diff --git a/.gitignore b/.gitignore index bafbf59a..300fda45 100644 --- a/.gitignore +++ b/.gitignore @@ -19,6 +19,8 @@ TODO .claude/ .worktrees/ .superpowers/ +# Superpowers design specs and plans: working notes, kept out of the repo. +docs/superpowers/ # mage desktop:* build outputs (rootfs.img, images-minimal.tar.zst, ap.app) # and downloaded upstream artifacts (Ubuntu cloud image, k3s release) — see diff --git a/AGENTS.md b/AGENTS.md index 430b838c..6987e7ad 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -348,9 +348,10 @@ mage manifests # always after gen:api, OR after any config/ edit ## Documentation regeneration -`mage docs:cli` and `mage docs:crd` regenerate the showcase docs site's -reference pages — one from the live cobra tree, one from the CRD schemas under -`config/crds`. Both are plain deterministic generators; neither invokes an LLM. +`mage docs:cli` and `mage docs:crd` regenerate the docs site's reference pages — +one from the live cobra tree, one from the CRD schemas under `config/crds` — +writing into `site/content/docs`. Both are plain deterministic generators; +neither invokes an LLM. `PRIMITIVES.md` (repo root) and `docs/owasp-agentic-top10-coverage.html` are both hand-maintained: update them by hand when a primitive's code moves or the @@ -625,7 +626,7 @@ invisible in the mode everyone tests.** See ## Ship gate: all three test suites must pass before anything merges -**Nothing ships — no merge to `master`, no push, no "done" — until all three +**Nothing ships — no merge to `main`, no push, no "done" — until all three suites are green:** ```bash @@ -809,7 +810,7 @@ false confidence. The integration and e2e tests are gated behind A change can leave the entire e2e suite red — or not even compiling — and the default `go test` run stays green. -This is not hypothetical: the owner-derived approver refactor merged to `master` +This is not hypothetical: the owner-derived approver refactor merged to `main` with the whole e2e suite broken (stale `started_by` model, a `pipeline.Authz` stub missing new methods, approval scenarios that no longer had a valid approver) because only the unit suite was run. Fixing it after the fact cost far @@ -1029,7 +1030,7 @@ log): here "audit" means _review the code_, not _the append-only ledger_. ### What a pass does 1. **Scope the target.** Default is the **whole repo** (`pkg/` + `cmd/`). Narrow - it when asked: "recent changes" → `git diff master...HEAD`; one or more named + it when asked: "recent changes" → `git diff main...HEAD`; one or more named packages → just those. The whole-repo pass is expensive by design — it partitions the 330+ leaf packages into subsystem groups and fans out — so use the narrowed forms for routine work and reserve the full sweep for a periodic @@ -1089,13 +1090,13 @@ it): ```bash mage audit:all # whole repo (pkg/ + internal/ + cmd/) -mage audit:recent # git diff master...HEAD (no-op if empty) +mage audit:recent # git diff main...HEAD (no-op if empty) mage audit:pkg pkg/memory # a named package/dir ``` Env overrides: `AUDIT_DRY_RUN=1` prints the prompt/command without invoking Claude; `AUDIT_CLAUDE_MODEL` (default `opus`) and `AUDIT_DIFF_BASE` (default -`master`) override the model and the "recent" diff base. Or trigger a pass in +`main`) override the model and the "recent" diff base. Or trigger a pass in plain language — "run an audit on `pkg/memory`" — following the steps above. ### Rules of thumb diff --git a/README.md b/README.md index ba43a908..95c3bdb9 100644 --- a/README.md +++ b/README.md @@ -52,15 +52,15 @@ with many different owners. Every control in OAP therefore sits outside the model. The platform decides before the call, and the decision does not depend on the agent's cooperation. -| | Typical agent platform | OAP | -| ----------------------------------- | ---------------------------------- | ------------------------------------ | -| What an agent can reach | Whatever its credentials allow | Exactly what you granted | -| Who decides an action is allowed | The model, in the moment | The platform, before the call | -| An injected instruction mid-session | Can redirect the agent | Cannot exceed the approved plan | -| Tool credentials | Shared across tools in one sandbox | Held only by the tool that uses them | -| Restricting an MCP server | Needs a narrow upstream token | Declared by you, enforced per call | -| Revoking access | Rotate credentials, redeploy | One permission graph call | -| The audit log | Append-only, enforced by the store | Signed, chained, verifiable offline | +| | Typical agent platform | OAP | +| ----------------------------------- | ---------------------------------- | --------------------------------------- | +| What an agent can reach | Whatever its credentials allow | Exactly what you granted | +| Who decides an action is allowed | The model, in the moment | The platform, before the call | +| An injected instruction mid-session | Can redirect the agent | Cannot widen what it's authorized to do | +| Tool credentials | Shared across tools in one sandbox | Held only by the tool that uses them | +| Restricting an MCP server | Needs a narrow upstream token | Declared by you, enforced per call | +| Revoking access | Rotate credentials, redeploy | One permission graph call | +| The audit log | Append-only, enforced by the store | Signed, chained, verifiable offline | ## What makes it secure @@ -192,9 +192,8 @@ On first launch, pick a model provider, enter its API key, and set a local admin password. OAP provisions the VM, configures the platform, and installs a demo agent. -Desktop is single-player: good for trying OAP, developing and demoing agents, or -running production agents one person owns and operates. Use Kubernetes when -agents need a shared environment. +Desktop is single-player: good for trying OAP and for developing and demoing +agents. Use Kubernetes for anything durable or shared. **Local Kubernetes** installs onto a `kind` cluster for development: @@ -340,10 +339,13 @@ outside it. ## Read the docs +The docs are at [openap.org/docs](https://openap.org/docs). To run them locally +instead: + ```bash -cd showcase +cd site pnpm install -pnpm docs:dev +pnpm dev ``` Then open [http://localhost:5179](http://localhost:5179) for installation diff --git a/cmd/oap/clidocs_gen_test.go b/cmd/oap/clidocs_gen_test.go index b2f94be4..677a89d1 100644 --- a/cmd/oap/clidocs_gen_test.go +++ b/cmd/oap/clidocs_gen_test.go @@ -7,7 +7,7 @@ import ( "github.com/authzed/openagentprimitives/pkg/gen/clidocs" ) -// TestGenerateCLIReference regenerates the showcase docs' CLI reference from the +// TestGenerateCLIReference regenerates the site's CLI reference from the // live oap command tree. It is the gated driver for pkg/gen/clidocs (NewRootCmd // is in package main and can't be imported there). Runs only when // OAP_GEN_CLI_DOCS names an output dir — `mage docs:cli` sets it; a normal diff --git a/cmd/oap/internal/channelcmd/root.go b/cmd/oap/internal/channelcmd/root.go index d982ff60..293d1efe 100644 --- a/cmd/oap/internal/channelcmd/root.go +++ b/cmd/oap/internal/channelcmd/root.go @@ -12,7 +12,7 @@ func NewCmd(g *apcmd.Globals) *cobra.Command { cmd := &cobra.Command{ Use: "channel", Aliases: []string{"channels", "ch"}, - Short: "Manage Channel CRs (Slack, future webhook/cron, ...).", + Short: "Manage Channel CRs (Slack, browser, GitHub webhooks, schedules, ...).", } cmd.AddCommand( newChannelListCmd(g), diff --git a/docs/assets/brand/README.md b/docs/assets/brand/README.md index cd8250f8..d693bdf1 100644 --- a/docs/assets/brand/README.md +++ b/docs/assets/brand/README.md @@ -34,6 +34,7 @@ the inlined copies too: | `pkg/platform/identityd/handlers_password.go` | The icon on the sign-in page | | `cmd/oap/internal/desktop/setupui/static/index.html` | The logomark in the desktop setup header, plus the icon | | `cmd/oap/internal/desktop/menubaricons/render/tunnel.go` | Not a copy: the menu-bar icons are drawn in code. `menuMarkCutout` carries the menu icon's cut-out; regenerate the PNGs with `mage desktop:icons`. | +| `site/components/OapMark.tsx` | `OapMark`, the logomark inlined for the landing page and site footer so it inherits `currentColor` and needs no light/dark asset pair. | -The repo README and the showcase docs site (`showcase/docs/app`) reference the -files here directly. +The repo README and the docs + landing site (`site/`: the `Wordmark` component +and the root layout icons) reference the files here directly. diff --git a/docs/owasp-agentic-top10-coverage.html b/docs/owasp-agentic-top10-coverage.html index 1b85c8d6..ef4ba2a2 100644 --- a/docs/owasp-agentic-top10-coverage.html +++ b/docs/owasp-agentic-top10-coverage.html @@ -91,7 +91,7 @@ } .distro > div { display: flex; align-items: center; justify-content: center; color: #0c050f; } .distro .s-full { background: var(--cov-full); flex: 4; } - .distro .s-partial { background: var(--cov-partial); flex: 5; } + .distro .s-partial { background: var(--cov-partial); flex: 6; } .distro .s-minimal { background: var(--cov-minimal); flex: 1; } .distro .s-na { background: var(--cov-na); flex: 1; } .distro-note { color: var(--fg-faint); font-size: 12px; } @@ -213,7 +213,7 @@

OWASP Agentic Top 10 × agentprimiti

Source: OWASP Top 10 For Agentic Applications 2026 (OWASP GenAI Security Project — Agentic Security Initiative, Dec 2025, CC BY-SA 4.0)  ·  - Assessment scope: agentprimitives @ branch master, + Assessment scope: agentprimitives @ branch main, point-in-time read of the codebase.  ·  Not an official OWASP or AuthZed artifact.

@@ -229,17 +229,16 @@

At a glance

ap's defenses concentrate at the action boundary (tools, identity, authorization, human approval) and the execution boundary (sandboxed, non-root, no-shell, default-on per-tool - circuit breakers / rate limits, and default-on runner + sandbox egress NetworkPolicies). They thin out at + circuit breakers plus opt-in rate limits, and default-on runner + sandbox egress NetworkPolicies). They thin out at the input / content-integrity boundary (memory poisoning, indirect injection of retrieved content); supply-chain provenance now has content-hash pinning across dependency kinds but - still lacks signing / attestation. Multi-agent risks (ASI07/ASI08 - fan-out) are mostly off the table because ap runs one agent per session. + still lacks signing / attestation. Multi-agent risk (ASI07) is bounded by a closed, reviewed subagent + roster and typed, separately authorized parent↔child messages, but stays within one cluster.

@@ -299,12 +298,12 @@

Memory & Context Poisoning

-
-
ASI07Architectural N/A
+
+
ASI07Partial

Insecure Inter-Agent Comms

Tampered / spoofed / replayed messages between cooperating agents (A2A, MCP, message bus).

-
-
single-agent
+
+
channelsagent-def
@@ -351,7 +350,7 @@

Rogue Agents

ASI04 — Agentic Supply Chain ASI05 — Unexpected Code Execution ASI06 — Memory & Context Poisoning - ASI07 — Insecure Inter-Agent Comms + ASI07 — Insecure Inter-Agent Comms ASI08 — Cascading Failures ASI09 — Human-Agent Trust Exploitation ASI10 — Rogue Agents @@ -374,10 +373,11 @@

What ap does

  • Every tool result is wrapped in an unpredictable per-result nonce (<untrusted-tool-output nonce="…">) the output can't forge — and tool results are the only non-user ingress path: retrieval, web search, and even memory/KG recall arrive as wrapped tool output, and wrappers persist in the transcript across turns.pkg/agent/runner/loop.go:59–98, 1561
  • System prompt rule: treat everything inside a matched pair strictly as data to observe, never instructions — even "ignore previous instructions" style text. This is delimiter-based spotlighting with unforgeable markers, and prompt-level by design: a general-purpose agent must reason over the content itself, so quarantining it behind a sub-LLM or paraphrasing it would strip or alter exactly the meaning the task needs. The rule's first line is model compliance; the enforcement backstop is structural at the action boundary — dual validation, approval gates, the isolated summarizer — not input isolation.pkg/agent/runner/prompt.go:206
    • +
  • Tool output cannot widen what the agent may do: every action a tool result might prompt is checked outside the model, at the same pre-dispatch choke point as any other call. The delimiter and system-prompt items above help the model, but are not the boundary.pkg/agent/runner/loop_dispatch.go
  • High-impact / external actions are gated by human approval, so a hijacked goal can't silently execute irreversible side effects.pkg/authz/hooks/toolcallauthz.go
  • The approver's "What" is generated by an isolated summarizer LLM that never sees the (possibly-poisoned) primary chat — a hijacked agent can't talk its way past the gate (see ASI09).
  • Closed-world tools + least privilege bound the blast radius of any redirected goal.
    • -
  • A pluggable content-inspection seam now guards the tool-I/O ingress path — the only non-user ingress (see the nonce-wrap item above). Registry-keyed contentguard Inspector plugins examine the serialized tool args (PreToolCall) and the tool result (PostToolCall) and return pass / block / approve, mapped onto the existing pipeline (Block withholds the whole result from the model; Approve raises a human gate). Default-off, referenced from tiered settings by ID as a ceiling (lower tiers add, never weaken), and fail-closed: an inspector that errors blocks, an unregistered ID / unparseable config makes the settings object Invalid. The shipped example, url-allowlist, enforces an ordered domain-glob / regex / CEL URL policy (per-rule allow/deny/approve) over URLs found in tool I/O — blocking exfiltration / injection-carrier URLs in tool output before they reach the model.pkg/authz/contentguard/; pkg/authz/contentguard/kinds/urlallowlist/; pkg/authz/contentguard/hook.go; pkg/apis/v1alpha1/settings_common_types.go (ContentInspectors)
    • +
  • A pluggable content-inspection seam now guards the tool-I/O ingress path — the only non-user ingress (see the nonce-wrap item above). Registry-keyed contentguard Inspector plugins examine the serialized tool args (PreToolCall) and the tool result (PostToolCall) and return pass / block / approve, mapped onto the existing pipeline (Block withholds the whole result from the model; Approve raises a human gate). Default-off, referenced from tiered settings by ID as a ceiling (lower tiers add, never weaken), and fail-closed: an inspector that errors blocks, an unregistered ID / unparseable config makes the settings object Invalid. Two inspectors ship. prompt-injection runs a classifier over inspected text in a per-session pod with egress denied unconditionally, and blocks content above a threshold. url-allowlist enforces an ordered domain-glob / regex / CEL URL policy (per-rule allow/deny/approve) over URLs found in tool I/O — blocking exfiltration / injection-carrier URLs in tool output before they reach the model.pkg/authz/contentguard/; pkg/authz/contentguard/kinds/promptinjection/; pkg/authz/contentguard/kinds/urlallowlist/; pkg/authz/contentguard/hook.go; pkg/apis/v1alpha1/settings_common_types.go (ContentInspectors)
@@ -385,7 +385,7 @@

What's missing

  • No goal-lock / "intent capsule." The declared goal isn't bound into a signed envelope per cycle, so subtle goal drift isn't detected.
  • No plan-divergence detection. The plans state tracks step status but never alerts when the agent deviates from its declared plan.pkg/agent/session/state/plans/
    • -
  • The content-inspection seam exists, but no prompt-injection / prompt-carrier detector ships in it yet. The contentguard framework + the url-allowlist example (see left) cover URL-policy exfil/injection-carrier guarding, but there is no built-in CDR (content disarm & reconstruction) or injection-payload classifier inspector — that detector is the next inspector kind, not a new framework. Coverage is also tool-I/O-scoped: meta tools (respond_to_user et al.) bypass the gate pipeline, and memory/KG writes aren't inspected (ASI06).
    • +
  • Inspection covers tool I/O, not the agent's own replies. The prompt-injection and url-allowlist inspectors (see left) examine tool args and results; there is no built-in CDR (content disarm & reconstruction) inspector, and memory/KG writes aren't inspected (ASI06).
@@ -410,7 +410,7 @@

What ap does

  • Secret scrubbing + out-of-band secretout: declared secrets in tool output are diverted to a session store and replaced with an opaque handle the LLM never reads.pkg/tools/redact/, pkg/agent/secretout/
  • SSRF-guarded HTTP for MCP; turn / token / duration budgets bound runaway loops.pkg/x/safehttp/, pkg/agent/runner/budget.go
  • Capability drift is enforced per the effective pinning mode: a block rule withholds drifted tools at session start, approve escalates their calls to human approval (an empty rule mode defaults to approve), and drift is recorded in observedPins + audit pin facts.cmd/runner/pindrift.go:10–24; pkg/platform/settings/pinning.go:11–15
    • -
  • Per-tool rate limits are enforced at dispatch and default-on: a toolguard Guard hook runs at PreToolCall (before the SpiceDB check) and denies calls that exceed maxCallsPerTurn or maxCalls + window; even with no policy declared, a builtin rule applies. This directly bounds the OWASP "ping in a loop to exfiltrate via DNS" pattern (ASI02 scenario 7).pkg/apis/v1alpha1/toolguard_types.go:87–101; pkg/authz/toolguard/state.go:217–239; pkg/authz/toolguard/hook_guard.go:45–102; pkg/agent/runner/pipeline_wiring.go:794–814
    • +
  • Per-tool rate limits are enforced at dispatch, opt-in: a toolguard Guard hook runs at PreToolCall (before the SpiceDB check) and denies calls that exceed maxCallsPerTurn or maxCalls + window. The builtin rule that applies with no policy declared turns the circuit breaker on and leaves rate limits off, so a limit binds once a ToolGuardPolicy tier sets one. This directly bounds the OWASP "ping in a loop to exfiltrate via DNS" pattern (ASI02 scenario 7).pkg/apis/v1alpha1/toolguard_types.go:87–101; pkg/authz/toolguard/policy.go:11; pkg/authz/toolguard/state.go:217–239; pkg/authz/toolguard/hook_guard.go:45–102; pkg/agent/runner/pipeline_wiring.go:794–814
  • Per-call data-volume budgets are enforced in both directions. A toolguard DataLimit caps the serialized tool-args size at PreToolCall (egress — over-limit denies before the tool runs) and the tool-result size at PostToolCall (ingress — over-limit withholds the result, swapping in an IsError the model never reads), so a single call can't move an unbounded payload past its cap. The ingress cap applies to error results too — a tool can't mark an oversized exfil payload IsError to slip it through — and the limit is available per-tool and as a tiered, strictest-wins ceiling.pkg/apis/v1alpha1/toolguard_types.go:105–132,164–172; pkg/authz/toolguard/hook_guard.go:58–62; pkg/authz/toolguard/hook_record.go; pkg/authz/toolguard/events.go
    • @@ -418,7 +418,7 @@

    What ap does

    What's missing

    @@ -557,28 +557,28 @@

    What's missing

    -
    -

    ASI07 Insecure Inter-Agent Communication Architectural N/A

    +
    +

    ASI07 Insecure Inter-Agent Communication Partial

    Multi-agent systems are exposed to intercepted, spoofed, or replayed messages between cooperating agents - (A2A, MCP, message bus). ap runs one agent per session; channels are - human↔agent, not agent↔agent — so this class is largely out of scope today. + (A2A, MCP, message bus). In ap, agents talk to each other only through delegation: a parent + session hands work to a subagent session, and the two exchange a small set of typed messages.

    -

    Why it's out of scope (and where the seam is)

    +

    What ap does

      -
    • Each AgentSession is a single runner pod with one LLM loop; there is no agent-to-agent delegation or A2A registry.
      • -
    • NATS carries human↔agent envelopes and operator↔runner control only — not cross-runner agent messaging.README.md (architecture)
      • -
    • Per-session pods, per-session Secrets, and scoped RBAC keep one session's traffic off another's.
      • +
    • Delegation reaches only a closed, reviewed subagent roster, validated as a DAG (no cycles); entries can be pinned to an exact bundle digest.
      • +
    • The delegation tree is bounded: maxDelegatedAgents caps its size, and each roster member has a mode ceiling. Each subagent is its own scoped, budgeted, audited AgentSession.
      • +
    • Parent and child exchange only three typed, separately authorized directions (ask_parent, return_result, reply_to_subagent), delivered as inspected tool results. Free-form agent-to-agent messages were deliberately removed.pkg/apis/v1alpha1/subagentrequest_types.go
      • +
    • The sender is authenticated by its own per-session bus subject, and the destination must match a real Channel joining the two sessions.pkg/channels/channelkinds/agent/sender.go
      • +
    • Passing data past its audience parks for the data owner's approval, so delegation can't launder a disclosure boundary.
    -

    What to watch if multi-agent lands

    +

    What's missing

      -
    • The transport that does exist isn't fully locked down: the channelsd NATS JWT subject scope is broad (ap.> + _INBOX.>), though runner per-session JWTs are already narrowly scoped.
      • -
    • No mutual-auth / signed-message / anti-replay machinery exists to build on — it would be green-field if A2A is added.
      • -
    • No attested agent registry or agent-card verification.
      • +
    • Delegation stays within one cluster; there is no protocol for agents outside it.
    @@ -701,7 +701,7 @@

    Where the gaps cluster

    Input / content integrity - A pluggable content-inspection seam (contentguard) now guards the tool-I/O ingress path with a url-allowlist example — but no prompt-injection/CDR detector inspector ships yet, meta tools bypass it, and memory/KG writes are still uninspected (no content validation on memory writes; bootstrap-poisoning via self-ingestion; no provenance scores). + A pluggable content-inspection seam (contentguard) now guards the tool-I/O ingress path with a prompt-injection classifier and a url-allowlist inspector — but inspection covers tool I/O, not the agent's own replies, no CDR inspector ships, and memory/KG writes are still uninspected (no content validation on memory writes; assistant turns ingested into the knowledge graph without separate validation; no provenance scores). ASI01 · ASI06 pkg/authz/contentguard/; facade.go:108–127, kgingestion/hooks.go @@ -719,7 +719,7 @@

    Where the gaps cluster

    Intra-session isolation - Tier-1 sandbox isolation deferred — ToolCalls in a session share UID / /proc / /work. (Per-tool rate limits / circuit breakers are now enforced and default-on via pkg/toolguard in the dispatch pipeline.) + Tier-1 sandbox isolation deferred — ToolCalls in a session share UID / /proc / /work. (Per-tool circuit breakers are now enforced and default-on via pkg/authz/toolguard in the dispatch pipeline; rate limits are enforced there too, but opt-in.) ASI05 · ASI08 Open @@ -731,11 +731,10 @@

    Where the gaps cluster

    classic agent-authorization risks — tool misuse, privilege abuse, unsafe execution, and human-approval manipulation (ASI02/03/05/09). The work ahead is mostly at two frontiers the design hasn't reached yet: content integrity (treating untrusted data and memory as adversarial, not just access-controlled) — - where a pluggable contentguard inspection seam over tool I/O is now the first foothold, awaiting a - prompt-injection/CDR detector and memory-write validation — and supply-chain provenance - (verifying where tools and descriptors come from). Multi-agent risks - (ASI07/08) stay parked until/unless ap grows agent-to-agent topology — at which point inter-agent - auth becomes green-field work, not a retrofit. + where a pluggable contentguard inspection seam over tool I/O, with a prompt-injection classifier and a + URL allowlist, is now the first foothold, awaiting CDR and memory-write validation — and supply-chain provenance + (verifying where tools and descriptors come from). Inter-agent communication (ASI07) is bounded to delegation + inside one cluster; there is no protocol for agents outside it.
    @@ -747,8 +746,8 @@

    Mapped to the six primitives

    Safe toolsASI02, ASI04, ASI05, ASI01Strong on misuse/RCE; weak on supply-chain provenance. Identity & credentialsASI03Strong; TOCTOU + sidecar-freeze are the edges. AuthorizationASI02, ASI03, ASI06, ASI10Strong per-action checks; no behavioral attestation. - Agent definitionASI01, ASI08, ASI09Approval + budgets + isolation strong; no plan-divergence. - Channels & continuityASI09, (ASI07)Human approval strong; agent↔agent absent by design. + Agent definitionASI01, ASI07, ASI08, ASI09Approval + budgets + isolation strong; no plan-divergence. + Channels & continuityASI09, ASI07Human approval strong; agent↔agent limited to typed, authorized delegation messages. Memory & knowledgeASI06, ASI10Access-control strong; content-integrity thin. @@ -756,7 +755,7 @@

    Mapped to the six primitives

    Methodology. Risk definitions are taken from the OWASP Top 10 for Agentic Applications 2026. Coverage verdicts come from a point-in-time read of the agentprimitives codebase (branch - master): file references point at the mechanism that mitigates each risk, + main): file references point at the mechanism that mitigates each risk, Meter fills are a qualitative judgment of coverage breadth, not a quantitative score.

    Caveats. This is an internal mapping for orientation, not a formal security audit or a penetration test. It does not certify that the cited controls are free of implementation bugs — only that the diff --git a/magefiles/clidocs.go b/magefiles/clidocs.go index fa7f937e..049d1dd0 100644 --- a/magefiles/clidocs.go +++ b/magefiles/clidocs.go @@ -13,14 +13,14 @@ import ( "github.com/authzed/openagentprimitives/pkg/gen/crddocs" ) -// docsGuidesDir is where the generated reference MDX lands, alongside the rest of -// the showcase docs guides. -const cliDocsDir = "showcase/docs/guides" +// cliDocsDir is where the generated reference MDX lands, alongside the +// hand-written guides the site renders. +const cliDocsDir = "site/content/docs" // crdSchemaDir holds the controller-gen CRD YAMLs the CRD reference is built from. const crdSchemaDir = "config/crds" -// Crd regenerates the showcase docs' CRD reference (one MDX page per CustomResource +// Crd regenerates the site's CRD reference (one MDX page per CustomResource // kind) from the CRD schemas under config/crds. Unlike Cli it runs in-process — it // reads YAML, so it needs no seam into package main. Run `mage gen:api` first if // the CRD schemas are stale relative to the *_types.go. @@ -32,7 +32,7 @@ func (Docs) Crd() error { return nil } -// Cli regenerates the showcase docs' CLI reference (one MDX page per `oap` +// Cli regenerates the site's CLI reference (one MDX page per `oap` // command family) from the live cobra tree. The walk lives in pkg/gen/clidocs; // it is driven here by the gated TestGenerateCLIReference in cmd/oap, because // NewRootCmd is package main and can only be reached from within that package. diff --git a/magefiles/fmt.go b/magefiles/fmt.go index e850ef51..23422c14 100644 --- a/magefiles/fmt.go +++ b/magefiles/fmt.go @@ -30,6 +30,8 @@ var fmtTargets = []string{ "web/**/*.tsx", "showcase/**/*.ts", "showcase/**/*.tsx", + "site/**/*.ts", + "site/**/*.tsx", } // All rewrites Markdown and TypeScript in place. diff --git a/magefiles/magefile.go b/magefiles/magefile.go index 02aa998c..ddb90014 100644 --- a/magefiles/magefile.go +++ b/magefiles/magefile.go @@ -417,9 +417,8 @@ func (Test) Unit() error { } // defaultWebCheckDiffBase is the git ref checkWebBundleFreshness diffs -// against by default, mirroring auditgen's DiffBase convention -// (AUDIT_DIFF_BASE, defaulting to "master"). -const defaultWebCheckDiffBase = "master" +// against by default: this repo's base branch. +const defaultWebCheckDiffBase = "main" // checkWebBundleFreshness runs `mage web:check` when this branch's diff // touches pkg/**/ui/** — the TypeScript source web/vite.config.ts's @@ -443,7 +442,7 @@ const defaultWebCheckDiffBase = "master" // already needs node to have made that edit, so paying it here costs them // nothing new. // -// WEB_CHECK_DIFF_BASE overrides the default "master" base. A diff-computation +// WEB_CHECK_DIFF_BASE overrides the default "main" base. A diff-computation // failure (no such ref, a shallow clone missing history) is logged and SKIPS // the check rather than failing test:unit outright — test:unit is the fast // gate every developer runs constantly (see (Test).Postgres's own doc), and a @@ -1356,7 +1355,7 @@ func shortDockerID(id string) string { return id } -// Docs regenerates the showcase docs site's generated reference pages from the +// Docs regenerates the site's generated reference pages from the // live source of truth (the cobra tree, the CRD schemas) — see Cli and Crd in // clidocs.go. Both are deterministic; neither invokes an LLM. type Docs mg.Namespace @@ -1385,8 +1384,8 @@ func (Audit) All() error { return auditGenerator().All(context.Background()) } -// Recent audits only the code changed vs AUDIT_DIFF_BASE (default master): -// `git diff master...HEAD`. A no-op when that diff is empty. Writes +// Recent audits only the code changed vs AUDIT_DIFF_BASE (default main): +// `git diff main...HEAD`. A no-op when that diff is empty. Writes // docs/audits/-recent-audit.md. Good for a pre-merge pass on a branch. func (Audit) Recent() error { return auditGenerator().Recent(context.Background()) diff --git a/pkg/controllers/agentsession/netpol_envtest_test.go b/pkg/controllers/agentsession/netpol_envtest_test.go index 5cf3605e..69d99bbe 100644 --- a/pkg/controllers/agentsession/netpol_envtest_test.go +++ b/pkg/controllers/agentsession/netpol_envtest_test.go @@ -230,7 +230,7 @@ func TestReconcileStampsSidecarNetworkPolicy(t *testing.T) { // assertion the "isolated" row makes. Without it these assertions could pass // for a reason unrelated to the field -- e.g. RunModeFor always choosing // separate-pod, or an empty container list for an unrelated reason. Row -// "isolated" fails against master's sidecars.go if the isolation branch of +// "isolated" fails against main's sidecars.go if the isolation branch of // RunModeFor is reverted (confirmed by temporarily removing that branch and // re-running -- see the task report). func TestReconcileFieldIsolatedSidecar_SeparatePodOwnNetpolNoRunnerContainer(t *testing.T) { diff --git a/pkg/gen/README.md b/pkg/gen/README.md index 1a164770..dff6e992 100644 --- a/pkg/gen/README.md +++ b/pkg/gen/README.md @@ -12,8 +12,8 @@ involved — that walk the live cobra tree and the CRD schemas. | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | [`auditgen`](auditgen/) | The audit pass behind `mage audit:*`: the canonical lens list, the prompt, and the run orchestration. | | [`claudeexec`](claudeexec/) | The shared headless-`claude` invocation contract — argv, exec, and the `RunFunc`/`DiffFunc` seams a claude-driven generator injects. | -| [`clidocs`](clidocs/) | `mage docs:cli`: regenerates the showcase docs' CLI reference from the live cobra tree. | -| [`crddocs`](crddocs/) | `mage docs:crd`: regenerates the showcase docs' CRD reference from `config/crds`. | +| [`clidocs`](clidocs/) | `mage docs:cli`: regenerates the docs site's CLI reference from the live cobra tree, into `site/content/docs`. | +| [`crddocs`](crddocs/) | `mage docs:crd`: regenerates the docs site's CRD reference from `config/crds`, into `site/content/docs`. | ## Boundary diff --git a/pkg/gen/auditgen/generator.go b/pkg/gen/auditgen/generator.go index dfe52ec3..c09fcef6 100644 --- a/pkg/gen/auditgen/generator.go +++ b/pkg/gen/auditgen/generator.go @@ -15,7 +15,7 @@ import ( const DefaultModel = "opus" // DefaultDiffBase is the git ref the "recent" scope diffs against by default. -const DefaultDiffBase = "master" +const DefaultDiffBase = "main" // Scope identifies what an audit pass covers. type Scope string diff --git a/pkg/gen/auditgen/prompt_test.go b/pkg/gen/auditgen/prompt_test.go index 5a867162..26166e7c 100644 --- a/pkg/gen/auditgen/prompt_test.go +++ b/pkg/gen/auditgen/prompt_test.go @@ -44,8 +44,8 @@ func TestAuditPrompt_ScopeDescription(t *testing.T) { }, { name: "recent scope embeds the diff", - target: Target{Scope: ScopeRecent, Slug: "recent", Date: "2026-07-15", Diff: "DIFF-SENTINEL-42", DiffBase: "master"}, - contains: []string{"```diff", "DIFF-SENTINEL-42", "master...HEAD"}, + target: Target{Scope: ScopeRecent, Slug: "recent", Date: "2026-07-15", Diff: "DIFF-SENTINEL-42", DiffBase: "main"}, + contains: []string{"```diff", "DIFF-SENTINEL-42", "main...HEAD"}, notContain: []string{"WHOLE repository"}, }, { diff --git a/pkg/gen/clidocs/clidocs.go b/pkg/gen/clidocs/clidocs.go index 5f4f248a..0fc5486d 100644 --- a/pkg/gen/clidocs/clidocs.go +++ b/pkg/gen/clidocs/clidocs.go @@ -1,4 +1,4 @@ -// Package clidocs generates the showcase docs' CLI reference: one MDX page per +// Package clidocs generates the site's CLI reference: one MDX page per // top-level `oap` command family, walked deterministically from the live cobra // command tree. It takes a *cobra.Command so the heavy rendering is unit-testable // against a synthetic tree; the real oap tree is passed in by a gated test in @@ -81,7 +81,7 @@ func overviewPage(root *cobra.Command, fams []*cobra.Command) string { b.WriteString("## Families\n\n") b.WriteString("| Family | What it does |\n| --- | --- |\n") for _, f := range fams { - fmt.Fprintf(&b, "| [`oap %s`](#/oap-%s) | %s |\n", f.Name(), f.Name(), mdxutil.TableText(f.Short)) + fmt.Fprintf(&b, "| [`oap %s`](/docs/oap-%s) | %s |\n", f.Name(), f.Name(), mdxutil.TableText(f.Short)) } b.WriteString("\n## Global flags\n\n") b.WriteString("These persistent flags apply to every command:\n\n") diff --git a/pkg/gen/clidocs/clidocs_test.go b/pkg/gen/clidocs/clidocs_test.go index 44a82759..156b5086 100644 --- a/pkg/gen/clidocs/clidocs_test.go +++ b/pkg/gen/clidocs/clidocs_test.go @@ -35,7 +35,7 @@ func TestGenerate(t *testing.T) { over := string(overB) assert.Contains(t, over, "section: 'Reference'") assert.Contains(t, over, "group: 'CLI'") - assert.Contains(t, over, "[`oap agent`](#/oap-agent)", "family listed in overview") + assert.Contains(t, over, "[`oap agent`](/docs/oap-agent)", "family listed in overview") assert.Contains(t, over, "--namespace", "global persistent flags rendered on the overview") famB, err := os.ReadFile(filepath.Join(dir, "oap-agent.mdx")) diff --git a/pkg/gen/crddocs/crddocs.go b/pkg/gen/crddocs/crddocs.go index cec7de79..7de360c6 100644 --- a/pkg/gen/crddocs/crddocs.go +++ b/pkg/gen/crddocs/crddocs.go @@ -1,4 +1,4 @@ -// Package crddocs generates the showcase docs' CRD reference: one MDX page per +// Package crddocs generates the site's CRD reference: one MDX page per // OAP CustomResourceDefinition, from the generated CRD YAML schemas (which carry // field descriptions from the Go doc comments, plus types/enums/defaults). A // change to a *_types.go field surfaces — after `mage gen:api` — as a docs diff, @@ -135,7 +135,7 @@ func overviewPage(crds []crdInfo) string { b.WriteString("full spec.\n\n") b.WriteString("| Kind | Scope | Summary |\n| --- | --- | --- |\n") for _, c := range crds { - fmt.Fprintf(&b, "| [%s](#/crd-%s) | %s | %s |\n", c.kind, c.singular, c.scope, mdxutil.TableText(c.desc)) + fmt.Fprintf(&b, "| [%s](/docs/crd-%s) | %s | %s |\n", c.kind, c.singular, c.scope, mdxutil.TableText(c.desc)) } return b.String() } diff --git a/pkg/gen/crddocs/crddocs_test.go b/pkg/gen/crddocs/crddocs_test.go index 65588822..32f0667b 100644 --- a/pkg/gen/crddocs/crddocs_test.go +++ b/pkg/gen/crddocs/crddocs_test.go @@ -67,7 +67,7 @@ func TestGenerate(t *testing.T) { require.NoError(t, err) over := string(overB) assert.Contains(t, over, "group: 'CRD reference'") - assert.Contains(t, over, "[Widget](#/crd-widget)", "kind listed in the overview") + assert.Contains(t, over, "[Widget](/docs/crd-widget)", "kind listed in the overview") pageB, err := os.ReadFile(filepath.Join(out, "crd-widget.mdx")) require.NoError(t, err) diff --git a/pkg/memory/sqlite/backend_test.go b/pkg/memory/sqlite/backend_test.go index 13eeed5e..c503bbc7 100644 --- a/pkg/memory/sqlite/backend_test.go +++ b/pkg/memory/sqlite/backend_test.go @@ -513,7 +513,7 @@ func TestBackend_QueryLimit(t *testing.T) { } // TestBackend_QueryAllScopes covers Part 2 (not in the original task brief, -// added because master grew memory.Backend.QueryAllScopes after this task +// added because main grew memory.Backend.QueryAllScopes after this task // was planned): seeds entries across TWO scope_ids under the same // ScopeKind and confirms the cross-scope query spans both, honoring // OrderDesc + Limit/Offset. Mirrors postgres's diff --git a/showcase/.gitignore b/showcase/.gitignore index 99fdfe41..c9680c6e 100644 --- a/showcase/.gitignore +++ b/showcase/.gitignore @@ -2,7 +2,8 @@ node_modules/ # All capture/render scratch (raw recordings, screenshots, transcodes). -# Published media lives under docs/public/media/ and IS committed. +# Published media lives under site/public/media/ (copied there by hand) and +# IS committed. out/ **/_raw/ diff --git a/showcase/AGENTS.md b/showcase/AGENTS.md index 6af04eef..938f7da3 100644 --- a/showcase/AGENTS.md +++ b/showcase/AGENTS.md @@ -9,20 +9,16 @@ Directions for an agent extending the OAP docs + demo system. Read outside Go's `./...` walk. Run `pnpm` commands from **`showcase/`**. - The generators it depends on are Go, under `pkg/gen/` in the repo, driven by `mage` from the **repo root**. -- Every doc page is one `*.mdx` in `docs/guides/`. Its `export const meta` block - (`section`, `group`, `order`) drives the two-level sidebar; the body is MDX - with ``, ``, ``, `` components. +- The docs + landing site that renders this media lives at + [`site/`](../site/AGENTS.md) — a separate pnpm project. Doc-page authoring, + the CLI/CRD reference recipe, and the docs validation gate live in + `site/AGENTS.md`, not here. ## The gate — run before you call anything done ```bash pnpm typecheck -pnpm exec vite build --config vite.docs.config.ts # every MDX must parse -pnpm docs:check # media/refs resolve + exist pnpm test # vitest -# dead cross-links (check.ts does NOT catch #/… links): -cd docs/guides && for t in $(grep -rhoE '#/[a-z0-9-]+' *.mdx | sed 's#/##;s/^#//' | sort -u); do \ - ls "$t.mdx" >/dev/null 2>&1 || echo "DEAD #/$t"; done ``` If you touched Go (a generator), also `go build ./...`, `go vet ./pkg/gen/...`, @@ -30,19 +26,6 @@ and `go test ./pkg/gen//` from the repo root. ## Recipes -### Add or edit a doc page - -1. Create `docs/guides/.mdx` with a `meta` block. Pick `section` + `group` - - `order` so it lands where you want — the nav orders sections and groups by - their lowest child `order`. Existing bands: Guides `10–290` (Get started, - Concepts, Admin console, Operations, Security), Reference `2010–3320` (the - 7 primitives, then CLI, then CRD reference). -2. Cross-link with `[text](#/other-slug)` (hash routes; no dead-link check in - CI, so run the scan above). -3. Match the house voice — a `doc-lede` paragraph, then `##` sections, a - security `` where relevant. Ground claims in code; don't invent - behavior. - ### Add a Slack demo 1. Write `demos/slacksim/src/scenarios/.ts` (model it on an existing one): @@ -55,7 +38,8 @@ and `go test ./pkg/gen//` from the repo root. 4. Render: `SIM_PORT=5178 node engine/capture/clip.mjs out/clips/ dark 1600x900` (and/or `still.mjs …` for a caption-free still). -5. Copy to `docs/public/media/`, add a `_manifest.json` entry, reference it. +5. Copy to `site/public/media/`, add a `site/content/_manifest.json` entry, + reference it from a guide (see [`site/AGENTS.md`](../site/AGENTS.md)). ### Add a console demo @@ -63,12 +47,6 @@ Same shape in `demos/consolesim/src/scenarios/`, but a beat's `run` is **async** and drives a `TermControl` (`type`, `line`, `prompt`, …) — animated typing + ANSI color via `term/ansi.ts`. Serve on `:5180`, capture with `SIM_PORT=5180`. -### Regenerate the CLI / CRD reference - -Never hand-edit `docs/guides/oap-*.mdx` or `crd-*.mdx`. From the repo root: -`mage docs:cli` / `mage docs:crd`. If the CRD schemas are stale, `mage gen:api` -first. Read the diff before committing. - ### Regenerate Block Kit fixtures Never hand-author a card that OAP really emits. Add a specimen in @@ -115,26 +93,18 @@ control makes, never to a fabricated state. - **`SIM_PORT`** selects the sim server (default 5178 slacksim; 5180 consolesim). `clip.mjs`/`still.mjs` build the URL from it. -- **`go test` runs with cwd = the package dir**, so `docs:cli`'s driver needs an - **absolute** output path (the mage target handles it) — a relative path writes - under `cmd/oap/`. -- **MDX escaping in generators.** Prose containing `<` or `{` must be entity- - escaped (`mdxutil.EscapeMDX`); usages/flags/paths go in code spans/fences, - which MDX takes literally — never escape those. - **consolesim beats are async** — `window.__showcaseStory.run(i)` returns a promise so `page.evaluate` awaits the whole typing animation. Keep them async. - **Empty-state captures.** A minimal cluster yields empty admin sections; that's honest but thin. Re-capture on a populated cluster when one's available — the scripts are deterministic, so stills swap in with no doc changes. -- **`docs:check` ≠ dead-link check.** It validates media/refs, not `#/…` links. - Run the scan in the gate. ## Commit & merge discipline - Commit in focused chunks; keep the gate green per commit. -- The showcase branch merges to **local master** as clean `--no-ff` merges run - in the main checkout (master diverges, so it's a merge, not a fast-forward). - Local only — do **not** push to origin unless asked. +- The showcase branch merges to **local main** as clean `--no-ff` merges run in + the main checkout (main diverges, so it's a merge, not a fast-forward). Local + only — do **not** push to origin unless asked. - Never `git stash` (repo-wide rule); never touch the main checkout's uncommitted work — the merges are on disjoint paths and must leave it untouched. diff --git a/showcase/README.md b/showcase/README.md index e1765c1b..e4689789 100644 --- a/showcase/README.md +++ b/showcase/README.md @@ -1,10 +1,11 @@ -# showcase — OAP docs + narrated-demo system +# showcase — OAP demo media -A self-contained Node/TS project that produces the OAP documentation site and -its demo media. Two scripted **simulators** (a fake Slack and a fake terminal) -and two kinds of **real capture** (the web chat, the admin console) feed a -Playwright engine that renders stills and narrated webm/mp4 clips; those, plus -generated CLI and CRD reference, assemble into an MDX docs site. +A self-contained Node/TS project that produces OAP's demo media: two scripted +**simulators** (a fake Slack and a fake terminal) and two kinds of **real +capture** (the web chat, the admin console) feed a Playwright engine that +renders stills and narrated webm/mp4 clips. That media, plus the generated CLI +and CRD reference, feed the docs + landing site under +[`site/`](../site/README.md). It is deliberately **outside** the `web/` pnpm workspace and outside Go's `./...` walk — the heavy capture toolchain (Playwright, ffmpeg, xterm.js) lives @@ -21,14 +22,6 @@ showcase/ ├── demos/ │ ├── slacksim/ fake Slack (React): chrome + Block Kit renderer + scenario store :5178 │ └── consolesim/ fake terminal (xterm.js): themed window + scripted typing/ANSI :5180 -├── docs/ -│ ├── guides/ every doc page (*.mdx) — frontmatter meta drives the two-level nav -│ ├── _manifest.json media map: name → clip {webm,mp4,poster} | screenshot {src} -│ ├── app/ the MDX docs app (nav, components, Clip/Screenshot/Callout, lightbox) -│ ├── public/media/ committed stills + clips (NOT gitignored) -│ ├── check.ts validator: every referenced media/ref resolves + exists -│ ├── DOCS-PLAN.md the information architecture -│ └── DOCS-GAPS.md the codebase→docs gap analysis (what's covered / missing) ├── engine/ │ ├── capture/ Playwright drivers: shot.mjs (still), still.mjs (beat still), │ │ clip.mjs (narrated webm+mp4+poster), webshot.mjs (real product login) @@ -38,14 +31,12 @@ showcase/ ``` Real Block Kit fixtures live at `demos/slacksim/src/fixtures/blockkit/*.json` -and are generated (not hand-authored) — see below. The CLI/CRD reference pages -under `docs/guides/` (`oap-*.mdx`, `crd-*.mdx`) are generated too. +and are generated (not hand-authored) — see below. ## Quick start ```bash pnpm install -pnpm docs:dev # docs site → http://localhost:5179 pnpm slacksim:dev # fake Slack → http://localhost:5178/?scenario=&theme=dark pnpm consolesim:dev # fake term → http://localhost:5180/?scenario=&theme=dark ``` @@ -53,9 +44,7 @@ pnpm consolesim:dev # fake term → http://localhost:5180/?scenario= Validate (the gate every change must pass): ```bash -pnpm typecheck # tsc over docs app + both sims -pnpm exec vite build --config vite.docs.config.ts # all MDX must parse -pnpm docs:check # media/refs resolve + exist +pnpm typecheck # tsc over both sims pnpm test # vitest (parsers, renderers, generators-as-libs) ``` @@ -90,24 +79,24 @@ SIM_PORT=5180 node engine/capture/clip.mjs out/clips/ dark 1120 node engine/capture/shot.mjs "http://localhost:5178/?scenario=…" out/x.png 1600x900 ``` -Then copy the output into `docs/public/media/`, add an entry to -`_manifest.json`, and reference it from a page with `` or -``. +Then copy the output into `site/public/media/`, add an entry to +`site/content/_manifest.json`, and reference it from a page with +`` or `` — see +[`site/AGENTS.md`](../site/AGENTS.md). ## Generated content (run from the repo root) -These are the no-drift generators — **never hand-edit their output**; re-run the -generator instead. +This is the no-drift generator for Slack fixtures — **never hand-edit its +output**; re-run the generator instead. ```bash mage blocks:capture # real Slack Block Kit JSON → demos/slacksim/src/fixtures/blockkit/ -mage docs:cli # oap CLI reference (one page per family) from the live cobra tree -mage docs:crd # CRD reference (one page per kind) from config/crds schemas ``` -Sources: `pkg/gen/blockcapture`, `pkg/gen/clidocs`, `pkg/gen/crddocs` (shared -MDX helpers in `pkg/gen/mdxutil`). `docs:cli` runs a gated test in `cmd/oap` -(`NewRootCmd` is package `main`); `docs:crd` reads YAML directly. +Source: `pkg/gen/blockcapture`. The CLI and CRD reference generators +(`mage docs:cli`, `mage docs:crd`) write straight into +[`site/content/docs`](../site/content/docs) — see +[`site/AGENTS.md`](../site/AGENTS.md). ## Real product captures diff --git a/showcase/docs/app/App.tsx b/showcase/docs/app/App.tsx deleted file mode 100644 index 6d59b5db..00000000 --- a/showcase/docs/app/App.tsx +++ /dev/null @@ -1,180 +0,0 @@ -import { useEffect, useState, type ComponentType } from "react"; -import { MDXProvider } from "@mdx-js/react"; -import { mdxComponents } from "./components/mdxComponents"; -// The brand files live once, at the repo root (docs/assets/brand); the docs -// chrome is dark-only, so it takes the light-ink variant. -import wordmarkUrl from "../../../docs/assets/brand/oap-wordmark-light.svg"; - -interface GuideMeta { - title: string; - /** Top-level nav category (e.g. "Concepts"). */ - section?: string; - /** Sub-heading within the section (e.g. "Multiplayer & Permissions"). */ - group?: string; - order?: number; - description?: string; -} -interface GuideModule { - default: ComponentType; - meta?: GuideMeta; -} - -// Eagerly load every guide. Each MDX module exports a default component and a -// `meta` object (title/section/group/order) used to build the two-level sidebar. -const modules = import.meta.glob("../guides/*.mdx", { - eager: true, -}); - -interface Guide { - slug: string; - title: string; - section: string; - group: string; - order: number; - description?: string; - Component: ComponentType; -} - -const guides: Guide[] = Object.entries(modules) - .map(([path, mod]) => { - const slug = path - .split("/") - .pop()! - .replace(/\.mdx$/, ""); - const meta = mod.meta ?? { title: slug }; - return { - slug, - title: meta.title, - section: meta.section ?? "Guides", - group: meta.group ?? "", - order: meta.order ?? 100, - description: meta.description, - Component: mod.default, - }; - }) - .sort((a, b) => a.order - b.order || a.title.localeCompare(b.title)); - -// Preserve first-seen order for sections. -const sections = [...new Set(guides.map((g) => g.section))]; - -// A nav block is one rendered unit in the sidebar: either a single ungrouped -// guide or a titled group of guides. Blocks are emitted in `order` sequence, so -// an ungrouped guide sits at its own order position rather than being hoisted -// above every group — a group is anchored at its first-seen (lowest-order) child. -interface NavBlock { - group: string; - guides: Guide[]; -} -const navBlocksIn = (section: string): NavBlock[] => { - const blocks: NavBlock[] = []; - const byGroup = new Map(); - for (const g of guides.filter((x) => x.section === section)) { - if (g.group === "") { - blocks.push({ group: "", guides: [g] }); - continue; - } - let block = byGroup.get(g.group); - if (!block) { - block = { group: g.group, guides: [] }; - byGroup.set(g.group, block); - blocks.push(block); - } - block.guides.push(g); - } - return blocks; -}; - -// A route is a guide slug plus an optional intra-page anchor. The URL hash is -// `#/` or `#/#` — the second `#` deep-links into a page (e.g. -// a concept overview links to `#/owasp-top10#asi03`). -function parseHash(): { slug: string; anchor: string } { - const raw = window.location.hash.replace(/^#\/?/, ""); - const [slug, anchor] = raw.split("#"); - return { slug, anchor: anchor ?? "" }; -} - -export function App() { - const [route, setRoute] = useState(() => { - const { slug, anchor } = parseHash(); - return { - slug: guides.some((g) => g.slug === slug) - ? slug - : (guides[0]?.slug ?? ""), - anchor, - }; - }); - const active = guides.find((g) => g.slug === route.slug) ?? guides[0]; - - // Any `#/…` link (nav button or in-content) flows through hashchange, so cross- - // doc links work without wiring each one. - useEffect(() => { - const onHash = () => { - const { slug, anchor } = parseHash(); - if (guides.some((g) => g.slug === slug)) setRoute({ slug, anchor }); - }; - window.addEventListener("hashchange", onHash); - return () => window.removeEventListener("hashchange", onHash); - }, []); - - // Scroll to the anchor after the page renders, else to the top on page change. - useEffect(() => { - if (route.anchor) { - document.getElementById(route.anchor)?.scrollIntoView({ block: "start" }); - } else { - window.scrollTo(0, 0); - } - }, [route]); - - const link = (g: Guide) => ( -

  • - -
    • - ); - - return ( -
    - -
    -
    - {active && ( - - - - )} -
    -
    -
    - ); -} diff --git a/showcase/docs/app/components/mdxComponents.tsx b/showcase/docs/app/components/mdxComponents.tsx deleted file mode 100644 index 02dc0328..00000000 --- a/showcase/docs/app/components/mdxComponents.tsx +++ /dev/null @@ -1,22 +0,0 @@ -import type { MDXComponents } from "mdx/types"; -import { Clip, Screenshot, ScreenshotSeries } from "./media"; -import { Callout } from "./Callout"; -import { Coverage } from "./Coverage"; - -// The component set available to every MDX guide: the media embeds, callouts, -// and lightly-styled base elements. Custom components are capitalized so MDX -// resolves them here rather than as HTML tags. -export const mdxComponents: MDXComponents = { - Clip, - Screenshot, - ScreenshotSeries, - Callout, - Coverage, - a: (props) => ( - - ), -}; diff --git a/showcase/docs/app/index.html b/showcase/docs/app/index.html deleted file mode 100644 index ab575681..00000000 --- a/showcase/docs/app/index.html +++ /dev/null @@ -1,12 +0,0 @@ - - - - - - OAP docs - - -
    - - - diff --git a/showcase/docs/app/main.tsx b/showcase/docs/app/main.tsx deleted file mode 100644 index 275efe15..00000000 --- a/showcase/docs/app/main.tsx +++ /dev/null @@ -1,29 +0,0 @@ -import { StrictMode } from "react"; -import { createRoot } from "react-dom/client"; -import { App } from "./App"; -import "./styles.css"; -import iconDarkInkUrl from "../../../docs/assets/brand/oap-icon-dark.svg"; -import iconLightInkUrl from "../../../docs/assets/brand/oap-icon-light.svg"; - -// Favicons are added here rather than in index.html because the brand files -// sit outside the Vite root: an HTML href to them is rewritten at build time -// only, while an import resolves in dev too. Two icons, not one: the favicon -// sits on the browser's tab strip, not on this page, so its ink follows the OS -// colour scheme. -for (const [href, scheme] of [ - [iconDarkInkUrl, "light"], - [iconLightInkUrl, "dark"], -] as const) { - const link = document.createElement("link"); - link.rel = "icon"; - link.type = "image/svg+xml"; - link.href = href; - link.media = `(prefers-color-scheme: ${scheme})`; - document.head.appendChild(link); -} - -createRoot(document.getElementById("root")!).render( - - - , -); diff --git a/showcase/docs/app/mdx.d.ts b/showcase/docs/app/mdx.d.ts deleted file mode 100644 index a26ee097..00000000 --- a/showcase/docs/app/mdx.d.ts +++ /dev/null @@ -1,14 +0,0 @@ -declare module "*.mdx" { - import type { ComponentType } from "react"; - export const meta: - | { - title: string; - section?: string; - group?: string; - order?: number; - description?: string; - } - | undefined; - const MDXComponent: ComponentType; - export default MDXComponent; -} diff --git a/showcase/docs/app/styles.css b/showcase/docs/app/styles.css deleted file mode 100644 index 9d64f09f..00000000 --- a/showcase/docs/app/styles.css +++ /dev/null @@ -1,392 +0,0 @@ -/* OAP docs chrome — a clean dark "blueprint" theme, deliberately distinct from - * the Slack look inside the embedded media. */ -:root { - --doc-bg: #0e1116; - --doc-panel: #12161d; - --doc-nav: #0b0e13; - --doc-border: #232b36; - --doc-text: #d7dde5; - --doc-muted: #8b95a3; - --doc-heading: #f2f5f9; - --doc-accent: #6ea8fe; - --doc-accent-soft: rgba(110, 168, 254, 0.14); - --doc-code-bg: #171c24; - --doc-code-border: #262f3b; - --doc-max: 760px; - --doc-font: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif; - --doc-mono: 'SFMono-Regular', 'Menlo', 'Consolas', monospace; -} - -* { - box-sizing: border-box; -} -html, -body, -#root { - margin: 0; - height: 100%; -} -body { - background: var(--doc-bg); - color: var(--doc-text); - font-family: var(--doc-font); - font-size: 16px; - line-height: 1.65; - -webkit-font-smoothing: antialiased; -} - -.doc-app { - display: flex; - min-height: 100vh; -} - -/* Sidebar nav */ -.doc-nav { - width: 264px; - flex-shrink: 0; - background: var(--doc-nav); - border-right: 1px solid var(--doc-border); - padding: 22px 16px; - position: sticky; - top: 0; - height: 100vh; - overflow-y: auto; -} -.doc-brand { - font-weight: 800; - font-size: 17px; - color: var(--doc-heading); - margin-bottom: 24px; - display: flex; - flex-direction: column; - align-items: flex-start; - gap: 6px; -} -.doc-brand-wordmark { - display: block; - width: 168px; - height: auto; -} -.doc-brand-sub { - color: var(--doc-muted); - font-weight: 500; - font-size: 13px; - letter-spacing: 0.04em; - text-transform: uppercase; -} -.doc-nav-section { - margin-bottom: 8px; -} -.doc-nav-section-title { - font-size: 12px; - text-transform: uppercase; - letter-spacing: 0.06em; - color: var(--doc-muted); - margin: 18px 8px 6px; - font-weight: 700; -} -.doc-nav-group-title { - font-size: 13px; - color: var(--doc-text); - margin: 10px 8px 4px; - padding-left: 6px; - font-weight: 700; -} -.doc-nav-group { - margin-left: 6px; - border-left: 1px solid var(--doc-border); - padding-left: 4px; -} -.doc-nav ul { - list-style: none; - margin: 0; - padding: 0; -} -.doc-nav-link { - display: block; - width: 100%; - text-align: left; - background: transparent; - border: none; - color: var(--doc-text); - padding: 6px 8px; - border-radius: 6px; - font-size: 14.5px; - cursor: pointer; -} -.doc-nav-link:hover { - background: var(--doc-panel); -} -.doc-nav-link.is-active { - background: var(--doc-accent-soft); - color: var(--doc-accent); - font-weight: 600; -} - -/* Article */ -.doc-main { - flex: 1; - min-width: 0; - display: flex; - justify-content: center; - padding: 56px 40px 120px; -} -.doc-article { - width: 100%; - max-width: var(--doc-max); -} -.doc-article h1 { - font-size: 34px; - line-height: 1.2; - color: var(--doc-heading); - margin: 0 0 8px; - letter-spacing: -0.01em; -} -.doc-article h2 { - font-size: 24px; - color: var(--doc-heading); - margin: 44px 0 12px; - padding-top: 12px; - border-top: 1px solid var(--doc-border); - letter-spacing: -0.01em; -} -.doc-article h3 { - font-size: 18px; - color: var(--doc-heading); - margin: 28px 0 8px; -} -.doc-article p { - margin: 14px 0; -} -.doc-article a { - color: var(--doc-accent); - text-decoration: none; -} -.doc-article a:hover { - text-decoration: underline; -} -.doc-article ul, -.doc-article ol { - padding-left: 24px; -} -.doc-article li { - margin: 6px 0; -} -.doc-article strong { - color: var(--doc-heading); -} -.doc-article code { - font-family: var(--doc-mono); - font-size: 13.5px; - background: var(--doc-code-bg); - border: 1px solid var(--doc-code-border); - border-radius: 4px; - padding: 1px 5px; -} -.doc-article pre { - background: var(--doc-code-bg); - border: 1px solid var(--doc-code-border); - border-radius: 8px; - padding: 14px 16px; - overflow-x: auto; -} -.doc-article pre code { - border: none; - background: none; - padding: 0; -} -.doc-article blockquote { - margin: 16px 0; - padding: 2px 16px; - border-left: 3px solid var(--doc-accent); - color: var(--doc-muted); -} -.doc-lede { - font-size: 19px; - color: var(--doc-muted); - line-height: 1.6; -} - -/* Media */ -.doc-clip { - margin: 28px 0; -} -.doc-clip-video { - width: 100%; - border-radius: 12px; - border: 1px solid var(--doc-border); - box-shadow: 0 12px 40px rgba(0, 0, 0, 0.4); - display: block; - background: #000; -} -.doc-clip figcaption, -.doc-shot figcaption, -.doc-series-item figcaption { - margin-top: 8px; - font-size: 13.5px; - color: var(--doc-muted); - text-align: center; -} -.doc-shot { - margin: 24px 0; -} -.doc-shot img { - width: 100%; - border-radius: 10px; - border: 1px solid var(--doc-border); - cursor: zoom-in; -} -.doc-series { - display: grid; - grid-template-columns: 1fr 1fr; - gap: 16px; - margin: 24px 0; -} -.doc-series-item img { - width: 100%; - border-radius: 8px; - border: 1px solid var(--doc-border); - cursor: zoom-in; -} -/* Lightbox: full-screen enlarge of a screenshot */ -.doc-lightbox { - position: fixed; - inset: 0; - z-index: 1000; - display: flex; - align-items: center; - justify-content: center; - padding: 4vmin; - background: rgba(0, 0, 0, 0.82); - cursor: zoom-out; - animation: doc-lightbox-in 120ms ease-out; -} -@keyframes doc-lightbox-in { - from { - opacity: 0; - } -} -.doc-lightbox-inner { - margin: 0; - max-width: 96vw; - max-height: 92vh; - display: flex; - flex-direction: column; - align-items: center; - cursor: default; -} -.doc-lightbox-inner img { - max-width: 96vw; - max-height: 84vh; - object-fit: contain; - border-radius: 10px; - border: 1px solid var(--doc-border); - box-shadow: 0 24px 80px rgba(0, 0, 0, 0.6); -} -.doc-lightbox-inner figcaption { - margin-top: 12px; - font-size: 14px; - color: #e6e8eb; - text-align: center; - max-width: 70ch; -} -.doc-lightbox-close { - position: fixed; - top: 16px; - right: 20px; - width: 40px; - height: 40px; - border: 0; - border-radius: 8px; - background: rgba(255, 255, 255, 0.1); - color: #fff; - font-size: 26px; - line-height: 1; - cursor: pointer; -} -.doc-lightbox-close:hover { - background: rgba(255, 255, 255, 0.2); -} -.doc-media-missing { - padding: 24px; - border: 1px dashed var(--doc-border); - border-radius: 8px; - color: var(--doc-muted); - text-align: center; - font-family: var(--doc-mono); - font-size: 13px; -} - -/* Coverage badges (OWASP page) */ -.doc-cov { - display: inline-block; - font-size: 12px; - font-weight: 700; - padding: 2px 9px; - border-radius: 999px; - vertical-align: middle; - margin-left: 8px; - border: 1px solid transparent; -} -.doc-cov--substantial { - color: #7ee2b8; - background: rgba(75, 191, 135, 0.14); - border-color: rgba(75, 191, 135, 0.4); -} -.doc-cov--partial { - color: #e6c25a; - background: rgba(224, 179, 65, 0.14); - border-color: rgba(224, 179, 65, 0.4); -} -.doc-cov--minimal { - color: #e88497; - background: rgba(224, 96, 126, 0.14); - border-color: rgba(224, 96, 126, 0.4); -} -.doc-cov--na { - color: var(--doc-muted); - background: rgba(139, 149, 163, 0.14); - border-color: rgba(139, 149, 163, 0.35); -} - -/* Callouts */ -.doc-callout { - margin: 20px 0; - padding: 14px 16px; - border-radius: 10px; - border: 1px solid var(--doc-border); - background: var(--doc-panel); - border-left: 3px solid var(--doc-accent); -} -.doc-callout--warning { - border-left-color: #e0b341; -} -.doc-callout--security { - border-left-color: #e0607e; -} -.doc-callout--tip { - border-left-color: #4bbf87; -} -.doc-callout-head { - display: flex; - align-items: center; - gap: 8px; - font-weight: 700; - color: var(--doc-heading); - margin-bottom: 4px; -} -.doc-callout-body p:first-child { - margin-top: 0; -} -.doc-callout-body p:last-child { - margin-bottom: 0; -} - -@media (max-width: 900px) { - .doc-nav { - display: none; - } - .doc-series { - grid-template-columns: 1fr; - } -} diff --git a/showcase/docs/guides/cli-reference.mdx b/showcase/docs/guides/cli-reference.mdx deleted file mode 100644 index 0ea7dbed..00000000 --- a/showcase/docs/guides/cli-reference.mdx +++ /dev/null @@ -1,57 +0,0 @@ -export const meta = { - title: 'oap CLI reference', - section: 'Reference', - group: 'CLI', - order: 2700, - description: 'Every oap command family, generated from the CLI itself.', -} - -# oap CLI reference - -The `oap` CLI installs, manages, and runs agents. Every command below is generated directly -from the CLI, so it matches the binary you have. Pick a family for its subcommands and flags. - -## Families - -| Family | What it does | -| --- | --- | -| [`oap agent`](#/oap-agent) | Manage and run AgentClass resources | -| [`oap artifact`](#/oap-artifact) | Inspect versioned artifacts and their revisions | -| [`oap audit`](#/oap-audit) | Verify the tamper-evident audit log of a session | -| [`oap build`](#/oap-build) | Build (and load) Docker images | -| [`oap channel`](#/oap-channel) | Manage Channel CRs (Slack, future webhook/cron, ...). | -| [`oap check`](#/oap-check) | verify namespace, CRDs, services, and every registered component's health | -| [`oap class`](#/oap-class) | Inspect SpiceboxClass resources (sandbox image + capability descriptors) | -| [`oap clean`](#/oap-clean) | Remove everything oap installed (CRs → operator → CRDs → namespace) | -| [`oap desktop`](#/oap-desktop) | Run the oap macOS menubar app (local VM + built-in chat; macOS/Apple Silicon only) | -| [`oap identity`](#/oap-identity) | Manage AgentIdentity resources | -| [`oap idp`](#/oap-idp) | Manage the cluster identity provider | -| [`oap image`](#/oap-image) | Work with local Docker images and the current cluster | -| [`oap init`](#/oap-init) | Bring up agent-primitives end-to-end (build + install + check) | -| [`oap install`](#/oap-install) | Install the operator + CRDs into the configured cluster | -| [`oap kg`](#/oap-kg) | Query the knowledge graph | -| [`oap login`](#/oap-login) | Log in to this cluster's identity provider and cache the assertion | -| [`oap logout`](#/oap-logout) | Remove the cached identity assertion | -| [`oap memory`](#/oap-memory) | Inspect and manage session memory entries | -| [`oap pin`](#/oap-pin) | Inspect and update dependency pin baselines | -| [`oap plangate`](#/oap-plangate) | Inspect what the plan gate recorded for a session | -| [`oap platform`](#/oap-platform) | Manage platform-level admin access (the admin UI gate) | -| [`oap sandbox`](#/oap-sandbox) | Inspect SpiceboxSession resources (per-bundle running sandbox pods) | -| [`oap session`](#/oap-session) | Inspect AgentSession resources | -| [`oap settings`](#/oap-settings) | Manage cluster-wide agent settings (security defaults wizard + apply). | -| [`oap skill`](#/oap-skill) | List, view, create, and delete agent Skills and SkillSources | -| [`oap spicedb`](#/oap-spicedb) | Apply schema and check permissions against the system SpiceDB. | -| [`oap tools`](#/oap-tools) | Manage tools used by agents (kind-agnostic) | -| [`oap user-identity`](#/oap-user-identity) | Manage UserIdentity resources (per-user credential catalogs) | - -## Global flags - -These persistent flags apply to every command: - -```text ---context string Kubeconfig context to use (default: current-context) ---kubeconfig string Path to kubeconfig file (default: $KUBECONFIG or ~/.kube/config) ---no-color Disable terminal colors (also auto-disabled when stdout isn't a TTY or NO_COLOR is set) --n, --namespace string Kubernetes namespace (default: kubeconfig context's namespace, falling back to 'default') -``` - diff --git a/showcase/docs/guides/crd-reference.mdx b/showcase/docs/guides/crd-reference.mdx deleted file mode 100644 index e6944bb2..00000000 --- a/showcase/docs/guides/crd-reference.mdx +++ /dev/null @@ -1,49 +0,0 @@ -export const meta = { - title: 'CRD reference', - section: 'Reference', - group: 'CRD reference', - order: 3000, - description: 'Every OAP custom resource, generated from the installed CRD schemas.', -} - -# CRD reference - -OAP's resources are Kubernetes CRDs. Each page below is generated from the CRD schema — so -field names, types, and descriptions match what the cluster enforces. Pick a kind for its -full spec. - -| Kind | Scope | Summary | -| --- | --- | --- | -| [AgentClass](#/crd-agentclass) | Namespaced | AgentClass is the reviewable template an agent is defined by: model, system | -| [AgentIdentity](#/crd-agentidentity) | Namespaced | AgentIdentity is the named credential set an agent acts as: reusable static | -| [AgentSession](#/crd-agentsession) | Namespaced | AgentSession is one running instance of an AgentClass: a conversation with | -| [AgentSessionGrants](#/crd-agentsessiongrants) | Namespaced | AgentSessionGrants is the per-AgentClass declaration of the (resourceType, | -| [AgentSettings](#/crd-agentsettings) | Namespaced | AgentSettings is the namespace tier of agent governance settings: limits | -| [AgentUI](#/crd-agentui) | Namespaced | AgentUI is a bundle-authored DECLARATION of an agent-defined view: a page | -| [ArtifactRender](#/crd-artifactrender) | Namespaced | ArtifactRender is one request to turn agent-supplied bytes into a | -| [Channel](#/crd-channel) | Namespaced | Channel binds one transport conversation -- a Slack channel, a scheduled | -| [ClusterAgentSettings](#/crd-clusteragentsettings) | Cluster | ClusterAgentSettings is the cluster-wide top tier of agent governance | -| [ClusterIdentityProvider](#/crd-clusteridentityprovider) | Cluster | ClusterIdentityProvider configures cluster-wide human login: which | -| [ClusterSkill](#/crd-clusterskill) | Cluster | ClusterSkill is a cluster-scoped Skill, visible to every namespace. A | -| [ClusterSkillSource](#/crd-clusterskillsource) | Cluster | ClusterSkillSource is a git repo that materializes cluster-scoped | -| [CredentialUpdateRequest](#/crd-credentialupdaterequest) | Namespaced | CredentialUpdateRequest is an agent's REQUEST that a human replace a | -| [MCPServer](#/crd-mcpserver) | Namespaced | MCPServer declares one MCP endpoint an agent may call: where it lives | -| [PublicEndpoint](#/crd-publicendpoint) | Cluster | PublicEndpoint is how this cluster is reached from the public Internet. | -| [RelationshipSource](#/crd-relationshipsource) | Namespaced | RelationshipSource declares one upstream directory (Slack first) to poll | -| [SessionHold](#/crd-sessionhold) | Namespaced | SessionHold parks an AgentSession for forensic review and gates its return to | -| [SessionUserIdentity](#/crd-sessionuseridentity) | Namespaced | SessionUserIdentity is one session's narrowing of a user's UserIdentity | -| [SidecarToolbox](#/crd-sidecartoolbox) | Namespaced | SidecarToolbox declares a user-supplied MCP server that runs as a sidecar | -| [Skill](#/crd-skill) | Namespaced | Skill is one agentskills.io skill: a SKILL.md (frontmatter + body) plus | -| [SkillSource](#/crd-skillsource) | Namespaced | SkillSource is a git repo that yields one or more Skills. | -| [SpiceDBBootstrap](#/crd-spicedbbootstrap) | Namespaced | SpiceDBBootstrap declaratively seeds SpiceDB state: an optional schema | -| [SpiceboxClass](#/crd-spiceboxclass) | Cluster | SpiceboxClass is the template a tool sandbox is cut from: image, resources, | -| [SpiceboxSession](#/crd-spiceboxsession) | Namespaced | SpiceboxSession is one live sandbox instantiated from a SpiceboxClass: the | -| [SpiceboxToolchain](#/crd-spiceboxtoolchain) | Cluster | SpiceboxToolchain is a language or tooling overlay a sandbox can mount -- a | -| [SpiceboxToolkit](#/crd-spiceboxtoolkit) | Cluster | SpiceboxToolkit is the machine-readable description of one CLI a sandbox | -| [SpiceboxToolspec](#/crd-spiceboxtoolspec) | Cluster | SpiceboxToolspec is one sandbox tool as the agent sees it: a SpiceboxToolkit | -| [SubagentRequest](#/crd-subagentrequest) | Namespaced | SubagentRequest is a runner's request to delegate a task to a child session. | -| [ToolCall](#/crd-toolcall) | Namespaced | ToolCall is one execution of one sandbox tool inside a SpiceboxSession: the | -| [UserIdentity](#/crd-useridentity) | Cluster | UserIdentity is a human's credential catalog: the credentials one person has | -| [Workshop](#/crd-workshop) | Namespaced | Workshop is one builder session's isolated build space: the durable record | -| [WorkshopProbe](#/crd-workshopprobe) | Namespaced | WorkshopProbe is the tool-discovery probe object for an agent-builder | -| [WorkspaceSource](#/crd-workspacesource) | Namespaced | WorkspaceSource declares a named, pluggable origin that per-session | diff --git a/showcase/docs/guides/what-is-oap.mdx b/showcase/docs/guides/what-is-oap.mdx deleted file mode 100644 index 5035fd7b..00000000 --- a/showcase/docs/guides/what-is-oap.mdx +++ /dev/null @@ -1,46 +0,0 @@ -export const meta = { - title: 'What is OAP?', - section: 'Guides', - group: 'Get started', - order: 10, - description: - 'Open Agent Primitives — a Kubernetes-native runtime for LLM agents, built so operating an agent safely is the default.', -} - -# What is OAP? - -

    - Open Agent Primitives (OAP) is a Kubernetes-native runtime for LLM agents. Defining an agent - is easy — a prompt, some tools, a loop. Operating one safely is the hard part, and that's what OAP is - for: an agent's identity, authorization, tools, memory, and channels are first-class, governed things rather - than an afterthought. -

    - -## The premise - -The model is not a trust boundary. A capable agent will be asked to touch real systems — repositories, -dashboards, customer data — and the interesting questions aren't "can it call a tool" but "*whose* credentials -does it use, *may* it do this to *this* resource, *who* approves the risky steps, and *what* did it actually -do." OAP answers those with six composable primitives. - -## The six primitives - -- **[Agent definition](#/agent-definition)** — an agent is a reviewable template (AgentClass) and a disposable - instance (AgentSession), not a process. -- **[Safe tools](#/safe-tools)** — an agent can only do what was written down: sandboxed CLI tools and MCP - servers, validated against a toolspec. -- **[Identity & credentials](#/identity)** — an agent acts as itself or on your behalf, with named credentials - resolved by need. -- **[Authorization](#/authorization)** — every action is checked against a graph: can this subject do this, to - this resource, right now? -- **[Channels & continuity](#/channels)** — agents are reached where teams already work; threads continue and - approvals live in-channel. -- **[Memory & knowledge](#/memory)** — an agent remembers within reason: an authorized, searchable store with a - knowledge-graph layer. - -Each is designed around specific threats from the [OWASP Agentic Top 10](#/owasp-top10). - -## Where to next - -- **[Install OAP](#/install-overview)** — bring up the platform, on your Mac or on a cluster. -- **[Your first agent](#/quickstart)** — define an agent and talk to it in a few minutes. diff --git a/showcase/engine/capture/clip.mjs b/showcase/engine/capture/clip.mjs index a9d42dc5..3ae966c3 100644 --- a/showcase/engine/capture/clip.mjs +++ b/showcase/engine/capture/clip.mjs @@ -22,7 +22,8 @@ const url = `http://localhost:${PORT}/?scenario=${scenario}&theme=${theme}` const outDir = path.dirname(outBase) mkdirSync(outDir, { recursive: true }) // Raw Playwright recordings go to the always-gitignored out/ scratch, never -// next to published media (which may live under docs/public). +// next to published media (which may live under site/public, copied there by +// hand). const rawDir = path.join('out', '_raw') mkdirSync(rawDir, { recursive: true }) diff --git a/showcase/package.json b/showcase/package.json index 279e83b6..fb72716d 100644 --- a/showcase/package.json +++ b/showcase/package.json @@ -11,34 +11,25 @@ "consolesim:dev": "vite --config vite.consolesim.config.ts", "consolesim:build": "tsc -p tsconfig.consolesim.json && vite build --config vite.consolesim.config.ts", "consolesim:preview": "vite preview --config vite.consolesim.config.ts", - "docs:dev": "vite --config vite.docs.config.ts", - "docs:build": "vite build --config vite.docs.config.ts", - "docs:preview": "vite preview --config vite.docs.config.ts", - "docs:check": "tsx docs/check.ts", "typecheck": "tsc -p tsconfig.json --noEmit", "test": "vitest run", "test:watch": "vitest" }, "dependencies": { - "@mdx-js/react": "^3.1.1", "@xterm/xterm": "^6.0.0", "lucide-react": "^0.454.0", "react": "^18.3.1", - "react-dom": "^18.3.1", - "react-markdown": "^9.1.0" + "react-dom": "^18.3.1" }, "devDependencies": { - "@mdx-js/rollup": "^3.1.1", "@testing-library/jest-dom": "^6.4.8", "@testing-library/react": "^16.0.1", - "@types/mdx": "^2.0.14", "@types/node": "^22.20.2", "@types/react": "^18.3.5", "@types/react-dom": "^18.3.0", "@vitejs/plugin-react": "^4.3.1", "jsdom": "^25.0.0", "playwright": "^1.63.0", - "remark-gfm": "^4.0.1", "tsx": "^4.23.13", "typescript": "^5.5.4", "vite": "^5.4.2", diff --git a/showcase/pnpm-lock.yaml b/showcase/pnpm-lock.yaml index e26e86d4..caff4046 100644 --- a/showcase/pnpm-lock.yaml +++ b/showcase/pnpm-lock.yaml @@ -8,9 +8,6 @@ importers: .: dependencies: - '@mdx-js/react': - specifier: ^3.1.1 - version: 3.1.1(@types/react@18.3.31)(react@18.3.1) '@xterm/xterm': specifier: ^6.0.0 version: 6.0.0 @@ -23,22 +20,13 @@ importers: react-dom: specifier: ^18.3.1 version: 18.3.1(react@18.3.1) - react-markdown: - specifier: ^9.1.0 - version: 9.1.0(@types/react@18.3.31)(react@18.3.1) devDependencies: - '@mdx-js/rollup': - specifier: ^3.1.1 - version: 3.1.1(rollup@4.63.2) '@testing-library/jest-dom': specifier: ^6.4.8 version: 6.10.0(@testing-library/dom@10.4.1) '@testing-library/react': specifier: ^16.0.1 version: 16.3.3(@testing-library/dom@10.4.1)(@types/react-dom@18.3.7(@types/react@18.3.31))(@types/react@18.3.31)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) - '@types/mdx': - specifier: ^2.0.14 - version: 2.0.14 '@types/node': specifier: ^22.20.2 version: 22.20.2 @@ -57,9 +45,6 @@ importers: playwright: specifier: ^1.63.0 version: 1.63.0 - remark-gfm: - specifier: ^4.0.1 - version: 4.0.1 tsx: specifier: ^4.23.13 version: 4.23.13 @@ -509,20 +494,6 @@ packages: '@jridgewell/trace-mapping@0.3.31': resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==} - '@mdx-js/mdx@3.1.1': - resolution: {integrity: sha512-f6ZO2ifpwAQIpzGWaBQT2TXxPv6z3RBzQKpVftEWN78Vl/YweF1uwussDx8ECAXVtr3Rs89fKyG9YlzUs9DyGQ==} - - '@mdx-js/react@3.1.1': - resolution: {integrity: sha512-f++rKLQgUVYDAtECQ6fn/is15GkEH9+nZPM3MS0RcxVqoTfawHvDlSCH7JbMhAM6uJ32v3eXLvLmLvjGu7PTQw==} - peerDependencies: - '@types/react': '>=16' - react: '>=16' - - '@mdx-js/rollup@3.1.1': - resolution: {integrity: sha512-v8satFmBB+DqDzYohnm1u2JOvxx6Hl3pUvqzJvfs2Zk/ngZ1aRUhsWpXvwPkNeGN9c2NCm/38H29ZqXQUjf8dw==} - peerDependencies: - rollup: '>=2' - '@napi-rs/lzma-linux-x64-gnu@1.5.1': resolution: {integrity: sha512-oTXEIha4SsuXdTA4Iyskj0kpdx2yVXdhd75c2v3xGrHFfVMsbhTPZU/nMPL4sWKo4pBHm3aucLaqGlF696dTyQ==} engines: {node: ^22.20 || ^24.12 || >=25} @@ -533,15 +504,6 @@ packages: '@rolldown/pluginutils@1.0.0-beta.27': resolution: {integrity: sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA==} - '@rollup/pluginutils@5.4.0': - resolution: {integrity: sha512-MfPp06CjRLfXQ3wY0R8vJDYBy/MvVcc9OulEfR0B8Iv9ko+GCNaRZ+EpJYFl27LhKsZK0o420sYCRHCjfCgeUg==} - engines: {node: '>=14.0.0'} - peerDependencies: - rollup: ^1.20.0||^2.0.0||^3.0.0||^4.0.0 - peerDependenciesMeta: - rollup: - optional: true - '@rollup/rollup-android-arm-eabi@4.63.2': resolution: {integrity: sha512-Xa6RDoWa+hNiX6PgsljlH6W75RaONx3y6PVlbLhkEWW+GaPQ3dP5gwbL/erAzQHWwkvW5UxdD5l87Qx2FAQ/4A==} cpu: [arm] @@ -721,27 +683,9 @@ packages: '@types/babel__traverse@7.28.0': resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==} - '@types/debug@4.1.13': - resolution: {integrity: sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==} - - '@types/estree-jsx@1.0.5': - resolution: {integrity: sha512-52CcUVNFyfb1A2ALocQw/Dd1BQFNmSdkuC3BkZ6iqhdMfQz7JWOFRuJFloOzjk+6WijU56m9oKXFAXc7o3Towg==} - '@types/estree@1.0.9': resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==} - '@types/hast@3.0.5': - resolution: {integrity: sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==} - - '@types/mdast@4.0.4': - resolution: {integrity: sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==} - - '@types/mdx@2.0.14': - resolution: {integrity: sha512-T48PeuJtvLosNTPVhfnIp3i/n3a4g4Bad7YCq5k64D4u7NwDrAotikQ+5+sjtUvBmxCMlbo3dVL+C2dP0rWHzg==} - - '@types/ms@2.1.0': - resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==} - '@types/node@22.20.2': resolution: {integrity: sha512-xlvWf4Vs9n1PEVYwP1n4vvG07M6y8WgvJ2t0vbrWTmijsIHp1cS+uJ2kMIRdY3nHZK0nCYKrPeD171+SzF4/zw==} @@ -756,15 +700,6 @@ packages: '@types/react@18.3.31': resolution: {integrity: sha512-vfEqpXTvwT91yhmwdfouStN2hSKwTvyRs8qpLfADyrq/kxDw0hZM7Wk9Ug1FELj8hIby+S/+kQCSRFF32nv2Qw==} - '@types/unist@2.0.11': - resolution: {integrity: sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA==} - - '@types/unist@3.0.3': - resolution: {integrity: sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==} - - '@ungap/structured-clone@1.4.0': - resolution: {integrity: sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ==} - '@vitejs/plugin-react@4.7.0': resolution: {integrity: sha512-gUu9hwfWvvEDBBmgtAowQCojwZmJ5mcLn3aufeCsitijs3+f2NsrPtlAWIR6OPiqljl96GVCUbLe0HyqIpVaoA==} engines: {node: ^14.18.0 || >=16.0.0} @@ -803,16 +738,6 @@ packages: '@xterm/xterm@6.0.0': resolution: {integrity: sha512-TQwDdQGtwwDt+2cgKDLn0IRaSxYu1tSUjgKarSDkUM0ZNiSRXFpjxEsvc/Zgc5kq5omJ+V0a8/kIM2WD3sMOYg==} - acorn-jsx@5.3.2: - resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==} - peerDependencies: - acorn: ^6.0.0 || ^7.0.0 || ^8.0.0 - - acorn@8.18.0: - resolution: {integrity: sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==} - engines: {node: '>=0.4.0'} - hasBin: true - agent-base@7.1.4: resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==} engines: {node: '>= 14'} @@ -836,16 +761,9 @@ packages: resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==} engines: {node: '>=12'} - astring@1.9.0: - resolution: {integrity: sha512-LElXdjswlqjWrPpJFg1Fx4wpkOCxj1TDHlSV4PlaRxHGWko024xICaa97ZkMfs6DRKlCguiAI+rbXv5GWwXIkg==} - hasBin: true - asynckit@0.4.0: resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==} - bail@2.0.2: - resolution: {integrity: sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==} - baseline-browser-mapping@2.11.23: resolution: {integrity: sha512-le521dGVfxM7yRX0EikCoSz+rOK+hHzdDt/E7mG1jOJB/6WAAUuwVroLwaB7ApaUsz5Q0kFlDXLSA9MheUIfRQ==} engines: {node: '>=6.0.0'} @@ -867,39 +785,18 @@ packages: caniuse-lite@1.0.30001810: resolution: {integrity: sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==} - ccount@2.0.1: - resolution: {integrity: sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==} - chai@5.3.3: resolution: {integrity: sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==} engines: {node: '>=18'} - character-entities-html4@2.1.0: - resolution: {integrity: sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA==} - - character-entities-legacy@3.0.0: - resolution: {integrity: sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==} - - character-entities@2.0.2: - resolution: {integrity: sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ==} - - character-reference-invalid@2.0.1: - resolution: {integrity: sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw==} - check-error@2.1.3: resolution: {integrity: sha512-PAJdDJusoxnwm1VwW07VWwUN1sl7smmC3OKggvndJFadxxDRyFJBX/ggnu/KE4kQAB7a3Dp8f/YXC1FlUprWmA==} engines: {node: '>= 16'} - collapse-white-space@2.1.0: - resolution: {integrity: sha512-loKTxY1zCOuG4j9f6EPnuyyYkf58RnhhWTvRoZEokgB+WbdXehfjFviyOVYkqzEWz1Q5kRiZdBYS5SwxbQYwzw==} - combined-stream@1.0.8: resolution: {integrity: sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==} engines: {node: '>= 0.8'} - comma-separated-tokens@2.0.3: - resolution: {integrity: sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==} - convert-source-map@2.0.0: resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==} @@ -929,9 +826,6 @@ packages: decimal.js@10.6.0: resolution: {integrity: sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==} - decode-named-character-reference@1.3.0: - resolution: {integrity: sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q==} - deep-eql@5.0.2: resolution: {integrity: sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q==} engines: {node: '>=6'} @@ -944,9 +838,6 @@ packages: resolution: {integrity: sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==} engines: {node: '>=6'} - devlop@1.1.0: - resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==} - dom-accessibility-api@0.5.16: resolution: {integrity: sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==} @@ -983,12 +874,6 @@ packages: resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==} engines: {node: '>= 0.4'} - esast-util-from-estree@2.0.0: - resolution: {integrity: sha512-4CyanoAudUSBAn5K13H4JhsMH6L9ZP7XbLVe/dKybkxMO7eDyLsT8UHl9TRNrU2Gr9nz+FovfSIjuXWJ81uVwQ==} - - esast-util-from-js@2.0.1: - resolution: {integrity: sha512-8Ja+rNJ0Lt56Pcf3TAmpBZjmx8ZcK5Ts4cAzIOjsjevg9oSXJnl6SUQ2EevU8tv3h6ZLWmoKL5H4fgWvdvfETw==} - esbuild@0.21.5: resolution: {integrity: sha512-mg3OPMV4hXywwpoDxu3Qda5xCKQi+vCTZq8S9J/EpkhB2HzKXq4SNFZE3+NK93JYxc8VMSep+lOUSC/RVKaBqw==} engines: {node: '>=12'} @@ -1003,31 +888,6 @@ packages: resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==} engines: {node: '>=6'} - escape-string-regexp@5.0.0: - resolution: {integrity: sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==} - engines: {node: '>=12'} - - estree-util-attach-comments@3.0.0: - resolution: {integrity: sha512-cKUwm/HUcTDsYh/9FgnuFqpfquUbwIqwKM26BVCGDPVgvaCl/nDCCjUfiLlx6lsEZ3Z4RFxNbOQ60pkaEwFxGw==} - - estree-util-build-jsx@3.0.1: - resolution: {integrity: sha512-8U5eiL6BTrPxp/CHbs2yMgP8ftMhR5ww1eIKoWRMlqvltHF8fZn5LRDvTKuxD3DUn+shRbLGqXemcP51oFCsGQ==} - - estree-util-is-identifier-name@3.0.0: - resolution: {integrity: sha512-hFtqIDZTIUZ9BXLb8y4pYGyk6+wekIivNVTcmvk8NoOh+VeRn5y6cEHzbURrWbfp1fIqdVipilzj+lfaadNZmg==} - - estree-util-scope@1.0.1: - resolution: {integrity: sha512-B0np3dcdxqILX5e9nEi5/Fr4K7gL4oYFVPV1zRa2e9wRCbQoZZNWOZFYyoInvXUPJXBXjss+QXlWLJChDEHDkA==} - - estree-util-to-js@2.0.0: - resolution: {integrity: sha512-WDF+xj5rRWmD5tj6bIqRi6CkLIXbbNQUcxQHzGysQzvHmdYG2G7p/Tf0J0gpxGgkeMZNTIjT/AoSvC9Xehcgdg==} - - estree-util-visit@2.0.0: - resolution: {integrity: sha512-m5KgiH85xAhhW8Wta0vShLcUvOsh3LLPI2YVwcbio1l7E09NTLL1EyMZFM1OyWowoH0skScNbhOPl4kcBgzTww==} - - estree-walker@2.0.2: - resolution: {integrity: sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==} - estree-walker@3.0.3: resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==} @@ -1035,9 +895,6 @@ packages: resolution: {integrity: sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==} engines: {node: '>=12.0.0'} - extend@3.0.2: - resolution: {integrity: sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==} - form-data@4.0.6: resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==} engines: {node: '>= 6'} @@ -1078,22 +935,10 @@ packages: resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==} engines: {node: '>= 0.4'} - hast-util-to-estree@3.1.3: - resolution: {integrity: sha512-48+B/rJWAp0jamNbAAf9M7Uf//UVqAoMmgXhBdxTDJLGKY+LRnZ99qcG+Qjl5HfMpYNzS5v4EAwVEF34LeAj7w==} - - hast-util-to-jsx-runtime@2.3.6: - resolution: {integrity: sha512-zl6s8LwNyo1P9uw+XJGvZtdFF1GdAkOg8ujOw+4Pyb76874fLps4ueHXDhXWdk6YHQ6OgUtinliG7RsYvCbbBg==} - - hast-util-whitespace@3.0.0: - resolution: {integrity: sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw==} - html-encoding-sniffer@4.0.0: resolution: {integrity: sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==} engines: {node: '>=18'} - html-url-attributes@3.0.1: - resolution: {integrity: sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ==} - http-proxy-agent@7.0.2: resolution: {integrity: sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==} engines: {node: '>= 14'} @@ -1110,25 +955,6 @@ packages: resolution: {integrity: sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==} engines: {node: '>=8'} - inline-style-parser@0.2.7: - resolution: {integrity: sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==} - - is-alphabetical@2.0.1: - resolution: {integrity: sha512-FWyyY60MeTNyeSRpkM2Iry0G9hpr7/9kD40mD/cGQEuilcZYS4okz8SN2Q6rLCJ8gbCt6fN+rC+6tMGS99LaxQ==} - - is-alphanumerical@2.0.1: - resolution: {integrity: sha512-hmbYhX/9MUMF5uh7tOXyK/n0ZvWpad5caBA17GsC6vyuCqaWliRG5K1qS9inmUhEMaOBIW7/whAnSwveW/LtZw==} - - is-decimal@2.0.1: - resolution: {integrity: sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A==} - - is-hexadecimal@2.0.1: - resolution: {integrity: sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg==} - - is-plain-obj@4.1.0: - resolution: {integrity: sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==} - engines: {node: '>=12'} - is-potential-custom-element-name@1.0.1: resolution: {integrity: sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==} @@ -1154,9 +980,6 @@ packages: engines: {node: '>=6'} hasBin: true - longest-streak@3.1.0: - resolution: {integrity: sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g==} - loose-envify@1.4.0: resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==} hasBin: true @@ -1182,170 +1005,10 @@ packages: magic-string@0.30.21: resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==} - markdown-extensions@2.0.0: - resolution: {integrity: sha512-o5vL7aDWatOTX8LzaS1WMoaoxIiLRQJuIKKe2wAw6IeULDHaqbiqiggmx+pKvZDb1Sj+pE46Sn1T7lCqfFtg1Q==} - engines: {node: '>=16'} - - markdown-table@3.0.4: - resolution: {integrity: sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw==} - math-intrinsics@1.1.0: resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==} engines: {node: '>= 0.4'} - mdast-util-find-and-replace@3.0.2: - resolution: {integrity: sha512-Tmd1Vg/m3Xz43afeNxDIhWRtFZgM2VLyaf4vSTYwudTyeuTneoL3qtWMA5jeLyz/O1vDJmmV4QuScFCA2tBPwg==} - - mdast-util-from-markdown@2.0.3: - resolution: {integrity: sha512-W4mAWTvSlKvf8L6J+VN9yLSqQ9AOAAvHuoDAmPkz4dHf553m5gVj2ejadHJhoJmcmxEnOv6Pa8XJhpxE93kb8Q==} - - mdast-util-gfm-autolink-literal@2.0.1: - resolution: {integrity: sha512-5HVP2MKaP6L+G6YaxPNjuL0BPrq9orG3TsrZ9YXbA3vDw/ACI4MEsnoDpn6ZNm7GnZgtAcONJyPhOP8tNJQavQ==} - - mdast-util-gfm-footnote@2.1.0: - resolution: {integrity: sha512-sqpDWlsHn7Ac9GNZQMeUzPQSMzR6Wv0WKRNvQRg0KqHh02fpTz69Qc1QSseNX29bhz1ROIyNyxExfawVKTm1GQ==} - - mdast-util-gfm-strikethrough@2.0.0: - resolution: {integrity: sha512-mKKb915TF+OC5ptj5bJ7WFRPdYtuHv0yTRxK2tJvi+BDqbkiG7h7u/9SI89nRAYcmap2xHQL9D+QG/6wSrTtXg==} - - mdast-util-gfm-table@2.0.0: - resolution: {integrity: sha512-78UEvebzz/rJIxLvE7ZtDd/vIQ0RHv+3Mh5DR96p7cS7HsBhYIICDBCu8csTNWNO6tBWfqXPWekRuj2FNOGOZg==} - - mdast-util-gfm-task-list-item@2.0.0: - resolution: {integrity: sha512-IrtvNvjxC1o06taBAVJznEnkiHxLFTzgonUdy8hzFVeDun0uTjxxrRGVaNFqkU1wJR3RBPEfsxmU6jDWPofrTQ==} - - mdast-util-gfm@3.1.0: - resolution: {integrity: sha512-0ulfdQOM3ysHhCJ1p06l0b0VKlhU0wuQs3thxZQagjcjPrlFRqY215uZGHHJan9GEAXd9MbfPjFJz+qMkVR6zQ==} - - mdast-util-mdx-expression@2.0.1: - resolution: {integrity: sha512-J6f+9hUp+ldTZqKRSg7Vw5V6MqjATc+3E4gf3CFNcuZNWD8XdyI6zQ8GqH7f8169MM6P7hMBRDVGnn7oHB9kXQ==} - - mdast-util-mdx-jsx@3.2.0: - resolution: {integrity: sha512-lj/z8v0r6ZtsN/cGNNtemmmfoLAFZnjMbNyLzBafjzikOM+glrjNHPlf6lQDOTccj9n5b0PPihEBbhneMyGs1Q==} - - mdast-util-mdx@3.0.0: - resolution: {integrity: sha512-JfbYLAW7XnYTTbUsmpu0kdBUVe+yKVJZBItEjwyYJiDJuZ9w4eeaqks4HQO+R7objWgS2ymV60GYpI14Ug554w==} - - mdast-util-mdxjs-esm@2.0.1: - resolution: {integrity: sha512-EcmOpxsZ96CvlP03NghtH1EsLtr0n9Tm4lPUJUBccV9RwUOneqSycg19n5HGzCf+10LozMRSObtVr3ee1WoHtg==} - - mdast-util-phrasing@4.1.0: - resolution: {integrity: sha512-TqICwyvJJpBwvGAMZjj4J2n0X8QWp21b9l0o7eXyVJ25YNWYbJDVIyD1bZXE6WtV6RmKJVYmQAKWa0zWOABz2w==} - - mdast-util-to-hast@13.2.1: - resolution: {integrity: sha512-cctsq2wp5vTsLIcaymblUriiTcZd0CwWtCbLvrOzYCDZoWyMNV8sZ7krj09FSnsiJi3WVsHLM4k6Dq/yaPyCXA==} - - mdast-util-to-markdown@2.1.2: - resolution: {integrity: sha512-xj68wMTvGXVOKonmog6LwyJKrYXZPvlwabaryTjLh9LuvovB/KAH+kvi8Gjj+7rJjsFi23nkUxRQv1KqSroMqA==} - - mdast-util-to-string@4.0.0: - resolution: {integrity: sha512-0H44vDimn51F0YwvxSJSm0eCDOJTRlmN0R1yBh4HLj9wiV1Dn0QoXGbvFAWj2hSItVTlCmBF1hqKlIyUBVFLPg==} - - micromark-core-commonmark@2.0.3: - resolution: {integrity: sha512-RDBrHEMSxVFLg6xvnXmb1Ayr2WzLAWjeSATAoxwKYJV94TeNavgoIdA0a9ytzDSVzBy2YKFK+emCPOEibLeCrg==} - - micromark-extension-gfm-autolink-literal@2.1.0: - resolution: {integrity: sha512-oOg7knzhicgQ3t4QCjCWgTmfNhvQbDDnJeVu9v81r7NltNCVmhPy1fJRX27pISafdjL+SVc4d3l48Gb6pbRypw==} - - micromark-extension-gfm-footnote@2.1.0: - resolution: {integrity: sha512-/yPhxI1ntnDNsiHtzLKYnE3vf9JZ6cAisqVDauhp4CEHxlb4uoOTxOCJ+9s51bIB8U1N1FJ1RXOKTIlD5B/gqw==} - - micromark-extension-gfm-strikethrough@2.1.0: - resolution: {integrity: sha512-ADVjpOOkjz1hhkZLlBiYA9cR2Anf8F4HqZUO6e5eDcPQd0Txw5fxLzzxnEkSkfnD0wziSGiv7sYhk/ktvbf1uw==} - - micromark-extension-gfm-table@2.1.2: - resolution: {integrity: sha512-pRzm4kDTu0MjlmBkxmS9yYhw60nncfcEwu9NNdPFSQEFXS95ZKyIIyTSHu/o3ReBUrLKYEq+7YaXCRn/bPB4MA==} - - micromark-extension-gfm-tagfilter@2.0.0: - resolution: {integrity: sha512-xHlTOmuCSotIA8TW1mDIM6X2O1SiX5P9IuDtqGonFhEK0qgRI4yeC6vMxEV2dgyr2TiD+2PQ10o+cOhdVAcwfg==} - - micromark-extension-gfm-task-list-item@2.1.0: - resolution: {integrity: sha512-qIBZhqxqI6fjLDYFTBIa4eivDMnP+OZqsNwmQ3xNLE4Cxwc+zfQEfbs6tzAo2Hjq+bh6q5F+Z8/cksrLFYWQQw==} - - micromark-extension-gfm@3.0.0: - resolution: {integrity: sha512-vsKArQsicm7t0z2GugkCKtZehqUm31oeGBV/KVSorWSy8ZlNAv7ytjFhvaryUiCUJYqs+NoE6AFhpQvBTM6Q4w==} - - micromark-extension-mdx-expression@3.0.1: - resolution: {integrity: sha512-dD/ADLJ1AeMvSAKBwO22zG22N4ybhe7kFIZ3LsDI0GlsNr2A3KYxb0LdC1u5rj4Nw+CHKY0RVdnHX8vj8ejm4Q==} - - micromark-extension-mdx-jsx@3.0.2: - resolution: {integrity: sha512-e5+q1DjMh62LZAJOnDraSSbDMvGJ8x3cbjygy2qFEi7HCeUT4BDKCvMozPozcD6WmOt6sVvYDNBKhFSz3kjOVQ==} - - micromark-extension-mdx-md@2.0.0: - resolution: {integrity: sha512-EpAiszsB3blw4Rpba7xTOUptcFeBFi+6PY8VnJ2hhimH+vCQDirWgsMpz7w1XcZE7LVrSAUGb9VJpG9ghlYvYQ==} - - micromark-extension-mdxjs-esm@3.0.0: - resolution: {integrity: sha512-DJFl4ZqkErRpq/dAPyeWp15tGrcrrJho1hKK5uBS70BCtfrIFg81sqcTVu3Ta+KD1Tk5vAtBNElWxtAa+m8K9A==} - - micromark-extension-mdxjs@3.0.0: - resolution: {integrity: sha512-A873fJfhnJ2siZyUrJ31l34Uqwy4xIFmvPY1oj+Ean5PHcPBYzEsvqvWGaWcfEIr11O5Dlw3p2y0tZWpKHDejQ==} - - micromark-factory-destination@2.0.1: - resolution: {integrity: sha512-Xe6rDdJlkmbFRExpTOmRj9N3MaWmbAgdpSrBQvCFqhezUn4AHqJHbaEnfbVYYiexVSs//tqOdY/DxhjdCiJnIA==} - - micromark-factory-label@2.0.1: - resolution: {integrity: sha512-VFMekyQExqIW7xIChcXn4ok29YE3rnuyveW3wZQWWqF4Nv9Wk5rgJ99KzPvHjkmPXF93FXIbBp6YdW3t71/7Vg==} - - micromark-factory-mdx-expression@2.0.3: - resolution: {integrity: sha512-kQnEtA3vzucU2BkrIa8/VaSAsP+EJ3CKOvhMuJgOEGg9KDC6OAY6nSnNDVRiVNRqj7Y4SlSzcStaH/5jge8JdQ==} - - micromark-factory-space@2.0.1: - resolution: {integrity: sha512-zRkxjtBxxLd2Sc0d+fbnEunsTj46SWXgXciZmHq0kDYGnck/ZSGj9/wULTV95uoeYiK5hRXP2mJ98Uo4cq/LQg==} - - micromark-factory-title@2.0.1: - resolution: {integrity: sha512-5bZ+3CjhAd9eChYTHsjy6TGxpOFSKgKKJPJxr293jTbfry2KDoWkhBb6TcPVB4NmzaPhMs1Frm9AZH7OD4Cjzw==} - - micromark-factory-whitespace@2.0.1: - resolution: {integrity: sha512-Ob0nuZ3PKt/n0hORHyvoD9uZhr+Za8sFoP+OnMcnWK5lngSzALgQYKMr9RJVOWLqQYuyn6ulqGWSXdwf6F80lQ==} - - micromark-util-character@2.1.1: - resolution: {integrity: sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q==} - - micromark-util-chunked@2.0.1: - resolution: {integrity: sha512-QUNFEOPELfmvv+4xiNg2sRYeS/P84pTW0TCgP5zc9FpXetHY0ab7SxKyAQCNCc1eK0459uoLI1y5oO5Vc1dbhA==} - - micromark-util-classify-character@2.0.1: - resolution: {integrity: sha512-K0kHzM6afW/MbeWYWLjoHQv1sgg2Q9EccHEDzSkxiP/EaagNzCm7T/WMKZ3rjMbvIpvBiZgwR3dKMygtA4mG1Q==} - - micromark-util-combine-extensions@2.0.1: - resolution: {integrity: sha512-OnAnH8Ujmy59JcyZw8JSbK9cGpdVY44NKgSM7E9Eh7DiLS2E9RNQf0dONaGDzEG9yjEl5hcqeIsj4hfRkLH/Bg==} - - micromark-util-decode-numeric-character-reference@2.0.2: - resolution: {integrity: sha512-ccUbYk6CwVdkmCQMyr64dXz42EfHGkPQlBj5p7YVGzq8I7CtjXZJrubAYezf7Rp+bjPseiROqe7G6foFd+lEuw==} - - micromark-util-decode-string@2.0.1: - resolution: {integrity: sha512-nDV/77Fj6eH1ynwscYTOsbK7rR//Uj0bZXBwJZRfaLEJ1iGBR6kIfNmlNqaqJf649EP0F3NWNdeJi03elllNUQ==} - - micromark-util-encode@2.0.1: - resolution: {integrity: sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw==} - - micromark-util-events-to-acorn@2.0.3: - resolution: {integrity: sha512-jmsiEIiZ1n7X1Rr5k8wVExBQCg5jy4UXVADItHmNk1zkwEVhBuIUKRu3fqv+hs4nxLISi2DQGlqIOGiFxgbfHg==} - - micromark-util-html-tag-name@2.0.1: - resolution: {integrity: sha512-2cNEiYDhCWKI+Gs9T0Tiysk136SnR13hhO8yW6BGNyhOC4qYFnwF1nKfD3HFAIXA5c45RrIG1ub11GiXeYd1xA==} - - micromark-util-normalize-identifier@2.0.1: - resolution: {integrity: sha512-sxPqmo70LyARJs0w2UclACPUUEqltCkJ6PhKdMIDuJ3gSf/Q+/GIe3WKl0Ijb/GyH9lOpUkRAO2wp0GVkLvS9Q==} - - micromark-util-resolve-all@2.0.1: - resolution: {integrity: sha512-VdQyxFWFT2/FGJgwQnJYbe1jjQoNTS4RjglmSjTUlpUMa95Htx9NHeYW4rGDJzbjvCsl9eLjMQwGeElsqmzcHg==} - - micromark-util-sanitize-uri@2.0.1: - resolution: {integrity: sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ==} - - micromark-util-subtokenize@2.1.0: - resolution: {integrity: sha512-XQLu552iSctvnEcgXw6+Sx75GflAPNED1qx7eBJ+wydBb2KCbRZe+NwvIEEMM83uml1+2WSXpBAcp9IUCgCYWA==} - - micromark-util-symbol@2.0.1: - resolution: {integrity: sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==} - - micromark-util-types@2.0.2: - resolution: {integrity: sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA==} - - micromark@4.0.2: - resolution: {integrity: sha512-zpe98Q6kvavpCr1NPVSCMebCKfD7CA2NqZ+rykeNhONIJBpc1tFKt9hucLGwha3jNTNI8lHpctWJWoimVF4PfA==} - mime-db@1.52.0: resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==} engines: {node: '>= 0.6'} @@ -1373,9 +1036,6 @@ packages: nwsapi@2.2.27: resolution: {integrity: sha512-gQPNF78qebCQ6tvVFBYrvJdBNOrYZm90ZlXgpIFm06p6qHDHq/XC4TnJftN6OMbxVE0UTBAoRgcsDeJBBooITw==} - parse-entities@4.0.2: - resolution: {integrity: sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw==} - parse5@7.3.0: resolution: {integrity: sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==} @@ -1389,10 +1049,6 @@ packages: picocolors@1.1.1: resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==} - picomatch@4.0.7: - resolution: {integrity: sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==} - engines: {node: '>=12'} - playwright-core@1.63.0: resolution: {integrity: sha512-rYCsBF/M5HjUch52bbtVONEFjv6Xu8sm8h72dNlR5bzIE1fvC/bxgspzkjSfU+MweEMmPM8KJebG6nnyxo5mCg==} engines: {node: '>=20'} @@ -1411,9 +1067,6 @@ packages: resolution: {integrity: sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==} engines: {node: ^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0} - property-information@7.2.0: - resolution: {integrity: sha512-IAtzIB6sUiWaJYrX9smp3V46pBGbBeLFRGdh25kg1334VcBlD8HzhPeNIWQH9zhGmo2itIe25EHt9dQP7G5hmg==} - punycode@2.3.1: resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==} engines: {node: '>=6'} @@ -1426,12 +1079,6 @@ packages: react-is@17.0.2: resolution: {integrity: sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==} - react-markdown@9.1.0: - resolution: {integrity: sha512-xaijuJB0kzGiUdG7nc2MOMDUDBWPyGAjZtUrow9XxUeua8IqeP+VlIfAZ3bphpcLTnSZXz6z9jcVC/TCwbfgdw==} - peerDependencies: - '@types/react': '>=18' - react: '>=18' - react-refresh@0.17.0: resolution: {integrity: sha512-z6F7K9bV85EfseRCp2bzrpyQ0Gkw1uLoCel9XBVWPg/TjRj94SkJzUTGfOa4bs7iJvBWtQG0Wq7wnI0syw3EBQ==} engines: {node: '>=0.10.0'} @@ -1440,42 +1087,10 @@ packages: resolution: {integrity: sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==} engines: {node: '>=0.10.0'} - recma-build-jsx@1.0.0: - resolution: {integrity: sha512-8GtdyqaBcDfva+GUKDr3nev3VpKAhup1+RvkMvUxURHpW7QyIvk9F5wz7Vzo06CEMSilw6uArgRqhpiUcWp8ew==} - - recma-jsx@1.0.1: - resolution: {integrity: sha512-huSIy7VU2Z5OLv6oFLosQGGDqPqdO1iq6bWNAdhzMxSJP7RAso4fCZ1cKu8j9YHCZf3TPrq4dw3okhrylgcd7w==} - peerDependencies: - acorn: ^6.0.0 || ^7.0.0 || ^8.0.0 - - recma-parse@1.0.0: - resolution: {integrity: sha512-OYLsIGBB5Y5wjnSnQW6t3Xg7q3fQ7FWbw/vcXtORTnyaSFscOtABg+7Pnz6YZ6c27fG1/aN8CjfwoUEUIdwqWQ==} - - recma-stringify@1.0.0: - resolution: {integrity: sha512-cjwII1MdIIVloKvC9ErQ+OgAtwHBmcZ0Bg4ciz78FtbT8In39aAYbaA7zvxQ61xVMSPE8WxhLwLbhif4Js2C+g==} - redent@3.0.0: resolution: {integrity: sha512-6tDA8g98We0zd0GvVeMT9arEOnTw9qM03L9cJXaCjrip1OO764RDBLBfrB4cwzNGDj5OA5ioymC9GkizgWJDUg==} engines: {node: '>=8'} - rehype-recma@1.0.0: - resolution: {integrity: sha512-lqA4rGUf1JmacCNWWZx0Wv1dHqMwxzsDWYMTowuplHF3xH0N/MmrZ/G3BDZnzAkRmxDadujCjaKM2hqYdCBOGw==} - - remark-gfm@4.0.1: - resolution: {integrity: sha512-1quofZ2RQ9EWdeN34S79+KExV1764+wCUGop5CPL1WGdD0ocPpu91lzPGbwWMECpEpd42kJGQwzRfyov9j4yNg==} - - remark-mdx@3.1.1: - resolution: {integrity: sha512-Pjj2IYlUY3+D8x00UJsIOg5BEvfMyeI+2uLPn9VO9Wg4MEtN/VTIq2NEJQfde9PnX15KgtHyl9S0BcTnWrIuWg==} - - remark-parse@11.0.0: - resolution: {integrity: sha512-FCxlKLNGknS5ba/1lmpYijMUzX2esxW5xQqjWxw2eHFfS2MSdaHVINFmhjo+qN1WhZhNimq0dZATN9pH0IDrpA==} - - remark-rehype@11.1.2: - resolution: {integrity: sha512-Dh7l57ianaEoIpzbp0PC9UKAdCSVklD8E5Rpw7ETfbTl3FqcOOgq5q2LVDhgGCkaBv7p24JXikPdvhhmHvKMsw==} - - remark-stringify@11.0.0: - resolution: {integrity: sha512-1OSmLd3awB/t8qdoEOMazZkNsfVTeY4fTsgzcQFdXNq8ToTN4ZGwrMnlda4K6smTFKD+GRV6O48i6Z4iKgPPpw==} - rollup@4.63.2: resolution: {integrity: sha512-l5eyksV4tPBj6lJyEa37YzIOCSOV7lkZzEHUdpjWZbtD7wTcFYmEYXSgm5bT4vV+dZLb9rBG1W9GROOG4NS4Ew==} engines: {node: '>=18.0.0', npm: '>=8.0.0'} @@ -1508,32 +1123,16 @@ packages: resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} engines: {node: '>=0.10.0'} - source-map@0.7.6: - resolution: {integrity: sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==} - engines: {node: '>= 12'} - - space-separated-tokens@2.0.2: - resolution: {integrity: sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q==} - stackback@0.0.2: resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==} std-env@3.10.0: resolution: {integrity: sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==} - stringify-entities@4.0.4: - resolution: {integrity: sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg==} - strip-indent@3.0.0: resolution: {integrity: sha512-laJTa3Jb+VQpaC6DseHhF7dXVqHTfJPCRDaEbid/drOhgitgYku/letMUqOXFoWV0zIIUbjpdH2t+tYj4bQMRQ==} engines: {node: '>=8'} - style-to-js@1.1.21: - resolution: {integrity: sha512-RjQetxJrrUJLQPHbLku6U/ocGtzyjbJMP9lCNK7Ag0CNh690nSH8woqWH9u16nMjYBAok+i7JO1NP2pOy8IsPQ==} - - style-to-object@1.0.14: - resolution: {integrity: sha512-LIN7rULI0jBscWQYaSswptyderlarFkjQ+t79nzty8tcIAceVomEVlLzH5VP4Cmsv6MtKhs7qaAiwlcp+Mgaxw==} - symbol-tree@3.2.4: resolution: {integrity: sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==} @@ -1570,12 +1169,6 @@ packages: resolution: {integrity: sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==} engines: {node: '>=18'} - trim-lines@3.0.1: - resolution: {integrity: sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg==} - - trough@2.2.0: - resolution: {integrity: sha512-tmMpK00BjZiUyVyvrBK7knerNgmgvcV/KLVyuma/SC+TQN167GrMRciANTz09+k3zW8L8t60jWO1GpfkZdjTaw==} - tsx@4.23.13: resolution: {integrity: sha512-BL5MGkRln6aDYhb0xbQlEAGw743BaZYWdbWtdJOBriYJboKgUUYCadFp2/FpBBZquBC/ezNBn7wMMPx7FDZUDw==} engines: {node: '>=18.0.0'} @@ -1589,39 +1182,12 @@ packages: undici-types@6.21.0: resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==} - unified@11.0.5: - resolution: {integrity: sha512-xKvGhPWw3k84Qjh8bI3ZeJjqnyadK+GEFtazSfZv/rKeTkTjOJho6mFqh2SM96iIcZokxiOpg78GazTSg8+KHA==} - - unist-util-is@6.0.1: - resolution: {integrity: sha512-LsiILbtBETkDz8I9p1dQ0uyRUWuaQzd/cuEeS1hoRSyW5E5XGmTzlwY1OrNzzakGowI9Dr/I8HVaw4hTtnxy8g==} - - unist-util-position-from-estree@2.0.0: - resolution: {integrity: sha512-KaFVRjoqLyF6YXCbVLNad/eS4+OfPQQn2yOd7zF/h5T/CSL2v8NpN6a5TPvtbXthAGw5nG+PuTtq+DdIZr+cRQ==} - - unist-util-position@5.0.0: - resolution: {integrity: sha512-fucsC7HjXvkB5R3kTCO7kUjRdrS0BJt3M/FPxmHMBOm8JQi2BsHAHFsy27E0EolP8rp0NzXsJ+jNPyDWvOJZPA==} - - unist-util-stringify-position@4.0.0: - resolution: {integrity: sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ==} - - unist-util-visit-parents@6.0.2: - resolution: {integrity: sha512-goh1s1TBrqSqukSc8wrjwWhL0hiJxgA8m4kFxGlQ+8FYQ3C/m11FcTs4YYem7V664AhHVvgoQLk890Ssdsr2IQ==} - - unist-util-visit@5.1.0: - resolution: {integrity: sha512-m+vIdyeCOpdr/QeQCu2EzxX/ohgS8KbnPDgFni4dQsfSCtpz8UqDyY5GjRru8PDKuYn7Fq19j1CQ+nJSsGKOzg==} - update-browserslist-db@1.3.3: resolution: {integrity: sha512-pJ2sYawQS0R/WI928Gj5GlPhTGzbMelq0+4INtSYNDV9ErKJcX6xjGWkoG/VnB3dpUm00zALaqkrUD77pO5TDQ==} hasBin: true peerDependencies: browserslist: '>= 4.21.0' - vfile-message@4.0.3: - resolution: {integrity: sha512-QTHzsGd1EhbZs4AsQ20JX1rC3cOlt/IWJruk893DfLRr57lcnOeMaWG4K0JrRta4mIJZKth2Au3mM3u03/JWKw==} - - vfile@6.0.3: - resolution: {integrity: sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==} - vite-node@2.1.9: resolution: {integrity: sha512-AM9aQ/IPrW/6ENLQg3AGY4K1N2TGZdR5e4gu/MmmR2xR3Ll1+dib+nook92g4TV3PXVyeyxdWwtaCAiUL0hMxA==} engines: {node: ^18.0.0 || >=20.0.0} @@ -1736,9 +1302,6 @@ packages: engines: {node: '>= 14.6'} hasBin: true - zwitch@2.0.4: - resolution: {integrity: sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==} - snapshots: '@adobe/css-tools@4.5.0': {} @@ -2051,65 +1614,11 @@ snapshots: '@jridgewell/resolve-uri': 3.1.2 '@jridgewell/sourcemap-codec': 1.6.0 - '@mdx-js/mdx@3.1.1': - dependencies: - '@types/estree': 1.0.9 - '@types/estree-jsx': 1.0.5 - '@types/hast': 3.0.5 - '@types/mdx': 2.0.14 - acorn: 8.18.0 - collapse-white-space: 2.1.0 - devlop: 1.1.0 - estree-util-is-identifier-name: 3.0.0 - estree-util-scope: 1.0.1 - estree-walker: 3.0.3 - hast-util-to-jsx-runtime: 2.3.6 - markdown-extensions: 2.0.0 - recma-build-jsx: 1.0.0 - recma-jsx: 1.0.1(acorn@8.18.0) - recma-stringify: 1.0.0 - rehype-recma: 1.0.0 - remark-mdx: 3.1.1 - remark-parse: 11.0.0 - remark-rehype: 11.1.2 - source-map: 0.7.6 - unified: 11.0.5 - unist-util-position-from-estree: 2.0.0 - unist-util-stringify-position: 4.0.0 - unist-util-visit: 5.1.0 - vfile: 6.0.3 - transitivePeerDependencies: - - supports-color - - '@mdx-js/react@3.1.1(@types/react@18.3.31)(react@18.3.1)': - dependencies: - '@types/mdx': 2.0.14 - '@types/react': 18.3.31 - react: 18.3.1 - - '@mdx-js/rollup@3.1.1(rollup@4.63.2)': - dependencies: - '@mdx-js/mdx': 3.1.1 - '@rollup/pluginutils': 5.4.0(rollup@4.63.2) - rollup: 4.63.2 - source-map: 0.7.6 - vfile: 6.0.3 - transitivePeerDependencies: - - supports-color - '@napi-rs/lzma-linux-x64-gnu@1.5.1': optional: true '@rolldown/pluginutils@1.0.0-beta.27': {} - '@rollup/pluginutils@5.4.0(rollup@4.63.2)': - dependencies: - '@types/estree': 1.0.9 - estree-walker: 2.0.2 - picomatch: 4.0.7 - optionalDependencies: - rollup: 4.63.2 - '@rollup/rollup-android-arm-eabi@4.63.2': optional: true @@ -2239,28 +1748,8 @@ snapshots: dependencies: '@babel/types': 7.29.8 - '@types/debug@4.1.13': - dependencies: - '@types/ms': 2.1.0 - - '@types/estree-jsx@1.0.5': - dependencies: - '@types/estree': 1.0.9 - '@types/estree@1.0.9': {} - '@types/hast@3.0.5': - dependencies: - '@types/unist': 3.0.3 - - '@types/mdast@4.0.4': - dependencies: - '@types/unist': 3.0.3 - - '@types/mdx@2.0.14': {} - - '@types/ms@2.1.0': {} - '@types/node@22.20.2': dependencies: undici-types: 6.21.0 @@ -2276,12 +1765,6 @@ snapshots: '@types/prop-types': 15.7.15 csstype: 3.2.3 - '@types/unist@2.0.11': {} - - '@types/unist@3.0.3': {} - - '@ungap/structured-clone@1.4.0': {} - '@vitejs/plugin-react@4.7.0(vite@5.4.21(@types/node@22.20.2))': dependencies: '@babel/core': 7.29.7 @@ -2336,12 +1819,6 @@ snapshots: '@xterm/xterm@6.0.0': {} - acorn-jsx@5.3.2(acorn@8.18.0): - dependencies: - acorn: 8.18.0 - - acorn@8.18.0: {} - agent-base@7.1.4: {} ansi-regex@5.0.1: {} @@ -2356,12 +1833,8 @@ snapshots: assertion-error@2.0.1: {} - astring@1.9.0: {} - asynckit@0.4.0: {} - bail@2.0.2: {} - baseline-browser-mapping@2.11.23: {} browserslist@4.28.9: @@ -2381,8 +1854,6 @@ snapshots: caniuse-lite@1.0.30001810: {} - ccount@2.0.1: {} - chai@5.3.3: dependencies: assertion-error: 2.0.1 @@ -2391,24 +1862,12 @@ snapshots: loupe: 3.2.1 pathval: 2.0.1 - character-entities-html4@2.1.0: {} - - character-entities-legacy@3.0.0: {} - - character-entities@2.0.2: {} - - character-reference-invalid@2.0.1: {} - check-error@2.1.3: {} - collapse-white-space@2.1.0: {} - combined-stream@1.0.8: dependencies: delayed-stream: 1.0.0 - comma-separated-tokens@2.0.3: {} - convert-source-map@2.0.0: {} css.escape@1.5.1: {} @@ -2431,20 +1890,12 @@ snapshots: decimal.js@10.6.0: {} - decode-named-character-reference@1.3.0: - dependencies: - character-entities: 2.0.2 - deep-eql@5.0.2: {} delayed-stream@1.0.0: {} dequal@2.0.3: {} - devlop@1.1.0: - dependencies: - dequal: 2.0.3 - dom-accessibility-api@0.5.16: {} dom-accessibility-api@0.6.3: {} @@ -2476,20 +1927,6 @@ snapshots: has-tostringtag: 1.0.2 hasown: 2.0.4 - esast-util-from-estree@2.0.0: - dependencies: - '@types/estree-jsx': 1.0.5 - devlop: 1.1.0 - estree-util-visit: 2.0.0 - unist-util-position-from-estree: 2.0.0 - - esast-util-from-js@2.0.1: - dependencies: - '@types/estree-jsx': 1.0.5 - acorn: 8.18.0 - esast-util-from-estree: 2.0.0 - vfile-message: 4.0.3 - esbuild@0.21.5: optionalDependencies: '@esbuild/aix-ppc64': 0.21.5 @@ -2547,47 +1984,12 @@ snapshots: escalade@3.2.0: {} - escape-string-regexp@5.0.0: {} - - estree-util-attach-comments@3.0.0: - dependencies: - '@types/estree': 1.0.9 - - estree-util-build-jsx@3.0.1: - dependencies: - '@types/estree-jsx': 1.0.5 - devlop: 1.1.0 - estree-util-is-identifier-name: 3.0.0 - estree-walker: 3.0.3 - - estree-util-is-identifier-name@3.0.0: {} - - estree-util-scope@1.0.1: - dependencies: - '@types/estree': 1.0.9 - devlop: 1.1.0 - - estree-util-to-js@2.0.0: - dependencies: - '@types/estree-jsx': 1.0.5 - astring: 1.9.0 - source-map: 0.7.6 - - estree-util-visit@2.0.0: - dependencies: - '@types/estree-jsx': 1.0.5 - '@types/unist': 3.0.3 - - estree-walker@2.0.2: {} - estree-walker@3.0.3: dependencies: '@types/estree': 1.0.9 expect-type@1.4.0: {} - extend@3.0.2: {} - form-data@4.0.6: dependencies: asynckit: 0.4.0 @@ -2633,57 +2035,10 @@ snapshots: dependencies: function-bind: 1.1.2 - hast-util-to-estree@3.1.3: - dependencies: - '@types/estree': 1.0.9 - '@types/estree-jsx': 1.0.5 - '@types/hast': 3.0.5 - comma-separated-tokens: 2.0.3 - devlop: 1.1.0 - estree-util-attach-comments: 3.0.0 - estree-util-is-identifier-name: 3.0.0 - hast-util-whitespace: 3.0.0 - mdast-util-mdx-expression: 2.0.1 - mdast-util-mdx-jsx: 3.2.0 - mdast-util-mdxjs-esm: 2.0.1 - property-information: 7.2.0 - space-separated-tokens: 2.0.2 - style-to-js: 1.1.21 - unist-util-position: 5.0.0 - zwitch: 2.0.4 - transitivePeerDependencies: - - supports-color - - hast-util-to-jsx-runtime@2.3.6: - dependencies: - '@types/estree': 1.0.9 - '@types/hast': 3.0.5 - '@types/unist': 3.0.3 - comma-separated-tokens: 2.0.3 - devlop: 1.1.0 - estree-util-is-identifier-name: 3.0.0 - hast-util-whitespace: 3.0.0 - mdast-util-mdx-expression: 2.0.1 - mdast-util-mdx-jsx: 3.2.0 - mdast-util-mdxjs-esm: 2.0.1 - property-information: 7.2.0 - space-separated-tokens: 2.0.2 - style-to-js: 1.1.21 - unist-util-position: 5.0.0 - vfile-message: 4.0.3 - transitivePeerDependencies: - - supports-color - - hast-util-whitespace@3.0.0: - dependencies: - '@types/hast': 3.0.5 - html-encoding-sniffer@4.0.0: dependencies: whatwg-encoding: 3.1.1 - html-url-attributes@3.0.1: {} - http-proxy-agent@7.0.2: dependencies: agent-base: 7.1.4 @@ -2704,21 +2059,6 @@ snapshots: indent-string@4.0.0: {} - inline-style-parser@0.2.7: {} - - is-alphabetical@2.0.1: {} - - is-alphanumerical@2.0.1: - dependencies: - is-alphabetical: 2.0.1 - is-decimal: 2.0.1 - - is-decimal@2.0.1: {} - - is-hexadecimal@2.0.1: {} - - is-plain-obj@4.1.0: {} - is-potential-custom-element-name@1.0.1: {} js-tokens@4.0.0: {} @@ -2755,8 +2095,6 @@ snapshots: json5@2.2.3: {} - longest-streak@3.1.0: {} - loose-envify@1.4.0: dependencies: js-tokens: 4.0.0 @@ -2779,439 +2117,8 @@ snapshots: dependencies: '@jridgewell/sourcemap-codec': 1.6.0 - markdown-extensions@2.0.0: {} - - markdown-table@3.0.4: {} - math-intrinsics@1.1.0: {} - mdast-util-find-and-replace@3.0.2: - dependencies: - '@types/mdast': 4.0.4 - escape-string-regexp: 5.0.0 - unist-util-is: 6.0.1 - unist-util-visit-parents: 6.0.2 - - mdast-util-from-markdown@2.0.3: - dependencies: - '@types/mdast': 4.0.4 - '@types/unist': 3.0.3 - decode-named-character-reference: 1.3.0 - devlop: 1.1.0 - mdast-util-to-string: 4.0.0 - micromark: 4.0.2 - micromark-util-decode-numeric-character-reference: 2.0.2 - micromark-util-decode-string: 2.0.1 - micromark-util-normalize-identifier: 2.0.1 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - unist-util-stringify-position: 4.0.0 - transitivePeerDependencies: - - supports-color - - mdast-util-gfm-autolink-literal@2.0.1: - dependencies: - '@types/mdast': 4.0.4 - ccount: 2.0.1 - devlop: 1.1.0 - mdast-util-find-and-replace: 3.0.2 - micromark-util-character: 2.1.1 - - mdast-util-gfm-footnote@2.1.0: - dependencies: - '@types/mdast': 4.0.4 - devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3 - mdast-util-to-markdown: 2.1.2 - micromark-util-normalize-identifier: 2.0.1 - transitivePeerDependencies: - - supports-color - - mdast-util-gfm-strikethrough@2.0.0: - dependencies: - '@types/mdast': 4.0.4 - mdast-util-from-markdown: 2.0.3 - mdast-util-to-markdown: 2.1.2 - transitivePeerDependencies: - - supports-color - - mdast-util-gfm-table@2.0.0: - dependencies: - '@types/mdast': 4.0.4 - devlop: 1.1.0 - markdown-table: 3.0.4 - mdast-util-from-markdown: 2.0.3 - mdast-util-to-markdown: 2.1.2 - transitivePeerDependencies: - - supports-color - - mdast-util-gfm-task-list-item@2.0.0: - dependencies: - '@types/mdast': 4.0.4 - devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3 - mdast-util-to-markdown: 2.1.2 - transitivePeerDependencies: - - supports-color - - mdast-util-gfm@3.1.0: - dependencies: - mdast-util-from-markdown: 2.0.3 - mdast-util-gfm-autolink-literal: 2.0.1 - mdast-util-gfm-footnote: 2.1.0 - mdast-util-gfm-strikethrough: 2.0.0 - mdast-util-gfm-table: 2.0.0 - mdast-util-gfm-task-list-item: 2.0.0 - mdast-util-to-markdown: 2.1.2 - transitivePeerDependencies: - - supports-color - - mdast-util-mdx-expression@2.0.1: - dependencies: - '@types/estree-jsx': 1.0.5 - '@types/hast': 3.0.5 - '@types/mdast': 4.0.4 - devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3 - mdast-util-to-markdown: 2.1.2 - transitivePeerDependencies: - - supports-color - - mdast-util-mdx-jsx@3.2.0: - dependencies: - '@types/estree-jsx': 1.0.5 - '@types/hast': 3.0.5 - '@types/mdast': 4.0.4 - '@types/unist': 3.0.3 - ccount: 2.0.1 - devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3 - mdast-util-to-markdown: 2.1.2 - parse-entities: 4.0.2 - stringify-entities: 4.0.4 - unist-util-stringify-position: 4.0.0 - vfile-message: 4.0.3 - transitivePeerDependencies: - - supports-color - - mdast-util-mdx@3.0.0: - dependencies: - mdast-util-from-markdown: 2.0.3 - mdast-util-mdx-expression: 2.0.1 - mdast-util-mdx-jsx: 3.2.0 - mdast-util-mdxjs-esm: 2.0.1 - mdast-util-to-markdown: 2.1.2 - transitivePeerDependencies: - - supports-color - - mdast-util-mdxjs-esm@2.0.1: - dependencies: - '@types/estree-jsx': 1.0.5 - '@types/hast': 3.0.5 - '@types/mdast': 4.0.4 - devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3 - mdast-util-to-markdown: 2.1.2 - transitivePeerDependencies: - - supports-color - - mdast-util-phrasing@4.1.0: - dependencies: - '@types/mdast': 4.0.4 - unist-util-is: 6.0.1 - - mdast-util-to-hast@13.2.1: - dependencies: - '@types/hast': 3.0.5 - '@types/mdast': 4.0.4 - '@ungap/structured-clone': 1.4.0 - devlop: 1.1.0 - micromark-util-sanitize-uri: 2.0.1 - trim-lines: 3.0.1 - unist-util-position: 5.0.0 - unist-util-visit: 5.1.0 - vfile: 6.0.3 - - mdast-util-to-markdown@2.1.2: - dependencies: - '@types/mdast': 4.0.4 - '@types/unist': 3.0.3 - longest-streak: 3.1.0 - mdast-util-phrasing: 4.1.0 - mdast-util-to-string: 4.0.0 - micromark-util-classify-character: 2.0.1 - micromark-util-decode-string: 2.0.1 - unist-util-visit: 5.1.0 - zwitch: 2.0.4 - - mdast-util-to-string@4.0.0: - dependencies: - '@types/mdast': 4.0.4 - - micromark-core-commonmark@2.0.3: - dependencies: - decode-named-character-reference: 1.3.0 - devlop: 1.1.0 - micromark-factory-destination: 2.0.1 - micromark-factory-label: 2.0.1 - micromark-factory-space: 2.0.1 - micromark-factory-title: 2.0.1 - micromark-factory-whitespace: 2.0.1 - micromark-util-character: 2.1.1 - micromark-util-chunked: 2.0.1 - micromark-util-classify-character: 2.0.1 - micromark-util-html-tag-name: 2.0.1 - micromark-util-normalize-identifier: 2.0.1 - micromark-util-resolve-all: 2.0.1 - micromark-util-subtokenize: 2.1.0 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-extension-gfm-autolink-literal@2.1.0: - dependencies: - micromark-util-character: 2.1.1 - micromark-util-sanitize-uri: 2.0.1 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-extension-gfm-footnote@2.1.0: - dependencies: - devlop: 1.1.0 - micromark-core-commonmark: 2.0.3 - micromark-factory-space: 2.0.1 - micromark-util-character: 2.1.1 - micromark-util-normalize-identifier: 2.0.1 - micromark-util-sanitize-uri: 2.0.1 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-extension-gfm-strikethrough@2.1.0: - dependencies: - devlop: 1.1.0 - micromark-util-chunked: 2.0.1 - micromark-util-classify-character: 2.0.1 - micromark-util-resolve-all: 2.0.1 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-extension-gfm-table@2.1.2: - dependencies: - devlop: 1.1.0 - micromark-factory-space: 2.0.1 - micromark-util-character: 2.1.1 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-extension-gfm-tagfilter@2.0.0: - dependencies: - micromark-util-types: 2.0.2 - - micromark-extension-gfm-task-list-item@2.1.0: - dependencies: - devlop: 1.1.0 - micromark-factory-space: 2.0.1 - micromark-util-character: 2.1.1 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-extension-gfm@3.0.0: - dependencies: - micromark-extension-gfm-autolink-literal: 2.1.0 - micromark-extension-gfm-footnote: 2.1.0 - micromark-extension-gfm-strikethrough: 2.1.0 - micromark-extension-gfm-table: 2.1.2 - micromark-extension-gfm-tagfilter: 2.0.0 - micromark-extension-gfm-task-list-item: 2.1.0 - micromark-util-combine-extensions: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-extension-mdx-expression@3.0.1: - dependencies: - '@types/estree': 1.0.9 - devlop: 1.1.0 - micromark-factory-mdx-expression: 2.0.3 - micromark-factory-space: 2.0.1 - micromark-util-character: 2.1.1 - micromark-util-events-to-acorn: 2.0.3 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-extension-mdx-jsx@3.0.2: - dependencies: - '@types/estree': 1.0.9 - devlop: 1.1.0 - estree-util-is-identifier-name: 3.0.0 - micromark-factory-mdx-expression: 2.0.3 - micromark-factory-space: 2.0.1 - micromark-util-character: 2.1.1 - micromark-util-events-to-acorn: 2.0.3 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - vfile-message: 4.0.3 - - micromark-extension-mdx-md@2.0.0: - dependencies: - micromark-util-types: 2.0.2 - - micromark-extension-mdxjs-esm@3.0.0: - dependencies: - '@types/estree': 1.0.9 - devlop: 1.1.0 - micromark-core-commonmark: 2.0.3 - micromark-util-character: 2.1.1 - micromark-util-events-to-acorn: 2.0.3 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - unist-util-position-from-estree: 2.0.0 - vfile-message: 4.0.3 - - micromark-extension-mdxjs@3.0.0: - dependencies: - acorn: 8.18.0 - acorn-jsx: 5.3.2(acorn@8.18.0) - micromark-extension-mdx-expression: 3.0.1 - micromark-extension-mdx-jsx: 3.0.2 - micromark-extension-mdx-md: 2.0.0 - micromark-extension-mdxjs-esm: 3.0.0 - micromark-util-combine-extensions: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-factory-destination@2.0.1: - dependencies: - micromark-util-character: 2.1.1 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-factory-label@2.0.1: - dependencies: - devlop: 1.1.0 - micromark-util-character: 2.1.1 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-factory-mdx-expression@2.0.3: - dependencies: - '@types/estree': 1.0.9 - devlop: 1.1.0 - micromark-factory-space: 2.0.1 - micromark-util-character: 2.1.1 - micromark-util-events-to-acorn: 2.0.3 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - unist-util-position-from-estree: 2.0.0 - vfile-message: 4.0.3 - - micromark-factory-space@2.0.1: - dependencies: - micromark-util-character: 2.1.1 - micromark-util-types: 2.0.2 - - micromark-factory-title@2.0.1: - dependencies: - micromark-factory-space: 2.0.1 - micromark-util-character: 2.1.1 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-factory-whitespace@2.0.1: - dependencies: - micromark-factory-space: 2.0.1 - micromark-util-character: 2.1.1 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-util-character@2.1.1: - dependencies: - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-util-chunked@2.0.1: - dependencies: - micromark-util-symbol: 2.0.1 - - micromark-util-classify-character@2.0.1: - dependencies: - micromark-util-character: 2.1.1 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-util-combine-extensions@2.0.1: - dependencies: - micromark-util-chunked: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-util-decode-numeric-character-reference@2.0.2: - dependencies: - micromark-util-symbol: 2.0.1 - - micromark-util-decode-string@2.0.1: - dependencies: - decode-named-character-reference: 1.3.0 - micromark-util-character: 2.1.1 - micromark-util-decode-numeric-character-reference: 2.0.2 - micromark-util-symbol: 2.0.1 - - micromark-util-encode@2.0.1: {} - - micromark-util-events-to-acorn@2.0.3: - dependencies: - '@types/estree': 1.0.9 - '@types/unist': 3.0.3 - devlop: 1.1.0 - estree-util-visit: 2.0.0 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - vfile-message: 4.0.3 - - micromark-util-html-tag-name@2.0.1: {} - - micromark-util-normalize-identifier@2.0.1: - dependencies: - micromark-util-symbol: 2.0.1 - - micromark-util-resolve-all@2.0.1: - dependencies: - micromark-util-types: 2.0.2 - - micromark-util-sanitize-uri@2.0.1: - dependencies: - micromark-util-character: 2.1.1 - micromark-util-encode: 2.0.1 - micromark-util-symbol: 2.0.1 - - micromark-util-subtokenize@2.1.0: - dependencies: - devlop: 1.1.0 - micromark-util-chunked: 2.0.1 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - - micromark-util-symbol@2.0.1: {} - - micromark-util-types@2.0.2: {} - - micromark@4.0.2: - dependencies: - '@types/debug': 4.1.13 - debug: 4.4.3 - decode-named-character-reference: 1.3.0 - devlop: 1.1.0 - micromark-core-commonmark: 2.0.3 - micromark-factory-space: 2.0.1 - micromark-util-character: 2.1.1 - micromark-util-chunked: 2.0.1 - micromark-util-combine-extensions: 2.0.1 - micromark-util-decode-numeric-character-reference: 2.0.2 - micromark-util-encode: 2.0.1 - micromark-util-normalize-identifier: 2.0.1 - micromark-util-resolve-all: 2.0.1 - micromark-util-sanitize-uri: 2.0.1 - micromark-util-subtokenize: 2.1.0 - micromark-util-symbol: 2.0.1 - micromark-util-types: 2.0.2 - transitivePeerDependencies: - - supports-color - mime-db@1.52.0: {} mime-types@2.1.35: @@ -3228,16 +2135,6 @@ snapshots: nwsapi@2.2.27: {} - parse-entities@4.0.2: - dependencies: - '@types/unist': 2.0.11 - character-entities-legacy: 3.0.0 - character-reference-invalid: 2.0.1 - decode-named-character-reference: 1.3.0 - is-alphanumerical: 2.0.1 - is-decimal: 2.0.1 - is-hexadecimal: 2.0.1 - parse5@7.3.0: dependencies: entities: 6.0.1 @@ -3248,8 +2145,6 @@ snapshots: picocolors@1.1.1: {} - picomatch@4.0.7: {} - playwright-core@1.63.0: {} playwright@1.63.0: @@ -3268,8 +2163,6 @@ snapshots: ansi-styles: 5.2.0 react-is: 17.0.2 - property-information@7.2.0: {} - punycode@2.3.1: {} react-dom@18.3.1(react@18.3.1): @@ -3280,113 +2173,17 @@ snapshots: react-is@17.0.2: {} - react-markdown@9.1.0(@types/react@18.3.31)(react@18.3.1): - dependencies: - '@types/hast': 3.0.5 - '@types/mdast': 4.0.4 - '@types/react': 18.3.31 - devlop: 1.1.0 - hast-util-to-jsx-runtime: 2.3.6 - html-url-attributes: 3.0.1 - mdast-util-to-hast: 13.2.1 - react: 18.3.1 - remark-parse: 11.0.0 - remark-rehype: 11.1.2 - unified: 11.0.5 - unist-util-visit: 5.1.0 - vfile: 6.0.3 - transitivePeerDependencies: - - supports-color - react-refresh@0.17.0: {} react@18.3.1: dependencies: loose-envify: 1.4.0 - recma-build-jsx@1.0.0: - dependencies: - '@types/estree': 1.0.9 - estree-util-build-jsx: 3.0.1 - vfile: 6.0.3 - - recma-jsx@1.0.1(acorn@8.18.0): - dependencies: - acorn: 8.18.0 - acorn-jsx: 5.3.2(acorn@8.18.0) - estree-util-to-js: 2.0.0 - recma-parse: 1.0.0 - recma-stringify: 1.0.0 - unified: 11.0.5 - - recma-parse@1.0.0: - dependencies: - '@types/estree': 1.0.9 - esast-util-from-js: 2.0.1 - unified: 11.0.5 - vfile: 6.0.3 - - recma-stringify@1.0.0: - dependencies: - '@types/estree': 1.0.9 - estree-util-to-js: 2.0.0 - unified: 11.0.5 - vfile: 6.0.3 - redent@3.0.0: dependencies: indent-string: 4.0.0 strip-indent: 3.0.0 - rehype-recma@1.0.0: - dependencies: - '@types/estree': 1.0.9 - '@types/hast': 3.0.5 - hast-util-to-estree: 3.1.3 - transitivePeerDependencies: - - supports-color - - remark-gfm@4.0.1: - dependencies: - '@types/mdast': 4.0.4 - mdast-util-gfm: 3.1.0 - micromark-extension-gfm: 3.0.0 - remark-parse: 11.0.0 - remark-stringify: 11.0.0 - unified: 11.0.5 - transitivePeerDependencies: - - supports-color - - remark-mdx@3.1.1: - dependencies: - mdast-util-mdx: 3.0.0 - micromark-extension-mdxjs: 3.0.0 - transitivePeerDependencies: - - supports-color - - remark-parse@11.0.0: - dependencies: - '@types/mdast': 4.0.4 - mdast-util-from-markdown: 2.0.3 - micromark-util-types: 2.0.2 - unified: 11.0.5 - transitivePeerDependencies: - - supports-color - - remark-rehype@11.1.2: - dependencies: - '@types/hast': 3.0.5 - '@types/mdast': 4.0.4 - mdast-util-to-hast: 13.2.1 - unified: 11.0.5 - vfile: 6.0.3 - - remark-stringify@11.0.0: - dependencies: - '@types/mdast': 4.0.4 - mdast-util-to-markdown: 2.1.2 - unified: 11.0.5 - rollup@4.63.2: dependencies: '@types/estree': 1.0.9 @@ -3439,31 +2236,14 @@ snapshots: source-map-js@1.2.1: {} - source-map@0.7.6: {} - - space-separated-tokens@2.0.2: {} - stackback@0.0.2: {} std-env@3.10.0: {} - stringify-entities@4.0.4: - dependencies: - character-entities-html4: 2.1.0 - character-entities-legacy: 3.0.0 - strip-indent@3.0.0: dependencies: min-indent: 1.0.1 - style-to-js@1.1.21: - dependencies: - style-to-object: 1.0.14 - - style-to-object@1.0.14: - dependencies: - inline-style-parser: 0.2.7 - symbol-tree@3.2.4: {} tinybench@2.9.0: {} @@ -3490,10 +2270,6 @@ snapshots: dependencies: punycode: 2.3.1 - trim-lines@3.0.1: {} - - trough@2.2.0: {} - tsx@4.23.13: dependencies: esbuild: 0.28.2 @@ -3504,59 +2280,12 @@ snapshots: undici-types@6.21.0: {} - unified@11.0.5: - dependencies: - '@types/unist': 3.0.3 - bail: 2.0.2 - devlop: 1.1.0 - extend: 3.0.2 - is-plain-obj: 4.1.0 - trough: 2.2.0 - vfile: 6.0.3 - - unist-util-is@6.0.1: - dependencies: - '@types/unist': 3.0.3 - - unist-util-position-from-estree@2.0.0: - dependencies: - '@types/unist': 3.0.3 - - unist-util-position@5.0.0: - dependencies: - '@types/unist': 3.0.3 - - unist-util-stringify-position@4.0.0: - dependencies: - '@types/unist': 3.0.3 - - unist-util-visit-parents@6.0.2: - dependencies: - '@types/unist': 3.0.3 - unist-util-is: 6.0.1 - - unist-util-visit@5.1.0: - dependencies: - '@types/unist': 3.0.3 - unist-util-is: 6.0.1 - unist-util-visit-parents: 6.0.2 - update-browserslist-db@1.3.3(browserslist@4.28.9): dependencies: browserslist: 4.28.9 escalade: 3.2.0 picocolors: 1.1.1 - vfile-message@4.0.3: - dependencies: - '@types/unist': 3.0.3 - unist-util-stringify-position: 4.0.0 - - vfile@6.0.3: - dependencies: - '@types/unist': 3.0.3 - vfile-message: 4.0.3 - vite-node@2.1.9(@types/node@22.20.2): dependencies: cac: 6.7.14 @@ -3651,5 +2380,3 @@ snapshots: yallist@3.1.1: {} yaml@2.9.1: {} - - zwitch@2.0.4: {} diff --git a/showcase/tsconfig.json b/showcase/tsconfig.json index 6d4959ac..b31d1f77 100644 --- a/showcase/tsconfig.json +++ b/showcase/tsconfig.json @@ -22,5 +22,5 @@ "@slacksim/*": ["demos/slacksim/src/*"] } }, - "include": ["demos", "engine", "docs", "vite.slacksim.config.ts", "vite.docs.config.ts", "vitest.setup.ts"] + "include": ["demos", "engine", "vite.slacksim.config.ts", "vitest.setup.ts"] } diff --git a/showcase/vite.docs.config.ts b/showcase/vite.docs.config.ts deleted file mode 100644 index 2f18c63d..00000000 --- a/showcase/vite.docs.config.ts +++ /dev/null @@ -1,40 +0,0 @@ -import { defineConfig } from "vite"; -import react from "@vitejs/plugin-react"; -import mdx from "@mdx-js/rollup"; -import remarkGfm from "remark-gfm"; -import { fileURLToPath, URL } from "node:url"; - -// The docs site: MDX guides rendered by a small React app. Media (clips, -// screenshots) is served from docs/public and referenced by name through -// docs/_manifest.json. Guides carry code-anchored claims in sibling .refs.yaml -// sidecars, validated by docs/check.ts (not part of the Vite build). -export default defineConfig({ - root: fileURLToPath(new URL("./docs/app", import.meta.url)), - publicDir: fileURLToPath(new URL("./docs/public", import.meta.url)), - plugins: [ - { - enforce: "pre", - ...mdx({ - remarkPlugins: [remarkGfm], - providerImportSource: "@mdx-js/react", - }), - }, - react(), - ], - build: { - outDir: fileURLToPath(new URL("./out/docs", import.meta.url)), - emptyOutDir: true, - }, - // The brand marks are imported from the repo root's docs/assets/brand, which - // sits outside this package; let the dev server read it. - server: { - port: 5179, - strictPort: true, - fs: { - allow: [ - fileURLToPath(new URL(".", import.meta.url)), - fileURLToPath(new URL("../docs/assets/brand", import.meta.url)), - ], - }, - }, -}); diff --git a/site/.gitignore b/site/.gitignore new file mode 100644 index 00000000..ec07c88d --- /dev/null +++ b/site/.gitignore @@ -0,0 +1,5 @@ +node_modules/ +.next/ +next-env.d.ts +public/_pagefind/ +*.tsbuildinfo diff --git a/site/AGENTS.md b/site/AGENTS.md new file mode 100644 index 00000000..b58362e0 --- /dev/null +++ b/site/AGENTS.md @@ -0,0 +1,88 @@ +# AGENTS.md — working in `site/` + +Directions for an agent extending the OAP docs + landing site. Read +[README.md](./README.md) for what the pieces are; this is how to change them. + +## Orientation + +- This tree is its **own pnpm project**, with its own `package.json` and + `pnpm-lock.yaml`. It joins no workspace. Run `pnpm` commands from **`site/`**. +- The generators the docs content depends on are Go, under `pkg/gen/` in the + repo, driven by `mage` from the **repo root**; they write into + `site/content/docs`. +- Every doc page is one `*.mdx` in `content/docs/`. Its `export const meta` + block (`title`, `section`, `group`, `order`, `description`) drives the + two-level sidebar; the body is MDX with ``, ``, ``, + `` components. + +## The gate — run before you call anything done + +```bash +pnpm check # media/refs resolve + exist; every /docs link + anchor resolves +pnpm typecheck +pnpm test +pnpm build # pnpm check, then next build, then the Pagefind index +``` + +If you touched Go (a generator), also `go build ./...`, `go vet ./pkg/gen/...`, +and `go test ./pkg/gen//` from the repo root. + +## Recipes + +### Add or edit a doc page + +1. Create `content/docs/.mdx` with a `meta` block. Pick `section` + + `group` + `order` so it lands where you want — the nav orders sections and + groups by their lowest child `order`. Existing bands: Guides `10–290` (Get + started, Concepts, Admin console, Operations, Security), Reference + `2010–3320` (the 7 primitives, then CLI, then CRD reference). +2. Cross-link with `[text](/docs/other-slug)`, or + `[text](/docs/other-slug#anchor)` for a specific section — `pnpm check` + enforces that every link resolves. +3. Match the house voice — a lede written as `
    `, + **never** `

    `, then `##` sections, a security + `` where relevant. Ground claims in code; don't invent behavior. The + `

    ` isn't a style choice: MDX wraps multi-line block content (including a + top-level lede) in its own `

    `, so a `

    ` you write for the lede nests + inside that `

    `. A `

    ` inside a `

    ` is invalid HTML — the browser + re-parents it at parse time, the server-rendered markup and the client's DOM + disagree, and React throws hydration error #418, but only in production. + `pnpm check` fails the build if a guide does this. + +### Regenerate the CLI / CRD reference + +Never hand-edit `content/docs/oap-*.mdx` or `crd-*.mdx`. From the repo root: +`mage docs:cli` / `mage docs:crd`. If the CRD schemas are stale, `mage gen:api` +first. Read the diff before committing. + +### Add media + +Capture stills and clips with the `showcase/` engine (see +[`showcase/AGENTS.md`](../showcase/AGENTS.md)), then copy the output into +`site/public/media/`, add an entry to `site/content/_manifest.json`, and +reference it from a page with `` or ``. + +## Rules (non-negotiable) + +- **Real-not-drift.** Prefer captured fixtures and generated reference over + hand-authored approximations. When you must author, say so in the file header + and keep it faithful. +- **A blocking assertion.** New generator logic gets a unit test; `pnpm check` + must pass before a doc page counts as done. + +## Gotchas (learned the hard way) + +- **`go test` runs with cwd = the package dir**, so `mage docs:cli`'s driver + needs an **absolute** output path (the mage target handles it) — a relative + path would write under `cmd/oap/` instead of `site/content/docs`. +- **MDX escaping in generators.** Prose containing `<` or `{` must be entity- + escaped (`mdxutil.EscapeMDX`); usages/flags/paths go in code spans/fences, + which MDX takes literally — never escape those. +- **`pnpm check` covers dead links too.** It validates `/docs/` and + `#anchor` links along with media/refs — no separate scan needed. +- **Search needs a build.** Pagefind indexes `.next/server/app`. On a clean + checkout `pnpm dev` has no search index at all; after any `pnpm build`, + `public/_pagefind` exists on disk and `pnpm dev` serves that index too — it's + just possibly stale, reflecting content as of that build rather than your + latest edits. Run `pnpm build` (or `pnpm start` against one) to get a fresh + index. diff --git a/site/README.md b/site/README.md new file mode 100644 index 00000000..aa55029f --- /dev/null +++ b/site/README.md @@ -0,0 +1,51 @@ +# site — OAP landing page + docs + +A Next.js app that serves the Open Agent Primitives marketing landing page and +product documentation. + +> Working in here as an agent? Read **[AGENTS.md](./AGENTS.md)** first — it has +> the authoring recipes and the validation gate. + +## Commands + +```bash +pnpm dev # dev server → http://localhost:5179 (search needs a build; see below) +pnpm build # pnpm check && next build && pagefind --site .next/server/app --output-path public/_pagefind +pnpm start # serve the production build +pnpm check # validates docs structure: media/refs resolve, refs sidecars are well-formed, + # and every /docs link + anchor resolves +pnpm test # vitest +``` + +Pagefind builds its search index from the built `.next/server/app` output. On a +clean checkout, `pnpm dev` has no index at all — the search box reports +"unavailable" until something has built one. Once any `pnpm build` has run, +`public/_pagefind` exists on disk, and `pnpm dev` serves that index too, like +any other static file; it just won't reflect content changes since that build, +so treat it as possibly stale until you rebuild. + +## Layout + +- `app/` — routes: the `(landing)` group (the marketing page: `Landing.tsx`, + `landing.css`, `OapMark.tsx`, `owasp.ts`) and `docs/` (sidebar layout, one + static route per guide, `docs.css`) +- `components/` — shared client components: `Analytics`, `ThemeToggle`, + `Wordmark`, `NavLink`, `Search` (Pagefind UI), `media` (Clip/Screenshot/ + ScreenshotSeries + lightbox), `Callout`, `Coverage` +- `lib/` — pure and server helpers: `nav`, `guides`, `links`, `manifest`, + `analytics`, `pagefind` +- `content/` — `docs/*.mdx` guide pages (with optional `*.refs.yaml` + anti-hallucination sidecars) and `_manifest.json`, the media asset map. The + `mage docs:cli` / `mage docs:crd` generators write into `content/docs`. +- `public/` — static assets: `media/` (committed stills and clips) and, after a + build, the generated `_pagefind/` search index +- `scripts/` — `check.ts`, the validator behind `pnpm check` + +## Analytics + +The site records page views and page leaves through PostHog's cookieless mode, +via `i.authzed.com`. It sets no cookies, writes no browser storage, and does not +identify visitors. Autocapture, session replay, heatmaps, surveys, feature +flags, conversations, and product tours are off. Nothing is sent unless +`NEXT_PUBLIC_POSTHOG_KEY` is set on a production Vercel deploy. The whole +configuration is [`lib/analytics.ts`](./lib/analytics.ts). diff --git a/site/app/(landing)/Landing.tsx b/site/app/(landing)/Landing.tsx new file mode 100644 index 00000000..1d1b28a9 --- /dev/null +++ b/site/app/(landing)/Landing.tsx @@ -0,0 +1,751 @@ +"use client"; +import { + useCallback, + useRef, + useState, + type KeyboardEvent as ReactKeyboardEvent, + type ReactNode, +} from "react"; +import { Wordmark } from "@/components/Wordmark"; +import { SiteFooter } from "@/components/SiteFooter"; +import { OWASP, coverageSummary } from "./owasp"; + +const REPO = "https://github.com/authzed/openagentprimitives"; + +/* The page's copy follows the repository README: its order, its emphasis and + * its claims. When the README's story changes, change this page to match. */ + +/* ------------------------------------------------------------------ data --- */ + +interface Step { + cmd: string; +} + +const INSTALL: { + id: string; + label: string; + steps: Step[]; + comment: string[]; +}[] = [ + { + id: "desktop", + label: "macOS desktop", + steps: [ + { cmd: "mage desktop:all" }, + { cmd: "open build/desktop/out/oap.app" }, + ], + comment: ["# a local VM with a menubar app. No Kubernetes needed."], + }, + { + id: "kubernetes", + label: "Local Kubernetes", + steps: [ + { cmd: "mage build:oap" }, + { cmd: "kind create cluster --name oap-dev" }, + { cmd: "./bin/oap init --local --pinning-mode=warn --wizard" }, + ], + comment: ["# builds, installs, and walks you through setup."], + }, +]; + +const QUESTIONS = [ + "What can it reach?", + "Who granted that access?", + "What happens when a tool result tells it to do something else?", + "What is exposed if one component is compromised?", +]; + +const COMPARE: [string, string, string][] = [ + [ + "What an agent can reach", + "Whatever its credentials allow", + "Exactly what you granted", + ], + [ + "Who decides an action is allowed", + "The model, in the moment", + "The platform, before the call", + ], + [ + "An injected instruction mid-session", + "Can redirect the agent", + "Cannot widen what it's authorized to do", + ], + [ + "Tool credentials", + "Shared across tools in one sandbox", + "Held only by the tool that uses them", + ], + [ + "Restricting an MCP server", + "Needs a narrow upstream token", + "Declared by you, enforced per call", + ], + [ + "Revoking access", + "Rotate credentials, redeploy", + "One permission graph call", + ], + [ + "The audit log", + "Append-only, enforced by the store", + "Signed, chained, verifiable offline", + ], +]; + +const PRIMITIVES = [ + { + verb: "Define", + title: "Agent definition", + body: "An AgentClass is a reviewable template kept in git. Each AgentSession gets its own pod, budget and memory, and is torn down when the work is done.", + href: "/docs/agent-definition", + }, + { + verb: "Constrain", + title: "Safe tools", + body: "A tool is a declarative contract, checked when it is written and again when it runs. Calls execute in a hardened sandbox, never through a shell.", + href: "/docs/safe-tools", + }, + { + verb: "Broker", + title: "Identity & credentials", + body: "Credentials resolve at the moment of use, and the agent never holds them.", + href: "/docs/identity", + }, + { + verb: "Decide", + title: "Authorization", + body: "One relationship graph answers every action: may this person do this, to this resource, right now. Every path fails closed.", + href: "/docs/authorization", + }, + { + verb: "Carry", + title: "Channels & continuity", + body: "Agents work in Slack, the browser, the CLI and GitHub. Threads last for days, and approvals appear where the conversation already is.", + href: "/docs/channels", + }, + { + verb: "Remember", + title: "Memory & knowledge", + body: "Recall, search and a knowledge graph. Reading memory is an authorization decision, and the transcript is a signed ledger.", + href: "/docs/memory", + }, +]; + +interface Area { + title: string; + points: [string, ReactNode][]; + links: [string, string][]; +} + +const AREAS: Area[] = [ + { + title: "Every action is authorized", + points: [ + [ + "Checked per action.", + "Tool calls, memory, lookups and interactions all go through one permission graph.", + ], + [ + "Operation-level rules.", + "One agent can be read-only for one team and read-write for another.", + ], + [ + "Directory sync.", + "Groups from Slack, GitHub and 1Password keep permissions in step with your organization.", + ], + [ + "Multiplayer sessions.", + "Joining, directing and sensitive tools can each require approval.", + ], + ], + links: [ + ["Authorization", "/docs/authorization"], + ["Identity modes", "/docs/identity-modes"], + ["Multiplayer", "/docs/multiplayer-sessions"], + ], + }, + { + title: "Injected instructions can't widen access", + points: [ + [ + "Plan gating.", + "A person approves the agent's plan, and every later action is checked against it.", + ], + [ + "Slots.", + "A session commits to one resource and cannot drift to another.", + ], + [ + "Approvals the model can't reword.", + "The platform describes the action from the call itself.", + ], + [ + "Tool specs.", + "Make a read-write integration read-only without a read-only token.", + ], + ], + links: [ + ["Plan gating", "/docs/plan-gating"], + ["Tool specs", "/docs/toolspec-validation"], + ], + }, + { + title: "Data reaches only its audience", + points: [ + [ + "Leakage tracking.", + "Data is tagged with its origin and checked against who will receive it.", + ], + [ + "Slot-scoped memory.", + "One customer's context never reaches another customer's session.", + ], + [ + "Secret scrubbing.", + "The model sees an opaque handle in place of the value.", + ], + ], + links: [ + ["Information leakage", "/docs/information-leakage"], + ["Memory authorization", "/docs/memory-authorization"], + ], + }, + { + title: "Least privilege by default", + points: [ + [ + "Opt-in capabilities.", + "No tool or capability is granted until someone adds it.", + ], + [ + "A sandbox per tool.", + "Each tool holds only its own credentials, and the agent holds none.", + ], + [ + "Narrowing delegation.", + "Sub-agents request their own permissions instead of inheriting yours.", + ], + ], + links: [ + ["Sandboxed execution", "/docs/sandboxed-execution"], + ["Sub-agents", "/docs/subagents-delegation"], + ], + }, + { + title: "Control and oversight", + points: [ + [ + "Inherited policy.", + "Cluster, namespace and class defaults that agents can't opt out of.", + ], + [ + "Revocation.", + "Remove one relationship and the next action is refused, with no credential rotation or redeploy.", + ], + [ + "Verifiable audit.", + <> + Signed, hash-chained entries, checked offline with{" "} + oap audit verify. + , + ], + [ + "Pinning and budgets.", + "Approved versions, capped spend and circuit breakers.", + ], + ], + links: [ + ["Audit log", "/docs/audit-log"], + ["Revocation", "/docs/revocation"], + ["Pinning", "/docs/supply-chain-pinning"], + ], + }, + { + title: "Isolation in the platform", + points: [ + [ + "Sanitized output.", + "Each content type has its own sanitizer, and rendered output runs under a strict CSP.", + ], + [ + "Separate pods.", + "Runner, operator and sanitizers run apart, on micro-VMs where available.", + ], + [ + "Scoped credentials.", + "Each component reaches only its own session on the control-plane bus.", + ], + [ + "Reviewable packages.", + "Each agent ships as one OCI package you can gate like any artifact.", + ], + ], + links: [ + ["Artifact safety", "/docs/artifact-safety"], + ["Packaging", "/docs/packaging-oap"], + ], + }, +]; + +const BUILDER = [ + { + step: "Describe", + title: "Say what it's for", + body: "Agent Builder picks the tools, connects accounts, and sets what the new agent may do.", + }, + { + step: "Test", + title: "Try it in a workshop", + body: "Drafts run in isolation and can't touch your live agents.", + }, + { + step: "Deliver", + title: "Hand over a bundle", + body: "You get a portable .oap bundle for an administrator to review and install.", + }, +]; + +const EVERYTHING = [ + { + title: "Your choice of model", + body: "Anthropic, OpenAI or OpenRouter, swappable per deployment.", + }, + { + title: "Your infrastructure", + body: "A laptop, a local cluster, GKE, EKS, AKS or self-managed Kubernetes.", + }, + { + title: "Channels", + body: "Slack, the browser, the CLI and GitHub, plus signed webhooks and scheduled runs. Transports are pluggable, so you can add your own.", + }, + { + title: "Memory and knowledge graph", + body: "Structured recall, ranked search and graph queries.", + }, + { + title: "Built in and swappable", + body: "The runner, authorization, approvals, sandboxing, credentials, memory and audit ship built in, and each can be swapped for one you already run.", + }, + { + title: "Under your control", + body: "OAP runs inside a cluster you operate. Your team owns its network, access and upgrades.", + }, +]; + +const COV_LABEL: Record = { + substantial: "Substantial", + partial: "Partial", + na: "Architectural N/A", +}; + +/* ------------------------------------------------------------ components --- */ + +function CopyButton({ text }: { text: string }) { + const [done, setDone] = useState(false); + const copy = useCallback(() => { + void navigator.clipboard?.writeText(text).then(() => { + setDone(true); + window.setTimeout(() => setDone(false), 1600); + }); + }, [text]); + return ( + + ); +} + +/* A two-tab terminal: Desktop is the README's fastest path, kind the one for + * development. Arrow keys move between tabs, per the ARIA tabs pattern. */ +function InstallTerminal() { + const [active, setActive] = useState(0); + const tabs = useRef<(HTMLButtonElement | null)[]>([]); + const current = INSTALL[active]; + + const onKeyDown = (e: ReactKeyboardEvent) => { + if (e.key !== "ArrowRight" && e.key !== "ArrowLeft") return; + e.preventDefault(); + const next = + (active + (e.key === "ArrowRight" ? 1 : -1) + INSTALL.length) % + INSTALL.length; + setActive(next); + tabs.current[next]?.focus(); + }; + + return ( +

    +
    +
    + {INSTALL.map((t, i) => ( + + ))} +
    + s.cmd).join("\n")} /> +
    + 
    +        {current.steps.map((s) => (
+          
+            $ 
+            {s.cmd}
+            {"\n"}
+          
+        ))}
+        {current.comment.map((line) => (
+          
+            {line}
+            {"\n"}
+          
+        ))}
+
    +
    + ); +} + +function SectionHead({ + kicker, + children, +}: { + kicker: string; + children: ReactNode; +}) { + return ( + <> +

    {kicker}

    +

    {children}

    + + ); +} + +/* ------------------------------------------------------------------ page --- */ + +export function Landing() { + return ( +
    + + + {/* ------------------------------------------------------------ hero --- */} +
    +
    +
    +

    + A secure way to run enterprise AI agents. +

    +

    + Building blocks for running enterprise agents in your own cluster, + on the models you choose.{" "} + + The AI never decides what it’s allowed to do. OAP checks + every action before it runs. + +

    +

    + Trusting an agent means answering four questions: +

    +
      + {QUESTIONS.map((q) => ( +
    1. {q}
      2. + ))} +
    +

    + OAP answers each one in the platform, before the agent acts. +

    + +
    +
    + +
    +
    + + {/* ---------------------------------------------------- 01 problem --- */} +
    + + Your agent can reach everything its credentials can. + +

    + A token for one repository usually reaches every repository. An + agent inherits all of it. +

    +

    + A model can’t reliably tell instructions from data, so its + judgment can’t be the boundary. A better prompt is still just + an instruction. +

    +

    + + So OAP enforces every rule itself, before each action runs, where + no prompt can change it. + +

    + +
    + + + + + + + + + + {COMPARE.map(([q, typical, oap]) => ( + + + + + + ))} + +
    + Question + Typical agent platformOAP
    {q}{typical}{oap}
    +
    +
    + + {/* ------------------------------------------------- 02 primitives --- */} +
    + + Six concerns every agent has to solve. + +

    + A primitive is a basic building block that agents rely on, whatever + they do. OAP ships a working implementation of every one. +

    +
    + {PRIMITIVES.map((p, i) => ( +
    +

    + #{i + 1} {p.verb} +

    +

    + {p.title} +

    +

    {p.body}

    +
    + ))} +
    +
    + + {/* ---------------------------------------------------- 03 secure --- */} +
    + + Controls in six areas. + +

    + The platform enforces every control. No prompt or tool output can + affect enforcement. +

    +
      + {AREAS.map((a) => ( +
    1. +

      {a.title}

      +
        + {a.points.map(([lead, body]) => ( +
      • + {lead} {body} +
        • + ))} +
      +

      + {a.links.map(([label, href]) => ( + + {label} + + ))} +

      +
      2. + ))} +
    +

    + Plan gating and leakage tracking are opt-in per agent class. Network + policy is on by default. +

    +
    + + {/* --------------------------------------------- 04 agent builder --- */} +
    + + Build an agent by talking to an agent. + +

    + Agent Builder is an OAP agent that creates other agents. Describe + what you need in plain language, then test it live. +

    +
    + {BUILDER.map((b) => ( +
    +

    {b.step}

    +

    {b.title}

    +

    {b.body}

    +
    + ))} +
    + +

    + Off by default. You turn it on by naming who may use it, and it + follows every control above. +

    +
    + + {/* -------------------------------------------- 05 everything else --- */} +
    + + The rest of the platform, included. + +

    + The capabilities you’d expect from any agent platform. +

    +
    + {EVERYTHING.map((e) => ( +
    +

    {e.title}

    +

    {e.body}

    +
    + ))} +
    +
    + + {/* ------------------------------------------------------- 06 owasp --- */} +
    + + Coverage of the OWASP{" "} + Agentic Top 10. + +

    + How OAP maps to each risk in the OWASP Top 10 for Agentic + Applications, with the remaining gaps listed alongside. This is a + self-assessment, not a certification. +

    +
    + + + + + + + + + + + + {OWASP.map(([id, title, level, gap]) => ( + + + + + + + ))} + +
    {coverageSummary(OWASP)}
    ItemRiskCoverageKnown gap
    + {id} + {title} + + {COV_LABEL[level]} + + {gap}
    +
    + +
    +

    How we know the gates still hold

    +

    + Every merge runs whole-session scenarios, golden authorization + traces and replays of real sessions. A permission check that stops + working fails the build. +

    +
    +

    + Based on the{" "} + + OWASP Top 10 for Agentic Applications (2026) + {" "} + by the OWASP GenAI Security Project, licensed under{" "} + + CC BY-SA 4.0 + + . This assessment is not affiliated with or endorsed by OWASP. +

    +
    + + {/* ----------------------------------------------------------- close --- */} +
    +

    Defense in depth

    +

    Every layer assumes the others may fail.

    +

    + To misuse an agent, an attacker has to get past an approved plan, a + locked slot, a tool spec, a check on every call, and a sandbox that + never held the credential. +

    + +
    +
    + + +
    + ); +} diff --git a/site/app/(landing)/landing.css b/site/app/(landing)/landing.css new file mode 100644 index 00000000..6b410316 --- /dev/null +++ b/site/app/(landing)/landing.css @@ -0,0 +1,977 @@ +/* OAP landing page. + * + * Palette, type semantics and radius come from the product's own design tokens + * (web/packages/design/src/tokens.css), copied rather than imported because + * site/ is its own package outside the web/ pnpm workspace. The rules those + * tokens carry are honored here, not just their values: + * + * - --lp-state (teal-400) is the ONE hue on the page and means STATE, never + * action. Buttons are ink. Links are stone. If you find yourself reaching + * for teal to make something clickable, use a border instead. + * - Surfaces are pinned on contrast against the surface beneath, not on an + * alpha modifier: on a dark ground alpha moves a color toward the + * background, so `bg/50` lands ~1.06:1 away from it, which is nothing. + * - Monospace is quarantined to small (<=13px) labels, notes and code. It + * never sets body copy, so it reads unambiguously as "system label". + * + * Structure is a ruled frame, not floating cards: the page body sits inside a + * drawn rectangle and every section adds a top rule. Grid rules are produced by + * `gap: 1px` over a border-colored background rather than by per-cell borders, + * so adjacent cells share one hairline. + */ + +:root { + --lp-bg: #0c050f; /* stone-975 — background */ + --lp-card: #1e1424; /* stone-900 — card */ + --lp-surface-2: #2f2136; /* 1.18:1 on --lp-card */ + --lp-surface-3: #372b3e; /* 1.34:1 on --lp-card */ + --lp-line: #3f3644; /* stone-800 — border */ + --lp-line-soft: #2a2231; /* the rule inside a slab, one rung quieter */ + /* Every value below clears WCAG AA (4.5:1) against all three of --lp-bg, + --lp-card and --lp-surface-2, so no token needs a per-surface override. + Worst case is --lp-muted on --lp-surface-2 at 5.11:1; lighten it before + darkening any surface. Ratios: muted 6.82/6.03/5.11, fg 16.35/14.46/12.27, + heading 18.82/16.64/14.12, link 11.66/10.31/8.75, state 8.24/7.29/6.19, + deny 8.12/7.18/6.10, warn 11.43/10.11/8.58. Ink text on the primary button + is 14.86:1. */ + --lp-fg: #e9e7e9; /* stone-050 — foreground */ + --lp-heading: #f8f7f8; /* stone-025 */ + --lp-muted: #9a94a0; /* stone ramp */ + --lp-ink: #dedddf; /* stone-100 — primary, i.e. buttons */ + --lp-ink-fg: #0c050f; + --lp-link: #c7c4ca; /* stone-200 — links are NEUTRAL */ + --lp-state: #72b1ad; /* teal-400 — the one hue; state, never action */ + --lp-state-dim: #4a7d7b; /* teal-600 */ + --lp-deny: #f9808a; /* red-400 — destructive */ + --lp-warn: #ffb370; /* sand-300 — warning */ + + /* The terminal is deliberately NOT themed. It reads as a thing from your + machine rather than a panel on a web page, and a light-on-light install + block loses that. These five are the only colors that do not flip. */ + --lp-term-bg: #090410; + --lp-term-fg: #e9e7e9; + --lp-term-muted: #9a94a0; + --lp-term-accent: #72b1ad; + --lp-term-line: #2a2231; + + --lp-radius: 0.5rem; + --lp-rail: 1180px; + --lp-sans: + -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, + sans-serif; + --lp-mono: + "SFMono-Regular", "Menlo", "Consolas", "Liberation Mono", monospace; + + color-scheme: dark; +} + +/* Light theme. Same token SET, opposite direction: the surface ladder DESCENDS + * from the ground, so a raised panel is darker rather than lighter, and ink + * flips to stone-950. Values track the product's own light block + * (web/packages/design/src/tokens.css, `:root[data-theme="light"]`). + * + * Three hues are one rung darker than that file's: teal-600, red-600 and + * sand-600 clear 4.5:1 on the page ground but land at 3.78-3.81 on + * --lp-surface-2, which this page uses as a hover fill under accent-colored + * text. Hue and saturation are unchanged; only lightness moved, the same + * correction the product file already documents for --muted-foreground. + * Measured on --lp-bg / --lp-card / --lp-surface-2: + * heading 18.43/17.69/15.37, fg 17.34/16.64/14.46, muted 6.16/5.91/5.14, + * link 8.49/8.15/7.08, state 5.42/5.21/4.52, deny 7.02/6.74/5.85, + * warn 5.63/5.40/4.69. Ink text on the primary button is 17.69:1. */ +:root[data-theme="light"] { + --lp-bg: #fcfcfc; /* site light ground */ + --lp-card: #f8f7f8; /* stone-025 */ + --lp-surface-2: #e9e7e9; /* stone-050 */ + --lp-surface-3: #dedddf; /* stone-100 */ + --lp-line: #d2cfd3; /* stone-150 */ + --lp-line-soft: #e6e3e8; /* the rule inside a slab, one rung quieter */ + --lp-fg: #1e1424; /* stone-900 */ + --lp-heading: #170d1c; /* stone-950 */ + --lp-muted: #655d69; /* stone-600 — stone-500 is under AA on card */ + --lp-ink: #170d1c; /* ink button inverts with the ground */ + --lp-ink-fg: #f8f7f8; + --lp-link: #514856; /* stone-700 */ + --lp-state: #42706e; /* teal-600 hue, darkened for AA on --lp-surface-2 */ + --lp-state-dim: #72b1ad; /* teal-400 reads as a border on paper */ + --lp-deny: #9e2e3f; /* red-600 hue, darkened */ + --lp-warn: #8b5a41; /* sand-600 hue, darkened */ + + color-scheme: light; +} + +* { + box-sizing: border-box; +} + +html, +body { + margin: 0; +} + +body:has(.lp) { + background: var(--lp-bg); + color: var(--lp-fg); + font-family: var(--lp-sans); + font-size: 16px; + line-height: 1.6; + -webkit-font-smoothing: antialiased; +} + +/* A grid item defaults to `min-width: auto`, which means it refuses to shrink + below its content's min-content width. Several cells here hold `white-space: + pre` blocks whose min-content width is the longest line, so without this the + track is forced open and the whole page scrolls sideways on a phone. Every + such block already has its own `overflow-x: auto`. */ +.lp-hero > *, +.lp-slab > *, +.lp-prims > * { + min-width: 0; +} + +/* ---------------------------------------------------------------- frame --- */ + +.lp { + width: min(var(--lp-rail), 100%); + margin: 0 auto; + border-left: 1px solid var(--lp-line); + border-right: 1px solid var(--lp-line); + + /* Theme toggle (components/theme-toggle.css styles itself from these). */ + --tt-line: var(--lp-line); + --tt-fg: var(--lp-muted); + --tt-fg-hover: var(--lp-fg); + --tt-fg-active: var(--lp-heading); + --tt-bg-active: var(--lp-surface-2); + --tt-ring: var(--lp-link); + + /* Shared footer (components/site-footer.css). */ + --sf-line: var(--lp-line); + --sf-line-soft: var(--lp-line-soft); + --sf-muted: var(--lp-muted); + --sf-link: var(--lp-link); + --sf-strong: var(--lp-fg); + --sf-pad-x: 40px; +} + +.lp-section { + border-top: 1px solid var(--lp-line); + padding: 76px 40px; +} + +.lp-kicker { + font-family: var(--lp-mono); + font-size: 12px; + line-height: 16px; + letter-spacing: 0.09em; + text-transform: uppercase; + color: var(--lp-state); + margin: 0 0 14px; +} + +/* Display type: large, LIGHT, tightly tracked, near-solid leading. The pairing + of a 300-weight display face with 15px body is the page's whole density + signature — do not bold these. */ +.lp-h2 { + font-size: clamp(30px, 3.4vw, 42px); + font-weight: 300; + line-height: 1.06; + letter-spacing: -0.03em; + color: var(--lp-heading); + margin: 0 0 18px; + max-width: 22ch; + /* Even lines rather than one stranded word on the last. */ + text-wrap: balance; +} + +/* Keeps a phrase whole when balanced wrapping would split it badly. */ +.lp-nowrap { + white-space: nowrap; +} + +.lp-h2 em { + font-style: normal; + color: var(--lp-state); +} + +.lp-lede { + font-size: 18px; + line-height: 1.65; + color: var(--lp-muted); + max-width: 58ch; + margin: 0 0 14px; +} + +.lp-lede strong { + color: var(--lp-fg); + font-weight: 500; +} + +/* A link inside a note's running text is underlined, not colour-only. */ +.lp-note a { + color: var(--lp-fg); + text-decoration: underline; + text-decoration-color: var(--lp-line); + text-underline-offset: 3px; +} + +.lp-note a:hover { + text-decoration-color: currentColor; +} + +.lp-note { + font-family: var(--lp-mono); + font-size: 12.5px; + line-height: 1.6; + color: var(--lp-muted); + max-width: 78ch; + margin: 20px 0 0; + padding-left: 12px; + border-left: 1px solid var(--lp-line); +} + +/* ------------------------------------------------------------------ nav --- */ + +.lp-nav { + display: flex; + align-items: center; + gap: 20px; + padding: 18px 40px; +} + +.lp-nav-brand { + display: flex; + align-items: center; + gap: 10px; + color: var(--lp-heading); + text-decoration: none; + margin-right: auto; +} + +/* The full wordmark: the one place on the page the logo names the project. + Which ink shows is left to components/wordmark.css. */ +.lp-nav-wordmark { + height: 38px; + width: auto; +} + +.lp-nav-links { + display: flex; + align-items: center; + gap: 20px; +} + +/* `:not(.lp-btn)` matters: a bare `.lp-nav-links a` rule outranks `.lp-btn--primary` + on specificity and would repaint the pill's ink-on-light text as a link color. */ +.lp-nav-links a:not(.lp-btn) { + color: var(--lp-link); + text-decoration: none; + font-size: 14px; +} + +.lp-nav-links a:not(.lp-btn):hover { + color: var(--lp-heading); + text-decoration: underline; + text-underline-offset: 3px; +} + +/* --------------------------------------------------------------- buttons --- */ + +.lp-btn { + display: inline-flex; + align-items: center; + gap: 8px; + height: 36px; + padding: 0 16px; + border-radius: 999px; + font-size: 14.5px; + font-weight: 500; + text-decoration: none; + border: 1px solid transparent; + transition: + opacity 0.12s ease-out, + background 0.12s ease-out; + white-space: nowrap; +} + +.lp-btn--primary { + background: var(--lp-ink); + color: var(--lp-ink-fg); +} + +.lp-btn--primary:hover { + opacity: 0.86; +} + +.lp-btn--ghost { + border-color: var(--lp-line); + color: var(--lp-fg); +} + +.lp-btn--ghost:hover { + background: var(--lp-surface-2); +} + +/* ----------------------------------------------------------------- hero --- */ + +/* Two columns above 900px: the claim on the left, something you can run on the + right. The install block is the hero's real proof, so it sits beside the + headline rather than below the fold. */ +.lp-hero { + padding: 84px 40px 76px; + display: grid; + grid-template-columns: 1.08fr 0.92fr; + gap: 52px; + align-items: start; +} + +@media (max-width: 900px) { + .lp-hero { + grid-template-columns: 1fr; + gap: 38px; + } +} + +.lp-hero h1 { + font-size: clamp(40px, 5.4vw, 66px); + font-weight: 300; + line-height: 1.01; + letter-spacing: -0.038em; + color: var(--lp-heading); + margin: 0 0 24px; + text-wrap: balance; +} + +.lp-hero h1 em { + font-style: normal; + color: var(--lp-state); +} + +.lp-hero-sub { + font-size: 18px; + line-height: 1.62; + color: var(--lp-muted); + max-width: 60ch; + margin: 0 0 30px; +} + +.lp-hero-sub strong { + color: var(--lp-fg); + font-weight: 500; +} + +.lp-hero-cta { + display: flex; + flex-wrap: wrap; + gap: 10px; +} + +.lp-hero-aside { + padding-top: 6px; +} + +/* The README's four trust questions, set as a quiet numbered list under the + subhead. They frame the page; the sections below answer them. */ +.lp-hero-qs-head { + font-size: 15px; + color: var(--lp-fg); + margin: 0 0 10px; +} + +.lp-hero-qs { + counter-reset: lp-q; + list-style: none; + margin: 0 0 14px; + padding: 0; + max-width: 60ch; +} + +/* Closes the four questions; the comparison table in the next section answers + them row by row. */ +.lp-hero-qs-foot { + font-size: 15px; + line-height: 1.55; + color: var(--lp-fg); + max-width: 60ch; + margin: 0 0 30px; +} + +.lp-hero-qs li { + counter-increment: lp-q; + display: grid; + grid-template-columns: 28px 1fr; + font-size: 15.5px; + line-height: 1.55; + color: var(--lp-muted); + padding: 7px 0; + border-top: 1px solid var(--lp-line-soft); +} + +.lp-hero-qs li:last-child { + border-bottom: 1px solid var(--lp-line-soft); +} + +.lp-hero-qs li::before { + content: "0" counter(lp-q); + font-family: var(--lp-mono); + font-size: 12px; + color: var(--lp-state); + padding-top: 3px; +} + +/* ------------------------------------------------------------- terminal --- */ + +.lp-term { + border: 1px solid var(--lp-term-line); + border-radius: var(--lp-radius); + background: var(--lp-term-bg); + overflow: hidden; +} + +.lp-term-bar { + display: flex; + align-items: center; + gap: 8px; + padding: 8px 12px; + border-bottom: 1px solid var(--lp-term-line); +} + +.lp-term-tabs { + display: flex; + flex-wrap: wrap; + gap: 4px; + margin-right: auto; +} + +/* The selected tab is a state, so it earns the accent underline; the text + itself stays neutral. */ +.lp-term-tab { + font-family: var(--lp-mono); + font-size: 11.5px; + letter-spacing: 0.02em; + color: var(--lp-term-muted); + background: transparent; + border: 0; + border-bottom: 1px solid transparent; + padding: 3px 6px; + cursor: pointer; +} + +.lp-term-tab:hover { + color: var(--lp-term-fg); +} + +.lp-term-tab[aria-selected="true"] { + color: var(--lp-term-fg); + border-bottom-color: var(--lp-term-accent); +} + +.lp-term-tab:focus-visible { + outline: 1px solid var(--lp-term-muted); + outline-offset: 1px; +} + +.lp-copy-btn { + font-family: var(--lp-mono); + font-size: 11.5px; + letter-spacing: 0.06em; + text-transform: uppercase; + color: var(--lp-term-muted); + background: transparent; + border: 1px solid var(--lp-term-line); + border-radius: 4px; + padding: 2px 8px; + cursor: pointer; +} + +.lp-copy-btn:hover { + color: var(--lp-term-fg); + border-color: var(--lp-term-muted); +} + +.lp-term pre { + margin: 0; + padding: 14px 16px; + font-family: var(--lp-mono); + font-size: 13px; + line-height: 1.85; + color: var(--lp-term-fg); + overflow-x: auto; +} + +/* The prompt glyph must never land in a drag-select of the command. */ +.lp-term .p { + color: var(--lp-term-accent); + user-select: none; +} + +.lp-term .c { + color: var(--lp-term-muted); +} + +/* ---------------------------------------------------------------- slabs --- */ + +/* Cells fused into one slab by a 1px gap over a line-colored ground, so + adjacent cells share a single hairline rather than doubling borders. */ +.lp-slab { + display: grid; + gap: 1px; + background: var(--lp-line); + border: 1px solid var(--lp-line); + border-radius: var(--lp-radius); + overflow: hidden; + margin-top: 34px; +} + +.lp-slab > * { + background: var(--lp-card); + padding: 22px 24px; +} + +.lp-slab--2 { + grid-template-columns: repeat(2, 1fr); +} + +.lp-slab--3 { + grid-template-columns: repeat(3, 1fr); +} + +.lp-slab h3 { + font-size: 18px; + font-weight: 500; + line-height: 1.25; + letter-spacing: -0.012em; + color: var(--lp-heading); + margin: 0 0 10px; + text-wrap: balance; +} + +.lp-slab p:not(.lp-prim-eyebrow) { + font-size: 15.5px; + line-height: 1.6; + color: var(--lp-muted); + margin: 0; +} + +/* ---------------------------------------------------------------- areas --- */ + +.lp-areas { + list-style: none; + padding: 0; +} + +.lp-areas > li { + display: flex; + flex-direction: column; + padding: 26px 28px 24px; +} + +/* The area title has to read as the card's heading, a clear step above the + bold lead-in on each bullet: larger, tighter, and ruled off from the list. */ +.lp-slab .lp-areas-title { + font-size: 22px; + line-height: 1.2; + letter-spacing: -0.02em; + color: var(--lp-heading); + margin: 0 0 18px; + padding-bottom: 16px; + border-bottom: 1px solid var(--lp-line); +} + +.lp-points { + list-style: none; + margin: 0 0 16px; + padding: 0; +} + +.lp-points li { + font-size: 15.5px; + line-height: 1.55; + color: var(--lp-muted); + margin: 0 0 12px; +} + +.lp-points strong { + color: var(--lp-fg); + font-weight: 500; +} + +.lp-points code, +.lp-note code { + font-family: var(--lp-mono); + font-size: 0.9em; + color: var(--lp-fg); +} + +.lp-slab p.lp-area-links { + margin-top: auto; + display: flex; + flex-wrap: wrap; + gap: 6px 16px; + font-family: var(--lp-mono); + font-size: 12px; + letter-spacing: 0.02em; +} + +.lp-area-links a { + color: var(--lp-link); + text-decoration: none; + border-bottom: 1px solid var(--lp-line); +} + +.lp-area-links a:hover { + color: var(--lp-heading); + border-bottom-color: var(--lp-surface-3); +} + +.lp-section-cta { + margin-top: 28px; +} + +/* ---------------------------------------------------------- comparison --- */ + +.lp-compare-wrap { + margin-top: 34px; + overflow-x: auto; + border: 1px solid var(--lp-line); + border-radius: var(--lp-radius); +} + +.lp-compare { + width: 100%; + border-collapse: collapse; + font-size: 15px; + background: var(--lp-card); +} + +.lp-compare th, +.lp-compare td { + text-align: left; + vertical-align: top; + padding: 12px 18px; + border-bottom: 1px solid var(--lp-line-soft); +} + +.lp-compare tbody tr:last-child > * { + border-bottom: 0; +} + +.lp-compare thead th { + font-family: var(--lp-mono); + font-size: 11.5px; + font-weight: 400; + letter-spacing: 0.08em; + text-transform: uppercase; + color: var(--lp-muted); + border-bottom-color: var(--lp-line); +} + +.lp-compare thead th:last-child { + color: var(--lp-state); +} + +.lp-compare tbody th { + font-weight: 500; + color: var(--lp-heading); + width: 34%; +} + +.lp-compare-typical { + color: var(--lp-muted); +} + +.lp-compare-oap { + color: var(--lp-fg); +} + +.lp-sr { + position: absolute; + width: 1px; + height: 1px; + overflow: hidden; + clip: rect(0 0 0 0); + white-space: nowrap; +} + +/* --------------------------------------------------------------- primitives */ + +.lp-prims { + display: grid; + grid-template-columns: repeat(3, 1fr); + gap: 1px; + background: var(--lp-line); + border: 1px solid var(--lp-line); + border-radius: var(--lp-radius); + overflow: hidden; + margin-top: 34px; +} + +.lp-prim { + background: var(--lp-card); + padding: 26px 24px 28px; +} + +.lp-prim-eyebrow { + font-family: var(--lp-mono); + font-size: 12px; + letter-spacing: 0.1em; + text-transform: uppercase; + color: var(--lp-state); + margin: 0 0 12px; +} + +.lp-prim h3 { + font-size: 20px; + font-weight: 500; + line-height: 1.2; + letter-spacing: -0.015em; + color: var(--lp-heading); + margin: 0 0 10px; + text-wrap: balance; +} + +/* Links are neutral and carry a rule on hover, never the accent: teal means + state on this page, and spending it on an affordance collapses that meaning. */ +.lp-prim h3 a { + color: inherit; + text-decoration: none; +} + +.lp-prim h3 a:hover { + text-decoration: underline; + text-underline-offset: 4px; + text-decoration-color: var(--lp-line); +} + +.lp-prim p:not(.lp-prim-eyebrow) { + font-size: 16px; + line-height: 1.6; + color: var(--lp-muted); + margin: 0 0 14px; +} + +/* ------------------------------------------------------------ evidence --- */ + +.lp-col-head { + font-family: var(--lp-mono); + font-size: 12px; + letter-spacing: 0.09em; + text-transform: uppercase; + color: var(--lp-state); + margin: 0 0 12px; +} + +.lp-evidence { + margin-top: 34px; + padding: 22px 24px; + background: var(--lp-card); + border: 1px solid var(--lp-line); + border-radius: var(--lp-radius); +} + +.lp-evidence p:last-child { + font-size: 15px; + line-height: 1.65; + color: var(--lp-muted); + max-width: 88ch; + margin: 0; +} + +/* ---------------------------------------------------------------- owasp --- */ + +.lp-owasp-wrap { + margin-top: 34px; + overflow-x: auto; +} + +.lp-owasp { + width: 100%; + border-collapse: collapse; + font-size: 14.5px; +} + +.lp-owasp caption { + caption-side: top; + text-align: left; + font-family: var(--lp-mono); + font-size: 11.5px; + letter-spacing: 0.08em; + text-transform: uppercase; + color: var(--lp-muted); + padding-bottom: 12px; +} + +.lp-owasp th, +.lp-owasp td { + text-align: left; + padding: 11px 14px 11px 0; + border-bottom: 1px solid var(--lp-line-soft); + vertical-align: top; +} + +.lp-owasp thead th { + font-family: var(--lp-mono); + font-size: 11.5px; + font-weight: 400; + letter-spacing: 0.08em; + text-transform: uppercase; + color: var(--lp-muted); + border-bottom-color: var(--lp-line); +} + +.lp-owasp td.lp-id { + font-family: var(--lp-mono); + font-size: 12.5px; + white-space: nowrap; + width: 1%; +} + +/* The ids deep-link into the guide's own per-item anchors, resolved at + `/docs/#`. */ +.lp-owasp td.lp-id a { + color: var(--lp-muted); + text-decoration: none; + border-bottom: 1px solid var(--lp-line); +} + +.lp-owasp td.lp-id a:hover { + color: var(--lp-heading); + border-bottom-color: var(--lp-surface-3); +} + +/* Inline code in marketing prose: a quiet label, not a code block. */ +.lp-lede code { + font-family: var(--lp-mono); + font-size: 0.88em; + color: var(--lp-fg); + background: var(--lp-surface-2); + border-radius: 3px; + padding: 1px 5px; +} + +.lp-owasp td.lp-title { + color: var(--lp-heading); +} + +.lp-owasp td.lp-gap { + color: var(--lp-muted); + font-size: 14px; +} + +.lp-cov { + display: inline-block; + font-family: var(--lp-mono); + font-size: 11.5px; + letter-spacing: 0.04em; + text-transform: uppercase; + padding: 2px 9px; + border-radius: 999px; + border: 1px solid; + white-space: nowrap; +} + +.lp-cov--substantial { + color: var(--lp-state); + border-color: var(--lp-state-dim); +} + +.lp-cov--partial { + color: var(--lp-warn); + border-color: color-mix(in srgb, var(--lp-warn) 45%, transparent); +} + +.lp-cov--na { + color: var(--lp-muted); + border-color: var(--lp-line); +} + +/* --------------------------------------------------------------- closing --- */ + +.lp-close { + text-align: center; + padding: 92px 40px 96px; +} + +.lp-close .lp-h2 { + margin-left: auto; + margin-right: auto; + max-width: 26ch; +} + +.lp-close .lp-lede { + margin-left: auto; + margin-right: auto; +} + +.lp-close .lp-hero-cta { + justify-content: center; + margin: 28px 0 0; +} + +/* ------------------------------------------------------------ responsive --- */ + +@media (max-width: 1000px) { + .lp-prims, + .lp-slab--3 { + grid-template-columns: repeat(2, 1fr); + } +} + +@media (max-width: 720px) { + .lp-section, + .lp-hero, + .lp-close, + .lp { + --sf-pad-x: 16px; + } + .lp-areas > li { + padding: 22px 20px 20px; + } + .lp-nav { + padding-left: 16px; + padding-right: 16px; + } + .lp-section { + padding-top: 52px; + padding-bottom: 52px; + } + .lp-prims, + .lp-slab--2, + .lp-slab--3 { + grid-template-columns: 1fr; + } + /* Phones keep only Docs beside the button; the rest are on the page. */ + .lp-nav-links a:not(.lp-btn):not(.lp-nav-keep) { + display: none; + } + .lp-nav-links { + gap: 12px; + } + .lp-nav-wordmark { + height: 29px; + } + .lp-nav .lp-btn { + padding-left: 14px; + padding-right: 14px; + } + .lp-owasp td.lp-gap, + .lp-owasp thead th:last-child { + display: none; + } + .lp-owasp caption { + white-space: normal; + line-height: 1.6; + } + .lp-compare th, + .lp-compare td { + padding: 10px 12px; + font-size: 14px; + } +} + +@media (prefers-reduced-motion: reduce) { + * { + transition: none !important; + animation: none !important; + } +} diff --git a/site/app/(landing)/owasp.test.ts b/site/app/(landing)/owasp.test.ts new file mode 100644 index 00000000..f162b7ad --- /dev/null +++ b/site/app/(landing)/owasp.test.ts @@ -0,0 +1,61 @@ +import { readFileSync } from "node:fs"; +import { fileURLToPath } from "node:url"; +import { describe, expect, it } from "vitest"; +import { anchorIds } from "@/lib/links"; +import { OWASP, coverageSummary } from "./owasp"; + +// The landing table builds each row's link as /docs/owasp-top10#, which +// the static link check cannot follow. Pin it here instead. +describe("landing OWASP links", () => { + const ids = anchorIds( + readFileSync( + fileURLToPath( + new URL("../../content/docs/owasp-top10.mdx", import.meta.url), + ), + "utf8", + ), + ); + it.each(OWASP.map(([id]) => id))("%s has an anchor in owasp-top10", (id) => { + expect(ids.has(id.toLowerCase())).toBe(true); + }); +}); + +describe("coverageSummary", () => { + it("counts the landing table's rows", () => { + const counts = { substantial: 0, partial: 0, na: 0 }; + for (const [, , level] of OWASP) counts[level]++; + expect(coverageSummary(OWASP)).toBe( + [ + counts.substantial && `${counts.substantial} substantial`, + counts.partial && `${counts.partial} partial`, + counts.na && `${counts.na} architectural N/A`, + ] + .filter(Boolean) + .join(" · "), + ); + }); + + it.each([ + [ + "every level present, in fixed order", + [ + ["A", "a", "partial", ""], + ["B", "b", "na", ""], + ["C", "c", "substantial", ""], + ["D", "d", "partial", ""], + ], + "1 substantial · 2 partial · 1 architectural N/A", + ], + [ + "a level with no rows is left out", + [ + ["A", "a", "substantial", ""], + ["B", "b", "partial", ""], + ], + "1 substantial · 1 partial", + ], + ["no rows at all yields an empty caption", [], ""], + ] as const)("%s", (_name, rows, want) => + expect(coverageSummary(rows)).toBe(want), + ); +}); diff --git a/site/app/(landing)/owasp.ts b/site/app/(landing)/owasp.ts new file mode 100644 index 00000000..219a05e5 --- /dev/null +++ b/site/app/(landing)/owasp.ts @@ -0,0 +1,91 @@ +// The landing page's OWASP Agentic Top 10 coverage table. Each row's id +// (lowercased) must match an `id="…"` anchor in content/docs/owasp-top10.mdx; +// see owasp.test.ts, which pins this against a templated href the static +// link check (scripts/check.ts) cannot follow. +export type CoverageLevel = "substantial" | "partial" | "na"; + +export const OWASP: readonly (readonly [ + id: string, + title: string, + level: CoverageLevel, + gap: string, +])[] = [ + [ + "ASI01", + "Agent Goal Hijack", + "partial", + "No goal-lock or plan-divergence detection.", + ], + [ + "ASI02", + "Tool Misuse and Exploitation", + "substantial", + "Egress enforcement is L3/L4; volume budgets are per-call and opt-in.", + ], + [ + "ASI03", + "Identity and Privilege Abuse", + "substantial", + "Sidecar credentials freeze at pod-create; revocation delivery is at-most-once.", + ], + [ + "ASI04", + "Agentic Supply Chain", + "partial", + "A hash pins content, not origin. No descriptor signing, no SBOM or AIBOM.", + ], + [ + "ASI05", + "Unexpected Code Execution", + "substantial", + "Isolation is per session: tool calls within one session share a UID, /proc, /tmp and /work.", + ], + [ + "ASI06", + "Memory and Context Poisoning", + "partial", + "No content validation on writes; no quarantine, decay or rollback.", + ], + [ + "ASI07", + "Insecure Inter-Agent Communication", + "partial", + "Delegation stays within one cluster; there is no protocol for agents outside it.", + ], + [ + "ASI08", + "Cascading Failures", + "partial", + "Breakers are per tool and per origin rather than cross-cutting.", + ], + [ + "ASI09", + "Human-Agent Trust Exploitation", + "substantial", + "No plan-divergence cross-check; no confidence-weighted cues in the UI.", + ], + [ + "ASI10", + "Rogue Agents", + "partial", + "The tool manifest is enforced but unsigned; tamper-evidence is not tamper-proofing.", + ], +]; + +const SUMMARY_LABEL: Record = { + substantial: "substantial", + partial: "partial", + na: "architectural N/A", +}; + +/** The table caption, counted from the rows so it cannot drift from them. */ +export function coverageSummary( + rows: readonly (readonly [string, string, CoverageLevel, string])[], +): string { + const order: CoverageLevel[] = ["substantial", "partial", "na"]; + return order + .map((level) => [level, rows.filter((r) => r[2] === level).length] as const) + .filter(([, n]) => n > 0) + .map(([level, n]) => `${n} ${SUMMARY_LABEL[level]}`) + .join(" · "); +} diff --git a/site/app/(landing)/page.tsx b/site/app/(landing)/page.tsx new file mode 100644 index 00000000..d2522d73 --- /dev/null +++ b/site/app/(landing)/page.tsx @@ -0,0 +1,25 @@ +import type { Metadata } from "next"; +import { OG_IMAGE, SITE_DESCRIPTION, SITE_NAME } from "@/lib/site"; +import { Landing } from "./Landing"; +import "./landing.css"; + +export const metadata: Metadata = { + title: { + absolute: "Open Agent Primitives: a secure way to run enterprise AI agents", + }, + description: SITE_DESCRIPTION, + alternates: { canonical: "/" }, + openGraph: { + title: SITE_NAME, + description: SITE_DESCRIPTION, + url: "/", + siteName: SITE_NAME, + type: "website", + images: [OG_IMAGE], + }, + twitter: { card: "summary_large_image", images: [OG_IMAGE.url] }, +}; + +export default function Page() { + return ; +} diff --git a/site/app/apple-icon.png b/site/app/apple-icon.png new file mode 100644 index 00000000..dc182034 Binary files /dev/null and b/site/app/apple-icon.png differ diff --git a/site/app/docs/[slug]/page.tsx b/site/app/docs/[slug]/page.tsx new file mode 100644 index 00000000..ad7ecf89 --- /dev/null +++ b/site/app/docs/[slug]/page.tsx @@ -0,0 +1,42 @@ +import type { Metadata } from "next"; +import { guideSlugs, loadGuide } from "@/lib/guides"; +import { OG_IMAGE, SITE_NAME } from "@/lib/site"; + +// Every guide is prerendered; any other slug is a real 404, not a silent +// fallback to the first guide. +export const dynamicParams = false; + +export async function generateStaticParams() { + return (await guideSlugs()).map((slug) => ({ slug })); +} + +type Props = { params: Promise<{ slug: string }> }; + +export async function generateMetadata({ params }: Props): Promise { + const { slug } = await params; + const { guide } = await loadGuide(slug); + const url = `/docs/${slug}`; + return { + title: guide.title, + description: guide.description, + alternates: { canonical: url }, + openGraph: { + title: `${guide.title} · OAP docs`, + description: guide.description, + url, + siteName: SITE_NAME, + type: "article", + images: [OG_IMAGE], + }, + twitter: { card: "summary_large_image", images: [OG_IMAGE.url] }, + }; +} + +export default async function GuidePage({ params }: Props) { + const { Component, guide } = await loadGuide((await params).slug); + return ( +
    + +
    + ); +} diff --git a/site/app/docs/docs.css b/site/app/docs/docs.css new file mode 100644 index 00000000..a12e7721 --- /dev/null +++ b/site/app/docs/docs.css @@ -0,0 +1,608 @@ +/* OAP docs chrome — a clean dark "blueprint" theme, deliberately distinct from + * the Slack look inside the embedded media. */ +:root { + --doc-bg: #0e1116; + --doc-panel: #12161d; + --doc-nav: #0b0e13; + --doc-border: #232b36; + --doc-text: #d7dde5; + --doc-muted: #8b95a3; + --doc-heading: #f2f5f9; + --doc-accent: #6ea8fe; + --doc-accent-soft: rgba(110, 168, 254, 0.14); + --doc-code-bg: #171c24; + --doc-code-border: #262f3b; + /* Status hues, named so the light block can restate them. Coverage badges + tint their own fill and border from these; callouts use them as a 3px + left stroke. */ + --doc-ok: #4bbf87; + --doc-ok-text: #7ee2b8; + --doc-warn: #e0b341; + --doc-warn-text: #e6c25a; + --doc-bad: #e0607e; + --doc-bad-text: #e88497; + --doc-na: #8b95a3; + --doc-shadow: rgba(0, 0, 0, 0.4); + --doc-max: 760px; + --doc-font: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif; + --doc-mono: 'SFMono-Regular', 'Menlo', 'Consolas', monospace; + + color-scheme: dark; +} + +/* Light theme. Same token SET; the blueprint blue darkens to clear AA on paper + * (#6ea8fe is 2.35:1 on white). Measured on --doc-bg / --doc-nav / --doc-panel: + * text 14.64/14.06/13.58, muted 6.62/6.35/6.14, heading 18.43/17.69/17.09, + * accent 6.22/5.97/5.77, and the three status hues 4.96 or better. + * The lightbox scrim stays dark in both themes: it is an overlay over the + * viewport, not a surface, and its caption and close button are sized for it. */ +:root[data-theme='light'] { + --doc-bg: #fcfcfc; + --doc-panel: #f4f3f5; + --doc-nav: #f8f7f8; + --doc-border: #d8d5db; + --doc-text: #2b2430; + --doc-muted: #605868; + --doc-heading: #170d1c; + --doc-accent: #2a5db0; + --doc-accent-soft: rgba(42, 93, 176, 0.12); + --doc-code-bg: #f4f3f5; + --doc-code-border: #e0dde2; + --doc-ok: #1f6b4a; + --doc-ok-text: #1f6b4a; + --doc-warn: #8a6200; + --doc-warn-text: #8a6200; + --doc-bad: #b03050; + --doc-bad-text: #b03050; + --doc-na: #605868; + --doc-shadow: rgba(23, 13, 28, 0.14); + + color-scheme: light; +} + +* { + box-sizing: border-box; +} +html, +body { + margin: 0; +} +body:has(.doc-app) { + background: var(--doc-bg); + color: var(--doc-text); + font-family: var(--doc-font); + font-size: 16px; + line-height: 1.65; + -webkit-font-smoothing: antialiased; +} + +.doc-app { + display: flex; + min-height: 100vh; + /* Theme toggle (components/theme-toggle.css styles itself from these). */ + --tt-line: var(--doc-border); + --tt-fg: var(--doc-muted); + --tt-fg-hover: var(--doc-text); + --tt-fg-active: var(--doc-heading); + --tt-bg-active: var(--doc-panel); + --tt-ring: var(--doc-accent); + /* Shared footer (components/site-footer.css). */ + --sf-line: var(--doc-border); + --sf-line-soft: var(--doc-border); + --sf-muted: var(--doc-muted); + --sf-link: var(--doc-text); + --sf-strong: var(--doc-heading); + --sf-pad-x: 0px; +} + +/* Sidebar nav */ +.doc-nav { + width: 264px; + flex-shrink: 0; + background: var(--doc-nav); + border-right: 1px solid var(--doc-border); + padding: 22px 16px; + position: sticky; + top: 0; + height: 100vh; + overflow-y: auto; +} +.doc-brand-row { + margin-bottom: 24px; +} +.doc-brand { + display: block; + text-decoration: none; +} +.doc-brand-wordmark { + display: block; + width: 168px; + height: auto; +} +.doc-brand-meta { + display: flex; + align-items: center; + justify-content: space-between; + gap: 10px; + margin-top: 6px; +} +.doc-brand-sub { + color: var(--doc-muted); + font-weight: 500; + font-size: 13px; + letter-spacing: 0.04em; + text-transform: uppercase; +} +.doc-brand:hover + .doc-brand-meta .doc-brand-sub { + color: var(--doc-accent); +} +.doc-search { margin-bottom: 20px; } +/* Visually hidden, still read aloud: the search's status line. */ +.doc-sr { + position: absolute; + width: 1px; + height: 1px; + overflow: hidden; + clip: rect(0 0 0 0); + white-space: nowrap; +} +.doc-search-input { + width: 100%; + padding: 7px 10px; + border: 1px solid var(--doc-border); + border-radius: 6px; + background: var(--doc-bg); + color: var(--doc-text); + font: inherit; + font-size: 14px; +} +.doc-search-field { position: relative; } +.doc-search-field .doc-search-input { padding-right: 56px; } +.doc-search-kbd { + position: absolute; + right: 8px; + top: 50%; + transform: translateY(-50%); + padding: 1px 6px; + border: 1px solid var(--doc-border); + border-radius: 4px; + color: var(--doc-muted); + font-family: var(--doc-font); + font-size: 11.5px; + line-height: 1.5; + pointer-events: none; +} +/* The hint is for finding the box; once you're in it, it's noise. */ +.doc-search-field:focus-within .doc-search-kbd { display: none; } +.doc-search-input:focus-visible { outline: 2px solid var(--doc-accent); outline-offset: 1px; } +.doc-search-note { color: var(--doc-muted); font-size: 13px; margin: 8px 2px 0; } +.doc-search-results { list-style: none; margin: 8px 0 0; padding: 0; font-size: 13.5px; } +.doc-search-results li { padding: 6px 4px; border-bottom: 1px solid var(--doc-border); } +.doc-search-results p { margin: 2px 0 0; color: var(--doc-muted); } +.doc-search-results mark { background: var(--doc-accent-soft); color: inherit; } + +.doc-nav-section { + margin-bottom: 8px; +} +.doc-nav-section-title { + font-size: 12px; + text-transform: uppercase; + letter-spacing: 0.06em; + color: var(--doc-muted); + margin: 18px 8px 6px; + font-weight: 700; +} +.doc-nav-group-title { + font-size: 13px; + color: var(--doc-text); + margin: 10px 8px 4px; + padding-left: 6px; + font-weight: 700; +} +.doc-nav-group { + margin-left: 6px; + border-left: 1px solid var(--doc-border); + padding-left: 4px; +} +.doc-nav ul { + list-style: none; + margin: 0; + padding: 0; +} +.doc-nav-link { + display: block; + width: 100%; + text-align: left; + background: transparent; + border: none; + color: var(--doc-text); + padding: 6px 8px; + border-radius: 6px; + font-size: 14.5px; + cursor: pointer; + text-decoration: none; + box-sizing: border-box; +} +.doc-nav-link:hover { + background: var(--doc-panel); +} +.doc-nav-link.is-active { + background: var(--doc-accent-soft); + color: var(--doc-accent); + font-weight: 600; +} + +/* Article */ +.doc-main { + flex: 1; + min-width: 0; + display: flex; + flex-direction: column; + align-items: center; + padding: 56px 40px 0; +} +/* The shared site footer, under the article at the same measure. */ +.doc-footer { + width: 100%; + max-width: var(--doc-max); + margin-top: 120px; +} +.doc-article { + width: 100%; + max-width: var(--doc-max); +} +.doc-article h1 { + font-size: 34px; + line-height: 1.2; + color: var(--doc-heading); + margin: 0 0 8px; + letter-spacing: -0.01em; +} +.doc-article h2 { + font-size: 24px; + color: var(--doc-heading); + margin: 44px 0 12px; + padding-top: 12px; + border-top: 1px solid var(--doc-border); + letter-spacing: -0.01em; +} +.doc-article h3 { + font-size: 18px; + color: var(--doc-heading); + margin: 28px 0 8px; +} +.doc-article p { + margin: 14px 0; +} +.doc-article a { + color: var(--doc-accent); + /* Underlined, not colour alone: the accent is only ~2.4:1 against body + text, under the 3:1 a colour-only link needs (WCAG 1.4.1). */ + text-decoration: underline; + text-decoration-color: color-mix(in srgb, currentColor 45%, transparent); + text-underline-offset: 3px; +} +.doc-article a:hover { + text-decoration-color: currentColor; +} +.doc-article ul, +.doc-article ol { + padding-left: 24px; +} +.doc-article li { + margin: 6px 0; +} +.doc-article strong { + color: var(--doc-heading); +} +.doc-article code { + font-family: var(--doc-mono); + font-size: 13.5px; + background: var(--doc-code-bg); + border: 1px solid var(--doc-code-border); + border-radius: 4px; + padding: 1px 5px; +} +.doc-article pre { + background: var(--doc-code-bg); + border: 1px solid var(--doc-code-border); + border-radius: 8px; + padding: 14px 16px; + overflow-x: auto; +} +.doc-article pre code { + border: none; + background: none; + padding: 0; +} +.doc-article blockquote { + margin: 16px 0; + padding: 2px 16px; + border-left: 3px solid var(--doc-accent); + color: var(--doc-muted); +} +.doc-lede { + font-size: 19px; + color: var(--doc-muted); + line-height: 1.6; +} + +/* Media */ +.doc-clip { + margin: 28px 0; +} +.doc-clip-video { + width: 100%; + border-radius: 12px; + border: 1px solid var(--doc-border); + box-shadow: 0 12px 40px var(--doc-shadow); + display: block; + background: #000; +} +.doc-clip figcaption, +.doc-shot figcaption, +.doc-series-item figcaption { + margin-top: 8px; + font-size: 13.5px; + color: var(--doc-muted); + text-align: center; +} +.doc-shot { + margin: 24px 0; +} +.doc-shot img { + width: 100%; + border-radius: 10px; + border: 1px solid var(--doc-border); + cursor: zoom-in; +} +.doc-series { + display: grid; + grid-template-columns: 1fr 1fr; + gap: 16px; + margin: 24px 0; +} +.doc-series-item img { + width: 100%; + border-radius: 8px; + border: 1px solid var(--doc-border); + cursor: zoom-in; +} +/* Lightbox: full-screen enlarge of a screenshot */ +.doc-lightbox { + position: fixed; + inset: 0; + z-index: 1000; + display: flex; + align-items: center; + justify-content: center; + padding: 4vmin; + background: rgba(0, 0, 0, 0.82); + cursor: zoom-out; + animation: doc-lightbox-in 120ms ease-out; +} +@keyframes doc-lightbox-in { + from { + opacity: 0; + } +} +.doc-lightbox-inner { + margin: 0; + max-width: 96vw; + max-height: 92vh; + display: flex; + flex-direction: column; + align-items: center; + cursor: default; +} +.doc-lightbox-inner img { + max-width: 96vw; + max-height: 84vh; + object-fit: contain; + border-radius: 10px; + border: 1px solid var(--doc-border); + box-shadow: 0 24px 80px rgba(0, 0, 0, 0.6); +} +.doc-lightbox-inner figcaption { + margin-top: 12px; + font-size: 14px; + color: #e6e8eb; + text-align: center; + max-width: 70ch; +} +.doc-lightbox-close { + position: fixed; + top: 16px; + right: 20px; + width: 40px; + height: 40px; + border: 0; + border-radius: 8px; + background: rgba(255, 255, 255, 0.1); + color: #fff; + font-size: 26px; + line-height: 1; + cursor: pointer; +} +.doc-lightbox-close:hover { + background: rgba(255, 255, 255, 0.2); +} +.doc-media-missing { + padding: 24px; + border: 1px dashed var(--doc-border); + border-radius: 8px; + color: var(--doc-muted); + text-align: center; + font-family: var(--doc-mono); + font-size: 13px; +} + +/* Coverage badges (OWASP page) */ +.doc-cov { + display: inline-block; + font-size: 12px; + font-weight: 700; + padding: 2px 9px; + border-radius: 999px; + vertical-align: middle; + margin-left: 8px; + border: 1px solid transparent; +} +.doc-cov--substantial { + color: var(--doc-ok-text); + background: color-mix(in srgb, var(--doc-ok) 14%, transparent); + border-color: color-mix(in srgb, var(--doc-ok) 40%, transparent); +} +.doc-cov--partial { + color: var(--doc-warn-text); + background: color-mix(in srgb, var(--doc-warn) 14%, transparent); + border-color: color-mix(in srgb, var(--doc-warn) 40%, transparent); +} +.doc-cov--minimal { + color: var(--doc-bad-text); + background: color-mix(in srgb, var(--doc-bad) 14%, transparent); + border-color: color-mix(in srgb, var(--doc-bad) 40%, transparent); +} +.doc-cov--na { + color: var(--doc-muted); + background: color-mix(in srgb, var(--doc-na) 14%, transparent); + border-color: color-mix(in srgb, var(--doc-na) 35%, transparent); +} + +/* Callouts */ +.doc-callout { + margin: 20px 0; + padding: 14px 16px; + border-radius: 10px; + border: 1px solid var(--doc-border); + background: var(--doc-panel); + border-left: 3px solid var(--doc-accent); +} +.doc-callout--warning { + border-left-color: var(--doc-warn); +} +.doc-callout--security { + border-left-color: var(--doc-bad); +} +.doc-callout--tip { + border-left-color: var(--doc-ok); +} +.doc-callout-head { + display: flex; + align-items: center; + gap: 8px; + font-weight: 700; + color: var(--doc-heading); + margin-bottom: 4px; +} +.doc-callout-body p:first-child { + margin-top: 0; +} +.doc-callout-body p:last-child { + margin-bottom: 0; +} + +/* The Menu button only exists for the narrow layout below. */ +.doc-nav-toggle { + display: none; +} + +/* Under 900px the sidebar becomes a sticky top bar (brand, search, Menu), and + the guide list opens as an overlay filling the viewport beneath it. Search + results drop down over the page rather than growing the bar. */ +@media (max-width: 900px) { + .doc-app { + flex-direction: column; + } + .doc-nav { + --doc-bar-h: 56px; + width: 100%; + height: var(--doc-bar-h); + padding: 0 16px; + border-right: 0; + border-bottom: 1px solid var(--doc-border); + overflow: visible; + z-index: 20; + } + .doc-nav-bar { + height: 100%; + display: flex; + align-items: center; + gap: 12px; + } + .doc-brand-row { + margin: 0; + flex-shrink: 0; + } + .doc-brand-wordmark { + width: 118px; + } + .doc-brand-meta { + display: none; + } + /* Static, so the results below anchor to the whole bar rather than to + this narrow field. */ + .doc-search { + position: static; + flex: 1; + min-width: 0; + margin: 0; + } + /* Phones have no keyboard shortcut to hint at, and the field needs the room. */ + .doc-search-kbd { + display: none; + } + .doc-search-field .doc-search-input { + padding-right: 10px; + } + .doc-search-results, + .doc-search > .doc-search-note { + position: absolute; + top: calc(100% + 6px); + left: 12px; + right: 12px; + margin: 0; + max-height: 70vh; + overflow-y: auto; + padding: 6px 10px; + background: var(--doc-nav); + border: 1px solid var(--doc-border); + border-radius: 6px; + box-shadow: 0 8px 24px var(--doc-shadow); + } + .doc-nav-toggle { + display: inline-flex; + align-items: center; + flex-shrink: 0; + padding: 6px 12px; + border: 1px solid var(--doc-border); + border-radius: 6px; + background: var(--doc-bg); + color: var(--doc-text); + font: inherit; + font-size: 14px; + cursor: pointer; + } + .doc-nav-toggle:focus-visible { + outline: 2px solid var(--doc-accent); + outline-offset: 1px; + } + .doc-nav-list { + display: none; + } + .doc-nav[data-open="true"] .doc-nav-list { + display: block; + position: absolute; + top: 100%; + left: 0; + right: 0; + height: calc(100dvh - var(--doc-bar-h)); + overflow-y: auto; + padding: 8px 16px 32px; + background: var(--doc-nav); + border-top: 1px solid var(--doc-border); + } + .doc-series { + grid-template-columns: 1fr; + } +} diff --git a/site/app/docs/layout.tsx b/site/app/docs/layout.tsx new file mode 100644 index 00000000..4bbf39db --- /dev/null +++ b/site/app/docs/layout.tsx @@ -0,0 +1,72 @@ +import type { ReactNode } from "react"; +import { allGuides } from "@/lib/guides"; +import { buildNav } from "@/lib/nav"; +import { DocNav } from "@/components/DocNav"; +import { NavLink } from "@/components/NavLink"; +import { Search } from "@/components/Search"; +import { SiteFooter } from "@/components/SiteFooter"; +import { Wordmark } from "@/components/Wordmark"; +import "./docs.css"; + +export default async function DocsLayout({ + children, +}: { + children: ReactNode; +}) { + const nav = buildNav(await allGuides()); + return ( +
    + + + + + } + > + {nav.map(({ section, blocks }) => ( +
    +
    {section}
    + {blocks.map((block, i) => ( +
    + {block.group && ( +
    {block.group}
    + )} +
      + {block.guides.map((g) => ( +
    • + +
      • + ))} +
    +
    + ))} +
    + ))} +     +
    +
    + {children} +
    +
    + +
    +
    +
    + ); +} diff --git a/site/app/docs/page.tsx b/site/app/docs/page.tsx new file mode 100644 index 00000000..662aac6b --- /dev/null +++ b/site/app/docs/page.tsx @@ -0,0 +1,9 @@ +import { permanentRedirect } from "next/navigation"; +import { allGuides } from "@/lib/guides"; + +// /docs has no page of its own: it opens the lowest-order guide, as the old +// hash router did for an empty hash. +export default async function DocsIndex() { + const [first] = await allGuides(); + permanentRedirect(`/docs/${first.slug}`); +} diff --git a/site/app/favicon.ico b/site/app/favicon.ico new file mode 100644 index 00000000..cffe8554 Binary files /dev/null and b/site/app/favicon.ico differ diff --git a/site/app/layout.tsx b/site/app/layout.tsx new file mode 100644 index 00000000..2421d61b --- /dev/null +++ b/site/app/layout.tsx @@ -0,0 +1,66 @@ +import type { Metadata, Viewport } from "next"; +import type { ReactNode } from "react"; +import { ThemeProvider } from "next-themes"; +import { Analytics } from "@/components/Analytics"; +import { SITE_DESCRIPTION, SITE_NAME, SITE_URL } from "@/lib/site"; +import iconDarkInk from "../../docs/assets/brand/oap-icon-dark.svg"; +import iconLightInk from "../../docs/assets/brand/oap-icon-light.svg"; + +export const metadata: Metadata = { + metadataBase: new URL(SITE_URL), + title: { default: SITE_NAME, template: "%s · OAP docs" }, + description: SITE_DESCRIPTION, + openGraph: { + siteName: SITE_NAME, + type: "website", + locale: "en_US", + }, + twitter: { card: "summary_large_image" }, + // The favicon sits on the browser's tab strip, not on this page, so its ink + // follows the OS scheme rather than the site's toggle. + icons: { + icon: [ + { + url: iconDarkInk.src, + type: "image/svg+xml", + media: "(prefers-color-scheme: light)", + }, + { + url: iconLightInk.src, + type: "image/svg+xml", + media: "(prefers-color-scheme: dark)", + }, + ], + // Declared here because an explicit `icons` replaces the file-based + // app/apple-icon.png link rather than adding to it. + apple: [{ url: "/apple-icon.png", sizes: "180x180", type: "image/png" }], + }, +}; + +export const viewport: Viewport = { + colorScheme: "dark light", + themeColor: [ + { media: "(prefers-color-scheme: dark)", color: "#0c050f" }, + { media: "(prefers-color-scheme: light)", color: "#fcfcfc" }, + ], +}; + +export default function RootLayout({ children }: { children: ReactNode }) { + return ( + // next-themes sets data-theme on before hydration; this is the one + // element whose attributes are allowed to differ from the server render. + + + + {children} + + + + + ); +} diff --git a/site/app/not-found.css b/site/app/not-found.css new file mode 100644 index 00000000..459dae00 --- /dev/null +++ b/site/app/not-found.css @@ -0,0 +1,94 @@ +/* The 404 page loads neither the landing nor the docs stylesheet, so it + carries a small palette of its own that follows the same theme attribute. */ +.nf { + --nf-bg: #0c050f; + --nf-fg: #e9e7e9; + --nf-heading: #f8f7f8; + --nf-muted: #9a94a0; + --nf-line: #3f3644; + --nf-surface: #2f2136; + max-width: 760px; + margin: 0 auto; + padding: 0 24px; + min-height: 100vh; + display: flex; + flex-direction: column; + + --sf-line: var(--nf-line); + --sf-line-soft: var(--nf-line); + --sf-muted: var(--nf-muted); + --sf-link: var(--nf-fg); + --sf-strong: var(--nf-heading); + --sf-pad-x: 0px; + --tt-line: var(--nf-line); + --tt-fg: var(--nf-muted); + --tt-fg-hover: var(--nf-fg); + --tt-fg-active: var(--nf-heading); + --tt-bg-active: var(--nf-surface); + --tt-ring: var(--nf-fg); +} + +:root[data-theme="light"] .nf { + --nf-bg: #fcfcfc; + --nf-fg: #1e1424; + --nf-heading: #170d1c; + --nf-muted: #655d69; + --nf-line: #d2cfd3; + --nf-surface: #e9e7e9; +} + +body:has(.nf) { + margin: 0; + background: var(--nf-bg, #0c050f); + font-family: + -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, + sans-serif; +} + +:root[data-theme="light"] body:has(.nf) { + background: #fcfcfc; +} + +.nf-main { + flex: 1; + padding: 120px 0 96px; + color: var(--nf-fg); + font-size: 17px; + line-height: 1.6; +} + +.nf-code { + font-family: "SFMono-Regular", "Menlo", "Consolas", monospace; + font-size: 12px; + letter-spacing: 0.09em; + color: var(--nf-muted); + margin: 0 0 12px; +} + +.nf-main h1 { + font-size: clamp(30px, 5vw, 44px); + font-weight: 300; + letter-spacing: -0.03em; + line-height: 1.1; + color: var(--nf-heading); + margin: 0 0 16px; +} + +.nf-main p { + margin: 0 0 12px; + max-width: 56ch; +} + +.nf-links { + display: flex; + flex-wrap: wrap; + gap: 12px 24px; + margin-top: 28px !important; +} + +.nf-links a { + color: var(--nf-heading); + font-weight: 500; + text-decoration: underline; + text-underline-offset: 4px; +} diff --git a/site/app/not-found.tsx b/site/app/not-found.tsx new file mode 100644 index 00000000..b9059170 --- /dev/null +++ b/site/app/not-found.tsx @@ -0,0 +1,29 @@ +import type { Metadata } from "next"; +import { SiteFooter } from "@/components/SiteFooter"; +import "./not-found.css"; + +export const metadata: Metadata = { + title: { absolute: "Page not found · Open Agent Primitives" }, +}; + +// Every unknown path lands here, including stale /docs/ bookmarks, so +// the page offers the two ways back in. +export default function NotFound() { + return ( +
    +
    +

    404

    +

    This page doesn’t exist.

    +

    + It may have moved when the docs were reorganized. Try the docs, or + start from the home page. +

    +

    + Browse the docs + Go to the home page +

    +
    + +
    + ); +} diff --git a/site/app/opengraph-image.tsx b/site/app/opengraph-image.tsx new file mode 100644 index 00000000..b96132cb --- /dev/null +++ b/site/app/opengraph-image.tsx @@ -0,0 +1,55 @@ +import { ImageResponse } from "next/og"; +import { OG_IMAGE } from "@/lib/site"; + +// The share card for every page that does not ship its own. Rendered once at +// build time. The logomark geometry is the same as components/OapMark.tsx. +export const alt = OG_IMAGE.alt; +export const size = { width: 1200, height: 630 }; +export const contentType = "image/png"; + +// The renderer's default font sets an ordinary space far wider than the +// non-breaking one, so the headline's spaces are swapped before rendering. +const nb = (text: string) => text.replaceAll(" ", "\u00a0"); + +export default function OpengraphImage() { + return new ImageResponse( +
    + + + + + +
    +
    +
    {nb("A secure way to run")}
    +
    + {nb("enterprise AI agents.")} +
    +
    +
    + Open Agent Primitives · openap.org +
    +
    +
    , + size, + ); +} diff --git a/site/app/robots.ts b/site/app/robots.ts new file mode 100644 index 00000000..77a1b9b6 --- /dev/null +++ b/site/app/robots.ts @@ -0,0 +1,9 @@ +import type { MetadataRoute } from "next"; +import { SITE_URL } from "@/lib/site"; + +export default function robots(): MetadataRoute.Robots { + return { + rules: { userAgent: "*", allow: "/" }, + sitemap: `${SITE_URL}/sitemap.xml`, + }; +} diff --git a/site/app/sitemap.ts b/site/app/sitemap.ts new file mode 100644 index 00000000..eac60d7f --- /dev/null +++ b/site/app/sitemap.ts @@ -0,0 +1,11 @@ +import type { MetadataRoute } from "next"; +import { guideSlugs } from "@/lib/guides"; +import { SITE_URL } from "@/lib/site"; + +export default async function sitemap(): Promise { + const slugs = await guideSlugs(); + return [ + { url: `${SITE_URL}/`, priority: 1 }, + ...slugs.map((slug) => ({ url: `${SITE_URL}/docs/${slug}` })), + ]; +} diff --git a/site/components/Analytics.tsx b/site/components/Analytics.tsx new file mode 100644 index 00000000..a3cd7ebb --- /dev/null +++ b/site/components/Analytics.tsx @@ -0,0 +1,15 @@ +"use client"; +import posthog from "posthog-js"; +import { useEffect } from "react"; +import { posthogOptions } from "@/lib/analytics"; + +export function Analytics() { + useEffect(() => { + const opts = posthogOptions({ + key: process.env.NEXT_PUBLIC_POSTHOG_KEY, + vercelEnv: process.env.NEXT_PUBLIC_VERCEL_ENV, + }); + if (opts) posthog.init(opts.key, opts.config); + }, []); + return null; +} diff --git a/showcase/docs/app/components/Callout.tsx b/site/components/Callout.tsx similarity index 100% rename from showcase/docs/app/components/Callout.tsx rename to site/components/Callout.tsx diff --git a/showcase/docs/app/components/Coverage.tsx b/site/components/Coverage.tsx similarity index 100% rename from showcase/docs/app/components/Coverage.tsx rename to site/components/Coverage.tsx diff --git a/site/components/DocNav.tsx b/site/components/DocNav.tsx new file mode 100644 index 00000000..9f78715c --- /dev/null +++ b/site/components/DocNav.tsx @@ -0,0 +1,57 @@ +"use client"; +import { useEffect, useRef, useState, type ReactNode } from "react"; +import { usePathname } from "next/navigation"; + +/* The docs sidebar. On a wide screen it is the full-height column; under + * 900px it collapses to a top bar (brand, search, a Menu button) and the guide + * list opens as an overlay beneath it. Only the open/closed state lives here; + * the brand, search and guide list are rendered by the server layout and + * passed in, so there is still exactly one search box on the page. */ +export function DocNav({ + header, + children, +}: { + header: ReactNode; + children: ReactNode; +}) { + const [open, setOpen] = useState(false); + const toggle = useRef(null); + const pathname = usePathname(); + + // Choosing a guide navigates; the menu should not stay over the new page. + useEffect(() => { + setOpen(false); + }, [pathname]); + + useEffect(() => { + if (!open) return; + const onKey = (e: KeyboardEvent) => { + if (e.key !== "Escape") return; + setOpen(false); + toggle.current?.focus(); + }; + window.addEventListener("keydown", onKey); + return () => window.removeEventListener("keydown", onKey); + }, [open]); + + return ( + + ); +} diff --git a/site/components/NavLink.tsx b/site/components/NavLink.tsx new file mode 100644 index 00000000..ec41ef6f --- /dev/null +++ b/site/components/NavLink.tsx @@ -0,0 +1,17 @@ +"use client"; +import Link from "next/link"; +import { usePathname } from "next/navigation"; + +export function NavLink({ slug, title }: { slug: string; title: string }) { + const href = `/docs/${slug}`; + const active = usePathname() === href; + return ( + + {title} + + ); +} diff --git a/site/components/OapMark.tsx b/site/components/OapMark.tsx new file mode 100644 index 00000000..fbcddecd --- /dev/null +++ b/site/components/OapMark.tsx @@ -0,0 +1,22 @@ +// The OAP logomark, inlined so it inherits `currentColor` and needs no +// light/dark asset pair. Geometry is the 2026-09-23 finals, verbatim from +// docs/assets/brand/oap-logomark-*.svg (the committed files differ only in +// their baked-in fill). A second inlined copy lives in +// web/packages/design/src/components/ui/oap-mark.tsx — docs/assets/brand/README.md +// lists every copy; update them together. +export function OapMark({ className }: { className?: string }) { + return ( + + + + + + ); +} diff --git a/site/components/Search.tsx b/site/components/Search.tsx new file mode 100644 index 00000000..98466f96 --- /dev/null +++ b/site/components/Search.tsx @@ -0,0 +1,178 @@ +"use client"; +import Link from "next/link"; +import { usePathname } from "next/navigation"; +import { + useEffect, + useRef, + useState, + type KeyboardEvent as ReactKeyboardEvent, +} from "react"; +import { + isApplePlatform, + isSearchShortcut, + platformName, + searchShortcutLabel, +} from "@/lib/shortcut"; +import { + loadPagefind, + toPath, + type Pagefind, + type PagefindResult, +} from "@/lib/pagefind"; + +type State = + | { kind: "idle" } + | { kind: "unavailable" } + | { kind: "error" } + | { kind: "results"; items: PagefindResult[] }; + +// The index only exists after `pnpm build`, so on a dev server "unavailable" +// has a known fix; on a deployed site it means something failed to load. +const UNAVAILABLE = + process.env.NODE_ENV === "production" ? ( + "Search is unavailable right now." + ) : ( + <> + Search is available after pnpm build. + + ); + +/** What the hidden status line announces for each state. */ +function announce(state: State): string { + switch (state.kind) { + case "idle": + return ""; + case "unavailable": + return "Search is unavailable."; + case "error": + return "Search failed. Try again."; + case "results": + return state.items.length === 0 + ? "No matches." + : `${state.items.length} result${state.items.length === 1 ? "" : "s"}.`; + } +} + +export function Search() { + const pf = useRef(undefined); + const inputRef = useRef(null); + // Bumped at the start of each onInput call; a stale (slower) call's result + // is dropped instead of overwriting a newer call's state. + const gen = useRef(0); + const [state, setState] = useState({ kind: "idle" }); + // Unknown until mount: the server can't know the visitor's platform, so the + // shortcut hint renders only on the client and never mismatches hydration. + const [apple, setApple] = useState(null); + const pathname = usePathname(); + + // ⌘K / Ctrl K focuses search from anywhere on a docs page. + useEffect(() => { + const nav = navigator as Navigator & { + userAgentData?: { platform?: string }; + }; + const isApple = isApplePlatform( + platformName(nav.userAgentData?.platform, nav.platform), + ); + setApple(isApple); + const onKey = (e: KeyboardEvent) => { + if (!isSearchShortcut(e, isApple)) return; + e.preventDefault(); + inputRef.current?.focus(); + inputRef.current?.select(); + }; + window.addEventListener("keydown", onKey); + return () => window.removeEventListener("keydown", onKey); + }, []); + + // Escape closes the search: clear it and give focus back to the page. + function onKeyDown(e: ReactKeyboardEvent) { + if (e.key !== "Escape") return; + gen.current++; + setState({ kind: "idle" }); + e.currentTarget.value = ""; + e.currentTarget.blur(); + } + + // Search lives in the docs layout, which persists across navigations. + // Picking a result routes to a new page without remounting this + // component, so without this the query and result list would still be + // showing over the page you just navigated to. Bump the generation first + // so a search already in flight can't repopulate state after we clear it. + useEffect(() => { + gen.current++; + setState({ kind: "idle" }); + if (inputRef.current) inputRef.current.value = ""; + }, [pathname]); + + async function ensure() { + if (pf.current === undefined) pf.current = await loadPagefind(); + if (pf.current === null) setState({ kind: "unavailable" }); + return pf.current; + } + + async function onInput(q: string) { + const my = ++gen.current; + const engine = await ensure(); + if (!engine) return; + if (!q.trim()) { + if (my === gen.current) setState({ kind: "idle" }); + return; + } + try { + const { results } = await engine.search(q); + const items = await Promise.all(results.slice(0, 8).map((r) => r.data())); + if (my === gen.current) setState({ kind: "results", items }); + } catch (err) { + console.error("docs search: query failed", { query: q, err }); + if (my === gen.current) setState({ kind: "error" }); + } + } + + return ( +
    +
    + void onInput(e.target.value)} + /> + {apple !== null && ( + + )} +
    +

    + {announce(state)} +

    + {state.kind === "unavailable" && ( +

    {UNAVAILABLE}

    + )} + {state.kind === "error" && ( +

    Search failed. Try again.

    + )} + {state.kind === "results" && ( +
      + {state.items.length === 0 && ( +
    • No matches.
      • + )} + {state.items.map((r) => ( +
    • + {r.meta.title ?? toPath(r.url)} + {/* Pagefind's excerpt is its own escaped text with highlights. */} +

      +

      • + ))} +
    + )} +
    + ); +} diff --git a/site/components/SiteFooter.tsx b/site/components/SiteFooter.tsx new file mode 100644 index 00000000..7f836de7 --- /dev/null +++ b/site/components/SiteFooter.tsx @@ -0,0 +1,40 @@ +import { OapMark } from "./OapMark"; +import { ThemeToggle } from "./ThemeToggle"; +import "./site-footer.css"; + +// The AuthZed Discord, the destination authzed.com/discord redirects to. +const COMMUNITY = "https://discord.gg/TUd4k5McMX"; +const LICENSE = + "https://github.com/authzed/openagentprimitives/blob/main/LICENSE"; + +/* The footer shared by the landing page and the docs. Plain throughout: + * the two sections load different stylesheets, so crossing between them is a + * full page load either way. */ +export function SiteFooter() { + return ( + + ); +} diff --git a/site/components/ThemeToggle.tsx b/site/components/ThemeToggle.tsx new file mode 100644 index 00000000..affa5618 --- /dev/null +++ b/site/components/ThemeToggle.tsx @@ -0,0 +1,68 @@ +"use client"; +import { useEffect, useState, type JSX } from "react"; +import { useTheme } from "next-themes"; +import "./theme-toggle.css"; + +type Mode = "light" | "dark" | "system"; + +// Native radios rather than buttons with aria-checked: a radio group gives +// arrow-key navigation, roving focus and the correct grouping semantics for +// free, and the three options are genuinely mutually exclusive. +const MODES: { id: Mode; label: string; icon: JSX.Element }[] = [ + { + id: "light", + label: "Light", + icon: ( + + ), + }, + { + id: "dark", + label: "Dark", + icon: ( + + ), + }, + { + id: "system", + label: "System", + icon: ( + + ), + }, +]; + +export function ThemeToggle({ className }: { className?: string }) { + const { theme, setTheme } = useTheme(); + // The server cannot know the stored choice, so no radio is checked until + // mount; rendering one would mismatch hydration. + const [mounted, setMounted] = useState(false); + useEffect(() => setMounted(true), []); + + return ( +
    + Color theme + {MODES.map((mode) => ( + + ))} +
    + ); +} diff --git a/site/components/Wordmark.tsx b/site/components/Wordmark.tsx new file mode 100644 index 00000000..bb9471d6 --- /dev/null +++ b/site/components/Wordmark.tsx @@ -0,0 +1,24 @@ +// "light" and "dark" name the INK, not the background, so the light-ink file +// is the one for the dark theme. Both render; CSS on the data-theme attribute +// next-themes stamps before paint shows one, so the mark is right on the first +// frame without waiting for React. +import lightInk from "../../docs/assets/brand/oap-wordmark-light.svg"; +import darkInk from "../../docs/assets/brand/oap-wordmark-dark.svg"; +import "./wordmark.css"; + +export function Wordmark({ className = "" }: { className?: string }) { + return ( + <> + + + + ); +} diff --git a/showcase/docs/app/components/media.tsx b/site/components/media.tsx similarity index 73% rename from showcase/docs/app/components/media.tsx rename to site/components/media.tsx index 26f9dd81..c70b3ba3 100644 --- a/showcase/docs/app/components/media.tsx +++ b/site/components/media.tsx @@ -1,12 +1,35 @@ -import { useEffect, useState } from "react"; -import { getAsset } from "../manifest"; +"use client"; +import { + useEffect, + useRef, + useState, + type KeyboardEvent as ReactKeyboardEvent, +} from "react"; +import { getAsset } from "@/lib/manifest"; function Missing({ name }: { name: string }) { return
    missing media: {name}
    ; } +// Screenshot and ScreenshotSeries images are role="button" (a real