wiki-formant 0.53.0 → 0.56.0

package/README.md

@@ -412,7 +412,7 @@ Every agent group also allows the agent surface — `/api/mcp`, the three `llms`
 
 ## IndexNow
 
-Bing, Yandex, Seznam, Naver and Yep take a POST of changed URLs instead of waiting to recrawl. The `indexnow` bin reads an origin's live sitemap and posts the rows whose `lastModified` falls inside the window, so the editor, the MCP write tools and the sweep scripts that write straight to the database are all covered with no hook in any of them. It runs where the sweeps run, never as a cron on the host: a submission costs the origin one cached sitemap fetch and no function time.
+Bing, Yandex, Seznam, Naver and Yep take a POST of changed URLs instead of waiting to recrawl. The `indexnow` bin reads an origin's live sitemap and posts the rows whose `lastModified` falls inside the window, so the editor, the MCP write tools and the sweep scripts that write straight to the database are all covered with no hook in any of them. It runs where the sweeps run, never as a cron on the host: a submission costs the origin one sitemap render and no scheduled function. The sitemap must render per request. A cached one froze at the last deploy and listed none of the pages edited since, so this bin submitted nothing.
 
 The key is public by design, since an engine checks it by fetching `/<key>.txt`. The file in the app's `public/` is the only copy, and the bin finds it there, so run it from the app's root. It checks that the live origin serves the key before posting anything.
 
@@ -535,6 +535,20 @@ export const GET = async (request: Request) => feedResponse(request, channel, aw
 had not — the recrawl the conditional-GET helpers exist to prevent. An empty feed
 carries no build date rather than a fictional one.
 
+## Sitemaps
+
+`treeSitemap(pages, { sections, sectionRow, pageRow })` returns the rows a wiki's tree adds to its sitemap: a row per section, dated by the newest page at or beneath it, then a row per page, dated by its own `updatedAt`. All three wikis listed their sections, and each dated them differently. One used the newest page beneath, one did the same from a derived tree, and one used no date at all. A section with no page beneath it carries no date rather than an invented one.
+
+```ts
+...treeSitemap(pages, {
+  sections: tagPrefixes(pages.map(p => p.tagPath)),
+  sectionRow: path => ({ url: `${SITE_URL}/wiki/${path}`, changeFrequency: 'weekly', priority: 0.6 }),
+  pageRow: p => ({ url: pageUrl(p), changeFrequency: 'weekly', priority: 0.7 }),
+}),
+```
+
+Every URL appears once. An empty-slug page is its section's own article, so it dates the section and gets no row of its own. A section whose URL a page already holds is served as that page, so the section row is dropped. `tagPrefixes` lists every path at or above the given ones, for a wiki whose sections are wherever its pages sit rather than a configured list. Which sections exist, the URLs, and each row's frequency and priority stay with the caller.
+
 ## Licence declarations
 
 
@@ -657,11 +671,11 @@ export const POST = uploadHandler({
 });
 ```
 
-The bytes say what the file is, never the name or type, and SVG is refused. Every image is re-encoded, upright, so nothing from the source's metadata is kept, a phone's GPS position included; the bytes as sent are never stored. `encode` is the re-encode, the sniffed format by default; a wiki with an image standard resizes and converts there. Each uploader has a budget, keyed on `authorize`'s id and address. `maxBytes`, `maxPixels` and `rateLimit` take other limits, and `store` replaces Vercel Blob. `sharp` and `@vercel/blob` are optional peers. `normalizeImage(bytes, { maxPixels, encode })` is the same sniff, cap and re-encode without the route, for images that arrive another way – a server action, or a picture copied in from another site; it resolves to `{ buffer, format, contentType }` and throws a message fit to show the uploader.
+The bytes say what the file is, never the name or type, and SVG is refused. Every image is re-encoded, upright, so nothing from the source's metadata is kept, a phone's GPS position included; the bytes as sent are never stored. `encode` is the re-encode, the sniffed format by default; a wiki with an image standard resizes and converts there. Each uploader has a budget keyed on `authorize`'s id and address, and each address one of its own, so an id minted fresh per burst (a self-signed wallet) refills nothing. `maxBytes`, `maxPixels` and `rateLimit` take other limits, and `store` replaces Vercel Blob. `sharp` and `@vercel/blob` are optional peers. `normalizeImage(bytes, { maxPixels, encode })` is the same sniff, cap and re-encode without the route, for images that arrive another way – a server action, or a picture copied in from another site; it resolves to `{ buffer, format, contentType }` and throws a message fit to show the uploader.
 
 ## Editor nodes
 
-`wiki-formant/tiptap` carries the custom nodes both wiki editors had written twice: `Iframe`, `YouTube` (the stock extension plus the paste rule it does not ship with), `TwitterEmbed`, `createMapEmbed`, `createCodeBlock` and `createTabs`.
+`wiki-formant/tiptap` carries the custom nodes both wiki editors had written twice: `Iframe`, `YouTube` (the stock extension plus the paste rule it does not ship with), `TwitterEmbed`, `createMapEmbed`, `createCodeBlock` and `createTabs`. `Iframe` and `createMapEmbed` draw a frame only for an https src on `DEFAULT_IFRAME_HOSTS` (`embedSrc`), since an editor draws stored HTML where its author is signed in, and a `javascript:` src runs there under any CSP that allows inline script.
 
 ```ts
 const CodeBlock = createCodeBlock({
@@ -797,16 +811,17 @@ its readers asked for. The queries that return zero rows are the valuable ones
 
 `wiki-formant/passkey` is the door to a site's own admin pages: a passkey and
 nothing else, no account, password or email. `createPasskeyGate({ sql, rpName })`
-returns the whole of it. `gate.route` is the sign-in route,
-`gate.signedIn(cookieValue)` is the check a page makes, `gate.open()` is true
-while no passkey is saved, and `gate.cookie` is the cookie's name. The two tables (`Passkey`, `PasskeyToken`) ship as Prisma
+returns the whole of it. `gate.route` is the sign-in route, `gate.signOut` the
+sign-out route, `gate.signedIn(cookieValue)` is the check a page makes, and
+`gate.cookie` is the cookie's name. The two tables (`Passkey`, `PasskeyToken`) ship as Prisma
 models in `prisma/passkey.prisma`, and every token is kept only as its hash.
 
-There is no sign-up. While no passkey is saved, the page saves the first one
-from whoever opens it, so the owner should do that as soon as the door ships.
-Every passkey after that is saved from a single-use link that the
-`passkey-invite` bin prints from a machine holding `DATABASE_URL`. A passkey is
-bound to the host it was saved on, so localhost needs its own.
+There is no sign-up. Every passkey, the first among them, is saved from a
+single-use link that the `passkey-invite` bin prints from a machine holding
+`DATABASE_URL`, so a fresh deployment cannot be claimed by whoever reaches it
+first. A passkey is bound to the host it was saved on, so localhost needs its
+own. A session names the passkey that signed in: deleting a `Passkey` row signs
+out every session it opened.
 
 ```ts
 // src/lib/admin.ts
@@ -814,6 +829,7 @@ export const gate = createPasskeyGate({ sql, rpName: 'Caper' });
 
 // src/app/api/passkey/route.ts
 export const POST = gate.route;
+export const DELETE = gate.signOut;
 
 // src/app/stats/page.tsx
 const q = statsQuery(params); // ?days= (1, 7, 30, 90, 365 or all, else 30) and the filters
@@ -824,7 +840,7 @@ return (
 );
 ```
 
-`StatsGate` (`wiki-formant/stats`) renders `children` for a signed-in reader and, for anyone else, the line saying what the prompt will do and the `PasskeyButton` that does it; `classNames` places the text, the button's box, the button and its error.
+`StatsGate` (`wiki-formant/stats`) renders `children` and a sign-out button (`PasskeySignOut`) for a signed-in reader and, for anyone else, the line saying what the prompt will do and the `PasskeyButton` that does it; `classNames` places the text, the button's box, the button and its error.
 
 `PasskeyButton` (`wiki-formant/passkey-button`) is the browser half and has its
 own subpath, because it imports `@simplewebauthn/browser`.
@@ -986,7 +1002,7 @@ npx analytics-digest --days 30 --handle radixwiki --siblings caper.network,acuiq
 npx analytics-digest --days 7 --gap "Symptom Miss:term"   # adds an event to the search gaps
 ```
 
-`passkey-invite` prints a single-use link that saves another passkey for the page it names, good for a day (`--days n` for longer). No routine calls it: the site's owner runs it by hand, from an app's checkout, when a second device or a second person needs into the stats page. Run it the same way:
+`passkey-invite` prints a single-use link that saves a passkey for the page it names, good for a day (`--days n` for longer). No routine calls it: the site's owner runs it by hand, from an app's checkout, for the first passkey and whenever another device or person needs into the stats page. Run it the same way:
 
 ```sh
 npx passkey-invite https://caper.network/stats
@@ -1011,7 +1027,7 @@ npx prisma-models analytics --check --in prisma/schema.prisma --tenant   # miow
 npx fts-ddl pages
 ```
 
-`mark-verified` stamps `last_verified_at` on pages a sweep checked and found current, so `freshnessBanner` stops calling them outdated, and `maintenance-log` is the state I/O of a wiki-sweep routine whose memory lives in one page's `metadata.state`: `read`, `write` (the whole state, or `-` for stdin), `compact` and `backlog-add`, which appends under a row lock so another routine's item cannot be lost to a concurrent `write`. Every write compacts and re-renders the page; a revision is written at most once a day. Two wikis carried both scripts against their own tables, so the tables are arguments. Run them from the app's root, like `passkey-invite`:
+`mark-verified` stamps `last_verified_at` on pages a sweep checked and found current, so `freshnessBanner` stops calling them outdated, and `maintenance-log` is the state I/O of a wiki-sweep routine whose memory lives in one page's `metadata.state`: `read`, `write` (the whole state, or `-` for stdin), `compact` and `backlog-add`, which appends under a row lock so another routine's item cannot be lost to a concurrent `write`. Every write compacts and re-renders the page, holding at most as many FLAG FOR A HUMAN items as the page shows; a revision is written at most once a day. `write` refuses a state whose `totalRuns` is below the stored one, which is a state read before another run wrote. Two wikis carried both scripts against their own tables, so the tables are arguments. Run them from the app's root, like `passkey-invite`:
 
 ```sh
 npx mark-verified contents/tech/radix-engine scrypto       # one page

package/bin/maintenance-log.mjs

@@ -26,13 +26,15 @@
 // `write` takes the whole new state: read, change, write back. A revision is
 // written at most once a day, and on every `compact`; other writes edit the
 // page in place, because a full copy per run is what made radix-wiki's log
-// over half its revisions table. `backlog-add` is how another routine files an
+// over half its revisions table. `write` refuses a state whose totalRuns is
+// below the stored one: that state was read before another run wrote.
+// `backlog-add` is how another routine files an
 // item: `write` replaces the whole state, so an append through it could lose a
 // concurrent run's, and the row lock serialises the two. A revision's version
 // is the page's `version` column bumped a minor where the table has one, else
 // the latest revision's.
 import { randomUUID } from 'node:crypto';
-import { addBacklog, compact, ident, render, scopeSql } from '../dist/maintenance.js';
+import { PINNED, addBacklog, compact, ident, render, scopeSql, staleWrite } from '../dist/maintenance.js';
 import { bump } from '../dist/versioning.js';
 import { arg, connect, invalidate } from './_cli.mjs';
 
@@ -105,6 +107,8 @@ try {
       const text = payload === undefined || payload === '-' ? await readStdin() : payload;
       if (!text.trim()) throw new Error('write needs the state as JSON, as an argument or on stdin with `write -`');
       input = JSON.parse(text);
+      const stale = staleWrite(page.metadata?.state ?? {}, input);
+      if (stale) throw new Error(stale);
     }
     const state = compact(input);
     const content = render(state, routine);
@@ -121,6 +125,13 @@ try {
       const [before, after] = [(input[key] ?? []).length, state[key].length];
       if (before !== after) console.log(`  ${key}: ${before} → ${after}`);
     }
+    const kept = new Set(state.backlog.map(b => b.item));
+    for (const b of input.backlog ?? []) {
+      const item = typeof b === 'string' ? b : b.item;
+      if (PINNED.test(item ?? '') && (typeof b === 'string' || (b.status ?? 'open') === 'open') && !kept.has(item)) {
+        console.log(`  flag dropped over the cap: ${item}`);
+      }
+    }
     console.log(
       `  ${dry ? '[dry] ' : ''}state ${JSON.stringify(input).length} → ${JSON.stringify(state).length} B, ` +
         `content ${JSON.stringify(content).length} B${revise ? `, revision v${version}` : ', no revision today'}`,

package/dist/block-views.d.ts

@@ -112,11 +112,14 @@ export declare function StatsView({ items, columns, }: {
  * The fallback `message` arrives as a prop because it is the wiki's editorial
  * voice — "You can help RADIX Wiki by expanding it" has a name in it. `icon`
  * is optional: a component library that hardcoded an icon set would make its
- * consumers install that icon set.
+ * consumers install that icon set. `policy` is the wiki's page for the
+ * standard the notice enforces; given, the label links to it, so a reader who
+ * meets "Needs citations" can find out what a citation has to be.
  */
-export declare function BannerView({ variant, text, message, icon, }: {
+export declare function BannerView({ variant, text, message, icon, policy, }: {
     variant: string;
     text?: string | null;
     message: string;
     icon?: ReactNode;
+    policy?: string;
 }): import("react").JSX.Element;

package/dist/block-views.js

@@ -123,9 +123,12 @@ export function StatsView({ items, columns = 4, }) {
  * The fallback `message` arrives as a prop because it is the wiki's editorial
  * voice — "You can help RADIX Wiki by expanding it" has a name in it. `icon`
  * is optional: a component library that hardcoded an icon set would make its
- * consumers install that icon set.
+ * consumers install that icon set. `policy` is the wiki's page for the
+ * standard the notice enforces; given, the label links to it, so a reader who
+ * meets "Needs citations" can find out what a citation has to be.
  */
-export function BannerView({ variant, text, message, icon, }) {
+export function BannerView({ variant, text, message, icon, policy, }) {
     const known = bannerVariant(variant);
-    return (_jsxs("div", { className: cx('editorial-banner', `editorial-banner-${known}`), role: "note", children: [icon, _jsxs("p", { className: "editorial-banner-body", children: [_jsxs("strong", { children: [BANNER_LABELS[known], "."] }), " ", text?.trim() || message] })] }));
+    const label = BANNER_LABELS[known];
+    return (_jsxs("div", { className: cx('editorial-banner', `editorial-banner-${known}`), role: "note", children: [icon, _jsxs("p", { className: "editorial-banner-body", children: [_jsxs("strong", { children: [policy ? _jsx("a", { href: policy, children: label }) : label, "."] }), " ", text?.trim() || message] })] }));
 }

package/dist/indexnow.js

@@ -4,7 +4,9 @@
 // The `indexnow` bin reads an origin's live sitemap, keeps the rows whose
 // `lastModified` falls inside the window, and posts them. It runs on the machine
 // that runs the sweeps, not as a cron on the host: a submission costs the origin
-// one cached sitemap fetch and no function time. The sitemap is the one place
+// one sitemap render and no scheduled function. The sitemap renders per request,
+// because one Vercel served from cache froze at the last deploy and listed none
+// of the pages edited since. The sitemap is the one place
 // every writer shows up — the editor, the MCP write tools, and the sweep scripts
 // that write to the database without passing through the app — so reading it
 // covers all of them with no hook in any.

package/dist/maintenance.d.ts

@@ -40,6 +40,13 @@ export interface LogState {
 }
 /** Drops what is closed or a diary entry, and caps what is append-only. Newest first. */
 export declare function compact(state: LogState): LogState;
+/**
+ * Why a `write` of `next` over `stored` would lose runs, or null. A run that
+ * writes back a state it read before another run wrote (a copy left in /tmp, a
+ * stale variable) carries a lower `totalRuns`, and replacing the whole state
+ * with it silently erases what the later run recorded.
+ */
+export declare function staleWrite(stored: LogState, next: LogState): string | null;
 /** New backlog items, deduplicated against what is there, dated today unless they carry a date. */
 export declare function addBacklog(state: LogState, items: readonly BacklogEntry[], today: string): BacklogEntry[];
 /** The page's content blocks, re-rendered from state on every write. `routine` names who keeps it. */

package/dist/maintenance.js

@@ -14,17 +14,21 @@
 // its revisions table. Two kinds of entry are pinned against the caps because
 // a run cannot recreate them: a backlog item flagged for a human, and a
 // watermark that banks a verdict on a whole class of site (a bot wall, a 403),
-// which is what lets an audit spend no probes on its flag list.
+// which is what lets an audit spend no probes on its flag list. Flags have a
+// cap of their own, the page's backlog window: pinned without one, they grew to
+// 48 on radix-wiki's log and held most of the backlog's sixty slots, and a flag
+// that no longer fits on the page is one no human reads.
 //
 // No subpath exports this: the bins and the tests import it from dist.
 import { escXml } from './feed.js';
-/** Held in state. */
-const MAX = { backlog: 60, runs: 30, feedback: 40, sources: 150 };
 /** Shown on the page. What a reader pays is words, and the entries run long. */
 const SHOWN = { backlog: 15, runs: 5, feedback: 8, sources: 15 };
+/** Held in state. */
+const MAX = { backlog: 60, flags: SHOWN.backlog, runs: 30, feedback: 40, sources: 150 };
 /** "run 214 (ecosystem): link audit CLEAN…" is a diary entry, not a work item. */
 const JOURNAL = /^run\s+\d+\b/i;
-const PINNED = /FLAG FOR A HUMAN/i;
+/** @internal The bin names the flags a write drops. */
+export const PINNED = /FLAG FOR A HUMAN/i;
 const BANKED = /\bbanked\b|bot[- ]?(wall|block)|\b(403|429|999)\b|cloudflare/i;
 const itemOf = (b) => (typeof b === 'string' ? b : b.item);
 const recency = (a, b) => String(b[1]?.lastChecked ?? '').localeCompare(String(a[1]?.lastChecked ?? ''));
@@ -35,7 +39,7 @@ export function compact(state) {
         .map((b, i) => ({ status: 'open', ...(typeof b === 'string' ? { date: '', item: b } : b), i }))
         .filter(b => b.status === 'open' && b.item && (PINNED.test(b.item) || !JOURNAL.test(b.item)))
         .sort((a, b) => String(b.date ?? '').localeCompare(String(a.date ?? '')) || b.i - a.i);
-    const backlog = [...open.filter(b => PINNED.test(b.item)), ...open.filter(b => !PINNED.test(b.item))]
+    const backlog = [...open.filter(b => PINNED.test(b.item)).slice(0, MAX.flags), ...open.filter(b => !PINNED.test(b.item))]
         .slice(0, MAX.backlog)
         .map(({ i: _i, ...b }) => b);
     // Most source keys are one-off verdicts on a single site. Sorting by
@@ -51,6 +55,18 @@ export function compact(state) {
         runHistory: (state.runHistory ?? []).slice(-MAX.runs),
     };
 }
+/**
+ * Why a `write` of `next` over `stored` would lose runs, or null. A run that
+ * writes back a state it read before another run wrote (a copy left in /tmp, a
+ * stale variable) carries a lower `totalRuns`, and replacing the whole state
+ * with it silently erases what the later run recorded.
+ */
+export function staleWrite(stored, next) {
+    const [had, has] = [stored.totalRuns ?? 0, next.totalRuns ?? 0];
+    return has < had
+        ? `refusing a state with totalRuns ${has} over the stored ${had}: it predates a run that has already written. Read the log again and reapply this run's changes.`
+        : null;
+}
 /** New backlog items, deduplicated against what is there, dated today unless they carry a date. */
 export function addBacklog(state, items, today) {
     const seen = new Set((state.backlog ?? []).map(itemOf));

package/dist/passkey-button.d.ts

@@ -3,9 +3,12 @@ export interface PasskeyButtonProps {
     endpoint: string;
     /** The invite token from the link, when there is one. */
     invite?: string | undefined;
-    /** Save a passkey without an invite: pass `await gate.open()`. */
-    create?: boolean;
     className?: string;
     errorClassName?: string;
 }
-export declare function PasskeyButton({ endpoint, invite, create, className, errorClassName }: PasskeyButtonProps): import("react").JSX.Element;
+export declare function PasskeyButton({ endpoint, invite, className, errorClassName }: PasskeyButtonProps): import("react").JSX.Element;
+/** Ends the session at `endpoint` (`gate.signOut` as DELETE) and reloads the page. */
+export declare function PasskeySignOut({ endpoint, className }: {
+    endpoint: string;
+    className?: string;
+}): import("react").JSX.Element;

package/dist/passkey-button.js

@@ -3,10 +3,10 @@ import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-run
 // passkey-button.tsx – the browser half of `wiki-formant/passkey`.
 //
 // Its own subpath because it imports `@simplewebauthn/browser`, an optional
-// peer that only an app with a passkey door installs. With an invite, or with
-// `create` while the site has no passkey (`gate.open()`), it saves a new
-// passkey; otherwise it signs in with a saved one. Either way, success reloads
-// the page without the invite, and the server sees the new cookie.
+// peer that only an app with a passkey door installs. With an invite it saves a
+// new passkey; otherwise it signs in with a saved one. Either way, success
+// reloads the page without the invite, and the server sees the new cookie.
+// `PasskeySignOut` calls the route's DELETE (`gate.signOut`) and reloads.
 import { startAuthentication, startRegistration } from '@simplewebauthn/browser';
 import { useState } from 'react';
 async function post(endpoint, body) {
@@ -15,8 +15,8 @@ async function post(endpoint, body) {
         throw new Error((await res.json().catch(() => null))?.error ?? 'Sign-in failed.');
     return res.status === 204 ? null : res.json();
 }
-export function PasskeyButton({ endpoint, invite, create, className, errorClassName }) {
-    const saving = !!invite || !!create;
+export function PasskeyButton({ endpoint, invite, className, errorClassName }) {
+    const saving = !!invite;
     const [busy, setBusy] = useState(false);
     const [error, setError] = useState(null);
     async function go() {
@@ -36,3 +36,10 @@ export function PasskeyButton({ endpoint, invite, create, className, errorClassN
     }
     return (_jsxs(_Fragment, { children: [_jsx("button", { type: "button", className: className, onClick: go, disabled: busy, children: saving ? 'Save a passkey' : 'Sign in with a passkey' }), error && (_jsx("p", { role: "alert", className: errorClassName, children: error }))] }));
 }
+/** Ends the session at `endpoint` (`gate.signOut` as DELETE) and reloads the page. */
+export function PasskeySignOut({ endpoint, className }) {
+    return (_jsx("button", { type: "button", className: className, onClick: async () => {
+            await fetch(endpoint, { method: 'DELETE' }).catch(() => null);
+            location.reload();
+        }, children: "Sign out" }));
+}

package/dist/passkey.d.ts

@@ -12,18 +12,18 @@ export interface PasskeyGateOptions {
 export interface PasskeyGate {
     /** The session cookie's name, for the app to read it with. */
     cookie: string;
-    /** Whether a session cookie's value is a live session. */
+    /** Whether a session cookie's value is a live session whose passkey is still saved. */
     signedIn(session: string | undefined): Promise<boolean>;
-    /** True while no passkey is saved, when the page offers to save the first one. */
-    open(): Promise<boolean>;
     /** A single-use invite token, good for `days`. The bin turns it into a link. */
     invite(days?: number): Promise<string>;
     /**
      * The whole sign-in route: `export const POST = gate.route`. The body is
      * `{ invite?, response? }`: without `response` it answers with the options
      * for the browser's prompt, with one it verifies it and sets the cookie. An
-     * invite, or a site with no passkey yet, turns the prompt into saving one.
+     * invite turns the prompt into saving one.
      */
     route(request: Request): Promise<Response>;
+    /** The sign-out route: `export const DELETE = gate.signOut`. Ends the session and clears the cookie. */
+    signOut(request: Request): Promise<Response>;
 }
 export declare function createPasskeyGate({ sql, rpName, cookie, sessionDays }: PasskeyGateOptions): PasskeyGate;

package/dist/passkey.js

@@ -1,10 +1,10 @@
 // passkey.ts – the door to a site's own admin pages: a passkey, and nothing else.
 //
 // No account, no password, no email. Whoever holds a passkey saved for the
-// site is in. While none is saved, the page saves the first one without asking
-// for anything, so the owner opens it from the deployed site the way they would
-// any other. Every passkey after that needs an invite link, which the
-// `passkey-invite` bin prints from a machine holding the database URL.
+// site is in. Every passkey, the first among them, is saved from an invite
+// link, which the `passkey-invite` bin prints from a machine holding the
+// database URL. A fresh deployment once saved the first passkey from whoever
+// opened the page, so a stranger who got there before the owner held the door.
 //
 // A passkey is bound to the host it was saved on. One saved on localhost does
 // not open the deployed site, and one saved on the site does not open localhost.
@@ -14,10 +14,10 @@
 // `prisma-models` bin copies into the app's schema folder.
 //
 // Every token is stored as its hash, so a read of the table opens nothing. A
-// challenge is spent the moment a response quotes it, and an invite the moment
-// a passkey is saved with it. The first passkey without an invite is checked
-// against an empty table in the insert itself, so two people racing to it
-// cannot both win.
+// challenge is spent the moment a response quotes it, and only by the ceremony
+// it was issued for; an invite the moment a passkey is saved with it. A session
+// names the passkey that signed in, and lives only as long as that passkey's
+// row: deleting a passkey signs out everyone who signed in with it.
 import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
 import { clientKey, rateLimit, rateLimitedResponse } from './rate-limit.js';
 const MINUTE = 60_000;
@@ -27,9 +27,9 @@ const b64url = (bytes) => Buffer.from(bytes).toString('base64url');
 const token = () => b64url(crypto.getRandomValues(new Uint8Array(32)));
 const hash = async (value) => b64url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value))));
 /** Store a token's hash; the token is returned and kept nowhere else. */
-async function issue(sql, kind, ms, value = token()) {
+async function issue(sql, kind, ms, value = token(), passkeyId = null) {
     await sql(`DELETE FROM "PasskeyToken" WHERE "expiresAt" < now()`);
-    await sql(`INSERT INTO "PasskeyToken" (hash, kind, "expiresAt") VALUES ($1, $2, now() + make_interval(secs => $3::int))`, await hash(value), kind, Math.round(ms / 1000));
+    await sql(`INSERT INTO "PasskeyToken" (hash, kind, "expiresAt", "passkeyId") VALUES ($1, $2, now() + make_interval(secs => $3::int), $4)`, await hash(value), kind, Math.round(ms / 1000), passkeyId);
     return value;
 }
 /** True once for a live token of this kind; it is gone either way. */
@@ -44,19 +44,32 @@ async function live(sql, kind, value) {
 /** Any request that fails is told only that it failed. */
 const refuse = (status, error) => Response.json({ error }, { status });
 export function createPasskeyGate({ sql, rpName, cookie = 'passkey_session', sessionDays = 90 }) {
-    async function session(secure) {
-        const value = await issue(sql, 'session', sessionDays * DAY);
-        const attrs = [`${cookie}=${value}`, 'Path=/', 'HttpOnly', 'SameSite=Lax', `Max-Age=${sessionDays * 86_400}`];
+    const setCookie = (value, maxAge, secure) => {
+        const attrs = [`${cookie}=${value}`, 'Path=/', 'HttpOnly', 'SameSite=Lax', `Max-Age=${maxAge}`];
         if (secure)
             attrs.push('Secure');
         return new Response(null, { status: 204, headers: { 'set-cookie': attrs.join('; ') } });
+    };
+    async function session(passkeyId, secure) {
+        const value = await issue(sql, 'session', sessionDays * DAY, undefined, passkeyId);
+        return setCookie(value, sessionDays * 86_400, secure);
     }
-    const open = async () => (await sql(`SELECT 1 FROM "Passkey" LIMIT 1`)).length === 0;
     return {
         cookie,
-        signedIn: async (value) => !!value && live(sql, 'session', value),
-        open,
+        signedIn: async (value) => !!value &&
+            (await sql(`SELECT 1 FROM "PasskeyToken" t JOIN "Passkey" p ON p.id = t."passkeyId"
+         WHERE t.hash = $1 AND t.kind = 'session' AND t."expiresAt" > now()`, await hash(value))).length > 0,
         invite: (days = 1) => issue(sql, 'invite', days * DAY),
+        async signOut(request) {
+            const value = request.headers
+                .get('cookie')
+                ?.split(/;\s*/)
+                .find(c => c.startsWith(`${cookie}=`))
+                ?.slice(cookie.length + 1);
+            if (value)
+                await spend(sql, 'session', value);
+            return setCookie('', 0, new URL(request.url).protocol === 'https:');
+        },
         async route(request) {
             const limited = rateLimit(clientKey('passkey', request.headers), { capacity: 10, refillPerSec: 0.2 });
             if (!limited.ok)
@@ -67,11 +80,12 @@ export function createPasskeyGate({ sql, rpName, cookie = 'passkey_session', ses
             const body = (await request.json().catch(() => null));
             const invite = typeof body?.invite === 'string' ? body.invite : undefined;
             const response = body?.response;
-            const expectedChallenge = (challenge) => spend(sql, 'challenge', challenge);
+            const ceremony = invite ? 'registration' : 'authentication';
+            const expectedChallenge = (challenge) => spend(sql, ceremony, challenge);
             if (!response) {
                 if (invite && !(await live(sql, 'invite', invite)))
                     return refuse(403, 'This invite has expired.');
-                const options = invite || (await open())
+                const options = invite
                     ? await generateRegistrationOptions({
                         rpName,
                         rpID,
@@ -81,10 +95,10 @@ export function createPasskeyGate({ sql, rpName, cookie = 'passkey_session', ses
                         authenticatorSelection: { residentKey: 'required', userVerification: 'preferred' },
                     })
                     : await generateAuthenticationOptions({ rpID, userVerification: 'preferred' });
-                await issue(sql, 'challenge', CHALLENGE_MS, options.challenge);
+                await issue(sql, ceremony, CHALLENGE_MS, options.challenge);
                 return Response.json(options);
             }
-            if (invite || (await open())) {
+            if (invite) {
                 const result = await verifyRegistrationResponse({
                     response,
                     expectedChallenge,
@@ -95,14 +109,11 @@ export function createPasskeyGate({ sql, rpName, cookie = 'passkey_session', ses
                 if (!result?.verified)
                     return refuse(400, 'That passkey could not be saved.');
                 // Spent after the check, so a failed prompt leaves the invite to try again.
-                if (invite && !(await spend(sql, 'invite', invite)))
+                if (!(await spend(sql, 'invite', invite)))
                     return refuse(403, 'This invite has expired.');
                 const { credential } = result.registrationInfo;
-                const saved = (await sql(`INSERT INTO "Passkey" (id, "publicKey", counter, transports)
-           SELECT $1, $2, $3, $4::text[] WHERE $5::boolean OR NOT EXISTS (SELECT 1 FROM "Passkey") RETURNING id`, credential.id, b64url(credential.publicKey), credential.counter, credential.transports ?? [], !!invite));
-                if (!saved.length)
-                    return refuse(403, 'This site already has a passkey. Adding another takes an invite.');
-                return session(protocol === 'https:');
+                await sql(`INSERT INTO "Passkey" (id, "publicKey", counter, transports) VALUES ($1, $2, $3, $4::text[])`, credential.id, b64url(credential.publicKey), credential.counter, credential.transports ?? []);
+                return session(credential.id, protocol === 'https:');
             }
             const [passkey] = (await sql(`SELECT id, "publicKey", counter, transports FROM "Passkey" WHERE id = $1`, String(response.id)));
             if (!passkey)
@@ -118,7 +129,7 @@ export function createPasskeyGate({ sql, rpName, cookie = 'passkey_session', ses
             if (!result?.verified)
                 return refuse(403, 'Sign-in failed.');
             await sql(`UPDATE "Passkey" SET counter = $2 WHERE id = $1`, passkey.id, result.authenticationInfo.newCounter);
-            return session(protocol === 'https:');
+            return session(passkey.id, protocol === 'https:');
         },
     };
 }

package/dist/rola.js

@@ -30,6 +30,12 @@ export function createRola({ challenges, challengeTtlSec = 300, ...identity }) {
         },
         async verifySignedChallenge(signed) {
             try {
+                // Anything but a string is a filter, not a challenge: an absent one
+                // matches every row, so one bad request would spend every pending
+                // sign-in's challenge.
+                if (typeof signed?.challenge !== 'string' || typeof signed.address !== 'string') {
+                    return { isValid: false, error: 'Invalid or expired challenge' };
+                }
                 const { count } = await challenges.deleteMany({
                     where: { challenge: signed.challenge, expiresAt: { gt: new Date() } },
                 });

package/dist/sitemap.d.ts

@@ -0,0 +1,31 @@
+export type ChangeFrequency = 'always' | 'hourly' | 'daily' | 'weekly' | 'monthly' | 'yearly' | 'never';
+export interface SitemapRow {
+    url: string;
+    lastModified?: Date;
+    changeFrequency?: ChangeFrequency;
+    priority?: number;
+}
+/** The minimum a page must be to date its sections and earn a row. */
+export interface TreePage {
+    tagPath: string;
+    slug: string;
+    updatedAt: Date;
+}
+export interface TreeSitemapOptions<P extends TreePage> {
+    /** Section tag paths to list, in order. A path with no page beneath it is listed undated. */
+    sections: Iterable<string>;
+    sectionRow: (tagPath: string) => Omit<SitemapRow, 'lastModified'>;
+    pageRow: (page: P) => Omit<SitemapRow, 'lastModified'>;
+}
+/**
+ * One row per section, dated by the newest page at or beneath it, then one row
+ * per page, dated by its own `updatedAt`.
+ *
+ * Every URL appears once. An empty-slug page is its section's own article (a
+ * category hub): it dates the section and gets no row of its own, since its URL
+ * is the section's. A section whose URL a page row already holds is served as
+ * that page, so the section's row is dropped.
+ */
+export declare function treeSitemap<P extends TreePage>(pages: readonly P[], o: TreeSitemapOptions<P>): SitemapRow[];
+/** Every tag path at or above the given ones, each once: `a/b` yields `a` and `a/b`. */
+export declare function tagPrefixes(tagPaths: Iterable<string>): string[];

package/dist/sitemap.js

@@ -0,0 +1,50 @@
+// sitemap.ts — the rows a wiki's tree contributes to its sitemap.
+//
+// All three wikis list their sections beside their pages, and each dated them
+// its own way: one by the newest page beneath, one the same but derived from
+// where the pages sit, and one not at all. A section's listing changes when a
+// page under it does, so the newest page beneath is its honest date; a section
+// with no page under it carries none rather than a fictional one.
+//
+// What stays with the caller is which sections exist, every URL, and the
+// frequency and priority each row carries. The return is structurally Next's
+// `MetadataRoute.Sitemap`, so a `sitemap.ts` spreads it as it is.
+/**
+ * One row per section, dated by the newest page at or beneath it, then one row
+ * per page, dated by its own `updatedAt`.
+ *
+ * Every URL appears once. An empty-slug page is its section's own article (a
+ * category hub): it dates the section and gets no row of its own, since its URL
+ * is the section's. A section whose URL a page row already holds is served as
+ * that page, so the section's row is dropped.
+ */
+export function treeSitemap(pages, o) {
+    const pageRows = pages
+        .filter(p => p.slug)
+        .map((p) => ({ ...o.pageRow(p), lastModified: p.updatedAt }));
+    const taken = new Set(pageRows.map(r => r.url));
+    const sectionRows = [];
+    for (const path of o.sections) {
+        const row = o.sectionRow(path);
+        if (taken.has(row.url))
+            continue;
+        let newest;
+        for (const p of pages) {
+            if ((p.tagPath === path || p.tagPath.startsWith(`${path}/`)) && (!newest || p.updatedAt > newest))
+                newest = p.updatedAt;
+        }
+        taken.add(row.url);
+        sectionRows.push({ ...row, lastModified: newest });
+    }
+    return [...sectionRows, ...pageRows];
+}
+/** Every tag path at or above the given ones, each once: `a/b` yields `a` and `a/b`. */
+export function tagPrefixes(tagPaths) {
+    const out = new Set();
+    for (const tagPath of tagPaths) {
+        const segments = tagPath.split('/').filter(Boolean);
+        for (let depth = 1; depth <= segments.length; depth++)
+            out.add(segments.slice(0, depth).join('/'));
+    }
+    return [...out];
+}

package/dist/stats.d.ts

@@ -36,7 +36,7 @@ export interface StatsGateProps {
     invite?: string | undefined;
     /** The site's host, named in the prompt. */
     host: string;
-    /** The route that serves `gate.route`. */
+    /** The route that serves `gate.route` as POST and `gate.signOut` as DELETE. */
     endpoint?: string;
     /** What a signed-in reader sees, rendered only for one. */
     children: () => ReactNode | Promise<ReactNode>;
@@ -48,9 +48,9 @@ export interface StatsGateProps {
     };
 }
 /**
- * A stats page's door: `children` for a signed-in reader, else a line saying
- * what the passkey prompt will do and the button that does it. With an invite
- * it saves a passkey, as it does while the site has none; otherwise it signs
- * in. Three apps wrote this branch and its three sentences.
+ * A stats page's door: `children` and a sign-out button for a signed-in
+ * reader, else a line saying what the passkey prompt will do and the button
+ * that does it. With an invite it saves a passkey; otherwise it signs in.
+ * Three apps wrote this branch and its sentences.
  */
-export declare function StatsGate({ gate, session, invite, host, endpoint, children, classNames: c }: StatsGateProps): Promise<string | number | bigint | boolean | Iterable<ReactNode> | import("react").JSX.Element | null | undefined>;
+export declare function StatsGate({ gate, session, invite, host, endpoint, children, classNames: c }: StatsGateProps): Promise<import("react").JSX.Element>;

package/dist/stats.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { STATS_FILTERS } from './analytics.js';
-import { PasskeyButton } from './passkey-button.js';
+import { PasskeyButton, PasskeySignOut } from './passkey-button.js';
 import { StatsFigures } from './stats-figures.js';
 /** The windows the stats page offers, in days; `Infinity` is all time. */
 const STATS_RANGES = [1, 7, 30, 90, 365, Infinity];
@@ -76,18 +76,14 @@ export function Stats({ digest: d, days, filter = {}, ranges = STATS_RANGES }) {
     return (_jsxs("div", { className: "stats", children: [narrowed.length > 0 && (_jsxs("div", { className: "stats-filters", children: [_jsx("ul", { "aria-label": "Narrowed to", children: narrowed.map(k => (_jsx("li", { children: _jsxs("a", { href: href(days, { ...filter, [k]: undefined }), title: "Remove", children: [NAMES[k], ": ", k === 'country' ? country(filter[k]) : filter[k], " \u00D7"] }) }, k))) }), start < counted && d.counted_from && (_jsxs("p", { children: ["Narrowed figures start on ", d.counted_from, ", the first day this site counted its own visits."] }))] })), _jsx(StatsFigures, { digest: d, first: first, windows: windows }), _jsxs("div", { className: "stats-lists", children: [_jsx(StatsList, { title: "Pages", rows: rows(d.top_pages, 'page', 'visitors'), to: to('page') }), _jsx(StatsList, { title: "Entry pages", rows: rows(d.entry_pages, 'page', 'visitors'), to: to('entry') }), _jsx(StatsList, { title: "Sources", rows: rows(d.top_sources, 'source', 'visitors'), to: to('source') }), _jsx(StatsList, { title: "From X posts", rows: rows(d.from_posts, 'page', 'visitors'), to: v => href(days, { ...filter, source: 'x', entry: v }) }), _jsx(StatsList, { title: "Sibling sites", rows: rows(d.sibling_referrals, 'source', 'visitors'), to: to('source') }), _jsx(StatsList, { title: "Countries", rows: rows(d.countries, 'country', 'visitors'), label: country, to: to('country') }), _jsx(StatsList, { title: "Devices", rows: rows(d.devices, 'device', 'visitors'), to: to('device') }), _jsx(StatsList, { title: "Agents", rows: rows(d.top_agents, 'agent', 'visitors') }), _jsx(StatsList, { title: "Agent tool calls", rows: rows(d.agent_tool_calls, 'tool', 'events') }), _jsx(StatsList, { title: "Searches that found nothing", rows: rows(d.gaps, 'query', 'events') })] })] }));
 }
 /**
- * A stats page's door: `children` for a signed-in reader, else a line saying
- * what the passkey prompt will do and the button that does it. With an invite
- * it saves a passkey, as it does while the site has none; otherwise it signs
- * in. Three apps wrote this branch and its three sentences.
+ * A stats page's door: `children` and a sign-out button for a signed-in
+ * reader, else a line saying what the passkey prompt will do and the button
+ * that does it. With an invite it saves a passkey; otherwise it signs in.
+ * Three apps wrote this branch and its sentences.
  */
 export async function StatsGate({ gate, session, invite, host, endpoint = '/api/passkey', children, classNames: c = {} }) {
-    if (!invite && (await gate.signedIn(session)))
-        return children();
-    const open = !invite && (await gate.open());
-    return (_jsxs(_Fragment, { children: [_jsx("p", { className: c.text, children: invite
-                    ? `Save a passkey on this device to open ${host}'s stats.`
-                    : open
-                        ? `No passkey is saved for ${host} yet. Save the first one here; any after that needs an invite.`
-                        : 'Sign in with a passkey saved for this site.' }), _jsx("div", { className: c.actions, children: _jsx(PasskeyButton, { endpoint: endpoint, invite: invite, create: open, className: c.button, errorClassName: c.error }) })] }));
+    if (!invite && (await gate.signedIn(session))) {
+        return (_jsxs(_Fragment, { children: [await children(), _jsx("div", { className: c.actions, children: _jsx(PasskeySignOut, { endpoint: endpoint, className: c.button }) })] }));
+    }
+    return (_jsxs(_Fragment, { children: [_jsx("p", { className: c.text, children: invite ? `Save a passkey on this device to open ${host}'s stats.` : 'Sign in with a passkey saved for this site.' }), _jsx("div", { className: c.actions, children: _jsx(PasskeyButton, { endpoint: endpoint, invite: invite, className: c.button, errorClassName: c.error }) })] }));
 }

package/dist/tiptap.d.ts

@@ -1,6 +1,13 @@
 import { type ReactNode } from 'react';
 import { Extension, Node as TiptapNode } from '@tiptap/core';
 /** Local `cn`. Both wikis import one; the package will not depend on one. */
+/**
+ * An embed's address, if it is https on a host the sanitiser and the CSP
+ * admit; otherwise null, and the node draws an empty frame. The editor draws
+ * stored HTML on the origin where its author is signed in, and a
+ * `javascript:` src runs there under any CSP with 'unsafe-inline' script.
+ */
+export declare function embedSrc(src: unknown): string | null;
 export declare const Iframe: TiptapNode<any, any>;
 /** The stock extension plus the paste rule it does not ship with. */
 export declare const YouTube: TiptapNode<import("@tiptap/extension-youtube").YoutubeOptions, any>;

package/dist/tiptap.js

@@ -17,6 +17,7 @@ import { NodeViewContent, NodeViewWrapper, ReactNodeViewRenderer } from '@tiptap
 import TiptapYoutube from '@tiptap/extension-youtube';
 import TiptapCodeBlock from '@tiptap/extension-code-block';
 import { onTweetResize, tweetEmbedSrc } from './dom.js';
+import { DEFAULT_IFRAME_HOSTS } from './headers.js';
 import { toMapEmbedUrl } from './maps.js';
 import { useClickOutside } from './react.js';
 import { cx } from './html.js';
@@ -24,6 +25,23 @@ import { slugifyHeading, uniqueHeadingId } from './headings.js';
 import { CODE_LANGS, DEFAULT_LANG } from './blocks.js';
 /** Local `cn`. Both wikis import one; the package will not depend on one. */
 // ---- iframe -----------------------------------------------------------------
+/**
+ * An embed's address, if it is https on a host the sanitiser and the CSP
+ * admit; otherwise null, and the node draws an empty frame. The editor draws
+ * stored HTML on the origin where its author is signed in, and a
+ * `javascript:` src runs there under any CSP with 'unsafe-inline' script.
+ */
+export function embedSrc(src) {
+    if (typeof src !== 'string')
+        return null;
+    try {
+        const u = new URL(src);
+        return u.protocol === 'https:' && DEFAULT_IFRAME_HOSTS.includes(u.hostname) ? u.href : null;
+    }
+    catch {
+        return null;
+    }
+}
 export const Iframe = TiptapNode.create({
     name: 'iframe',
     group: 'block',
@@ -38,7 +56,7 @@ export const Iframe = TiptapNode.create({
         return [
             'div',
             { 'data-iframe-embed': '', class: 'iframe-embed' },
-            ['iframe', mergeAttributes(HTMLAttributes, { frameborder: '0', allowfullscreen: 'true' })],
+            ['iframe', mergeAttributes({ ...HTMLAttributes, src: embedSrc(HTMLAttributes.src) }, { frameborder: '0', allowfullscreen: 'true' })],
         ];
     },
 });
@@ -159,7 +177,7 @@ export function createMapEmbed({ resolveMapUrl }) {
                 [
                     'iframe',
                     {
-                        src: node.attrs.src,
+                        src: embedSrc(node.attrs.src),
                         frameborder: '0',
                         allowfullscreen: 'true',
                         loading: 'lazy',

package/dist/upload.js

@@ -84,7 +84,11 @@ export function uploadHandler({ authorize, maxBytes = 4 * 1024 * 1024, maxPixels
         const who = await authorize(request);
         if (who instanceof Response)
             return who;
-        const limit = limitClient(`upload:${who}`, request.headers, rateLimit);
+        // The address gets a bucket of its own: an id keyed with it is free to mint
+        // where sign-in is a self-signed wallet proof, so a fresh one per burst would
+        // otherwise refill the budget.
+        const limit = [limitClient(`upload:${who}`, request.headers, rateLimit), limitClient('upload-ip', request.headers, rateLimit)]
+            .find(l => !l.ok) ?? { ok: true };
         if (!limit.ok) {
             return errors.tooManyRequests(limit.retryAfterSec, `Too many uploads. Try again in ${limit.retryAfterSec}s.`);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wiki-formant",
-  "version": "0.53.0",
+  "version": "0.56.0",
   "description": "The portable half of a wiki: derived taxonomy and facet controls, a version-negotiating MCP transport, markdown twins, block rendering, a rich-text editor engine, conditional-GET plumbing, and the headers and CSP every origin sends.",
   "type": "module",
   "license": "MIT",
@@ -52,6 +52,11 @@
       "import": "./dist/pagination.js",
       "default": "./dist/pagination.js"
     },
+    "./sitemap": {
+      "types": "./dist/sitemap.d.ts",
+      "import": "./dist/sitemap.js",
+      "default": "./dist/sitemap.js"
+    },
     "./versioning": {
       "types": "./dist/versioning.d.ts",
       "import": "./dist/versioning.js",

package/prisma/passkey.prisma

@@ -12,10 +12,14 @@ model Passkey {
   counter    Int
   transports String[]
   createdAt  DateTime @default(now()) @db.Timestamptz(3)
+  sessions   PasskeyToken[]
 }
 
 model PasskeyToken {
   hash      String   @id // sha-256 of the token, base64url
-  kind      String // session | invite | challenge
+  kind      String // session | invite | registration | authentication
   expiresAt DateTime @db.Timestamptz(3)
+  // The passkey a session signed in with: deleting the passkey ends its sessions.
+  passkeyId String?
+  passkey   Passkey? @relation(fields: [passkeyId], references: [id], onDelete: Cascade)
 }