@qnroa/qtype 0.0.1

package/dist/cli/commands/plugin/index.js

@@ -0,0 +1,41 @@
+import { t } from '../../i18n/index.js';
+import { info } from '../../utils/output.js';
+import { messages } from './i18n.js';
+const listCmd = {
+    name: 'list',
+    aliases: ['ls'],
+    summary: () => t('plugin.list.summary'),
+    describe: () => t('plugin.list.description'),
+    action: async () => {
+        info(t('plugin.msg.noPlugins'));
+    },
+};
+const enableCmd = {
+    name: 'enable',
+    summary: () => t('plugin.enable.summary'),
+    describe: () => t('plugin.enable.description'),
+    args: [{ flag: '<id>', describe: () => 'plugin id' }],
+    action: async (id) => {
+        info(t('plugin.msg.notImplemented', { phase: 'v0' }));
+        info(t('plugin.msg.notFound', { id }));
+        process.exitCode = 1;
+    },
+};
+const disableCmd = {
+    name: 'disable',
+    summary: () => t('plugin.disable.summary'),
+    describe: () => t('plugin.disable.description'),
+    args: [{ flag: '<id>', describe: () => 'plugin id' }],
+    action: async (id) => {
+        info(t('plugin.msg.notImplemented', { phase: 'v0' }));
+        info(t('plugin.msg.notFound', { id }));
+        process.exitCode = 1;
+    },
+};
+export const pluginCmd = {
+    name: 'plugin',
+    messages,
+    summary: () => t('plugin.summary'),
+    describe: () => t('plugin.description'),
+    subcommands: [listCmd, enableCmd, disableCmd],
+};

package/dist/cli/commands/publish/build/action.js

@@ -0,0 +1,208 @@
+/**
+ * `qtype publish build` action — assemble the deployable static site.
+ *
+ * Flow:
+ *   1. Verify repo has material/ and qtype has a prebuilt view bundle.
+ *   2. Resolve optional password-encryption context (see `publish/password/`).
+ *   3. Wipe & recreate the output directory.
+ *   4. Copy the view bundle wholesale, then strip its dev-seed material/.
+ *   5. Copy the user's material/*.md (encrypting each file if the repo has
+ *      password protection enabled) and emit an index.json manifest that
+ *      records the file list + titles for the view to consume.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { error, info, success } from '../../../utils/output.js';
+import { resolveBundle } from '../../../utils/paths.js';
+import { promptPassword } from '../../../utils/prompt.js';
+import { t } from '../../../i18n/index.js';
+import { createRepoKv } from '../../../bootstrap.js';
+import { deriveAesKey, encryptString, DEFAULT_ARGON2_PARAMS, } from '../../../../core/encrypt.js';
+import { verifyPassword } from '../password/action.js';
+import { prerenderMermaid, emptyMermaidPass } from './mermaidPass.js';
+export async function publishBuildAction(opts = {}) {
+    const cwd = opts.path ? path.resolve(opts.path) : process.cwd();
+    const outDir = path.resolve(cwd, opts.out ?? 'dist');
+    const viewBundle = resolveBundle('dist/view');
+    const materialDir = path.join(cwd, 'material');
+    info(t('publish.build.msg.parsing', { path: cwd }));
+    if (!fs.existsSync(viewBundle) ||
+        !fs.existsSync(path.join(viewBundle, 'index.html'))) {
+        error(t('publish.build.err.noView', { path: viewBundle }));
+        process.exitCode = 1;
+        return;
+    }
+    if (!fs.existsSync(materialDir)) {
+        error(t('publish.build.err.noMaterial'));
+        process.exitCode = 1;
+        return;
+    }
+    const encryptCtx = await resolveEncryptCtx(cwd);
+    const mermaidMode = await resolveMermaidMode(cwd);
+    const repoLang = await resolveRepoLang(cwd);
+    const materials = [];
+    for (const name of fs.readdirSync(materialDir)) {
+        if (!name.endsWith('.md'))
+            continue;
+        const body = fs.readFileSync(path.join(materialDir, name), 'utf8');
+        const title = readTitle(body) ?? name.replace(/\.md$/, '');
+        materials.push({ name, body, title });
+    }
+    // Mermaid pre-render — scan all bodies, produce svg + css maps.
+    const mermaid = mermaidMode === 'prerender'
+        ? await prerenderMermaid(materials.map((m) => m.body))
+        : emptyMermaidPass();
+    if (mermaidMode !== 'prerender') {
+        info(t('publish.build.msg.mermaidSkip', { mode: mermaidMode }));
+    }
+    info(t('publish.build.msg.building', { path: outDir }));
+    fs.rmSync(outDir, { recursive: true, force: true });
+    fs.mkdirSync(outDir, { recursive: true });
+    copyDir(viewBundle, outDir);
+    // Defensive: clear any stale material/ that might have snuck into the
+    // view bundle. Since dev-seed content lives at repo root's examples/
+    // (served only by the vite dev middleware, not the bundle), this is a
+    // no-op today — kept in case a future build tool ships anything here.
+    const targetMaterial = path.join(outDir, 'material');
+    fs.rmSync(targetMaterial, { recursive: true, force: true });
+    fs.mkdirSync(targetMaterial, { recursive: true });
+    const entries = [];
+    for (const m of materials) {
+        if (encryptCtx) {
+            const blob = await encryptString(encryptCtx.key, m.body);
+            fs.writeFileSync(path.join(targetMaterial, `${m.name}.enc.json`), JSON.stringify(blob));
+        }
+        else {
+            fs.writeFileSync(path.join(targetMaterial, m.name), m.body);
+        }
+        entries.push({ file: m.name, title: m.title });
+    }
+    // Mermaid SVG map + CSS: the view fetches these alongside index.json and
+    // looks up each fence by its trimmed source when rendering material bodies.
+    if (mermaid.count > 0) {
+        const mermaidJson = mermaidMode === 'prerender' ? mermaid.svgs : {};
+        if (encryptCtx) {
+            const blob = await encryptString(encryptCtx.key, JSON.stringify(mermaidJson));
+            fs.writeFileSync(path.join(targetMaterial, 'mermaid.json.enc'), JSON.stringify(blob));
+        }
+        else {
+            fs.writeFileSync(path.join(targetMaterial, 'mermaid.json'), JSON.stringify(mermaidJson));
+        }
+        if (mermaid.css) {
+            fs.writeFileSync(path.join(targetMaterial, 'mermaid.css'), mermaid.css);
+        }
+    }
+    // Manifest: lists materials + optional encryption envelope + mermaid mode.
+    const manifest = { materials: entries };
+    if (encryptCtx) {
+        manifest.encrypted = {
+            algo: 'AES-GCM',
+            argon2: DEFAULT_ARGON2_PARAMS,
+            aesSalt: encryptCtx.aesSalt,
+            scope: encryptCtx.scope,
+        };
+    }
+    manifest.mermaid = {
+        mode: mermaidMode,
+        count: mermaid.count,
+        errored: mermaid.errored,
+        hasCss: mermaid.css.length > 0,
+    };
+    // Repo language — the reader locks its UI to this so the interface
+    // matches the material's own language.
+    manifest.lang = repoLang;
+    fs.writeFileSync(path.join(targetMaterial, 'index.json'), JSON.stringify(manifest, null, 2) + '\n');
+    success(t('publish.build.msg.done', { path: outDir }));
+    info(t('publish.build.msg.stat', {
+        count: countCards(materialDir).toString(),
+        materialCount: entries.length.toString(),
+    }));
+    info(t('publish.build.msg.hint'));
+}
+/**
+ * Read publish.password.* from the repo's KV and, if enabled, obtain the
+ * plaintext (env var or TTY prompt), verify it against the stored hash, and
+ * derive the AES key. Returns null when protection is off — build stays
+ * plaintext.
+ */
+async function resolveEncryptCtx(cwd) {
+    const kv = createRepoKv(cwd);
+    if (!(await kv.available()))
+        return null;
+    const enabled = (await kv.get('publish.password.enabled')) === true;
+    if (!enabled)
+        return null;
+    const scope = (await kv.get('publish.password.scope')) ?? 'all';
+    if (scope !== 'all' && scope !== 'material-only') {
+        throw new Error(t('publish.build.err.scopeUnsupported', { scope }));
+    }
+    const hash = (await kv.get('publish.password.hash'));
+    const aesSalt = (await kv.get('publish.password.aesSalt'));
+    if (!hash || !aesSalt) {
+        throw new Error(t('publish.build.err.pwdNoHash'));
+    }
+    const plaintext = await obtainPassword();
+    if (!verifyPassword(plaintext, hash)) {
+        throw new Error(t('publish.build.err.pwdWrong'));
+    }
+    info(t('publish.build.msg.encrypting', { scope }));
+    const key = await deriveAesKey(plaintext, aesSalt);
+    return { key, aesSalt, scope: scope };
+}
+/** Read `publish.mermaid` from the repo KV, falling back to 'prerender'. */
+async function resolveMermaidMode(cwd) {
+    const kv = createRepoKv(cwd);
+    if (!(await kv.available()))
+        return 'prerender';
+    const v = (await kv.get('publish.mermaid'));
+    return v === 'client' || v === 'off' ? v : 'prerender';
+}
+/**
+ * Read `repo.lang` from the repo KV, normalise to canonical BCP 47
+ * (`zh-CN` / `en-US`). Falls back to `en-US` when the field is missing
+ * or unrecognised. The reader consumes this to lock its UI language.
+ */
+async function resolveRepoLang(cwd) {
+    const kv = createRepoKv(cwd);
+    if (!(await kv.available()))
+        return 'en-US';
+    const v = await kv.get('repo.lang');
+    if (v === 'zh' || v === 'zh-CN')
+        return 'zh-CN';
+    return 'en-US';
+}
+async function obtainPassword() {
+    const envPwd = process.env.QTYPE_PUBLISH_PASSWORD;
+    if (envPwd)
+        return envPwd;
+    if (process.stdin.isTTY) {
+        return promptPassword(t('publish.build.msg.pwdPrompt'));
+    }
+    throw new Error(t('publish.build.err.pwdMissing'));
+}
+function copyDir(src, dst) {
+    fs.mkdirSync(dst, { recursive: true });
+    for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+        const s = path.join(src, entry.name);
+        const d = path.join(dst, entry.name);
+        if (entry.isDirectory())
+            copyDir(s, d);
+        else if (entry.isFile())
+            fs.copyFileSync(s, d);
+    }
+}
+function readTitle(source) {
+    const head = source.slice(0, 1024);
+    const m = head.match(/^title:\s*(.+)$/m);
+    return m ? m[1].trim().replace(/^["']|["']$/g, '') : null;
+}
+function countCards(materialDir) {
+    let n = 0;
+    for (const name of fs.readdirSync(materialDir)) {
+        if (!name.endsWith('.md'))
+            continue;
+        const body = fs.readFileSync(path.join(materialDir, name), 'utf8');
+        n += body.split(/\n\n---\n\n/).filter((s) => /##\s*Q:/.test(s)).length;
+    }
+    return n;
+}

package/dist/cli/commands/publish/build/i18n.js

@@ -0,0 +1,50 @@
+export const messages = {
+    'zh-CN': {
+        'publish.build.summary': '构建静态资料站',
+        'publish.build.description': '拼装 qtype 预编译 view 与当前目录 material/ 为可部署静态站（CI 主用，本地可验证产物）',
+        'publish.build.arg.path': '仓库路径（默认当前目录）',
+        'publish.build.opt.out': '输出目录（默认 dist）',
+        'publish.build.example.basic': 'CI 里构建 / 本地验证产物',
+        'publish.build.msg.parsing': '解析仓库: {path}',
+        'publish.build.msg.building': '构建 → {path}',
+        'publish.build.msg.stat': '{count} 张卡片，{materialCount} 个资料',
+        'publish.build.msg.done': '构建完成 → {path}',
+        'publish.build.msg.hint': '运行 `qtype publish serve` 预览。',
+        'publish.build.err.noView': '未找到 qtype 预编译 view（{path}）。若你正在开发 qtype，请先运行 npm run build:view。',
+        'publish.build.err.noMaterial': '未找到 material/。请先运行 `qtype init`。',
+        'publish.build.msg.encrypting': '启用密码保护，正在加密 material/ (scope={scope})',
+        'publish.build.msg.pwdPrompt': '输入发布密码: ',
+        'publish.build.err.pwdMissing': '密码保护已启用但 build 时未提供密码。请通过 TTY 交互输入，或设置环境变量 QTYPE_PUBLISH_PASSWORD',
+        'publish.build.err.pwdWrong': '密码错误，与 `qtype publish password set` 记录的哈希不匹配',
+        'publish.build.err.pwdNoHash': '`publish.password.enabled=true` 但缺少 hash / aesSalt。请重新运行 `qtype publish password set`',
+        'publish.build.err.scopeUnsupported': '当前仅支持 `scope=all` 与 `scope=material-only`；`scope={scope}` 暂未实现',
+        'publish.build.msg.mermaidStart': '预渲染 {count} 个 mermaid 图...',
+        'publish.build.msg.mermaidDone': 'mermaid 渲染完成：{count} 个图，{errored} 个失败',
+        'publish.build.msg.mermaidErrored': '{count} 个 mermaid 图渲染失败（已回落到错误占位 SVG）',
+        'publish.build.msg.mermaidSkip': 'publish.mermaid={mode}，跳过预渲染',
+    },
+    'en-US': {
+        'publish.build.summary': 'Build the static material site',
+        'publish.build.description': "Assemble qtype's prebuilt view with the local material/ into a deployable static site (CI-first)",
+        'publish.build.arg.path': 'Repo path (default: current directory)',
+        'publish.build.opt.out': 'Output directory (default: dist)',
+        'publish.build.example.basic': 'CI build / local dry run',
+        'publish.build.msg.parsing': 'Parsing repo: {path}',
+        'publish.build.msg.building': 'Building → {path}',
+        'publish.build.msg.stat': '{count} cards across {materialCount} materials',
+        'publish.build.msg.done': 'Build complete → {path}',
+        'publish.build.msg.hint': 'Run `qtype publish serve` to preview.',
+        'publish.build.err.noView': 'Prebuilt qtype view not found ({path}). If you are hacking on qtype, run `npm run build:view` first.',
+        'publish.build.err.noMaterial': 'No material/ found. Run `qtype init` first.',
+        'publish.build.msg.encrypting': 'Password protection enabled, encrypting material/ (scope={scope})',
+        'publish.build.msg.pwdPrompt': 'Publish password: ',
+        'publish.build.err.pwdMissing': 'Password protection enabled but no password provided to build. Enter interactively via TTY, or set QTYPE_PUBLISH_PASSWORD env var',
+        'publish.build.err.pwdWrong': 'Wrong password (does not match the hash stored by `qtype publish password set`)',
+        'publish.build.err.pwdNoHash': '`publish.password.enabled=true` but hash / aesSalt is missing. Re-run `qtype publish password set`',
+        'publish.build.err.scopeUnsupported': "Only scope='all' and scope='material-only' are currently supported; scope='{scope}' is not implemented",
+        'publish.build.msg.mermaidStart': 'Prerendering {count} mermaid diagram(s)...',
+        'publish.build.msg.mermaidDone': 'Mermaid render complete: {count} diagrams, {errored} failed',
+        'publish.build.msg.mermaidErrored': '{count} mermaid diagram(s) failed to render (falling back to inline error SVG)',
+        'publish.build.msg.mermaidSkip': 'publish.mermaid={mode}, skipping prerender',
+    },
+};

package/dist/cli/commands/publish/build/index.js

@@ -0,0 +1,24 @@
+import { t } from '../../../i18n/index.js';
+import { messages } from './i18n.js';
+import { publishBuildAction } from './action.js';
+export const publishBuildCmd = {
+    name: 'build',
+    messages,
+    summary: () => t('publish.build.summary'),
+    describe: () => t('publish.build.description'),
+    args: [{ flag: '[path]', describe: () => t('publish.build.arg.path') }],
+    options: [
+        {
+            flags: '-o, --out <dir>',
+            describe: () => t('publish.build.opt.out'),
+            defaultValue: 'dist',
+        },
+    ],
+    examples: () => [
+        { command: 'qtype publish build', describe: () => t('publish.build.example.basic') },
+    ],
+    seeAlso: ['publish serve', 'publish init'],
+    action: async (pathArg, opts) => {
+        await publishBuildAction({ path: pathArg, out: opts.out });
+    },
+};

package/dist/cli/commands/publish/build/mermaidPass.js

@@ -0,0 +1,93 @@
+/**
+ * Pre-render every ```mermaid code block found across all `material/*.md`
+ * files into inline SVG.
+ *
+ * The view side runs markdown-it (or similar) on each material file when
+ * the user opens it. Rather than let the browser drag in mermaid.js on
+ * demand (~800 KB gz, delayed first paint), we scan every material at
+ * build time and produce a map keyed by the mermaid source. The view
+ * looks up the SVG synchronously and swaps it in — no JS mermaid runtime
+ * needed at runtime.
+ *
+ * Two SVGs per unique diagram (dark + light theme) so theme switching is
+ * a pure CSS swap.
+ *
+ * Order in publishBuildAction:
+ *   1. Read all material/*.md
+ *   2. Prerender mermaid → collect svgs + css
+ *   3. Encrypt if enabled (svg map goes through the same key)
+ *   4. Emit `dist/material/mermaid.json` (+ mermaid.css) alongside the materials
+ */
+import { MermaidRenderer } from './mermaidPrerender.js';
+import { info, warn } from '../../../utils/output.js';
+import { t } from '../../../i18n/index.js';
+const MERMAID_FENCE = /^([ \t]{0,3})(```+)\s*mermaid[ \t]*\n([\s\S]*?)\n\1\2[ \t]*(?=\n|$)/gm;
+/**
+ * Map key: the mermaid source itself (trimmed). markdown-it's `highlight`
+ * hook is sync while the browser's SubtleCrypto is async — using the raw
+ * source as the key sidesteps hashing altogether. The map JSON is slightly
+ * bigger but typical qtype materials have few enough diagrams that this
+ * is negligible next to each diagram's ~2 KB SVG payload.
+ */
+export function mermaidSvgKey(source) {
+    return source.trim();
+}
+function extractSources(md) {
+    const out = [];
+    MERMAID_FENCE.lastIndex = 0;
+    let m;
+    while ((m = MERMAID_FENCE.exec(md)) !== null) {
+        out.push(m[3]);
+    }
+    return out;
+}
+/** Empty result — used when no diagrams found or mermaid pass disabled. */
+export function emptyMermaidPass() {
+    return { svgs: {}, css: '', count: 0, errored: 0 };
+}
+/**
+ * Scan all provided material bodies for ```mermaid fences and pre-render
+ * each unique diagram twice (dark + light). Returns a lookup map + the
+ * associated CSS. Returns an empty result when no diagrams are found.
+ */
+export async function prerenderMermaid(materialBodies) {
+    const uniqueSources = new Map();
+    for (const body of materialBodies) {
+        for (const src of extractSources(body)) {
+            const key = mermaidSvgKey(src);
+            if (!uniqueSources.has(key))
+                uniqueSources.set(key, src);
+        }
+    }
+    if (uniqueSources.size === 0)
+        return emptyMermaidPass();
+    info(t('publish.build.msg.mermaidStart', { count: uniqueSources.size }));
+    const renderer = new MermaidRenderer();
+    await renderer.init();
+    const svgs = {};
+    const cssChunks = [];
+    let errored = 0;
+    try {
+        for (const [key, source] of uniqueSources) {
+            const r = await renderer.render(source);
+            if (r.errored)
+                errored++;
+            svgs[key] = { dark: r.svgDark, light: r.svgLight };
+            if (r.cssDark)
+                cssChunks.push(r.cssDark);
+            if (r.cssLight)
+                cssChunks.push(r.cssLight);
+        }
+    }
+    finally {
+        await renderer.close();
+    }
+    if (errored > 0)
+        warn(t('publish.build.msg.mermaidErrored', { count: errored }));
+    return {
+        svgs,
+        css: cssChunks.join('\n'),
+        count: uniqueSources.size,
+        errored,
+    };
+}

package/dist/cli/commands/publish/build/mermaidPrerender.js

@@ -0,0 +1,199 @@
+/**
+ * Build-time Mermaid pre-renderer.
+ *
+ * Boots ONE headless chromium via puppeteer, loads mermaid ESM from the
+ * local node_modules (no CDN, works offline / in air-gapped CI), then
+ * batch-renders every mermaid code block TWICE — once against mermaid's
+ * built-in `dark` theme and once against `default` (light). Both SVGs
+ * are shipped; the client shows/hides them via CSS
+ * `[data-theme="dark"|"light"]` selectors, so switching themes swaps
+ * the whole rendered figure with no re-render, no JS, no CSP violation.
+ *
+ * Why two full renders instead of one SVG with CSS variables:
+ *   `themeVariables` only controls ~20 mermaid palette slots. Mermaid
+ *   internally derives dozens more (subgraph tints, alternating rows,
+ *   error accents, cluster shadows) and hard-codes those derived values
+ *   into the emitted SVG. Rewriting them post-hoc is fragile — the
+ *   mapping "which derived HSL corresponds to which theme role" isn't
+ *   documented and changes across mermaid versions. Letting mermaid do
+ *   both passes with its own coherent palette yields two clean SVGs.
+ *
+ * SVG post-processing (per theme):
+ *   1. Inline `style="..."` attrs → `.qt-mm-s{N}` classes (moved into
+ *      the SVG's internal <style>). Strict CSPs treat inline style attrs
+ *      as violations even inside freshly-inserted SVGs.
+ *   2. The SVG's internal `<style>` element is *also* stripped and its
+ *      CSS returned separately so the caller can concatenate it into an
+ *      external stylesheet — again, `style-src-elem` blocks any newly
+ *      inserted `<style>` element.
+ */
+import puppeteer from 'puppeteer';
+import path from 'node:path';
+import os from 'node:os';
+import fs from 'node:fs';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+export class MermaidRenderer {
+    browser = null;
+    pageDark = null;
+    pageLight = null;
+    async init() {
+        const candidates = [
+            path.resolve(__dirname, '..', '..', '..', '..', '..', 'node_modules', 'mermaid', 'dist', 'mermaid.esm.min.mjs'),
+            path.resolve(process.cwd(), 'node_modules', 'mermaid', 'dist', 'mermaid.esm.min.mjs'),
+        ];
+        let mermaidEsm = null;
+        for (const c of candidates) {
+            if (fs.existsSync(c)) {
+                mermaidEsm = c;
+                break;
+            }
+        }
+        if (!mermaidEsm) {
+            throw new Error('mermaid ESM not found in node_modules — cannot pre-render mermaid diagrams. ' +
+                'Set publish.mermaid to "client" or "off" in .qtype/config.json to disable prerender.');
+        }
+        this.browser = await puppeteer.launch({
+            headless: true,
+            args: ['--allow-file-access-from-files'],
+        });
+        this.pageDark = await this.makeThemePage(mermaidEsm, 'dark');
+        this.pageLight = await this.makeThemePage(mermaidEsm, 'default');
+    }
+    async makeThemePage(mermaidEsm, theme) {
+        if (!this.browser)
+            throw new Error('browser not launched');
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'qtype-mermaid-'));
+        const hostHtml = path.join(tmpDir, 'host.html');
+        const initJson = JSON.stringify({
+            startOnLoad: false,
+            securityLevel: 'strict',
+            theme,
+            themeVariables: {
+                fontFamily: '-apple-system, BlinkMacSystemFont, "Segoe UI", "PingFang SC", sans-serif',
+            },
+            flowchart: { htmlLabels: true, useMaxWidth: true },
+        });
+        fs.writeFileSync(hostHtml, `<!doctype html>
+<html><head><meta charset="utf-8" /></head><body>
+<script type="module">
+import mermaid from ${JSON.stringify(pathToFileURL(mermaidEsm).href)};
+mermaid.initialize(${initJson});
+window.__qtRender = async (code) => {
+  try {
+    const { svg } = await mermaid.render('qm-' + Math.random().toString(36).slice(2), code);
+    return { ok: true, svg };
+  } catch (e) {
+    return { ok: false, error: e && e.message ? e.message : String(e) };
+  }
+};
+window.__qtReady = true;
+</script>
+</body></html>`);
+        const page = await this.browser.newPage();
+        await page.goto(pathToFileURL(hostHtml).href);
+        await page.waitForFunction('window.__qtReady === true', { timeout: 30_000 });
+        return page;
+    }
+    async renderOne(page, code) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        return await page.evaluate(
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (c) => globalThis.__qtRender(c), code);
+    }
+    async render(code) {
+        if (!this.pageDark || !this.pageLight) {
+            throw new Error('MermaidRenderer not initialised — call init() first');
+        }
+        const [rDark, rLight] = await Promise.all([
+            this.renderOne(this.pageDark, code),
+            this.renderOne(this.pageLight, code),
+        ]);
+        if (!rDark.ok || !rLight.ok) {
+            const msg = (!rDark.ok && rDark.error) || (!rLight.ok && rLight.error) || 'render failed';
+            return {
+                svgDark: errorSvg(msg, code, 'qt-mm-dark'),
+                svgLight: errorSvg(msg, code, 'qt-mm-light'),
+                cssDark: '',
+                cssLight: '',
+                errored: true,
+            };
+        }
+        const dark = processSvg(rDark.svg, 'qt-mm-dark');
+        const light = processSvg(rLight.svg, 'qt-mm-light');
+        return {
+            svgDark: dark.svg,
+            svgLight: light.svg,
+            cssDark: dark.css,
+            cssLight: light.css,
+            errored: false,
+        };
+    }
+    async close() {
+        if (this.browser) {
+            await this.browser.close();
+            this.browser = null;
+            this.pageDark = null;
+            this.pageLight = null;
+        }
+    }
+}
+/**
+ * All post-processing for a raw mermaid SVG in one pass:
+ *   1. Tag the <svg> root with a theme class (`qt-mm-dark` / `qt-mm-light`).
+ *   2. Move every inline `style="..."` attribute to a generated class.
+ *   3. Extract the SVG's internal <style> body, scoped by SVG id.
+ * Returns the sanitised SVG plus the extracted CSS.
+ */
+function processSvg(rawSvg, themeClass) {
+    const idMatch = rawSvg.match(/<svg\b[^>]*\bid="([^"]+)"/);
+    const scope = idMatch ? idMatch[1] : `qm-${Math.random().toString(36).slice(2, 8)}`;
+    let svg = rawSvg;
+    if (/<svg\b[^>]*\sclass="([^"]*)"/.test(svg)) {
+        svg = svg.replace(/(<svg\b[^>]*\sclass=")([^"]*)("[^>]*>)/, (_full, a, cls, b) => `${a}${cls} ${themeClass}${b}`);
+    }
+    else {
+        svg = svg.replace(/<svg\b/, `<svg class="${themeClass}"`);
+    }
+    const styleMap = new Map();
+    let counter = 0;
+    const withClasses = svg.replace(/<([a-zA-Z][a-zA-Z0-9-]*)\b([^>]*?)\sstyle="([^"]*)"([^>]*)>/g, (_full, tag, before, style, after) => {
+        const norm = style.trim().replace(/;\s*$/, '');
+        if (!norm)
+            return `<${tag}${before}${after}>`;
+        let cls = styleMap.get(norm);
+        if (!cls) {
+            counter += 1;
+            cls = `qt-mm-s${counter}`;
+            styleMap.set(norm, cls);
+        }
+        const combined = before + after;
+        if (/\sclass="([^"]*)"/.test(combined)) {
+            const replaced = combined.replace(/\sclass="([^"]*)"/, ` class="$1 ${cls}"`);
+            return `<${tag}${replaced}>`;
+        }
+        return `<${tag}${before} class="${cls}"${after}>`;
+    });
+    let extractedBody = '';
+    const stripped = withClasses.replace(/<style[^>]*>([\s\S]*?)<\/style>/g, (_full, body) => {
+        extractedBody += body;
+        return '';
+    });
+    const classRules = Array.from(styleMap.entries())
+        .map(([style, cls]) => `#${scope} .${cls}{${style}}`)
+        .join('');
+    return {
+        svg: stripped,
+        css: extractedBody + classRules,
+    };
+}
+function errorSvg(message, source, themeClass) {
+    const esc = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+    const short = message.length > 200 ? message.slice(0, 200) + '…' : message;
+    return `<svg xmlns="http://www.w3.org/2000/svg" class="${themeClass}" role="img" aria-label="Mermaid render error" width="600" height="80">
+  <rect x="0" y="0" width="600" height="80" fill="rgba(200,50,50,0.15)" rx="6"/>
+  <text x="12" y="24" fill="#c00">Mermaid render error:</text>
+  <text x="12" y="44" fill="#c00">${esc(short)}</text>
+  <text x="12" y="64" fill="#c00">${esc(source.split('\n')[0].slice(0, 80))}…</text>
+</svg>`;
+}

package/dist/cli/commands/publish/index.js

@@ -0,0 +1,21 @@
+import { t } from '../../i18n/index.js';
+import { publishBuildCmd } from './build/index.js';
+import { publishInitCmd } from './init/index.js';
+import { publishServeCmd } from './serve/index.js';
+import { publishPasswordCmd } from './password/index.js';
+export const publishCmd = {
+    name: 'publish',
+    summary: () => t('publish.summary'),
+    describe: () => t('publish.description'),
+    messages: {
+        'zh-CN': {
+            'publish.summary': '发布管理',
+            'publish.description': '构建、预览与保护静态资料站',
+        },
+        'en-US': {
+            'publish.summary': 'Publishing',
+            'publish.description': 'Build, preview, and protect the static material site',
+        },
+    },
+    subcommands: [publishInitCmd, publishBuildCmd, publishServeCmd, publishPasswordCmd],
+};