap.ts — the rows a wiki's tree contributes to its sitemap.
+//
+// All three wikis list their sections beside their pages, and each dated them
+// its own way: one by the newest page beneath, one the same but derived from
+// where the pages sit, and one not at all. A section's listing changes when a
+// page under it does, so the newest page beneath is its honest date; a section
+// with no page under it carries none rather than a fictional one.
+//
+// What stays with the caller is which sections exist, every URL, and the
+// frequency and priority each row carries. The return is structurally Next's
+// `MetadataRoute.Sitemap`, so a `sitemap.ts` spreads it as it is.
+/**
+ * One row per section, dated by the newest page at or beneath it, then one row
+ * per page, dated by its own `updatedAt`.
+ *
+ * Every URL appears once. An empty-slug page is its section's own article (a
+ * category hub): it dates the section and gets no row of its own, since its URL
+ * is the section's. A section whose URL a page row already holds is served as
+ * that page, so the section's row is dropped.
+ */
+export function treeSitemap(pages, o) {
+    const pageRows = pages
+        .filter(p => p.slug)
+        .map((p) => ({ ...o.pageRow(p), lastModified: p.updatedAt }));
+    const taken = new Set(pageRows.map(r => r.url));
+    const sectionRows = [];
+    for (const path of o.sections) {
+        const row = o.sectionRow(path);
+        if (taken.has(row.url))
+            continue;
+        let newest;
+        for (const p of pages) {
+            if ((p.tagPath === path || p.tagPath.startsWith(`${path}/`)) && (!newest || p.updatedAt > newest))
+                newest = p.updatedAt;
+        }
+        taken.add(row.url);
+        sectionRows.push({ ...row, lastModified: newest });
+    }
+    return [...sectionRows, ...pageRows];
+}
+/** Every tag path at or above the given ones, each once: `a/b` yields `a` and `a/b`. */
+export function tagPrefixes(tagPaths) {
+    const out = new Set();
+    for (const tagPath of tagPaths) {
+        const segments = tagPath.split('/').filter(Boolean);
+        for (let depth = 1; depth <= segments.length; depth++)
+            out.add(segments.slice(0, depth).join('/'));
+    }
+    return [...out];
+}

package/dist/stats-figures.js

@@ -24,6 +24,7 @@ function change(now, before, { points = false, lowerIsBetter = false } = {}) {
 }
 const figuresOf = ({ previous: p, ...d }) => [
     { label: 'Visitors', value: count(d.visitors), delta: change(d.visitors, p.visitors), day: r => r.visitors },
+    { label: 'Agents', value: count(d.agents), delta: change(d.agents, p.agents), day: r => r.agents },
     { label: 'Page views', value: count(d.pageviews), delta: change(d.pageviews, p.pageviews), day: r => r.pageviews },
     {
         label: 'Bounce rate',
@@ -39,12 +40,6 @@ const figuresOf = ({ previous: p, ...d }) => [
         day: r => (r.visits ? r.seconds / r.visits : null),
         format: duration,
     },
-    {
-        label: 'With agents',
-        value: count(d.visitors_incl_agents),
-        delta: change(d.visitors_incl_agents, p.visitors_incl_agents),
-        day: r => r.visitors_incl_agents,
-    },
     ...(d.follow_clicks
         ? [
             {
@@ -57,7 +52,7 @@ const figuresOf = ({ previous: p, ...d }) => [
         : []),
 ];
 const DAY = 86_400;
-const EMPTY = { date: '', visitors: 0, pageviews: 0, visits: 0, bounces: 0, seconds: 0, visitors_incl_agents: 0, follow_clicks: 0 };
+const EMPTY = { date: '', visitors: 0, pageviews: 0, visits: 0, bounces: 0, seconds: 0, agents: 0, visitors_incl_agents: 0, follow_clicks: 0 };
 /**
  * The figures as `.stats-figures button[aria-pressed]`, each with its change
  * as `.stats-delta[data-better]` for a stylesheet to colour, and the pressed one per

package/dist/stats.d.ts

@@ -36,7 +36,7 @@ export interface StatsGateProps {
     invite?: string | undefined;
     /** The site's host, named in the prompt. */
     host: string;
-    /** The route that serves `gate.route`. */
+    /** The route that serves `gate.route` as POST and `gate.signOut` as DELETE. */
     endpoint?: string;
     /** What a signed-in reader sees, rendered only for one. */
     children: () => ReactNode | Promise<ReactNode>;
@@ -48,9 +48,9 @@ export interface StatsGateProps {
     };
 }
 /**
- * A stats page's door: `children` for a signed-in reader, else a line saying
- * what the passkey prompt will do and the button that does it. With an invite
- * it saves a passkey, as it does while the site has none; otherwise it signs
- * in. Three apps wrote this branch and its three sentences.
+ * A stats page's door: `children` and a sign-out button for a signed-in
+ * reader, else a line saying what the passkey prompt will do and the button
+ * that does it. With an invite it saves a passkey; otherwise it signs in.
+ * Three apps wrote this branch and its sentences.
  */
-export declare function StatsGate({ gate, session, invite, host, endpoint, children, classNames: c }: StatsGateProps): Promise<string | number | bigint | boolean | Iterable<ReactNode> | import("react").JSX.Element | null | undefined>;
+export declare function StatsGate({ gate, session, invite, host, endpoint, children, classNames: c }: StatsGateProps): Promise<import("react").JSX.Element>;

package/dist/stats.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { STATS_FILTERS } from './analytics.js';
-import { PasskeyButton } from './passkey-button.js';
+import { PasskeyButton, PasskeySignOut } from './passkey-button.js';
 import { StatsFigures } from './stats-figures.js';
 /** The windows the stats page offers, in days; `Infinity` is all time. */
 const STATS_RANGES = [1, 7, 30, 90, 365, Infinity];
@@ -73,21 +73,17 @@ export function Stats({ digest: d, days, filter = {}, ranges = STATS_RANGES }) {
     // Each window is another digest, so a link rather than a button, pinned
     // with the chart's own controls.
     const windows = (_jsx("div", { role: "group", "aria-label": "Window", children: ranges.map(n => (_jsx("a", { href: href(n, filter), "aria-current": n === days ? 'page' : undefined, children: windowLabel(n) }, n))) }));
-    return (_jsxs("div", { className: "stats", children: [narrowed.length > 0 && (_jsxs("div", { className: "stats-filters", children: [_jsx("ul", { "aria-label": "Narrowed to", children: narrowed.map(k => (_jsx("li", { children: _jsxs("a", { href: href(days, { ...filter, [k]: undefined }), title: "Remove", children: [NAMES[k], ": ", k === 'country' ? country(filter[k]) : filter[k], " \u00D7"] }) }, k))) }), start < counted && d.counted_from && (_jsxs("p", { children: ["Narrowed figures start on ", d.counted_from, ", the first day this site counted its own visits."] }))] })), _jsx(StatsFigures, { digest: d, first: first, windows: windows }), _jsxs("div", { className: "stats-lists", children: [_jsx(StatsList, { title: "Pages", rows: rows(d.top_pages, 'page', 'visitors'), to: to('page') }), _jsx(StatsList, { title: "Entry pages", rows: rows(d.entry_pages, 'page', 'visitors'), to: to('entry') }), _jsx(StatsList, { title: "Sources", rows: rows(d.top_sources, 'source', 'visitors'), to: to('source') }), _jsx(StatsList, { title: "From X posts", rows: rows(d.from_posts, 'page', 'visitors'), to: v => href(days, { ...filter, source: 'x', entry: v }) }), _jsx(StatsList, { title: "Sibling sites", rows: rows(d.sibling_referrals, 'source', 'visitors'), to: to('source') }), _jsx(StatsList, { title: "Countries", rows: rows(d.countries, 'country', 'visitors'), label: country, to: to('country') }), _jsx(StatsList, { title: "Devices", rows: rows(d.devices, 'device', 'visitors'), to: to('device') }), _jsx(StatsList, { title: "Agent tool calls", rows: rows(d.agent_tool_calls, 'tool', 'events') }), _jsx(StatsList, { title: "Searches that found nothing", rows: rows(d.gaps, 'query', 'events') })] })] }));
+    return (_jsxs("div", { className: "stats", children: [narrowed.length > 0 && (_jsxs("div", { className: "stats-filters", children: [_jsx("ul", { "aria-label": "Narrowed to", children: narrowed.map(k => (_jsx("li", { children: _jsxs("a", { href: href(days, { ...filter, [k]: undefined }), title: "Remove", children: [NAMES[k], ": ", k === 'country' ? country(filter[k]) : filter[k], " \u00D7"] }) }, k))) }), start < counted && d.counted_from && (_jsxs("p", { children: ["Narrowed figures start on ", d.counted_from, ", the first day this site counted its own visits."] }))] })), _jsx(StatsFigures, { digest: d, first: first, windows: windows }), _jsxs("div", { className: "stats-lists", children: [_jsx(StatsList, { title: "Pages", rows: rows(d.top_pages, 'page', 'visitors'), to: to('page') }), _jsx(StatsList, { title: "Entry pages", rows: rows(d.entry_pages, 'page', 'visitors'), to: to('entry') }), _jsx(StatsList, { title: "Sources", rows: rows(d.top_sources, 'source', 'visitors'), to: to('source') }), _jsx(StatsList, { title: "From X posts", rows: rows(d.from_posts, 'page', 'visitors'), to: v => href(days, { ...filter, source: 'x', entry: v }) }), _jsx(StatsList, { title: "Sibling sites", rows: rows(d.sibling_referrals, 'source', 'visitors'), to: to('source') }), _jsx(StatsList, { title: "Countries", rows: rows(d.countries, 'country', 'visitors'), label: country, to: to('country') }), _jsx(StatsList, { title: "Devices", rows: rows(d.devices, 'device', 'visitors'), to: to('device') }), _jsx(StatsList, { title: "Agents", rows: rows(d.top_agents, 'agent', 'visitors') }), _jsx(StatsList, { title: "Agent tool calls", rows: rows(d.agent_tool_calls, 'tool', 'events') }), _jsx(StatsList, { title: "Searches that found nothing", rows: rows(d.gaps, 'query', 'events') })] })] }));
 }
 /**
- * A stats page's door: `children` for a signed-in reader, else a line saying
- * what the passkey prompt will do and the button that does it. With an invite
- * it saves a passkey, as it does while the site has none; otherwise it signs
- * in. Three apps wrote this branch and its three sentences.
+ * A stats page's door: `children` and a sign-out button for a signed-in
+ * reader, else a line saying what the passkey prompt will do and the button
+ * that does it. With an invite it saves a passkey; otherwise it signs in.
+ * Three apps wrote this branch and its sentences.
  */
 export async function StatsGate({ gate, session, invite, host, endpoint = '/api/passkey', children, classNames: c = {} }) {
-    if (!invite && (await gate.signedIn(session)))
-        return children();
-    const open = !invite && (await gate.open());
-    return (_jsxs(_Fragment, { children: [_jsx("p", { className: c.text, children: invite
-                    ? `Save a passkey on this device to open ${host}'s stats.`
-                    : open
-                        ? `No passkey is saved for ${host} yet. Save the first one here; any after that needs an invite.`
-                        : 'Sign in with a passkey saved for this site.' }), _jsx("div", { className: c.actions, children: _jsx(PasskeyButton, { endpoint: endpoint, invite: invite, create: open, className: c.button, errorClassName: c.error }) })] }));
+    if (!invite && (await gate.signedIn(session))) {
+        return (_jsxs(_Fragment, { children: [await children(), _jsx("div", { className: c.actions, children: _jsx(PasskeySignOut, { endpoint: endpoint, className: c.button }) })] }));
+    }
+    return (_jsxs(_Fragment, { children: [_jsx("p", { className: c.text, children: invite ? `Save a passkey on this device to open ${host}'s stats.` : 'Sign in with a passkey saved for this site.' }), _jsx("div", { className: c.actions, children: _jsx(PasskeyButton, { endpoint: endpoint, invite: invite, className: c.button, errorClassName: c.error }) })] }));
 }

package/dist/tiptap.d.ts

@@ -1,6 +1,13 @@
 import { type ReactNode } from 'react';
 import { Extension, Node as TiptapNode } from '@tiptap/core';
 /** Local `cn`. Both wikis import one; the package will not depend on one. */
+/**
+ * An embed's address, if it is https on a host the sanitiser and the CSP
+ * admit; otherwise null, and the node draws an empty frame. The editor draws
+ * stored HTML on the origin where its author is signed in, and a
+ * `javascript:` src runs there under any CSP with 'unsafe-inline' script.
+ */
+export declare function embedSrc(src: unknown): string | null;
 export declare const Iframe: TiptapNode<any, any>;
 /** The stock extension plus the paste rule it does not ship with. */
 export declare const YouTube: TiptapNode<import("@tiptap/extension-youtube").YoutubeOptions, any>;

package/dist/tiptap.js

@@ -17,6 +17,7 @@ import { NodeViewContent, NodeViewWrapper, ReactNodeViewRenderer } from '@tiptap
 import TiptapYoutube from '@tiptap/extension-youtube';
 import TiptapCodeBlock from '@tiptap/extension-code-block';
 import { onTweetResize, tweetEmbedSrc } from './dom.js';
+import { DEFAULT_IFRAME_HOSTS } from './headers.js';
 import { toMapEmbedUrl } from './maps.js';
 import { useClickOutside } from './react.js';
 import { cx } from './html.js';
@@ -24,6 +25,23 @@ import { slugifyHeading, uniqueHeadingId } from './headings.js';
 import { CODE_LANGS, DEFAULT_LANG } from './blocks.js';
 /** Local `cn`. Both wikis import one; the package will not depend on one. */
 // ---- iframe -----------------------------------------------------------------
+/**
+ * An embed's address, if it is https on a host the sanitiser and the CSP
+ * admit; otherwise null, and the node draws an empty frame. The editor draws
+ * stored HTML on the origin where its author is signed in, and a
+ * `javascript:` src runs there under any CSP with 'unsafe-inline' script.
+ */
+export function embedSrc(src) {
+    if (typeof src !== 'string')
+        return null;
+    try {
+        const u = new URL(src);
+        return u.protocol === 'https:' && DEFAULT_IFRAME_HOSTS.includes(u.hostname) ? u.href : null;
+    }
+    catch {
+        return null;
+    }
+}
 export const Iframe = TiptapNode.create({
     name: 'iframe',
     group: 'block',
@@ -38,7 +56,7 @@ export const Iframe = TiptapNode.create({
         return [
             'div',
             { 'data-iframe-embed': '', class: 'iframe-embed' },
-            ['iframe', mergeAttributes(HTMLAttributes, { frameborder: '0', allowfullscreen: 'true' })],
+            ['iframe', mergeAttributes({ ...HTMLAttributes, src: embedSrc(HTMLAttributes.src) }, { frameborder: '0', allowfullscreen: 'true' })],
         ];
     },
 });
@@ -159,7 +177,7 @@ export function createMapEmbed({ resolveMapUrl }) {
                 [
                     'iframe',
                     {
-                        src: node.attrs.src,
+                        src: embedSrc(node.attrs.src),
                         frameborder: '0',
                         allowfullscreen: 'true',
                         loading: 'lazy',

package/dist/upload.js

@@ -84,7 +84,11 @@ export function uploadHandler({ authorize, maxBytes = 4 * 1024 * 1024, maxPixels
         const who = await authorize(request);
         if (who instanceof Response)
             return who;
-        const limit = limitClient(`upload:${who}`, request.headers, rateLimit);
+        // The address gets a bucket of its own: an id keyed with it is free to mint
+        // where sign-in is a self-signed wallet proof, so a fresh one per burst would
+        // otherwise refill the budget.
+        const limit = [limitClient(`upload:${who}`, request.headers, rateLimit), limitClient('upload-ip', request.headers, rateLimit)]
+            .find(l => !l.ok) ?? { ok: true };
         if (!limit.ok) {
             return errors.tooManyRequests(limit.retryAfterSec, `Too many uploads. Try again in ${limit.retryAfterSec}s.`);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wiki-formant",
-  "version": "0.52.1",
+  "version": "0.56.0",
   "description": "The portable half of a wiki: derived taxonomy and facet controls, a version-negotiating MCP transport, markdown twins, block rendering, a rich-text editor engine, conditional-GET plumbing, and the headers and CSP every origin sends.",
   "type": "module",
   "license": "MIT",
@@ -52,6 +52,11 @@
       "import": "./dist/pagination.js",
       "default": "./dist/pagination.js"
     },
+    "./sitemap": {
+      "types": "./dist/sitemap.d.ts",
+      "import": "./dist/sitemap.js",
+      "default": "./dist/sitemap.js"
+    },
     "./versioning": {
       "types": "./dist/versioning.d.ts",
       "import": "./dist/versioning.js",

package/prisma/passkey.prisma

@@ -12,10 +12,14 @@ model Passkey {
   counter    Int
   transports String[]
   createdAt  DateTime @default(now()) @db.Timestamptz(3)
+  sessions   PasskeyToken[]
 }
 
 model PasskeyToken {
   hash      String   @id // sha-256 of the token, base64url
-  kind      String // session | invite | challenge
+  kind      String // session | invite | registration | authentication
   expiresAt DateTime @db.Timestamptz(3)
+  // The passkey a session signed in with: deleting the passkey ends its sessions.
+  passkeyId String?
+  passkey   Passkey? @relation(fields: [passkeyId], references: [id], onDelete: Cascade)
 }