austere-axi 0.7.0 → 0.7.3

package/dist/cli.mjs

@@ -618,7 +618,7 @@ var init_paths = __esm({
     HERE = path.dirname(fileURLToPath(import.meta.url));
     BUNDLED = true;
     ASSET_DIR = BUNDLED ? HERE : path.resolve(HERE, "../../dist");
-    VERSION = true ? "0.7.0" : packageVersion();
+    VERSION = true ? "0.7.3" : packageVersion();
     CLI_ENTRY = BUNDLED ? fileURLToPath(import.meta.url) : path.resolve(HERE, "main.ts");
     securedDir = null;
   }
@@ -1907,38 +1907,177 @@ var init_sessions = __esm({
   }
 });
 
-// src/cli/export.ts
+// src/cli/assets.ts
 import fs9 from "node:fs";
 import path8 from "node:path";
+function resolveSibling(dir, rel, maxBytes = MAX_ASSET_BYTES) {
+  if (rel.includes("\0")) return { ok: false, reason: "outside" };
+  const file3 = path8.resolve(dir, rel);
+  if (!file3.startsWith(dir + path8.sep)) return { ok: false, reason: "outside" };
+  if (rel.split(/[/\\]/).some((p) => p !== "." && p.startsWith("."))) return { ok: false, reason: "hidden" };
+  try {
+    const realDir = fs9.realpathSync(dir);
+    const real = fs9.realpathSync(file3);
+    if (!real.startsWith(realDir + path8.sep)) return { ok: false, reason: "outside" };
+    if (path8.relative(realDir, real).split(path8.sep).some((p) => p.startsWith("."))) return { ok: false, reason: "hidden" };
+    const st2 = fs9.statSync(real);
+    if (!st2.isFile()) return { ok: false, reason: "missing" };
+    if (st2.size > maxBytes) return { ok: false, reason: "too-large" };
+    return { ok: true, file: real, size: st2.size };
+  } catch {
+    return { ok: false, reason: "missing" };
+  }
+}
+var MAX_ASSET_BYTES;
+var init_assets = __esm({
+  "src/cli/assets.ts"() {
+    "use strict";
+    MAX_ASSET_BYTES = 64 * 1024 * 1024;
+  }
+});
+
+// src/cli/export.ts
+import fs10 from "node:fs";
+import path9 from "node:path";
 function inlineScript(code) {
   return `<script>${code.replace(/<\/script/gi, "<\\/script")}</script>`;
 }
-function exportHtml(html) {
+function stringAt(src, i) {
+  const q2 = src[i];
+  let value = "";
+  for (let j = i + 1; j < src.length; j++) {
+    const c = src[j];
+    if (c === "\\" && j + 1 < src.length) value += src[++j];
+    else if (c === q2) return { start: i, end: j + 1, value };
+    else value += c;
+  }
+  return null;
+}
+function skipBlank(src, i) {
+  for (; ; ) {
+    while (i < src.length && /\s/.test(src[i])) i++;
+    if (src[i] === "#" || src[i] === "/" && src[i + 1] === "/") while (i < src.length && src[i] !== "\n") i++;
+    else return i;
+  }
+}
+function imageSources(src) {
+  const out = [];
+  let i = 0;
+  while (i < src.length) {
+    const c = src[i];
+    if (c === '"' || c === "'") {
+      i = stringAt(src, i)?.end ?? src.length;
+    } else if (c === "#" || c === "/" && src[i + 1] === "/") {
+      while (i < src.length && src[i] !== "\n") i++;
+    } else if (/[A-Za-z_$]/.test(c)) {
+      let j = i + 1;
+      while (j < src.length && /[\w$]/.test(src[j])) j++;
+      const word = src.slice(i, j);
+      i = j;
+      if (word !== "Image") continue;
+      j = skipBlank(src, j);
+      if (src[j] !== "(") continue;
+      let k = j + 1;
+      let depth = 0;
+      while (k < src.length) {
+        const d = src[k];
+        if (d === '"' || d === "'") k = stringAt(src, k)?.end ?? src.length;
+        else if (d === "#" || d === "/" && src[k + 1] === "/") k = skipBlank(src, k);
+        else if (d === "(" || d === "[" || d === "{") {
+          depth++;
+          k++;
+        } else if (d === ")" || d === "]" || d === "}") {
+          if (depth === 0) break;
+          depth--;
+          k++;
+        } else if (d === "," && depth === 0) break;
+        else k++;
+      }
+      if (src[k] !== ",") continue;
+      k = skipBlank(src, k + 1);
+      if (src[k] === '"' || src[k] === "'") {
+        const lit = stringAt(src, k);
+        if (lit) out.push(lit);
+      }
+    } else i++;
+  }
+  return out;
+}
+function inlineImages(program, dir, notices) {
+  let out = "";
+  let at2 = 0;
+  const seen = /* @__PURE__ */ new Set();
+  const warn = (src, why) => {
+    if (!seen.has(src)) notices.push(`Image "${src}" is not inlined: ${why}. Keep it next to the exported file.`);
+    seen.add(src);
+  };
+  for (const lit of imageSources(program)) {
+    if (/^(?:[a-z][a-z0-9+.-]*:|\/\/)/i.test(lit.value)) continue;
+    let rel = lit.value.replace(/[?#].*$/, "");
+    try {
+      rel = decodeURIComponent(rel);
+    } catch {
+    }
+    const type = IMAGE_TYPES[path9.extname(rel).toLowerCase()];
+    if (!type) {
+      warn(lit.value, "not a png, jpg, gif, webp, svg or avif file");
+      continue;
+    }
+    const sib = resolveSibling(dir, rel, MAX_INLINE_BYTES);
+    if (!sib.ok) {
+      const why = { missing: "no such file next to the page", outside: "it is outside the page's folder", hidden: "hidden files are never read", "too-large": "it is over 10 MB" }[sib.reason];
+      warn(lit.value, why);
+      continue;
+    }
+    let bytes;
+    try {
+      bytes = fs10.readFileSync(sib.file);
+    } catch {
+      warn(lit.value, "it cannot be read (permissions?)");
+      continue;
+    }
+    out += program.slice(at2, lit.start) + JSON.stringify(`data:${type};base64,${bytes.toString("base64")}`);
+    at2 = lit.end;
+  }
+  return out + program.slice(at2);
+}
+function exportHtml(html, dir) {
   const art = readArtifact(html);
   const notices = [];
   if (art.program == null) throw new Error('no <script type="text/openui"> block');
   let tags = "";
   if (/\bMermaid\s*\(/.test(art.program)) {
-    tags += inlineScript(fs9.readFileSync(assetPath("mermaid.min.js"), "utf8")) + "\n";
+    tags += inlineScript(fs10.readFileSync(assetPath("mermaid.min.js"), "utf8")) + "\n";
   }
-  tags += inlineScript(fs9.readFileSync(assetPath("austere.js"), "utf8"));
-  for (const p of implicitPacks(art.program)) tags += "\n" + inlineScript(fs9.readFileSync(path8.join(p.dir, "pack.js"), "utf8"));
+  tags += inlineScript(fs10.readFileSync(assetPath("austere.js"), "utf8"));
+  for (const p of implicitPacks(art.program)) tags += "\n" + inlineScript(fs10.readFileSync(path9.join(p.dir, "pack.js"), "utf8"));
   const packs = pagePacks(html);
-  for (const p of packs.installed) tags += "\n" + inlineScript(fs9.readFileSync(path8.join(p.dir, "pack.js"), "utf8"));
+  for (const p of packs.installed) tags += "\n" + inlineScript(fs10.readFileSync(path9.join(p.dir, "pack.js"), "utf8"));
   for (const p of [...packs.missing, ...packs.mismatched]) {
     notices.push(`Pack ${p.name}@${p.version} is not installed here, so the exported page loads it from the CDN (needs network).`);
   }
-  const out = rewriteRuntime(html, () => tags);
-  const rel = art.program.match(/Image\([^)]*?["'](?!https?:|data:)([^"']+\.(?:png|jpe?g|gif|webp|svg|avif))["']/gi);
-  if (rel) notices.push("Images referenced by relative path are not inlined; keep them next to the exported file.");
-  return { html: out, notices };
+  const inlined = inlineImages(art.program, dir, notices);
+  const withImages = inlined === art.program ? html : html.slice(0, art.programStart) + inlined + html.slice(art.programEnd);
+  return { html: rewriteRuntime(withImages, () => tags), notices };
 }
+var IMAGE_TYPES, MAX_INLINE_BYTES;
 var init_export = __esm({
   "src/cli/export.ts"() {
     "use strict";
     init_artifact();
+    init_assets();
     init_paths();
     init_packs();
+    IMAGE_TYPES = {
+      ".png": "image/png",
+      ".jpg": "image/jpeg",
+      ".jpeg": "image/jpeg",
+      ".gif": "image/gif",
+      ".webp": "image/webp",
+      ".svg": "image/svg+xml",
+      ".avif": "image/avif"
+    };
+    MAX_INLINE_BYTES = 10 * 1024 * 1024;
   }
 });
 
@@ -1953,8 +2092,8 @@ __export(install_exports, {
   removePack: () => removePack,
   untar: () => untar
 });
-import fs11 from "node:fs";
-import path10 from "node:path";
+import fs12 from "node:fs";
+import path11 from "node:path";
 import zlib from "node:zlib";
 import crypto4 from "node:crypto";
 function registryUrl() {
@@ -2091,15 +2230,15 @@ function readTarball(tgz, label) {
   return { packJs, catalog, packageJson: files.get("package.json") || null };
 }
 function fromTarball(file3) {
-  const abs = path10.resolve(file3.replace(/^~(?=[\\/])/, process.env.HOME || ""));
-  if (!fs11.existsSync(abs)) throw new Error(`no such file: ${abs}`);
-  return { ...readTarball(fs11.readFileSync(abs), path10.basename(abs)), source: "tarball", resolved: abs };
+  const abs = path11.resolve(file3.replace(/^~(?=[\\/])/, process.env.HOME || ""));
+  if (!fs12.existsSync(abs)) throw new Error(`no such file: ${abs}`);
+  return { ...readTarball(fs12.readFileSync(abs), path11.basename(abs)), source: "tarball", resolved: abs };
 }
 function fromFolder(dir) {
-  const abs = path10.resolve(dir.replace(/^~(?=[\\/])/, process.env.HOME || ""));
-  if (!fs11.existsSync(abs)) throw new Error(`no such folder: ${abs}`);
-  if (fs11.statSync(abs).isFile()) return fromTarball(abs);
-  const read = (rel) => fs11.existsSync(path10.join(abs, rel)) ? fs11.readFileSync(path10.join(abs, rel)) : null;
+  const abs = path11.resolve(dir.replace(/^~(?=[\\/])/, process.env.HOME || ""));
+  if (!fs12.existsSync(abs)) throw new Error(`no such folder: ${abs}`);
+  if (fs12.statSync(abs).isFile()) return fromTarball(abs);
+  const read = (rel) => fs12.existsSync(path11.join(abs, rel)) ? fs12.readFileSync(path11.join(abs, rel)) : null;
   const packJs = read("dist/pack.js");
   const catalog = read("dist/catalog.json");
   if (!packJs || !catalog) throw new Error(`${abs} has no dist/pack.js and dist/catalog.json: run \`austere-axi components build ${dir}\` first`);
@@ -2139,10 +2278,10 @@ async function addPack(spec, { trust = false } = {}) {
   }
   const got = local ? fromFolder(spec) : await fromRegistry(spec);
   if (got.source === "tarball" && !trust) {
-    const peek = parseCatalog(got.catalog, path10.basename(got.resolved));
+    const peek = parseCatalog(got.catalog, path11.basename(got.resolved));
     throw Object.assign(
       new Error(
-        `${path10.basename(got.resolved)} (${peek.pack}) comes from a file, not the registry: its code would run inside your review pages. Rerun with --trust once you have looked at it.`
+        `${path11.basename(got.resolved)} (${peek.pack}) comes from a file, not the registry: its code would run inside your review pages. Rerun with --trust once you have looked at it.`
       ),
       { code: "untrusted" }
     );
@@ -2167,14 +2306,14 @@ async function addPack(spec, { trust = false } = {}) {
   }
   const lock = readLock();
   const previous = lock.packs[cat.pack];
-  const dir = path10.join(packsDir(), packDirName(cat.pack, cat.version));
-  fs11.rmSync(dir, { recursive: true, force: true });
-  fs11.mkdirSync(dir, { recursive: true });
-  fs11.writeFileSync(path10.join(dir, "pack.js"), got.packJs);
-  fs11.writeFileSync(path10.join(dir, "catalog.json"), got.catalog);
-  if (got.packageJson) fs11.writeFileSync(path10.join(dir, "package.json"), got.packageJson);
+  const dir = path11.join(packsDir(), packDirName(cat.pack, cat.version));
+  fs12.rmSync(dir, { recursive: true, force: true });
+  fs12.mkdirSync(dir, { recursive: true });
+  fs12.writeFileSync(path11.join(dir, "pack.js"), got.packJs);
+  fs12.writeFileSync(path11.join(dir, "catalog.json"), got.catalog);
+  if (got.packageJson) fs12.writeFileSync(path11.join(dir, "package.json"), got.packageJson);
   if (previous && previous.version !== cat.version) {
-    fs11.rmSync(path10.join(packsDir(), packDirName(cat.pack, previous.version)), { recursive: true, force: true });
+    fs12.rmSync(path11.join(packsDir(), packDirName(cat.pack, previous.version)), { recursive: true, force: true });
   }
   lock.packs[cat.pack] = {
     version: cat.version,
@@ -2194,7 +2333,7 @@ function removePack(name) {
   if (!entry) return null;
   delete lock.packs[name];
   writeLock(lock);
-  fs11.rmSync(path10.join(packsDir(), packDirName(name, entry.version)), { recursive: true, force: true });
+  fs12.rmSync(path11.join(packsDir(), packDirName(name, entry.version)), { recursive: true, force: true });
   return { name, version: entry.version };
 }
 var MAX_TARBALL, MAX_PACK_JS;
@@ -2215,8 +2354,8 @@ __export(pack_dev_exports, {
   buildPackDir: () => buildPackDir,
   newPack: () => newPack
 });
-import fs12 from "node:fs";
-import path11 from "node:path";
+import fs13 from "node:fs";
+import path12 from "node:path";
 import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
 function packageJson(name) {
@@ -2253,9 +2392,9 @@ Publish with \`npm publish\` after \`npm run build\`. Others install it with
 }
 function newPack(dir, { name } = {}) {
   if (!dir) throw new Error("new needs a folder: austere-axi components new austere-pack-milestones");
-  const abs = path11.resolve(dir);
-  if (fs12.existsSync(abs) && fs12.readdirSync(abs).length) throw new Error(`${abs} is not empty`);
-  const pkgName = name || path11.basename(abs).toLowerCase().replace(/[^a-z0-9._-]+/g, "-");
+  const abs = path12.resolve(dir);
+  if (fs13.existsSync(abs) && fs13.readdirSync(abs).length) throw new Error(`${abs} is not empty`);
+  const pkgName = name || path12.basename(abs).toLowerCase().replace(/[^a-z0-9._-]+/g, "-");
   if (!isValidPackName(pkgName)) throw new Error(`${JSON.stringify(pkgName)} is not an npm package name; pass --name`);
   const files = {
     "package.json": JSON.stringify(packageJson(pkgName), null, 2) + "\n",
@@ -2264,13 +2403,13 @@ function newPack(dir, { name } = {}) {
     ...TEMPLATE
   };
   for (const [rel, text] of Object.entries(files)) {
-    fs12.mkdirSync(path11.dirname(path11.join(abs, rel)), { recursive: true });
-    fs12.writeFileSync(path11.join(abs, rel), text);
+    fs13.mkdirSync(path12.dirname(path12.join(abs, rel)), { recursive: true });
+    fs13.writeFileSync(path12.join(abs, rel), text);
   }
   return { dir: abs, name: pkgName, files: Object.keys(files) };
 }
 async function findEsbuild(dir) {
-  for (const base of [path11.join(dir, "package.json"), path11.join(process.cwd(), "package.json"), import.meta.url]) {
+  for (const base of [path12.join(dir, "package.json"), path12.join(process.cwd(), "package.json"), import.meta.url]) {
     try {
       const resolved = createRequire(base).resolve("esbuild");
       const esbuild = await import(pathToFileURL(resolved).href);
@@ -2281,8 +2420,8 @@ async function findEsbuild(dir) {
   return null;
 }
 async function buildPackDir(dir = ".") {
-  const abs = path11.resolve(dir);
-  if (!fs12.existsSync(path11.join(abs, "package.json"))) throw new Error(`${abs} has no package.json (\`austere-axi components new <dir>\` makes a pack)`);
+  const abs = path12.resolve(dir);
+  if (!fs13.existsSync(path12.join(abs, "package.json"))) throw new Error(`${abs} has no package.json (\`austere-axi components new <dir>\` makes a pack)`);
   const esbuild = await findEsbuild(abs);
   if (!esbuild) throw new Error(`components build needs esbuild: run \`npm install -D esbuild\` in ${abs}`);
   process.env.OPENUI_TELEMETRY_DISABLED ||= "1";
@@ -2406,7 +2545,7 @@ export default austereComponent({
 
 // src/cli/net.ts
 import { execFile } from "node:child_process";
-import fs13 from "node:fs";
+import fs14 from "node:fs";
 function run(bin, args) {
   return new Promise((resolve) => {
     execFile(bin, args, { timeout: 2500, windowsHide: true }, (err, stdout) => resolve(err ? null : stdout));
@@ -2417,7 +2556,7 @@ async function detectTailscale({ fresh = false } = {}) {
   if (!fresh && Date.now() - cache.at < 3e4) return cache.value;
   let value = null;
   for (const bin of CANDIDATES) {
-    if (bin.startsWith("/") && !fs13.existsSync(bin)) continue;
+    if (bin.startsWith("/") && !fs14.existsSync(bin)) continue;
     const out = await run(bin, ["status", "--json"]);
     if (!out) continue;
     try {
@@ -2515,7 +2654,7 @@ var init_items = __esm({
 
 // src/cli/hub-page.ts
 import os3 from "node:os";
-import path12 from "node:path";
+import path13 from "node:path";
 function day(ms) {
   const d = new Date(ms);
   const today = /* @__PURE__ */ new Date();
@@ -2530,7 +2669,7 @@ function time3(ms) {
 }
 function tilde(p) {
   const home = os3.homedir();
-  return p === home || p.startsWith(home + path12.sep) ? "~" + p.slice(home.length) : p;
+  return p === home || p.startsWith(home + path13.sep) ? "~" + p.slice(home.length) : p;
 }
 function counts(a) {
   const waiting = a.open + a.received;
@@ -2566,13 +2705,13 @@ function hubPage(rows, { version: version2, q: q2, project, stats }) {
     const body = [...days.entries()].map(
       ([d, items]) => `<h3>${escapeHtml(d)}</h3><ul>${items.map(
         (a) => `<li><a href="/hub/open/${a.id}" title="${escapeHtml(a.file)}">
-  <strong>${escapeHtml(a.title || path12.basename(a.file))}</strong>
-  <span class="meta">${escapeHtml(path12.relative(proj, a.file) || path12.basename(a.file))} \xB7 ${time3(a.updated_at)} \xB7 ${state(a)}${counts(a) ? ` \xB7 ${counts(a)}` : ""}</span>
+  <strong>${escapeHtml(a.title || path13.basename(a.file))}</strong>
+  <span class="meta">${escapeHtml(path13.relative(proj, a.file) || path13.basename(a.file))} \xB7 ${time3(a.updated_at)} \xB7 ${state(a)}${counts(a) ? ` \xB7 ${counts(a)}` : ""}</span>
 </a></li>`
       ).join("")}</ul>`
     ).join("");
     const unanswered = list.reduce((n, a) => n + a.open + a.received, 0);
-    return `<section><h2><a href="/?project=${encodeURIComponent(proj)}">${escapeHtml(path12.basename(proj) || proj)}</a> <small title="${escapeHtml(proj)}">${escapeHtml(
+    return `<section><h2><a href="/?project=${encodeURIComponent(proj)}">${escapeHtml(path13.basename(proj) || proj)}</a> <small title="${escapeHtml(proj)}">${escapeHtml(
       shortPath(proj)
     )}</small>${unanswered ? ` <b class="open">${unanswered} unanswered</b>` : ""}</h2>${body}</section>`;
   }).join("");
@@ -2595,7 +2734,7 @@ function notesPage(rows, { version: version2, q: q2, project, status, author = "
     const when = `${day(n.at)} ${time3(n.at)}`;
     return `<li class="n"><a href="/hub/open/${escapeHtml(n.artifact_id)}" title="${escapeHtml(n.file)}">
   <p class="note">${escapeHtml(n.text || "(no text)")}</p>
-  <span class="note-t">${n.author ? `<b class="by">${escapeHtml(n.author)}</b> \xB7 ` : ""}${n.target ? `on ${escapeHtml(n.target)} \xB7 ` : ""}<strong>${escapeHtml(n.title || path12.basename(n.file))}</strong> \xB7 ${escapeHtml(path12.basename(n.project) || n.project)} \xB7 ${escapeHtml(when)} \xB7 <span class="st ${waiting ? "waiting" : "done"}">${STATUS_LABEL[n.status] || escapeHtml(n.status)}</span></span>
+  <span class="note-t">${n.author ? `<b class="by">${escapeHtml(n.author)}</b> \xB7 ` : ""}${n.target ? `on ${escapeHtml(n.target)} \xB7 ` : ""}<strong>${escapeHtml(n.title || path13.basename(n.file))}</strong> \xB7 ${escapeHtml(path13.basename(n.project) || n.project)} \xB7 ${escapeHtml(when)} \xB7 <span class="st ${waiting ? "waiting" : "done"}">${STATUS_LABEL[n.status] || escapeHtml(n.status)}</span></span>
 </a></li>`;
   }).join("");
   const opt = (v, label) => `<option value="${v}"${status === v ? " selected" : ""}>${label}</option>`;
@@ -2650,9 +2789,9 @@ __export(server_exports, {
   persistEnv: () => persistEnv,
   runServer: () => runServer
 });
-import fs14 from "node:fs";
+import fs15 from "node:fs";
 import http3 from "node:http";
-import path13 from "node:path";
+import path14 from "node:path";
 import crypto5 from "node:crypto";
 function persistEnv() {
   return /^(1|true|yes)$/i.test(process.env.AUSTERE_AXI_PERSIST || "");
@@ -2667,7 +2806,7 @@ async function runServer({
     const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${a.join(" ")}`;
     if (verbose) process.stderr.write(line + "\n");
     try {
-      fs14.appendFileSync(path13.join(stateDir(), "server.log"), line + "\n", { mode: 384 });
+      fs15.appendFileSync(path14.join(stateDir(), "server.log"), line + "\n", { mode: 384 });
     } catch {
     }
   };
@@ -2849,7 +2988,7 @@ data: ${JSON.stringify({ state: "revoked" })}
   }
   function readFileSafe(file3) {
     try {
-      return fs14.readFileSync(file3, "utf8");
+      return fs15.readFileSync(file3, "utf8");
     } catch {
       return null;
     }
@@ -2861,14 +3000,14 @@ data: ${JSON.stringify({ state: "revoked" })}
     const w = { html, program: art?.program ?? null, shell: art?.shell ?? null, timer: void 0 };
     watchers.set(s.id, w);
     if (art?.title) s.title = art.title;
-    fs14.watchFile(s.file, { interval: 300 }, () => {
+    fs15.watchFile(s.file, { interval: 300 }, () => {
       clearTimeout(w.timer);
       w.timer = setTimeout(() => onFileChange(s, w), 120);
     });
   }
   function unwatch(id) {
     const s = store.get(id);
-    if (s) fs14.unwatchFile(s.file);
+    if (s) fs15.unwatchFile(s.file);
     watchers.delete(id);
   }
   function onFileChange(s, w) {
@@ -3045,7 +3184,7 @@ data: ${JSON.stringify({ state: "revoked" })}
     const file3 = typeof body.file === "string" ? body.file : "";
     if (!file3) return send(res, 400, { error: "file is required" });
     if (route === "share") {
-      if (!fs14.existsSync(file3)) return send(res, 404, { error: `no such file: ${file3}` });
+      if (!fs15.existsSync(file3)) return send(res, 404, { error: `no such file: ${file3}` });
       await ensureTailnetListener();
       if (!remoteBase()) {
         return send(res, 409, {
@@ -3065,7 +3204,7 @@ data: ${JSON.stringify({ state: "revoked" })}
       return send(res, 200, { id: inviteId(inv), name: inv.name, auto: inv.auto, link: inviteLink(inv), file: inv.file });
     }
     if (route === "open") {
-      if (!fs14.existsSync(file3)) return send(res, 404, { error: `no such file: ${file3}` });
+      if (!fs15.existsSync(file3)) return send(res, 404, { error: `no such file: ${file3}` });
       await ensureTailnetListener();
       const s2 = store.ensure(file3);
       if (s2.closedAt && !body.reopen) {
@@ -3198,7 +3337,7 @@ data: ${JSON.stringify({ state: "revoked" })}
     }
     const file3 = installedPackFile(spec.name, spec.version);
     if (!file3) return send(res, 404, `pack ${spec.name}@${spec.version} is not installed (austere-axi components add ${spec.name}@${spec.version})`);
-    fs14.readFile(file3, (err, buf) => {
+    fs15.readFile(file3, (err, buf) => {
       if (err) return send(res, 404, "not found");
       const actual = `sha384-${crypto5.createHash("sha384").update(buf).digest("base64")}`;
       const locked = readLock().packs[spec.name]?.integrity;
@@ -3222,13 +3361,13 @@ data: ${JSON.stringify({ state: "revoked" })}
   }
   function serveAsset(res, rel, url2) {
     if (rel.startsWith("installed-packs/")) return serveInstalledPack(res, rel, url2);
-    const clean = path13.normalize(rel).replace(/^(\.\.[/\\])+/, "");
-    const file3 = path13.join(ASSET_DIR, clean);
-    if (!file3.startsWith(ASSET_DIR + path13.sep)) return send(res, 404, "not found");
-    fs14.stat(file3, (err, st2) => {
+    const clean = path14.normalize(rel).replace(/^(\.\.[/\\])+/, "");
+    const file3 = path14.join(ASSET_DIR, clean);
+    if (!file3.startsWith(ASSET_DIR + path14.sep)) return send(res, 404, "not found");
+    fs15.stat(file3, (err, st2) => {
       if (err || !st2.isFile()) return send(res, 404, "not found");
       streamFile(res, file3, {
-        "content-type": MIME[path13.extname(file3)] || "application/octet-stream",
+        "content-type": MIME[path14.extname(file3)] || "application/octet-stream",
         "content-length": st2.size,
         "cache-control": "no-cache",
         "x-content-type-options": "nosniff"
@@ -3237,7 +3376,7 @@ data: ${JSON.stringify({ state: "revoked" })}
   }
   const ARTIFACT_CSP = "sandbox allow-scripts allow-popups allow-popups-to-escape-sandbox allow-forms";
   function streamFile(res, file3, headers) {
-    const rs = fs14.createReadStream(file3);
+    const rs = fs15.createReadStream(file3);
     rs.once("open", () => {
       res.writeHead(200, headers);
       rs.pipe(res);
@@ -3249,9 +3388,20 @@ data: ${JSON.stringify({ state: "revoked" })}
     });
     res.once("close", () => rs.destroy());
   }
+  function assetToken(s, viewer) {
+    const who = viewer.role === "owner" ? "owner" : `invite:${viewer.token}`;
+    return crypto5.createHmac("sha256", ownerToken).update(`austere-axi asset\0${s.id}\0${who}`).digest("base64url");
+  }
+  function assetTokenValid(s, token) {
+    let ok2 = safeEqual(token, assetToken(s, OWNER));
+    for (const inv of invites.list()) {
+      if (inv.sessionId === s.id && safeEqual(token, assetToken(s, { role: "reviewer", name: inv.name, auto: inv.auto, token: inv.token }))) ok2 = true;
+    }
+    return ok2;
+  }
   function serveArtifact(req, res, s, rest) {
-    const dir = path13.dirname(s.file);
-    const base = path13.basename(s.file);
+    const dir = path14.dirname(s.file);
+    const base = path14.basename(s.file);
     if (rest === base || rest === "") {
       const html = readFileSafe(s.file);
       if (html == null) return send(res, 404, "artifact file is missing");
@@ -3264,27 +3414,14 @@ data: ${JSON.stringify({ state: "revoked" })}
     } catch {
       return send(res, 400, "bad path");
     }
-    if (decoded.includes("\0")) return send(res, 404, "not found");
-    const file3 = path13.resolve(dir, decoded);
-    if (!file3.startsWith(dir + path13.sep) || decoded.split(/[/\\]/).some((p) => p.startsWith("."))) {
-      return send(res, 404, "not found");
-    }
-    fs14.realpath(dir, (e1, realDir) => {
-      if (e1) return send(res, 404, "not found");
-      fs14.realpath(file3, (e2, real) => {
-        if (e2 || !real.startsWith(realDir + path13.sep)) return send(res, 404, "not found");
-        if (path13.relative(realDir, real).split(path13.sep).some((p) => p.startsWith("."))) return send(res, 404, "not found");
-        fs14.stat(real, (err, st2) => {
-          if (err || !st2.isFile() || st2.size > 64 * 1024 * 1024) return send(res, 404, "not found");
-          streamFile(res, real, {
-            "content-type": MIME[path13.extname(real).toLowerCase()] || "application/octet-stream",
-            "content-length": st2.size,
-            "cache-control": "no-cache",
-            "x-content-type-options": "nosniff",
-            "content-security-policy": ARTIFACT_CSP
-          });
-        });
-      });
+    const sib = resolveSibling(dir, decoded);
+    if (!sib.ok) return send(res, 404, "not found");
+    streamFile(res, sib.file, {
+      "content-type": MIME[path14.extname(sib.file).toLowerCase()] || "application/octet-stream",
+      "content-length": sib.size,
+      "cache-control": "no-cache",
+      "x-content-type-options": "nosniff",
+      "content-security-policy": ARTIFACT_CSP
     });
   }
   function chromePage(s, viewer) {
@@ -3293,8 +3430,8 @@ data: ${JSON.stringify({ state: "revoked" })}
       title: s.title,
       file: viewer.role === "owner" ? s.file : "",
       viewer: { role: viewer.role, name: viewer.name, auto: viewer.role === "reviewer" ? viewer.auto : void 0 },
-      name: path13.basename(s.file),
-      artifactUrl: `/s/${s.id}/a/${encodeURIComponent(path13.basename(s.file))}`,
+      name: path14.basename(s.file),
+      artifactUrl: `/s/${s.id}/a/${assetToken(s, viewer)}/${encodeURIComponent(path14.basename(s.file))}`,
       version: VERSION
     };
     return `<!doctype html>
@@ -3328,7 +3465,7 @@ data: ${JSON.stringify({ state: "revoked" })}
   function hubOpen(res, id) {
     const a = /^[a-f0-9]{12}$/.test(id) ? hub.artifact(id) : null;
     if (!a) return send(res, 404, "not in the hub");
-    if (!fs14.existsSync(a.file)) return send(res, 410, `${a.file} no longer exists`);
+    if (!fs15.existsSync(a.file)) return send(res, 410, `${a.file} no longer exists`);
     const existed = store.byFile(a.file);
     const s = store.ensure(a.file);
     if (!existed) store.touch(s);
@@ -3406,6 +3543,10 @@ data: ${JSON.stringify({ state: "revoked" })}
       });
       return res.end();
     }
+    const tokened = /^\/a\/([A-Za-z0-9_-]{43})\/(.*)$/.exec(sub);
+    if (tokened && (req.method === "GET" || req.method === "HEAD") && assetTokenValid(s, tokened[1])) {
+      return serveArtifact(req, res, s, tokened[2]);
+    }
     const who = identify(req, s);
     if (!who) {
       if (tokenFromCookie(req.headers.cookie) == null) return send(res, 403, notOwner(req, "Ask the owner for a link to this page."));
@@ -3567,8 +3708,8 @@ ${message}`;
       const html = readFileSafe(s.file);
       if (html == null) return send(res, 404, "artifact file is missing");
       try {
-        const out = exportHtml(html);
-        const name = path13.basename(s.file).replace(/\.html?$/i, "") + ".export.html";
+        const out = exportHtml(html, path14.dirname(s.file));
+        const name = path14.basename(s.file).replace(/\.html?$/i, "") + ".export.html";
         return send(res, 200, out.html, {
           "content-type": "text/html; charset=utf-8",
           "content-disposition": `attachment; filename="${name.replace(/"/g, "")}"`,
@@ -3585,7 +3726,7 @@ ${message}`;
       if (listeners.has(host)) return resolve(true);
       const server = http3.createServer((req, res) => {
         handle(req, res).catch((err) => {
-          log("error", req.method, String(req.url).split("?")[0], String(err?.stack || err));
+          log("error", req.method, String(req.url).split("?")[0].replace(/\/a\/[\w-]{43}\//, "/a/\u2026/"), String(err?.stack || err));
           if (!res.headersSent) send(res, err.status || 500, { error: err.status ? String(err.message) : "internal error" });
           else res.end();
         });
@@ -3664,6 +3805,7 @@ var MIME, SHORT_GRACE_MS, LOGIN_TTL_MS, OWNER, REVIEWER_KINDS, RENDER_CHECK_AUTH
 var init_server = __esm({
   "src/cli/server.ts"() {
     "use strict";
+    init_assets();
     init_artifact();
     init_export();
     init_net();
@@ -3724,7 +3866,7 @@ __export(mcp_exports, {
   runMcp: () => runMcp
 });
 import { spawn as spawn3 } from "node:child_process";
-import path14 from "node:path";
+import path15 from "node:path";
 import readline from "node:readline";
 function runCli({ args, stdin }, signal) {
   return new Promise((resolve) => {
@@ -3767,7 +3909,7 @@ async function callTool(name, a, signal) {
   const bad = validate2(tool, a);
   if (bad) return { content: [{ type: "text", text: `status: error
 error: ${bad}` }], isError: true };
-  if (typeof a.file === "string") a = { ...a, file: path14.resolve(a.file) };
+  if (typeof a.file === "string") a = { ...a, file: path15.resolve(a.file) };
   const args = a;
   let text = "";
   let isError = false;
@@ -3869,7 +4011,7 @@ var init_mcp = __esm({
     isRecord2 = (v) => !!v && typeof v === "object";
     PROTOCOLS = ["2025-11-25", "2025-06-18", "2024-11-05"];
     POLL_TIMEOUT_MS = 5e4;
-    INSTRUCTIONS = `austere-axi turns plans, comparisons, decisions, code reviews and reports into review pages the user annotates in the browser. Call \`spec\` once per session for the workflow, the file skeleton and the component reference. Results are the CLI's output: where a \`next:\` hint names an \`austere-axi <command>\`, call the tool of that name instead. Pass absolute file paths. The reviewer judges how a page looks: do not open, screenshot or inspect it yourself unless the user asks.`;
+    INSTRUCTIONS = `austere-axi turns plans, comparisons, decisions, code reviews and reports into review pages the user annotates in the browser. Call \`spec\` once per session for the workflow, the file skeleton and the component reference. Results are the CLI's output: where a \`next:\` hint names an \`austere-axi <command>\`, call the tool of that name instead. Pass absolute file paths. The reviewer judges how a page looks: do not open, screenshot or inspect it yourself unless the user asks. Revise a page only with the \`patch\` tool: send the changed statements (every statement that shows a changed value), never the whole file.`;
     file2 = { type: "string", description: "Path of the .html page. Use an absolute path; a relative one resolves against the server's working directory." };
     TOOLS = {
       spec: {
@@ -3952,8 +4094,8 @@ var init_mcp = __esm({
 });
 
 // src/cli/main.ts
-import fs15 from "node:fs";
-import path15 from "node:path";
+import fs16 from "node:fs";
+import path16 from "node:path";
 
 // node_modules/@openuidev/lang-core/dist/shared-Dzgc28Wo.mjs
 var TELEMETRY_REQUEST_TIMEOUT_MS = 2e3;
@@ -4814,10 +4956,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path16) {
-  if (!path16)
+function getElementAtPath(obj, path17) {
+  if (!path17)
     return obj;
-  return path16.reduce((acc, key2) => acc?.[key2], obj);
+  return path17.reduce((acc, key2) => acc?.[key2], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -5157,11 +5299,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path16, issues) {
+function prefixIssues(path17, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path16);
+    iss.path.unshift(path17);
     return iss;
   });
 }
@@ -5623,16 +5765,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path16 = []) => {
+  const processError = (error63, path17 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path16, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path17, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path16, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path17, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path16, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path17, ...issue2.path]);
       } else {
-        const fullpath = [...path16, ...issue2.path];
+        const fullpath = [...path17, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -5671,17 +5813,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path16 = []) => {
+  const processError = (error63, path17 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path16, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path17, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path16, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path17, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path16, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path17, ...issue2.path]);
       } else {
-        const fullpath = [...path16, ...issue2.path];
+        const fullpath = [...path17, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -5720,8 +5862,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path16 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path16) {
+  const path17 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path17) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -22859,13 +23001,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path16 = ref.slice(1).split("/").filter(Boolean);
-  if (path16.length === 0) {
+  const path17 = ref.slice(1).split("/").filter(Boolean);
+  if (path17.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path16[0] === defsKey) {
-    const key2 = path16[1] === void 0 ? void 0 : decodeJSONPointerSegment(path16[1]);
+  if (path17[0] === defsKey) {
+    const key2 = path17[1] === void 0 ? void 0 : decodeJSONPointerSegment(path17[1]);
     if (!key2 || !ctx.defs[key2]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -23747,11 +23889,11 @@ function defineAction(config2) {
     ref: actionRef(config2.name, data)
   };
 }
-function resolveField(obj, path16) {
-  if (!path16 || obj == null) return void 0;
-  if (!path16.includes(".")) return obj[path16];
+function resolveField(obj, path17) {
+  if (!path17 || obj == null) return void 0;
+  if (!path17.includes(".")) return obj[path17];
   let cur = obj;
-  for (const p of path16.split(".")) {
+  for (const p of path17.split(".")) {
     if (cur == null) return void 0;
     cur = cur[p];
   }
@@ -25127,14 +25269,14 @@ function checkTypeMismatch(value, info) {
   };
   return null;
 }
-function validationMessage(component, path16, issue2) {
+function validationMessage(component, path17, issue2) {
   switch (issue2.code) {
     case "type-mismatch":
-      return `field "${path16}" expects ${issue2.expected} but got ${issue2.actual}`;
+      return `field "${path17}" expects ${issue2.expected} but got ${issue2.actual}`;
     case "missing-required":
-      return `missing required field "${path16}"${issue2.signature ? ` \u2014 signature: ${issue2.signature}` : ""}`;
+      return `missing required field "${path17}"${issue2.signature ? ` \u2014 signature: ${issue2.signature}` : ""}`;
     case "null-required":
-      return `required field "${path16}" cannot be null${issue2.signature ? ` \u2014 signature: ${issue2.signature}` : ""}`;
+      return `required field "${path17}" cannot be null${issue2.signature ? ` \u2014 signature: ${issue2.signature}` : ""}`;
     case "unknown-component":
       return `Unknown component "${component}" \u2014 not found in catalog or builtins${issue2.available?.length ? `. Available components: ${issue2.available.join(", ")}` : ""}`;
     case "inline-reserved":
@@ -25149,12 +25291,12 @@ function validationMessage(component, path16, issue2) {
       return component ? `No root statement, and no statement calls the root component ${component}` : "No root statement";
   }
 }
-function pushValidationIssue(ctx, component, path16, issue2) {
+function pushValidationIssue(ctx, component, path17, issue2) {
   ctx.errors.push({
     code: issue2.code,
     component,
-    path: path16,
-    message: validationMessage(component, path16, issue2),
+    path: path17,
+    message: validationMessage(component, path17, issue2),
     statementId: ctx.currentStatementId,
     ...issue2.code === "no-root" && issue2.reason === "fallback" && { severity: "warning" }
   });
@@ -25164,10 +25306,10 @@ function resolveInvalidValue(required2, defaultValue) {
   if (defaultValue !== void 0) return defaultValue;
   return required2 ? INVALID2 : void 0;
 }
-function validateElementPosition(element, s, component, path16, ctx) {
+function validateElementPosition(element, s, component, path17, ctx) {
   if (isCompositeSchema(s)) return false;
   if (typeof s["type"] === "string" || Array.isArray(s["enum"]) || "const" in s) {
-    pushValidationIssue(ctx, component, path16, {
+    pushValidationIssue(ctx, component, path17, {
       code: "type-mismatch",
       expected: typeof s["type"] === "string" ? s["type"] : "a literal value",
       actual: `component "${element.typeName}"`
@@ -25183,9 +25325,9 @@ function isOnlyComponentSlot(s, ctx) {
   const names = slotRefNames(s);
   return names.length > 0 && names.every((n) => n !== void 0 && ctx.cat?.has(n));
 }
-function validateObjectValue(value, s, component, path16, ctx) {
+function validateObjectValue(value, s, component, path17, ctx) {
   if (typeof value !== "object" || Array.isArray(value)) {
-    pushValidationIssue(ctx, component, path16, {
+    pushValidationIssue(ctx, component, path17, {
       code: "type-mismatch",
       expected: "object",
       actual: jsType(value)
@@ -25205,14 +25347,14 @@ function validateObjectValue(value, s, component, path16, ctx) {
         (out ??= { ...obj })[key2] = fallback;
         continue;
       }
-      pushValidationIssue(ctx, component, `${path16}/${key2}`, { code: present ? "null-required" : "missing-required" });
+      pushValidationIssue(ctx, component, `${path17}/${key2}`, { code: present ? "null-required" : "missing-required" });
       invalid = true;
     }
   }
   for (const key2 of Object.keys(props)) {
     if (!(key2 in obj)) continue;
     const sub = props[key2];
-    let next = validateSchemaValue(obj[key2], sub, component, `${path16}/${key2}`, ctx);
+    let next = validateSchemaValue(obj[key2], sub, component, `${path17}/${key2}`, ctx);
     if (next === INVALID2) {
       next = resolveInvalidValue(required2.includes(key2), getSchemaDefaultValue(sub));
       if (next === INVALID2) {
@@ -25227,9 +25369,9 @@ function validateObjectValue(value, s, component, path16, ctx) {
   }
   return invalid ? INVALID2 : out ?? obj;
 }
-function validateArrayValue(value, s, component, path16, ctx) {
+function validateArrayValue(value, s, component, path17, ctx) {
   if (!Array.isArray(value)) {
-    pushValidationIssue(ctx, component, path16, {
+    pushValidationIssue(ctx, component, path17, {
       code: "type-mismatch",
       expected: "array",
       actual: jsType(value)
@@ -25240,19 +25382,19 @@ function validateArrayValue(value, s, component, path16, ctx) {
   if (!items || typeof items !== "object" || Array.isArray(items)) return value;
   let out;
   for (let i = 0; i < value.length; i++) {
-    const next = validateSchemaValue(value[i], items, component, `${path16}/${i}`, ctx);
+    const next = validateSchemaValue(value[i], items, component, `${path17}/${i}`, ctx);
     if (next !== value[i] && !out) out = value.slice(0, i);
     if (out && next !== INVALID2) out.push(next);
   }
   return out ?? value;
 }
-function validateLeafValue(value, s, component, path16, ctx) {
+function validateLeafValue(value, s, component, path17, ctx) {
   const leaf = getScalarTypeInfo(s);
   if (leaf.expectedType == null && leaf.enumValues == null) return false;
   if (leaf.enumValues && ctx.partial) return false;
   const mismatch = checkTypeMismatch(value, leaf);
   if (mismatch) {
-    pushValidationIssue(ctx, component, path16, {
+    pushValidationIssue(ctx, component, path17, {
       code: "type-mismatch",
       ...mismatch
     });
@@ -25260,15 +25402,15 @@ function validateLeafValue(value, s, component, path16, ctx) {
   }
   return false;
 }
-function validateSchemaValue(value, schema, component, path16, ctx) {
+function validateSchemaValue(value, schema, component, path17, ctx) {
   if (!schema || typeof schema !== "object" || Array.isArray(schema)) return value;
   const s = schema;
   if (value == null) return value;
   if (isASTNode(value)) return value;
-  if (isElementNode(value)) return validateElementPosition(value, s, component, path16, ctx) ? INVALID2 : value;
+  if (isElementNode(value)) return validateElementPosition(value, s, component, path17, ctx) ? INVALID2 : value;
   if (isCompositeSchema(s)) {
     if (!isOnlyComponentSlot(s, ctx)) return value;
-    pushValidationIssue(ctx, component, path16, {
+    pushValidationIssue(ctx, component, path17, {
       code: "type-mismatch",
       expected: slotRefNames(s).join(" | "),
       actual: Array.isArray(value) ? "array" : typeof value === "object" ? "plain object" : typeof value
@@ -25276,9 +25418,9 @@ function validateSchemaValue(value, schema, component, path16, ctx) {
     return INVALID2;
   }
   const type = s["type"];
-  if (type === "object") return validateObjectValue(value, s, component, path16, ctx);
-  if (type === "array") return validateArrayValue(value, s, component, path16, ctx);
-  return validateLeafValue(value, s, component, path16, ctx) ? INVALID2 : value;
+  if (type === "object") return validateObjectValue(value, s, component, path17, ctx);
+  if (type === "array") return validateArrayValue(value, s, component, path17, ctx);
+  return validateLeafValue(value, s, component, path17, ctx) ? INVALID2 : value;
 }
 function containsDynamicValue(v) {
   if (v == null || typeof v !== "object") return false;
@@ -28904,11 +29046,11 @@ function routeOrthogonal({ boxes, edges: input2, xLines = [], yLines = [], avoid
       const blocked = solid.some(([id, r]) => id !== e.from && id !== e.to && seg.x0 < r.x + r.width && r.x < seg.x1 && seg.y0 < r.y + r.height && r.y < seg.y1);
       if (!blocked) {
         routes.set(e.id, [a, b]);
-        const path17 = [];
+        const path18 = [];
         const [i0, j0, i1, j1] = [ix(a.x), iy(a.y), ix(b.x), iy(b.y)];
-        if (j0 === j1) for (let i = Math.min(i0, i1); i <= Math.max(i0, i1); i++) path17.push([i, j0]);
-        else for (let j = Math.min(j0, j1); j <= Math.max(j0, j1); j++) path17.push([i0, j]);
-        if (path17.every((pt2) => pt2[0] !== void 0 && pt2[1] !== void 0)) mark(path17);
+        if (j0 === j1) for (let i = Math.min(i0, i1); i <= Math.max(i0, i1); i++) path18.push([i, j0]);
+        else for (let j = Math.min(j0, j1); j <= Math.max(j0, j1); j++) path18.push([i0, j]);
+        if (path18.every((pt2) => pt2[0] !== void 0 && pt2[1] !== void 0)) mark(path18);
         continue;
       }
     }
@@ -28918,12 +29060,12 @@ function routeOrthogonal({ boxes, edges: input2, xLines = [], yLines = [], avoid
     const sj = iy(st2.y);
     const ti = ix(tt2.x);
     const tj = iy(tt2.y);
-    let path16 = null;
+    let path17 = null;
     if (si !== void 0 && sj !== void 0 && ti !== void 0 && tj !== void 0) {
-      path16 = search(si, sj, dirOf(e.fromSide), ti, tj, reverse[dirOf(e.toSide)]);
+      path17 = search(si, sj, dirOf(e.fromSide), ti, tj, reverse[dirOf(e.toSide)]);
     }
-    const pts = path16 ? path16.map(([i, j]) => ({ x: xs[i], y: ys[j] })) : elbow(st2, tt2, e.fromSide);
-    if (path16) mark(path16);
+    const pts = path17 ? path17.map(([i, j]) => ({ x: xs[i], y: ys[j] })) : elbow(st2, tt2, e.fromSide);
+    if (path17) mark(path17);
     routes.set(e.id, simplify([e.fromPort, ...pts, e.toPort]));
   }
   return routes;
@@ -28992,10 +29134,10 @@ function routeOrthogonal({ boxes, edges: input2, xLines = [], yLines = [], avoid
     }
     return out.reverse();
   }
-  function mark(path16) {
-    for (let k = 1; k < path16.length; k++) {
-      const [i0, j0] = path16[k - 1];
-      const [i1, j1] = path16[k];
+  function mark(path17) {
+    for (let k = 1; k < path17.length; k++) {
+      const [i0, j0] = path17[k - 1];
+      const [i1, j1] = path17[k];
       if (j0 === j1) {
         hUse[j0 * nx + Math.min(i0, i1)]++;
         hPass[j0 * nx + i0]++;
@@ -29701,53 +29843,52 @@ init_sessions();
 init_export();
 
 // src/cli/render-check.ts
+init_artifact();
 init_export();
 import { spawn as spawn2 } from "node:child_process";
-import fs10 from "node:fs";
+import fs11 from "node:fs";
 import http2 from "node:http";
 import os2 from "node:os";
-import path9 from "node:path";
+import path10 from "node:path";
 var WIDTHS = [1280, 390];
 var LAUNCH_TIMEOUT_MS = 15e3;
 var RENDER_TIMEOUT_MS = 3e4;
 var FRAME_SANDBOX = "allow-scripts";
 function findChrome() {
   const fromEnv = process.env.CHROME_PATH;
-  if (fromEnv) return fs10.existsSync(fromEnv) ? fromEnv : null;
+  if (fromEnv) return fs11.existsSync(fromEnv) ? fromEnv : null;
   const candidates = [];
   if (process.platform === "darwin") {
     for (const p of ["Google Chrome.app/Contents/MacOS/Google Chrome", "Chromium.app/Contents/MacOS/Chromium", "Microsoft Edge.app/Contents/MacOS/Microsoft Edge"]) {
-      candidates.push(path9.join("/Applications", p));
+      candidates.push(path10.join("/Applications", p));
     }
   } else if (process.platform === "win32") {
     const roots = [process.env.PROGRAMFILES, process.env["PROGRAMFILES(X86)"], process.env.LOCALAPPDATA].filter((x) => typeof x === "string");
-    for (const r of roots) candidates.push(path9.join(r, "Google/Chrome/Application/chrome.exe"), path9.join(r, "Microsoft/Edge/Application/msedge.exe"));
+    for (const r of roots) candidates.push(path10.join(r, "Google/Chrome/Application/chrome.exe"), path10.join(r, "Microsoft/Edge/Application/msedge.exe"));
   } else {
-    const dirs = (process.env.PATH || "").split(path9.delimiter).filter(Boolean);
+    const dirs = (process.env.PATH || "").split(path10.delimiter).filter(Boolean);
     for (const name of ["google-chrome", "google-chrome-stable", "chromium", "chromium-browser", "microsoft-edge"]) {
-      for (const d of dirs) candidates.push(path9.join(d, name));
+      for (const d of dirs) candidates.push(path10.join(d, name));
     }
   }
-  return candidates.find((c) => fs10.existsSync(c)) ?? null;
+  return candidates.find((c) => fs11.existsSync(c)) ?? null;
 }
 var MEASURE = `<script>(() => {
   const exceptions = [];
   addEventListener("error", (e) => exceptions.push(String((e.error && e.error.message) || e.message || "error")));
   addEventListener("unhandledrejection", (e) => exceptions.push(String((e.reason && e.reason.message) || e.reason)));
   const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-  addEventListener("message", async (e) => {
-    const d = e.data;
-    if (e.source !== parent || !d || d.austereMeasure !== 1) return;
+  const idOf = (el) => (el.closest("[data-oui-id]") && el.closest("[data-oui-id]").getAttribute("data-oui-id")) || "";
+  const settle = async () => {
     for (let i = 0; i < 100; i++) {
       const pending = [...document.querySelectorAll(".austere-mermaid")].filter((m) => !m.querySelector("svg, .austere-render-error"));
       if (!pending.length) break;
       await sleep(100);
     }
     await sleep(200);
-    const shown = [...document.querySelectorAll(".austere-render-error")].map((el) => ({
-      statement: (el.closest("[data-oui-id]") && el.closest("[data-oui-id]").getAttribute("data-oui-id")) || "",
-      error: el.textContent.trim().slice(0, 300),
-    }));
+  };
+  const snapshot = () => {
+    const shown = [...document.querySelectorAll(".austere-render-error")].map((el) => ({ statement: idOf(el), error: el.textContent.trim().slice(0, 300) }));
     const se = document.scrollingElement;
     let past = null;
     if (se.scrollWidth > se.clientWidth + 1) {
@@ -29765,11 +29906,58 @@ var MEASURE = `<script>(() => {
       const out = [...document.body.querySelectorAll("*")].slice(0, 20000).filter(sticksOut);
       const outSet = new Set(out);
       const leaves = out.filter((el) => ![...el.children].some((c) => outSet.has(c)));
-      const ids = leaves.map((el) => el.closest("[data-oui-id]") && el.closest("[data-oui-id]").getAttribute("data-oui-id")).filter(Boolean);
-      past = [...new Set(ids)].slice(0, 8);
+      past = leaves.map(idOf).filter(Boolean);
+    }
+    // The sideways check above skips these: the diagram scrolls in its own box, so only a
+    // reader who notices the scroll sees all of it.
+    const wide = [...document.querySelectorAll(".austere-mermaid-svg")]
+      .filter((box) => box.scrollWidth > box.clientWidth + 1)
+      .map((box) => ({ statement: idOf(box), width: box.scrollWidth, box: box.clientWidth }));
+    const ids = [...document.querySelectorAll("[data-oui-id]")].map((el) => el.getAttribute("data-oui-id"));
+    return { shown, past, wide, ids };
+  };
+  // Radix tabs switch on mousedown with the main button.
+  const press = (tab) => tab.dispatchEvent(new MouseEvent("mousedown", { bubbles: true, cancelable: true, button: 0 }));
+  // Opens every tab under \`scope\` (the page, or an open tab panel), measuring each, then walks
+  // the tabs inside each panel while it is open: an inner Tabs mounts only with its panel.
+  // Restores each tab list's open tab. Capped so a huge page cannot stall the check.
+  let presses = 0;
+  const walk = async (scope, snaps) => {
+    const lists = [...scope.querySelectorAll('[role="tablist"]')].filter((l) => (l.parentElement.closest('[role="tabpanel"]') || document) === scope);
+    for (const list of lists) {
+      const count = list.querySelectorAll('[role="tab"]').length;
+      const opened = [...list.querySelectorAll('[role="tab"]')].findIndex((t) => t.getAttribute("aria-selected") === "true");
+      for (let i = 0; i < count && presses < 200; i++) {
+        const tab = list.querySelectorAll('[role="tab"]')[i];
+        if (!tab) break;
+        if (tab.getAttribute("aria-selected") !== "true") {
+          press(tab);
+          presses++;
+          await settle();
+          snaps.push(snapshot());
+        }
+        const panel = document.getElementById(tab.getAttribute("aria-controls") || "");
+        if (panel) await walk(panel, snaps);
+      }
+      const back = list.querySelectorAll('[role="tab"]')[opened];
+      if (back && back.getAttribute("aria-selected") !== "true") press(back);
     }
-    const statements = new Set([...document.querySelectorAll("[data-oui-id]")].map((el) => el.getAttribute("data-oui-id"))).size;
-    parent.postMessage({ austereMeasured: 1, id: d.id, shown, exceptions: exceptions.slice(0, 20), past, statements }, "*");
+  };
+  addEventListener("message", async (e) => {
+    const d = e.data;
+    if (e.source !== parent || !d || d.austereMeasure !== 1) return;
+    await settle();
+    presses = 0;
+    const snaps = [snapshot()];
+    await walk(document, snaps);
+    const overflowed = snaps.filter((x) => x.past);
+    const past = overflowed.length ? [...new Set(overflowed.flatMap((x) => x.past))].slice(0, 8) : null;
+    const shown = [];
+    for (const s of snaps.flatMap((x) => x.shown)) if (!shown.some((y) => y.statement === s.statement && y.error === s.error)) shown.push(s);
+    const wide = [];
+    for (const w of snaps.flatMap((x) => x.wide)) if (!wide.some((y) => y.statement === w.statement)) wide.push(w);
+    const statements = new Set(snaps.flatMap((x) => x.ids)).size;
+    parent.postMessage({ austereMeasured: 1, id: d.id, shown, exceptions: exceptions.slice(0, 20), past, wide, statements }, "*");
   });
 })();</script>`;
 var HARNESS = `<!doctype html><html><head><meta charset="utf-8"></head><body style="margin:0">
@@ -29800,16 +29988,19 @@ window.__austereReport = async (widths) => {
   for (let i = 0; i < 150 && !ready; i++) await sleep(100);
   const overflow = [];
   let last = null;
+  let wide = null;
   for (const w of widths) {
     f.style.width = w + "px";
     await sleep(300);
     last = await measure();
     if (last.past) overflow.push({ width: w, statements: last.past });
+    // Only the desktop width: on a phone most diagrams scroll, and the page shows that they do.
+    if (!wide) wide = last.wide.map((x) => ({ ...x, at: w }));
   }
   const all = [...errors];
   for (const s of last.shown) if (!all.some((x) => x.statement === s.statement)) all.push(s);
   for (const x of last.exceptions) if (!all.some((y) => y.error === x)) all.push({ statement: "", error: x.slice(0, 300) });
-  return { rendered: ready, statements: last.statements, errors: all, overflow };
+  return { rendered: ready, statements: last.statements, errors: all, overflow, wide: wide || [] };
 };
 </script></body></html>`;
 function connect(url2) {
@@ -29914,14 +30105,23 @@ function withMeasure(html) {
   const at2 = html.toLowerCase().lastIndexOf("</body>");
   return at2 < 0 ? html + MEASURE : html.slice(0, at2) + MEASURE + html.slice(at2);
 }
-async function renderCheck(html) {
+function wideMessages(html, wide) {
+  const sources = new Map(splitStatements(readArtifact(html).program).map((s) => [s.id, s.text]));
+  return wide.map(({ statement, width, box, at: at2 }) => {
+    const sideways = /\b(?:flowchart|graph)\s+(?:LR|RL)\b/.test(sources.get(statement) ?? "");
+    const fix = sideways ? "use `flowchart TD` or split it" : "split it or shorten its labels";
+    const name = statement || "(not one statement)";
+    return { statement: name, message: `Mermaid ${name} is ${width}px wide at its smallest legible size, more than its ${box}px box at ${at2}px, so it scrolls sideways; ${fix}.` };
+  });
+}
+async function renderCheck(html, dir) {
   const bin = findChrome();
   if (!bin) {
     const reason = process.env.CHROME_PATH ? `CHROME_PATH does not exist: ${process.env.CHROME_PATH}` : "no Chrome, Chromium or Edge found; install one or set CHROME_PATH";
     return { status: "unavailable", reason };
   }
-  const { html: page, notices } = exportHtml(html);
-  const profile = fs10.mkdtempSync(path9.join(os2.tmpdir(), "austere-render-"));
+  const { html: page, notices } = exportHtml(html, dir);
+  const profile = fs11.mkdtempSync(path10.join(os2.tmpdir(), "austere-render-"));
   const site = await serve(withMeasure(page));
   const { child, endpoint, exited } = launch(bin, profile);
   let cdp = null;
@@ -29945,7 +30145,7 @@ async function renderCheck(html) {
       if (r.exceptionDetails) throw new Error(`render report failed: ${r.exceptionDetails.text}`);
       const report = r.result.value;
       if (!report.rendered && !report.errors.length) report.errors.push({ statement: "", error: "the page did not finish rendering" });
-      return { status: "ok", statements: report.statements, errors: report.errors, overflow: report.overflow, notices };
+      return { status: "ok", statements: report.statements, errors: report.errors, overflow: report.overflow, wide: wideMessages(html, report.wide), notices };
     })();
     const timeout = new Promise((_, reject) => {
       timer = setTimeout(() => reject(new Error(`rendering took longer than ${RENDER_TIMEOUT_MS / 1e3} s`)), RENDER_TIMEOUT_MS);
@@ -29968,7 +30168,7 @@ async function renderCheck(html) {
     await Promise.race([exited, new Promise((r) => killGrace = setTimeout(r, 3e3))]);
     clearTimeout(killGrace);
     try {
-      fs10.rmSync(profile, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+      fs11.rmSync(profile, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
     } catch {
     }
   }
@@ -30261,7 +30461,8 @@ NOTES
   The CDN script tag lets the file open on its own (needs network); review and export work
   offline. A browser the CLI did not open gets 403 until it signs in with \`${BIN2} login\`.
   Mermaid syntax is only checked when it renders. check warns when an Architecture diagram
-  will not fit the page. check --render needs Chrome, Chromium or Edge (or CHROME_PATH).
+  will not fit the page; check --render, when a Mermaid diagram scrolls sideways in its box.
+  check --render needs Chrome, Chromium or Edge (or CHROME_PATH).
 
 ENV
   AUSTERE_AXI_PORT (4388)  AUSTERE_AXI_STATE_DIR (~/.austere-axi)  AUSTERE_AXI_NO_OPEN=1
@@ -30427,7 +30628,7 @@ function needFile(file3, cmd) {
     return null;
   }
   const abs = canonicalFile(file3);
-  if (!fs15.existsSync(abs)) {
+  if (!fs16.existsSync(abs)) {
     fail(`no such file: ${abs}`);
     return null;
   }
@@ -30444,7 +30645,7 @@ function readStdin() {
 async function replyText(flags) {
   if (typeof flags["agent-reply-file"] === "string") {
     const f = flags["agent-reply-file"];
-    return (f === "-" ? await readStdin() : fs15.readFileSync(f, "utf8")).trim();
+    return (f === "-" ? await readStdin() : fs16.readFileSync(f, "utf8")).trim();
   }
   if (typeof flags["agent-reply"] === "string") return flags["agent-reply"].trim();
   return "";
@@ -30483,7 +30684,7 @@ async function cmdHome() {
 async function cmdOpen(file3, flags) {
   const abs = needFile(file3, "open");
   if (!abs || file3 === void 0) return;
-  const html = fs15.readFileSync(abs, "utf8");
+  const html = fs16.readFileSync(abs, "utf8");
   const check2 = checkHtml(html, { file: quote(file3) });
   await ensureServer();
   const r = await request("POST", "/api/open", { file: abs, reopen: !!flags.reopen });
@@ -30522,7 +30723,7 @@ function quote(file3) {
 function describeItems(abs, items) {
   let lines = /* @__PURE__ */ new Map();
   try {
-    lines = statementLines(fs15.readFileSync(abs, "utf8"));
+    lines = statementLines(fs16.readFileSync(abs, "utf8"));
   } catch {
   }
   const at2 = locator(lines);
@@ -30539,7 +30740,7 @@ function describeItems(abs, items) {
 }
 function thirdPartyOf(abs) {
   try {
-    return pagePacks(fs15.readFileSync(abs, "utf8")).thirdParty.map((p) => `${p.name}@${p.version}`);
+    return pagePacks(fs16.readFileSync(abs, "utf8")).thirdParty.map((p) => `${p.name}@${p.version}`);
   } catch {
     return [];
   }
@@ -30565,7 +30766,7 @@ async function cmdPoll(file3, flags) {
   if (!reply && (flags["agent-reply"] !== void 0 || flags["agent-reply-file"] !== void 0)) {
     return fail("the agent reply is empty");
   }
-  process.stderr.write(`[${BIN2}] waiting for feedback on ${path15.basename(abs)} (interrupting is safe: feedback stays queued)
+  process.stderr.write(`[${BIN2}] waiting for feedback on ${path16.basename(abs)} (interrupting is safe: feedback stays queued)
 `);
   const ticker = process.stderr.isTTY ? setInterval(() => process.stderr.write(`[${BIN2}] still waiting\u2026
 `), 6e4) : null;
@@ -30662,13 +30863,13 @@ function fixPacks(abs, html) {
     return { html, changes };
   }
   const out = setPacksMeta(html, next);
-  if (out !== html) fs15.writeFileSync(abs, out);
+  if (out !== html) fs16.writeFileSync(abs, out);
   return { html: out, changes: changes.length ? changes : ["updated integrity hashes"] };
 }
 async function cmdCheck(file3, flags = {}) {
   const abs = needFile(file3, "check");
   if (!abs || file3 === void 0) return;
-  let html = fs15.readFileSync(abs, "utf8");
+  let html = fs16.readFileSync(abs, "utf8");
   let fixed = [];
   if (flags.fix) ({ html, changes: fixed } = fixPacks(abs, html));
   const result = checkHtml(html, { file: quote(file3) });
@@ -30680,7 +30881,7 @@ async function cmdCheck(file3, flags = {}) {
   if (flags.render) {
     if (!result.ok) out.render = "skipped: fix the errors above first";
     else {
-      const render = await renderOut(html);
+      const render = await renderOut(html, path16.dirname(abs));
       out.render = render;
       if (render.errors) out.status = "errors";
       else if (render.status === "unavailable") out.status = "render_unavailable";
@@ -30691,14 +30892,16 @@ async function cmdCheck(file3, flags = {}) {
   print(out);
   if (out.status !== "ok") process.exitCode = 1;
 }
-async function renderOut(html) {
-  const r = await renderCheck(html);
+async function renderOut(html, dir) {
+  const r = await renderCheck(html, dir);
   if (r.status === "unavailable") return { status: "unavailable", reason: r.reason };
-  const out = { status: r.errors.length ? "errors" : "clean", widths: "1280, 390", statements: r.statements };
+  const status = r.errors.length ? "errors" : r.overflow.length || r.wide.length ? "warnings" : "clean";
+  const out = { status, widths: "1280, 390", statements: r.statements };
   if (r.errors.length) out.errors = r.errors.map((e) => ({ statement: e.statement || "(page)", message: e.error }));
   if (r.overflow.length) {
     out.scrolls_sideways = r.overflow.map((o) => ({ width: o.width, statements: o.statements.length ? o.statements.join(", ") : "(not one statement)" }));
   }
+  if (r.wide.length) out.warnings = r.wide;
   if (r.notices.length) out.notices = r.notices;
   return out;
 }
@@ -30708,7 +30911,7 @@ async function cmdPatch(file3) {
   if (process.stdin.isTTY) return usage(`pipe the changed statements on stdin: ${BIN2} patch ${quote(file3)} <<'EOF' ... EOF`, "patch");
   const patch = await readStdin();
   if (!patch.trim()) return fail("stdin was empty");
-  const html = fs15.readFileSync(abs, "utf8");
+  const html = fs16.readFileSync(abs, "utf8");
   const art = readArtifact(html);
   if (art.program == null) return fail('no <script type="text/openui"> block to patch');
   const merged = mergeStatements(art.program.trim(), patch.trim(), "root");
@@ -30716,7 +30919,7 @@ async function cmdPatch(file3) {
   const patched = new Set(splitStatements(patch).filter((s) => !/=\s*null\s*;?$/.test(s.text)).map((s) => s.id));
   const dropped = [...patched].filter((id) => !kept.has(id));
   const next = replaceProgram(html, merged);
-  fs15.writeFileSync(abs, next);
+  fs16.writeFileSync(abs, next);
   const result = checkHtml(next, { file: quote(file3) });
   await registerWithHub(abs, result.title, sessionId(abs));
   const out = { status: "patched", file: abs };
@@ -30731,7 +30934,7 @@ function packSpec(p) {
   return lines.join("\n") + "\n";
 }
 function cmdSpec(groups) {
-  let text = fs15.readFileSync(assetPath("prompt.md"), "utf8");
+  let text = fs16.readFileSync(assetPath("prompt.md"), "utf8");
   const packs = installedPacks();
   const packArgs = groups.filter((g) => packs.some((p) => p.name === g));
   if (packArgs.length) {
@@ -30765,9 +30968,9 @@ ${trimmed.join("\n")}
 function cmdExport(file3, flags) {
   const abs = needFile(file3, "export");
   if (!abs) return;
-  const out = typeof flags.out === "string" ? path15.resolve(flags.out) : abs.replace(/\.html?$/i, "") + ".export.html";
-  const { html, notices } = exportHtml(fs15.readFileSync(abs, "utf8"));
-  fs15.writeFileSync(out, html);
+  const out = typeof flags.out === "string" ? path16.resolve(flags.out) : abs.replace(/\.html?$/i, "") + ".export.html";
+  const { html, notices } = exportHtml(fs16.readFileSync(abs, "utf8"), path16.dirname(abs));
+  fs16.writeFileSync(out, html);
   print({ status: "exported", file: out, bytes: html.length, notices: notices.length ? notices : void 0 });
 }
 function printResult(out) {
@@ -30827,7 +31030,7 @@ async function cmdComponents(sub, args, flags) {
           pack: r.name,
           dir: r.dir,
           files: r.files,
-          next: `cd ${quote(path15.relative(process.cwd(), r.dir) || ".")} && npm install && npm run build, then \`${BIN2} components add .\``
+          next: `cd ${quote(path16.relative(process.cwd(), r.dir) || ".")} && npm install && npm run build, then \`${BIN2} components add .\``
         });
       } catch (err) {
         return fail(messageOf(err));
@@ -30938,7 +31141,7 @@ async function cmdHub(sub, args, flags) {
         server: h ? `running on ${port()}${h.persist ? " (persist)" : ""}` : "not running"
       };
       if (hubEnabled() && h) out.url = url2;
-      if (fs15.existsSync(hubDbFile())) {
+      if (fs16.existsSync(hubDbFile())) {
         try {
           const hub = await Hub.open();
           try {
@@ -30954,8 +31157,8 @@ async function cmdHub(sub, args, flags) {
       return print(out);
     }
     case "list": {
-      if (!fs15.existsSync(hubDbFile())) return print({ artifacts: "none", next: `\`${BIN2} hub on\` starts indexing.` });
-      const project = typeof flags.project === "string" ? path15.resolve(flags.project) : "";
+      if (!fs16.existsSync(hubDbFile())) return print({ artifacts: "none", next: `\`${BIN2} hub on\` starts indexing.` });
+      const project = typeof flags.project === "string" ? path16.resolve(flags.project) : "";
       let hub;
       try {
         hub = await Hub.open();
@@ -30980,8 +31183,8 @@ async function cmdHub(sub, args, flags) {
       });
     }
     case "notes": {
-      if (!fs15.existsSync(hubDbFile())) return print({ notes: "none", next: `\`${BIN2} hub on\` starts indexing.` });
-      const project = typeof flags.project === "string" ? path15.resolve(flags.project) : "";
+      if (!fs16.existsSync(hubDbFile())) return print({ notes: "none", next: `\`${BIN2} hub on\` starts indexing.` });
+      const project = typeof flags.project === "string" ? path16.resolve(flags.project) : "";
       let hub;
       try {
         hub = await Hub.open();
@@ -31001,7 +31204,7 @@ async function cmdHub(sub, args, flags) {
           text: r.text || void 0,
           target: r.target || void 0,
           status: r.status === "addressed" ? "answered" : r.status === "held" ? "held" : "unanswered",
-          page: r.title || path15.basename(r.file),
+          page: r.title || path16.basename(r.file),
           file: r.file,
           sent: shortDate(r.at)
         })),
@@ -31125,7 +31328,7 @@ async function main() {
   let name = null;
   if (cmd !== void 0) {
     if (Object.hasOwn(COMMANDS, cmd)) name = cmd;
-    else if (/\.html?$/i.test(cmd) || fs15.existsSync(cmd)) name = "open";
+    else if (/\.html?$/i.test(cmd) || fs16.existsSync(cmd)) name = "open";
     else if (flags.help) return process.stdout.write(HELP);
     else return usage(`unknown command: ${cmd}. One of: ${Object.keys(COMMANDS).join(" ")}, or a page file`);
   }