@terreno/mcp 57.3.0 → 57.6.0

package/dist/docs/versioned/next/tasks/mongodb-migrations-tooling.md

@@ -0,0 +1,107 @@
+# Tasks: MongoDB migrations tooling
+
+IP: [mongodb-migrations-tooling.md](../implementationPlans/mongodb-migrations-tooling.md)  
+**Closes:** https://github.com/TerrenoLabs/terreno/issues/1189
+
+**Feature profile:** false (full IP)
+
+## Phase 1 — Runner, lock, history
+
+- [x] **Task 1.1**: Migration context + in-memory/programmatic runner
+  - Delivers: `runMigrations({migrations, dryRun})` runs pending `up` in order; dry-run calls `up({dryRun: true})` and does **not** record applied ids; wet records checksum + `appliedAt`; already-applied ids are skipped; checksum mismatch throws
+  - Files: `api/src/migrations/types.ts`, `api/src/migrations/runner.ts`, `api/src/migrations/runner.test.ts`
+  - Blocked by: none
+  - Skills: `terreno-backend-api`, `backend-test-env`, `mongoose-schema-safety`
+  - Docs: stub “Migrations” subsection in `docs/reference/api.md`
+  - Acceptance: bun tests — dry-run increments a counter inside `up` but history stays empty; wet applies once; second wet is a no-op; edited checksum fails
+
+- [x] **Task 1.2**: Lock collection (wait, heartbeat, 10-minute steal)
+  - Delivers: `withMigrationLock` uses `terreno_migrations` `_id: "_lock"`; concurrent second waiter proceeds after steal when `expiresAt` is past; holder heartbeats; `finally` releases
+  - Files: `api/src/migrations/lock.ts`, `api/src/migrations/lock.test.ts`; wire lock around wet `runMigrations`
+  - Blocked by: 1.1
+  - Skills: `backend-test-env`, `mongoose-schema-safety`
+  - Docs: lock TTL in the api.md stub
+  - Acceptance: two overlapping wet runs serialize; expired lock is stolen; crash-simulated missing release still steals after TTL (test injects past `expiresAt`)
+
+## Phase 2 — Files, CLI, production gate
+
+- [x] **Task 2.1**: File loader + `checkMigrationFiles`
+  - Delivers: load `migrations/<YYYYMMDDHHmmss>-<slug>.ts`; id must match filename; duplicate ids fail; optional `down`; `checkMigrationFiles` is the no-Mongo CI check
+  - Files: `api/src/migrations/load.ts`, `api/src/migrations/load.test.ts`, fixture files under `api/src/migrations/fixtures/`
+  - Blocked by: 1.1
+  - Skills: `terreno-backend-api`
+  - Docs: file naming in api.md
+  - Acceptance: tests for sort order, bad id, missing export, successful load of `up`/`down`
+
+- [x] **Task 2.2**: Production gate + CLI `status`/`up`/`down`/`check`
+  - Delivers: `terreno-migrate` bin; prod wet requires `ALLOW_MIGRATIONS=true` and `--force`; `down --steps` stops with a clear error when `down` is missing; `--dry` never writes history
+  - Files: `api/src/migrations/cli.ts`, `api/src/migrations/cli.test.ts`, `api/package.json` `bin`, `api/src/index.ts` exports
+  - Blocked by: 1.2, 2.1
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: command table in `docs/how-to/run-mongodb-migrations.md` (create page); `ALLOW_MIGRATIONS` row in `docs/reference/environment-variables.md`
+  - Acceptance: argv tests (help, check, dry up, prod deny); integration up/down against memory Mongo; `down` without function fails
+
+## Phase 3 — Generate from schema snapshot
+
+- [x] **Task 3.1**: Schema catalog + diff
+  - Delivers: `buildSchemaCatalog(models)` and `diffSchemaCatalog(before, after)` covering indexes, optional fields, required, unique, rename heuristic
+  - Files: `api/src/migrations/schemaCatalog.ts`, `api/src/migrations/schemaCatalog.test.ts`
+  - Blocked by: none (can parallel 1.x in theory; Pick runs after 2.2)
+  - Skills: `mongoose-schema-safety`
+  - Docs: what generate can/cannot emit (how-to)
+  - Acceptance: fixture schemas produce stable catalogs; required+unique+rename classified unsafe; optional field + index classified safe
+
+- [x] **Task 3.2**: `generate` CLI writes a timestamped file
+  - Delivers: `terreno-migrate generate --dir --models`; uses last `schemaAfter`; no-op diff exits 0; unsafe ops emit throwing stub; generated `up` honors `dryRun` for safe index ops
+  - Files: `api/src/migrations/generate.ts`, `api/src/migrations/generate.test.ts`, CLI subcommand
+  - Blocked by: 2.2, 3.1
+  - Skills: `mongoose-schema-safety`, `update-docs`
+  - Docs: generate workflow on the how-to
+  - Acceptance: temp dir tests — first generate from empty snapshot; second generate no-op; required-field stub throws in dry-run and wet
+
+## Phase 4 — Boot hook
+
+- [x] **Task 4.1**: `TerrenoApp` `migrations.runOnStart`
+  - Delivers: option default off; when true, wet `up` after DB connect before listen; prod still needs `ALLOW_MIGRATIONS`; failure prevents listen
+  - Files: `api/src/terrenoApp.ts`, `api/src/terrenoApp.migrations.test.ts` (or extend existing app tests)
+  - Blocked by: 2.2
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: option table in api.md
+  - Acceptance: tests — omitted option does not query `terreno_migrations`; `runOnStart: true` applies pending; prod without env throws before listen
+
+## Phase 5 — Admin HTTP
+
+- [x] **Task 5.1**: Admin migrations routes + config flag
+  - Delivers: `GET /admin/migrations/status` and `POST /admin/migrations/run?wetRun=` as `modelRouter` collection actions; creates BackgroundTask and runs batch pending; poll/cancel via existing script task routes; prod wet 403 without `ALLOW_MIGRATIONS`; `GET /admin/config` includes `migrations.enabled`
+  - Files: `admin-backend/src/adminApp.ts`, `admin-backend/src/adminApp.migrations.test.ts`, AdminApp options type
+  - Blocked by: 1.2, 2.1
+  - Skills: `terreno-backend-api`, `building-admin-interfaces`, `backend-test-env`
+  - Docs: `docs/reference/admin-config.md` + admin-backend reference
+  - Acceptance: 201 + taskId; dry-run does not persist applied ids; non-admin 403; unknown when migrations not configured 404
+
+## Phase 6 — Admin UI
+
+- [x] **Task 6.1**: Migrations page, nav, spa route
+  - Delivers: `__migrations` screen distinct from `__scripts`; status list; Dry run / Apply pending; reuse task polling (script-runner modal or equivalent); shell nav when `migrations.enabled`
+  - Files: `admin-frontend/src/AdminMigrations.tsx`, tests, `AdminShell.tsx`, `AdminScreenRouter.tsx`, types; `admin-spa` route
+  - Blocked by: 5.1
+  - Skills: `terreno-ui`, `building-admin-interfaces`, `verify-ui-changes`, `update-docs`
+  - Docs: `docs/how-to/build-admin-screens.md` nav note
+  - Acceptance: frontend tests for routing/nav; browser verification of dry-run vs apply on example admin (artifacts under `/opt/cursor/artifacts/`)
+
+## Phase 7 — Example, CI, agent docs
+
+- [x] **Task 7.1**: example-backend wiring + reversible fixture
+  - Delivers: `example-backend/migrations/` with a reversible index (or no-op) migration; package scripts `migrate:check` / `migrate:up` / `migrate:status`; test `exerciseReversibleMigrations`; do not wipe `terreno_migrations` in seed reset
+  - Files: `example-backend/package.json`, `example-backend/src/server.ts` (pass `migrations` into AdminApp + TerrenoApp), seed reset guard, tests
+  - Blocked by: 2.2, 5.1
+  - Skills: `update-docs`, `backend-test-env`
+  - Docs: example commands on the how-to
+  - Acceptance: `bun test` in example-backend covers migrate check + up/down; seed `--reset` leaves history collection
+
+- [x] **Task 7.2**: Diátaxis, changelog, mongoose-schema-safety
+  - Delivers: how-to complete; api/env/admin reference; skill tells authors to use versioned migrations for backfills; `CHANGELOG.md` Added; `bun run skills:sync` / `bun run rules` if the skill source changed
+  - Files: `docs/how-to/run-mongodb-migrations.md`, `docs/how-to/README.md`, `docs/reference/*`, `docs/how-to/seed-a-database.md`, `plugins/terreno-planning/skills/mongoose-schema-safety/SKILL.md` (canonical then sync), `CHANGELOG.md`
+  - Blocked by: 3.2, 4.1, 6.1, 7.1 (content must match shipped CLI/UI)
+  - Skills: `update-docs`
+  - Acceptance: stranger can generate → dry-run → up from the how-to; skill no longer points only at ad-hoc `ScriptRunner` backfills

package/dist/docs/versioned/next/tasks/notification-center.md

@@ -0,0 +1,102 @@
+# Tasks: In-app notification center
+
+IP: [notification-center.md](../implementationPlans/notification-center.md)  
+**Closes:** https://github.com/TerrenoLabs/terreno/issues/1179
+
+**Feature profile:** false (full IP)
+
+## Phase 1 — Tracer (inbox write + sync)
+
+- [x] **Task 1.1**: Notification model + `NotificationsApp` + `notify()` inbox write
+  - Delivers: `new NotificationsApp()` registers owner-scoped `/notifications` with `create: []`, `sync: {scope: {type: "owner"}}`, `isDeletedPlugin` + `syncPlugin`; `getNotificationService().notify({userId, title, body, href?, kind?})` inserts a row and change-stream/sync can see it; HTTP/sync create is 403/nack
+  - Files: `api/src/models/notification.ts`, `api/src/types/notification.ts`, `api/src/notifications/notificationsApp.ts`, `api/src/notifications/notificationService.ts`, `api/src/notifications/notificationsApp.test.ts`, `api/src/index.ts`
+  - Blocked by: none
+  - Skills: `terreno-backend-api`, `mongoose-schema-safety`, `backend-test-env`, `update-docs`
+  - Docs: stub **In-app notifications** in `docs/reference/api.md` (do not mix with Slack/Zoom notifiers)
+  - Acceptance: bun + supertest — `notify` creates one owner row; unauthenticated list 401; other user cannot read; POST `/notifications` 403 or disabled; every schema field has `description`
+
+- [x] **Task 1.2**: Owner mark-read and dismiss
+  - Delivers: `preUpdate` allows only `readAt` (ISO/date or `null`); `delete` soft-deletes; other fields in PATCH are stripped/rejected; unread query is `readAt` unset/null
+  - Files: `api/src/notifications/notificationsApp.ts`, tests in `notificationsApp.test.ts`
+  - Blocked by: 1.1
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: one sentence on patch/delete in the api.md stub
+  - Acceptance: bun tests — PATCH `{readAt}` persists; PATCH `{title: "x"}` does not change title; DELETE hides from list; second user 403
+
+## Phase 2 — Preferences, comms fan-out, retention
+
+- [x] **Task 2.1**: Preference model + defaults + `notificationsBeforeSend`
+  - Delivers: `NotificationPreference` unique `ownerId`, four booleans default true; missing row treated as all on; export duck-typed `notificationsBeforeSend({channel, userId})` that cancels when that boolean is false (`verification` channel never cancelled by this hook)
+  - Files: `api/src/models/notificationPreference.ts`, `api/src/types/notificationPreference.ts`, preference router on `NotificationsApp`, tests
+  - Blocked by: 1.1
+  - Skills: `terreno-backend-api`, `mongoose-schema-safety`, `backend-test-env`
+  - Docs: prefs table in api.md stub
+  - Acceptance: bun tests — no row → beforeSend does not cancel; `mail: false` → `{cancel: true}` for `channel: "mail"`; inapp false → `notify` does **not** insert a Notification
+
+- [x] **Task 2.2**: Optional comms fan-out from `notify()`
+  - Delivers: `NotificationsApp({getComms})`; after inbox write, call `sendMail` / `sendSms` / `sendPushToUser` when that pref is on and destination exists (email from User, phone if present on user, push via comms); missing `getComms` or missing destination skips that channel without failing `notify`; do not import `@terreno/comms` from `@terreno/api`
+  - Files: `api/src/notifications/notificationService.ts`, tests with a fake `getComms`
+  - Blocked by: 2.1
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: fan-out order in api.md
+  - Acceptance: bun tests — fake mail called when pref on + email present; mail not called when pref off; `notify` resolves when `getComms` throws after inbox write (log `logger.error`, still return the notification id)
+
+- [x] **Task 2.3**: Mark-all-read + `retainDays`
+  - Delivers: `POST /notifications/mark-all-read` sets `readAt` on the caller's unread rows; `retainDays` default `0` (no sweep); `retainDays > 0` tombstones (`deleted`) rows with `created` older than N days (best-effort on `notify` and/or a small `sweepExpired()`); **no** Mongo TTL index
+  - Files: `notificationsApp.ts`, `notificationService.ts`, tests
+  - Blocked by: 1.2
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: `retainDays` default 0 in api.md
+  - Acceptance: bun tests — mark-all-read only affects caller; retainDays 0 leaves old rows; retainDays 1 tombstones a row dated 2 days ago via Luxon; collection indexes do not include a TTL expireAfterSeconds on Notification
+
+## Phase 3 — UI
+
+- [x] **Task 3.1**: `NotificationBell` + `NotificationInbox`
+  - Delivers: presentational components (no syncdb import); bell shows badge from `unreadCount`; inbox lists items, mark read/unread, dismiss, tap calls `onOpen`; empty and loading states; `testID`s
+  - Files: `ui/src/NotificationBell.tsx`, `ui/src/NotificationInbox.tsx`, tests, `ui/src/index.tsx` exports
+  - Blocked by: none
+  - Skills: `terreno-ui`, `update-docs`, `verify-ui-changes`
+  - Docs: stub props in `docs/reference/ui.md`
+  - Acceptance: bun `ui` tests with `renderWithTheme`; badge hidden at 0; `onOpen` fired with the item; dismiss/mark callbacks fired
+
+- [x] **Task 3.2**: `NotificationPreferences`
+  - Delivers: four `BooleanField`s bound to `{inapp, mail, push, sms}`; `onChange` per channel
+  - Files: `ui/src/NotificationPreferences.tsx`, test, export
+  - Blocked by: none
+  - Skills: `terreno-ui`
+  - Docs: prefs props in ui.md
+  - Acceptance: bun tests — toggling mail calls `onChange("mail", false)`
+
+- [x] **Task 3.3**: Demo stories
+  - Delivers: demoConfig entries with fixture unread/read items and prefs toggles
+  - Files: `demo/stories/` + `demo/demoConfig.tsx` (or current demo registration)
+  - Blocked by: 3.1, 3.2
+  - Skills: `terreno-ui`, `verify-ui-changes`
+  - Docs: none (4.1)
+  - Acceptance: demo route renders bell + inbox + prefs without a backend
+
+## Phase 4 — Example app + docs
+
+- [x] **Task 4.1**: example-backend register + demo notify
+  - Delivers: `NotificationsApp({getComms: getCommsService})`; compose `notificationsBeforeSend` into `CommsApp` `beforeSend`; authenticated demo route (follow `commsDev`) that `notify`s the current user
+  - Files: `example-backend/src/server.ts`, `example-backend/src/api/` demo route + test
+  - Blocked by: 2.2, 2.3
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: none (4.3)
+  - Acceptance: bun tests — registered routes exist; demo notify 401 without auth; 200 with auth creates a row
+
+- [x] **Task 4.2**: example-frontend syncdb + bell + prefs
+  - Delivers: collections `notifications` and `notification-preferences`; bell on todos header; settings preferences screen; `onOpen` uses Expo Router for in-app `href`; optional “send test” calling the demo route
+  - Files: `example-frontend/store/syncdb.ts` (codegen/list), todos screen, settings route, tests if present
+  - Blocked by: 3.1, 3.2, 4.1
+  - Skills: `terreno-data-fetching`, `terreno-ui`, `verify-ui-changes`, `generate-sdk` (only if a non-sync demo route needs SDK)
+  - Docs: none (4.3)
+  - Acceptance: `useQuery` lists notify rows after demo send; mark read persists; prefs toggle survives reload (syncdb); no new RTK CRUD hooks for the collection
+
+- [x] **Task 4.3**: Diátaxis docs + rules + changelog
+  - Delivers: `docs/how-to/in-app-notifications.md`; finish `docs/reference/api.md` and `docs/reference/ui.md`; `docs/reference/comms.md` beforeSend composition; `docs/how-to/README.md` link; `.rulesync/rules/api` mention + `bun run rules`; `changelog/unreleased/notification-center.md`
+  - Files: those docs + rules
+  - Blocked by: 4.2
+  - Skills: `update-docs`
+  - Docs: (this task)
+  - Acceptance: a stranger can register the plugin and wire the bell from the how-to without reading the IP; website/how-to index lists the page

package/dist/docs/versioned/next/tasks/org-management-ui.md

@@ -6,19 +6,19 @@ Supporting skills (all tasks): `update-docs`. Models: `mongoose-schema-safety`.
 
 ## Phase 1 — Models + context
 
-- [ ] **Task 1.1**: Organization + Membership models
+- [x] **Task 1.1**: Organization + Membership models
   - Delivers: persist orgs and per-org `roleName` (`org-admin` \| `member`)
   - Files: `api/src/orgs/organizationModel.ts`, types, `api/src/orgs/*.test.ts`
   - Blocked by: none
   - Docs: field `description`s (OpenAPI); note in `docs/reference/api.md` stub section if the page is updated later in 6.1
   - Acceptance: unit tests for compound unique index and duplicate membership rejection
-- [ ] **Task 1.2**: `orgScopedPlugin`
+- [x] **Task 1.2**: `orgScopedPlugin`
   - Delivers: required indexed `organizationId` on consumer schemas
   - Files: `api/src/orgs/orgPlugin.ts` + tests
   - Blocked by: 1.1
   - Docs: none until 6.1
   - Acceptance: save without org fails; index present
-- [ ] **Task 1.3**: Org context middleware + `OrgQueryFilter`
+- [x] **Task 1.3**: Org context middleware + `OrgQueryFilter`
   - Delivers: Q13 header matrix; lists never cross orgs
   - Files: `api/src/orgs/orgContext.ts`, `orgPermissions.ts`, `api/src/permissions.ts` (stop using `User.organizationIds`)
   - Blocked by: 1.1, 1.2
@@ -27,7 +27,7 @@ Supporting skills (all tasks): `update-docs`. Models: `mongoose-schema-safety`.
 
 ## Phase 2 — RBAC
 
-- [ ] **Task 2.1**: `organization` statements + `operator` role + membership-scoped `org-admin`
+- [x] **Task 2.1**: `organization` statements + `operator` role + membership-scoped `org-admin`
   - Delivers: platform vs org grants as in the IP tables
   - Files: `api/src/rbac/statements.ts`, `roleModel.ts`, resolve/can path for Membership `roleName`, tests
   - Blocked by: 1.3
@@ -36,13 +36,13 @@ Supporting skills (all tasks): `update-docs`. Models: `mongoose-schema-safety`.
 
 ## Phase 3 — OrgsApp routes
 
-- [ ] **Task 3.1**: Operator org CRUD + `/orgs/mine`
+- [x] **Task 3.1**: Operator org CRUD + `/orgs/mine`
   - Delivers: create/list-all/mine/read/patch/soft-delete + `onOrgAudit`
   - Files: `api/src/orgs/orgsApp.ts`, exports, OpenAPI, supertest
   - Blocked by: 2.1
   - Docs: none until 6.1
   - Acceptance: org-admin 403 on `GET /orgs`; operator 200; create does not require membership; disable/soft-delete suspends memberships
-- [ ] **Task 3.2**: Members attach / patch / delete + last-admin guards
+- [x] **Task 3.2**: Members attach / patch / delete + last-admin guards
   - Delivers: existing-user attach; no email; last `org-admin` protected
   - Files: `api/src/orgs/orgsApp.ts` + tests
   - Blocked by: 3.1
@@ -51,7 +51,7 @@ Supporting skills (all tasks): `update-docs`. Models: `mongoose-schema-safety`.
 
 ## Phase 4 — Admin backend
 
-- [ ] **Task 4.1**: Admin org routes + AdminApp tenant context
+- [x] **Task 4.1**: Admin org routes + AdminApp tenant context
   - Delivers: admin UI can call org APIs; generic admin model lists use context filter
   - Files: `admin-backend/src/*` (org registration or aliases), AdminApp queryFilter/preCreate, tests
   - Blocked by: 3.2
@@ -60,31 +60,31 @@ Supporting skills (all tasks): `update-docs`. Models: `mongoose-schema-safety`.
 
 ## Phase 5 — Admin frontend
 
-- [ ] **Task 5.1**: `OrgDirectoryScreen` (operator)
+- [x] **Task 5.1**: `OrgDirectoryScreen` (operator)
   - Delivers: all-orgs table, create, disable, enter org
   - Files: `admin-frontend/src/orgs/OrgDirectoryScreen.tsx` + tests
   - Blocked by: 4.1
   - Docs: `docs/reference/admin-frontend.md` component section
   - Acceptance: loading/error/empty; org-admin nav hidden in unit test via role prop/fixture
-- [ ] **Task 5.2**: `OrgSwitcher` + `useOrgContext` (header + URL)
+- [x] **Task 5.2**: `OrgSwitcher` + `useOrgContext` (header + URL)
   - Delivers: Q10/Q13 client behavior for org-admins and operators-in-org
   - Files: `admin-frontend/src/orgs/OrgSwitcher.tsx`, `useOrgContext.tsx`, `AdminShellLayout` slot
   - Blocked by: 5.1
   - Docs: admin-frontend reference
   - Acceptance: switching sets `X-Organization-Id` on subsequent admin queries (test with mocked api); single-org org-admin still renders org name
-- [ ] **Task 5.3**: Org settings + members table
+- [x] **Task 5.3**: Org settings + members table
   - Delivers: settings PATCH; members DataTable; add existing user; last-admin error; disabled Invite; billing placeholder
   - Files: `admin-frontend/src/orgs/OrgSettingsScreen.tsx`, `OrgMembersScreen.tsx` + tests
   - Blocked by: 5.2, 3.2
   - Docs: admin-frontend reference
   - Acceptance: Invite control disabled; billing placeholder visible; last-admin error shown
-- [ ] **Task 5.4**: Host wiring — admin-spa + example-frontend `/admin`
+- [x] **Task 5.4**: Host wiring — admin-spa + example-frontend `/admin`
   - Delivers: routes on both hosts; SDK regen
   - Files: `admin-spa/app/orgs/*`, `example-frontend/app/admin/orgs/*`, `example-frontend/store/openApiSdk.ts` (generated)
   - Blocked by: 5.3
   - Docs: `docs/reference/admin-spa.md` nav entry
   - Acceptance: `cd example-frontend && bun run sdk` compiles; both apps have `/admin/orgs` routes
-- [ ] **Task 5.5**: Frontend verification
+- [x] **Task 5.5**: Frontend verification
   - Delivers: evidence org-admin vs operator flows
   - Files: `/opt/cursor/artifacts/` (not in repo)
   - Blocked by: 5.4, 6.2
@@ -93,13 +93,13 @@ Supporting skills (all tasks): `update-docs`. Models: `mongoose-schema-safety`.
 
 ## Phase 6 — Example + docs
 
-- [ ] **Task 6.1**: Docs (same slice as behavior; can land incrementally but must be complete before Brew)
+- [x] **Task 6.1**: Docs (same slice as behavior; can land incrementally but must be complete before Brew)
   - Delivers: stranger can operate orgs from docs
   - Files: `docs/how-to/add-organizations.md`, `docs/explanation/organizations.md`, `docs/reference/api.md`, `docs/reference/admin-backend.md`, `docs/reference/admin-frontend.md`, `docs/reference/admin-spa.md`, `.rulesync/**` if agent rules need org context
   - Blocked by: 4.1 (content must match shipped routes)
   - Docs: (this task)
   - Acceptance: `bun run website:build` (or package docs check used in CI); how-to has one minimal OrgsApp + AdminApp example
-- [ ] **Task 6.2**: example-backend migration + seeds
+- [x] **Task 6.2**: example-backend migration + seeds
   - Delivers: Membership instead of `User.organizationIds`; operator + two org-admins
   - Files: `example-backend/src/models/user.ts`, `types/models/userTypes.ts`, `api/projects.ts`, `scripts/seed-*`, `access.ts`, `rbacRoles.ts`, tests
   - Blocked by: 3.2, 2.1

package/dist/docs/versioned/next/tasks/rate-limiting.md

@@ -1,7 +1,7 @@
 # Tasks: API rate limiting
 
 IP: [rate-limiting.md](../implementationPlans/rate-limiting.md)  
-**Closes:** https://github.com/FlourishHealth/terreno/issues/1187
+**Closes:** https://github.com/TerrenoLabs/terreno/issues/1187
 
 **Feature profile:** false (full IP)
 

package/dist/docs/versioned/next/tasks/support-agent.md

@@ -0,0 +1,230 @@
+# Tasks: Support answering agent (`@terreno/support`)
+
+See: [`docs/implementationPlans/support-agent.md`](../implementationPlans/support-agent.md)
+
+**Status:** Draft (Grow). Do not Pick until the IP header is **Approved**.
+
+## Instructions for the implementing agent
+
+- Load `update-docs`, `terreno-backend-api`, `backend-test-env`, `mongoose-schema-safety`,
+  and `ai-prompt-governance` (prompt tasks). Load `model-router-actions` for every route.
+- TDD: failing Bun test first, then implementation. Mock `LanguageModel` /
+  `EmbeddingModel` the way `ai/src/service/aiService.test.ts` does; never call a real
+  provider in tests.
+- Every task that changes exports or behavior updates the named docs in the same task.
+- Run `bun test --only-failures support/` (and `example-backend/` for tracer tasks), then
+  `bun run lint` on touched packages. `bun run check:knip` before Brew.
+- No `app.get` / `app.post`: routes are `modelRouter` actions. MCP surface is
+  `registerMCPTool` only — no prompts/resources (Draft upstream IP).
+- Luxon for dates; prompt strings are constants at the top of `support/src/agent/prompts.ts`.
+
+---
+
+### Phase 1: Knowledge core
+
+- [ ] **Task 1.1**: Scaffold `@terreno/support` package
+  - Delivers: `support/` workspace package that compiles and runs an empty test; root scripts
+    `support:compile` / `support:test`; package listed in `AGENTS.md` / `CLAUDE.md` / `.cursor/rules/00-root.mdc`
+  - Files: `support/package.json` (deps `@terreno/api`, `@terreno/ai`, `ai`, `zod`, `luxon`, `gray-matter` or equivalent frontmatter parser via catalog), `support/tsconfig.json`, `support/biome.jsonc`, `support/README.md`, `support/src/index.ts`, `support/src/tests/bunSetup.ts`, root `package.json`, `knip.jsonc` (only if a narrow exception is needed), `AGENTS.md`, `CLAUDE.md`, `.cursor/rules/00-root.mdc`
+  - Blocked by: none
+  - Docs: `docs/reference/support.md` (create: header + install snippet), `docs/reference/README.md` link
+  - Skills: `terreno-backend-api`, `update-docs`
+  - Acceptance: `bun run support:compile` and `bun run support:test` succeed; `bun run check:knip` clean; package resolvable from `example-backend` as `workspace:*`
+
+- [ ] **Task 1.2**: Knowledge types + models
+  - Delivers: exported `KnowledgeDocument`, `KnowledgeSource`, `Retriever`, `RetrievedChunk`; Mongoose models `SupportDocument`, `SupportChunk` with indexes from the IP (unique `{sourceId, externalId}`, `{documentId, order}`, text index on chunk `text` + `heading`)
+  - Files: `support/src/knowledge/types.ts`, `support/src/models/supportDocument.ts`, `support/src/models/supportChunk.ts`, `support/src/modelTypes.ts`, `support/src/tests/models.test.ts`
+  - Blocked by: Task 1.1
+  - Docs: `docs/reference/support.md` (Models + Interfaces sections)
+  - Skills: `mongoose-schema-safety`, `terreno-backend-api`, `update-docs`
+  - Acceptance: test inserts two documents with the same `{sourceId, externalId}` and the second fails with a duplicate-key error; `SupportChunk.collection.indexes()` includes a text index
+
+- [ ] **Task 1.3**: Markdown chunker
+  - Delivers: `chunkMarkdown({title, body, maxTokens = 800, overlapTokens = 100})` — heading-aware, keeps code fences intact, returns `[{order, heading, text}]`
+  - Files: `support/src/knowledge/chunker.ts`, `support/src/knowledge/chunker.test.ts`
+  - Blocked by: Task 1.1
+  - Docs: `docs/explanation/support-agent.md` (create: Retrieval section, chunking paragraph)
+  - Skills: `update-docs`
+  - Acceptance: a doc with three H2 sections yields ≥ 3 chunks each carrying its heading; a 5,000-token section splits with overlap and no chunk exceeds `maxTokens`; a fenced code block is never split mid-fence
+
+- [ ] **Task 1.4**: `markdownDocsSource` + `SupportIndexer` (lexical only)
+  - Delivers: `markdownDocsSource({dir, id = "docs", watch})` parsing frontmatter (`title`, `slug`, `audience`, `tags`, `related`); `SupportIndexer.reindex({sourceId?})` that upserts `SupportDocument` by hash, replaces chunks only when the hash changed, marks missing docs `stale`, and returns `{indexed, unchanged, stale}`
+  - Files: `support/src/knowledge/sources/markdownDocsSource.ts`, `support/src/knowledge/indexer.ts`, `support/src/tests/indexer.test.ts`, `support/src/tests/fixtures/kb/*.md`
+  - Blocked by: Task 1.2, Task 1.3
+  - Docs: `docs/how-to/add-support-knowledge.md` (create: `support/kb` convention + frontmatter table), `docs/how-to/README.md` link
+  - Skills: `terreno-backend-api`, `update-docs`
+  - Acceptance: **AC2** — first `reindex()` indexes every fixture; second reports all `unchanged` and chunk count is identical; editing one fixture body re-chunks only that document; deleting a fixture marks it `stale`
+
+- [ ] **Task 1.5**: Lexical retriever + `SupportAgent.search`
+  - Delivers: `lexicalRetriever` over `$text` with `sourceIds` filter, `status: "active"` filter, and post-filter through `source.isVisible` / global `isVisible`; `SupportAgent.search({query, user, limit, sourceIds})` returning excerpts via `excerptBody`-style helper
+  - Files: `support/src/knowledge/retrievers/lexicalRetriever.ts`, `support/src/agent/supportAgent.ts`, `support/src/agent/excerpt.ts`, `support/src/tests/search.test.ts`
+  - Blocked by: Task 1.4
+  - Docs: `docs/explanation/support-agent.md` (Visibility section)
+  - Skills: `terreno-backend-api`, `update-docs`
+  - Acceptance: **AC3** — `search("archive todo")` ranks the archive fixture first; a source whose `isVisible` returns false for the test user contributes zero results; `stale` documents never appear
+
+---
+
+### Phase 2: Answering + REST
+
+- [ ] **Task 2.1**: Prompts + `SupportAgent.ask` (mocked model)
+  - Delivers: `SUPPORT_SYSTEM_PROMPT`, `SUPPORT_ANSWER_SCHEMA` (zod) constants; `ask({question, user, conversationId?, channel})` → retrieve → `aiService.generateJsonObject` → `SupportAnswer`; empty retrieval short-circuits to `shouldEscalate: true` without a model call
+  - Files: `support/src/agent/prompts.ts`, `support/src/agent/supportAgent.ts`, `support/src/tests/ask.test.ts`
+  - Blocked by: Task 1.5
+  - Docs: `docs/explanation/support-agent.md` (Answering + grounding section); prompt governance note in `docs/reference/support.md`
+  - Skills: `ai-prompt-governance`, `terreno-backend-api`, `update-docs`
+  - Acceptance: **AC4** — mock model receives a system prompt containing each retrieved chunk's text and nothing from non-retrieved fixtures; returned `sources` ⊆ retrieved documents; **AC5** (model part) — zero hits → no `doGenerate` call, `shouldEscalate: true`
+
+- [ ] **Task 2.2**: `SupportQuestion` log, feedback, escalation hook, conversation history
+  - Delivers: `SupportQuestion` model; every `ask` writes one row with `ownerId` for an authenticated asker, `channel`, `latencyMs`, `aiRequestId`; `onEscalate` invoked once when `shouldEscalate`; `conversationId` threads only the last 5 turns owned by the current authenticated user into the prompt; anonymous asks are single-turn; `recordFeedback({questionId, user, rating, comment})`
+  - Files: `support/src/models/supportQuestion.ts`, `support/src/agent/supportAgent.ts`, `support/src/tests/questionLog.test.ts`
+  - Blocked by: Task 2.1
+  - Docs: `docs/reference/support.md` (SupportQuestion model, hooks table)
+  - Skills: `mongoose-schema-safety`, `terreno-backend-api`, `update-docs`
+  - Acceptance: **AC5** (log + hook part) — escalated ask persists a `SupportQuestion` and calls a spy `onEscalate` exactly once; second ask by the same user with the same `conversationId` includes the first Q/A in the mock's prompt, while another user's ask with that id has no history; feedback stores `{rating, comment, at}`
+
+- [ ] **Task 2.3**: `SupportApp` plugin + REST routes
+  - Delivers: `SupportApp implements TerrenoPlugin` (constructor per IP; boot-time non-blocking `reindex()`); `modelRouter("/support/questions", SupportQuestion, {collectionActions: {ask, search}, instanceActions: {feedback}, permissions, allowAnonymous})`; public access requires `permissions.ask: [Permissions.IsAny]` with `allowAnonymous: true`; `modelRouter("/support/documents", SupportDocument, {collectionActions: {reindex}})` admin-only; OpenAPI registered
+  - Files: `support/src/supportApp.ts`, `support/src/routes.ts`, `support/src/tests/routes.test.ts`, `support/src/index.ts`
+  - Blocked by: Task 2.2
+  - Docs: `docs/reference/support.md` (REST table, constructor options); `docs/explanation/model-router-actions.md` gets a one-line cross-link example
+  - Skills: `model-router-actions`, `terreno-backend-api`, `backend-test-env`, `update-docs`
+  - Acceptance: **AC6** — supertest: unauthenticated `ask` 401; authenticated 200 with `SupportAnswer` shape; `permissions.ask: [Permissions.IsAny]` with `allowAnonymous: true` → anonymous 200; `permissions.ask: []` → 405; non-owner `feedback` 403; non-admin `reindex` 403; admin `reindex` returns indexer summary
+
+- [ ] **Task 2.4**: Example-backend tracer (kb docs + wiring + SDK)
+  - Delivers: `example-backend/support/kb/` with ≥ 3 docs about todos (create, complete, archive); `SupportApp` registered in `server.ts` with `markdownDocsSource`; `AIService` from existing `example-backend/src/api/ai.ts` provider; example-frontend SDK regenerated
+  - Files: `example-backend/support/kb/*.md`, `example-backend/src/api/support.ts`, `example-backend/src/server.ts`, `example-backend/src/api/support.test.ts`, `example-backend/package.json`, `example-frontend/store/openApiSdk.ts` (generated only)
+  - Blocked by: Task 2.3
+  - Docs: `example-backend/README.md` (Support section); `docs/how-to/add-support-knowledge.md` (worked example)
+  - Skills: `terreno-backend-api`, `generate-sdk`, `update-docs`
+  - Acceptance: example-backend test boots the app, waits for reindex, and `POST /support/questions/search {query: "archive"}` returns the archive doc; `bun run sdk` diff contains `usePostSupportQuestionsAskMutation` (or the generated equivalent) and nothing hand-edited
+
+---
+
+### Phase 3: MCP tools
+
+- [ ] **Task 3.1**: `support_ask` + `support_search` tools
+  - Delivers: `registerSupportMCPTools({agent, permissions})` called by `SupportApp.register`; zod schemas per IP; handlers reuse `SupportAgent` with `channel: "mcp"`; permission denial returns `isError: true`
+  - Files: `support/src/mcpTools.ts`, `support/src/tests/mcpTools.test.ts`, `support/src/supportApp.ts`
+  - Blocked by: Task 2.3
+  - Docs: `docs/how-to/expose-mcp-tools.md` (Support tools subsection); `docs/reference/support.md` (MCP tools table)
+  - Skills: `terreno-backend-api`, `update-docs`
+  - Acceptance: **AC7** (part) — MCP integration test (pattern: `api/src/mcp/integration.test.ts`) as authenticated user: `tools/list` contains `support_ask`, `support_search`; `support_ask` returns text JSON parseable into `SupportAnswer` and a `SupportQuestion` row with `channel: "mcp"`; unauthenticated call is rejected per MCP auth
+
+- [ ] **Task 3.2**: `support_get_document` + `support_list_sources`
+  - Delivers: full markdown + metadata for a visible document; sources summary `{id, label, documentCount, lastIndexedAt}`
+  - Files: `support/src/mcpTools.ts`, `support/src/agent/supportAgent.ts` (`getDocument`, `listSources`), `support/src/tests/mcpTools.test.ts`
+  - Blocked by: Task 3.1
+  - Docs: `docs/reference/support.md` (tools table complete)
+  - Skills: `terreno-backend-api`, `update-docs`
+  - Acceptance: **AC7** (rest) — unknown `documentId` → `isError: true`; hidden document (visibility false) → `isError: true` with no content leak; `support_list_sources` counts match `SupportDocument` `active` rows per source
+
+---
+
+### Phase 4: Sources
+
+- [ ] **Task 4.1**: `modelSource` + example-backend `BugReport` tracer
+  - Delivers: `modelSource({id, model, filter, toDocument, isVisible})`; example-backend `BugReport` model (`title`, `description`, `resolution`, `status`) with seed data and `modelSource` over resolved reports
+  - Files: `support/src/knowledge/sources/modelSource.ts`, `support/src/tests/modelSource.test.ts`, `example-backend/src/models/bugReport.ts`, `example-backend/src/modelInterfaces.ts`, `example-backend/src/api/support.ts`, `example-backend/src/scripts/seed-test-data.ts`, `example-backend/src/api/support.test.ts`
+  - Blocked by: Task 1.5
+  - Docs: `docs/how-to/add-support-knowledge.md` (Model source section: bug reports and resolutions)
+  - Skills: `mongoose-schema-safety`, `terreno-backend-api`, `update-docs`
+  - Acceptance: **AC9** — resolved reports indexed, open excluded; `search("crash on login")` returns the resolution excerpt
+
+- [ ] **Task 4.2**: `announcementsSource`
+  - Delivers: adapter over the `Announcement` model: `published` for everyone, `archived` with `includeArchived`, drafts never; `post("save")` hook triggers `reindex({sourceId})` for that document; `isVisible` delegates to an optional `matchAudience` passed in
+  - Files: `support/src/knowledge/sources/announcementsSource.ts`, `support/src/tests/announcementsSource.test.ts` (dev-dependency on `@terreno/announcements` for the test model only), `example-backend/src/api/support.ts`
+  - Blocked by: Task 1.5, **merge of [PR #1284](https://github.com/TerrenoLabs/terreno/pull/1284)**
+  - Docs: `docs/how-to/add-support-knowledge.md` (Announcements section); `docs/reference/announcements.md` (link to support integration)
+  - Skills: `terreno-backend-api`, `update-docs`
+  - Acceptance: **AC8** — status matrix test; publishing an announcement results in a new `SupportDocument` after the save hook resolves, without a manual `reindex()`
+
+- [ ] **Task 4.3**: Reindex lifecycle hardening
+  - Delivers: `watch: true` on `markdownDocsSource` re-indexes a changed file (debounced); boot reindex never blocks `TerrenoApp.start()`; indexer errors from one source do not abort others and are logged with `logger.warn`
+  - Files: `support/src/knowledge/indexer.ts`, `support/src/knowledge/sources/markdownDocsSource.ts`, `support/src/tests/indexerLifecycle.test.ts`
+  - Blocked by: Task 2.3, Task 4.1
+  - Docs: `docs/explanation/support-agent.md` (Indexing lifecycle section)
+  - Skills: `terreno-backend-api`, `update-docs`
+  - Acceptance: a source whose `list()` throws leaves other sources indexed and the summary reports it; file change under `watch` produces a new `contentHash` within the debounce window in a test using a temp dir
+
+---
+
+### Phase 5: Embeddings + hybrid retrieval
+
+- [ ] **Task 5.1**: `embeddingModel` option + chunk embeddings
+  - Delivers: indexer calls `embedMany` in batches when `embeddingModel` is set; stores `embedding` + `embeddingModelId`; re-embeds only when the model id differs or the chunk is new; embedding failure logs `warn` and leaves chunks lexical-only
+  - Files: `support/src/knowledge/indexer.ts`, `support/src/knowledge/embeddings.ts`, `support/src/tests/embeddings.test.ts`
+  - Blocked by: Task 1.4
+  - Docs: `docs/reference/support.md` (options: `embeddingModel`); `docs/reference/environment-variables.md` (example-backend key used for embeddings)
+  - Skills: `terreno-backend-api`, `update-docs`
+  - Acceptance: **AC10** (storage part) — mocked `EmbeddingModel` yields embeddings on every chunk; switching `modelId` re-embeds all; no `embeddingModel` → no `embedding` field
+
+- [ ] **Task 5.2**: Vector + hybrid retrievers with RRF
+  - Delivers: `vectorRetriever` (in-process cosine; `$vectorSearch` when `atlasVectorSearchIndex` set), `hybridRetriever` fusing lexical + vector by reciprocal rank fusion; `SupportApp` picks hybrid when embeddings exist, lexical otherwise; `retriever` option overrides
+  - Files: `support/src/knowledge/retrievers/vectorRetriever.ts`, `support/src/knowledge/retrievers/hybridRetriever.ts`, `support/src/supportApp.ts`, `support/src/tests/hybridRetriever.test.ts`
+  - Blocked by: Task 5.1, Task 1.5
+  - Docs: `docs/explanation/support-agent.md` (Retrieval: lexical vs hybrid vs Atlas); `docs/reference/support.md` (`atlasVectorSearchIndex`, `retriever`)
+  - Skills: `terreno-backend-api`, `update-docs`
+  - Acceptance: **AC10** (ranking part) — with deterministic mock embeddings a chunk with zero lexical overlap but nearest vector lands in top 3; custom `retriever` is called instead of the default; `$vectorSearch` path is unit-tested by asserting the aggregation pipeline shape (no Atlas in tests)
+
+- [ ] **Task 5.3**: Example-backend embedding wiring
+  - Delivers: `example-backend` passes `google.textEmbedding(...)` when the Google key is present (reuse provider loading in `example-backend/src/api/ai.ts`), otherwise omits `embeddingModel`; README documents both modes
+  - Files: `example-backend/src/api/support.ts`, `example-backend/src/api/ai.ts`, `example-backend/README.md`
+  - Blocked by: Task 5.2, Task 2.4
+  - Docs: `docs/reference/environment-variables.md`; `example-backend/README.md`
+  - Skills: `terreno-backend-api`, `update-docs`
+  - Acceptance: example-backend test with env unset boots lexical-only and `search` still works; a unit test asserts the embedding model is constructed only when the key is set
+
+---
+
+### Phase 6: AI authoring loop
+
+- [ ] **Task 6.1**: `terreno-support check` CLI
+  - Delivers: bin `terreno-support` with `check [dir]` validating frontmatter (`title`, `slug`), duplicate slugs, empty bodies, zero-chunk files; JSON and human output; non-zero exit on failure
+  - Files: `support/src/cli.ts`, `support/src/knowledge/validateKb.ts`, `support/src/tests/cli.test.ts`, `support/package.json` (`bin`), example-backend `package.json` script `support:check`
+  - Blocked by: Task 1.4
+  - Docs: `docs/how-to/add-support-knowledge.md` (Validate section); `docs/reference/support.md` (CLI)
+  - Skills: `update-docs`
+  - Acceptance: **AC11** — fixtures for pass and each failure class; failing output names the file and rule
+
+- [ ] **Task 6.2**: `write-support-docs` skill
+  - Delivers: plugin skill instructing agents to add/update `support/kb/<slug>.md` for user-visible changes, run `terreno-support check`, mention the doc in the PR; Roast criterion text; generated Claude copy via `bun run skills:sync`
+  - Files: `plugins/terreno-planning/skills/write-support-docs/SKILL.md`, generated `plugins/terreno-claude/skills/write-support-docs/SKILL.md`, `skills/` output, `plugins/README.md` skill list, `.rulesync/rules` or Pick guidance reference (`plugins/terreno-planning/skills/terreno-2-pick/SKILL.md` supporting-skills mention)
+  - Blocked by: Task 6.1
+  - Docs: `docs/reference/lifecycle-plugin.md` (skill table row); `docs/how-to/install-agent-skills.md` if it enumerates skills
+  - Skills: `update-agent-docs`, `update-docs`
+  - Acceptance: **AC14** — `bun run skills:sync` produces the generated copies with no manual edits; `bun run check:lifecycle-skills` passes; skill has a reliable trigger line and completion criteria per `update-agent-docs`
+
+- [ ] **Task 6.3**: Knowledge gaps + admin contribution
+  - Delivers: `GET /support/questions/gaps` collection action grouping `low` confidence and `down` feedback by normalized question (`{normalizedQuestion, count, lastAskedAt, sampleQuestions, sampleQuestionIds}`); `adminContribution()` registering `SupportQuestion` and `SupportDocument` read-only
+  - Files: `support/src/routes.ts`, `support/src/agent/gaps.ts`, `support/src/supportApp.ts`, `support/src/tests/gaps.test.ts`
+  - Blocked by: Task 2.3
+  - Docs: `docs/how-to/add-support-knowledge.md` (Close the loop: gaps → new doc); `docs/reference/support.md` (gaps action, admin models)
+  - Skills: `model-router-actions`, `building-admin-interfaces`, `update-docs`
+  - Acceptance: **AC12** — two `low` asks with case/punctuation variants collapse into one row with `count: 2`; non-admin 403; admin app lists both models
+
+---
+
+### Phase 7: Docs consolidation
+
+- [ ] **Task 7.1**: Explanation, reference, how-to reconciliation + Notion how-to
+  - Delivers: complete `docs/explanation/support-agent.md` (why RAG in-process, source contract, visibility, authoring loop, relation to announcements help API and hosted MCP), complete `docs/reference/support.md`, `docs/how-to/plug-in-notion-knowledge.md` with a full `KnowledgeSource` implementation using `@notionhq/client` that typechecks in a docs compile test, index links in all three READMEs, root `README.md` package table
+  - Files: the four docs pages, `docs/{explanation,reference,how-to}/README.md`, `README.md`, `support/src/tests/docsSnippets.test.ts` (compiles the Notion snippet against exported types with a stubbed client)
+  - Blocked by: Task 3.2, Task 4.2, Task 5.2, Task 6.3
+  - Docs: all of the above
+  - Skills: `update-docs`, `docs-audit`
+  - Acceptance: **AC13** — pages exist and are linked; `docs-audit` reports no drift for `@terreno/support`; Notion snippet compiles; no page documents prompts/resources as shipped
+
+---
+
+## Frontier after Approve
+
+Unblocked: **Task 1.1**.  
+After 1.1: 1.2, 1.3 in parallel.  
+1.4 after 1.2 + 1.3; 1.5 after 1.4.  
+Phase 2 is linear (2.1 → 2.2 → 2.3 → 2.4).  
+3.1 after 2.3; 3.2 after 3.1.  
+4.1 and 5.1 can start after 1.5 / 1.4 in parallel with Phase 2.  
+4.2 additionally waits for PR #1284 to merge — if it has not merged when the frontier reaches it, skip it and continue; Brew notes the gap.  
+6.1 after 1.4; 6.2 after 6.1; 6.3 after 2.3.  
+7.1 last.

package/dist/docs/versioned/next/tasks/web-ssr-and-admin-spa.md

@@ -4,7 +4,7 @@ See: [`docs/implementationPlans/web-ssr-and-admin-spa.md`](../implementationPlan
 
 **RTK deprecation flag:** **Partial.** Phase 0 must run after PR #869 merges, because whether the local-first client can be kept out of the server render path is the main feasibility question. Tasks marked `[RTK]` touch the data layer directly.
 
-**Prerequisite:** Expo SDK ≥ 55. The repo catalog is on `~54.0.29`; PR [#779](https://github.com/flourishhealth/terreno/pull/779) upgrades to SDK 56. Verify the merged Expo version before starting and stop if it is below 55.
+**Prerequisite:** Expo SDK ≥ 55. The repo catalog is on `~54.0.29`; PR [#779](https://github.com/TerrenoLabs/terreno/pull/779) upgrades to SDK 56. Verify the merged Expo version before starting and stop if it is below 55.
 
 ## Instructions for the implementing agent
 

package/dist/docs/versioned/next/tutorials/README.md

@@ -4,4 +4,4 @@ Learning-oriented, hands-on lessons. Start here if you are new to Terreno.
 
 ## Contents
 
-- [Getting started](getting-started.md) — Install, run the examples, and see the stack in action
+- [Getting started](getting-started.md) — Scaffold a new app with `create-terreno-app`, run it locally, or explore monorepo examples