@hollware/core 0.0.2 → 0.1.0

package/dist/index.mjs

@@ -1,4 +1,3309 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import * as z from "zod";
+//#region src/config/define.ts
+/**
+* The `define*` helpers only give the config its types: the frontmatter type of a collection
+* flows from its schema into its contracts. Validating the config is the job of the config
+* module, when the Worker starts.
+*/
+/** Declares the config of a deployment: what `hollware.config.ts` exports. */
+function defineConfig(config) {
+	return config;
+}
+/** Declares a collection. Its contracts see the frontmatter that its schema returns. */
+function defineCollection(collection) {
+	return collection;
+}
+/** Declares a component that entries may use in their body. */
+function defineComponent(component) {
+	return component;
+}
+/**
+* Declares a contract shared by several collections, with the frontmatter type it reads given
+* explicitly: `defineContract<{ title: string }>({ … })`. Inside `defineCollection`, write a
+* contract as a plain object instead: its `check` gets the frontmatter type of the schema there,
+* which a generic call inside the array would lose.
+*/
+function defineContract(contract) {
+	return contract;
+}
+//#endregion
+//#region src/config/config-error.ts
+/**
+* The error `resolveConfig` throws: every problem of the config at once, so that a broken
+* `hollware.config.ts` stops the Worker at startup with a message that says what to change. The
+* message has one line per problem, `<path>: <message>. <fix>`, and `problems` holds them as data.
+*/
+var ConfigError = class extends Error {
+	name = "ConfigError";
+	problems;
+	constructor(problems) {
+		super(problems.map((problem) => `${problem.path}: ${problem.message}. ${problem.fix}`).join("\n"));
+		this.problems = problems;
+	}
+};
+/** The problems found so far, in the order they were found. */
+var Problems = class {
+	list = [];
+	add(path, message, fix) {
+		this.list.push({
+			path,
+			message,
+			fix
+		});
+	}
+};
+//#endregion
+//#region src/config/constants.ts
+/** The largest Markdown file a collection accepts when its config does not say, 512 KiB. */
+const DEFAULT_MAX_MARKDOWN_BYTES = 524288;
+/**
+* The largest `maxMarkdownBytes` a collection may set, 768 KiB. A revision row holds the Markdown,
+* the frontmatter and the Comark document, which is about 1.3 times the Markdown, so a row is
+* about 2.3 times the file, and the store refuses rows over 1.9 MB: a file over about 800 KB could
+* never be saved. 768 KiB keeps a margin.
+*/
+const MAX_MARKDOWN_BYTES_CEILING = 786432;
+/**
+* A collection name or a component name: lowercase letters, digits and hyphens, starting with a
+* letter, at most 63 characters. A component name is what Markdown writes after the colons
+* (`::callout`). A site key has its own rule (`site-key.ts`).
+*/
+const NAME = /^[a-z][a-z0-9-]{0,62}$/;
+/** A language tag: a language, then an optional script and region: `es`, `pt-BR`, `zh-Hant-TW`. */
+const LOCALE_TAG = /^[a-z]{2,3}(?:-[A-Z][a-z]{3})?(?:-(?:[A-Z]{2}|[0-9]{3}))?$/;
+/** The id of a contract: lowercase words joined by single hyphens. */
+const CONTRACT_ID = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+/** The fix of a name that breaks `NAME`, with an example of the right kind. */
+function nameFix(example) {
+	return `Use lowercase letters, digits and hyphens, starting with a letter, at most 63 characters, such as "${example}".`;
+}
+//#endregion
+//#region src/contracts/registry.ts
+/**
+* The contracts that Hollware makes itself, as opposed to the ones a site writes. The runner
+* needs to know one thing about them that a `Contract` does not say: whether the rule reads the
+* frontmatter, because a rule that does only runs once the schema has accepted it.
+*/
+const BUILT_INS = /* @__PURE__ */ new WeakMap();
+/** Marks a contract as one of Hollware's own and returns it. */
+function registerBuiltIn(contract, options) {
+	BUILT_INS.set(contract, options);
+	return contract;
+}
+/**
+* Whether a contract was made by Hollware: the always-on ones and what the factories of
+* `contracts` return. A site's own contract with the id of a built-in one is not.
+*/
+function isBuiltInContract(contract) {
+	return BUILT_INS.has(contract);
+}
+/** Whether a contract only runs once the schema has accepted the frontmatter. */
+function readsFrontmatter(contract) {
+	return BUILT_INS.get(contract)?.readsFrontmatter ?? true;
+}
+//#endregion
+//#region src/contracts/runtime.ts
+const RUNTIMES = /* @__PURE__ */ new WeakMap();
+/** Records the runtime of the context a run hands to its contracts. */
+function bindRuntime(context, runtime) {
+	RUNTIMES.set(context, runtime);
+}
+/** The runtime of a context. A built-in contract called by hand, with a context of its own, throws. */
+function runtimeOf(contractId, context) {
+	const runtime = RUNTIMES.get(context);
+	if (runtime === void 0) throw new Error(`The built-in contract ${contractId} runs only through runContracts.`);
+	return runtime;
+}
+//#endregion
+//#region src/contracts/text.ts
+/**
+* Helpers for the texts of violations. A message can repeat something the entry holds, such as a
+* URL or a tag name. A verdict is stored with every revision and sent to the agent within an
+* output cap, so whatever a text repeats from the entry is clipped and escaped.
+*/
+/** The most characters of the entry's own text that a message repeats. */
+const MAX_ECHO_LENGTH = 80;
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Orders two texts by UTF-16 code units: the same in every runtime, unlike `localeCompare`. */
+function compareText(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+/** `text` cut to `max` characters, never inside a surrogate pair, with an ellipsis. */
+function clip(text, max = MAX_ECHO_LENGTH) {
+	if (text.length <= max) return text;
+	const head = text.slice(0, max);
+	const last = head.charCodeAt(max - 1);
+	return `${last >= 55296 && last <= 56319 ? head.slice(0, -1) : head}…`;
+}
+/** Text from the entry as a message shows it: clipped, in JSON quotes, control characters escaped. */
+function quote$1(text) {
+	return JSON.stringify(clip(text));
+}
+/** A JSON Pointer (RFC 6901) from its segments: `['tags', '0']` is `/tags/0`, none is the root. */
+function pointer(segments) {
+	return segments.map((segment) => `/${segment.replaceAll("~", "~0").replaceAll("/", "~1")}`).join("");
+}
+/** `1 character`, `2 characters`. */
+function count(amount, noun) {
+	return `${amount} ${noun}${amount === 1 ? "" : "s"}`;
+}
+//#endregion
+//#region src/contracts/schema-fix.ts
+/**
+* The fix of a schema violation. A Standard Schema issue says where (`path`) and what (`message`),
+* and nothing else is the same across libraries, so the fix comes from the JSON Schema of the same
+* schema: it names the field and what the schema accepts there ("a string of 1 to 160
+* characters", "one of "info", "tip""), which is what an agent needs to write the next attempt.
+* Where the JSON Schema cannot say, the fix falls back to the library's own message.
+*/
+/** The most values of an enum that a fix lists. */
+const MAX_LISTED_VALUES = 20;
+/** The path of an issue as plain strings; a number or a symbol becomes its text. */
+function issueSegments(issue) {
+	return (issue.path ?? []).map((segment) => String(typeof segment === "object" ? segment.key : segment));
+}
+/** A path as a person writes it: `author.links[2]`. */
+function label(segments) {
+	return segments.reduce((text, segment) => {
+		if (/^\d+$/.test(segment)) return `${text}[${segment}]`;
+		return text === "" ? segment : `${text}.${segment}`;
+	}, "");
+}
+/** The part of a JSON Schema that describes the value at `segments`, when the schema says. */
+function fragmentAt(schema, segments) {
+	let node = schema;
+	for (const segment of segments) {
+		const properties = node.properties;
+		if (isRecord$2(properties) && Object.hasOwn(properties, segment)) {
+			const next = properties[segment];
+			if (!isRecord$2(next)) return void 0;
+			node = next;
+		} else if (/^\d+$/.test(segment) && isRecord$2(node.items)) node = node.items;
+		else return;
+	}
+	return node;
+}
+function valueAt(input, segments) {
+	let node = input;
+	for (const segment of segments) if (Array.isArray(node) && /^\d+$/.test(segment)) node = node[Number(segment)];
+	else if (isRecord$2(node) && Object.hasOwn(node, segment)) node = node[segment];
+	else return void 0;
+	return node;
+}
+function listValues(values) {
+	const shown = values.slice(0, MAX_LISTED_VALUES).map((value) => JSON.stringify(value)).join(", ");
+	const more = values.length - MAX_LISTED_VALUES;
+	return more > 0 ? `${shown} and ${more} more` : shown;
+}
+/** `1 to 160 characters`, `at least 1 item`, `at most 3 items`, or nothing. */
+function range(min, max, noun) {
+	const low = typeof min === "number" ? min : void 0;
+	const high = typeof max === "number" ? max : void 0;
+	if (low !== void 0 && high !== void 0) return low === high ? `exactly ${count(low, noun)}` : `${low} to ${count(high, noun)}`;
+	if (low !== void 0) return `at least ${count(low, noun)}`;
+	if (high !== void 0) return `at most ${count(high, noun)}`;
+}
+function stringExpectation(schema) {
+	const length = range(schema.minLength, schema.maxLength, "character");
+	let shape = "";
+	if (typeof schema.format === "string") shape = ` in the format ${JSON.stringify(schema.format)}`;
+	else if (typeof schema.pattern === "string") shape = ` matching the pattern ${schema.pattern}`;
+	return `a string${length === void 0 ? "" : ` of ${length}`}${shape}`;
+}
+function numberExpectation(type, schema) {
+	const bounds = [
+		typeof schema.minimum === "number" ? `at least ${schema.minimum}` : void 0,
+		typeof schema.exclusiveMinimum === "number" ? `greater than ${schema.exclusiveMinimum}` : void 0,
+		typeof schema.maximum === "number" ? `at most ${schema.maximum}` : void 0,
+		typeof schema.exclusiveMaximum === "number" ? `less than ${schema.exclusiveMaximum}` : void 0
+	].filter((bound) => bound !== void 0);
+	const base = type === "integer" ? "an integer" : "a number";
+	return bounds.length === 0 ? base : `${base} that is ${bounds.join(" and ")}`;
+}
+function arrayExpectation(schema) {
+	const size = range(schema.minItems, schema.maxItems, "item");
+	const items = isRecord$2(schema.items) ? expectation(schema.items) : void 0;
+	return `an array${size === void 0 ? "" : ` of ${size}`}${items === void 0 ? "" : `, each ${items}`}`;
+}
+function objectExpectation(schema) {
+	const keys = isRecord$2(schema.properties) ? Object.keys(schema.properties) : [];
+	return keys.length === 0 ? "an object" : `an object with the keys ${keys.join(", ")}`;
+}
+function typeExpectation(type, schema) {
+	switch (type) {
+		case "string": return stringExpectation(schema);
+		case "integer":
+		case "number": return numberExpectation(type, schema);
+		case "boolean": return "true or false";
+		case "null": return "null";
+		case "array": return arrayExpectation(schema);
+		case "object": return objectExpectation(schema);
+		default: return;
+	}
+}
+/**
+* What a JSON Schema accepts, as the end of a sentence ("a string of at most 160 characters"), or
+* `undefined` when it uses something this does not put into words, such as `$ref` or `allOf`.
+*/
+function expectation(schema) {
+	if ("const" in schema) return `exactly ${JSON.stringify(schema.const)}`;
+	if (Array.isArray(schema.enum)) return `one of ${listValues(schema.enum)}`;
+	const alternatives = schema.anyOf ?? schema.oneOf;
+	const parts = Array.isArray(alternatives) ? alternatives.map((option) => isRecord$2(option) ? expectation(option) : void 0) : (Array.isArray(schema.type) ? schema.type : [schema.type]).map((type) => typeExpectation(type, schema));
+	return parts.every((part) => part !== void 0) ? parts.join(" or ") : void 0;
+}
+/** The keys of `value` that an object schema closed to other keys does not list. */
+function unknownKeys(fragment, value) {
+	const { additionalProperties, properties } = fragment;
+	if (additionalProperties !== false || !isRecord$2(properties) || !isRecord$2(value)) return [];
+	return Object.keys(value).filter((key) => !Object.hasOwn(properties, key));
+}
+/** The fix for one issue: imperative, naming the field and what the schema accepts there. */
+function fixForIssue({ subject, schema, input, segments, message }) {
+	const target = segments.length === 0 ? subject.container : `the ${subject.noun} ${quote$1(label(segments))}`;
+	const fragment = schema === null ? void 0 : fragmentAt(schema, segments);
+	if (fragment !== void 0) {
+		const unknown = unknownKeys(fragment, valueAt(input, segments));
+		if (unknown.length > 0) {
+			const allowed = isRecord$2(fragment.properties) ? Object.keys(fragment.properties) : [];
+			const nouns = unknown.length === 1 ? subject.noun : `${subject.noun}s`;
+			const where = allowed.length === 0 ? `no ${subject.noun}s are allowed there` : `the ${subject.noun}s allowed there are: ${allowed.join(", ")}`;
+			return `Remove the ${nouns} ${unknown.map((key) => quote$1(key)).join(", ")} from ${target}; ${where}.`;
+		}
+	}
+	const expected = fragment === void 0 ? void 0 : expectation(fragment);
+	return expected === void 0 ? `Change ${target} to a value that the schema of ${subject.container} accepts: ${message}` : `Set ${target} to ${expected}.`;
+}
+//#endregion
+//#region src/contracts/schema.ts
+const SNAPSHOTS = /* @__PURE__ */ new WeakMap();
+function toJsonSchema$1(schema) {
+	try {
+		return schema["~standard"].jsonSchema.input({ target: "draft-2020-12" });
+	} catch {
+		return null;
+	}
+}
+function schemaSnapshot(collection) {
+	let snapshot = SNAPSHOTS.get(collection);
+	if (snapshot === void 0) {
+		snapshot = {
+			frontmatter: toJsonSchema$1(collection.schema),
+			components: new Map([...collection.components].map(([name, component]) => [name, toJsonSchema$1(component.props)]))
+		};
+		SNAPSHOTS.set(collection, snapshot);
+	}
+	return snapshot;
+}
+const FRONTMATTER = {
+	container: "the frontmatter",
+	noun: "field"
+};
+/**
+* Validates the frontmatter with the collection's schema. When it passes, `value` is what the
+* schema returned, which is what the collection's own contracts get. Each issue becomes a finding
+* at its JSON Pointer under `/frontmatter`. It throws when the schema does.
+*/
+async function checkFrontmatter(collection, frontmatter) {
+	const result = await collection.schema["~standard"].validate(frontmatter);
+	if (!result.issues) return {
+		passed: true,
+		value: result.value
+	};
+	const json = schemaSnapshot(collection).frontmatter;
+	return {
+		passed: false,
+		findings: result.issues.map((issue) => {
+			const segments = issueSegments(issue);
+			return {
+				path: `/frontmatter${pointer(segments)}`,
+				message: issue.message,
+				fix: fixForIssue({
+					subject: FRONTMATTER,
+					schema: json,
+					input: frontmatter,
+					segments,
+					message: issue.message
+				})
+			};
+		})
+	};
+}
+//#endregion
+//#region src/contracts/components.ts
+/**
+* `components`: the props of every component the body uses, checked with the schema of that
+* component. A component the collection does not allow is `unknown-component`'s business: the
+* parser leaves a marker for it instead of a use.
+*/
+const COMPONENTS = registerBuiltIn({
+	id: "components",
+	severity: "error",
+	description: "The props of every component in the body match the schema of that component.",
+	async check(context) {
+		const { collection } = runtimeOf("components", context);
+		const schemas = schemaSnapshot(collection).components;
+		const findings = [];
+		for (const use of context.markdown.extracted.components) {
+			const definition = collection.components.get(use.name);
+			if (definition === void 0) continue;
+			const result = await definition.props["~standard"].validate(use.props);
+			if (!result.issues) continue;
+			const subject = {
+				container: `the component ${quote$1(use.name)}`,
+				noun: "prop"
+			};
+			for (const issue of result.issues) {
+				const segments = issueSegments(issue);
+				const which = segments.length === 0 ? "The props" : `The prop ${quote$1(label(segments))}`;
+				findings.push({
+					path: "/body",
+					message: `${which} of the component ${quote$1(use.name)} ${segments.length === 0 ? "are" : "is"} invalid: ${issue.message}`,
+					fix: fixForIssue({
+						subject,
+						schema: schemas.get(use.name) ?? null,
+						input: use.props,
+						segments,
+						message: issue.message
+					}),
+					line: use.line
+				});
+			}
+		}
+		return findings;
+	}
+}, { readsFrontmatter: false });
+//#endregion
+//#region src/contracts/description.ts
+/** The phases, in the order they happen. */
+const PHASES = ["write", "publish"];
+/**
+* The phases a contract is declared for: both when it names none, in their natural order and
+* without repeats, so that the same rule always reads the same.
+*/
+function contractPhases(contract) {
+	const declared = contract.phases ?? PHASES;
+	return PHASES.filter((phase) => declared.includes(phase));
+}
+/** A contract as `describe_site` shows it to agents. */
+function describeContract(contract) {
+	return {
+		id: contract.id,
+		severity: contract.severity,
+		phases: contractPhases(contract),
+		description: contract.description
+	};
+}
+//#endregion
+//#region src/contracts/safety.ts
+/** The components a collection allows, sorted: what a fix offers instead. */
+function allowedComponents(collection) {
+	return [...collection.components.keys()].toSorted();
+}
+function markerContract(kind, description, wording) {
+	return registerBuiltIn({
+		id: kind,
+		severity: "error",
+		description,
+		check(context) {
+			const { collection } = runtimeOf(kind, context);
+			return context.markdown.extracted.disallowed.filter((marker) => marker.kind === kind).map((marker) => ({
+				path: "/body",
+				...wording(marker, collection),
+				line: marker.line
+			}));
+		}
+	}, { readsFrontmatter: false });
+}
+const RAW_HTML = markerContract("raw-html", "The body holds Markdown and the components of the collection, never raw HTML.", (marker, collection) => {
+	const components = allowedComponents(collection);
+	return {
+		message: `Raw HTML is not allowed: the body has a <${clip(marker.name)}> tag.`,
+		fix: `Remove the HTML and use Markdown${components.length === 0 ? "" : ` or one of the allowed components: ${components.join(", ")}`}.`
+	};
+});
+const UNKNOWN_COMPONENT = markerContract("unknown-component", "The body uses only the components that the collection declares.", (marker, collection) => {
+	const components = allowedComponents(collection);
+	return {
+		message: `The component ${quote$1(marker.name)} does not exist in this collection.`,
+		fix: components.length === 0 ? "This collection allows no components: remove it and use Markdown." : `Use one of the allowed components: ${components.join(", ")}.`
+	};
+});
+const DISALLOWED_ATTRIBUTE = markerContract("disallowed-attribute", "Links, images and code carry only the attributes Markdown produces, and a component only the props its schema declares.", (marker) => ({
+	message: `The attribute ${quote$1(marker.name)} is not allowed.`,
+	fix: `Remove the attribute ${quote$1(marker.name)}. Links keep href and title, images keep src, alt, title, width and height, and a component takes only the props its schema declares.`
+}));
+const UNSAFE_URL = markerContract("unsafe-url", "Links and images use an https:, http: or mailto: URL, a path of the site or an anchor.", (marker) => ({
+	message: `The URL ${quote$1(marker.name)} is not allowed.`,
+	fix: "Use an https: or http: URL, a mailto: address, a path of this site that starts with /, or an anchor that starts with #."
+}));
+//#endregion
+//#region src/contracts/builtin.ts
+/**
+* Every id Hollware's own contracts use. The config module reserves them: a contract of a site
+* cannot take one, except through `contracts.*`, which makes the opt-in ones.
+*
+* - Always on, run by `runContracts`: `schema`, `components` and the four content-safety
+*   contracts, `raw-html`, `unknown-component`, `disallowed-attribute` and `unsafe-url`.
+* - Opt-in, listed in a collection's `contracts`: `translation-pair`, `internal-links-resolve`
+*   and `images-have-alt`.
+* - Always on, found before the contracts run: `size-limit` (made by the pipeline for
+*   `maxMarkdownBytes` and by the store for the row, with `sizeLimitViolation`),
+*   `frontmatter-syntax` and `comark-parse` (made by the pipeline), and `unique-slug` and
+*   `unique-translation` (made when the store finds the slug or the translation group taken). A
+*   write with one of them is `refused`, so no verdict is made for it: they are
+*   `REFUSAL_CONTRACT_IDS`.
+*/
+const BUILT_IN_CONTRACT_IDS = [
+	"schema",
+	"components",
+	"raw-html",
+	"unknown-component",
+	"disallowed-attribute",
+	"unsafe-url",
+	"translation-pair",
+	"internal-links-resolve",
+	"images-have-alt",
+	"size-limit",
+	"frontmatter-syntax",
+	"comark-parse",
+	"unique-slug",
+	"unique-translation"
+];
+/**
+* The ids of the violations that make a write `refused` instead of saving it: a file that cannot
+* be stored, because it is over a size limit, its frontmatter is not YAML or its Markdown does not
+* parse, or whose slug or translation group another entry holds. Every other violation is saved with the draft and only blocks publishing (ADR-004,
+* ADR-020). Plain strings, so that a violation's `contract` can be looked up in the list.
+*/
+const REFUSAL_CONTRACT_IDS = [
+	"size-limit",
+	"frontmatter-syntax",
+	"comark-parse",
+	"unique-slug",
+	"unique-translation"
+];
+/** The built-in contract that the schema of the collection stands for. It runs before the others. */
+const SCHEMA_CONTRACT = {
+	id: "schema",
+	severity: "error",
+	description: "The frontmatter matches the schema of the collection, which describe_site shows as JSON Schema."
+};
+/** The always-on contracts after `schema`, in the order they run. */
+const ALWAYS_ON_CONTRACTS = [
+	COMPONENTS,
+	RAW_HTML,
+	UNKNOWN_COMPONENT,
+	DISALLOWED_ATTRIBUTE,
+	UNSAFE_URL
+];
+/** The always-on contracts that are checked before any of these runs. */
+const PIPELINE_CONTRACTS = [
+	{
+		id: "size-limit",
+		severity: "error",
+		description: "The whole Markdown file stays within the size limit of the collection."
+	},
+	{
+		id: "frontmatter-syntax",
+		severity: "error",
+		description: "The frontmatter is valid YAML between two --- lines at the top of the file."
+	},
+	{
+		id: "comark-parse",
+		severity: "error",
+		description: "The Markdown parses."
+	},
+	{
+		id: "unique-slug",
+		severity: "error",
+		description: "No other entry of the collection and locale has the slug."
+	},
+	{
+		id: "unique-translation",
+		severity: "error",
+		description: "No other entry of the collection and locale belongs to the translation group."
+	}
+];
+/**
+* The always-on contracts as `describe_site` shows them, in `BUILT_IN_CONTRACT_IDS` order. The
+* opt-in ones are not here: a collection that uses one lists it in its own `contracts`.
+*/
+function describeBuiltInContracts() {
+	return [
+		SCHEMA_CONTRACT,
+		...ALWAYS_ON_CONTRACTS,
+		...PIPELINE_CONTRACTS
+	].map((contract) => describeContract(contract));
+}
+//#endregion
+//#region src/contracts/opt-in.ts
+/**
+* Every locale of the site has an entry in the translation group of this one. It reads the group
+* from the frontmatter field the collection names in `translations.groupBy`, and counts an entry
+* in any status, so the pair can be published one after the other. Checked when publishing, and
+* skipped when the collection has no translations.
+*/
+function translationPair(options = {}) {
+	return registerBuiltIn({
+		id: "translation-pair",
+		severity: options.severity ?? "error",
+		phases: ["publish"],
+		description: "Every locale of the site has an entry in the translation group of this entry. Checked when publishing.",
+		async check(context) {
+			const { site, collection } = runtimeOf("translation-pair", context);
+			const field = collection.translationGroupField;
+			if (field === null) return [];
+			const path = `/frontmatter${pointer([field])}`;
+			const group = isRecord$2(context.frontmatter) ? context.frontmatter[field] : void 0;
+			if (typeof group !== "string" || group === "") return [{
+				path,
+				message: `The entry has no translation group: its frontmatter field ${field} is empty.`,
+				fix: `Set ${field} in the frontmatter to the key that all the translations of this entry share, then create the entries for the locales of the site: ${site.locales.join(", ")}.`
+			}];
+			const found = await context.entries.translations(collection.name, group);
+			const present = /* @__PURE__ */ new Set([context.locale, ...found.map((entry) => entry.locale)]);
+			return site.locales.filter((locale) => !present.has(locale)).map((locale) => ({
+				path,
+				message: `The ${locale} version of the translation group ${quote$1(group)} does not exist.`,
+				fix: `Create the entry in ${locale} with ${field}: ${quote$1(group)} in its frontmatter before publishing.`
+			}));
+		}
+	}, { readsFrontmatter: true });
+}
+/**
+* Every link to another entry of the site points at an entry that is published, or at the entry
+* itself. All the targets are looked up in one call to `lookupMany`, and none when the body has no
+* link to another entry. Checked when publishing.
+*/
+function internalLinksResolve(options = {}) {
+	return registerBuiltIn({
+		id: "internal-links-resolve",
+		severity: options.severity ?? "error",
+		phases: ["publish"],
+		description: "Every link to another entry of the site points at a published entry. Checked when publishing.",
+		async check(context) {
+			const links = context.markdown.extracted.links.flatMap((link) => link.kind === "internal" && link.target !== void 0 && !isThisEntry(link.target, context) ? [{
+				link,
+				target: link.target
+			}] : []);
+			if (links.length === 0) return [];
+			const positions = /* @__PURE__ */ new Map();
+			const refs = [];
+			for (const { target } of links) {
+				const key = keyOf(target);
+				if (positions.has(key)) continue;
+				positions.set(key, refs.length);
+				refs.push({
+					collection: target.collection,
+					locale: target.locale,
+					slug: target.slug
+				});
+			}
+			const facts = await context.entries.lookupMany(refs);
+			const findings = [];
+			for (const { link, target } of links) {
+				const position = positions.get(keyOf(target));
+				const found = (position === void 0 ? void 0 : facts[position]) ?? null;
+				if (found?.status === "published") continue;
+				const entry = `the entry ${clip(`${target.collection}/${target.locale}/${target.slug}`)}`;
+				findings.push({
+					path: "/body",
+					message: found === null ? `The link ${quote$1(link.href)} points at ${entry}, which does not exist.` : `The link ${quote$1(link.href)} points at ${entry}, which is not published yet (${found.status}).`,
+					fix: found === null ? `Create and publish ${entry}, point the link at an entry that is published, or remove the link.` : `Publish ${entry} first, point the link at an entry that is published, or remove the link.`,
+					line: link.line
+				});
+			}
+			return findings;
+		}
+	}, { readsFrontmatter: false });
+}
+/** A key that tells two targets apart, whatever characters their names hold. */
+function keyOf(target) {
+	return JSON.stringify([
+		target.collection,
+		target.locale,
+		target.slug
+	]);
+}
+function isThisEntry(target, context) {
+	return target.collection === context.collection && target.locale === context.locale && target.slug === context.slug;
+}
+/** Every image has alt text. An alt of only spaces counts as none. Checked on every write. */
+function imagesHaveAlt(options = {}) {
+	return registerBuiltIn({
+		id: "images-have-alt",
+		severity: options.severity ?? "error",
+		phases: ["write", "publish"],
+		description: "Every image has alt text that describes it.",
+		check: (context) => context.markdown.extracted.images.filter((image) => image.alt.trim() === "").map((image) => ({
+			path: "/body",
+			message: `The image ${quote$1(image.src)} has no alt text.`,
+			fix: `Add alt text that describes the image, as in ![a short description](${clip(image.src)}).`,
+			line: image.line
+		}))
+	}, { readsFrontmatter: false });
+}
+/**
+* A contract of a site made of a yes or no question and the words to say when the answer is no.
+* One finding at most: a rule that reports several problems, or the line they are on, is a plain
+* `Contract` object, which can return as many findings as it wants.
+*
+* Inside `defineCollection`, TypeScript cannot infer the frontmatter type of a call like this one
+* (it can for a plain object): give it, as in `contracts.custom<{ title: string }>({ … })`.
+*/
+function custom(options) {
+	const text = (value, context) => typeof value === "function" ? value(context) : value;
+	return {
+		id: options.id,
+		severity: options.severity,
+		...options.phases === void 0 ? {} : { phases: options.phases },
+		description: options.description,
+		async check(context) {
+			if (await options.check(context)) return [];
+			return [{
+				path: options.path ?? "",
+				message: text(options.message, context),
+				fix: text(options.fix, context)
+			}];
+		}
+	};
+}
+const contracts = {
+	custom,
+	imagesHaveAlt,
+	internalLinksResolve,
+	translationPair
+};
+//#endregion
+//#region src/contracts/hash.ts
+/**
+* `contractsHash` (ADR-004): what a revision was checked against, in a short string. A stored
+* verdict says which rules it answered to, and a changed rule shows as another hash.
+*/
+/**
+* JSON with the keys of every object in order and no spaces, so that equal values always give
+* the same text. Arrays keep their order, which means something there. An `undefined` member is
+* left out, as `JSON.stringify` does.
+*/
+function canonicalJson(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+	if (typeof value === "object" && value !== null) return `{${Object.entries(value).filter(([, member]) => member !== void 0).toSorted(([left], [right]) => compareText(left, right)).map(([key, member]) => `${JSON.stringify(key)}:${canonicalJson(member)}`).join(",")}}`;
+	return JSON.stringify(value) ?? "null";
+}
+/** The SHA-256 of a text, in lowercase hex. */
+async function sha256Hex(text) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/**
+* The hash of the rules of a run: the input JSON Schema of the frontmatter and of each
+* component's props (`null` for one that does not convert), and the id, severity and phases of
+* every contract that was to run. Contracts go by id, so the order of the config does not matter,
+* and their descriptions are left out, because wording is no rule.
+*/
+function hashContracts(snapshot, contracts) {
+	return sha256Hex(canonicalJson({
+		components: Object.fromEntries(snapshot.components),
+		contracts: contracts.toSorted((left, right) => compareText(left.id, right.id)).map(({ id, phases, severity }) => ({
+			id,
+			phases,
+			severity
+		})),
+		frontmatter: snapshot.frontmatter
+	}));
+}
+//#endregion
+//#region src/contracts/run.ts
+/** The contracts after `schema` that a run has to run: the always-on ones, then the collection's own. */
+function contractsFor(collection, phase) {
+	const all = [...ALWAYS_ON_CONTRACTS, ...collection.contracts];
+	return phase === "publish" ? all : all.filter((contract) => contractPhases(contract).includes("write"));
+}
+/** Findings by line, then by path; one without a line comes first. The sort is stable. */
+function compareFindings(left, right) {
+	return (left.line ?? 0) - (right.line ?? 0) || compareText(left.path, right.path);
+}
+/**
+* The findings of one contract as violations of it, in order. A finding whose fix is empty, which
+* the type cannot rule out, gets the description of the rule instead, so that no violation ever
+* reaches an agent without something to do.
+*/
+function toViolations(contract, findings) {
+	return findings.toSorted(compareFindings).map((finding) => ({
+		contract: contract.id,
+		severity: contract.severity,
+		path: finding.path,
+		message: finding.message,
+		fix: finding.fix.trim() === "" ? `Change the entry so that the rule ${quote$1(contract.id)} passes: ${contract.description}` : finding.fix,
+		...finding.line === void 0 ? {} : { line: finding.line }
+	}));
+}
+function describeError(error) {
+	try {
+		return error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+	} catch {
+		return "an error that cannot be described";
+	}
+}
+/** What a contract that throws becomes: an error of that contract, and a fix for the maintainer. */
+function thrown(contract, error) {
+	return {
+		contract: contract.id,
+		severity: "error",
+		path: "",
+		message: `The contract ${quote$1(contract.id)} failed with an error while it checked this entry: ${clip(describeError(error), 200)}`,
+		fix: `This is a problem in the config of the site, not in the entry: report it to whoever maintains the config, naming the contract ${quote$1(contract.id)}.`
+	};
+}
+async function settle(contract, context) {
+	try {
+		return toViolations(contract, await contract.check(context));
+	} catch (error) {
+		return [thrown(contract, error)];
+	}
+}
+/** The schema's verdict on the frontmatter: whether it passed, what it returned and what it found. */
+async function validateFrontmatter(collection, markdown) {
+	try {
+		const check = await checkFrontmatter(collection, markdown.frontmatter);
+		return check.passed ? {
+			passed: true,
+			value: check.value,
+			violations: []
+		} : {
+			passed: false,
+			value: void 0,
+			violations: toViolations(SCHEMA_CONTRACT, check.findings)
+		};
+	} catch (error) {
+		return {
+			passed: false,
+			value: void 0,
+			violations: [thrown(SCHEMA_CONTRACT, error)]
+		};
+	}
+}
+/**
+* Runs the contracts of a collection on one revision (ADR-004).
+*
+* The `schema` contract goes first. The collection's own contracts, which read the frontmatter,
+* run only when it passed, and get what the schema returned; the built-in ones that do not need
+* it run anyway, so that one verdict lists as much as it can; the context of those has no
+* frontmatter (`undefined`) when the schema refused it. A contract that throws does not break
+* the run: it becomes an error of that contract.
+*
+* The violations come in a fixed order: the built-in contracts in their own order, then the
+* collection's in the order of its config, and the findings of each one by line and then by path.
+*/
+async function runContracts(input) {
+	const { site, collection, phase, markdown } = input;
+	const contracts = contractsFor(collection, phase);
+	const frontmatter = await validateFrontmatter(collection, markdown);
+	const context = Object.freeze({
+		site: site.key,
+		collection: collection.name,
+		locale: input.locale,
+		slug: input.slug,
+		entryId: input.entryId,
+		phase,
+		frontmatter: frontmatter.value,
+		markdown,
+		entries: input.entries
+	});
+	bindRuntime(context, {
+		site,
+		collection
+	});
+	const violations = [...frontmatter.violations];
+	for (const contract of contracts) {
+		if (!frontmatter.passed && readsFrontmatter(contract)) continue;
+		violations.push(...await settle(contract, context));
+	}
+	const errors = violations.filter((violation) => violation.severity === "error");
+	const warnings = violations.filter((violation) => violation.severity === "warning");
+	return {
+		ok: errors.length === 0,
+		phase,
+		errors,
+		warnings,
+		contractsHash: await hashContracts(schemaSnapshot(collection), [SCHEMA_CONTRACT, ...contracts].map((contract) => describeContract(contract)))
+	};
+}
+//#endregion
+//#region src/contracts/size.ts
+/**
+* The `size-limit` violation of the row that D1 holds, which the store checks against
+* `MAX_ROW_BYTES`. It points at the entry as a whole (the empty JSON Pointer), because what
+* counts is everything stored with it. The Markdown pipeline words its own `size-limit` for
+* `maxMarkdownBytes`, which names the file and the collection's limit.
+*
+* `bytes` is the size in UTF-8 bytes and `limit` the largest size accepted. Call it when `bytes`
+* is over `limit`.
+*/
+function sizeLimitViolation(bytes, limit) {
+	return {
+		contract: "size-limit",
+		severity: "error",
+		path: "",
+		message: `The entry takes ${bytes} bytes and the limit is ${limit} bytes.`,
+		fix: `Cut at least ${bytes - limit} bytes: shorten the text, drop what is not essential or split it into several entries.`
+	};
+}
+//#endregion
+//#region src/contracts/unique.ts
+/**
+* The violations of a write that the store refuses because another entry of the same collection
+* and locale holds what has to be unique there: the slug, or the translation group. `holder` is
+* the id of that entry. Like `sizeLimitViolation`, they make the write `refused`, and every such
+* refusal reads the same.
+*/
+/** Another entry of the collection and locale has the slug. The slug is no field of the file. */
+function uniqueSlugViolation(holder) {
+	return {
+		contract: "unique-slug",
+		severity: "error",
+		path: "",
+		message: `Another entry of this collection and locale, ${holder}, already has this slug.`,
+		fix: `Choose another slug, or change the entry ${holder} with update_draft.`
+	};
+}
+/** Another entry of the collection and locale belongs to the translation group in `field`. */
+function uniqueTranslationViolation(holder, field) {
+	return {
+		contract: "unique-translation",
+		severity: "error",
+		path: `/frontmatter${pointer([field])}`,
+		message: `Another entry of this collection and locale, ${holder}, already belongs to this translation group.`,
+		fix: `Give ${quote$1(field)} another value, or change the entry ${holder} with update_draft: a translation group holds one entry per locale.`
+	};
+}
+//#endregion
+//#region src/config/values.ts
+/** A value with keys: not null, not an array. */
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** A string as the messages show it: quoted, with what could break a line escaped. */
+function quote(text) {
+	return JSON.stringify(text);
+}
+/** Text of an error that someone else wrote, on one line, so that a problem stays one line. */
+function oneLine(text) {
+	return text.replace(/\s+/g, " ").trim();
+}
+/** What a value is, for a message: `"es"`, `42`, `null`, `an array`. */
+function found(value) {
+	if (value === null) return "null";
+	switch (typeof value) {
+		case "string": return quote(value);
+		case "number":
+		case "boolean":
+		case "bigint": return String(value);
+		case "function": return "a function";
+		case "symbol": return "a symbol";
+		default: return Array.isArray(value) ? "an array" : "an object";
+	}
+}
+/** `is 42; it must be a string`, or `is missing; …` when the value is not there. */
+function wrongType(value, expected) {
+	return `${value === void 0 ? "is missing" : `is ${found(value)}`}; it must be ${expected}`;
+}
+/** An optional string: `null` when it is absent, and a problem when it is anything else. */
+function readOptionalString(path, value, fix, problems) {
+	if (value === void 0) return null;
+	if (typeof value === "string") return value;
+	problems.add(path, wrongType(value, "a string"), fix);
+	return null;
+}
+const PLAIN_KEY = /^[A-Za-z0-9_-]+$/;
+/** The path of a key inside `parent`: `sites.demo`, or `sites["my site"]` for an odd key. */
+function keyPath(parent, key) {
+	return PLAIN_KEY.test(key) ? `${parent}.${key}` : `${parent}[${quote(key)}]`;
+}
+/** The path of an item of an array: `sites.demo.locales[1]`. */
+function itemPath(parent, index) {
+	return `${parent}[${index}]`;
+}
+//#endregion
+//#region src/config/json-schema.ts
+/**
+* JSON Schema as the config uses it: what agents see of a schema, and what the checks read of it
+* (which fields exist, of what type, whether an object rejects unknown keys).
+*/
+/** The dialect agents read. */
+const TARGET = "draft-2020-12";
+/**
+* The JSON Schema that a schema accepts as input, as plain JSON data. It throws what the library
+* throws when the schema has no JSON Schema (Zod: `z.date()`, `z.custom()`).
+*/
+function toJsonSchema(schema) {
+	const converted = schema["~standard"].jsonSchema.input({ target: TARGET });
+	if (!isRecord$1(converted)) throw new TypeError(`the library ${wrongType(converted, "a JSON Schema object")}`);
+	return JSON.parse(JSON.stringify(converted));
+}
+/** Reference chains longer than this are cycles. */
+const MAX_REF_HOPS = 16;
+/** What a local reference (`#` or `#/$defs/Name`) points to inside `root`, or `undefined`. */
+function pointTo(root, ref) {
+	if (ref === "#") return root;
+	if (!ref.startsWith("#/")) return void 0;
+	let node = root;
+	for (const part of ref.slice(2).split("/")) {
+		const key = part.replaceAll("~1", "/").replaceAll("~0", "~");
+		if (!isRecord$1(node) || !Object.hasOwn(node, key)) return void 0;
+		node = node[key];
+	}
+	return node;
+}
+/**
+* The schema itself, or the one that its local `$ref`s lead to (Zod writes `$ref` for a schema
+* with an `id`, and for a recursive one); `null` when there is none.
+*/
+function resolveSchema(root, schema) {
+	let node = schema;
+	for (let hop = 0; hop <= MAX_REF_HOPS; hop += 1) {
+		if (!isRecord$1(node)) return null;
+		const ref = node["$ref"];
+		if (typeof ref !== "string") return node;
+		node = pointTo(root, ref);
+	}
+	return null;
+}
+function typeLabel(node) {
+	const type = node["type"];
+	if (typeof type === "string") return type;
+	if (Array.isArray(type)) {
+		const names = type.filter((name) => typeof name === "string");
+		if (names.length > 0) return names.join(" or ");
+	}
+	return Array.isArray(node["anyOf"]) || Array.isArray(node["oneOf"]) ? "a union" : "any value";
+}
+/** The type of a schema in words, for a message: `string`, `string or null`, `an array of number`. */
+function describeShape(root, schema) {
+	const node = resolveSchema(root, schema);
+	if (node === null) return "an unresolvable reference";
+	if (node["type"] !== "array") return typeLabel(node);
+	const items = resolveSchema(root, node["items"]);
+	return `an array of ${items === null ? "any value" : typeLabel(items)}`;
+}
+/** A string: the value of the field is text. */
+function isStringSchema(root, schema) {
+	return resolveSchema(root, schema)?.["type"] === "string";
+}
+/** An array whose items are strings. */
+function isStringArraySchema(root, schema) {
+	const node = resolveSchema(root, schema);
+	return node?.["type"] === "array" && isStringSchema(root, node["items"]);
+}
+/**
+* A string with the format `date` or `date-time`, which is what proves that it is ISO 8601 and
+* sorts by time (Zod: `z.iso.date()` and `z.iso.datetime()`). A string that only has a pattern
+* does not count.
+*/
+function isDateSchema(root, schema) {
+	const node = resolveSchema(root, schema);
+	return node?.["type"] === "string" && (node["format"] === "date" || node["format"] === "date-time");
+}
+//#endregion
+//#region src/config/describe.ts
+/** What a call without built-in contracts memoizes under. */
+const NO_BUILT_IN = [];
+function describeCollection(collection, builtIn) {
+	return {
+		name: collection.name,
+		schema: toJsonSchema(collection.schema),
+		routes: { ...collection.routes },
+		translationGroupField: collection.translationGroupField,
+		tagsField: collection.tagsField,
+		sortByField: collection.sortByField,
+		components: [...collection.components].map(([name, component]) => ({
+			name,
+			description: component.description ?? null,
+			example: component.example ?? null,
+			props: toJsonSchema(component.props)
+		})),
+		contracts: [...builtIn, ...collection.contracts].map((contract) => describeContract(contract)),
+		maxMarkdownBytes: collection.maxMarkdownBytes,
+		styleGuide: collection.styleGuide
+	};
+}
+/** Freezes the value and everything inside it, so that a caller cannot change what is shared. */
+function deepFreeze(value) {
+	if (typeof value === "object" && value !== null && !Object.isFrozen(value)) {
+		Object.freeze(value);
+		for (const inner of Object.values(value)) deepFreeze(inner);
+	}
+	return value;
+}
+/** Descriptions by site, then by the array of built-in contracts they were made with. */
+const descriptions = /* @__PURE__ */ new WeakMap();
+/**
+* What an agent reads before it writes: for each collection, the JSON Schema of the frontmatter
+* (draft 2020-12, as the schema accepts it) and of each component's props, the routes, the
+* fields (the translation group, the tags and the sorting field), the contracts and the style
+* guides. `builtInContracts` are described before the collection's own ones.
+*
+* Converting the schemas costs about 1.4 ms for a realistic site, so the description is made once
+* per site and per array of built-in contracts (pass the same array every time), and every call
+* after that returns the same object, which is frozen because it is shared by every request of
+* the isolate. Collections, components and contracts come in the order of the config.
+*/
+function describeResolvedSite(site, options = {}) {
+	const builtIn = options.builtInContracts ?? NO_BUILT_IN;
+	let bySite = descriptions.get(site);
+	if (bySite === void 0) {
+		bySite = /* @__PURE__ */ new WeakMap();
+		descriptions.set(site, bySite);
+	}
+	let description = bySite.get(builtIn);
+	if (description === void 0) {
+		description = deepFreeze({
+			key: site.key,
+			locales: [...site.locales],
+			defaultLocale: site.defaultLocale,
+			styleGuide: site.styleGuide,
+			collections: [...site.collections.values()].map((collection) => describeCollection(collection, builtIn))
+		});
+		bySite.set(builtIn, description);
+	}
+	return description;
+}
+//#endregion
+//#region src/config/collection.ts
+const RESERVED = new Set(BUILT_IN_CONTRACT_IDS);
+const SCHEMA_FIX = "Use a schema from a library that implements Standard Schema and Standard JSON Schema, such as zod 4.2 or later.";
+function standardProps(value) {
+	return typeof value === "object" && value !== null || typeof value === "function" ? Reflect.get(value, "~standard") : void 0;
+}
+/** A Standard Schema that also converts to JSON Schema, which is what a collection needs. */
+function isDescribedSchema(value) {
+	const standard = standardProps(value);
+	if (!isRecord$1(standard) || typeof standard["validate"] !== "function") return false;
+	const converter = standard["jsonSchema"];
+	return isRecord$1(converter) && typeof converter["input"] === "function";
+}
+/** What `isDescribedSchema` found missing, for the message. */
+function whyNotDescribed(value) {
+	const standard = standardProps(value);
+	if (!isRecord$1(standard)) return wrongType(value, "a Standard Schema with JSON Schema");
+	if (typeof standard["validate"] !== "function") return "has no ~standard.validate function, so it is no Standard Schema";
+	return "has no ~standard.jsonSchema.input function, so describe_site could not show it to agents";
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/**
+* The schema of a collection's frontmatter, or of a component's props, once it is known to
+* convert to the JSON Schema of an object. Props must also reject the keys they do not declare.
+*/
+function readSchema(path, raw, kind, problems) {
+	if (!isDescribedSchema(raw)) {
+		problems.add(path, whyNotDescribed(raw), SCHEMA_FIX);
+		return null;
+	}
+	let document;
+	try {
+		document = toJsonSchema(raw);
+	} catch (error) {
+		problems.add(path, `cannot be converted to JSON Schema (${oneLine(errorMessage(error))})`, "Remove what JSON Schema cannot express, such as z.date() (use z.iso.date() for dates), z.custom() or z.map(), so that agents can read the schema.");
+		return null;
+	}
+	const object = resolveSchema(document, document);
+	if (object?.["type"] !== "object") {
+		problems.add(path, `describes ${describeShape(document, document)} instead of an object`, kind === "props" ? "Declare the props as an object, such as z.strictObject({ type: z.enum([\"info\", \"tip\"]) })." : "Declare the frontmatter as an object, such as z.object({ title: z.string() }).");
+		return null;
+	}
+	if (kind === "props" && object["additionalProperties"] !== false) {
+		problems.add(path, "accepts props it does not declare, because its JSON Schema does not set additionalProperties to false", "Declare the props with z.strictObject({ … }) instead of z.object({ … }), or with the strict object of your validation library, so that a prop the component does not declare is an error.");
+		return null;
+	}
+	return {
+		schema: raw,
+		document,
+		object
+	};
+}
+const ROUTES_FIX = "Add one route per locale, such as routes: { es: \"/blog/:slug/\", en: \"/en/blog/:slug/\" }.";
+/**
+* Where the slug of the entry goes in a route; `:slugs` is another placeholder, not this one. It is
+* global because `matchAll` needs that, and `matchAll` works on a copy, so nothing is shared.
+*/
+const SLUG_PLACEHOLDER = /:slug(?![A-Za-z0-9_])/g;
+/** Reports what is wrong with the shape of a route; true when nothing is. */
+function isRoutePattern(path, route, problems) {
+	let valid = true;
+	if (!route.startsWith("/")) {
+		problems.add(path, `${quote(route)} does not start with "/"`, "Write the path from the root of the site, such as \"/blog/:slug/\".");
+		valid = false;
+	}
+	const slugs = [...route.matchAll(SLUG_PLACEHOLDER)].length;
+	if (slugs !== 1) {
+		problems.add(path, slugs === 0 ? `${quote(route)} has no :slug` : `${quote(route)} has :slug ${slugs} times`, "Use :slug exactly once, where the slug of the entry goes, such as \"/blog/:slug/\".");
+		valid = false;
+	}
+	return valid;
+}
+/** Takes a route for the site, or reports the route that already has the same pattern. */
+function claimRoute(route, path, site, problems) {
+	const pattern = route.endsWith("/") ? route.slice(0, -1) : route;
+	const owner = site.routes.get(pattern);
+	if (owner === void 0) {
+		site.routes.set(pattern, path);
+		return;
+	}
+	problems.add(path, `${quote(route)} is the same pattern as the route at ${owner}`, "Give every route of the site its own path: internal links are matched against them.");
+}
+/** The route of each locale, in the order of the site's locales. */
+function readRoutes(path, raw, collection, site, problems) {
+	if (!isRecord$1(raw)) {
+		problems.add(path, wrongType(raw, "an object with one path per locale"), ROUTES_FIX);
+		return {};
+	}
+	for (const locale of Object.keys(raw)) {
+		const routePath = keyPath(path, locale);
+		const route = raw[locale];
+		const known = !site.localesOk || site.locales.includes(locale);
+		if (!known) problems.add(routePath, `is a route for ${quote(locale)}, which is not a locale of the site (${site.locales.join(", ")})`, `Remove it, or add ${quote(locale)} to the locales of the site.`);
+		if (typeof route !== "string") problems.add(routePath, wrongType(route, "a path such as \"/blog/:slug/\""), ROUTES_FIX);
+		else if (isRoutePattern(routePath, route, problems) && known) claimRoute(route, routePath, site, problems);
+	}
+	if (site.localesOk) {
+		for (const locale of site.locales) if (!Object.hasOwn(raw, locale)) problems.add(path, `has no route for the locale ${quote(locale)}`, `Add ${keyPath("routes", locale)}, a path such as ${quote(`/${locale}/${collection}/:slug/`)}.`);
+	}
+	const routes = {};
+	for (const locale of site.locales) {
+		const route = raw[locale];
+		if (typeof route === "string") routes[locale] = route;
+	}
+	return routes;
+}
+const GROUP_BY = {
+	mustBe: "a string",
+	accepts: isStringSchema,
+	fix: (field) => `Declare ${quote(field)} as z.string() in the schema, or name another field.`
+};
+const TAGS = {
+	mustBe: "an array of strings",
+	accepts: isStringArraySchema,
+	fix: (field) => `Declare ${quote(field)} as z.array(z.string()) in the schema, or name another field.`
+};
+/**
+* Listings sort by this field as text, which is chronological only for ISO 8601 dates. A string
+* that is not declared with the `date` or `date-time` format may be anything, so it is refused.
+*/
+const SORT_BY = {
+	mustBe: "a string with the \"date\" or \"date-time\" format",
+	accepts: isDateSchema,
+	fix: (field) => `Declare ${quote(field)} as z.iso.date() or z.iso.datetime() in the schema, or name another field.`
+};
+/** The name of a field of the frontmatter, checked against the schema when there is one. */
+function readField(path, raw, schema, kind, problems) {
+	if (typeof raw !== "string" || raw === "") {
+		problems.add(path, wrongType(raw, "the name of a frontmatter field"), "Set it to the name of a field of the frontmatter schema, or remove it.");
+		return null;
+	}
+	if (schema === null) return raw;
+	const properties = isRecord$1(schema.object["properties"]) ? schema.object["properties"] : {};
+	if (!Object.hasOwn(properties, raw)) {
+		const names = Object.keys(properties);
+		problems.add(path, `${quote(raw)} is not a property of the schema${names.length === 0 ? ", which declares none" : ` (its properties are ${names.map(quote).join(", ")})`}`, `Name a field that the schema declares, or add ${quote(raw)} to the schema.`);
+	} else if (!kind.accepts(schema.document, properties[raw])) problems.add(path, `${quote(raw)} is declared as ${describeShape(schema.document, properties[raw])}, but it must be ${kind.mustBe}`, kind.fix(raw));
+	return raw;
+}
+function readTranslations(path, raw, schema, problems) {
+	if (raw === void 0) return null;
+	if (!isRecord$1(raw)) {
+		problems.add(path, wrongType(raw, "an object like { groupBy: \"translationGroup\" }"), "Set it to { groupBy: \"<field>\" }, the field of the frontmatter that holds the key the translations of an entry share, or remove it.");
+		return null;
+	}
+	return readField(keyPath(path, "groupBy"), raw["groupBy"], schema, GROUP_BY, problems);
+}
+const COMPONENT_FIX = "Declare it with defineComponent({ props: z.strictObject({ … }) }).";
+function readComponent(path, name, raw, problems) {
+	if (!NAME.test(name)) problems.add(path, `${quote(name)} is not a valid component name`, nameFix("callout"));
+	if (!isRecord$1(raw)) {
+		problems.add(path, wrongType(raw, "a component"), COMPONENT_FIX);
+		return null;
+	}
+	const props = readSchema(keyPath(path, "props"), raw["props"], "props", problems);
+	const textFix = "Write it as a string, or remove it.";
+	const description = readOptionalString(keyPath(path, "description"), raw["description"], textFix, problems);
+	const example = readOptionalString(keyPath(path, "example"), raw["example"], textFix, problems);
+	if (props === null) return null;
+	return {
+		props: props.schema,
+		...description === null ? {} : { description },
+		...example === null ? {} : { example }
+	};
+}
+function readComponents(path, raw, problems) {
+	const components = /* @__PURE__ */ new Map();
+	if (raw === void 0) return components;
+	if (!isRecord$1(raw)) {
+		problems.add(path, wrongType(raw, "an object that maps each component name to its definition"), COMPONENT_FIX);
+		return components;
+	}
+	for (const name of Object.keys(raw)) {
+		const component = readComponent(keyPath(path, name), name, raw[name], problems);
+		if (component !== null) components.set(name, component);
+	}
+	return components;
+}
+function isSeverity(value) {
+	return value === "error" || value === "warning";
+}
+function isPhase(value) {
+	return value === "write" || value === "publish";
+}
+const PHASES_FIX = "Use \"write\" (create_draft and update_draft), \"publish\" (validate and publish) or both, or remove phases to run in both.";
+function checkPhases(path, raw, problems) {
+	if (raw === void 0) return;
+	if (!Array.isArray(raw)) {
+		problems.add(path, wrongType(raw, "an array of \"write\" and \"publish\""), PHASES_FIX);
+		return;
+	}
+	if (raw.length === 0) {
+		problems.add(path, "is empty, so the contract would never run", PHASES_FIX);
+		return;
+	}
+	const seen = /* @__PURE__ */ new Set();
+	const phases = raw;
+	for (let index = 0; index < phases.length; index += 1) {
+		const phase = phases[index];
+		if (!isPhase(phase)) problems.add(itemPath(path, index), wrongType(phase, "\"write\" or \"publish\""), PHASES_FIX);
+		else if (seen.has(phase)) problems.add(itemPath(path, index), `repeats ${quote(phase)}`, PHASES_FIX);
+		seen.add(phase);
+	}
+}
+/**
+* Reports every problem with the shape of one contract and says whether it has none, which is
+* what makes it a `Contract`. Whether it may have its id is a question for `checkIdentity`.
+*/
+function isContract(item, path, problems) {
+	if (!isRecord$1(item)) {
+		problems.add(path, wrongType(item, "a contract"), "Write it as { id, severity, description, check }.");
+		return false;
+	}
+	const before = problems.list.length;
+	const id = item["id"];
+	if (typeof id !== "string" || !CONTRACT_ID.test(id)) problems.add(keyPath(path, "id"), wrongType(id, "lowercase words joined by hyphens, such as \"seo-title-length\""), "Name the rule with lowercase words joined by hyphens.");
+	if (!isSeverity(item["severity"])) problems.add(keyPath(path, "severity"), wrongType(item["severity"], "\"error\" or \"warning\""), "Use \"error\" for a rule that blocks publishing and \"warning\" for one that publishing asks to acknowledge.");
+	checkPhases(keyPath(path, "phases"), item["phases"], problems);
+	const description = item["description"];
+	if (typeof description !== "string" || description.trim() === "") problems.add(keyPath(path, "description"), wrongType(description, "a sentence that says what the rule asks for"), "Describe the rule for the agent that has to follow it.");
+	if (typeof item["check"] !== "function") problems.add(keyPath(path, "check"), wrongType(item["check"], "a function that returns the problems it finds"), "Add check(context), which returns a list of problems, empty when the content passes.");
+	return problems.list.length === before;
+}
+/**
+* Whether a contract may have its id: the id of a built-in contract only when Hollware made the
+* contract (`contracts.translationPair()`, which is `own`), and no id that another contract of the
+* collection has. `ids` holds the contracts seen so far, by id. A contract that Hollware did not
+* make, such as a plain object with the id `translation-pair`, would be taken for the real one in
+* a verdict.
+*/
+function checkIdentity(id, own, path, ids, problems) {
+	if (RESERVED.has(id) && !own) {
+		problems.add(keyPath(path, "id"), `${quote(id)} is the id of a built-in contract`, `Choose another id: ${BUILT_IN_CONTRACT_IDS.join(", ")} belong to Hollware's built-in contracts, and the opt-in ones are listed as contracts.translationPair(), contracts.internalLinksResolve() and contracts.imagesHaveAlt().`);
+		return;
+	}
+	const first = ids.get(id);
+	if (first === void 0) {
+		ids.set(id, path);
+		return;
+	}
+	problems.add(keyPath(path, "id"), `${quote(id)} is already the id of the contract at ${first}`, "Give every contract of the collection its own id.");
+}
+function readContracts(path, raw, problems) {
+	const contracts = [];
+	if (raw === void 0) return contracts;
+	if (!Array.isArray(raw)) {
+		problems.add(path, wrongType(raw, "an array of contracts"), "Write it as [{ id, severity, description, check }, …].");
+		return contracts;
+	}
+	const ids = /* @__PURE__ */ new Map();
+	const items = raw;
+	for (let index = 0; index < items.length; index += 1) {
+		const item = items[index];
+		const itemAt = itemPath(path, index);
+		if (isContract(item, itemAt, problems)) {
+			checkIdentity(item.id, isBuiltInContract(item), itemAt, ids, problems);
+			contracts.push(item);
+		} else if (isRecord$1(item) && typeof item["id"] === "string" && CONTRACT_ID.test(item["id"])) checkIdentity(item["id"], false, itemAt, ids, problems);
+	}
+	return contracts;
+}
+function readMaxMarkdownBytes(path, raw, problems) {
+	if (raw === void 0) return DEFAULT_MAX_MARKDOWN_BYTES;
+	if (typeof raw === "number" && Number.isInteger(raw) && raw >= 1 && raw <= 786432) return raw;
+	problems.add(path, wrongType(raw, `an integer from 1 to ${MAX_MARKDOWN_BYTES_CEILING}`), `Set a size in bytes from 1 to ${MAX_MARKDOWN_BYTES_CEILING} (768 KiB), or remove it for the default of ${DEFAULT_MAX_MARKDOWN_BYTES} (512 KiB): a revision row is about 2.3 times the file and the store refuses rows over 1.9 MB, so a larger file could never be saved.`);
+	return DEFAULT_MAX_MARKDOWN_BYTES;
+}
+/**
+* Checks one collection and fills in its defaults. `null` when its schema is unusable, which is a
+* problem already: `resolveConfig` throws when there is any, so nothing else keeps track of them.
+*/
+function readCollection(path, name, raw, site, problems) {
+	if (!NAME.test(name)) problems.add(path, `${quote(name)} is not a valid collection name`, nameFix("blog"));
+	if (!isRecord$1(raw)) {
+		problems.add(path, wrongType(raw, "a collection"), "Declare it with defineCollection({ schema, routes, … }).");
+		return null;
+	}
+	const schema = readSchema(keyPath(path, "schema"), raw["schema"], "frontmatter", problems);
+	const routes = readRoutes(keyPath(path, "routes"), raw["routes"], name, site, problems);
+	const translationGroupField = readTranslations(keyPath(path, "translations"), raw["translations"], schema, problems);
+	const tagsField = raw["tags"] === void 0 ? null : readField(keyPath(path, "tags"), raw["tags"], schema, TAGS, problems);
+	const sortByField = raw["sortBy"] === void 0 ? null : readField(keyPath(path, "sortBy"), raw["sortBy"], schema, SORT_BY, problems);
+	const components = readComponents(keyPath(path, "components"), raw["components"], problems);
+	const contracts = readContracts(keyPath(path, "contracts"), raw["contracts"], problems);
+	const maxMarkdownBytes = readMaxMarkdownBytes(keyPath(path, "maxMarkdownBytes"), raw["maxMarkdownBytes"], problems);
+	const styleGuide = readOptionalString(keyPath(path, "styleGuide"), raw["styleGuide"], "Write the guidance as a Markdown string, or remove it.", problems);
+	if (schema === null) return null;
+	return {
+		name,
+		schema: schema.schema,
+		routes,
+		translationGroupField,
+		tagsField,
+		sortByField,
+		components,
+		contracts,
+		maxMarkdownBytes,
+		styleGuide
+	};
+}
+//#endregion
+//#region src/config/site-key.ts
+/**
+* The key of a site, which is the id of its row in the database: lowercase letters and digits
+* joined by single hyphens (`blog`, `docs-2`, `acme-eu`), from 1 to `SITE_KEY_MAX_LENGTH`
+* characters. It is the rule of the CLI, which can import it, so that a key the CLI writes is a
+* key the config accepts.
+*/
+const SITE_KEY_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/** The longest a site key can be. */
+const SITE_KEY_MAX_LENGTH = 64;
+/** Whether a value is a site key: a string that fits `SITE_KEY_PATTERN` and is not too long. */
+function isSiteKey(value) {
+	return typeof value === "string" && value.length <= 64 && SITE_KEY_PATTERN.test(value);
+}
+//#endregion
+//#region src/config/resolve.ts
+const SITE_FIX = "Declare one site: sites: { \"my-site\": { locales: [\"en\"], defaultLocale: \"en\", collections: { … } } }.";
+const SITE_KEY_FIX = `Use lowercase letters and digits joined by single hyphens, from 1 to 64 characters, such as "my-site".`;
+const LOCALE_FIX = "Write a language, then a region if you need one: \"es\", \"en\" or \"pt-BR\" (lowercase language, uppercase region).";
+/** The locales of a site, and whether they are fit to check the routes against. */
+function readLocales(path, raw, problems) {
+	if (!Array.isArray(raw)) {
+		problems.add(path, wrongType(raw, "an array of language tags"), "List the languages of the site, such as [\"es\", \"en\"].");
+		return {
+			locales: [],
+			ok: false
+		};
+	}
+	if (raw.length === 0) {
+		problems.add(path, "is empty", "List at least one language tag, such as [\"en\"].");
+		return {
+			locales: [],
+			ok: false
+		};
+	}
+	const locales = [];
+	const firstAt = /* @__PURE__ */ new Map();
+	const tags = raw;
+	let ok = true;
+	for (let index = 0; index < tags.length; index += 1) {
+		const tag = tags[index];
+		const tagPath = itemPath(path, index);
+		if (typeof tag !== "string") {
+			problems.add(tagPath, wrongType(tag, "a language tag"), LOCALE_FIX);
+			ok = false;
+			continue;
+		}
+		locales.push(tag);
+		if (!LOCALE_TAG.test(tag)) {
+			problems.add(tagPath, `${quote(tag)} is not a language tag`, LOCALE_FIX);
+			ok = false;
+			continue;
+		}
+		const first = firstAt.get(tag);
+		if (first === void 0) firstAt.set(tag, index);
+		else {
+			problems.add(tagPath, `${quote(tag)} is already listed at ${itemPath(path, first)}`, "List each locale once.");
+			ok = false;
+		}
+	}
+	return {
+		locales,
+		ok
+	};
+}
+function readDefaultLocale(path, raw, locales, problems) {
+	if (typeof raw !== "string") {
+		problems.add(path, wrongType(raw, "one of the locales"), "Set it to the main language of the site, one of its locales.");
+		return "";
+	}
+	if (locales.length > 0 && !locales.includes(raw)) problems.add(path, `is ${quote(raw)}, which is not one of the locales (${locales.map(quote).join(", ")})`, `Set it to one of ${locales.map(quote).join(", ")}, or add ${quote(raw)} to locales.`);
+	return raw;
+}
+const COLLECTIONS_FIX = "Declare at least one: collections: { blog: defineCollection({ schema, routes }) }.";
+function readCollections(path, raw, site, problems) {
+	const collections = /* @__PURE__ */ new Map();
+	if (!isRecord$1(raw)) {
+		problems.add(path, wrongType(raw, "an object that maps each collection name to its collection"), COLLECTIONS_FIX);
+		return collections;
+	}
+	const names = Object.keys(raw);
+	if (names.length === 0) problems.add(path, "has no collection", COLLECTIONS_FIX);
+	for (const name of names) {
+		const collection = readCollection(keyPath(path, name), name, raw[name], site, problems);
+		if (collection !== null) collections.set(name, collection);
+	}
+	return collections;
+}
+/** Checks one site; `null` when it is no object, which is a problem already. */
+function readSite(key, raw, problems) {
+	const path = keyPath("sites", key);
+	if (!isSiteKey(key)) problems.add(path, `${quote(key)} is not a valid site key`, SITE_KEY_FIX);
+	if (!isRecord$1(raw)) {
+		problems.add(path, wrongType(raw, "a site"), "Declare it as { locales: [\"en\"], defaultLocale: \"en\", collections: { … } }.");
+		return null;
+	}
+	const { locales, ok } = readLocales(keyPath(path, "locales"), raw["locales"], problems);
+	const defaultLocale = readDefaultLocale(keyPath(path, "defaultLocale"), raw["defaultLocale"], locales, problems);
+	const collections = readCollections(keyPath(path, "collections"), raw["collections"], {
+		path,
+		locales,
+		localesOk: ok,
+		routes: /* @__PURE__ */ new Map()
+	}, problems);
+	return {
+		key,
+		locales,
+		defaultLocale,
+		styleGuide: readOptionalString(keyPath(path, "styleGuide"), raw["styleGuide"], "Write the guidance as a Markdown string, or remove it.", problems),
+		collections
+	};
+}
+function readSites(raw, problems) {
+	const sites = /* @__PURE__ */ new Map();
+	if (!isRecord$1(raw)) {
+		problems.add("sites", wrongType(raw, "an object that maps the site key to the site"), SITE_FIX);
+		return sites;
+	}
+	const keys = Object.keys(raw);
+	if (keys.length === 0) problems.add("sites", "has no site, and v0.1 serves exactly one site per deployment", SITE_FIX);
+	else if (keys.length > 1) problems.add("sites", `has ${keys.length} sites (${keys.map(quote).join(", ")}), and v0.1 serves exactly one site per deployment`, "Keep exactly one site in sites.");
+	for (const key of keys) {
+		const site = readSite(key, raw[key], problems);
+		if (site !== null) sites.set(key, site);
+	}
+	return sites;
+}
+/**
+* Checks the config of the deployment and fills in its defaults, or throws a `ConfigError` with
+* every problem it found, so that a broken `hollware.config.ts` stops the Worker at startup with
+* a message that says what to change. v0.1 serves exactly one site per deployment.
+*
+* The parameter is `unknown` because the config comes from user code that may be plain
+* JavaScript; a `HollwareConfig` is accepted as is, so this is a `ResolveConfig`. Notes on the
+* rules:
+*
+* - A site key is lowercase letters and digits joined by single hyphens, from 1 to 64 characters
+*   (`isSiteKey`, the rule of the CLI). A collection name and a component name are lowercase
+*   letters, digits and hyphens, starting with a letter, at most 63 characters. A contract id is
+*   lowercase words joined by single hyphens, and the id of a built-in contract
+*   (`BUILT_IN_CONTRACT_IDS`) is taken only by a contract that Hollware made (`isBuiltInContract`:
+*   `contracts.translationPair()` and the like), once.
+* - Each locale is a language tag with an optional script and region (`es`, `pt-BR`,
+*   `zh-Hant-TW`). Routes are checked against the locales only when the locales are valid.
+* - A route has `:slug` once. Two routes of the site are the same pattern when they differ at
+*   most by a trailing slash; patterns that overlap without being equal are not detected.
+* - `translations.groupBy`, `tags` and `sortBy` name properties of the frontmatter's JSON Schema
+*   (as agents see it, so `$ref`s are followed). `groupBy` is a string, `tags` an array of
+*   strings and `sortBy` a string with the `date` or `date-time` format: a plain string does not
+*   prove that the listing sorts by time. None may be nullable, and each may be optional.
+* - Collections, components and contracts keep the order of the config; each collection's routes
+*   come out in the order of the site's locales.
+*/
+function resolveConfig(config) {
+	const problems = new Problems();
+	let sites = /* @__PURE__ */ new Map();
+	if (isRecord$1(config)) sites = readSites(config["sites"], problems);
+	else problems.add("config", wrongType(config, "an object"), "Export the result of defineConfig({ sites: { … } }) from hollware.config.ts.");
+	if (problems.list.length > 0) throw new ConfigError(problems.list);
+	return { sites };
+}
+//#endregion
+//#region src/errors.ts
+/**
+* The errors of an operation that are none of its outcomes: the caller asked for something it
+* cannot have, or the server could not answer. Conflicts, missing entries and blocked publishes
+* are outcomes, not errors (`operations/specs.ts`).
+*/
+const ERROR_CODES = [
+	"invalid_input",
+	"unknown_collection",
+	"unknown_locale",
+	"insufficient_scope",
+	"output_too_large",
+	"timeout",
+	"internal"
+];
+/**
+* An error that the caller sees: a code, a message for the agent and a fix it can act on. The
+* cause, when there is one, is for the log only and never reaches the caller.
+*/
+var HollwareError = class extends Error {
+	name = "HollwareError";
+	code;
+	fix;
+	constructor(code, message, fix, options) {
+		super(message, options);
+		this.code = code;
+		this.fix = fix;
+	}
+};
+//#endregion
+//#region src/ids.ts
+/**
+* Identifiers: a prefix that names the kind of thing, an underscore, and a ULID (48 bits of
+* time in milliseconds, then 80 random bits, in Crockford's base 32), so that ids of one kind
+* sort by creation time. For example `ent_01JAB3XQ8ZK4M6N2P5R7S9T0VW`.
+*/
+const CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+/** The kinds of ids and their prefixes. A new kind adds its prefix here. */
+const ID_PREFIXES = {
+	entry: "ent",
+	publication: "pub",
+	revision: "rev",
+	revisionTag: "tag",
+	token: "tok",
+	user: "usr"
+};
+const LARGEST_TIME = 2 ** 48 - 1;
+/**
+* A ULID for the given time and 10 random bytes. Both default to now and to fresh randomness
+* from `crypto.getRandomValues`; tests pass their own.
+*/
+function ulid(time = Date.now(), random = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(10))) {
+	if (!Number.isInteger(time) || time < 0 || time > LARGEST_TIME) throw new RangeError(`a ULID time is a whole number of milliseconds from 0 to 2^48 - 1, got ${time}`);
+	if (random.length !== 10) throw new RangeError(`a ULID takes 10 random bytes, got ${random.length}`);
+	let timePart = "";
+	let rest = time;
+	for (let i = 0; i < 10; i += 1) {
+		timePart = CROCKFORD.charAt(rest % 32) + timePart;
+		rest = Math.floor(rest / 32);
+	}
+	let randomPart = "";
+	let buffer = 0;
+	let bits = 0;
+	for (const byte of random) {
+		buffer = buffer << 8 | byte;
+		bits += 8;
+		while (bits >= 5) {
+			bits -= 5;
+			randomPart += CROCKFORD.charAt(buffer >>> bits & 31);
+		}
+		buffer &= (1 << bits) - 1;
+	}
+	return timePart + randomPart;
+}
+/** A new id of the given kind: `newId('ent')` → `ent_01JAB…`. */
+function newId(prefix) {
+	return `${prefix}_${ulid()}`;
+}
+const ID_PATTERN = /^([a-z]{3})_[0-9A-HJKMNP-TV-Z]{26}$/;
+/** Whether a string is an id of the given kind. */
+function isId(prefix, value) {
+	const match = ID_PATTERN.exec(value);
+	return match !== null && match[1] === prefix;
+}
+//#endregion
+//#region src/markdown/policy.ts
+/**
+* What the pipeline lets through (ADR-020): the tags Markdown itself produces, the attributes each
+* of them may carry and the URLs that links and images may point to. The write path
+* (`analyze.ts`) applies these rules and reports whatever it removes; `renderHtml` applies the
+* ones that matter for safety once more to any document it is given.
+*/
+/** The tag of the element that stands in the document for something the pipeline did not let through. */
+const MARKER_TAG = "hollware-marker";
+/**
+* The prefix of the tag the markdown-it rule gives raw HTML (`hollware-raw:script`). Component
+* syntax cannot write a colon in a tag name, so no author can forge one, and the analysis turns
+* every such element into a marker.
+*/
+const RAW_HTML_PREFIX = "hollware-raw:";
+/**
+* The tag of the node the markdown-it rule adds at the end of the document, which lists the text
+* that Comark's syntax read as attributes or parameters and left out of the document: the
+* analysis reads it, reports what it holds and removes it. Like `hollware-raw:`, it has a colon,
+* which component syntax cannot write.
+*/
+const LEFT_OUT_TAG = "hollware-left-out:";
+/**
+* The key of an attribute that names one `{...}` (`$p0`, `$p1`): it travels from the token to the
+* element that took the braces as its attributes, which tells the analysis that they were taken.
+*/
+const PROPS_KEY = /^\$p(\d+)$/;
+/** The attribute that carries the line of a block from the markdown-it rule to the analysis, which removes it. */
+const LINE_KEY = "$line";
+/**
+* The same for a component, whose line is the one it opens on. A component with a single
+* paragraph is unwrapped by Comark, which merges the paragraph's props into it: the paragraph's
+* `$line` then says where the content starts, and `$open` where the component does.
+*/
+const OPEN_KEY = "$open";
+/** The tags Markdown itself produces, plus the slot wrapper `template` and the task list checkbox `input`. */
+const NATIVE_TAGS = /* @__PURE__ */ new Set([
+	"h1",
+	"h2",
+	"h3",
+	"h4",
+	"h5",
+	"h6",
+	"p",
+	"a",
+	"img",
+	"ul",
+	"ol",
+	"li",
+	"pre",
+	"code",
+	"table",
+	"thead",
+	"tbody",
+	"tr",
+	"th",
+	"td",
+	"blockquote",
+	"hr",
+	"br",
+	"strong",
+	"em",
+	"del",
+	"span",
+	"input",
+	"template"
+]);
+/** The tags that sit inside a line of text: they do not end a word, which a block does. */
+const INLINE_TAGS = /* @__PURE__ */ new Set([
+	"a",
+	"img",
+	"code",
+	"strong",
+	"em",
+	"del",
+	"span",
+	"input"
+]);
+/** The kinds of alert a blockquote can be (`> [!NOTE]`). */
+const ALERT_TYPES = [
+	"note",
+	"tip",
+	"important",
+	"warning",
+	"caution"
+];
+const text = (value) => typeof value === "string";
+const exactly = (...allowed) => (value) => typeof value === "string" && allowed.includes(value);
+const matching = (pattern) => (value) => typeof value === "string" && pattern.test(value);
+/** Only `language-*` classes, which is what a fenced code block carries. */
+const languageClasses = (value) => {
+	if (typeof value !== "string") return false;
+	const names = value.split(/\s+/).filter((name) => name !== "");
+	return names.length > 0 && names.every((name) => /^language-[\w+#.-]+$/.test(name));
+};
+const lineNumbers = (value) => Array.isArray(value) && value.every((line) => Number.isSafeInteger(line));
+const alignment = /* @__PURE__ */ new Map([["style", exactly("text-align:left", "text-align:right", "text-align:center")]]);
+/**
+* The attributes each native tag may carry, with the values it may have. The headings carry none:
+* their ids are Hollware's own. The classes, the alert and the table alignment are what Comark
+* and markdown-it add themselves, so a document the parser writes passes its own rules.
+*/
+const ATTRIBUTE_RULES = /* @__PURE__ */ new Map([
+	["a", /* @__PURE__ */ new Map([["href", text], ["title", text]])],
+	["img", /* @__PURE__ */ new Map([
+		["src", text],
+		["alt", text],
+		["title", text],
+		["width", text],
+		["height", text]
+	])],
+	["code", /* @__PURE__ */ new Map([["class", languageClasses]])],
+	["pre", /* @__PURE__ */ new Map([
+		["language", text],
+		["filename", text],
+		["highlights", lineNumbers],
+		["meta", text]
+	])],
+	["ol", /* @__PURE__ */ new Map([["start", matching(/^\d{1,9}$/)]])],
+	["ul", /* @__PURE__ */ new Map([["class", exactly("contains-task-list")]])],
+	["li", /* @__PURE__ */ new Map([["class", exactly("task-list-item")]])],
+	["blockquote", /* @__PURE__ */ new Map([["as", exactly(...ALERT_TYPES)]])],
+	["th", alignment],
+	["td", alignment],
+	["input", /* @__PURE__ */ new Map([
+		["class", exactly("task-list-item-checkbox")],
+		["type", exactly("checkbox")],
+		[":disabled", exactly("true")],
+		[":checked", exactly("true")]
+	])],
+	["template", /* @__PURE__ */ new Map([["name", matching(/^[\w-]+$/)]])]
+]);
+/** Whether a native tag may carry the attribute with that value. */
+function isAllowedAttribute(tag, key, value) {
+	const rule = ATTRIBUTE_RULES.get(tag)?.get(key);
+	return rule !== void 0 && rule(value);
+}
+/** The attribute as an author wrote it: Comark stores `{open}` as `:open`. */
+function displayAttribute(key) {
+	return key.startsWith(":") ? key.slice(1) : key;
+}
+/**
+* The name of an attribute as a browser or a framework will see it: Comark keeps `:name` for
+* bindings and Vue spells a handler `@click` or `v-on:click`, so those prefixes go before the name
+* is judged.
+*/
+function attributeName(key) {
+	return key.toLowerCase().replace(/^(?::|v-bind:)/, "").replace(/^(?:@|v-on:)/, "on").replaceAll(":", "");
+}
+const SINK_NAMES = /* @__PURE__ */ new Set([
+	"srcdoc",
+	"formaction",
+	"innerhtml",
+	"dangerouslysetinnerhtml",
+	"textcontent"
+]);
+/**
+* An attribute no element may carry: an event handler (every name that starts with `on`, which
+* is also what Vue reads as a listener) or one that writes HTML.
+*/
+function isForbiddenAttribute(name) {
+	return name.startsWith("on") || SINK_NAMES.has(name);
+}
+const NAMED_ENTITY = /* @__PURE__ */ new Map([
+	["colon", ":"],
+	["Tab", "	"],
+	["NewLine", "\n"]
+]);
+/** The character references a URL can hide its scheme behind, decoded the way an HTML renderer that does not escape them would leave them for a browser. */
+function decodeEntities(value) {
+	let current = value;
+	for (let pass = 0; pass < 3; pass++) {
+		const next = current.replace(/&(?:#[xX]([0-9a-fA-F]+)|#(\d+)|(colon|Tab|NewLine));?/g, (match, hex, decimal, name) => {
+			if (name !== void 0) return NAMED_ENTITY.get(name) ?? match;
+			const code = hex !== void 0 ? Number.parseInt(hex, 16) : Number.parseInt(decimal ?? "", 10);
+			return Number.isFinite(code) && code <= 1114111 ? String.fromCodePoint(code) : match;
+		});
+		if (next === current) break;
+		current = next;
+	}
+	return current;
+}
+/** Drops the control characters and spaces at the start of a URL, which a browser ignores. */
+function trimLeadingControls(value) {
+	let at = 0;
+	while (at < value.length && value.charCodeAt(at) <= 32) at++;
+	return value.slice(at);
+}
+/**
+* The scheme of a URL as a browser reads it, in lowercase, or `undefined` for a relative URL.
+* A browser drops the control characters and spaces at the start, and every tab and line break,
+* before it reads the scheme, and it reads a character reference in an attribute: `jav&#9;ascript:`
+* is `javascript:`.
+*/
+function urlScheme(value) {
+	const decoded = value.includes("&") ? decodeEntities(value) : value;
+	const colon = decoded.indexOf(":");
+	if (colon === -1) return void 0;
+	const head = trimLeadingControls(decoded.slice(0, colon).replace(/[\t\n\r]/g, ""));
+	return /^[A-Za-z][A-Za-z0-9+.-]*$/.test(head) ? head.toLowerCase() : void 0;
+}
+const LINK_SCHEMES = /* @__PURE__ */ new Set([
+	"http",
+	"https",
+	"mailto"
+]);
+const IMAGE_SCHEMES = /* @__PURE__ */ new Set(["http", "https"]);
+/**
+* Whether a link or an image may point there. A relative URL (a path, `#anchor`, `?query` or
+* `//host/path`) is always safe: it keeps the scheme of the page. Of the schemes, links may use
+* `http`, `https` and `mailto`, and images `http` and `https`.
+*/
+function isSafeUrl(value, kind) {
+	const scheme = urlScheme(value);
+	return scheme === void 0 || (kind === "link" ? LINK_SCHEMES : IMAGE_SCHEMES).has(scheme);
+}
+const NAME_LENGTH = 100;
+/** A tag, attribute or URL as a marker names it: long values, such as a `data:` URL, are cut. */
+function shorten(value) {
+	return value.length > NAME_LENGTH ? `${value.slice(0, 97)}...` : value;
+}
+/** Defines an own property, so that a prop called `__proto__` is a prop and not a prototype. */
+function setOwn(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+}
+/** Reads a string as JSON, or gives it back when it is not JSON (or is a number that JSON cannot hold). */
+function parseJson(value) {
+	try {
+		const parsed = JSON.parse(value);
+		return typeof parsed === "number" && !Number.isFinite(parsed) ? value : parsed;
+	} catch {
+		return value;
+	}
+}
+/** Comark stores a prop that holds data, such as `{open}` or `{:count="3"}`, under `:name`. */
+function isBinding(key) {
+	return key.startsWith(":") || key.startsWith("v-bind:");
+}
+/** The URL an attribute holds, or `undefined` when it holds a value that cannot be one. */
+function urlValue(key, value) {
+	if (typeof value !== "string") return void 0;
+	if (!isBinding(key)) return value;
+	const parsed = parseJson(value);
+	return typeof parsed === "string" ? parsed : value;
+}
+//#endregion
+//#region src/markdown/json.ts
+function isPlainObject(value) {
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+/**
+* Checks that a value YAML or JSON gave can be stored as JSON and read back as it is. YAML anchors
+* and aliases build a value in which one array or object is reachable twice, so a few lines of
+* them are a tree of billions of nodes once they are written out (and `&a [*a]` is a cycle).
+* The walk is iterative, so no depth can overflow the stack, and it never visits a container
+* twice, so it takes time in proportion to what was parsed.
+*/
+function jsonProblem(root) {
+	const seen = /* @__PURE__ */ new Set();
+	const stack = [{
+		value: root,
+		depth: 1
+	}];
+	while (stack.length > 0) {
+		const item = stack.pop();
+		if (item === void 0) break;
+		const { value, depth } = item;
+		if (value === null || typeof value === "string" || typeof value === "boolean") continue;
+		if (typeof value === "number") {
+			if (!Number.isFinite(value)) return "number";
+			continue;
+		}
+		if (typeof value !== "object") return "type";
+		if (seen.has(value)) return "shared";
+		seen.add(value);
+		if (depth > 100) return "depth";
+		if (Array.isArray(value)) for (const child of value) stack.push({
+			value: child,
+			depth: depth + 1
+		});
+		else if (isPlainObject(value)) for (const key of Object.keys(value)) stack.push({
+			value: Reflect.get(value, key),
+			depth: depth + 1
+		});
+		else return "type";
+	}
+}
+//#endregion
+//#region src/markdown/routes.ts
+const SLUG = ":slug";
+/** The segments of a path: `/en/blog/x/` and `/en/blog/x` are both `en`, `blog`, `x`. */
+function segmentsOf(path) {
+	const segments = path.slice(1).split("/");
+	if (segments[segments.length - 1] === "") segments.pop();
+	return segments;
+}
+/**
+* Compiles the routes of the site's collections, which hold `:slug` once. They are sorted by
+* collection and locale, so that the order of the config never changes which entry a link
+* names when two routes could match the same path.
+*/
+function compileRoutes(routes) {
+	const compiled = [];
+	for (const collection of Object.keys(routes).sort()) {
+		const byLocale = routes[collection] ?? {};
+		for (const locale of Object.keys(byLocale).sort()) {
+			const pattern = byLocale[locale] ?? "";
+			if (!pattern.startsWith("/")) continue;
+			const segments = segmentsOf(pattern);
+			const slugAt = segments.indexOf(SLUG);
+			if (slugAt !== -1) compiled.push({
+				collection,
+				locale,
+				segments,
+				slugAt
+			});
+		}
+	}
+	return compiled;
+}
+function safeDecode(segment) {
+	try {
+		return decodeURIComponent(segment);
+	} catch {
+		return segment;
+	}
+}
+function matchRoute(path, routes) {
+	const segments = segmentsOf(path);
+	for (const route of routes) {
+		if (route.segments.length !== segments.length) continue;
+		let matches = true;
+		for (let at = 0; at < segments.length && matches; at++) {
+			const segment = segments[at] ?? "";
+			matches = at === route.slugAt ? segment !== "" : segment === route.segments[at];
+		}
+		if (matches) return {
+			collection: route.collection,
+			locale: route.locale,
+			slug: safeDecode(segments[route.slugAt] ?? "")
+		};
+	}
+}
+/**
+* Tells what a link points to. Links with a scheme (`http:`, `https:`, `mailto:`: the policy
+* has already removed any other) and `//host/path` are `external`, `#section` is an `anchor`, and
+* a path that starts with one `/` and matches a route is `internal`. The query and the fragment
+* do not count, and nor does a trailing slash, so `/en/blog/x?utm=1#top` names the entry that
+* `/en/blog/x/` does. Any other path, absolute or relative, is `site`.
+*/
+function classifyLink(href, routes) {
+	const value = trimLeadingControls(href);
+	if (value.startsWith("#")) return { kind: "anchor" };
+	if (urlScheme(value) !== void 0 || value.startsWith("//")) return { kind: "external" };
+	if (value.startsWith("/")) {
+		const end = value.search(/[?#]/);
+		const target = matchRoute(end === -1 ? value : value.slice(0, end), routes);
+		if (target !== void 0) return {
+			kind: "internal",
+			target
+		};
+	}
+	return { kind: "site" };
+}
+//#endregion
+//#region src/markdown/slug.ts
+/**
+* Hollware's own heading ids (ADR-020): Comark's drop every letter outside ASCII, so `Diseño`
+* would become `diseo`. The id is the text in lowercase, with the letters, digits and marks of
+* every script kept, whitespace and hyphens collapsed into one hyphen and anything else removed.
+*/
+function slugify(text) {
+	const slug = text.normalize("NFC").toLowerCase().replace(/[^\p{L}\p{N}\p{M}_\s-]+/gu, "").replace(/[\s-]+/g, "-").replace(/^-+|-+$/g, "");
+	return slug === "" ? "section" : slug;
+}
+/** Hands out the ids of one document: the second `Setup` is `setup-1`, the third `setup-2`. */
+var HeadingIds = class {
+	#used = /* @__PURE__ */ new Set();
+	#next = /* @__PURE__ */ new Map();
+	/** The id for a heading with this text, different from every id handed out before. */
+	next(text) {
+		const base = slugify(text);
+		let count = this.#next.get(base) ?? 0;
+		let id = count === 0 ? base : `${base}-${count}`;
+		while (this.#used.has(id)) {
+			count++;
+			id = `${base}-${count}`;
+		}
+		this.#used.add(id);
+		this.#next.set(base, count + 1);
+		return id;
+	}
+};
+//#endregion
+//#region src/markdown/analyze.ts
+const HEADING_LEVEL = /* @__PURE__ */ new Map([
+	["h1", 1],
+	["h2", 2],
+	["h3", 3],
+	["h4", 4],
+	["h5", 5],
+	["h6", 6]
+]);
+function isProps$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** What `\s` matches, which is what separates the words of a text. */
+function isSpace(code) {
+	return code === 32 || code >= 9 && code <= 13 || code === 160 || code === 5760 || code >= 8192 && code <= 8202 || code === 8232 || code === 8233 || code === 8239 || code === 8287 || code === 12288 || code === 65279;
+}
+function countNewlines(text) {
+	let count = 0;
+	let at = text.indexOf("\n");
+	while (at !== -1) {
+		count++;
+		at = text.indexOf("\n", at + 1);
+	}
+	return count;
+}
+function addText(state, text) {
+	for (let at = 0; at < text.length; at++) if (isSpace(text.charCodeAt(at))) state.inWord = false;
+	else if (!state.inWord) {
+		state.inWord = true;
+		state.words++;
+	}
+}
+/** The text of a node, without its marks. */
+function plainText(node, depth) {
+	let text = "";
+	for (let at = 2; at < node.length; at++) {
+		const child = node[at];
+		if (typeof child === "string") text += child;
+		else if (Array.isArray(child) && depth < 100) text += plainText(child, depth + 1);
+	}
+	return text;
+}
+/** Takes the line the markdown-it rule left in the props under `key`, as a line of the file, or `undefined`. */
+function takeLine(props, key, lineOffset) {
+	if (!Object.hasOwn(props, key)) return void 0;
+	const value = props[key];
+	delete props[key];
+	const line = typeof value === "string" ? Number.parseInt(value, 10) : NaN;
+	return Number.isSafeInteger(line) && line >= 0 ? line + 1 + lineOffset : void 0;
+}
+/** Reads and removes the node at the end of the document that lists what was left out. */
+function takeLeftOut(nodes, lineOffset) {
+	const found = /* @__PURE__ */ new Map();
+	const last = nodes[nodes.length - 1];
+	if (!Array.isArray(last) || last[0] !== "hollware-left-out:") return found;
+	nodes.pop();
+	const props = last[1];
+	if (!isProps$1(props)) return found;
+	for (const key of Object.keys(props)) {
+		const id = PROPS_KEY.exec(key)?.[1];
+		const value = props[key];
+		if (id === void 0 || typeof value !== "string") continue;
+		const [line = "", tag = "", given = "", ...text] = value.split("\0");
+		const at = Number.parseInt(line, 10);
+		if (Number.isSafeInteger(at) && at >= 0) found.set(Number(id), {
+			line: at + 1 + lineOffset,
+			tag,
+			given: given === "1",
+			text: text.join("\0")
+		});
+	}
+	return found;
+}
+/** Removes the attributes that name the `{...}` an element took, and remembers which. */
+function takeProps(state, props) {
+	for (const key of Object.keys(props)) {
+		const id = PROPS_KEY.exec(key)?.[1];
+		if (id !== void 0) {
+			delete props[key];
+			state.taken.add(Number(id));
+		}
+	}
+}
+function record(state, kind, name, line) {
+	const shortName = shorten(name);
+	const key = `${kind}\u0000${shortName}\u0000${line}`;
+	if (state.reported.has(key)) return;
+	state.reported.add(key);
+	state.disallowed.push({
+		kind,
+		name: shortName,
+		line
+	});
+}
+function markerNode(kind, name, line, children) {
+	return [
+		MARKER_TAG,
+		{
+			kind,
+			name: shorten(name),
+			line
+		},
+		...children
+	];
+}
+/** The props of a component as its schema should see them: Comark stores `{open}` as `":open": "true"`. */
+function decodeProps(props) {
+	const decoded = {};
+	for (const key of Object.keys(props)) {
+		const value = props[key];
+		if (key.startsWith(":")) setOwn(decoded, key.slice(1), typeof value === "string" ? parseJson(value) : value);
+		else setOwn(decoded, key, value);
+	}
+	return decoded;
+}
+/** What kind of URL an attribute holds, if it holds one. */
+function urlKind(tag, key, native) {
+	if (native) {
+		if (tag === "a" && key === "href") return "link";
+		return tag === "img" && key === "src" ? "image" : void 0;
+	}
+	const name = attributeName(key);
+	if (name === "href" || name === "xlinkhref") return "link";
+	return name === "src" ? "image" : void 0;
+}
+/**
+* Takes off an element every attribute its tag may not carry and every URL it may not point
+* to. A native tag has an allowlist (`policy.ts`). A component takes the props its schema
+* declares, which only the contracts know, so here it loses only what is never safe: event
+* handlers, attributes that write HTML and unsafe `href` and `src`.
+*/
+function cleanProps(state, tag, props, native, line) {
+	for (const key of Object.keys(props)) {
+		const value = props[key];
+		if (native ? !isAllowedAttribute(tag, key, value) : isForbiddenAttribute(attributeName(key))) {
+			delete props[key];
+			record(state, "disallowed-attribute", `${tag}[${displayAttribute(key)}]`, line);
+			continue;
+		}
+		const kind = urlKind(tag, key, native);
+		if (kind !== void 0) {
+			const url = urlValue(key, value);
+			if (url === void 0) {
+				delete props[key];
+				record(state, "disallowed-attribute", `${tag}[${displayAttribute(key)}]`, line);
+			} else if (!isSafeUrl(url, kind)) {
+				delete props[key];
+				record(state, "unsafe-url", url, line);
+			}
+		} else if (!native && typeof value === "object" && value !== null && jsonProblem(value) !== void 0) state.problem ??= "props";
+	}
+}
+/**
+* Gives a span back the brackets Comark took off it. Comark reads `[text]` as a span, for
+* `[text]{.class}`, and prints the text without the brackets, so `array[0]` would read `array0`.
+* Hollware allows no attribute on a span, so a span is always text that had brackets.
+*/
+function bracket(node) {
+	const last = node.length - 1;
+	const end = node[last];
+	if (last >= 2 && typeof end === "string") node[last] = `${end}]`;
+	else node.push("]");
+	const first = node[2];
+	if (typeof first === "string") node[2] = `[${first}`;
+	else node.splice(2, 0, "[");
+}
+function collectLink(state, props, line) {
+	const href = props.href;
+	if (typeof href !== "string") return;
+	const { kind, target } = classifyLink(href, state.options.routes);
+	state.links.push(target === void 0 ? {
+		href,
+		kind,
+		line
+	} : {
+		href,
+		kind,
+		target,
+		line
+	});
+}
+function collectImage(state, props, line) {
+	const src = props.src;
+	if (typeof src !== "string" || src === "") return;
+	const alt = props.alt;
+	state.images.push({
+		src,
+		alt: typeof alt === "string" ? alt : "",
+		line
+	});
+}
+/**
+* Judges the children of a node, in order, and returns the line the next sibling starts on.
+* A line is counted from the block that carries it: every line break in the text (a soft break)
+* and every hard break moves it down one.
+*/
+function walk(state, list, start, firstLine, depth, inPre) {
+	let cursor = firstLine;
+	for (let at = start; at < list.length; at++) {
+		const node = list[at];
+		if (typeof node === "string") {
+			if (!inPre) addText(state, node);
+			cursor += countNewlines(node);
+		} else if (Array.isArray(node)) cursor = visit(state, list, at, node, cursor, depth, inPre);
+	}
+	return cursor;
+}
+function visit(state, list, at, node, cursor, depth, inPre) {
+	if (depth > 100) {
+		state.problem ??= "nesting";
+		return cursor;
+	}
+	const tag = node[0];
+	let props;
+	if (isProps$1(node[1])) props = node[1];
+	else {
+		props = {};
+		node[1] = props;
+	}
+	const open = takeLine(props, OPEN_KEY, state.options.lineOffset);
+	const content = takeLine(props, LINE_KEY, state.options.lineOffset);
+	const line = open ?? content ?? cursor;
+	if (state.leftOut.size > 0) takeProps(state, props);
+	if (typeof tag !== "string") {
+		list[at] = markerNode("raw-html", "!--", line, []);
+		record(state, "raw-html", "!--", line);
+		state.inWord = false;
+		return line;
+	}
+	if (tag.startsWith("hollware-raw:")) {
+		const name = tag.slice(13);
+		list[at] = markerNode("raw-html", name, line, []);
+		record(state, "raw-html", name, line);
+		state.inWord = false;
+		return line;
+	}
+	const native = NATIVE_TAGS.has(tag);
+	if (!native && !state.options.components.has(tag)) {
+		const marker = markerNode("unknown-component", tag, line, node.slice(2));
+		list[at] = marker;
+		record(state, "unknown-component", tag, line);
+		state.inWord = false;
+		const end = walk(state, marker, 2, content ?? line, depth + 1, inPre);
+		state.inWord = false;
+		return end;
+	}
+	cleanProps(state, tag, props, native, line);
+	if (tag === "span") bracket(node);
+	if (!native) state.components.push({
+		name: tag,
+		props: decodeProps(props),
+		line
+	});
+	if (tag === "a") collectLink(state, props, line);
+	else if (tag === "img") collectImage(state, props, line);
+	const inline = INLINE_TAGS.has(tag);
+	if (!inline) state.inWord = false;
+	if (tag === "br") return line + 1;
+	const end = walk(state, node, 2, content ?? line, depth + 1, inPre || tag === "pre");
+	if (!inline) state.inWord = false;
+	const level = HEADING_LEVEL.get(tag);
+	if (level !== void 0) {
+		const text = plainText(node, depth);
+		const id = state.ids.next(text);
+		props.id = id;
+		state.headings.push({
+			depth: level,
+			text,
+			id,
+			line
+		});
+	}
+	return end;
+}
+/**
+* Judges and extracts a document: see the comment at the top of this file. The `words` are
+* the whitespace-separated words of the text outside code blocks, with the headings, the list
+* items, the link text and the text inside components, and without URLs and the marks of Markdown.
+*/
+function analyzeDocument(document, options) {
+	const state = {
+		options,
+		leftOut: takeLeftOut(document.nodes, options.lineOffset),
+		taken: /* @__PURE__ */ new Set(),
+		headings: [],
+		links: [],
+		images: [],
+		components: [],
+		disallowed: [],
+		reported: /* @__PURE__ */ new Set(),
+		ids: new HeadingIds(),
+		words: 0,
+		inWord: false,
+		problem: void 0
+	};
+	walk(state, document.nodes, 0, options.lineOffset + 1, 1, false);
+	for (const [id, item] of state.leftOut) if (!item.given || !state.taken.has(id)) record(state, "disallowed-attribute", `${item.tag}[${item.text}]`, item.line);
+	state.disallowed.sort((a, b) => (a.line ?? 0) - (b.line ?? 0));
+	return {
+		extracted: {
+			headings: state.headings,
+			links: state.links,
+			images: state.images,
+			components: state.components,
+			words: state.words,
+			disallowed: state.disallowed
+		},
+		problem: state.problem
+	};
+}
+//#endregion
+//#region src/markdown/parser.ts
+/** The block tokens whose attributes reach the node, so that the line they start on can travel with them. */
+const LINE_TOKENS = /* @__PURE__ */ new Set([
+	"paragraph_open",
+	"heading_open",
+	"blockquote_open",
+	"bullet_list_open",
+	"ordered_list_open",
+	"list_item_open",
+	"table_open",
+	"thead_open",
+	"tbody_open",
+	"tr_open"
+]);
+/** The tokens of a component, whose line is kept apart from the line of its content. */
+const OPEN_TOKENS = /* @__PURE__ */ new Set(["mdc_block_open", "mdc_block_shorthand"]);
+const TAG_NAME$1 = /^\s*<\/?([A-Za-z][A-Za-z0-9-]*)/;
+const DECLARATION = /^\s*<!([A-Za-z]+)/;
+/** What a piece of raw HTML is called in a marker: its tag, or `!--` for a comment, `?` for an instruction. */
+function rawHtmlName(content) {
+	const tag = TAG_NAME$1.exec(content)?.[1];
+	if (tag !== void 0) return tag.toLowerCase();
+	const start = content.trimStart();
+	if (start.startsWith("<!--")) return "!--";
+	if (start.startsWith("<![CDATA[")) return "![cdata[";
+	const declaration = DECLARATION.exec(start)?.[1];
+	return declaration === void 0 ? "?" : `!${declaration.toLowerCase()}`;
+}
+function skipSpaces(text, from) {
+	let at = from;
+	while (text[at] === " " || text[at] === "	") at++;
+	return at;
+}
+/** The `]` that closes the `[` at `open`, with Comark's rules: a backslash hides a character and brackets nest. */
+function closingBracket(text, open) {
+	let depth = 0;
+	for (let at = open + 1; at < text.length; at++) {
+		const char = text[at];
+		if (char === "\\") at++;
+		else if (char === "[") depth++;
+		else if (char === "]") {
+			if (depth === 0) return at;
+			depth--;
+		}
+	}
+	return -1;
+}
+/** The `}` that closes the `{` at `open`: quotes hide their braces, and braces nest. */
+function closingBrace(text, open) {
+	let depth = 0;
+	for (let at = open + 1; at < text.length; at++) {
+		const char = text[at];
+		if (char === "\\") at++;
+		else if (char === "\"" || char === "'" || char === "`") {
+			let end = at + 1;
+			while (end < text.length && text[end] !== char) end += text[end] === "\\" ? 2 : 1;
+			if (end >= text.length) return -1;
+			at = end;
+		} else if (char === "{") depth++;
+		else if (char === "}") {
+			if (depth === 0) return at;
+			depth--;
+		}
+	}
+	return -1;
+}
+/**
+* The text that follows the name, the `[content]` and the `{props}` on the line that opens a
+* component (`::callout{type="tip"} and this`). Comark takes the line for the component and
+* leaves what follows out of the document. It is empty when there is nothing after them, and
+* when the line is too odd to tell where they end.
+*/
+function openTail(line) {
+	const fence = line.indexOf("::");
+	if (fence === -1) return "";
+	let at = fence;
+	while (line[at] === ":") at++;
+	at = skipSpaces(line, at);
+	const name = /^[A-Za-z$][$\w.-]*/.exec(line.slice(at));
+	if (name === null) return "";
+	at = skipSpaces(line, at + name[0].length);
+	if (line[at] === "[") {
+		const close = closingBracket(line, at);
+		if (close === -1) return "";
+		at = skipSpaces(line, close + 1);
+	}
+	if (line[at] === "{") {
+		const close = closingBrace(line, at);
+		if (close === -1) return "";
+		at = skipSpaces(line, close + 1);
+	}
+	return line.slice(at).trim();
+}
+/**
+* Runs once the block and inline rules have made their tokens. It leaves no token that the
+* analysis could not judge:
+* - Raw HTML becomes an element no author can write (`hollware-raw:script`), so the content of
+*   the tag never reaches the document and the analysis can report it with its line.
+* - A block that Comark turns into a node gets the line it starts on, for the same reason.
+* - A link reference definition, which the links that use it have already read, leaves no token:
+*   Comark would make an empty `component` node of it.
+* - Text that Comark's syntax takes and leaves out of the document is listed in a node at the
+*   end of the document, for the analysis to report: every `{...}` (Comark reads it as
+*   attributes, and drops it wherever no element takes them, which includes any `{` in prose that
+*   is not closed), and whatever follows the parameters on the line that opens a component.
+*/
+function rewriteTokens(state) {
+	const { tokens } = state;
+	const leftOut = [];
+	let lines;
+	let blockTag = "p";
+	let blockLine = 0;
+	let kept = 0;
+	for (let at = 0; at < tokens.length; at++) {
+		const token = tokens[at];
+		if (token === void 0 || token.type === "reference") continue;
+		if (token.map !== null) blockLine = token.map[0];
+		if (token.nesting === 1 && token.tag !== "") blockTag = token.tag;
+		if (token.type === "html_block") {
+			const raw = new state.Token("hollware_raw_html", RAW_HTML_PREFIX + rawHtmlName(token.content), 0);
+			if (token.map !== null) raw.attrs = [[LINE_KEY, String(token.map[0])]];
+			tokens[kept++] = raw;
+			continue;
+		}
+		if (token.type === "inline" && token.children !== null) {
+			const { children } = token;
+			let line = blockLine;
+			for (let child = 0; child < children.length; child++) {
+				const inner = children[child];
+				if (inner === void 0) continue;
+				if (inner.type === "html_inline") children[child] = new state.Token("mdc_inline_component", RAW_HTML_PREFIX + rawHtmlName(inner.content), 0);
+				else if (inner.type === "mdc_inline_props") {
+					const given = inner.attrs !== null && inner.attrs.length > 0;
+					inner.attrs ??= [];
+					inner.attrs.push([`$p${leftOut.length}`, "1"]);
+					leftOut.push([
+						String(line),
+						blockTag,
+						given ? "1" : "0",
+						inner.content
+					]);
+				} else if (inner.type === "softbreak" || inner.type === "hardbreak") line++;
+			}
+		} else if (token.map !== null && token.nesting >= 0) {
+			const key = OPEN_TOKENS.has(token.type) ? OPEN_KEY : LINE_TOKENS.has(token.type) ? LINE_KEY : void 0;
+			if (key !== void 0) {
+				token.attrs ??= [];
+				token.attrs.push([key, String(token.map[0])]);
+			}
+			if (token.type === "mdc_block_open") {
+				lines ??= state.src.split("\n");
+				const tail = openTail(lines[token.map[0]] ?? "");
+				if (tail !== "") leftOut.push([
+					String(token.map[0]),
+					token.tag,
+					"0",
+					tail
+				]);
+			}
+		}
+		tokens[kept++] = token;
+	}
+	tokens.length = kept;
+	if (leftOut.length > 0) {
+		const list = new state.Token("hollware_left_out", LEFT_OUT_TAG, 0);
+		list.attrs = leftOut.map((entry, id) => [`$p${id}`, entry.join("\0")]);
+		tokens.push(list);
+	}
+}
+/**
+* Keeps the text of every `{...}` that Comark reads as attributes in the content of its token,
+* which Comark leaves empty, so that the analysis can say what was left out. The rule is
+* Comark's own, found by its name in the rules of markdown-it.
+*/
+function keepPropsText(md) {
+	const rules = Reflect.get(md.inline.ruler, "__rules__");
+	const rule = Array.isArray(rules) ? rules.find((entry) => typeof entry === "object" && entry !== null && Reflect.get(entry, "name") === "comark_inline_props") : void 0;
+	const original = typeof rule === "object" && rule !== null ? Reflect.get(rule, "fn") : void 0;
+	if (typeof original !== "function") throw new Error("Comark no longer has the inline rule `comark_inline_props`");
+	md.inline.ruler.at("comark_inline_props", (state, silent) => {
+		const start = state.pos;
+		const matched = Reflect.apply(original, void 0, [state, silent]) === true;
+		if (matched && !silent) {
+			const token = state.tokens[state.tokens.length - 1];
+			if (token?.type === "mdc_inline_props") token.content = state.src.slice(start, state.pos);
+		}
+		return matched;
+	});
+}
+/**
+* Hollware's settings for Comark's markdown-it:
+* - `html` is on only so that raw HTML is tokenized, never parsed: the rule above replaces it.
+* - Any destination is let through, so that a link or an image with an unsafe URL is a link
+*   the analysis can report, not text that Markdown left behind without a word.
+* - A bare `README.md` is not a link to the host `readme.md`; `https://…` and e-mail addresses
+*   still are.
+* - A component takes its props in `{...}`. The YAML block form (`---` under the component)
+*   is off: its anchors and aliases can build a value of billions of nodes, and Comark writes
+*   that value out as JSON while it parses: a file of 1 KB cost it 9.5 seconds of CPU with seven
+*   levels of anchors and more than 40 with nine.
+*/
+function hollwareMarkdownIt(md) {
+	md.set({ html: true });
+	md.validateLink = () => true;
+	md.linkify.set({ fuzzyLink: false });
+	md.block.ruler.disable("comark_block_yaml");
+	keepPropsText(md);
+	md.core.ruler.push("hollware", rewriteTokens);
+}
+const hollware = {
+	name: "hollware",
+	markdownItPlugins: [hollwareMarkdownIt]
+};
+async function createParser() {
+	const [comark, components, attributes, taskList, alert] = await Promise.all([
+		import("comark"),
+		import("comark/plugins/components"),
+		import("comark/plugins/attributes"),
+		import("comark/plugins/task-list"),
+		import("comark/plugins/alert")
+	]);
+	const parse = comark.createMarkdownParser({
+		autoClose: false,
+		registerDefaultPlugins: false,
+		headingIds: false,
+		plugins: [
+			components.default(),
+			attributes.default(),
+			taskList.default(),
+			hollware,
+			alert.default()
+		]
+	});
+	return {
+		splitFrontmatter: (markdown) => comark.parseFrontmatter(markdown),
+		parseBody: (markdown) => parse(markdown)
+	};
+}
+let parser;
+/** The parser of this isolate, built the first time it is asked for. */
+function getParser() {
+	parser ??= createParser().catch((error) => {
+		parser = void 0;
+		throw error;
+	});
+	return parser;
+}
+//#endregion
+//#region src/markdown/violations.ts
+function refusal(contract, path, message, fix, line) {
+	const violation = {
+		contract,
+		severity: "error",
+		path,
+		message,
+		fix
+	};
+	return line === void 0 ? violation : {
+		...violation,
+		line
+	};
+}
+function sizeLimit(bytes, limit) {
+	return refusal("size-limit", "/body", `The Markdown file is ${bytes} bytes and this collection accepts at most ${limit}.`, `Shorten the file to ${limit} bytes or fewer, counting the frontmatter, or split the content into several entries.`);
+}
+const YAML_FIX = "Put a space after every colon, indent nested keys with spaces (never tabs), quote any value that contains a colon, a hash or a bracket, and give each key only once.";
+/** YAML that does not parse. `line` is the line of the file, when the parser says where. */
+function yamlSyntax(reason, line, column) {
+	return refusal("frontmatter-syntax", "/frontmatter", `The frontmatter is not valid YAML: ${reason}${line === void 0 ? "" : ` (line ${line}${column === void 0 ? "" : `, column ${column}`})`}.`, `Fix the YAML between the two --- lines at the top of the file${line === void 0 ? "" : `, at line ${line}`}. ${YAML_FIX}`, line);
+}
+/** Frontmatter that parses to something other than a mapping, such as a list or a sentence. */
+function frontmatterNotMapping(found) {
+	return refusal("frontmatter-syntax", "/frontmatter", `The frontmatter must be a YAML mapping of keys to values, but the file starts with ${found}.`, "Start the file with a line of three dashes, one \"key: value\" line for each field and a closing line of three dashes. If the dashes at the top were meant as a horizontal rule, remove them or write *** instead.", 1);
+}
+const JSON_PROBLEMS = {
+	shared: "a YAML anchor or alias, which Hollware does not store",
+	depth: `a value nested more than 100 levels deep`,
+	number: "a number that is not finite",
+	type: "a value that is not text, a number, a boolean, null, a list or a mapping"
+};
+/** Frontmatter that cannot be stored as JSON. */
+function frontmatterNotJson(problem) {
+	return refusal("frontmatter-syntax", "/frontmatter", `The frontmatter holds ${JSON_PROBLEMS[problem]}.`, problem === "shared" ? "Remove the &anchor and *alias markers and write every value out in full." : "Replace the value with plain text, a number, a boolean, null, a list or a mapping of them.", 1);
+}
+const PARSE_FIX = "Simplify the Markdown: flatten deep nesting of emphasis, lists, quotes and components, and balance every bracket and brace. If it still fails, split the entry to find the part that breaks.";
+/** Anything the parser or the analysis could not get through. */
+function parseFailure(error) {
+	return refusal("comark-parse", "/body", `Comark could not parse the Markdown (${(error instanceof Error ? `${error.name}: ${error.message.split("\n")[0] ?? ""}` : String(error)).slice(0, 200)}).`, PARSE_FIX);
+}
+function notAString() {
+	return refusal("comark-parse", "/body", "The Markdown is not a string.", "Send the whole file, frontmatter and body, as one string.");
+}
+/** A document the parser accepted but the pipeline cannot store. */
+function unstorable(problem) {
+	return refusal("comark-parse", "/body", problem === "nesting" ? `The document nests elements more than 100 levels deep.` : `A component prop holds a value that nests more than 100 levels deep or is not JSON.`, problem === "nesting" ? "Flatten the nesting of emphasis, lists, quotes and components." : "Give the component a smaller, flatter value, written as JSON.");
+}
+//#endregion
+//#region src/markdown/versions.ts
+/**
+* The version of Comark that parses the Markdown, which every revision stores as `comark_version`.
+* Comark exports no version at runtime, so this constant is the one place that names it, and
+* `tests/markdown/versions.test.ts` binds it to the package that is installed.
+*/
+const COMARK_VERSION = "0.7.0";
+/**
+* The version of Hollware's own pipeline settings: the plugins, the allowlists, the heading ids,
+* the markers and the line numbers (ADR-020). Bump it whenever the same Markdown would give another
+* document or other extracted data, so that `reparse` knows which revisions to rebuild.
+* `tests/markdown/versions.test.ts` pins the output for the shared fixtures, so a change that
+* forgets the bump fails there.
+*/
+const PIPELINE_VERSION = "1";
+//#endregion
+//#region src/markdown/process.ts
+const BYTE_ORDER_MARK = 65279;
+/** The size of a string in UTF-8, which is what D1 stores: a lone surrogate is written as U+FFFD, three bytes. */
+function utf8ByteLength(text) {
+	let bytes = 0;
+	for (let at = 0; at < text.length; at++) {
+		const code = text.charCodeAt(at);
+		if (code < 128) bytes += 1;
+		else if (code < 2048) bytes += 2;
+		else if (code >= 55296 && code <= 56319 && at + 1 < text.length) {
+			const next = text.charCodeAt(at + 1);
+			if (next >= 56320 && next <= 57343) {
+				bytes += 4;
+				at++;
+			} else bytes += 3;
+		} else bytes += 3;
+	}
+	return bytes;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function describe(value) {
+	if (Array.isArray(value)) return "a list";
+	if (typeof value === "string") return "text";
+	if (typeof value === "number") return "a number";
+	if (typeof value === "boolean") return "a boolean";
+	return "something else";
+}
+function isYamlError(error) {
+	return error instanceof Error && error.name === "YAMLException";
+}
+/**
+* How many lines of the file come before the body: the frontmatter and its two fences. The
+* first line of the body is then `lines + 1`. A carriage return that is followed by a line feed is
+* one break, even when Comark cut it in two, with the carriage return in the frontmatter and the
+* line feed in the body.
+*/
+function linesBeforeBody(source, body) {
+	if (!source.endsWith(body)) return 0;
+	const end = source.length - body.length;
+	let lines = 0;
+	for (let at = 0; at < end; at++) {
+		const code = source.charCodeAt(at);
+		if (code === 10 || code === 13 && source.charCodeAt(at + 1) !== 10) lines++;
+	}
+	return lines;
+}
+/** The line of the file that a YAML error is on: the parser counts from the first line after the opening fence. */
+function yamlViolation(error, source) {
+	const reason = Reflect.get(error, "reason");
+	const mark = Reflect.get(error, "mark");
+	const markLine = isRecord(mark) ? mark.line : void 0;
+	const markColumn = isRecord(mark) ? mark.column : void 0;
+	const firstLine = source.startsWith("---\r\n") ? 1 : 2;
+	return yamlSyntax(typeof reason === "string" ? reason : error.message.split("\n")[0] ?? "it does not parse", typeof markLine === "number" ? markLine + firstLine : void 0, typeof markColumn === "number" ? markColumn + 1 : void 0);
+}
+async function run(markdown, options) {
+	if (typeof markdown !== "string") return {
+		ok: false,
+		violations: [notAString()]
+	};
+	const bytes = utf8ByteLength(markdown);
+	if (!(bytes <= options.maxMarkdownBytes)) return {
+		ok: false,
+		violations: [sizeLimit(bytes, options.maxMarkdownBytes)]
+	};
+	const source = markdown.charCodeAt(0) === BYTE_ORDER_MARK ? markdown.slice(1) : markdown;
+	const parser = await getParser();
+	let split;
+	try {
+		split = parser.splitFrontmatter(source);
+	} catch (error) {
+		return {
+			ok: false,
+			violations: [isYamlError(error) ? yamlViolation(error, source) : parseFailure(error)]
+		};
+	}
+	const frontmatter = split.data;
+	if (!isRecord(frontmatter)) return {
+		ok: false,
+		violations: [frontmatterNotMapping(describe(frontmatter))]
+	};
+	const problem = jsonProblem(frontmatter);
+	if (problem !== void 0) return {
+		ok: false,
+		violations: [frontmatterNotJson(problem)]
+	};
+	const document = await parser.parseBody(split.content);
+	document.frontmatter = frontmatter;
+	const analysis = analyzeDocument(document, {
+		components: new Set(options.components),
+		routes: compileRoutes(options.routes),
+		lineOffset: linesBeforeBody(source, split.content)
+	});
+	if (analysis.problem !== void 0) return {
+		ok: false,
+		violations: [unstorable(analysis.problem)]
+	};
+	return {
+		ok: true,
+		value: {
+			frontmatter,
+			document,
+			extracted: analysis.extracted,
+			comarkVersion: COMARK_VERSION,
+			pipelineVersion: "1"
+		}
+	};
+}
+/**
+* Processes a Markdown file for a collection (ADR-001, ADR-020): the frontmatter and the body
+* are parsed once and the contracts get what they need from the result. It answers for any
+* string and never throws: a file it cannot store comes back as violations.
+*/
+const processMarkdown = async (markdown, options) => {
+	try {
+		return await run(markdown, options);
+	} catch (error) {
+		return {
+			ok: false,
+			violations: [parseFailure(error)]
+		};
+	}
+};
+//#endregion
+//#region src/markdown/render.ts
+/** HTML elements that load, run or restyle something, or change how the HTML after them is read. */
+const DANGEROUS_TAGS = /* @__PURE__ */ new Set([
+	"script",
+	"style",
+	"iframe",
+	"frame",
+	"frameset",
+	"object",
+	"embed",
+	"applet",
+	"base",
+	"link",
+	"meta",
+	"form",
+	"svg",
+	"math",
+	"noscript",
+	"noembed",
+	"noframes",
+	"xmp",
+	"plaintext",
+	"listing",
+	"textarea",
+	"title",
+	"select",
+	"option",
+	"button",
+	"audio",
+	"video",
+	"source",
+	"track",
+	"picture",
+	"canvas",
+	"portal",
+	"dialog",
+	"slot",
+	"html",
+	"head",
+	"body",
+	"param",
+	"bgsound",
+	"image"
+]);
+/** A tag name that is safe to print: letters, digits and a few separators, starting with a letter. */
+const TAG_NAME = /^[A-Za-z][\w.-]{0,63}$/;
+/** The attributes that hold a URL, by the name `attributeName` gives them. */
+const URL_ATTRIBUTES = /* @__PURE__ */ new Set([
+	"href",
+	"xlinkhref",
+	"src",
+	"action",
+	"poster",
+	"background",
+	"cite",
+	"ping"
+]);
+function isProps(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sanitizeProps(raw) {
+	const props = {};
+	if (!isProps(raw)) return props;
+	for (const key of Object.keys(raw)) {
+		if (key.startsWith("$")) continue;
+		const name = attributeName(key);
+		if (isForbiddenAttribute(name)) continue;
+		const value = raw[key];
+		if (URL_ATTRIBUTES.has(name)) {
+			const url = urlValue(key, value);
+			if (url === void 0 || !isSafeUrl(url, name === "src" ? "image" : "link")) continue;
+		}
+		setOwn(props, key, typeof value === "string" && !isBinding(key) ? value.replaceAll("&", "&amp;") : value);
+	}
+	return props;
+}
+function marker(name) {
+	return [MARKER_TAG, {
+		kind: "raw-html",
+		name: TAG_NAME.test(name) ? shorten(name) : "?"
+	}];
+}
+function sanitizeElement(node, depth) {
+	const tag = node[0];
+	if (typeof tag !== "string") return void 0;
+	if (!NATIVE_TAGS.has(tag) && tag !== "hollware-marker") {
+		if (!TAG_NAME.test(tag) || DANGEROUS_TAGS.has(tag.toLowerCase())) return marker(tag);
+	}
+	const element = [tag, sanitizeProps(node[1])];
+	if (depth >= 100) return element;
+	for (let at = 2; at < node.length; at++) {
+		const child = node[at];
+		if (typeof child === "string") element.push(child);
+		else if (Array.isArray(child)) {
+			const clean = sanitizeElement(child, depth + 1);
+			if (clean !== void 0) element.push(clean);
+		}
+	}
+	return element;
+}
+/** Copies a document through the rules of this file. */
+function sanitizeDocument(document) {
+	const nodes = [];
+	if (Array.isArray(document.nodes)) {
+		for (const node of document.nodes) if (typeof node === "string") nodes.push(node);
+		else if (Array.isArray(node)) {
+			const clean = sanitizeElement(node, 1);
+			if (clean !== void 0) nodes.push(clean);
+		}
+	}
+	return {
+		frontmatter: document.frontmatter,
+		meta: document.meta,
+		nodes
+	};
+}
+/**
+* Renders a stored document to HTML with `@comark/html`. `@comark/html` is imported when the
+* first document is rendered, so that an isolate that never renders never loads it.
+*/
+const renderHtml = async (document) => {
+	const { renderHtmlFromDocument } = await import("@comark/html");
+	return renderHtmlFromDocument(sanitizeDocument(document));
+};
+//#endregion
+//#region src/operations/schemas.ts
+var schemas_exports = /* @__PURE__ */ __exportAll({
+	acknowledgedWarning: () => acknowledgedWarning,
+	collectionDescription: () => collectionDescription,
+	collectionName: () => collectionName,
+	componentDescription: () => componentDescription,
+	conflict: () => conflict,
+	contractDescription: () => contractDescription,
+	document: () => document,
+	entry: () => entry,
+	entryId: () => entryId,
+	entryStatus: () => entryStatus,
+	entrySummary: () => entrySummary,
+	format: () => format,
+	locale: () => locale,
+	markdown: () => markdown,
+	phase: () => phase,
+	publication: () => publication,
+	revisionId: () => revisionId,
+	severity: () => severity,
+	siteDescription: () => siteDescription,
+	slug: () => slug,
+	verdict: () => verdict,
+	version: () => version,
+	violation: () => violation
+});
+/**
+* The pieces the operation schemas share. Their descriptions become the JSON Schema that agents
+* read over MCP, so they are written for the agent.
+*/
+const collectionName = z.string().min(1).describe("A collection of the site, as describe_site lists it.");
+const locale = z.string().min(1).describe("A locale of the site, as describe_site lists it.");
+const slug = z.string().max(200).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).describe("The entry's path segment: lowercase letters and digits joined by hyphens, such as edge-caching-guide.");
+const entryId = z.string().regex(/^ent_[0-9A-HJKMNP-TV-Z]{26}$/).describe("The id of an entry (ent_…), as the other operations return it.");
+const revisionId = z.string().regex(/^rev_[0-9A-HJKMNP-TV-Z]{26}$/).describe("The id of a revision (rev_…).");
+const version = z.number().int().min(1).describe("The version of the entry you read. A change against an older version answers conflict.");
+const markdown = z.string().describe("The whole Markdown file: the YAML frontmatter between two --- lines, then the body. The collection schema in describe_site says what the frontmatter needs.");
+const entryStatus = z.enum([
+	"draft",
+	"scheduled",
+	"published"
+]);
+const severity = z.enum(["error", "warning"]);
+const phase = z.enum(["write", "publish"]);
+const violation = z.object({
+	contract: z.string().describe("The id of the contract."),
+	severity,
+	path: z.string().describe("A JSON Pointer into { frontmatter, body }: /frontmatter/title, or /body with a line."),
+	message: z.string(),
+	fix: z.string().describe("What to change so that the problem goes away."),
+	line: z.number().int().min(1).optional()
+});
+const verdict = z.object({
+	ok: z.boolean().describe("Whether there are no errors. Warnings do not count, but publish asks about them."),
+	phase,
+	errors: z.array(violation),
+	warnings: z.array(violation),
+	contractsHash: z.string().describe("A hash of the rules the content was checked against.")
+});
+const acknowledgedWarning = z.object({
+	contract: z.string(),
+	path: z.string()
+});
+const entrySummary = z.object({
+	id: entryId,
+	collection: z.string(),
+	locale: z.string(),
+	slug: z.string(),
+	translationGroup: z.string().nullable(),
+	status: entryStatus,
+	version: z.number().int().min(1),
+	frontmatter: z.record(z.string(), z.unknown()),
+	tags: z.array(z.string()),
+	hasUnpublishedChanges: z.boolean().describe("Whether the latest revision differs from the published one."),
+	publishedAt: z.string().nullable().describe("When the entry was first published, or null."),
+	updatedAt: z.string()
+});
+const publication = z.object({
+	revision: revisionId,
+	verdict: verdict.describe("The verdict of the publish phase."),
+	acknowledged: z.array(acknowledgedWarning).describe("The warnings acknowledged to publish."),
+	at: z.string()
+});
+/** The Comark document of a revision: what a site's renderer takes. */
+const document = z.object({
+	nodes: z.array(z.unknown()),
+	frontmatter: z.record(z.string(), z.unknown()),
+	meta: z.record(z.string(), z.unknown())
+});
+const entry = entrySummary.extend({
+	revision: revisionId.describe("The revision this view shows."),
+	verdict: verdict.describe("The verdict of the contracts when this revision was written."),
+	lastPublication: publication.nullable(),
+	markdown: z.string().optional(),
+	document: document.optional(),
+	html: z.string().optional()
+});
+const conflict = z.object({
+	currentVersion: z.number().int().min(1),
+	headRevision: revisionId
+});
+const format = z.enum([
+	"markdown",
+	"document",
+	"html"
+]);
+const componentDescription = z.object({
+	name: z.string(),
+	description: z.string().nullable(),
+	example: z.string().nullable(),
+	props: z.record(z.string(), z.unknown()).describe("The JSON Schema of the props.")
+});
+const contractDescription = z.object({
+	id: z.string(),
+	severity,
+	phases: z.array(phase),
+	description: z.string()
+});
+const collectionDescription = z.object({
+	name: z.string(),
+	schema: z.record(z.string(), z.unknown()).describe("The JSON Schema of the frontmatter."),
+	routes: z.record(z.string(), z.string()).describe("The public path of an entry, per locale."),
+	translationGroupField: z.string().nullable().describe("The frontmatter field that the translations of an entry share, or null."),
+	tagsField: z.string().nullable().describe("The frontmatter field with the tags, or null."),
+	sortByField: z.string().nullable().describe("The frontmatter field, a date, that orders published listings, newest first; null when they follow the date of first publication."),
+	components: z.array(componentDescription),
+	contracts: z.array(contractDescription),
+	maxMarkdownBytes: z.number().int(),
+	styleGuide: z.string().nullable()
+});
+const siteDescription = z.object({
+	key: z.string(),
+	locales: z.array(z.string()),
+	defaultLocale: z.string(),
+	styleGuide: z.string().nullable(),
+	collections: z.array(collectionDescription)
+});
+//#endregion
+//#region src/operations/types.ts
+/** Declares an operation spec, keeping the literal types of its name and schemas. */
+function defineOperation(spec) {
+	return spec;
+}
+//#endregion
+//#region src/operations/specs.ts
+/**
+* The operations of v0.1, specified once (ADR-017). The outcomes and the effect of each one are
+* the table of the v0.1 plan; `tests/operations.test.ts` holds it literally. Inputs are strict
+* objects, so a misspelled field is an error instead of being ignored.
+*/
+const describeSite = defineOperation({
+	name: "describe_site",
+	title: "Describe the site",
+	description: "Describes the site: its locales, and for each collection the JSON Schema of the frontmatter, the components the body may use, the contracts that writes and publishes are checked against, and the style guides. Read it before writing.",
+	input: z.strictObject({}),
+	output: z.object({
+		outcome: z.enum(["ok"]),
+		site: siteDescription
+	}),
+	scopes: ["content:read"],
+	effect: "read",
+	outcomes: { ok: { isError: false } }
+});
+const listEntries = defineOperation({
+	name: "list_entries",
+	title: "List entries",
+	description: "Lists the entries of a collection, newest first, filtered by locale, tag or status. Pass the nextCursor of an answer as cursor to get the next page.",
+	input: z.strictObject({
+		collection: collectionName,
+		locale: locale.optional(),
+		tag: z.string().min(1).optional(),
+		status: entryStatus.optional(),
+		limit: z.number().int().min(1).max(100).default(20),
+		cursor: z.string().min(1).optional()
+	}),
+	output: z.object({
+		outcome: z.enum(["ok"]),
+		entries: z.array(entrySummary),
+		nextCursor: z.string().nullable().describe("The cursor of the next page, or null.")
+	}),
+	scopes: ["content:read"],
+	effect: "read",
+	outcomes: { ok: { isError: false } }
+});
+const getEntry = defineOperation({
+	name: "get_entry",
+	title: "Get an entry",
+	description: "Gets an entry by collection, locale and slug, with its latest revision: the Markdown, the frontmatter, the verdict of its contracts and its last publication.",
+	input: z.strictObject({
+		collection: collectionName,
+		locale,
+		slug,
+		formats: z.array(format).min(1).default(["markdown"]).describe("What to return of the revision: markdown, the Comark document, or html.")
+	}),
+	output: z.object({
+		outcome: z.enum(["ok", "not_found"]),
+		entry: entry.optional()
+	}),
+	scopes: ["content:read"],
+	effect: "read",
+	outcomes: {
+		ok: { isError: false },
+		not_found: { isError: true }
+	}
+});
+const getTranslations = defineOperation({
+	name: "get_translations",
+	title: "Get the translations of an entry",
+	description: "Gets the entries of a translation group of a collection, one per locale. The group is the value of the field that describe_site names as translationGroupField.",
+	input: z.strictObject({
+		collection: collectionName,
+		translationGroup: z.string().min(1)
+	}),
+	output: z.object({
+		outcome: z.enum(["ok", "not_found"]),
+		entries: z.array(entrySummary).optional()
+	}),
+	scopes: ["content:read"],
+	effect: "read",
+	outcomes: {
+		ok: { isError: false },
+		not_found: { isError: true }
+	}
+});
+const createDraft = defineOperation({
+	name: "create_draft",
+	title: "Create a draft",
+	description: "Creates an entry from a Markdown file and saves it as a draft at version 1. Contract errors do not stop the draft: it is saved, and the verdict says what to fix before publishing. It is refused only when it cannot be stored: the file is too large, its frontmatter or syntax does not parse, or the slug or translation is taken.",
+	input: z.strictObject({
+		collection: collectionName,
+		locale,
+		slug,
+		markdown
+	}),
+	output: z.object({
+		outcome: z.enum(["saved", "refused"]),
+		entry: entrySummary.optional(),
+		verdict: verdict.optional()
+	}),
+	scopes: ["content:write"],
+	effect: "write",
+	outcomes: {
+		saved: { isError: false },
+		refused: { isError: true }
+	}
+});
+const updateDraft = defineOperation({
+	name: "update_draft",
+	title: "Update a draft",
+	description: "Saves a new revision of an entry from the whole Markdown file, if the entry is still at the version you read; otherwise it answers conflict with the current version, and nothing is saved. A file identical to the latest revision answers unchanged. Contract errors do not stop the save; the verdict says what to fix.",
+	input: z.strictObject({
+		id: entryId,
+		version,
+		markdown
+	}),
+	output: z.object({
+		outcome: z.enum([
+			"saved",
+			"unchanged",
+			"conflict",
+			"not_found",
+			"refused"
+		]),
+		entry: entrySummary.optional(),
+		verdict: verdict.optional(),
+		conflict: conflict.optional()
+	}),
+	scopes: ["content:write"],
+	effect: "edit",
+	outcomes: {
+		saved: { isError: false },
+		unchanged: { isError: false },
+		conflict: { isError: true },
+		not_found: { isError: true },
+		refused: { isError: true }
+	}
+});
+const validate = defineOperation({
+	name: "validate",
+	title: "Validate a Markdown file",
+	description: "Checks a Markdown file against every contract of the collection, as publish would, without saving anything: the verdict lists each problem with its fix.",
+	input: z.strictObject({
+		collection: collectionName,
+		locale,
+		slug,
+		markdown
+	}),
+	output: z.object({
+		outcome: z.enum(["ok"]),
+		verdict
+	}),
+	scopes: ["content:read"],
+	effect: "read",
+	outcomes: { ok: { isError: false } }
+});
+const publish = defineOperation({
+	name: "publish",
+	title: "Publish an entry",
+	description: "Publishes the latest revision of an entry, if the entry is still at the version you read. It is blocked while the contracts report errors. Warnings have to be acknowledged: an answer of needs_acknowledgement lists them, and publish again with them in acknowledgeWarnings.",
+	input: z.strictObject({
+		id: entryId,
+		version,
+		acknowledgeWarnings: z.array(acknowledgedWarning).default([]).describe("The warnings you accept, as needs_acknowledgement listed them.")
+	}),
+	output: z.object({
+		outcome: z.enum([
+			"published",
+			"blocked",
+			"needs_acknowledgement",
+			"conflict",
+			"not_found"
+		]),
+		entry: entrySummary.optional(),
+		verdict: verdict.optional(),
+		conflict: conflict.optional()
+	}),
+	scopes: ["content:publish"],
+	effect: "write",
+	outcomes: {
+		published: { isError: false },
+		blocked: { isError: true },
+		needs_acknowledgement: { isError: false },
+		conflict: { isError: true },
+		not_found: { isError: true }
+	}
+});
+const unpublish = defineOperation({
+	name: "unpublish",
+	title: "Unpublish an entry",
+	description: "Takes an entry off the public site and keeps it, with its revisions, as a draft. An entry that is not published stays as it is.",
+	input: z.strictObject({ id: entryId }),
+	output: z.object({
+		outcome: z.enum(["unpublished", "not_found"]),
+		entry: entrySummary.optional()
+	}),
+	scopes: ["content:publish"],
+	effect: "destructive",
+	outcomes: {
+		unpublished: { isError: false },
+		not_found: { isError: true }
+	}
+});
+/** Every operation of v0.1, sorted by name: the order of `tools/list`. */
+const OPERATIONS = [
+	createDraft,
+	describeSite,
+	getEntry,
+	getTranslations,
+	listEntries,
+	publish,
+	unpublish,
+	updateDraft,
+	validate
+];
+//#endregion
+//#region src/scopes.ts
+/**
+* The scopes a token carries. An operation asks for scopes, never for a role: what a token may
+* do is its own scopes intersected with those of its user's role (ADR-019).
+*/
+const SCOPES = [
+	"content:read",
+	"content:write",
+	"content:publish",
+	"schema:admin"
+];
+/** Whether a string is one of the scopes. */
+function isScope(value) {
+	return SCOPES.some((scope) => scope === value);
+}
+//#endregion
+//#region src/tokens.ts
+/**
+* Personal tokens (ADR-019): `hw_pat_` and 52 characters of lowercase Crockford base 32, which
+* carry 260 random bits. The CLI makes a token and prints it once. The server never stores it:
+* it keeps the SHA-256 of the whole token, in hex, and finds a presented token by that hash. The
+* row of a token has an id of its own (`tok_…`, see `ids.ts`), its scopes and its expiry.
+*/
+const PERSONAL_TOKEN_PREFIX = "hw_pat_";
+/** Days until a new personal token expires, unless whoever creates it asks for another expiry. */
+const PERSONAL_TOKEN_TTL_DAYS = 90;
+const ALPHABET = "0123456789abcdefghjkmnpqrstvwxyz";
+const SECRET_LENGTH = 52;
+const TOKEN_PATTERN = /^hw_pat_[0-9a-hjkmnp-tv-z]{52}$/;
+/**
+* A new personal token. Each of the 52 random bytes gives one character (its low 5 bits, which
+* are uniform because 256 is a multiple of 32). `random` defaults to `crypto.getRandomValues`;
+* tests pass their own bytes.
+*/
+function generatePersonalToken(random = crypto.getRandomValues(new Uint8Array(SECRET_LENGTH))) {
+	if (random.length !== SECRET_LENGTH) throw new RangeError(`a personal token takes ${SECRET_LENGTH} random bytes, got ${random.length}`);
+	let secret = "";
+	for (const byte of random) secret += ALPHABET.charAt(byte & 31);
+	return PERSONAL_TOKEN_PREFIX + secret;
+}
+/** Whether a string has the shape of a personal token. It says nothing about whether one exists. */
+function isPersonalToken(value) {
+	return TOKEN_PATTERN.test(value);
+}
+/** The SHA-256 of a token, in lowercase hex: what the `tokens` table stores and looks up. */
+async function hashPersonalToken(token) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+//#endregion
 //#region src/index.ts
 const name = "@hollware/core";
 //#endregion
-export { name };
+export { BUILT_IN_CONTRACT_IDS, COMARK_VERSION, ConfigError, DEFAULT_MAX_MARKDOWN_BYTES, ERROR_CODES, HollwareError, ID_PREFIXES, MAX_MARKDOWN_BYTES_CEILING, OPERATIONS, PERSONAL_TOKEN_PREFIX, PERSONAL_TOKEN_TTL_DAYS, PIPELINE_VERSION, REFUSAL_CONTRACT_IDS, SCOPES, SITE_KEY_MAX_LENGTH, SITE_KEY_PATTERN, contracts, createDraft, defineCollection, defineComponent, defineConfig, defineContract, defineOperation, describeBuiltInContracts, describeContract, describeResolvedSite, describeSite, generatePersonalToken, getEntry, getTranslations, hashPersonalToken, isBuiltInContract, isId, isPersonalToken, isScope, isSiteKey, listEntries, name, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, schemas_exports as schemas, sizeLimitViolation, ulid, uniqueSlugViolation, uniqueTranslationViolation, unpublish, updateDraft, validate };