@qnroa/qtype 0.0.2 → 0.0.3

package/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-Chinese: [CHANGELOG.zh.md](./CHANGELOG.zh.md)
+Chinese: [CHANGELOG.zh.md](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=CHANGELOG.zh.md)
 
 All notable changes to this project are documented in this file.
 
@@ -93,5 +93,3 @@ with this version.
 - `content search` is plain substring — no tag / type filters
 - Welcome feature is a skeleton
 - E2E automation is minimal
-
-See [TODO.md](./TODO.md) for the tracked backlog.

package/CHANGELOG.zh.md

@@ -1,6 +1,6 @@
 # 变更记录
 
-English: [CHANGELOG.md](./CHANGELOG.md)
+English: [CHANGELOG.md](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=CHANGELOG.md)
 
 本文件记录本项目的所有值得注意的变更。
 
@@ -79,4 +79,3 @@ English: [CHANGELOG.md](./CHANGELOG.md)
 - Welcome 特性只是骨架
 - E2E 自动化很少
 
-追踪清单见 [TODO.zh.md](./TODO.zh.md)。

package/README.md

@@ -1,79 +1,106 @@
 # qtype
 
-**English** | [中文](./README.zh.md)
+**English** | [中文](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=README.zh.md)
 
-**Markdown-driven typing review / practice tool.** Write a `## Q:` / `## A:` card, and qtype makes you **type the answer** to review it.
-
-qtype is the sister project of [qrism](https://github.com/qnroa/qrism): qrism focuses on **graph-navigated knowledge reading**, qtype focuses on **active typing to internalise knowledge**. Both share the same "MD is the single source of truth" value.
+**Markdown-driven typing practice tool.** Author cards in Markdown, and qtype makes you **type them** to internalise them. Six card shapes (`word` / `sentence` / `article` / `snippet` / `qa` / `code`) cover everything from GRE vocab drills to code snippets to poems.
 
 ## Quick start
 
 ```bash
-# One-time
-npm install -g @qnroa/qtype
-
-# Or run directly via npx
-npx @qnroa/qtype init my-deck
+mkdir my-deck
+npx @qnroa/qtype init my-deck --lang en
 cd my-deck
-# Author your material/*.md files (see QTYPE.md)
+# `qtype init` ships one starter file per material type under material/
+# — edit any of them, or add your own:
+#   material/word.md  sentence.md  article.md  snippet.md  qa.md  code.md
 npx @qnroa/qtype publish build
-npx @qnroa/qtype publish serve    # http://localhost:4000
+npx @qnroa/qtype publish serve   # http://localhost:4000
 ```
 
 Requires Node ≥ 20.
 
-## CLI
-
-| Command | What it does |
-|---|---|
-| `qtype init [dir]` | Scaffold a material repo (with `QTYPE.md` spec + AGENTS/CLAUDE/GEMINI symlinks) |
-| `qtype check [dir]` | Validate card format (read-only) |
-| `qtype publish build` | Assemble the static site into `dist/` |
-| `qtype publish serve` | Local preview |
-| `qtype publish init` | Write `.gitignore` + GitHub Pages workflow |
-| `qtype pack` | Bundle the material repo into `.tar.gz` |
-| `qtype config` | Get / set / unset / list settings (user + repo layers) |
-| `qtype repo new / sync` | Create a new repo / fill in conventions |
-
-Run `qtype <cmd> --help` for full options.
-
 ## Card format
 
-A single card:
+A file is one deck; its `type` (in frontmatter) picks the shape. The
+simplest example — one sentence card:
 
 ```markdown
 ---
-tags: [js, basics]
-type: normal
+title: Warm-up
+type: sentence
+tags: [warmup]
 ---
 
-## Q:
+# The quick brown fox jumps over the lazy dog.
+### The classic English pangram.
+```
 
-What are the three core concepts of React?
+`#` H1 splits cards. `sentence` uses H2 for a phonetic and H3 for a
+translation. Other types differ:
 
-## A:
+| type | Typing target | Extras |
+|---|---|---|
+| `word` | H1 word | H2 phonetic · H3 gloss · H4 image |
+| `sentence` | H1 sentence | H2 phonetic · H3 translation · H4 image |
+| `article` | Body under H1 | inline images extracted |
+| `snippet` | Body under H1 | centered layout (poems / aphorisms) |
+| `qa` | `## A` block | `## Q` prompt (full markdown) |
+| `code` | Fenced block in `## A` | Optional Shiki highlight |
 
-Components, props, and state.
-```
+Full spec: [`templates/en/QTYPE.md`](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=templates/en/QTYPE.md) (dropped
+into every new repo). Deep reference:
+[docs/en/material-types.md](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/en/material-types.md).
 
-Multiple cards in one file are separated by `\n\n---\n\n` (on its own line).
+**Rich rendering** (display side, not typed): mermaid diagrams
+(pre-rendered at build time), KaTeX math (`$…$` / `$$…$$`, lazy-loaded),
+code highlighting via Shiki. See material-types.md for details.
 
-Supported types: `normal | word | sentence`. `word` / `sentence` cards may carry `phonetic` / `gloss` / `translation`. Full spec lives in `templates/{zh,en}/QTYPE.md` (copied into your repo by `qtype init`).
+## CLI
+
+| Command | Notes |
+|---|---|
+| `qtype init [dir]` | Scaffold a material repo (`QTYPE.md` + 6 starter types + `.qtype/`) |
+| `qtype check [dir]` | Validate cards (read-only, exit 1 on error) |
+| `qtype content search <q>` | Full-text search, supports `--tag` / `--type` / `--json` |
+| `qtype publish build` | Assemble static site into `dist/` (mermaid pre-render, optional AES-GCM encrypt) |
+| `qtype publish serve` | Local preview on `:4000` |
+| `qtype publish init` | Write `.gitignore` (+ `--ci github` for a Pages workflow) |
+| `qtype publish password set` | Password-protect the site (argon2id → AES-256) |
+| `qtype pack` | Bundle repo into `.tar.gz` |
+| `qtype config get/set/list` | User + repo layer settings (`~/.config/qtype/` + `<repo>/.qtype/`) |
+| `qtype repo new / sync` | Create a new repo / re-sync conventions |
+
+Run `qtype <cmd> --help` for full options. Full listing:
+[docs/en/cli-reference.md](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/en/cli-reference.md).
+
+## Password protection
+
+```bash
+qtype publish password set                    # interactive
+QTYPE_PUBLISH_PASSWORD=hunter2 qtype publish build
+```
+
+Content encrypts client-side with AES-256-GCM; the argon2id-derived key
+is cached in the user's sessionStorage so a reload in the same tab
+doesn't re-prompt. Threat model: prevents casual URL-holders from
+reading, not a motivated attacker who downloads and brute-forces the
+KDF offline.
 
 ## Naming
 
-- `qrism = Q + prism` — the prism of questions, refracting MD into an explorable knowledge graph.
-- `qtype = Q + type` — typing your way through questions, turning MD into typable cards.
+`qtype = Q + type` — typing your way through questions, turning MD into typable cards.
 
 ## Documentation
 
-- [Architecture](./docs/en/architecture.md) — how `core` / `cli` / `view` relate
-- [CLI reference](./docs/en/cli-reference.md) — brief overview of every command
-- [Authoring guide](./docs/en/authoring.md) — quick primer on writing `material/*.md`
-- [`CONTRIBUTING.md`](./CONTRIBUTING.md) — dev setup + PR flow
-- [`CHANGELOG.md`](./CHANGELOG.md) — release history
-
-Full authoring spec: [`templates/en/QTYPE.md`](./templates/en/QTYPE.md) / [`templates/zh/QTYPE.md`](./templates/zh/QTYPE.md). Copied into every new repo as `QTYPE.md` based on `qtype init --lang zh|en`.
+- [Getting started](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/en/getting-started.md) — 5-minute walkthrough
+- [Authoring guide](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/en/authoring.md) — quick primer on writing `material/*.md`
+- [Material types](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/en/material-types.md) — deep reference for all 6 types
+- [CLI reference](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/en/cli-reference.md) — every command + config key
+- [Settings](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/en/settings.md) — every user-facing setting
+- [Deployment](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/en/deployment.md) — GitHub Pages / Cloudflare / nginx
+- [Keyboard shortcuts](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/en/shortcuts.md) — key bindings + rebinding
+- [Typing rules](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/en/typing-rules.md) — ignoreCase / retryOnFail / etc.
+- [`CHANGELOG.md`](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=CHANGELOG.md) — release history
 
 ## Development
 
@@ -81,33 +108,38 @@ Full authoring spec: [`templates/en/QTYPE.md`](./templates/en/QTYPE.md) / [`temp
 npm install
 npm run dev:view         # http://localhost:5173 (view hot dev)
 npm test                 # vitest
-npm run build            # build:cli + build:view
+npm run build            # CLI (tsc)
+npm run build:view       # SPA bundle (vite)
+npm run build:all        # both
 npm run lint             # tsc --noEmit (cli + view tsconfigs)
 ```
 
+Point the dev server at a specific material directory:
+
+```bash
+QTYPE_DEV_MATERIAL=templates/zh/material npm run dev:view
+```
+
 ## Repo layout
 
 ```
 qtype/
 ├── src/
-│   ├── core/       # pure logic, no IO (parser / typing / keystroke / ...)
-│   ├── view/       # React SPA
+│   ├── core/       # pure logic, no IO (parser / typing engine / keystroke / encrypt)
+│   ├── view/       # React SPA (TanStack Router + Vite)
 │   ├── store/      # persistence (KvStore + JsonStorage / MemoryStorage / BrowserStorage)
 │   └── cli/        # commander + registry/mount pattern
-├── templates/{zh,en}/    # copied into user repo by init
-├── tsconfig.{cli,view}.json
+├── templates/{zh,en}/    # copied into user repos by init
+├── examples/{zh,en}/     # real-shape repos for smoke tests + dev
+├── docs/                 # this documentation
 └── vite.config.ts        # outputs to dist/view
 ```
 
 Publish structure:
 - `dist/cli/` — CLI executable (`bin: qtype`)
-- `dist/core/` — re-usable for external APIs (`exports "./core"`)
+- `dist/core/` — reusable types (`exports "./core"`)
 - `dist/view/` — pre-built SPA; `publish build` copies this into user `dist/`
 
-## Relationship to qrism
-
-The CLI structure (registry / mount / i18n / bootstrap) mirrors qrism almost one-for-one. QTYPE.md is the counterpart of QRISM.md — an LLM-authoring spec for structured Markdown. The only real difference is that qtype cards are "meant to be typed" while qrism nodes are "meant to be read".
-
 ## License
 
-Apache-2.0 — see [LICENSE](./LICENSE).
+Apache-2.0 — see [LICENSE](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=LICENSE).

package/README.zh.md

@@ -1,89 +1,112 @@
 # qtype
 
-[English](./README.md) | **中文**
+[English](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=README.md) | **中文**
 
-**Markdown 驱动的打字复习/练习工具。** 写一份 `## Q:` / `## A:` 卡片，qtype 让你把答案**打一遍**来复习。
-
-qtype 是 [qrism](https://github.com/qnroa/qrism) 的姊妹项目：qrism 关注**图导航的知识阅读**，qtype 关注**主动打字的知识内化**。共享同一个"MD 是唯一真相源"的价值观。
+**Markdown 驱动的打字练习工具。** 用 Markdown 写卡片,qtype 让你把它**打一遍**来内化。6 种卡片形态(`word` / `sentence` / `article` / `snippet` / `qa` / `code`)覆盖从背单词到练代码到抄诗的所有场景。
 
 ## 快速开始
 
 ```bash
-# 一次性
-npm install -g @qnroa/qtype
-
-# 或直接 npx
-npx @qnroa/qtype init my-deck
+mkdir my-deck
+npx @qnroa/qtype init my-deck --lang zh
 cd my-deck
-# 用你的编辑器/AI 助手写 material/*.md（详见 QTYPE.md）
+# `qtype init` 会在 material/ 下放 6 张类型模板 —— 直接改任意一张,
+# 或复制一份重命名当新卡组:
+#   material/word.md  sentence.md  article.md  snippet.md  qa.md  code.md
 npx @qnroa/qtype publish build
 npx @qnroa/qtype publish serve    # http://localhost:4000
 ```
 
 需要 Node ≥ 20。
 
-## CLI
-
-| 命令 | 作用 |
-|---|---|
-| `qtype init [dir]` | 初始化资料仓库（含 QTYPE.md 规范 + AGENTS/CLAUDE/GEMINI 软链） |
-| `qtype check [dir]` | 校验卡片格式，只读 |
-| `qtype publish build` | 拼装静态站到 `dist/` |
-| `qtype publish serve` | 本地预览 |
-| `qtype publish init` | 写 `.gitignore` + GitHub Pages workflow |
-| `qtype pack` | 打包整个资料为 `.tar.gz` |
-| `qtype config` | 读 / 写 / 删 / 列配置（user + repo 双层） |
-| `qtype repo new / sync` | 新建仓库 / 补齐约定 |
-
-每个命令 `qtype <cmd> --help` 看完整选项。
-
 ## 卡片格式
 
-一张卡：
+一个文件 = 一副卡组,`type`(在 frontmatter)决定形态。最简单的例子 —— 一张 sentence 卡:
 
 ```markdown
 ---
-tags: [js, basics]
-type: normal
+title: 热身
+type: sentence
+tags: [热身]
 ---
 
-## Q:
+# The quick brown fox jumps over the lazy dog.
+### 英文全字母句。
+```
 
-React 三大核心概念是什么？
+用 `#` H1 分卡。`sentence` 卡用 H2 放音标、H3 放翻译。其他类型:
 
-## A:
+| type | 打字目标 | 附加项 |
+|---|---|---|
+| `word` | H1 单词 | H2 音标 · H3 释义 · H4 图片 |
+| `sentence` | H1 句子 | H2 音标 · H3 翻译 · H4 图片 |
+| `article` | H1 之下正文 | 内嵌图片自动抽出 |
+| `snippet` | H1 之下正文 | 居中排版(诗句/格言) |
+| `qa` | `## A` 块 | `## Q` 题干(完整 markdown) |
+| `code` | `## A` 里的 fenced 块 | 可选 Shiki 语法高亮 |
 
-组件、props 和 state。
-```
+完整规范:[`templates/zh/QTYPE.md`](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=templates/zh/QTYPE.md)(会拷进每个新仓库)。深度参考:[docs/zh/material-types.md](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/zh/material-types.md)。
 
-一份 MD 里多张卡片用 `\n\n---\n\n`（独占行）分隔。
+**富渲染**(展示侧,不参与打字):Mermaid 流程图(构建时预渲染)、KaTeX 数学公式(`$…$` / `$$…$$`,懒加载)、Shiki 代码高亮。详见 material-types.md。
 
-支持 `type: normal | word | sentence`，`word` / `sentence` 可带 `phonetic` / `gloss` / `translation`。完整规范见 `templates/{zh,en}/QTYPE.md`（由 `qtype init` 复制到你的仓库）。
+## CLI
+
+| 命令 | 作用 |
+|---|---|
+| `qtype init [dir]` | 初始化资料仓库(QTYPE.md + 6 种类型起手模板 + `.qtype/`) |
+| `qtype check [dir]` | 校验卡片(只读,错则退出码 1) |
+| `qtype content search <q>` | 全文搜索,支持 `--tag` / `--type` / `--json` |
+| `qtype publish build` | 拼装静态站到 `dist/`(mermaid 预渲染、可选 AES-GCM 加密) |
+| `qtype publish serve` | 本地 `:4000` 预览 |
+| `qtype publish init` | 写 `.gitignore`(加 `--ci github` 写 Pages workflow) |
+| `qtype publish password set` | 密码保护(argon2id → AES-256) |
+| `qtype pack` | 打包资料为 `.tar.gz` |
+| `qtype config get/set/list` | 双层配置(`~/.config/qtype/` + `<repo>/.qtype/`) |
+| `qtype repo new / sync` | 新建仓库 / 补齐约定 |
+
+每个命令 `qtype <cmd> --help` 看完整选项。完整列表:[docs/zh/cli-reference.md](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/zh/cli-reference.md)。
+
+## 密码保护
+
+```bash
+qtype publish password set                        # 交互输入
+QTYPE_PUBLISH_PASSWORD=hunter2 qtype publish build
+```
+
+内容用 AES-256-GCM **客户端**加密,argon2id 派生的密钥缓存在浏览器 sessionStorage(同 tab 刷新不再问密码)。威胁模型:防止拿到 URL 的路人随便看,不防拿到 dist 后离线暴力破解 KDF 的高动机攻击者。
 
 ## 命名
 
-- `qrism = Q + prism`（问题的棱镜）—— 把 MD 折射成可探索的知识图。
-- `qtype = Q + type`（问题的打字）—— 把 MD 转成可打字复现的卡片。
+`qtype = Q + type`(问题的打字)—— 把 MD 转成可打字复现的卡片
 
 ## 文档
 
-- [架构总览](./docs/zh/architecture.md) —— `core` / `cli` / `view` 怎么分工
-- [CLI 简介](./docs/zh/cli-reference.md) —— 每个命令的简单说明
-- [撰写指南](./docs/zh/authoring.md) —— `material/*.md` 的快速入门
-- [`CONTRIBUTING.zh.md`](./CONTRIBUTING.zh.md) —— 开发环境 + PR 流程
-- [`CHANGELOG.zh.md`](./CHANGELOG.zh.md) —— 版本历史
-
-规范全文：[`templates/en/QTYPE.md`](./templates/en/QTYPE.md) /
-[`templates/zh/QTYPE.md`](./templates/zh/QTYPE.md)。`qtype init --lang zh|en` 时拷成用户仓库的 `QTYPE.md`。
+- [Getting Started](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/zh/getting-started.md) —— 5 分钟教程
+- [撰写指南](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/zh/authoring.md) —— `material/*.md` 的快速入门
+- [Material 类型详解](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/zh/material-types.md) —— 6 种类型的深度参考
+- [CLI 简介](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/zh/cli-reference.md) —— 所有命令 + 配置键
+- [Settings 参考](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/zh/settings.md) —— 所有用户可见的设置项
+- [部署指南](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/zh/deployment.md) —— GitHub Pages / Cloudflare / nginx
+- [快捷键](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/zh/shortcuts.md) —— 按键绑定 + 重绑
+- [打字规则](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=docs/zh/typing-rules.md) —— ignoreCase / retryOnFail / 等
+- [`CHANGELOG.zh.md`](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=CHANGELOG.zh.md) —— 版本历史
 
 ## 开发
 
 ```bash
 npm install
-npm run dev:view         # http://localhost:5173（view 端热开发）
+npm run dev:view         # http://localhost:5173(view 端热开发)
 npm test                 # vitest
-npm run build            # build:cli + build:view
-npm run lint             # tsc --noEmit（cli + view 两份 tsconfig）
+npm run build            # CLI(tsc)
+npm run build:view       # SPA bundle(vite)
+npm run build:all        # 一起
+npm run lint             # tsc --noEmit(cli + view 两份 tsconfig)
+```
+
+让 dev server 指向别的 material 目录:
+
+```bash
+QTYPE_DEV_MATERIAL=templates/zh/material npm run dev:view
 ```
 
 ## 目录结构
@@ -91,24 +114,21 @@ npm run lint             # tsc --noEmit（cli + view 两份 tsconfig）
 ```
 qtype/
 ├── src/
-│   ├── core/       # 纯逻辑，无 IO（parser / typing / keystroke / ...）
-│   ├── view/       # React SPA
-│   ├── store/      # 持久化（KvStore + JsonStorage / MemoryStorage / BrowserStorage）
+│   ├── core/       # 纯逻辑,无 IO(parser / typing engine / keystroke / encrypt)
+│   ├── view/       # React SPA(TanStack Router + Vite)
+│   ├── store/      # 持久化(KvStore + JsonStorage / MemoryStorage / BrowserStorage)
 │   └── cli/        # commander + registry/mount 模式
-├── templates/{zh,en}/    # init 时复制到用户仓库
-├── tsconfig.{cli,view}.json
+├── templates/{zh,en}/    # init 时拷进用户仓库
+├── examples/{zh,en}/     # smoke test + dev 用的真实形状仓库
+├── docs/                 # 这份文档
 └── vite.config.ts        # 输出到 dist/view
 ```
 
-发布结构：
-- `dist/cli/` — CLI 可执行文件（`bin: qtype`）
-- `dist/core/` — 复用给外部 API（`exports "./core"`）
-- `dist/view/` — 预编译的 SPA，`publish build` 拷贝这里到用户 `dist/`
-
-## 与 qrism 的关系
-
-CLI 结构（registry / mount / i18n / bootstrap）几乎一比一镜像 qrism。QTYPE.md 对应 QRISM.md —— 一份让 LLM 生成结构化 Markdown 的规范。区别只在于 qtype 的卡片是"要被打字重现的"，而 qrism 的节点是"要被阅读的"。
+发布结构:
+- `dist/cli/` — CLI 可执行(`bin: qtype`)
+- `dist/core/` — 类型复用(`exports "./core"`)
+- `dist/view/` — 预编译 SPA;`publish build` 时拷到用户 `dist/`
 
 ## License
 
-Apache-2.0 —— 详见 [LICENSE](./LICENSE)。
+Apache-2.0 —— 详见 [LICENSE](https://www.npmjs.com/package/@qnroa/qtype?activeTab=code&filepath=LICENSE)。

package/dist/cli/bootstrap.js

@@ -16,9 +16,9 @@
  * ## Schema (git-style layering)
  *
  * Both KVs enable `strict: true` (`qtype config set` needs to reject typo'd keys).
- * Each key is one of:
+ * Schemas live in `./schemas/`, one file per scope:
  *   - user-only  → registered on userKv only (cli.*)
- *   - repo-only  → registered on repoKv only (repo.name)
+ *   - repo-only  → registered on repoKv only (repo.name, publish.*)
  *   - both       → registered on BOTH sides (repo.lang, typing.*).
  *                  Users can set a global default; individual repos override.
  *                  Read precedence: repo > user > schema default.
@@ -26,119 +26,8 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { KvStore, JsonStorage, enumValidator, nonEmptyStringValidator, boolValidator, positiveIntValidator, } from '../store/index.js';
-// ═══════════════════════════════════════════════════════════════
-// Schemas grouped by scope (git-style layering)
-// ═══════════════════════════════════════════════════════════════
-/** user-only: settings tied to the person, not the repo. */
-const userOnlySchema = {
-    // CLI display language. Values are BCP 47 codes; the short forms
-    // `zh` / `en` are accepted for backwards compatibility with older
-    // config files and normalised at read time by the i18n layer.
-    'cli.lang': {
-        validator: enumValidator(['zh-CN', 'en-US', 'zh', 'en']),
-        default: 'en-US',
-    },
-    'cli.color': {
-        validator: enumValidator(['always', 'never', 'auto']),
-        default: 'auto',
-    },
-};
-/** repo-only: settings that only make sense per-repo. */
-const repoOnlySchema = {
-    'repo.name': {
-        validator: nonEmptyStringValidator(),
-    },
-    // ── Password protection for `publish build` ─────────────
-    // On/off toggle. When true, `publish build` reads the other three fields
-    // and encrypts every material/*.md before writing to dist.
-    'publish.password.enabled': {
-        validator: boolValidator(),
-        default: false,
-    },
-    // Argon2id PHC-style hash of the plaintext password, used to verify the
-    // password entered at build time. NOT the AES key — that's derived
-    // separately via `publish.password.aesSalt`. Empty string when protection
-    // is off; shape enforced by `publish password set` writing a well-formed
-    // PHC string.
-    'publish.password.hash': {
-        validator: (v) => typeof v === 'string'
-            ? null
-            : { code: 'err.schema.nonEmptyString', fallback: 'must be a string' },
-        default: '',
-    },
-    // Base64 salt used with argon2id (password → AES-256 key). Rotated only
-    // when the user calls `publish password set` — stable across rebuilds so
-    // the same password unlocks previously published sites.
-    'publish.password.aesSalt': {
-        validator: (v) => typeof v === 'string'
-            ? null
-            : { code: 'err.schema.nonEmptyString', fallback: 'must be a string' },
-        default: '',
-    },
-    // What to encrypt. `all` covers material/ + any future encrypted assets;
-    // `material-only` limits encryption to material/*.md (same behavior in
-    // v0 since qtype has no other content streams).
-    'publish.password.scope': {
-        validator: enumValidator(['all', 'material-only', 'selected']),
-        default: 'all',
-    },
-    // When scope='selected', the list of file names (relative to material/)
-    // to encrypt. Ignored otherwise.
-    'publish.password.selected': {
-        validator: (v) => Array.isArray(v) && v.every((x) => typeof x === 'string')
-            ? null
-            : { code: 'err.schema.nonEmptyString', fallback: 'must be an array of strings' },
-        default: [],
-    },
-};
-/** both: user sets a global default, individual repos override. */
-const bothSchema = {
-    // Repo language. Drives:
-    //   • which template locale (examples/zh vs examples/en) new repos are
-    //     scaffolded from
-    //   • the web UI language — the reader is locked to repo.lang so the UI
-    //     matches the material's own language
-    //
-    // Values are BCP 47 codes (`zh-CN` / `en-US`); the short forms `zh` /
-    // `en` are accepted for backwards compatibility with older `.qtype/
-    // config.json` files and normalised at read time.
-    'repo.lang': {
-        validator: enumValidator(['zh-CN', 'en-US', 'zh', 'en']),
-        default: 'en-US',
-    },
-    'typing.theme': {
-        validator: enumValidator(['mocha', 'latte']),
-        default: 'mocha',
-    },
-    'typing.targetWpm': {
-        validator: positiveIntValidator(),
-    },
-    'typing.tabBehavior': {
-        validator: enumValidator(['reset', 'input', 'disabled']),
-        default: 'reset',
-    },
-    'typing.hint': {
-        validator: enumValidator(['none', 'ghost']),
-        default: 'none',
-    },
-    'typing.showKeyboard': {
-        validator: boolValidator(),
-        default: true,
-    },
-    'typing.showHands': {
-        validator: boolValidator(),
-        default: true,
-    },
-    // Mermaid pre-render mode. `prerender` (default) uses puppeteer at build
-    // time to bake SVGs into dist/material/mermaid.json; `client` ships raw
-    // ```mermaid fences and lets the browser render them; `off` treats mermaid
-    // as plain code blocks.
-    'publish.mermaid': {
-        validator: enumValidator(['prerender', 'client', 'off']),
-        default: 'prerender',
-    },
-};
+import { KvStore, JsonStorage } from '../store/index.js';
+import { userOnlySchema, repoOnlySchema, bothSchema } from '../core/schemas/index.js';
 // ═══════════════════════════════════════════════════════════════
 // Path resolution
 // ═══════════════════════════════════════════════════════════════

package/dist/cli/commands/check/index.js

@@ -1,20 +1,21 @@
 import { t } from '../../i18n/index.js';
-import { messages } from './i18n.js';
-import { checkAction } from './action.js';
+import { messages as lintMessages } from '../content/lint/i18n.js';
+import { contentLintAction } from '../content/lint/action.js';
 export const checkCmd = {
     name: 'check',
-    messages,
-    summary: () => t('check.summary'),
-    describe: () => t('check.description'),
+    messages: lintMessages,
+    summary: () => t('content.lint.summary'),
+    describe: () => t('content.lint.description'),
     options: [
-        { flags: '--repo <path>', describe: () => t('check.opt.repo') },
+        { flags: '--repo <path>', describe: () => t('content.lint.arg.path') },
+        { flags: '--json', describe: () => t('content.lint.opt.json') },
     ],
     examples: () => [
-        { command: 'qtype check', describe: () => t('check.example.basic') },
-        { command: 'qtype check --repo ./my-material', describe: () => t('check.example.repo') },
+        { command: 'qtype check', describe: () => t('content.lint.example.basic') },
+        { command: 'qtype check --json', describe: () => t('content.lint.example.json') },
     ],
-    seeAlso: ['publish build', 'content lint'],
+    seeAlso: ['content lint', 'content validate', 'publish build'],
     action: async (opts) => {
-        await checkAction({ repo: opts.repo });
+        await contentLintAction({ path: opts.repo, json: opts.json });
     },
 };

package/dist/cli/commands/config/action.js

@@ -1,6 +1,6 @@
 import { KvError } from '../../../store/index.js';
 import { userKv, repoKv } from '../../bootstrap.js';
-import { info, success, dim, error } from '../../utils/output.js';
+import { info, success, dim, error, fatal } from '../../utils/output.js';
 import { t } from '../../i18n/index.js';
 /** --global / --local are mutually exclusive; returns the explicitly-specified scope (neither given → undefined). */
 function pickScope(opts) {
@@ -61,8 +61,7 @@ export async function configGetAction(key, opts) {
         if (!has) {
             const def = kv.getSchema(key)?.default;
             if (def === undefined) {
-                error(t('config.get.msg.notSetScoped', { key, scope }));
-                process.exit(1);
+                fatal(t('config.get.msg.notSetScoped', { key, scope }));
             }
             console.log(formatValue(def));
             return;
@@ -85,8 +84,7 @@ export async function configGetAction(key, opts) {
     // Fall back to default: repo schema first, then user
     const def = repoKv.getSchema(key)?.default ?? userKv.getSchema(key)?.default;
     if (def === undefined) {
-        error(t('config.get.msg.notSet', { key }));
-        process.exit(1);
+        fatal(t('config.get.msg.notSet', { key }));
     }
     console.log(formatValue(def));
 }
@@ -95,8 +93,7 @@ async function showOrigin(key, scope) {
     const inUser = await userKv.has(key);
     if (scope === 'user') {
         if (!inUser) {
-            error(t('config.get.msg.notSetScoped', { key, scope: 'user' }));
-            process.exit(1);
+            fatal(t('config.get.msg.notSetScoped', { key, scope: 'user' }));
         }
         console.log(formatValue(await userKv.get(key)));
         console.error(`  ${dim('from:')} ${userKv.origin} (user)`);
@@ -104,8 +101,7 @@ async function showOrigin(key, scope) {
     }
     if (scope === 'repo') {
         if (!inRepo) {
-            error(t('config.get.msg.notSetScoped', { key, scope: 'repo' }));
-            process.exit(1);
+            fatal(t('config.get.msg.notSetScoped', { key, scope: 'repo' }));
         }
         console.log(formatValue(await repoKv.get(key)));
         console.error(`  ${dim('from:')} ${repoKv.origin} (repo)`);