@docsworth/cli 0.0.0-stage → 0.2.0

package/dist/core/sla.d.ts

@@ -0,0 +1,16 @@
+export type SlaState = "fresh" | "due_soon" | "overdue" | "unverified";
+export interface Sla {
+    state: SlaState;
+    /** YYYY-MM-DD, or null when the page has no valid verification date/period. */
+    due: string | null;
+    /** Negative once overdue. */
+    days_until_due: number | null;
+}
+/**
+ * Review-SLA state of a page, evaluated in a fixed order so states never overlap:
+ * invalid input → unverified; past the due day → overdue; within the warning window →
+ * due_soon; otherwise fresh. The due day itself is still within SLA.
+ */
+export declare function computeSla(lastVerified: unknown, reviewEvery: unknown, now: Date, dueSoonDays: number): Sla;
+/** Within SLA = may be cited (together with status: canonical, see gate.ts). */
+export declare function withinSla(state: SlaState): boolean;

package/dist/core/sla.js

@@ -0,0 +1,20 @@
+import { addDuration, daysBetween, formatDate, parseDate, parseDuration, utcToday } from "./duration.js";
+/**
+ * Review-SLA state of a page, evaluated in a fixed order so states never overlap:
+ * invalid input → unverified; past the due day → overdue; within the warning window →
+ * due_soon; otherwise fresh. The due day itself is still within SLA.
+ */
+export function computeSla(lastVerified, reviewEvery, now, dueSoonDays) {
+    const verified = parseDate(lastVerified);
+    const period = parseDuration(reviewEvery);
+    if (!verified || !period)
+        return { state: "unverified", due: null, days_until_due: null };
+    const due = addDuration(verified, period);
+    const daysLeft = daysBetween(utcToday(now), due);
+    const state = daysLeft < 0 ? "overdue" : daysLeft <= dueSoonDays ? "due_soon" : "fresh";
+    return { state, due: formatDate(due), days_until_due: daysLeft };
+}
+/** Within SLA = may be cited (together with status: canonical, see gate.ts). */
+export function withinSla(state) {
+    return state === "fresh" || state === "due_soon";
+}

package/dist/core/stale.d.ts

@@ -0,0 +1,16 @@
+import type { Page, Repo } from "./repo.js";
+export interface StaleEntry {
+    id: string;
+    title: string;
+    path: string;
+    owner_team: string;
+    status: Page["status"];
+    reason: "overdue" | "unverified" | "unowned";
+    due: string | null;
+    detail: string;
+}
+/**
+ * Pages past their SLA or without a resolvable team owner (§4.2 `stale`). Deprecated
+ * pages are retired and never reported. Callers pass an ACL-filtered page list.
+ */
+export declare function listStale(pages: Page[], repo: Repo, now: Date, ownerTeam?: string): StaleEntry[];

package/dist/core/stale.js

@@ -0,0 +1,23 @@
+import { pageStatus } from "./gate.js";
+/**
+ * Pages past their SLA or without a resolvable team owner (§4.2 `stale`). Deprecated
+ * pages are retired and never reported. Callers pass an ACL-filtered page list.
+ */
+export function listStale(pages, repo, now, ownerTeam) {
+    const out = [];
+    for (const page of pages) {
+        if (page.status === "deprecated")
+            continue;
+        if (ownerTeam && page.owner_team !== ownerTeam)
+            continue;
+        const s = pageStatus(page, repo, now);
+        const base = { id: page.id, title: page.title, path: page.path, owner_team: page.owner_team, status: page.status, due: s.sla.due };
+        if (!s.owned)
+            out.push({ ...base, reason: "unowned", detail: s.ownership_problem ?? "unowned" });
+        else if (s.sla.state === "overdue")
+            out.push({ ...base, reason: "overdue", detail: `due ${s.sla.due}, ${-(s.sla.days_until_due ?? 0)} days ago` });
+        else if (s.sla.state === "unverified")
+            out.push({ ...base, reason: "unverified", detail: "no valid last_verified" });
+    }
+    return out.sort((a, b) => (a.due ?? "").localeCompare(b.due ?? ""));
+}

package/dist/core/tool-registry.d.ts

@@ -0,0 +1,31 @@
+import type { AuditEvent } from "./audit-log.js";
+import { POLICY_TOOLS } from "./config.js";
+/** A name `policy.tools` in .knowledge/config.yaml can key on. */
+export type PolicyName = (typeof POLICY_TOOLS)[number];
+type Structured = Record<string, any>;
+type Returned = Pick<AuditEvent, "returned" | "excluded" | "pr_url">;
+export interface ToolSpec {
+    readonly name: string;
+    /** `all`: every server (stdio and HTTP). `http`: only `docsworth serve` sessions. */
+    readonly surface: "all" | "http";
+    /** Has side effects: its intent is audited before it runs, and `policy.writes` turns it off. */
+    readonly write: boolean;
+    /** The `policy.tools` entry this tool answers to. */
+    readonly policy: PolicyName;
+    /** Arguments the audit log may record, each checked against FIELD_CHECKS. */
+    readonly auditFields: readonly string[];
+    /** Page ids and PR links in a successful response (the service already filtered it by ACL). */
+    returned(sc: Structured): Returned;
+}
+/**
+ * The shape each recordable argument must have to be recorded as given. A value that
+ * fails its check is recorded as "<invalid>", so a malformed call can't smuggle text into
+ * the log through, say, `path`.
+ */
+export declare const FIELD_CHECKS: Readonly<Record<string, (v: unknown) => boolean>>;
+export declare const TOOLS: readonly ToolSpec[];
+/** The tool called `name`, or undefined for any name that isn't one. */
+export declare function toolSpec(name: string): ToolSpec | undefined;
+/** Names of the tools with side effects. */
+export declare const WRITE_TOOLS: ReadonlySet<string>;
+export {};

package/dist/core/tool-registry.js

@@ -0,0 +1,77 @@
+import { PAGE_TYPES } from "./schema.js";
+const SLUGISH = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+/**
+ * The shape each recordable argument must have to be recorded as given. A value that
+ * fails its check is recorded as "<invalid>", so a malformed call can't smuggle text into
+ * the log through, say, `path`.
+ */
+export const FIELD_CHECKS = {
+    // A page id, or a mirrored page's (`mirror:<source>:<space>:<native id>`, v0.2 L2).
+    id: (v) => typeof v === "string" && (/^[a-z0-9][a-z0-9-]{0,99}$/.test(v) || /^mirror:(?:confluence|notion):[A-Za-z0-9_.~-]{1,64}:[A-Za-z0-9_-]{1,64}$/.test(v)),
+    type: (v) => typeof v === "string" && PAGE_TYPES.includes(v),
+    owner_team: (v) => typeof v === "string" && SLUGISH.test(v),
+    applies_to: (v) => typeof v === "string" && /^[a-z0-9][a-z0-9:_./-]{0,99}$/i.test(v),
+    path: (v) => typeof v === "string" && /^[a-z0-9_./-]{0,200}$/i.test(v) && !v.includes(".."),
+    include_stale: (v) => typeof v === "boolean",
+    draft: (v) => typeof v === "boolean",
+    acl: (v) => typeof v === "string" && SLUGISH.test(v),
+    polish: (v) => typeof v === "boolean",
+    limit: (v) => typeof v === "number" && Number.isInteger(v) && v >= 0 && v <= 1000,
+};
+const ids = (xs) => (Array.isArray(xs) ? xs.map((x) => String(x?.id)) : []);
+const prUrl = (sc) => (typeof sc.pr_url === "string" ? { pr_url: sc.pr_url } : {});
+export const TOOLS = [
+    {
+        name: "search",
+        surface: "all",
+        write: false,
+        policy: "search",
+        auditFields: ["type", "owner_team", "applies_to", "include_stale", "limit"],
+        // Mirrored pages were shown too (as context), so they count as returned.
+        returned: (sc) => ({ returned: [...ids(sc.results), ...ids(sc.mirrored)], excluded: ids(sc.excluded) }),
+    },
+    { name: "read", surface: "all", write: false, policy: "read", auditFields: ["id"], returned: (sc) => ({ returned: [String(sc.id)] }) },
+    {
+        name: "list",
+        surface: "all",
+        write: false,
+        policy: "list",
+        auditFields: ["path", "type"],
+        returned: (sc) => ({ returned: [...(sc.index ? [String(sc.index.id)] : []), ...ids(sc.pages)] }),
+    },
+    { name: "stale", surface: "all", write: false, policy: "stale", auditFields: ["owner_team"], returned: (sc) => ({ returned: ids(sc.pages) }) },
+    { name: "propose_edit", surface: "all", write: true, policy: "propose_edit", auditFields: ["id", "draft", "polish"], returned: prUrl },
+    { name: "verify", surface: "all", write: true, policy: "verify", auditFields: ["id"], returned: prUrl },
+    // The new page's id is the server's (random), so the intent can't name it: it is
+    // recorded from the successful response only.
+    {
+        name: "draft_page",
+        surface: "all",
+        write: true,
+        policy: "draft_page",
+        auditFields: ["type", "owner_team", "acl", "draft"],
+        returned: (sc) => ({ ...(typeof sc.id === "string" ? { returned: [sc.id] } : {}), ...prUrl(sc) }),
+    },
+    // The web app's views, on `docsworth serve` sessions only. They show page lists, so they
+    // answer to `list`: a policy that refuses `list` refuses them too.
+    { name: "ui_capabilities", surface: "http", write: false, policy: "list", auditFields: [], returned: () => ({}) },
+    { name: "ui_overview", surface: "http", write: false, policy: "list", auditFields: [], returned: (sc) => ({ returned: [...ids(sc.due_soon), ...ids(sc.stale)] }) },
+    { name: "ui_graph", surface: "http", write: false, policy: "list", auditFields: ["owner_team"], returned: (sc) => ({ returned: ids(sc.nodes) }) },
+    // A page for the app: `read`'s view plus the ids of the visible pages it links to.
+    {
+        name: "ui_page",
+        surface: "http",
+        write: false,
+        policy: "read",
+        auditFields: ["id"],
+        returned: (sc) => ({ returned: [String(sc.id), ...Object.values((sc.links ?? {}))] }),
+    },
+];
+// A Map, not an object: a tool called `constructor` or `__proto__` must not look known.
+const BY_NAME = new Map(TOOLS.map((t) => [t.name, t]));
+/** The tool called `name`, or undefined for any name that isn't one. */
+export function toolSpec(name) {
+    return BY_NAME.get(name);
+}
+/** Names of the tools with side effects. */
+export const WRITE_TOOLS = new Set(TOOLS.filter((t) => t.write).map((t) => t.name));

package/dist/core/url.d.ts

@@ -0,0 +1,4 @@
+/** Why `raw` may not carry a credential, or null when it may. */
+export declare function insecureUrl(raw: string): string | null;
+/** A URL for an error message: scheme and host only, never a path, user or password. */
+export declare function urlForError(raw: string): string;

package/dist/core/url.js

@@ -0,0 +1,31 @@
+// Every URL Docsworth sends a credential to must be https, except on loopback (tests and
+// local fakes). Plain http would put a GitHub or Confluence token on the wire in clear.
+const LOOPBACK = new Set(["127.0.0.1", "localhost", "[::1]", "::1"]);
+/** Why `raw` may not carry a credential, or null when it may. */
+export function insecureUrl(raw) {
+    let u;
+    try {
+        u = new URL(raw);
+    }
+    catch {
+        return "is not a valid URL";
+    }
+    // A password in the URL would be echoed by every error and log that names it.
+    if (u.username || u.password)
+        return "must not carry a user name or password; give credentials through their own setting";
+    if (u.protocol === "https:")
+        return null;
+    if (u.protocol === "http:" && LOOPBACK.has(u.hostname.replace(/\.$/, "")))
+        return null;
+    return "must use https:// (plain http is allowed only on loopback), since the token is sent to it";
+}
+/** A URL for an error message: scheme and host only, never a path, user or password. */
+export function urlForError(raw) {
+    try {
+        const u = new URL(raw);
+        return `${u.protocol}//${u.host}`;
+    }
+    catch {
+        return "(not a URL)";
+    }
+}

package/dist/core/version.d.ts

@@ -0,0 +1,22 @@
+/** Format version of the knowledge repo contract in docs/format-spec.md. */
+export declare const FORMAT_VERSION = 1;
+export declare const PACKAGE_VERSION = "0.2.0";
+/**
+ * The npm package Docsworth is published as, with its version range: what `docsworth init
+ * --ci` writes into a workflow, and what the plugin launcher runs without DOCSWORTH_BIN.
+ * The `@docsworth` scope is ours on npm (the org `docsworth`). Another publisher owns
+ * `agent-kb` (and `akb`), our old names, and nobody owns the bare `docsworth`, so nothing
+ * may fetch any of those. PUBLISHED_PACKAGE in plugin/bin/docsworth-mcp.mjs is kept equal
+ * by a test, and scripts/release-guard.ts refuses a release outside its range.
+ */
+export declare const PUBLISHED_PACKAGE = "@docsworth/cli@^0.2";
+/** The one package we publish (release checklist, decision 1): a release of any other name is refused. */
+export declare const PACKAGE_NAME = "@docsworth/cli";
+/**
+ * Names on npm that aren't ours, never to fetch or publish: other publishers own `agent-kb`
+ * and `akb`, and nobody owns the bare `docsworth` (2026-11-07), so whoever publishes it first
+ * decides what it runs.
+ */
+export declare const UNOWNED_PACKAGES: string[];
+/** Whether a spec is a plain registry package with a range, and not a name we don't own. */
+export declare function ownedPackage(spec: string): boolean;

package/dist/core/version.js

@@ -0,0 +1,32 @@
+/** Format version of the knowledge repo contract in docs/format-spec.md. */
+export const FORMAT_VERSION = 1;
+export const PACKAGE_VERSION = "0.2.0";
+/**
+ * The npm package Docsworth is published as, with its version range: what `docsworth init
+ * --ci` writes into a workflow, and what the plugin launcher runs without DOCSWORTH_BIN.
+ * The `@docsworth` scope is ours on npm (the org `docsworth`). Another publisher owns
+ * `agent-kb` (and `akb`), our old names, and nobody owns the bare `docsworth`, so nothing
+ * may fetch any of those. PUBLISHED_PACKAGE in plugin/bin/docsworth-mcp.mjs is kept equal
+ * by a test, and scripts/release-guard.ts refuses a release outside its range.
+ */
+export const PUBLISHED_PACKAGE = "@docsworth/cli@^0.2";
+/** The one package we publish (release checklist, decision 1): a release of any other name is refused. */
+export const PACKAGE_NAME = "@docsworth/cli";
+/**
+ * Names on npm that aren't ours, never to fetch or publish: other publishers own `agent-kb`
+ * and `akb`, and nobody owns the bare `docsworth` (2026-11-07), so whoever publishes it first
+ * decides what it runs.
+ */
+export const UNOWNED_PACKAGES = ["agent-kb", "akb", "docsworth"];
+/**
+ * A registry package and a semver range, nothing else: `@scope/name@^0.2`, `name@1.2.3`.
+ * No aliases (`x@npm:agent-kb`), URLs, git or file specs, tags, or shell characters
+ * (`*` included: unquoted, a repo's filenames could glob-expand it),
+ * since this goes unquoted into a workflow that runs with a token that can push.
+ */
+const PACKAGE_SPEC = /^(@[a-z0-9][a-z0-9._-]*\/)?([a-z0-9][a-z0-9._-]*)@([\^~]?\d+(?:\.(?:\d+|x)){0,2}(?:-[0-9a-z.]+)?)$/;
+/** Whether a spec is a plain registry package with a range, and not a name we don't own. */
+export function ownedPackage(spec) {
+    const m = PACKAGE_SPEC.exec(spec);
+    return Boolean(m) && !UNOWNED_PACKAGES.includes(`${m[1] ?? ""}${m[2]}`);
+}

package/dist/core/writes.d.ts

@@ -0,0 +1,58 @@
+import { type GitHubClient } from "./github.js";
+export interface Edit {
+    old: string;
+    new: string;
+}
+export declare class WriteError extends Error {
+}
+/**
+ * Fields an agent may not change through propose_edit. last_verified goes through the
+ * owner-only `verify`; changing owner_team, id or acl through an agent PR would let a
+ * page change hands or widen its audience in a diff reviewers may skim.
+ */
+export declare const PROTECTED_FIELDS: readonly ["id", "owner_team", "acl", "last_verified"];
+/** Apply exact replacements in order; each `old` must occur exactly once. */
+export declare function applyEdits(text: string, edits: Edit[]): string;
+export declare function assertProtectedFieldsUnchanged(before: string, after: string): void;
+/**
+ * Replace everything after the frontmatter block, keeping the block byte for byte. `read`
+ * returns a page's body without its frontmatter, so an agent edits the body and the
+ * frontmatter (owner, ACL, review date) never passes through it.
+ */
+export declare function replaceBody(text: string, body: string): string;
+/** Set last_verified in the frontmatter block, leaving every other byte alone. */
+export declare function setLastVerified(text: string, date: string): string;
+export interface PrRequest {
+    repo: string;
+    baseBranch: string;
+    verb: "propose" | "verify" | "draft";
+    pageId: string;
+    path: string;
+    transform: (current: string) => string;
+    commitMessage: string;
+    title: string;
+    /** A function when the body depends on what the transform found. */
+    body: string | (() => string);
+    draft?: boolean;
+    /** Injected for tests; defaults to now. */
+    timestamp?: Date;
+    /** Create a new file (promote): refuse if it already exists, PUT without a sha. */
+    create?: boolean;
+}
+export interface PrResult {
+    number: number;
+    url: string;
+    branch: string;
+}
+/**
+ * A fresh branch for one proposal. The second-resolution timestamp alone collided when
+ * two agents proposed on the same page in the same second (GitHub: "Reference already
+ * exists"), so a random suffix follows it.
+ */
+export declare function branchName(verb: string, pageId: string, at: Date, nonce?: string): string;
+/**
+ * The only write path: read the file at the default branch, transform it, create a new
+ * branch, commit to that branch (explicitly), open a PR. Nothing ever targets the
+ * default branch; if a step after branch creation fails, the branch is removed.
+ */
+export declare function openPagePr(gh: GitHubClient, req: PrRequest): Promise<PrResult>;

package/dist/core/writes.js

@@ -0,0 +1,113 @@
+import { randomBytes } from "node:crypto";
+import { splitFrontmatter } from "./frontmatter.js";
+import { decodeContent, GitHubError } from "./github.js";
+export class WriteError extends Error {
+}
+/**
+ * Fields an agent may not change through propose_edit. last_verified goes through the
+ * owner-only `verify`; changing owner_team, id or acl through an agent PR would let a
+ * page change hands or widen its audience in a diff reviewers may skim.
+ */
+export const PROTECTED_FIELDS = ["id", "owner_team", "acl", "last_verified"];
+/** Apply exact replacements in order; each `old` must occur exactly once. */
+export function applyEdits(text, edits) {
+    if (edits.length === 0)
+        throw new WriteError("no edits given");
+    return edits.reduce((acc, e, i) => {
+        if (!e.old)
+            throw new WriteError(`edit ${i + 1}: \`old\` is empty`);
+        const first = acc.indexOf(e.old);
+        if (first === -1)
+            throw new WriteError(`edit ${i + 1}: \`old\` text not found in the current page`);
+        if (acc.indexOf(e.old, first + 1) !== -1)
+            throw new WriteError(`edit ${i + 1}: \`old\` text matches more than once; include more context`);
+        return acc.slice(0, first) + e.new + acc.slice(first + e.old.length);
+    }, text);
+}
+export function assertProtectedFieldsUnchanged(before, after) {
+    const a = splitFrontmatter(before).data ?? {};
+    const b = splitFrontmatter(after).data;
+    if (!b)
+        throw new WriteError("the edited page no longer has valid frontmatter");
+    for (const f of PROTECTED_FIELDS) {
+        if (JSON.stringify(a[f]) !== JSON.stringify(b[f])) {
+            const hint = f === "last_verified" ? "; owners bump it with the verify tool" : "";
+            throw new WriteError(`propose_edit may not change \`${f}\`${hint}`);
+        }
+    }
+}
+/**
+ * Replace everything after the frontmatter block, keeping the block byte for byte. `read`
+ * returns a page's body without its frontmatter, so an agent edits the body and the
+ * frontmatter (owner, ACL, review date) never passes through it.
+ */
+export function replaceBody(text, body) {
+    const m = /^---\r?\n[\s\S]*?\r?\n---[ \t]*(?:\r?\n|$)/.exec(text);
+    if (!m)
+        throw new WriteError("page has no frontmatter block");
+    // The body as given. Only a block that ends the file needs a line break before it.
+    return m[0] + (m[0].endsWith("\n") || body === "" ? "" : "\n") + body;
+}
+/** Set last_verified in the frontmatter block, leaving every other byte alone. */
+export function setLastVerified(text, date) {
+    const m = /^(---\r?\n)([\s\S]*?)(\r?\n---[ \t]*(?:\r?\n|$))/.exec(text);
+    if (!m)
+        throw new WriteError("page has no frontmatter block");
+    const fm = /^last_verified:.*$/m.test(m[2])
+        ? m[2].replace(/^last_verified:.*$/m, `last_verified: ${date}`)
+        : `${m[2]}\nlast_verified: ${date}`;
+    return m[1] + fm + m[3] + text.slice(m[0].length);
+}
+/**
+ * A fresh branch for one proposal. The second-resolution timestamp alone collided when
+ * two agents proposed on the same page in the same second (GitHub: "Reference already
+ * exists"), so a random suffix follows it.
+ */
+export function branchName(verb, pageId, at, nonce = randomBytes(3).toString("hex")) {
+    const ts = at.toISOString().replace(/[-:]/g, "").replace(/\..*$/, "");
+    return `docsworth/${verb}/${pageId}-${ts}-${nonce}`;
+}
+/**
+ * The only write path: read the file at the default branch, transform it, create a new
+ * branch, commit to that branch (explicitly), open a PR. Nothing ever targets the
+ * default branch; if a step after branch creation fails, the branch is removed.
+ */
+export async function openPagePr(gh, req) {
+    const branch = branchName(req.verb, req.pageId, req.timestamp ?? new Date());
+    if (branch === req.baseBranch || !branch.startsWith("docsworth/"))
+        throw new WriteError(`refusing to write to ${branch}`);
+    let file;
+    if (req.create) {
+        const exists = await gh.getFile(req.repo, req.path, req.baseBranch).then(() => true, (err) => (err instanceof GitHubError && err.status === 404 ? false : Promise.reject(err)));
+        if (exists)
+            throw new WriteError(`${req.path} already exists on ${req.baseBranch}`);
+        file = { sha: undefined, before: "" };
+    }
+    else {
+        const current = await gh.getFile(req.repo, req.path, req.baseBranch);
+        file = { sha: current.sha, before: decodeContent(current) };
+    }
+    const after = req.transform(file.before);
+    if (after === file.before)
+        throw new WriteError("the change is empty");
+    const baseSha = await gh.getBranchSha(req.repo, req.baseBranch);
+    await gh.createBranch(req.repo, branch, baseSha);
+    try {
+        await gh.putFile(req.repo, req.path, { message: req.commitMessage, content: after, sha: file.sha, branch });
+        const pr = await gh.createPull(req.repo, { title: req.title, head: branch, base: req.baseBranch, body: typeof req.body === "function" ? req.body() : req.body, draft: req.draft });
+        return { number: pr.number, url: pr.html_url, branch };
+    }
+    catch (err) {
+        // The PR may exist even though its response was lost (timeout, reset): never delete
+        // the head branch of a live PR. Only clean up when GitHub confirms there is none.
+        const existing = await gh.findPull(req.repo, branch, req.baseBranch).catch(() => undefined);
+        if (existing)
+            return { number: existing.number, url: existing.html_url, branch };
+        if (existing === undefined)
+            throw new WriteError(`${err.message}; branch ${branch} was kept because its PR state is unknown`);
+        const cleanup = await gh.deleteBranch(req.repo, branch).then(() => null, (e) => e);
+        if (cleanup)
+            throw new WriteError(`${err.message}; also failed to delete branch ${branch}: ${cleanup.message}`);
+        throw err;
+    }
+}

package/dist/web/assets/index-BglLMIyN.css

@@ -0,0 +1 @@
+:root,:host{--dw-bg:#fbfbfa;--dw-surface:#fff;--dw-fg:#1d1d1b;--dw-muted:#6b6b66;--dw-line:#e4e3de;--dw-track:#ecebe6;--dw-accent:#2b5fa8;--dw-good:#2f7d4f;--dw-warn:#b7791f;--dw-bad:#b4442c;--dw-code:#f2f1ed;--dw-radius:8px;--dw-font:15px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif;--dw-mono:13px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace;--lightningcss-light:initial;--lightningcss-dark: ;color-scheme:light}@media (prefers-color-scheme:dark){:root,:host{--dw-bg:#161615;--dw-surface:#1d1d1c;--dw-fg:#ecebe6;--dw-muted:#9a9993;--dw-line:#2c2c2a;--dw-track:#2a2a28;--dw-accent:#7aa7e8;--dw-good:#58b07c;--dw-warn:#d9a441;--dw-bad:#e0735a;--dw-code:#242422;--lightningcss-light: ;--lightningcss-dark:initial;color-scheme:dark}}*{box-sizing:border-box}.dw{background:var(--dw-bg);color:var(--dw-fg);font:var(--dw-font)}.dw a{color:var(--dw-accent);text-decoration:none}.dw a:hover{text-decoration:underline}.dw code{font:var(--dw-mono);background:var(--dw-code);border-radius:4px;padding:0 4px}.dw h1{margin:0 0 4px;font-size:24px;line-height:1.25}.dw h2{margin:28px 0 10px;font-size:17px}.dw-muted{color:var(--dw-muted)}.dw-num{font-variant-numeric:tabular-nums}.dw-header{border-bottom:1px solid var(--dw-line);background:var(--dw-surface);flex-wrap:wrap;align-items:center;gap:20px;padding:12px 20px;display:flex}.dw-brand{letter-spacing:-.01em;font-weight:650;color:var(--dw-fg)!important}.dw-nav{flex-wrap:wrap;gap:4px;display:flex}.dw-nav a{color:var(--dw-muted);border-radius:6px;padding:6px 10px}.dw-nav a[aria-current=page]{color:var(--dw-fg);background:var(--dw-track)}.dw-who{color:var(--dw-muted);align-items:center;gap:8px;margin-left:auto;font-size:13px;display:flex}.dw-main{max-width:1040px;margin:0 auto;padding:28px 20px 64px}.dw-sub{color:var(--dw-muted);margin:0 0 20px}.dw-tiles{grid-template-columns:repeat(auto-fit,minmax(160px,1fr));gap:12px;display:grid}.dw-tile{border:1px solid var(--dw-line);border-radius:var(--dw-radius);background:var(--dw-surface);padding:14px 16px}.dw-tile b{font-variant-numeric:tabular-nums;font-size:28px;display:block}.dw-tile span{color:var(--dw-muted);font-size:13px}.dw-table{border-collapse:collapse;width:100%}.dw-table th,.dw-table td{text-align:left;border-bottom:1px solid var(--dw-line);vertical-align:middle;padding:8px 6px}.dw-table thead th{text-transform:uppercase;letter-spacing:.04em;color:var(--dw-muted);font-size:12px;font-weight:600}.dw-scroll{overflow-x:auto}.dw-bar{background:var(--dw-track);border-radius:4px;max-width:240px;height:8px;margin-bottom:4px;overflow:hidden}.dw-bar>span{height:100%;display:block}.dw-good{background:var(--dw-good)}.dw-warn{background:var(--dw-warn)}.dw-bad{background:var(--dw-bad)}.dw-badge{border:1px solid var(--dw-line);color:var(--dw-muted);white-space:nowrap;border-radius:999px;padding:0 7px;font-size:12px;line-height:18px;display:inline-block}.dw-badge.ok{color:var(--dw-good);border-color:currentColor}.dw-badge.warn{color:var(--dw-warn);border-color:currentColor}.dw-badge.bad{color:var(--dw-bad);border-color:currentColor}.dw-meta{color:var(--dw-muted);flex-wrap:wrap;align-items:center;gap:8px;font-size:13px;display:flex}.dw-search{gap:8px;margin-bottom:20px;display:flex}.dw-search input{flex:1}.dw-results{gap:10px;margin:0;padding:0;list-style:none;display:grid}.dw-result{border:1px solid var(--dw-line);border-radius:var(--dw-radius);background:var(--dw-surface);padding:12px 14px}.dw-result h3{margin:0 0 4px;font-size:16px}.dw-result p{color:var(--dw-muted);margin:6px 0 0;font-size:14px}.dw-excluded{border-left:3px solid var(--dw-warn);background:var(--dw-surface);margin:6px 0;padding:8px 12px}.dw-page{max-width:760px}.dw-prose{line-height:1.65}.dw-prose pre{font:var(--dw-mono);background:var(--dw-code);border-radius:var(--dw-radius);padding:12px 14px;overflow-x:auto}.dw-prose pre code{background:0 0;padding:0}.dw-prose h1{margin-top:24px;font-size:22px}.dw-prose h2{margin-top:24px}.dw-note{border:1px solid var(--dw-line);border-left:3px solid var(--dw-warn);background:var(--dw-surface);border-radius:6px;margin:12px 0;padding:10px 12px;font-size:14px}.dw-error{border-left-color:var(--dw-bad)}.dw input,.dw select,.dw textarea,.dw button{font:inherit;color:inherit}.dw input,.dw select,.dw textarea{background:var(--dw-surface);border:1px solid var(--dw-line);border-radius:6px;width:100%;padding:8px 10px}.dw textarea{font:var(--dw-mono);resize:vertical;min-height:220px}.dw button{background:var(--dw-fg);color:var(--dw-bg);cursor:pointer;border:0;border-radius:6px;padding:8px 14px;font-weight:550}.dw button.secondary{color:var(--dw-fg);border:1px solid var(--dw-line);background:0 0}.dw button:disabled{opacity:.45;cursor:not-allowed}.dw-form{gap:14px;max-width:760px;display:grid}.dw-form label{gap:6px;font-size:14px;font-weight:550;display:grid}.dw-form .dw-row{grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:12px;display:grid}.dw-preview{font:var(--dw-mono);white-space:pre-wrap;background:var(--dw-code);border-radius:var(--dw-radius);max-height:260px;padding:12px 14px;overflow:auto}.dw-graph{border:1px solid var(--dw-line);border-radius:var(--dw-radius);background:var(--dw-surface);width:100%;height:560px;display:block}.dw-graph line{stroke:var(--dw-line);stroke-width:1.2px}.dw-graph circle{stroke:var(--dw-surface);stroke-width:1.5px;cursor:pointer}.dw-graph circle.dim{opacity:.35}.dw-graph text{fill:var(--dw-muted);pointer-events:none;font-size:11px}.dw-legend{color:var(--dw-muted);flex-wrap:wrap;gap:14px;margin:10px 0;font-size:13px;display:flex}.dw-swatch{vertical-align:-1px;border-radius:50%;width:10px;height:10px;margin-right:6px;display:inline-block}