wikimemory 0.2.0

package/dist/npm-cli/scripts/uninstall.js

@@ -0,0 +1,220 @@
+import { spawn } from "node:child_process";
+import { readFile, unlink, writeFile } from "node:fs/promises";
+import process from "node:process";
+import { createInterface } from "node:readline/promises";
+import { pathToFileURL } from "node:url";
+import { removePackagedDeploymentRecord, uninstallRuntime } from "./lifecycle-runtime.js";
+import { bindingProperty, configValue, deploymentListIndicatesExisting } from "./setup.js";
+const CONFIG_PATH = uninstallRuntime.config;
+const STATE_PATH = uninstallRuntime.installProgress;
+const UNINSTALL_STATE_PATH = uninstallRuntime.uninstallProgress;
+export function parseUninstallOptions(args) {
+    let apply = false;
+    let confirmation = null;
+    let help = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index];
+        if (argument === "--apply")
+            apply = true;
+        else if (argument === "--help")
+            help = true;
+        else if (argument === "--confirm") {
+            const value = args[index + 1];
+            if (value === undefined || value.startsWith("--"))
+                throw new Error("--confirm requires the exact Worker name");
+            confirmation = value;
+            index += 1;
+        }
+        else
+            throw new Error(`Unknown option: ${argument ?? ""}`);
+    }
+    if (confirmation !== null && !apply)
+        throw new Error("--confirm is valid only with --apply");
+    return { apply, confirmation, help };
+}
+export function resolveUninstallTargets(config) {
+    const accountId = configValue(config, "account_id");
+    const workerName = configValue(config, "name");
+    const databaseName = bindingProperty(config, "DB", "database_name");
+    const databaseId = bindingProperty(config, "DB", "database_id");
+    const kvNamespaceId = bindingProperty(config, "OAUTH_KV", "id");
+    if (accountId === null ||
+        workerName === null ||
+        databaseName === null ||
+        databaseId === null ||
+        kvNamespaceId === null) {
+        throw new Error(`${CONFIG_PATH} does not identify one exact Worker, D1 database, and KV namespace`);
+    }
+    return { accountId, workerName, databaseName, databaseId, kvNamespaceId };
+}
+function summary(targets) {
+    return `Cloudflare uninstall targets:\n  Account ID: ${targets.accountId}\n  Worker: ${targets.workerName}\n  D1 database: ${targets.databaseName} (${targets.databaseId})\n  KV namespace ID: ${targets.kvNamespaceId}`;
+}
+export function clientRemovalInstructions(connectorName = "wikimemory") {
+    return `Client registrations are not removed automatically. Disconnect each configured client separately:\n\n  codex mcp logout ${connectorName}\n  codex mcp remove ${connectorName}\n\n  claude mcp logout ${connectorName}\n  claude mcp remove --scope user ${connectorName}\n\nFor Claude web or mobile, remove the custom connector from Settings > Connectors.`;
+}
+async function run(args, allowFailure = false) {
+    console.log(`\n> npx ${args.join(" ")}`);
+    const result = await new Promise((resolve, reject) => {
+        const child = spawn("npx", args, { stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk;
+            process.stdout.write(chunk);
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk;
+            process.stderr.write(chunk);
+        });
+        child.on("error", (error) => {
+            reject(error);
+        });
+        child.on("close", (code) => {
+            resolve({ stdout, stderr, exitCode: code ?? -1 });
+        });
+    });
+    if (result.exitCode !== 0 && !allowFailure)
+        throw new Error(`npx exited with status ${result.exitCode}`);
+    return result;
+}
+async function requireExactName(workerName, supplied) {
+    let answer = supplied;
+    if (answer === null) {
+        const prompt = createInterface({ input: process.stdin, output: process.stdout });
+        answer = await prompt.question(`Type the Worker name ${workerName} to permanently delete all listed cloud resources: `);
+        prompt.close();
+    }
+    if (answer !== workerName)
+        throw new Error("Confirmation did not exactly match the Worker name");
+}
+async function loadProgress(targets) {
+    try {
+        const parsed = JSON.parse(await readFile(UNINSTALL_STATE_PATH, "utf8"));
+        if (typeof parsed !== "object" ||
+            parsed === null ||
+            !("targets" in parsed) ||
+            !("workerDeleted" in parsed) ||
+            !("kvDeleted" in parsed) ||
+            !("databaseDeleted" in parsed)) {
+            throw new Error("Invalid uninstall progress state");
+        }
+        const savedTargets = parsed.targets;
+        if (typeof savedTargets !== "object" ||
+            savedTargets === null ||
+            JSON.stringify(savedTargets) !== JSON.stringify(targets)) {
+            throw new Error("Uninstall progress does not match the current production config");
+        }
+        if (typeof parsed.workerDeleted !== "boolean" ||
+            typeof parsed.kvDeleted !== "boolean" ||
+            typeof parsed.databaseDeleted !== "boolean") {
+            throw new Error("Invalid uninstall progress flags");
+        }
+        return {
+            targets,
+            workerDeleted: parsed.workerDeleted,
+            kvDeleted: parsed.kvDeleted,
+            databaseDeleted: parsed.databaseDeleted
+        };
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+            return { targets, workerDeleted: false, kvDeleted: false, databaseDeleted: false };
+        }
+        throw error;
+    }
+}
+async function saveProgress(progress) {
+    await writeFile(UNINSTALL_STATE_PATH, `${JSON.stringify(progress, null, 2)}\n`, "utf8");
+}
+export async function runUninstall(args, runCommand = run) {
+    const options = parseUninstallOptions(args);
+    if (options.help) {
+        console.log(`Usage: ${uninstallRuntime.executable}                 # preview only\n       ${uninstallRuntime.executable} --apply       # prompt for exact Worker name\n       ${uninstallRuntime.executable} --apply --confirm WORKER_NAME`);
+        return;
+    }
+    const targets = resolveUninstallTargets(await readFile(CONFIG_PATH, "utf8"));
+    console.log(`${summary(targets)}\n\nThis permanently deletes the remote memory database and cannot be undone.`);
+    if (!options.apply) {
+        console.log(`\nPreview only. Rerun with --apply to perform this uninstall.\n\n${clientRemovalInstructions(targets.workerName)}`);
+        return;
+    }
+    await requireExactName(targets.workerName, options.confirmation);
+    const progress = await loadProgress(targets);
+    await saveProgress(progress);
+    if (!progress.workerDeleted) {
+        const probe = await runCommand([
+            "wrangler",
+            "deployments",
+            "list",
+            "--name",
+            targets.workerName,
+            "--json",
+            "--config",
+            CONFIG_PATH
+        ], true);
+        if (deploymentListIndicatesExisting(probe)) {
+            await runCommand([
+                "wrangler",
+                "delete",
+                targets.workerName,
+                "--force",
+                "--config",
+                CONFIG_PATH
+            ]);
+        }
+        else {
+            console.log(`\nWorker ${targets.workerName} is already absent; continuing partial-install cleanup.`);
+        }
+        progress.workerDeleted = true;
+        await saveProgress(progress);
+    }
+    if (!progress.kvDeleted) {
+        await runCommand([
+            "wrangler",
+            "kv",
+            "namespace",
+            "delete",
+            "--namespace-id",
+            targets.kvNamespaceId,
+            "--skip-confirmation",
+            "--config",
+            CONFIG_PATH
+        ]);
+        progress.kvDeleted = true;
+        await saveProgress(progress);
+    }
+    if (!progress.databaseDeleted) {
+        await runCommand([
+            "wrangler",
+            "d1",
+            "delete",
+            targets.databaseId,
+            "--skip-confirmation",
+            "--config",
+            CONFIG_PATH
+        ]);
+        progress.databaseDeleted = true;
+        await saveProgress(progress);
+    }
+    await unlink(CONFIG_PATH);
+    try {
+        await unlink(STATE_PATH);
+    }
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
+            throw error;
+    }
+    await removePackagedDeploymentRecord();
+    await unlink(UNINSTALL_STATE_PATH);
+    console.log(`\nRemoved the Worker, KV namespace, D1 database, and local production config. The remote data is not recoverable.\n\n${clientRemovalInstructions(targets.workerName)}`);
+}
+const entrypoint = process.argv[1];
+if (entrypoint !== undefined && import.meta.url === pathToFileURL(entrypoint).href) {
+    runUninstall(process.argv.slice(2)).catch((error) => {
+        console.error(`\nUninstall failed: ${error instanceof Error ? error.message : "Unknown error"}`);
+        process.exitCode = 1;
+    });
+}

package/dist/npm-cli/scripts/upgrade.js

@@ -0,0 +1,301 @@
+import { createHash } from "node:crypto";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import process from "node:process";
+import { createInterface } from "node:readline/promises";
+import { z } from "zod";
+import { deploymentRecordPath, readDeploymentRecord, writeDeploymentRecord } from "./deployment-record.js";
+import { packageRoot } from "./package-root.js";
+const PACKAGE_ROOT = packageRoot();
+const DEPLOYMENT_NAME = /^[a-z0-9][a-z0-9-]{0,62}$/u;
+const MIGRATION_NAME = /^\d{4}_[a-z0-9_]+\.sql$/u;
+const SHA256 = /^[a-f0-9]{64}$/u;
+const RELEASE_MANIFEST_SCHEMA = z
+    .object({
+    version: z.string().regex(/^\d+\.\d+\.\d+$/u),
+    schemaVersion: z.string().regex(MIGRATION_NAME),
+    migrations: z.array(z
+        .object({ name: z.string().regex(MIGRATION_NAME), sha256: z.string().regex(SHA256) })
+        .strict())
+})
+    .strict();
+export function parseUpgradeOptions(args) {
+    let deployment = "wikimemory";
+    let recordPath = null;
+    let yes = false;
+    let help = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index];
+        if (argument === "--yes")
+            yes = true;
+        else if (argument === "--help")
+            help = true;
+        else if (argument === "--deployment" || argument === "--record") {
+            const value = args[index + 1];
+            if (value === undefined || value.startsWith("--"))
+                throw new Error(`${argument} requires a value`);
+            if (argument === "--deployment") {
+                if (!DEPLOYMENT_NAME.test(value))
+                    throw new Error("Invalid deployment name");
+                deployment = value;
+            }
+            else
+                recordPath = value;
+            index += 1;
+        }
+        else
+            throw new Error(`Unknown option: ${argument ?? ""}`);
+    }
+    return { deployment, recordPath, yes, help };
+}
+export function validateReleaseManifest(value) {
+    const manifest = RELEASE_MANIFEST_SCHEMA.parse(value);
+    const names = manifest.migrations.map((item) => item.name);
+    if (new Set(names).size !== names.length ||
+        names.some((name, index) => index > 0 && name <= (names[index - 1] ?? "")))
+        throw new Error("Release migrations must be unique and strictly ordered");
+    if (names.at(-1) !== manifest.schemaVersion)
+        throw new Error("Release schemaVersion must equal the final migration");
+    return manifest;
+}
+export function planMigrations(manifest, appliedNames) {
+    if (appliedNames.length > manifest.migrations.length)
+        throw new Error("Installed schema is newer than this Wikimemory release");
+    for (const [index, applied] of appliedNames.entries()) {
+        if (manifest.migrations[index]?.name !== applied)
+            throw new Error("Installed migration history does not match this release");
+    }
+    return manifest.migrations.slice(appliedNames.length);
+}
+export function compareSemanticVersions(left, right) {
+    const version = z.string().regex(/^\d+\.\d+\.\d+$/u);
+    const leftParts = version.parse(left).split(".").map(Number);
+    const rightParts = version.parse(right).split(".").map(Number);
+    for (let index = 0; index < 3; index += 1) {
+        const difference = (leftParts[index] ?? 0) - (rightParts[index] ?? 0);
+        if (difference !== 0)
+            return Math.sign(difference);
+    }
+    return 0;
+}
+export function productionUpgradeConfig(record, packageRoot) {
+    return `${JSON.stringify({
+        $schema: join(packageRoot, "node_modules", "wrangler", "config-schema.json"),
+        name: record.workerName,
+        account_id: record.accountId,
+        main: join(packageRoot, "src", "index.ts"),
+        compatibility_date: "2026-07-18",
+        compatibility_flags: ["nodejs_compat"],
+        assets: {
+            directory: join(packageRoot, "dist", "web"),
+            binding: "ASSETS",
+            not_found_handling: "single-page-application"
+        },
+        vars: { APP_ENV: "production", APP_BASE_URL: record.origin },
+        d1_databases: [
+            {
+                binding: "DB",
+                database_name: record.databaseName,
+                database_id: record.databaseId,
+                migrations_dir: join(packageRoot, "migrations")
+            }
+        ],
+        kv_namespaces: [{ binding: "OAUTH_KV", id: record.kvId }]
+    }, null, 2)}\n`;
+}
+const PRODUCTION_UPGRADE_CONFIG_SCHEMA = z.object({
+    name: z.string(),
+    account_id: z.string(),
+    main: z.string(),
+    assets: z.object({ directory: z.string() }),
+    vars: z.object({ APP_BASE_URL: z.string() }),
+    d1_databases: z.array(z.object({ database_id: z.string() })),
+    kv_namespaces: z.array(z.object({ id: z.string() }))
+});
+export function parseProductionUpgradeConfig(value) {
+    return PRODUCTION_UPGRADE_CONFIG_SCHEMA.parse(value);
+}
+export function validateRemoteTargets(record, remote) {
+    if (!remote.accounts.some((account) => account.id === record.accountId))
+        throw new Error("Authenticated identity cannot access the recorded Cloudflare account");
+    if (!remote.databases.some((database) => database.uuid === record.databaseId && database.name === record.databaseName))
+        throw new Error("Recorded D1 database ID and name do not match Cloudflare");
+    if (!remote.namespaces.some((namespace) => namespace.id === record.kvId && namespace.title === record.kvName))
+        throw new Error("Recorded KV namespace ID and name do not match Cloudflare");
+}
+function migrationBundle(sql, migration) {
+    const name = migration.name.replaceAll("'", "''");
+    return `${sql.trimEnd()}\n\nINSERT INTO d1_migrations(name) VALUES ('${name}');\n`;
+}
+async function command(commandName, args) {
+    const { spawn } = await import("node:child_process");
+    return await new Promise((resolve, reject) => {
+        const child = spawn(commandName, args, { stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk;
+            process.stdout.write(chunk);
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk;
+            process.stderr.write(chunk);
+        });
+        child.on("error", (error) => {
+            reject(error);
+        });
+        child.on("close", (code) => {
+            resolve({ stdout, stderr, exitCode: code ?? -1 });
+        });
+    });
+}
+function parsedJson(stdout) {
+    return JSON.parse(stdout);
+}
+async function confirmUpgrade(summary, automatic) {
+    console.log(summary);
+    if (automatic)
+        return;
+    const prompt = createInterface({ input: process.stdin, output: process.stdout });
+    const answer = (await prompt.question("Apply this upgrade? [y/N] ")).trim().toLowerCase();
+    prompt.close();
+    if (answer !== "y" && answer !== "yes")
+        throw new Error("Cancelled");
+}
+async function verifyRelease(origin, manifest) {
+    const health = await fetch(`${origin}/health`, { redirect: "error" });
+    const healthBody = z
+        .object({ status: z.literal("ok"), service: z.literal("wikimemory"), version: z.string() })
+        .parse(await health.json());
+    if (!health.ok || healthBody.version !== manifest.version)
+        throw new Error("Deployed Worker version verification failed");
+    const ready = await fetch(`${origin}/ready`, { redirect: "error" });
+    const readyBody = z
+        .object({
+        status: z.literal("ready"),
+        service: z.literal("wikimemory"),
+        version: z.string(),
+        schemaVersion: z.string()
+    })
+        .parse(await ready.json());
+    if (!ready.ok ||
+        readyBody.version !== manifest.version ||
+        readyBody.schemaVersion !== manifest.schemaVersion)
+        throw new Error("Deployed schema version verification failed");
+    const discovery = await fetch(`${origin}/.well-known/oauth-protected-resource/mcp`, {
+        redirect: "error"
+    });
+    if (!discovery.ok)
+        throw new Error("OAuth protected-resource discovery verification failed");
+    const app = await fetch(`${origin}/app`, { redirect: "error" });
+    if (!app.ok || !(await app.text()).includes('<div id="root"></div>'))
+        throw new Error("React application verification failed");
+}
+export async function runUpgrade(args) {
+    const options = parseUpgradeOptions(args);
+    if (options.help) {
+        console.log("Usage: wikimemory upgrade [--deployment NAME | --record PATH] [--yes]");
+        return;
+    }
+    const recordPath = options.recordPath ?? deploymentRecordPath(options.deployment);
+    const record = await readDeploymentRecord(recordPath);
+    const manifest = validateReleaseManifest(parsedJson(await readFile(join(PACKAGE_ROOT, "release-manifest.json"), "utf8")));
+    for (const migration of manifest.migrations) {
+        const sql = await readFile(join(PACKAGE_ROOT, "migrations", migration.name), "utf8");
+        const digest = createHash("sha256").update(sql, "utf8").digest("hex");
+        if (digest !== migration.sha256)
+            throw new Error(`Packaged migration checksum mismatch: ${migration.name}`);
+    }
+    const temporary = await mkdtemp(join(tmpdir(), "wikimemory-upgrade-"));
+    try {
+        const configPath = join(temporary, "wrangler.jsonc");
+        await writeFile(configPath, productionUpgradeConfig(record, PACKAGE_ROOT), "utf8");
+        const common = ["--config", configPath];
+        const [whoami, deployments, d1, kv] = await Promise.all([
+            command("npx", ["wrangler", "whoami", "--json"]),
+            command("npx", [
+                "wrangler",
+                "deployments",
+                "list",
+                "--name",
+                record.workerName,
+                "--json",
+                ...common
+            ]),
+            command("npx", ["wrangler", "d1", "list", "--json", ...common]),
+            command("npx", ["wrangler", "kv", "namespace", "list", ...common])
+        ]);
+        if ([whoami, deployments, d1, kv].some((result) => result.exitCode !== 0))
+            throw new Error("Cloudflare target preflight failed");
+        const whoamiBody = z
+            .object({ accounts: z.array(z.object({ id: z.string() })) })
+            .parse(parsedJson(whoami.stdout));
+        const deploymentBody = z.array(z.unknown()).parse(parsedJson(deployments.stdout));
+        if (deploymentBody.length === 0)
+            throw new Error("Recorded Worker does not exist");
+        validateRemoteTargets(record, {
+            accounts: whoamiBody.accounts,
+            databases: z
+                .array(z.object({ uuid: z.string(), name: z.string() }))
+                .parse(parsedJson(d1.stdout)),
+            namespaces: z
+                .array(z.object({ id: z.string(), title: z.string() }))
+                .parse(parsedJson(kv.stdout))
+        });
+        const listed = await command("npx", [
+            "wrangler",
+            "d1",
+            "execute",
+            record.databaseId,
+            "--remote",
+            "--json",
+            ...common,
+            "--command",
+            "SELECT name FROM d1_migrations ORDER BY id"
+        ]);
+        if (listed.exitCode !== 0)
+            throw new Error("Could not read installed migrations");
+        const query = z
+            .array(z.object({ results: z.array(z.object({ name: z.string() })) }))
+            .parse(parsedJson(listed.stdout));
+        const applied = query.flatMap((result) => result.results.map((row) => row.name));
+        const pending = planMigrations(manifest, applied);
+        const health = await fetch(`${record.origin}/health`, { redirect: "error" });
+        const current = z.object({ version: z.string().optional() }).parse(await health.json()).version ??
+            record.installedVersion;
+        if (!health.ok)
+            throw new Error("Current deployment health check failed");
+        if (compareSemanticVersions(current, manifest.version) > 0)
+            throw new Error(`Refusing to downgrade Wikimemory from ${current} to ${manifest.version}`);
+        await confirmUpgrade(`\nWikimemory upgrade\n  Account: ${record.accountId}\n  Worker: ${record.workerName}\n  D1: ${record.databaseName} (${record.databaseId})\n  KV: ${record.kvName} (${record.kvId})\n  Origin: ${record.origin}\n  Version: ${current} -> ${manifest.version}\n  Migrations: ${pending.map((item) => item.name).join(", ") || "none"}`, options.yes);
+        for (const migration of pending) {
+            const bundlePath = join(temporary, migration.name);
+            const sql = await readFile(join(PACKAGE_ROOT, "migrations", migration.name), "utf8");
+            await writeFile(bundlePath, migrationBundle(sql, migration), "utf8");
+            const result = await command("npx", [
+                "wrangler",
+                "d1",
+                "execute",
+                record.databaseId,
+                "--remote",
+                ...common,
+                "--file",
+                bundlePath
+            ]);
+            if (result.exitCode !== 0)
+                throw new Error(`Migration failed: ${migration.name}`);
+        }
+        const deployed = await command("npx", ["wrangler", "deploy", "--strict", ...common]);
+        if (deployed.exitCode !== 0)
+            throw new Error("Worker deployment failed");
+        await verifyRelease(record.origin, manifest);
+        await writeDeploymentRecord({ ...record, installedVersion: manifest.version }, recordPath);
+        console.log(`\nWikimemory ${manifest.version} is ready. Schema: ${manifest.schemaVersion}`);
+    }
+    finally {
+        await rm(temporary, { recursive: true, force: true });
+    }
+}

package/dist/npm-cli/src/version.js

@@ -0,0 +1,2 @@
+export const WIKIMEMORY_VERSION = "0.2.0";
+export const LATEST_SCHEMA_VERSION = "0004_credential_bound_registration_tokens.sql";

package/dist/web/assets/index-CjnFBnXp.css

@@ -0,0 +1 @@
+:root{--lightningcss-light:initial;--lightningcss-dark: ;color-scheme:light dark;--bg:#f5f6f8;--panel:#fff;--ink:#19211e;--muted:#66716c;--line:#dfe4e1;--accent:#176b52;--danger:#a83a3a}@media (prefers-color-scheme:dark){:root{--lightningcss-light: ;--lightningcss-dark:initial}}*{box-sizing:border-box}body{background:var(--bg);color:var(--ink);margin:0;font:400 1rem/1.6 ui-sans-serif,system-ui,sans-serif}a{color:var(--accent)}header{border-bottom:1px solid var(--line);background:var(--panel);flex-wrap:wrap;align-items:center;gap:.5rem;padding:.75rem max(1rem,50% - 36rem);display:flex}header a{padding:.4rem;text-decoration:none}.brand{align-items:center;gap:.5rem;margin-right:auto;font-weight:800;display:flex}.brand span{background:var(--accent);color:#fff;border-radius:.55rem;place-items:center;width:2rem;height:2rem;display:grid}main{width:min(72rem,100% - 2rem);margin:auto;padding:3rem 0 6rem}.center{place-items:center;min-height:100vh;padding:1rem;display:grid}.center .panel{width:min(32rem,100%)}h1,h2{line-height:1.2}.lede,.muted,small{color:var(--muted)}.panel,.card{border:1px solid var(--line);background:var(--panel);border-radius:.85rem;padding:1.25rem}.panel{margin-bottom:1rem}.grid{grid-template-columns:repeat(auto-fill,minmax(min(100%,19rem),1fr));gap:1rem;display:grid}.meta{flex-wrap:wrap;gap:.4rem;display:flex}.meta span{background:#e7f4ef;border-radius:999px;padding:.1rem .45rem;font-size:.8rem}.search{gap:.5rem;margin:1rem 0 2rem;display:flex}input{background:var(--panel);width:100%;color:inherit;font:inherit;border:1px solid #b8c2bd;border-radius:.55rem;padding:.7rem}label{margin:1rem 0;font-weight:650;display:block}button,.button{border:1px solid var(--accent);background:var(--accent);color:#fff;cursor:pointer;border-radius:.55rem;padding:.7rem .95rem;font:600 .9rem system-ui;text-decoration:none;display:inline-flex}button:disabled{opacity:.5}.danger{border-color:var(--danger);color:var(--danger);background:0 0;margin-top:.5rem}.list{padding:0;list-style:none}.list li{border-bottom:1px solid var(--line);padding:.75rem 0}.list small{display:block}.notice{border-left:.3rem solid var(--accent);background:#e7f4ef;padding:.7rem 1rem}.document-body{border:1px solid var(--line);background:var(--panel);color:inherit;font:inherit;white-space:pre-wrap;overflow-wrap:anywhere;border-radius:.85rem;margin:2rem 0;padding:1.25rem;overflow-x:auto}.metadata{gap:.5rem;margin:1.5rem 0;display:grid}.metadata div{grid-template-columns:minmax(7rem,.25fr) 1fr;gap:1rem;display:grid}.metadata dt{color:var(--muted);font-weight:650}.metadata dd{margin:0}@media (prefers-color-scheme:dark){:root{--bg:#111714;--panel:#19201d;--ink:#edf3ef;--muted:#a6b0ab;--line:#2c3732;--accent:#74c9aa;--danger:#ef8585}.meta span,.notice{background:#183a2f}}