wiki-formant 0.9.4 → 0.10.0

package/dist/rola.d.ts

@@ -0,0 +1,128 @@
+export interface AuthSession {
+    userId: string;
+    radixAddress: string;
+    personaAddress?: string;
+    displayName?: string;
+    expiresAt: Date;
+}
+export interface SignedChallenge {
+    challenge: string;
+    address: string;
+    proof: {
+        publicKey: string;
+        signature: string;
+        curve: 'curve25519' | 'secp256k1';
+    };
+}
+/**
+ * The two Prisma delegates this needs, structurally. Both wikis' `Session` and
+ * `Challenge` models already satisfy it, so the binding is
+ * `{ session: prisma.session, challenge: prisma.challenge }`.
+ */
+export interface RolaStore {
+    session: {
+        create(args: {
+            data: {
+                userId: string;
+                token: string;
+                expiresAt: Date;
+            };
+        }): Promise<unknown>;
+        findUnique(args: {
+            where: {
+                token: string;
+            };
+        }): Promise<{
+            id: string;
+            expiresAt: Date;
+        } | null>;
+        delete(args: {
+            where: {
+                id: string;
+            };
+        }): Promise<unknown>;
+        deleteMany(args: {
+            where: {
+                token: string;
+            };
+        }): Promise<unknown>;
+    };
+    challenge: {
+        create(args: {
+            data: {
+                challenge: string;
+                expiresAt: Date;
+            };
+        }): Promise<unknown>;
+        findUnique(args: {
+            where: {
+                challenge: string;
+            };
+        }): Promise<{
+            id: string;
+            expiresAt: Date;
+        } | null>;
+        delete(args: {
+            where: {
+                id: string;
+            };
+        }): Promise<unknown>;
+    };
+}
+/** What `await cookies()` already gives you, narrowed to what this uses. */
+export interface CookieJar {
+    get(name: string): {
+        value: string;
+    } | undefined;
+    set(name: string, value: string, options: {
+        httpOnly: boolean;
+        secure: boolean;
+        sameSite: 'lax';
+        expires: Date;
+        path: string;
+    }): void;
+    delete(name: string): void;
+}
+export interface RolaAuthConfig {
+    /** This wiki's session cookie. The one thing the two copies actually differed in. */
+    cookieName: string;
+    jwtSecret: Uint8Array;
+    store: RolaStore;
+    cookies: () => Promise<CookieJar>;
+    rola: {
+        expectedOrigin: string;
+        dAppDefinitionAddress: string;
+        networkId: number;
+        applicationName: string;
+    };
+    sessionDurationMs?: number;
+    challengeTtlSec?: number;
+    /** Defaults to `process.env.NODE_ENV === 'production'`. */
+    secureCookies?: boolean;
+}
+/**
+ * A wallet address tells you which proof type it is, and getting it wrong is a
+ * silent rejection: the ROLA library verifies an `identity_*` proof only under
+ * `type: 'persona'`. One of the two copies this replaces hardcoded `'account'`
+ * and so could never accept a persona login at all.
+ */
+export declare function proofType(address: string): 'account' | 'persona' | null;
+export interface RolaAuth {
+    createSession(userId: string, radixAddress: string, personaAddress?: string, displayName?: string): Promise<string>;
+    getSession(request?: {
+        headers: {
+            get(name: string): string | null;
+        };
+    }): Promise<AuthSession | null>;
+    destroySession(): Promise<void>;
+    generateChallenge(): Promise<{
+        challenge: string;
+        expiresAt: Date;
+    }>;
+    verifySignedChallenge(signed: SignedChallenge): Promise<{
+        isValid: boolean;
+        error?: string;
+    }>;
+}
+export declare function createRolaAuth(config: RolaAuthConfig): RolaAuth;
+//# sourceMappingURL=rola.d.ts.map

package/dist/rola.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rola.d.ts","sourceRoot":"","sources":["../src/rola.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,YAAY,GAAG,WAAW,CAAC;KACnC,CAAC;CACH;AASD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE;QACP,MAAM,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE;gBAAE,MAAM,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,IAAI,CAAA;aAAE,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7F,UAAU,CAAC,IAAI,EAAE;YAAE,KAAK,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QAChG,MAAM,CAAC,IAAI,EAAE;YAAE,KAAK,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1D,UAAU,CAAC,IAAI,EAAE;YAAE,KAAK,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAClE,CAAC;IACF,SAAS,EAAE;QACT,MAAM,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE;gBAAE,SAAS,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,IAAI,CAAA;aAAE,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACjF,UAAU,CAAC,IAAI,EAAE;YAAE,KAAK,EAAE;gBAAE,SAAS,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QACpG,MAAM,CAAC,IAAI,EAAE;YAAE,KAAK,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC3D,CAAC;CACH;AAED,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACjD,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;QACxC,QAAQ,EAAE,OAAO,CAAC;QAClB,MAAM,EAAE,OAAO,CAAC;QAChB,QAAQ,EAAE,KAAK,CAAC;QAChB,OAAO,EAAE,IAAI,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,IAAI,CAAC;IACT,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,qFAAqF;IACrF,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,UAAU,CAAC;IACtB,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,EAAE;QACJ,cAAc,EAAE,MAAM,CAAC;QACvB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAQD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,CAIvE;AAED,MAAM,WAAW,QAAQ;IACvB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpH,UAAU,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE;YAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACrG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,iBAAiB,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACrE,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/F;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,QAAQ,CAkI/D"}

package/dist/rola.js

@@ -0,0 +1,150 @@
+// rola.ts — Radix On-Ledger Authentication: challenge, proof, session.
+//
+// Both Radix wikis had written this file, and the two copies were 94% identical
+// — the whole difference was a cookie name, plus the half radix-wiki had learned
+// since and miow had not: persona (identity_*) proofs, which miow rejected
+// because it passed `type: 'account'` unconditionally, and the error logging
+// that makes a failed verification diagnosable at all.
+//
+// This is radix-wiki's version, parameterised on the two things a second wiki
+// actually differs in: the cookie name and its dApp identity.
+//
+// Storage and cookies are ports rather than imports. A Prisma client is
+// generated per repo and cannot be shared, and taking `next/headers` here would
+// bind the package to a framework it otherwise knows nothing about. Both ports
+// are shaped so the caller passes what it already has — the delegate and the
+// cookie jar — with no adapter to write.
+//
+// `jose` and `@radixdlt/rola` are optional peers: only a repo importing this
+// subpath needs them installed.
+import { SignJWT, jwtVerify } from 'jose';
+import { Rola } from '@radixdlt/rola';
+const DEFAULT_SESSION_MS = 7 * 24 * 60 * 60 * 1000;
+const DEFAULT_CHALLENGE_TTL_SEC = 300;
+const bytesToHex = (bytes) => Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+/**
+ * A wallet address tells you which proof type it is, and getting it wrong is a
+ * silent rejection: the ROLA library verifies an `identity_*` proof only under
+ * `type: 'persona'`. One of the two copies this replaces hardcoded `'account'`
+ * and so could never accept a persona login at all.
+ */
+export function proofType(address) {
+    if (address.startsWith('account_'))
+        return 'account';
+    if (address.startsWith('identity_'))
+        return 'persona';
+    return null;
+}
+export function createRolaAuth(config) {
+    const { cookieName, jwtSecret, store, cookies, sessionDurationMs = DEFAULT_SESSION_MS, challengeTtlSec = DEFAULT_CHALLENGE_TTL_SEC, secureCookies = process.env.NODE_ENV === 'production', } = config;
+    const rola = Rola(config.rola);
+    async function verifyToken(token) {
+        try {
+            const { payload } = await jwtVerify(token, jwtSecret);
+            const session = await store.session.findUnique({ where: { token } });
+            if (!session || session.expiresAt < new Date()) {
+                if (session)
+                    await store.session.delete({ where: { id: session.id } }).catch(() => { });
+                return null;
+            }
+            return {
+                userId: payload.userId,
+                radixAddress: payload.radixAddress,
+                personaAddress: payload.personaAddress,
+                displayName: payload.displayName,
+                expiresAt: new Date(payload.exp * 1000),
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Consumes the challenge: a replayed one must not verify twice. */
+    async function validateChallenge(challenge) {
+        const stored = await store.challenge.findUnique({ where: { challenge } });
+        if (!stored || stored.expiresAt < new Date()) {
+            if (stored)
+                await store.challenge.delete({ where: { id: stored.id } });
+            return false;
+        }
+        await store.challenge.delete({ where: { id: stored.id } });
+        return true;
+    }
+    return {
+        async createSession(userId, radixAddress, personaAddress, displayName) {
+            const expiresAt = new Date(Date.now() + sessionDurationMs);
+            const token = await new SignJWT({ userId, radixAddress, personaAddress, displayName })
+                .setProtectedHeader({ alg: 'HS256' })
+                .setIssuedAt()
+                .setExpirationTime(expiresAt)
+                .setJti(crypto.randomUUID())
+                .sign(jwtSecret);
+            await store.session.create({ data: { userId, token, expiresAt } });
+            const jar = await cookies();
+            jar.set(cookieName, token, {
+                httpOnly: true,
+                secure: secureCookies,
+                sameSite: 'lax',
+                expires: expiresAt,
+                path: '/',
+            });
+            return token;
+        },
+        async getSession(request) {
+            const jar = await cookies();
+            const cookieToken = jar.get(cookieName)?.value;
+            if (cookieToken) {
+                const session = await verifyToken(cookieToken);
+                if (session)
+                    return session;
+            }
+            // Agents authenticate per-request with a Bearer token rather than a
+            // cookie, so the header is a second, equal route in — not a fallback.
+            if (request) {
+                const authHeader = request.headers.get('Authorization');
+                const bearerToken = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null;
+                if (bearerToken)
+                    return verifyToken(bearerToken);
+            }
+            return null;
+        },
+        async destroySession() {
+            const jar = await cookies();
+            const token = jar.get(cookieName)?.value;
+            if (token)
+                await store.session.deleteMany({ where: { token } });
+            jar.delete(cookieName);
+        },
+        async generateChallenge() {
+            const array = new Uint8Array(32);
+            crypto.getRandomValues(array);
+            const challenge = bytesToHex(array);
+            const expiresAt = new Date(Date.now() + challengeTtlSec * 1000);
+            await store.challenge.create({ data: { challenge, expiresAt } });
+            return { challenge, expiresAt };
+        },
+        async verifySignedChallenge(signedChallenge) {
+            try {
+                if (!(await validateChallenge(signedChallenge.challenge))) {
+                    console.error('ROLA: challenge validation failed', signedChallenge.challenge.slice(0, 16) + '...');
+                    return { isValid: false, error: 'Invalid or expired challenge' };
+                }
+                const type = proofType(signedChallenge.address);
+                if (!type) {
+                    throw new Error(`ROLA: unrecognized address prefix (expected account_* or identity_*): ${signedChallenge.address}`);
+                }
+                const result = await rola.verifySignedChallenge({ ...signedChallenge, type });
+                if (result.isErr()) {
+                    console.error('ROLA: verification failed', result.error.reason, result.error);
+                    return { isValid: false, error: result.error.reason };
+                }
+                return { isValid: true };
+            }
+            catch (error) {
+                console.error('ROLA verification error:', error);
+                return { isValid: false, error: 'Verification failed' };
+            }
+        },
+    };
+}
+//# sourceMappingURL=rola.js.map

package/dist/rola.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rola.js","sourceRoot":"","sources":["../src/rola.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,2EAA2E;AAC3E,6EAA6E;AAC7E,uDAAuD;AACvD,EAAE;AACF,8EAA8E;AAC9E,8DAA8D;AAC9D,EAAE;AACF,wEAAwE;AACxE,gFAAgF;AAChF,+EAA+E;AAC/E,6EAA6E;AAC7E,yCAAyC;AACzC,EAAE;AACF,6EAA6E;AAC7E,gCAAgC;AAEhC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AA6EtC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnD,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC,MAAM,UAAU,GAAG,CAAC,KAAiB,EAAU,EAAE,CAC/C,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAUD,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,MAAM,EACJ,UAAU,EACV,SAAS,EACT,KAAK,EACL,OAAO,EACP,iBAAiB,GAAG,kBAAkB,EACtC,eAAe,GAAG,yBAAyB,EAC3C,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,GACtD,GAAG,MAAM,CAAC;IAEX,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAE/B,KAAK,UAAU,WAAW,CAAC,KAAa;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAiB,KAAK,EAAE,SAAS,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC/C,IAAI,OAAO;oBAAE,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACvF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAI,GAAG,IAAI,CAAC;aACzC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,KAAK,UAAU,iBAAiB,CAAC,SAAiB;QAChD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7C,IAAI,MAAM;gBAAE,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW;YACnE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;iBACnF,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;iBACpC,WAAW,EAAE;iBACb,iBAAiB,CAAC,SAAS,CAAC;iBAC5B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;iBAC3B,IAAI,CAAC,SAAS,CAAC,CAAC;YAEnB,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YAEnE,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE;gBACzB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,OAAO;YACtB,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;YAC/C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;gBAC/C,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;YAC9B,CAAC;YAED,oEAAoE;YACpE,sEAAsE;YACtE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBACxD,MAAM,WAAW,GAAG,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACnF,IAAI,WAAW;oBAAE,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC;YACnD,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,cAAc;YAClB,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;YACzC,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAChE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,iBAAiB;YACrB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;YACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,IAAI,CAAC,CAAC;YAEhE,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACjE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,eAAe;YACzC,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;oBAC1D,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;oBACnG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;gBACnE,CAAC;gBAED,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBAChD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CAAC,yEAAyE,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBACtH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;gBAE9E,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;oBACnB,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxD,CAAC;gBAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;gBACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YAC1D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wiki-formant",
-  "version": "0.9.4",
+  "version": "0.10.0",
   "description": "The portable half of a wiki: derived taxonomy with pressable facet controls, a spec-correct MCP transport, markdown twins, block rendering, link normalisation, freshness, rate limiting, a collapsible sidebar, typeahead and hover-preview hooks, editor nodes, server-side analytics for both the agent and human lanes, and the conditional-GET plumbing agent surfaces need.",
   "type": "module",
   "license": "MIT",
@@ -135,6 +135,10 @@
     "./tiptap": {
       "types": "./dist/tiptap.d.ts",
       "import": "./dist/tiptap.js"
+    },
+    "./rola": {
+      "types": "./dist/rola.d.ts",
+      "import": "./dist/rola.js"
     }
   },
   "files": [
@@ -149,6 +153,7 @@
     "prepublishOnly": "npm run build && node --test 'test/*.test.js'"
   },
   "devDependencies": {
+    "@radixdlt/rola": "^2.1.0",
     "@tiptap/core": "^2.10.0",
     "@tiptap/extension-code-block": "^2.10.0",
     "@tiptap/extension-youtube": "^2.10.0",
@@ -156,15 +161,18 @@
     "@tiptap/react": "^2.10.0",
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
+    "jose": "^6.2.10",
     "react": "^19.2.4",
     "typescript": "^5.9.0"
   },
   "peerDependencies": {
-    "react": ">=18",
     "@tiptap/core": ">=2.10",
-    "@tiptap/react": ">=2.10",
+    "@tiptap/extension-code-block": ">=2.10",
     "@tiptap/extension-youtube": ">=2.10",
-    "@tiptap/extension-code-block": ">=2.10"
+    "@tiptap/react": ">=2.10",
+    "react": ">=18",
+    "jose": ">=5",
+    "@radixdlt/rola": ">=2"
   },
   "peerDependenciesMeta": {
     "react": {
@@ -181,6 +189,12 @@
     },
     "@tiptap/extension-code-block": {
       "optional": true
+    },
+    "jose": {
+      "optional": true
+    },
+    "@radixdlt/rola": {
+      "optional": true
     }
   }
 }