Function resolveDocPath

apps/api/src/lib/docs.ts:24–34

(
  slug: string[],
  root: string = docsRoot(),
)

 * slug is empty, not a `.md` file, or escapes the root (path-traversal guard).
 */
export function resolveDocPath(
  slug: string[],
  root: string = docsRoot(),
): string | null {
  if (!slug.length) return null;
  const rel = slug.join("/");
  if (!rel.endsWith(".md")) return null;
  const abs = resolve(root, rel);
  if (abs !== root && !abs.startsWith(root + sep)) return null;
  return abs;
}

/** Read a doc by slug, or null if the slug is invalid or the file is missing. */
export function readDoc(slug: string[]): string | null {