wiki-formant 0.73.0 → 0.76.0

package/README.md

@@ -213,12 +213,6 @@ What it gets right:
 - **The rate limit is declared, not wired.** Put `rateLimit: {capacity, refillPerSec}` on the config and `mcpResponse` enforces it before parsing the body, refuses with a JSON-RPC envelope, and states `RateLimit-Limit`/`-Remaining`/`-Reset` on every answer. Four routes had each transcribed that by hand through three differently-named local helpers, which is how a headroom header gets added to one surface and forgotten on the next.
 - **`mcpRateLimited(retryAfterSec)` is a JSON-RPC envelope.** A 429 whose body is `{"error": "..."}` is a string where the client's parser expects `{code, message}`, on the one response an agent meets exactly when it is working hard.
 
-### A read-only surface
-
-`readOnly(config, hide?)` is the same server with its writes taken off: the tools marked `readOnlyHint: true` and not named in `hide`, with every instruction line and prompt that names a dropped tool dropped too, and `destructiveHint` and `openWorldHint` stated on each tool that is kept. It exists for ChatGPT plugins, whose review refuses crypto transfers and checkout links and whose reviewers cannot sign a ROLA challenge. Mount it at its own route (`mcpResponse(req, readOnly(config))`), so the main endpoint keeps its writes, and hold the plugin package to it with `pluginParity` (Conformance). Keep each instruction a line of its own, so a line that names a write takes nothing else with it.
-
-`openaiChallengeHandler()` from `wiki-formant/well-known` serves `/.well-known/openai-apps-challenge`: the portal's domain token from `OPENAI_APPS_CHALLENGE`, as bare text, or a 404 while it is unset.
-
 ### Structured output, `_meta`, and the envelope gate
 
 **Every object a handler returns comes back as `structuredContent` beside the text block**, so a client reads the answer rather than scraping prose for it. This used to be gated on declaring an `outputSchema`, and the result was that across four live servers and thirty-two tools — every one of them answering in JSON — not a single response ever carried it. `outputSchema` remains the stronger contract, because a client validates against it; it is no longer the price of admission. A handler returning a string is left alone.
@@ -266,7 +260,6 @@ The drift checks hold an MCP server to what its own site does, so a tool cannot
 - `roundTrip(t, label, { read, write })`: what a read tool hands out, the write tool takes back unchanged, and the next read matches.
 - `openapiWriteParity(t, [[path, method, tool], …])`: every field an OpenAPI write documents, the matching tool takes.
 - `rolaOriginCheck(t)`: a challenge tool's ROLA recipe names the origin under test.
-- `pluginParity(t, { plugin, mcp })`: a ChatGPT plugin package (`chatgpt/plugin.json` and `chatgpt/mcp.json`) agrees with the endpoint it names, rebased onto the origin under test: one streamable-HTTP server that answers; every tool a review case triggers is listed there; every tool states `readOnlyHint`, `destructiveHint` and `openWorldHint` as booleans; `capabilities` claims `Write` exactly when a write tool is listed; no instruction, description or prompt names a tool the main endpoint has and the plugin's lacks; the listing is within the portal's limits with five positive and three negative cases; and each listing page on the site's own origin answers, with its `#anchor` where it names one. The demo recording is the one review field it cannot check.
 
 `standardVersionSources(t, openapiPaths)` is the `versionCoherence` map every S10 surface serves — both agent-card paths, `mcp.json`, the server card and each path the OpenAPI document answers at — so a suite names only the paths it adds. `t.rpcAt(endpoint, …)` and `t.callAt` drive a second MCP endpoint on the same surface with the same backoff, User-Agent and tally.
 
@@ -467,7 +460,7 @@ are unit-tested without a DOM.
 `FacetBar` renders the rows `createTaxonomy` already produces. This is why the taxonomy exports a rows model rather than markup: the rows could always cross the boundary and, until this subpath existed, the markup could not, so all three wikis hand-rendered it and two put `aria-pressed` on an `<a>`. `Breadcrumbs` renders the trail and its `BreadcrumbList` JSON-LD together, because a trail whose structured data is written somewhere else is a trail that will one day disagree with its own markup — which is the case Google penalises. It takes a `base` origin: structured-data URLs must be absolute and a package cannot know the site.
 `FacetBar` takes a `count` class to render each count as its own element, and `alphaFirst` to lead with the A–Z row. A chip row above the grid and a panel beside it are the same markup laid out by different stylesheets, so the class names are what tell them apart: `letterRow`, `letterControl` and `letterControlActive` style the A–Z row apart from the facet rows (each falls back to `row`, `control` or `controlActive`); a `text` class wraps each label in its own element and gives a facet option its value as `title`, so a long value can truncate while its count stays in view; and `letterCounts="title"` keeps each letter a bare glyph with its count in the tooltip. With none of them set the markup is what it was. Its JSON-LD goes out through `JsonLd`, which is exported for every other payload a page emits: it re-encodes each `<` as `\u003c`, because these payloads carry authored titles and an authored `</script>` would otherwise close the tag.
 
-`PageNav` is the previous/next pair at the foot of an article — the sequential read the infobox rail's lateral links do not cover. Ordering is the caller's, because it is the one part that is never portable: a wiki's sequence is its section's configured sort, a knowledge base's is a taxonomy walk. Pair it with `adjacentPages` from `wiki-formant/pagination` over a list you already hold — neither wiki needs a query for it, and the two indexed lookups the neighbours used to cost were the reason one of them dropped the control.
+`Pager` is the "← Previous · Page 2 of 9 · Next →" line, for paged results and for a carousel. Pass `href` and the steps are links (pair it with `paginatedResponse`'s `page` and `totalPages`); pass `onPage` and they are buttons, `wrap` stepping round from either end as a snap row does. A step with nowhere to go stays in place, inert, so the count never jumps sideways, and `spread` puts the steps at the ends of the line. `noun` names what a page is ("Point 2 of 21", "Previous point"). `SnapDots` is a snap row's dots: with `onGo` (`useSnapRow`'s `go`) each is a named button, without it they only count and are hidden from assistive technology. Three sites had written the pager by hand, each stopping at the ends differently, and two had drawn their own dots around the shared hook. `base.css` lays both out; the colours are the site's, the dots' through `--snap-dot` and `--snap-dot-on`.
 
 `RailShell` stays in `wiki-formant/react`, because it calls `useSidebar` and genuinely is a client component. It renders the rail's landmark, its scroll wrapper and the three collapse states — including the `--instant` class that keeps a remembered-closed rail from animating shut on first paint, and the close-on-navigate that a mobile drawer needs. Only a followed link closes it: a search field or a table-of-contents entry inside the drawer leaves it open. Compose your own rail inside it and mark the active link with `isRailLinkActive`; all three wikis do, and the pre-composed component that used to sit here had one consumer and had already lost both of those behaviours.
 
@@ -718,7 +711,7 @@ leafBlocks(blocks, BLOCK_SHAPE.containers);
 
 The dispatch over a repo's own block union stays in that repo; the bodies come from here. `coreAtomicText` has a prose body for every core leaf — the stats, link-grid and page-list bodies joined the originals when two of the three wikis turned out to extract nothing from them, so their MCP `get_page` answered a hub page as nearly empty.
 
-The core leaves — `content`, `codeTabs`, `banner`, `references`, `stats`, `linkGrid`, `testimonial`, `recentPages`, `pageList` — had the same case bodies in every wiki's text export, markdown twin, validator and new-block record. A repo's switch hands those cases over and keeps its own, so it stays exhaustive over its union:
+The core leaves — `content`, `codeTabs`, `banner`, `references`, `stats`, `linkGrid`, `testimonial`, `recentPages`, `pageList`, and `list`, which does what the two page lists do between them — had the same case bodies in every wiki's text export, markdown twin, validator and new-block record. A repo's switch hands those cases over and keeps its own, so it stays exhaustive over its union:
 
 ```ts
 import { coreAtomicText, coreAtomicToMarkdown, coreBlockDefaults } from 'wiki-formant/blocks';
@@ -749,7 +742,7 @@ if (issues.length) return badRequest(`Invalid content: ${describeBlockIssues(iss
 
 A `codeTabs` tab's `code` is source text in every wiki here, and every view treats it that way: `CodeTabsView` escapes it into a `<pre><code>`, the sanitiser leaves it alone, the markdown twin fences it verbatim. A wiki that escapes and highlights on the server passes `highlighted` to the view. The package used to assume editors stored highlighted markup; none ever had, and every twin printed `Vec<u8>` as `Vec`.
 
-`recentPages` and `pageList` resolve to `ResolvedPageRef`s — build each with `pageRef(page, now)`, which carries the ISO date a `<time>` needs — and `PageRefsView` renders them as a list, with a `renderItem` slot for a wiki that has its own row.
+`recentPages`, `pageList` and a `list` resolve to `ResolvedPageRef`s — build each with `pageRef(page, now)`, which carries the ISO date a `<time>` needs — and `PageRefsView` renders them as a list, with a `renderItem` slot for a wiki that has its own row.
 
 ## Dates
 
@@ -849,7 +842,7 @@ const SCHEMA: BlockSchema<Block> = {
 <BlockEditor blocks={blocks} onChange={setBlocks} schema={SCHEMA} kit={KIT} />
 ```
 
-The dispatch stays a `switch` over the wiki's own union, so a new type is a compile error there. `CodeTabsFields`, `StatsFields`, `ReferencesFields`, `LinkGridFields`, `BannerFields`, `PageListFields`, `ColumnsFields` and `InfoboxFields` take the core blocks `wiki-formant/blocks` declares; the two containers hold the same list, offering `nestedTypes`. `Field`, `Choice` and `LimitField` are exported for a wiki's own editors, so its native types wear the same kit. A card is marked `data-selected` while it is being edited and `data-nested` inside a container; a type the build does not know is shown by its raw type and carried through untouched. Keep the kit and the schema stable — a module constant or a `useMemo` — since both reach every card through context, and a fresh one re-renders every card on every keystroke.
+The dispatch stays a `switch` over the wiki's own union, so a new type is a compile error there. `CodeTabsFields`, `StatsFields`, `ReferencesFields`, `LinkGridFields`, `BannerFields`, `PageListFields`, `ListFields`, `ColumnsFields` and `InfoboxFields` take the core blocks `wiki-formant/blocks` declares; the two containers hold the same list, offering `nestedTypes`. `Field`, `Choice` and `LimitField` are exported for a wiki's own editors, so its native types wear the same kit. A card is marked `data-selected` while it is being edited and `data-nested` inside a container; a type the build does not know is shown by its raw type and carried through untouched. Keep the kit and the schema stable — a module constant or a `useMemo` — since both reach every card through context, and a fresh one re-renders every card on every keystroke.
 
 An editor that draws each block in place, with a list of its own (miow's), hosts the same fields in `<BlockFieldsKit kit={KIT}>`, without `<BlockEditor>`. Only the two container fields need the full editor, since they hold a block list.
 
@@ -857,7 +850,9 @@ A `testimonial` is `{ quote, author, role?, avatarUrl? }`, drawn by `Testimonial
 
 A banner with no text of its own shows `BANNER_MESSAGES` from `wiki-formant/text`, a sentence per variant that names no wiki; `BannerView` takes it unless `message` overrides it.
 
-The core blocks are `ContentBlock`, `CodeTabsBlock`, `StatsBlock`, `LinkGridBlock`, `ReferencesBlock`, `BannerBlock`, `TestimonialBlock`, `ColumnsBlock<A>` and `InfoboxBlock<A>`, `A` being the wiki's atomic union. A wiki builds its union from them beside its own `recentPages` and `pageList`, which hold its own page rows or a section, and its native types.
+The core blocks are `ContentBlock`, `CodeTabsBlock`, `StatsBlock`, `LinkGridBlock`, `ReferencesBlock`, `BannerBlock`, `TestimonialBlock`, `ListBlock`, `ColumnsBlock<A>` and `InfoboxBlock<A>`, `A` being the wiki's atomic union. A wiki builds its union from them beside its own `recentPages` and `pageList`, which hold its own page rows or a section, and its native types.
+
+`ListBlock` is one list of the wiki's pages where those two were two: the pages in a section (`source: 'under'`), the newest, in a section or across the wiki (`'newest'`, `count`), or pages picked by hand (`'chosen'`, `pages`, keyed as the wiki keys a page, an id or a path), shown as links with their age or as cards (`show`). A wiki resolves it to `items` as it does a page list. `ListFields` edits it, with `pages` to pick from and `sections` to name; a wiki with a source of its own, a shop's products say, passes it in `sources` and draws its fields as `children`.
 
 ## Analytics
 

package/dist/base.css

@@ -201,6 +201,44 @@ html[data-sidebar='closed'] .wiki-sidebar { width: 0; }
 }
 .breadcrumbs .separator { user-select: none; }
 
+/* ---- Pager and SnapDots -----------------------------------------------------
+   One line that never wraps, the count in tabular figures so stepping does not
+   shift it. A step is a bare control: its colour, size and hit area are the
+   site's, set on `.pager-step`. The dots' colours are `--snap-dot` and
+   `--snap-dot-on`, defaulting to the text colour faint and full. */
+.pager {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: var(--pager-gap, 1rem);
+  white-space: nowrap;
+  font-variant-numeric: tabular-nums;
+}
+.pager[data-spread] { justify-content: space-between; gap: 0; }
+.pager-step { font: inherit; color: inherit; background: none; border: 0; padding: 0; cursor: pointer; }
+.pager-step:is(:disabled, [aria-disabled='true']) { opacity: 0.4; cursor: default; }
+
+.snap-dots { display: flex; flex-wrap: wrap; justify-content: center; gap: var(--snap-dot-gap, 0); }
+.snap-dots button {
+  display: grid;
+  place-items: center;
+  inline-size: var(--snap-dot-hit, 1.5rem);
+  block-size: var(--snap-dot-hit, 1.5rem);
+  padding: 0;
+  border: 0;
+  background: none;
+  cursor: pointer;
+}
+.snap-dots i {
+  display: block;
+  inline-size: var(--snap-dot-size, 0.5rem);
+  block-size: var(--snap-dot-size, 0.5rem);
+  border-radius: 9999px;
+  background: var(--snap-dot, color-mix(in srgb, currentColor 30%, transparent));
+  transition: background-color 150ms;
+}
+.snap-dots :is(i[data-on], [data-on] > i) { background: var(--snap-dot-on, currentColor); }
+
 /* ---- spinner, skeleton, empty state ----------------------------------------
    The shape and the motion; colour, size and surface are the site's. The
    spinner is a ring in currentColor sized by `--spinner-size`, the skeleton a

package/dist/block-editor.d.ts

@@ -200,6 +200,33 @@ export declare function PageListFields<B extends {
     onUpdate: (block: B) => void;
     pages?: readonly PageOption[];
 }): import("react").JSX.Element;
+/**
+ * A list block's fields: where its pages come from, and how it shows them.
+ * `pages` are what a hand-picked list chooses from, keyed as the wiki keys
+ * them; `sections` the sections a list may name, else a section is typed.
+ * A wiki with a source of its own passes it in `sources` and draws its fields
+ * as `children`, which show while it is chosen; `show` is then the wiki's own.
+ */
+export declare function ListFields<B extends {
+    source: string;
+    under?: string;
+    count?: number;
+    pages?: string[];
+    show: 'links' | 'cards';
+}>({ block, onUpdate, pages, sections, sources, children, }: {
+    block: B;
+    onUpdate: (block: B) => void;
+    pages?: readonly PageOption[];
+    sections?: readonly {
+        value: string;
+        label: string;
+    }[];
+    sources?: readonly {
+        value: string;
+        label: string;
+    }[];
+    children?: ReactNode;
+}): import("react").JSX.Element;
 /** Two to four columns, each a block list offering the schema's `nestedTypes`. */
 export declare function ColumnsFields<A extends EditableBlock>({ block, onUpdate }: {
     block: ColumnsBlock<A>;

package/dist/block-editor.js

@@ -1,5 +1,5 @@
 'use client';
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 // block-editor.tsx — the block list an author edits, and the fields of the core
 // block types.
 //
@@ -23,7 +23,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // card re-renders on every keystroke.
 import { createContext, memo, useCallback, useContext, useMemo, useState, } from 'react';
 import { BlockActions, useBlockOperations } from './react.js';
-import { CODE_LANGS, DEFAULT_LANG, } from './blocks.js';
+import { CODE_LANGS, DEFAULT_LANG, LIST_SOURCES, } from './blocks.js';
 import { BANNER_VARIANTS } from './text.js';
 import { MAX_BLOCK_ROWS } from './validation.js';
 import { cx } from './html.js';
@@ -187,11 +187,13 @@ export function BannerFields({ block, onUpdate }) {
  * the rest are offered in a picker; without, an id is typed in.
  */
 export function PageListFields({ block, onUpdate, pages }) {
+    return _jsx(PagePicker, { ids: block.pageIds, onChange: pageIds => onUpdate({ ...block, pageIds }), pages: pages });
+}
+/** Pages picked by key, in order: the body of a page list and of a list that picks its pages by hand. */
+function PagePicker({ ids, onChange: set, pages }) {
     const { kit } = useEditorContext();
     const c = kit.classNames;
     const [typed, setTyped] = useState('');
-    const ids = block.pageIds;
-    const set = (pageIds) => onUpdate({ ...block, pageIds });
     const byId = new Map(pages?.map(p => [p.id, p]));
     const full = ids.length >= MAX_BLOCK_ROWS;
     const add = (id) => {
@@ -222,6 +224,34 @@ export function PageListFields({ block, onUpdate, pages }) {
                             setTyped('');
                         }, children: "Add page" })] }))] }));
 }
+/** What each of a list's sources is called where it is chosen. */
+const LIST_SOURCE_LABELS = {
+    under: 'The pages in a section',
+    newest: 'The newest pages',
+    chosen: 'Pages picked by hand',
+};
+const LIST_SHOWS = [
+    { value: 'links', label: 'As links, with their age' },
+    { value: 'cards', label: 'As cards, with a picture and a line each' },
+];
+/**
+ * A list block's fields: where its pages come from, and how it shows them.
+ * `pages` are what a hand-picked list chooses from, keyed as the wiki keys
+ * them; `sections` the sections a list may name, else a section is typed.
+ * A wiki with a source of its own passes it in `sources` and draws its fields
+ * as `children`, which show while it is chosen; `show` is then the wiki's own.
+ */
+export function ListFields({ block, onUpdate, pages, sections, sources = [], children, }) {
+    const c = useEditorContext().kit.classNames;
+    const core = LIST_SOURCES.includes(block.source);
+    const set = (change) => onUpdate({ ...block, ...change });
+    const section = (label) => sections ? (_jsx(Choice, { label: label, value: block.under ?? '', options: [{ value: '', label: 'The whole wiki' }, ...sections], onChange: under => set({ under: under || undefined }) })) : (_jsx(Field, { label: label, children: _jsx(TextInput, { label: label, optional: true, value: block.under, onChange: under => set({ under: under?.trim().replace(/^\/+|\/+$/g, '') || undefined }) }) }));
+    return (_jsxs("div", { className: c.stack, children: [_jsx(Choice, { label: "Which pages", value: block.source, options: [...LIST_SOURCES.map(v => ({ value: v, label: LIST_SOURCE_LABELS[v] })), ...sources], onChange: source => set({
+                    source,
+                    ...(source === 'newest' && !block.count && { count: 5 }),
+                    ...(source === 'chosen' && !block.pages && { pages: [] }),
+                }) }), block.source === 'under' && section('The section'), block.source === 'newest' && (_jsxs(_Fragment, { children: [_jsx(LimitField, { value: block.count, onChange: count => set({ count }) }), section('From the section')] })), block.source === 'chosen' && _jsx(PagePicker, { ids: block.pages ?? [], onChange: p => set({ pages: p }), pages: pages }), core ? _jsx(Choice, { label: "Shown", value: block.show, options: LIST_SHOWS, onChange: show => set({ show }) }) : children] }));
+}
 const GAPS = ['sm', 'md', 'lg'].map(v => ({ value: v, label: v }));
 const ALIGNS = ['start', 'center', 'end', 'stretch'].map(v => ({ value: v, label: v }));
 const MAX_COLUMNS = 4;

package/dist/blocks.d.ts

@@ -126,6 +126,28 @@ export interface InfoboxBlock<A> {
     type: 'infobox';
     blocks: A[];
 }
+/** Where a list's pages come from: those in a section, the newest, or ones picked by hand. */
+export declare const LIST_SOURCES: readonly ["under", "newest", "chosen"];
+export type ListSource = (typeof LIST_SOURCES)[number];
+/**
+ * A list of the wiki's pages, one block for what `recentPages` and `pageList`
+ * do between them and for a section's index besides: the pages in a section,
+ * the newest (in a section or across the wiki), or pages picked by hand, shown
+ * as links with their age or as cards. `under` names a section the wiki's own
+ * way, a tag path or a URL path; `pages` holds whatever key the wiki picks a
+ * page by, an id or a path, in the order they are listed. A wiki resolves it
+ * to `items` when the page is read, as it does a page list.
+ */
+export interface ListBlock {
+    id: string;
+    type: 'list';
+    source: ListSource;
+    under?: string;
+    /** How many of the newest. */
+    count?: number;
+    pages?: string[];
+    show: 'links' | 'cards';
+}
 export interface BlockTreeOptions<B> {
     /** Render one leaf block. Return `''` to drop it from the document. */
     atomic: (block: B) => string;
@@ -264,6 +286,9 @@ export type CoreAtomicBlock<P = ResolvedPageRef> = {
 } | {
     type: 'recentPages' | 'pageList';
     resolvedPages?: readonly P[] | null;
+} | {
+    type: 'list';
+    items?: readonly P[] | null;
 };
 /**
  * One core leaf as prose, for the LLM and MCP exports. A page list reads only
@@ -313,6 +338,12 @@ export interface CoreBlockDefaults {
         type: 'pageList';
         pageIds: string[];
     };
+    list: () => {
+        type: 'list';
+        source: 'newest';
+        count: number;
+        show: 'links';
+    };
     columns: () => {
         type: 'columns';
         columns: {

package/dist/blocks.js

@@ -29,6 +29,8 @@ export function pageRef(page, now, style = 'long') {
         updated: new Date(page.updatedAt).toISOString(),
     };
 }
+/** Where a list's pages come from: those in a section, the newest, or ones picked by hand. */
+export const LIST_SOURCES = ['under', 'newest', 'chosen'];
 /**
  * The whole tree as markdown. Containers flatten in document order, because a
  * reader following prose does not have columns — and an agent quoting the page
@@ -218,6 +220,7 @@ export function coreAtomicText(block) {
         case 'testimonial': return testimonialToText(block.quote, block.author, block.role);
         case 'recentPages':
         case 'pageList': return pageListToText(block.resolvedPages ?? []);
+        case 'list': return pageListToText(block.items ?? []);
     }
 }
 /** One core leaf as markdown, for a page's `.md` twin. */
@@ -232,7 +235,8 @@ export function coreAtomicToMarkdown(block, opts) {
         case 'testimonial': return testimonialToMarkdown(block.quote, block.author, block.role);
         case 'recentPages':
         case 'pageList':
-            return linkList((block.resolvedPages ?? []).map(p => ({
+        case 'list':
+            return linkList(((block.type === 'list' ? block.items : block.resolvedPages) ?? []).map(p => ({
                 label: p.title,
                 href: p.href.startsWith('/') ? `${opts.siteUrl}${p.href}` : p.href,
             })));
@@ -257,6 +261,7 @@ export function coreBlockDefaults(opts = {}) {
         content: () => ({ type: 'content', text: '' }),
         recentPages: () => ({ type: 'recentPages', limit: 5 }),
         pageList: () => ({ type: 'pageList', pageIds: [] }),
+        list: () => ({ type: 'list', source: 'newest', count: 5, show: 'links' }),
         columns: () => ({
             type: 'columns',
             columns: [{ id: newId(), blocks: [] }, { id: newId(), blocks: [] }],

package/dist/conformance.d.ts

@@ -260,18 +260,3 @@ export declare function rolaOriginCheck(t: Tester, opts?: {
     endpoint?: string;
     tool?: string;
 }): Promise<void>;
-/**
- * A ChatGPT plugin package agrees with the server it names. The ZIP is uploaded
- * once and OpenAI rescans the server every day, so a renamed tool, a write that
- * reaches the plugin's endpoint, a description naming a tool the endpoint lacks,
- * or a moved legal page fails review with nothing in the repo noticing. Pass the
- * parsed `chatgpt/plugin.json` and `chatgpt/mcp.json`.
- *
- * URLs on the plugin's own origin are rebased onto the origin under test, so a
- * run against a dev server checks the dev server. The demo recording is the
- * one review field no code can hold, so it is not checked.
- */
-export declare function pluginParity(t: Tester, pkg: {
-    plugin: unknown;
-    mcp: unknown;
-}): Promise<void>;

package/dist/conformance.js

@@ -600,91 +600,3 @@ export async function rolaOriginCheck(t, opts = {}) {
     const message = answer?.sign?.message ?? '';
     t.check('ROLA recipe names this origin', message.includes(`"${origin}"`), `expects "${origin}" in: …${message.slice(-90)}`);
 }
-const LISTING_LIMITS = { displayName: 30, shortDescription: 30, longDescription: 4000, developerName: 80, category: 80 };
-const LISTING_URLS = ['websiteURL', 'supportURL', 'privacyPolicyURL', 'termsOfServiceURL'];
-const HINTS = ['readOnlyHint', 'destructiveHint', 'openWorldHint'];
-/**
- * A ChatGPT plugin package agrees with the server it names. The ZIP is uploaded
- * once and OpenAI rescans the server every day, so a renamed tool, a write that
- * reaches the plugin's endpoint, a description naming a tool the endpoint lacks,
- * or a moved legal page fails review with nothing in the repo noticing. Pass the
- * parsed `chatgpt/plugin.json` and `chatgpt/mcp.json`.
- *
- * URLs on the plugin's own origin are rebased onto the origin under test, so a
- * run against a dev server checks the dev server. The demo recording is the
- * one review field no code can hold, so it is not checked.
- */
-export async function pluginParity(t, pkg) {
-    const openai = pkg.plugin.extensions?.['com.openai'] ?? {};
-    const listing = openai.interface ?? {};
-    const cases = openai.review?.test_cases ?? {};
-    const servers = Object.values(pkg.mcp.mcpServers ?? {});
-    const named = servers[0]?.url ?? '';
-    t.check('plugin names one server', servers.length === 1 && servers[0]?.type === 'streamable-http' && named.startsWith('https://'), `${servers.length} server(s): ${named || 'no url'}`);
-    if (!named.startsWith('https://'))
-        return;
-    const canonical = new URL(named).origin;
-    const here = (url) => {
-        const u = new URL(url);
-        return u.origin === canonical ? new URL(`${u.pathname}${u.search}`, t.base).href : url;
-    };
-    const endpoint = here(named);
-    const tools = (await t.rpcAt(endpoint, 'tools/list')).result?.tools ?? [];
-    const names = new Set(tools.map(x => x.name));
-    t.check('plugin endpoint answers', tools.length > 0, `${endpoint}: ${tools.length} tools`);
-    const triggered = [...new Set((cases.positive ?? []).flatMap(c => (c.tools_triggered ?? '').split(/[\s,]+/).filter(Boolean)))];
-    const absent = triggered.filter(n => !names.has(n));
-    t.check('review cases name live tools', triggered.length > 0 && absent.length === 0, absent.length ? `not on the endpoint: ${absent.join(', ')}` : `${triggered.join(', ')}`);
-    const vague = tools.filter(x => HINTS.some(k => typeof x.annotations?.[k] !== 'boolean'));
-    t.check('plugin hints are booleans', vague.length === 0, vague.length ? vague.map(x => x.name).join(', ') : `${HINTS.join(', ')} on ${tools.length} tools`);
-    const writes = tools.filter(x => x.annotations?.readOnlyHint === false).map(x => x.name);
-    const claimsWrite = Array.isArray(listing.capabilities) && listing.capabilities.includes('Write');
-    t.check('plugin capabilities', claimsWrite === writes.length > 0, `capabilities ${claimsWrite ? 'claim' : 'omit'} Write; ${writes.length ? `writes: ${writes.join(', ')}` : 'no write tools'}`);
-    // A tool the main endpoint has and the plugin's lacks, named anywhere the
-    // model reads on the plugin's endpoint, sends it to a call that cannot work.
-    const lost = ((await t.rpc('tools/list')).result?.tools ?? []).map(x => x.name).filter(n => !names.has(n));
-    const init = await t.rpcAt(endpoint, 'initialize', {
-        protocolVersion: MCP_LEGACY_PROTOCOL_VERSION,
-        capabilities: {},
-        clientInfo: { name: 'plugin-parity', version: '1' },
-    });
-    const prompts = (await t.rpcAt(endpoint, 'prompts/list')).result?.prompts ?? [];
-    const texts = [
-        ['instructions', init.result?.instructions ?? ''],
-        ...tools.map((x) => [`${x.name} description`, x.description ?? '']),
-    ];
-    for (const p of prompts) {
-        const got = (await t.rpcAt(endpoint, 'prompts/get', { name: p.name })).result;
-        texts.push([`prompt ${p.name}`, (got?.messages ?? []).map(m => m.content?.text ?? '').join('\n')]);
-    }
-    const strays = texts.flatMap(([where, text]) => lost.filter(n => new RegExp(`\\b${n}\\b`).test(text)).map(n => `${where} names ${n}`));
-    t.check('plugin text names only its tools', strays.length === 0, strays.length ? strays.join('; ') : `${texts.length} texts, ${lost.length} tools withheld`);
-    const str = (k) => (typeof listing[k] === 'string' ? listing[k] : '');
-    const starters = Array.isArray(listing.defaultPrompt) ? listing.defaultPrompt : [];
-    const positive = cases.positive ?? [];
-    const faults = [
-        ...Object.entries(LISTING_LIMITS).filter(([k, n]) => !str(k) || str(k).length > n).map(([k, n]) => `${k} ${str(k).length}/${n}`),
-        ...(starters.length > 3 || starters.some(p => typeof p !== 'string' || p.length > 128) ? ['defaultPrompt: at most 3, 128 each'] : []),
-        ...(typeof listing.logo === 'string' ? [] : ['no logo']),
-        ...(positive.length === 5 && positive.every(c => c.description && c.prompt && c.tools_triggered && c.expected_behavior)
-            ? []
-            : ['5 positive cases, each with description, prompt, tools_triggered and expected_behavior']),
-        ...((cases.negative ?? []).length === 3 && (cases.negative ?? []).every(c => c.description && c.prompt) ? [] : ['3 negative cases']),
-    ];
-    t.check('plugin listing', faults.length === 0, faults.length ? faults.join('; ') : `${str('displayName')}: ${str('shortDescription')}`);
-    for (const k of LISTING_URLS) {
-        const url = str(k);
-        if (!url.startsWith('https://')) {
-            t.check(`listing ${k}`, false, url ? `not https: ${url}` : 'missing');
-            continue;
-        }
-        if (new URL(url).origin !== canonical) {
-            t.check(`listing ${k}`, true, `${url} (another origin, not fetched)`);
-            continue;
-        }
-        const res = await fetch(here(url));
-        const anchor = decodeURIComponent(new URL(url).hash.slice(1));
-        const found = !anchor || (await res.text()).includes(`id="${anchor}"`);
-        t.check(`listing ${k}`, res.ok && found, `${res.status} ${url}${found ? '' : ` (no id="${anchor}")`}`);
-    }
-}

package/dist/mcp.d.ts

@@ -240,18 +240,6 @@ export interface EnvelopeGate {
     empty: boolean;
     finish(dispatched: object | object[] | null): Promise<object | object[] | null>;
 }
-/**
- * The same server with its writes taken off, for a client that may not carry
- * them: ChatGPT's plugin review refuses crypto transfers and checkout links, and
- * a reviewer cannot sign a ROLA challenge. It keeps the tools marked
- * `readOnlyHint: true` and not in `hide`, then drops every instruction line and
- * prompt that names a tool it lost, so nothing sends an agent to a tool that is
- * not there.
- *
- * The kept tools state all three hints that review reads. A read-only tool
- * destroys nothing, and an unstated `openWorldHint` is the spec's default, true.
- */
-export declare function readOnly(config: McpServerConfig, hide?: readonly string[]): McpServerConfig;
 /**
  * A caller-fixable failure inside a handler (page not found, empty input).
  * Reported as a tool result with `isError` so the model sees the text and can

package/dist/mcp.js

@@ -86,28 +86,6 @@ export function toolCard(tool) {
         ...(tool.annotations ? { annotations: tool.annotations } : {}),
     };
 }
-/**
- * The same server with its writes taken off, for a client that may not carry
- * them: ChatGPT's plugin review refuses crypto transfers and checkout links, and
- * a reviewer cannot sign a ROLA challenge. It keeps the tools marked
- * `readOnlyHint: true` and not in `hide`, then drops every instruction line and
- * prompt that names a tool it lost, so nothing sends an agent to a tool that is
- * not there.
- *
- * The kept tools state all three hints that review reads. A read-only tool
- * destroys nothing, and an unstated `openWorldHint` is the spec's default, true.
- */
-export function readOnly(config, hide = []) {
-    const kept = config.tools.filter(t => t.annotations?.readOnlyHint === true && !hide.includes(t.name));
-    const lost = config.tools.filter(t => !kept.includes(t)).map(t => t.name);
-    const names = (text) => lost.some(name => new RegExp(`\\b${name}\\b`).test(text));
-    return {
-        ...config,
-        instructions: config.instructions.split('\n').filter(line => !names(line)).join('\n'),
-        tools: kept.map(t => ({ ...t, annotations: { destructiveHint: false, openWorldHint: true, ...t.annotations } })),
-        prompts: config.prompts?.filter(p => !names(p.text)),
-    };
-}
 /**
  * A caller-fixable failure inside a handler (page not found, empty input).
  * Reported as a tool result with `isError` so the model sees the text and can

package/dist/react-server.d.ts

@@ -195,6 +195,58 @@ export declare function Breadcrumbs({ items, base, className, link: Link, lastAs
 export declare function BreadcrumbsRow({ actions, className, ...props }: BreadcrumbsProps & {
     actions?: ReactNode;
 }): import("react").JSX.Element;
+export interface PagerProps {
+    /** The page showing, from 1. */
+    page: number;
+    total: number;
+    /** Each page's address: the steps are links and the pager ships no JavaScript. */
+    href?: (page: number) => string;
+    /** Or what a step does: the steps are buttons. A carousel passes `go`. */
+    onPage?: (page: number) => void;
+    /** Step round from either end, as a carousel does, instead of stopping. */
+    wrap?: boolean;
+    /** Both steps inert, as while the next page loads. */
+    disabled?: boolean;
+    /** What one page is: the middle reads "<noun> 2 of 9", the steps "Previous <noun>". */
+    noun?: string;
+    prev?: ReactNode;
+    next?: ReactNode;
+    /** The steps at the ends of the line rather than beside the count. */
+    spread?: boolean;
+    /** The landmark's name, when the page has more than one pager. */
+    label?: string;
+    link?: WikiLinkComponent;
+    className?: string;
+}
+/**
+ * "← Previous · Page 2 of 9 · Next →", for search results and for a carousel.
+ *
+ * Three sites wrote this line by hand, two of them for paged results (one with
+ * links, one with buttons) and one for a snap row of points, and each stopped
+ * at the ends differently: a disabled button, an empty span, a wrap. Here a
+ * step at an end with nowhere to go stays in place, inert, so the count does
+ * not jump sideways on the first and last page.
+ */
+export declare function Pager({ page, total, href, onPage, wrap, disabled, noun, prev, next, spread, label, link: Link, className, }: PagerProps): import("react").JSX.Element | null;
+export interface SnapDotsProps {
+    count: number;
+    /** The item showing, from 0: `useSnapRow`'s `at`. */
+    at: number;
+    /** `useSnapRow`'s `go`: each dot becomes a button. Omit it for dots that only count. */
+    onGo?: (i: number) => void;
+    /** What one item is, for each button's name: "Go to <noun> 3". */
+    noun?: string;
+    className?: string;
+}
+/**
+ * A snap row's dots, one per item, the one in view marked.
+ *
+ * With `onGo` each is a button, named, its 0.5rem mark in a 1.5rem target; on a
+ * card whose whole face is already a link it is only a count, `aria-hidden`.
+ * The mark is the `<i>` either way, so one rule draws both, and `data-on`
+ * marks the current one in both.
+ */
+export declare function SnapDots({ count, at, onGo, noun, className }: SnapDotsProps): import("react").JSX.Element | null;
 export interface InfoboxAsideProps {
     /** The landmark's accessible name, e.g. `Key facts about ${title}`. */
     label: string;

package/dist/react-server.js

@@ -148,6 +148,49 @@ export function Breadcrumbs({ items, base, className = '', link: Link = Anchor,
 export function BreadcrumbsRow({ actions, className = '', ...props }) {
     return (_jsxs("div", { className: `breadcrumbs-row ${actions ? 'spread' : ''} ${className}`.trim(), children: [_jsx(Breadcrumbs, { ...props }), actions] }));
 }
+const Arrow = ({ children }) => _jsx("span", { "aria-hidden": "true", children: children });
+/**
+ * "← Previous · Page 2 of 9 · Next →", for search results and for a carousel.
+ *
+ * Three sites wrote this line by hand, two of them for paged results (one with
+ * links, one with buttons) and one for a snap row of points, and each stopped
+ * at the ends differently: a disabled button, an empty span, a wrap. Here a
+ * step at an end with nowhere to go stays in place, inert, so the count does
+ * not jump sideways on the first and last page.
+ */
+export function Pager({ page, total, href, onPage, wrap = false, disabled = false, noun = 'Page', prev = _jsxs(_Fragment, { children: [_jsx(Arrow, { children: "\u2190" }), " Previous"] }), next = _jsxs(_Fragment, { children: ["Next ", _jsx(Arrow, { children: "\u2192" })] }), spread = false, label = `${noun}s`, link: Link = Anchor, className = '', }) {
+    if (total < 2)
+        return null;
+    const to = (dir) => {
+        const p = page + dir;
+        return p >= 1 && p <= total ? p : wrap ? (p < 1 ? total : 1) : null;
+    };
+    const name = noun.toLowerCase();
+    const step = (dir, content) => {
+        const p = disabled ? null : to(dir);
+        const aria = `${dir < 0 ? 'Previous' : 'Next'} ${name}`;
+        if (onPage) {
+            return (_jsx("button", { type: "button", className: "pager-step", "aria-label": aria, disabled: p === null, onClick: () => p !== null && onPage(p), children: content }));
+        }
+        return p !== null && href ? (_jsx(Link, { href: href(p), className: "pager-step", rel: dir < 0 ? 'prev' : 'next', children: content })) : (_jsx("span", { className: "pager-step", "aria-disabled": "true", children: content }));
+    };
+    return (_jsxs("nav", { "aria-label": label, className: `pager ${className}`.trim(), "data-spread": spread || undefined, children: [step(-1, prev), _jsxs("span", { className: "pager-count", "aria-live": onPage ? 'polite' : undefined, children: [noun, " ", page, " of ", total] }), step(1, next)] }));
+}
+/**
+ * A snap row's dots, one per item, the one in view marked.
+ *
+ * With `onGo` each is a button, named, its 0.5rem mark in a 1.5rem target; on a
+ * card whose whole face is already a link it is only a count, `aria-hidden`.
+ * The mark is the `<i>` either way, so one rule draws both, and `data-on`
+ * marks the current one in both.
+ */
+export function SnapDots({ count, at, onGo, noun = 'item', className = '' }) {
+    if (count < 2)
+        return null;
+    const cls = `snap-dots ${className}`.trim();
+    const dots = Array.from({ length: count }, (_, i) => i);
+    return onGo ? (_jsx("span", { className: cls, children: dots.map(i => (_jsx("button", { type: "button", "aria-label": `Go to ${noun} ${i + 1}`, "aria-current": i === at || undefined, "data-on": i === at || undefined, onClick: () => onGo(i), children: _jsx("i", {}) }, i))) })) : (_jsx("span", { className: cls, "aria-hidden": "true", children: dots.map(i => _jsx("i", { "data-on": i === at || undefined }, i)) }));
+}
 /**
  * The facts panel beside an article. Named, because two of the three asides
  * this replaced had no accessible name, and a complementary landmark without

package/dist/validation.d.ts

@@ -38,8 +38,9 @@ export interface CoreAtomicValidatorOptions {
  * core, so the repo's own cases still decide its native types.
  *
  * `recentPages.limit` must be a whole number within the cap and `pageIds` no
- * longer than it — caper's rule, which the other two lacked. A scope field
- * (`tagPath`, `section`) is a string when present.
+ * longer than it — caper's rule, which the other two lacked — and a `list`'s
+ * `count` and `pages` the same. A scope field (`tagPath`, `section`, `under`)
+ * is a string when present, and `pageId` checks a list's picked keys too.
  */
 export declare function coreAtomicValidator(opts?: CoreAtomicValidatorOptions): (block: Record<string, unknown>) => boolean;
 export interface BlockValidatorOptions {

package/dist/validation.js

@@ -8,6 +8,7 @@
 //
 // As elsewhere in this package, the dispatch stays with the caller so a new
 // block type is a compile error there until it is handled.
+import { LIST_SOURCES } from './blocks.js';
 /**
  * An href acceptable to persist: http, https, mailto, or a relative path or
  * fragment. Everything else — `javascript:`, `data:`, `vbscript:`, a
@@ -93,8 +94,9 @@ const optionalString = (v) => v === undefined || typeof v === 'string';
  * core, so the repo's own cases still decide its native types.
  *
  * `recentPages.limit` must be a whole number within the cap and `pageIds` no
- * longer than it — caper's rule, which the other two lacked. A scope field
- * (`tagPath`, `section`) is a string when present.
+ * longer than it — caper's rule, which the other two lacked — and a `list`'s
+ * `count` and `pages` the same. A scope field (`tagPath`, `section`, `under`)
+ * is a string when present, and `pageId` checks a list's picked keys too.
  */
 export function coreAtomicValidator(opts = {}) {
     const { pageId = () => true, maxRows = MAX_BLOCK_ROWS } = opts;
@@ -108,6 +110,13 @@ export function coreAtomicValidator(opts = {}) {
                 return (Array.isArray(b.pageIds) &&
                     b.pageIds.length <= maxRows &&
                     b.pageIds.every(id => typeof id === 'string' && pageId(id)));
+            case 'list':
+                return (LIST_SOURCES.includes(b.source) &&
+                    (b.show === 'links' || b.show === 'cards') &&
+                    optionalString(b.under) &&
+                    (b.count === undefined || okLimit(b.count, maxRows)) &&
+                    (b.pages === undefined ||
+                        (Array.isArray(b.pages) && b.pages.length <= maxRows && b.pages.every(id => typeof id === 'string' && pageId(id)))));
             case 'codeTabs':
                 return validateCodeTabs(b.tabs);
             case 'stats':

package/dist/well-known.d.ts

@@ -104,13 +104,6 @@ protocolVersions: readonly string[]): Record<string, unknown>;
  * configured" instead of failing verification for a reason nobody sees.
  */
 export declare function registryAuthHandler(publicKey?: string | undefined, keyType?: string | undefined): () => Response;
-/**
- * `/.well-known/openai-apps-challenge`: the token OpenAI's plugin portal issues
- * to prove the MCP origin is the publisher's, served as the bare text it checks
- * for. An env var for the same reason as the registry key: the portal issues it
- * per plugin, after the code has shipped. Unset → 404.
- */
-export declare function openaiChallengeHandler(token?: string | undefined): () => Response;
 /** A tool as `/.well-known/mcp.json` lists it: what tools/list says, no handler. */
 export interface ManifestTool {
     name: string;

package/dist/well-known.js

@@ -178,17 +178,6 @@ export function registryAuthHandler(publicKey = process.env.MCP_REGISTRY_PUBLIC_
         });
     };
 }
-/**
- * `/.well-known/openai-apps-challenge`: the token OpenAI's plugin portal issues
- * to prove the MCP origin is the publisher's, served as the bare text it checks
- * for. An env var for the same reason as the registry key: the portal issues it
- * per plugin, after the code has shipped. Unset → 404.
- */
-export function openaiChallengeHandler(token = process.env.OPENAI_APPS_CHALLENGE) {
-    return () => token
-        ? new Response(token.trim(), { headers: { 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'no-store' } })
-        : new Response('Not found', { status: 404 });
-}
 /**
  * `/.well-known/mcp.json`: the third path an arriving agent probes, after the
  * agent card and the OpenAPI spec. All three origins wrote the same envelope,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wiki-formant",
-  "version": "0.73.0",
+  "version": "0.76.0",
   "description": "The portable half of a wiki: derived taxonomy and facet controls, a version-negotiating MCP transport, markdown twins, block rendering, a rich-text editor engine, conditional-GET plumbing, and the headers and CSP every origin sends.",
   "type": "module",
   "license": "MIT",