@mesh-tech/mesh-cli 0.1.1 → 0.12.1

package/dist/src/docs/registry-docs.js

@@ -0,0 +1,138 @@
+/**
+ * The docs-as-registry-artifact client.
+ *
+ * The release job publishes the built portal as `@mesh-tech/docs` in the
+ * fixed lockstep group, so the docs version IS the @mesh-tech/* baseline
+ * version it describes. The audience is exactly "people who can install the
+ * packages": the CodeArtifact registry is Zitadel-role-gated (see
+ * `mesh registry login`), so no public hosting is required for the docs to
+ * reach precisely the authorized set.
+ *
+ * This module reads the user's existing `~/.npmrc` CodeArtifact token (the
+ * one `mesh registry login` writes), lists published docs versions, and
+ * fetches + caches a version's tarball. It never talks to AWS directly.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { homeNpmrcPath, parseNpmrcRegistryAuth } from "../utils/auth-preflight.js";
+export const DOCS_PACKAGE = "@mesh-tech/docs";
+/** The CodeArtifact token + endpoint from `mesh registry login`'s ~/.npmrc line. */
+export function readDocsRegistryAuth(npmrcPath = homeNpmrcPath()) {
+    if (!existsSync(npmrcPath))
+        return null;
+    return parseNpmrcRegistryAuth(readFileSync(npmrcPath, "utf-8"));
+}
+/** The packument URL for a package (`@scope/name` → `@scope%2fname` path encoding). */
+function packumentUrl(endpoint, pkg) {
+    return `${endpoint.replace(/\/+$/, "")}/${pkg.replace(/\//g, "%2f")}`;
+}
+async function registryFetch(auth, url, fetchImpl) {
+    return fetchImpl(url, {
+        headers: {
+            authorization: `Bearer ${auth.token}`,
+            accept: "application/json",
+        },
+    });
+}
+/** x.y.z numeric compare (release versions carry no prerelease suffixes). */
+export function compareVersions(a, b) {
+    const parse = (v) => {
+        const parts = v.split(".").map((n) => Number.parseInt(n, 10) || 0);
+        while (parts.length < 3)
+            parts.push(0);
+        return parts;
+    };
+    const pa = parse(a);
+    const pb = parse(b);
+    for (let i = 0; i < 3; i++) {
+        if (pa[i] !== pb[i])
+            return pa[i] - pb[i];
+    }
+    return 0;
+}
+/**
+ * Every published docs version, oldest → newest, plus the registry's
+ * `latest` dist-tag. Throws with the login remediation when the registry
+ * rejects the token — an expired token is the common case (12h TTL).
+ */
+export async function listDocsVersions(auth, fetchImpl = fetch) {
+    const response = await registryFetch(auth, packumentUrl(auth.endpoint, DOCS_PACKAGE), fetchImpl).catch((error) => {
+        throw new Error(`could not reach the package registry: ${error instanceof Error ? error.message : String(error)}`);
+    });
+    if (response.status === 401 || response.status === 403) {
+        throw new Error(`registry auth rejected the token (${response.status}). Refresh it: mesh registry login`);
+    }
+    if (response.status === 404) {
+        throw new Error(`${DOCS_PACKAGE} is not published yet — no release has shipped the docs artifact. In a mesh-platform checkout, use \`mesh docs start\` against the working tree instead.`);
+    }
+    if (!response.ok) {
+        throw new Error(`registry returned ${response.status} for ${DOCS_PACKAGE}`);
+    }
+    const packument = (await response.json());
+    const versions = Object.keys(packument.versions ?? {}).sort(compareVersions);
+    return { versions, latest: packument["dist-tags"]?.latest };
+}
+/** Where fetched docs versions live: `~/.cache/mesh/docs/<version>/`. */
+export function docsCacheRoot() {
+    const base = process.env.XDG_CACHE_HOME ?? path.join(homeDir(), ".cache");
+    return path.join(base, "mesh", "docs");
+}
+function homeDir() {
+    return process.env.HOME ?? tmpdir();
+}
+/**
+ * Fetch and extract a docs version into the cache; returns the directory
+ * containing the site's `dist/`. Cache hit = the directory already has a
+ * `dist/index.html`. Partial downloads extract to a temp sibling and rename,
+ * so an interrupted fetch never leaves a half-written "good" cache entry.
+ */
+export async function fetchDocsArtifact(auth, version, cacheRoot = docsCacheRoot(), fetchImpl = fetch) {
+    const targetDir = path.join(cacheRoot, version);
+    if (existsSync(path.join(targetDir, "dist", "index.html")))
+        return targetDir;
+    const listResponse = await registryFetch(auth, packumentUrl(auth.endpoint, DOCS_PACKAGE), fetchImpl);
+    if (!listResponse.ok) {
+        throw new Error(`registry returned ${listResponse.status} for ${DOCS_PACKAGE}`);
+    }
+    const packument = (await listResponse.json());
+    const tarball = packument.versions?.[version]?.dist?.tarball;
+    if (!tarball) {
+        throw new Error(`${DOCS_PACKAGE}@${version} is not in the registry. Run \`mesh docs list\` to see published versions.`);
+    }
+    // Only ever send the registry credential to the registry's own origin: the
+    // tarball URL comes out of a response BODY, and a bearer token must not
+    // follow it to an arbitrary host. Real CodeArtifact tarball URLs are
+    // same-origin; anything else is a malformed (or hostile) packument.
+    if (new URL(tarball).origin !== new URL(auth.endpoint).origin) {
+        throw new Error(`${DOCS_PACKAGE}@${version} points its tarball at ${new URL(tarball).origin}, not the registry (${new URL(auth.endpoint).origin}) — refusing to send the registry token off-origin`);
+    }
+    const tgzResponse = await registryFetch(auth, tarball, fetchImpl);
+    if (!tgzResponse.ok) {
+        throw new Error(`downloading ${DOCS_PACKAGE}@${version} failed: ${tgzResponse.status}`);
+    }
+    mkdirSync(cacheRoot, { recursive: true });
+    const tgzPath = path.join(cacheRoot, `.${version}.tgz`);
+    writeFileSync(tgzPath, Buffer.from(await tgzResponse.arrayBuffer()));
+    const staging = path.join(cacheRoot, `.staging-${version}`);
+    rmSync(staging, { recursive: true, force: true });
+    mkdirSync(staging, { recursive: true });
+    try {
+        // npm tarballs wrap everything in `package/` — strip one component.
+        execFileSync("tar", ["-xzf", tgzPath, "-C", staging, "--strip-components", "1"], {
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+    }
+    finally {
+        rmSync(tgzPath, { force: true });
+    }
+    if (!existsSync(path.join(staging, "dist", "index.html"))) {
+        rmSync(staging, { recursive: true, force: true });
+        throw new Error(`${DOCS_PACKAGE}@${version} unpacked without a dist/index.html — the artifact is malformed`);
+    }
+    rmSync(targetDir, { recursive: true, force: true });
+    renameSync(staging, targetDir);
+    return targetDir;
+}
+//# sourceMappingURL=registry-docs.js.map

package/dist/src/docs/registry-docs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-docs.js","sourceRoot":"","sources":["../../../src/docs/registry-docs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEnF,MAAM,CAAC,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAO9C,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,YAAoB,aAAa,EAAE;IACtE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,sBAAsB,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,uFAAuF;AACvF,SAAS,YAAY,CAAC,QAAgB,EAAE,GAAW;IACjD,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAsB,EACtB,GAAW,EACX,SAAuB;IAEvB,OAAO,SAAS,CAAC,GAAG,EAAE;QACpB,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;YACrC,MAAM,EAAE,kBAAkB;SAC3B;KACF,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAY,EAAE;QACpC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC,CAAC,CAAE,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAsB,EACtB,YAA0B,KAAK;IAE/B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/G,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,qCAAqC,QAAQ,CAAC,MAAM,oCAAoC,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,GAAG,YAAY,0JAA0J,CAC1K,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,QAAQ,YAAY,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGvC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;AAC9D,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,OAAO;IACd,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAsB,EACtB,OAAe,EACf,YAAoB,aAAa,EAAE,EACnC,YAA0B,KAAK;IAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAE7E,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;IACrG,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qBAAqB,YAAY,CAAC,MAAM,QAAQ,YAAY,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAE3C,CAAC;IACF,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC;IAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,GAAG,YAAY,IAAI,OAAO,4EAA4E,CACvG,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,GAAG,YAAY,IAAI,OAAO,0BAA0B,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,uBAAuB,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,oDAAoD,CACpL,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,eAAe,YAAY,IAAI,OAAO,YAAY,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,MAAM,CAAC,CAAC;IACxD,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAErE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,OAAO,EAAE,CAAC,CAAC;IAC5D,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,oEAAoE;QACpE,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,CAAC,EAAE;YAC/E,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,IAAI,OAAO,iEAAiE,CAAC,CAAC;IAC/G,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/B,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/src/docs/schema.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The `docs.json` contract — the one file that turns a directory into portal
+ * content, and the reserved-name list that keeps internal material
+ * unpublishable even inside an opted-in directory.
+ *
+ * The reserved list is the safety property of the whole design: it is frozen,
+ * deliberately coarse, and matched case-insensitively against every path
+ * segment at any depth. Publishing internal material takes TWO mistakes —
+ * adding a `docs.json` to a directory that holds it AND moving the material
+ * out of a reserved directory. Keep the list coarse; when a document should be
+ * public, move the document to a publishable directory rather than narrowing
+ * the list.
+ */
+import { z } from "zod";
+/**
+ * Directory/file names that never publish, at any depth beneath a doc root.
+ * Matched case-insensitively against each individual path segment.
+ *
+ * Evidence-derived from the repo's own `docs/` tree (plans/, superpowers/,
+ * incidents/, handoffs/, HRAN/, reviews/, runbooks/, proposals/, designs/,
+ * templates/ hold the internal corpus) plus the tooling directories that must
+ * never leak (node_modules, __tests__, .claude, .pi) and the generic internal
+ * markers (archive, internal, drafts).
+ */
+export declare const RESERVED_SEGMENTS: readonly string[];
+/**
+ * A doc root's declaration. Everything else about the site is derived from the
+ * tree, never declared — this schema is deliberately tiny, and STRICT: an
+ * unknown key is a typo the author meant something by, so it fails validation
+ * rather than being silently ignored.
+ */
+export declare const docsJsonSchema: z.ZodObject<{
+    title: z.ZodString;
+    order: z.ZodDefault<z.ZodNumber>;
+    slug: z.ZodOptional<z.ZodString>;
+    include: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type DocsJson = z.infer<typeof docsJsonSchema>;
+/** True when one path segment is a reserved name (case-insensitive). */
+export declare function isReservedSegment(segment: string): boolean;
+/**
+ * True when ANY segment of a repo-relative path is reserved. This is the
+ * fail-closed check the CI gate runs over every assembled output path.
+ */
+export declare function hasReservedSegment(relPath: string): boolean;
+/** Lower-kebab-case form of a title or filename stem, for routes. */
+export declare function slugify(value: string): string;
+//# sourceMappingURL=schema.d.ts.map

package/dist/src/docs/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/docs/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAkB9C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;;kBA6BhB,CAAC;AAEZ,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO7C"}

package/dist/src/docs/schema.js

@@ -0,0 +1,96 @@
+/**
+ * The `docs.json` contract — the one file that turns a directory into portal
+ * content, and the reserved-name list that keeps internal material
+ * unpublishable even inside an opted-in directory.
+ *
+ * The reserved list is the safety property of the whole design: it is frozen,
+ * deliberately coarse, and matched case-insensitively against every path
+ * segment at any depth. Publishing internal material takes TWO mistakes —
+ * adding a `docs.json` to a directory that holds it AND moving the material
+ * out of a reserved directory. Keep the list coarse; when a document should be
+ * public, move the document to a publishable directory rather than narrowing
+ * the list.
+ */
+import { z } from "zod";
+/**
+ * Directory/file names that never publish, at any depth beneath a doc root.
+ * Matched case-insensitively against each individual path segment.
+ *
+ * Evidence-derived from the repo's own `docs/` tree (plans/, superpowers/,
+ * incidents/, handoffs/, HRAN/, reviews/, runbooks/, proposals/, designs/,
+ * templates/ hold the internal corpus) plus the tooling directories that must
+ * never leak (node_modules, __tests__, .claude, .pi) and the generic internal
+ * markers (archive, internal, drafts).
+ */
+export const RESERVED_SEGMENTS = [
+    "plans",
+    "designs",
+    "proposals",
+    "incidents",
+    "handoffs",
+    "reviews",
+    "runbooks",
+    "hran",
+    "superpowers",
+    "templates",
+    "archive",
+    "internal",
+    "drafts",
+    "node_modules",
+    "__tests__",
+    ".claude",
+    ".pi",
+];
+/**
+ * A doc root's declaration. Everything else about the site is derived from the
+ * tree, never declared — this schema is deliberately tiny, and STRICT: an
+ * unknown key is a typo the author meant something by, so it fails validation
+ * rather than being silently ignored.
+ */
+export const docsJsonSchema = z
+    .object({
+    /** Section label in the nav, e.g. "Building apps". */
+    title: z.string().min(1),
+    /**
+     * Section position in the nav. Ties break alphabetically by title, so two
+     * sections can never fight over a slot nondeterministically.
+     */
+    order: z.number().int().default(50),
+    /**
+     * Route prefix for the section. Defaults to the slugified title. The
+     * empty string is legal and means "this section lives at the site root" —
+     * exactly one root should do that (the front door, `docs/portal`).
+     */
+    slug: z
+        .string()
+        .regex(/^$|^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'slug must be lower-kebab-case or ""')
+        .optional(),
+    /**
+     * Escape hatch: explicit repo-relative paths to publish that live outside
+     * any natural doc root (a package README, a repo-root policy file). Expected
+     * to hold a handful of entries across the whole repo — adding one is a
+     * deliberate, reviewable act. Paths under a reserved segment are refused.
+     */
+    include: z.array(z.string().min(1)).default([]),
+})
+    .strict();
+/** True when one path segment is a reserved name (case-insensitive). */
+export function isReservedSegment(segment) {
+    const lowered = segment.toLowerCase();
+    return RESERVED_SEGMENTS.some((reserved) => reserved === lowered);
+}
+/**
+ * True when ANY segment of a repo-relative path is reserved. This is the
+ * fail-closed check the CI gate runs over every assembled output path.
+ */
+export function hasReservedSegment(relPath) {
+    return relPath.split("/").some(isReservedSegment);
+}
+/** Lower-kebab-case form of a title or filename stem, for routes. */
+export function slugify(value) {
+    return (value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "") || "index");
+}
+//# sourceMappingURL=schema.js.map

package/dist/src/docs/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/docs/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,OAAO;IACP,SAAS;IACT,WAAW;IACX,WAAW;IACX,UAAU;IACV,SAAS;IACT,UAAU;IACV,MAAM;IACN,aAAa;IACb,WAAW;IACX,SAAS;IACT,UAAU;IACV,QAAQ;IACR,cAAc;IACd,WAAW;IACX,SAAS;IACT,KAAK;CACN,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,sDAAsD;IACtD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACnC;;;;OAIG;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,KAAK,CACJ,+BAA+B,EAC/B,qCAAqC,CACtC;SACA,QAAQ,EAAE;IACb;;;;;OAKG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AACpD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,CACL,KAAK;SACF,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CACtC,CAAC;AACJ,CAAC"}

package/dist/src/docs/serve.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Serve a BUILT docs site (the Zudoku `dist/`) over loopback HTTP.
+ *
+ * This is deliberately not the deleted portal-serve.ts: that one served a
+ * bespoke renderer's output with a custom search-index API. This one serves
+ * a prerendered static tree and nothing else — try the exact path, then
+ * `<path>.html` (Zudoku's prerendered routes), then `<path>/index.html`,
+ * then the SPA fallback. No search endpoint: Pagefind runs client-side
+ * against the shipped index files.
+ */
+export interface DocsServer {
+    url: string;
+    port: number;
+    close: () => Promise<void>;
+}
+/**
+ * Start the server. `port: 0` picks a free one (what tests use).
+ *
+ * Path safety: the URL path is normalized and rejected outright if it escapes
+ * the root — this serves a local preview to the machine's own user, but a
+ * `..` escape is a hole with no excuse to exist.
+ */
+export declare function serveDocsSite(args: {
+    root: string;
+    port: number;
+}): Promise<DocsServer>;
+//# sourceMappingURL=serve.d.ts.map

package/dist/src/docs/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../src/docs/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA0BH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAmE7F"}

package/dist/src/docs/serve.js

@@ -0,0 +1,102 @@
+/**
+ * Serve a BUILT docs site (the Zudoku `dist/`) over loopback HTTP.
+ *
+ * This is deliberately not the deleted portal-serve.ts: that one served a
+ * bespoke renderer's output with a custom search-index API. This one serves
+ * a prerendered static tree and nothing else — try the exact path, then
+ * `<path>.html` (Zudoku's prerendered routes), then `<path>/index.html`,
+ * then the SPA fallback. No search endpoint: Pagefind runs client-side
+ * against the shipped index files.
+ */
+import { createServer } from "node:http";
+import { readFile } from "node:fs/promises";
+import { extname, join, normalize, sep } from "node:path";
+const CONTENT_TYPES = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".map": "application/json; charset=utf-8",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".ico": "image/x-icon",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+    ".txt": "text/plain; charset=utf-8",
+    ".md": "text/markdown; charset=utf-8",
+    ".webmanifest": "application/manifest+json",
+};
+/**
+ * Start the server. `port: 0` picks a free one (what tests use).
+ *
+ * Path safety: the URL path is normalized and rejected outright if it escapes
+ * the root — this serves a local preview to the machine's own user, but a
+ * `..` escape is a hole with no excuse to exist.
+ */
+export async function serveDocsSite(args) {
+    const root = normalize(args.root);
+    // Containment, not prefix-match: the prefix test alone admits SIBLINGS
+    // whose names extend the root's basename (`<parent>/dist-secret/x` starts
+    // with `<parent>/dist`). The vector that reaches it is an encoded slash —
+    // WHATWG URL parsing strips dot-segments, then decodeURIComponent turns
+    // `..%2f` back into `../`. (Review on #3612.)
+    const rootPrefix = root.endsWith(sep) ? root : root + sep;
+    const server = createServer((req, res) => {
+        void (async () => {
+            const url = new URL(req.url ?? "/", "http://localhost");
+            const pathname = decodeURIComponent(url.pathname);
+            if (pathname === "/healthz") {
+                res.writeHead(200, { "content-type": "text/plain" }).end("ok");
+                return;
+            }
+            const candidates = [
+                pathname,
+                `${pathname}.html`,
+                `${pathname.replace(/\/$/, "")}/index.html`,
+            ];
+            if (pathname !== "/")
+                candidates.push("/index.html"); // SPA fallback
+            for (const candidate of candidates) {
+                const filePath = normalize(join(root, candidate));
+                // `continue`, not `break`: one malformed candidate must not change
+                // the response for the rest (the SPA fallback lives inside the root).
+                if (filePath !== root && !filePath.startsWith(rootPrefix))
+                    continue; // outside the root — never serve
+                try {
+                    const body = await readFile(filePath);
+                    const type = CONTENT_TYPES[extname(filePath)] ?? "application/octet-stream";
+                    // Prerendered HTML can be stale the moment a newer build exists;
+                    // hashed assets are immutable.
+                    const cache = candidate.includes("/assets/") ? "public, max-age=31536000, immutable" : "no-cache";
+                    res.writeHead(200, { "content-type": type, "cache-control": cache });
+                    res.end(body);
+                    return;
+                }
+                catch {
+                    // try the next candidate
+                }
+            }
+            res.writeHead(404, { "content-type": "text/plain" }).end("not found");
+        })().catch(() => {
+            res.writeHead(500).end("internal error");
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(args.port, "127.0.0.1", () => resolve());
+    });
+    const address = server.address();
+    const port = typeof address === "object" && address ? address.port : args.port;
+    return {
+        url: `http://127.0.0.1:${port}`,
+        port,
+        close: () => new Promise((resolve, reject) => {
+            server.close((error) => (error ? reject(error) : resolve()));
+        }),
+    };
+}
+//# sourceMappingURL=serve.js.map

package/dist/src/docs/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../../src/docs/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE1D,MAAM,aAAa,GAA2B;IAC5C,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,gCAAgC;IACvC,MAAM,EAAE,gCAAgC;IACxC,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,iCAAiC;IACzC,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,2BAA2B;IACnC,KAAK,EAAE,8BAA8B;IACrC,cAAc,EAAE,2BAA2B;CAC5C,CAAC;AAQF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAoC;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,8CAA8C;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;IAE1D,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAElD,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC/D,OAAO;YACT,CAAC;YAED,MAAM,UAAU,GAAG;gBACjB,QAAQ;gBACR,GAAG,QAAQ,OAAO;gBAClB,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa;aAC5C,CAAC;YACF,IAAI,QAAQ,KAAK,GAAG;gBAAE,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe;YAErE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;gBAClD,mEAAmE;gBACnE,sEAAsE;gBACtE,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;oBAAE,SAAS,CAAC,iCAAiC;gBACtG,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACtC,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,0BAA0B,CAAC;oBAC5E,iEAAiE;oBACjE,+BAA+B;oBAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,UAAU,CAAC;oBAClG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;oBACrE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACd,OAAO;gBACT,CAAC;gBAAC,MAAM,CAAC;oBACP,yBAAyB;gBAC3B,CAAC;YACH,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACxE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACd,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAE/E,OAAO;QACL,GAAG,EAAE,oBAAoB,IAAI,EAAE;QAC/B,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC;KACL,CAAC;AACJ,CAAC"}

package/dist/src/docs/start.d.ts

@@ -0,0 +1,80 @@
+/**
+ * `mesh docs start` / `mesh docs list` / `mesh docs stop` — the docs as a
+ * local, role-gated server (MESH-1803 follow-up).
+ *
+ * Two content modes, chosen automatically:
+ *
+ *   - **Repo mode** — inside a checkout that has doc roots (mesh-platform):
+ *     assemble the working tree, build, and serve the static output. This is
+ *     the contributor path; the docs are exactly what is on disk.
+ *   - **Registry mode** — anywhere else (a tenant repo, a global install):
+ *     fetch the published `@mesh-tech/docs` artifact — versioned with the
+ *     @mesh-tech/* baseline — from the role-gated registry and serve it.
+ *     `-v <version>` pins; default is the registry's `latest` dist-tag.
+ *
+ * Two run modes: by default the server runs DETACHED in a tmux session with
+ * the constant name `mesh-docs` — the handle that keeps a backgrounded server
+ * from getting lost — and the command prints the URL once it answers.
+ * `--foreground` (or a non-TTY, i.e. an agent/CI) serves in the foreground.
+ * `--dev` (repo mode) runs the Zudoku dev server and is foreground-only: it
+ * is an authoring tool — you are supposed to watch it.
+ *
+ * The registry mode is the distribution point: the people who can read the
+ * docs are exactly the people who can install the packages, and no public
+ * hosting is required.
+ */
+/** The one tmux session name — the constant handle for the detached server. */
+export declare const DOCS_TMUX_SESSION = "mesh-docs";
+/** `mesh docs list` — published docs versions, newest first. */
+export declare function runDocsList(): Promise<void>;
+/** The install command to show when tmux is missing, per platform. */
+export declare function tmuxInstallHint(platform?: string): string;
+/** True when tmux is runnable. */
+export declare function tmuxAvailable(): boolean;
+/** The detached/foreground decision, as one pure predicate. */
+export declare function shouldDetach(args: {
+    foreground: boolean;
+    dev: boolean;
+    isTTY: boolean;
+}): boolean;
+/** True when the detached session currently exists. */
+export declare function docsSessionExists(): boolean;
+/**
+ * The argv the tmux session runs: a hidden foreground serve of the prepared
+ * directory. Source checkouts re-enter through `pnpm exec mesh` at the repo
+ * root (the shim-free canonical form); a published install re-enters through
+ * the `mesh` bin on PATH.
+ */
+export declare function tmuxServeArgs(args: {
+    mode: "source" | "dist";
+    repoRoot: string;
+    serveRoot: string;
+    port: number;
+}): {
+    command: string[];
+    cwd: string;
+};
+/** (Re)start the detached docs session and wait for it to answer. */
+export declare function startDetached(args: {
+    mode: "source" | "dist";
+    repoRoot: string;
+    serveRoot: string;
+    port: number;
+    label: string;
+}): Promise<void>;
+/** `mesh docs stop` — kill the detached session if it exists. */
+export declare function runDocsStop(): void;
+/** The hidden `mesh docs serve-static` the tmux session re-enters through. */
+export declare function runDocsServeStatic(args: {
+    root: string;
+    port: string;
+}): Promise<void>;
+/** `mesh docs start` — serve the docs locally, detached by default. */
+export declare function runDocsStart(args: {
+    repoRoot: string;
+    version?: string | undefined;
+    port: string;
+    dev: boolean;
+    foreground: boolean;
+}): Promise<void>;
+//# sourceMappingURL=start.d.ts.map

package/dist/src/docs/start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../../src/docs/start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAkBH,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAa7C,gEAAgE;AAChE,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAcjD;AAMD,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,QAAQ,GAAE,MAAyB,GAAG,MAAM,CAI3E;AAED,kCAAkC;AAClC,wBAAgB,aAAa,IAAI,OAAO,CAOvC;AAED,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAEjG;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,IAAI,OAAO,CAO3C;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAMrC;AAED,qEAAqE;AACrE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAwDhB;AAWD,iEAAiE;AACjE,wBAAgB,WAAW,IAAI,IAAI,CAOlC;AAED,8EAA8E;AAC9E,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB5F;AAMD,uEAAuE;AACvE,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkIhB"}