# Commands

Run in the installed V2 project with Node 24+. Product name V2 does not mean package major version 2: this pin’s package is 1.1.4. Commands below describe the package scripts, not an installed global CLI.

# Package scripts

Account command names are listed below to keep phone tables readable. Installation can contact package sources and execute dependency installation behavior; it is not an offline operation merely because reader libraries are bundled. Ordinary build reads committed vendor files, not an automatic rebundle.

# Builder arguments

Folder paths resolve from working directory. Defaults are engine-root content/dist/.markstack, with data precedence described below. The first occurrence of a folder flag supplies its following token. Missing value or a next -- token prints FLAG needs a folder and exits 2. This is a small argument parser, not universal validation of every unknown/combined option.

Npm forwards arguments after --:

npm run build -- --content ./docs --out ./preview-output --data ./docs-data

Review absolute output target before running: build removes/recreates it. Do not choose source, valuable backup, unrelated directory or overlapping input target. The parser does not establish your permission or a safe output relationship.

# Inputs that flags do not replace

Static resources, templates and siteconfig remain tied to the installed engine. Selecting Markdown alone does not exclude private copied assets or shared branding. Use a reviewed isolated installation for public/private separation.

Data selection is first --data, then MARKSTACK_DATA_DIR, then parent of resolved MARKSTACK_USERS_FILE, then engine .markstack. Reader builder uses settings/links/icons there; it does not use account passwords to permission-filter reader output.

Watch monitors content/static/templates and rebuilds on change/add/unlink. It is not an editor session, approval queue, deployment service or promise every config/runtime change triggers a rebuild. Stop with Ctrl+C. Rebuild deliberately after configuration/runtime changes. A failed build can leave incomplete output; watch is a development workflow, not atomic reader-host release.

# Local preview

npm run serve starts project dist at 127.0.0.1:3000. MARKSTACK_PREVIEW_PORT selects another port. It does not inherit a custom builder output argument: run preview against an intended reviewed project dist or use your own explicit hosting workflow.

Preview implements GET/HEAD, missing routes as 404 and no-store responses. It is local-only, not TLS, authentication, CDN configuration or a production process supervisor. Build workflow explains review boundaries.

# Account creation

npm run editor:create-admin -- --user docs-admin

Creates an administrator in the selected users file. User name is lowercased by command, then validated by account store. Existing name is rejected, not overwritten. Name must be 2-32 allowed characters, first letter/digit, remaining lowercase letters/digits/dot/underscore/hyphen.

Terminal password prompt is hidden and asks twice. Non-TTY input reads stdin once and removes one final line ending. Password is not a command argument and is not printed. Never put persistent credentials in command text, source or support logs. Use approved secret handling for automation instead of a literal echoed password in shell history.

Policy accepts text of 12-256 characters and rejects the small built-in common-password list. It does not implement universal breached-password detection or require a particular mix of character classes.

# Administrator recovery

npm run editor:reset-admin -- --user docs-admin

Requires an existing administrator and server-shell authority. Resets password, enables account and clears forced-change state together under account-store locking. Active sessions for that account end when running editor next checks current account version. Restart is not required for that reload behavior.

It does not create a missing administrator, recover source, restore deleted pages or reset another runtime accidentally selected. Set the same MARKSTACK_USERS_FILE for account commands and server. MARKSTACK_DATA_DIR does not move this users file. Accounts and access gives the operational workflow.

Missing user argument exits 2; existing-name/create, missing-admin/reset, invalid policy or storage failure exits unsuccessfully with reason. Do not rerun blindly against a different path after an error. Read actual resulting account state and private file permissions.

# Maintainer and destructive work

Asset rebundle deletes static/vendor, reads installed dependency assets, bundles local Mermaid/highlight, copies Markdown/fonts and writes notices/hash manifest. It requires development dependencies. Do not run it merely to write content; review its generated diff and licensing under the contributor workflow.

Clean removes project dist with recursive force. It does not remove a different --out directory or rebuild afterward. CLI build directly recreates selected output; editor Publish uses a staged shared job with its own recovery boundaries. Neither command deploys remotely or commits Git.

Examples are syntax, not proof your service/host is configured. Validate actual result before calling work complete.