@wxxb789/anc 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ANC contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,295 @@
+# anc — a privacy-preserving static site generator for Markdown notes and digital gardens
+
+[![status: pre-release](https://img.shields.io/badge/status-pre--release-orange)](#status)
+[![node: >=22.18](https://img.shields.io/badge/node-%E2%89%A522.18-brightgreen)](#working-on-the-tool)
+[![verify](https://github.com/wxxb789/anc/actions/workflows/verify.yml/badge.svg)](https://github.com/wxxb789/anc/actions/workflows/verify.yml)
+[![license: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+[![docs: core design](https://img.shields.io/badge/docs-core%20design-blue)](docs/core-design/README.md)
+
+[English](README.md) · [简体中文](README_zh-cn.md)
+
+![anc, a privacy-preserving static site generator: publish your Markdown notes from git as a static digital garden with wikilinks, backlinks, a link graph, and Pagefind full-text search](docs/assets/readme-banner.webp)
+
+**anc turns a git repository of Markdown into a self-hosted static knowledge
+garden**: articles, backlinks, a link graph, breadcrumbs, tags, collections, a table
+of contents, full-text search, feeds, and a sitemap — all rendered ahead of time into
+plain static files that any host can serve.
+
+It reads the notes you already have, including Obsidian-style `[[wikilinks]]`, and
+needs no database, server, or account. Every note publishes unless you exclude it.
+Ordinary reading needs no JavaScript, and nothing is sent to a third party.
+
+![A note page built by anc: breadcrumbs, published and updated dates from git, tags, aliases, a table of contents, and a callout, in the dark theme](docs/assets/screenshot-note.webp)
+
+*anc* is short for **A**ctive **N**oise **C**ancelling. The command it installs is
+`anc`; the package is named `@wxxb789/anc` and is not yet published to npm.
+
+## Contents
+
+- [Status](#status)
+- [Why anc](#why-anc)
+- [Features](#features)
+- [How it works](#how-it-works)
+- [Screenshots](#screenshots)
+- [Quick start](#quick-start)
+- [How publication is decided](#how-publication-is-decided)
+- [Links, tags, and metadata](#links-tags-and-metadata)
+- [Architecture](#architecture)
+- [Working on the tool](#working-on-the-tool)
+- [Adoption and hosting](#adoption-and-hosting)
+- [FAQ](#faq)
+- [Documentation](#documentation)
+- [License](#license)
+
+## Status
+
+**Pre-release.** The tool builds, previews, and ships the GitHub Action and the `init`
+command. It is named `@wxxb789/anc`, because the unscoped `anc` is already taken on
+npm, and it is not on the registry yet; install from a checkout or from the tarball the
+repository builds. [`docs/adoption.md`](docs/adoption.md) gives both, along with
+configuration, exclusion, links, and hosting. ANC is not yet 0.1.0-ready or
+1.0.0-ready and makes no backward-compatibility promise.
+
+## Why anc
+
+- **Your notes stay yours.** Markdown in git is the source of truth. There is no
+  import step, no proprietary vault format, and no hosted service to subscribe to.
+- **Privacy is decided at publication.** `publish: false` and exclusion globs withhold
+  a note, a typo in a pattern fails the build instead of leaking drafts, and the build
+  log never prints a withheld file's name.
+- **A digital garden, not a blog.** Backlinks and the link graph are computed at
+  build time from how your notes link; hover previews and graph exploration read the
+  same public snapshot lazily.
+- **Static and portable.** The output is a `dist/` folder of HTML, CSS, a Pagefind
+  index, and one SQLite file. GitHub Pages, Cloudflare Pages, Netlify, or any web
+  server can host it at the root of a domain.
+
+## Features
+
+| Surface | What you get |
+| --- | --- |
+| Markdown | CommonMark plus GFM: tables, task lists, footnotes, callouts, highlighted code |
+| Links | `[[wikilinks]]`, relative and root-anchored links, Markdown links, and note embeds |
+| Relationships | Backlinks, outgoing links, and a link graph, rendered to static HTML |
+| Navigation | Tags, collections, breadcrumbs, table of contents, and recent changes |
+| Search | Pagefind full-text search, with a per-document language |
+| Rich content | Client-rendered math and Mermaid diagrams, each with a source fallback |
+| Discovery | Atom feed, sitemap, `robots.txt`, canonical URLs, and Open Graph metadata |
+| Languages | Per-document chrome in English and Simplified Chinese (`zh-CN`) |
+| Privacy | Default-publish with explicit withholding; released names stay out of logs |
+| Delivery | Static HTML by default; a public SQLite/WASM snapshot for lazy previews |
+| Security | A strict Content-Security-Policy in `dist/_headers`; no trackers or analytics |
+
+## How it works
+
+![How anc works: Markdown notes in a git repository go through anc build, which applies exclusion gates, resolves wikilinks and backlinks, and renders every page ahead of time into a dist/ folder of static HTML, a Pagefind index, and one SQLite snapshot, which any static host serves](docs/assets/build-pipeline.webp)
+
+1. **Write** Markdown in the git repository you already keep, in any editor —
+   Obsidian, VS Code, or plain `vim`.
+2. **Build** with `anc build`. Exclusions are applied first, then every link is
+   resolved and every page is rendered ahead of time.
+3. **Host** the resulting `dist/` folder anywhere that serves static files.
+
+## Screenshots
+
+Every image below is a real page built by anc from a small synthetic garden;
+[`docs/assets/make-screenshots.mjs`](docs/assets/make-screenshots.mjs) regenerates them.
+
+| Backlinks and outgoing links | Local link graph |
+| --- | --- |
+| ![Links to and Linked from lists on a note page, each rendered as static HTML](docs/assets/screenshot-relationships.webp) | ![The Nearby notes graph around one note, laid out at build time with a table fallback](docs/assets/screenshot-graph.webp) |
+| **Hover preview** | **Full-text search** |
+| ![A link preview card showing the target note's title and excerpt on hover](docs/assets/screenshot-preview.webp) | ![The Pagefind search dialog with highlighted matches across notes](docs/assets/screenshot-search.webp) |
+
+## Quick start
+
+From a checkout of this repository, against your own notes:
+
+```bash
+node /path/to/anc/bin/anc.mjs build --content ~/notes --out ~/notes/dist
+node /path/to/anc/bin/anc.mjs preview --dist ~/notes/dist
+```
+
+Or install the tarball the repository builds:
+
+```bash
+cd /path/to/anc && pnpm run pack:tarball
+cd ~/notes
+pnpm add -D /path/to/anc/wxxb789-anc-*.tgz   # or: npm install -D /path/to/anc/wxxb789-anc-*.tgz
+```
+
+Then name the commands in your notes repository's `package.json`; the same scripts
+work under pnpm and npm:
+
+```json
+{
+  "scripts": {
+    "build": "anc build",
+    "preview": "anc preview",
+    "review": "anc review",
+    "release": "anc build --release"
+  }
+}
+```
+
+```bash
+pnpm run build     # or: npm run build
+pnpm run preview   # serves dist/ at http://localhost:4321/
+pnpm run review    # write .publish-set.json for inspection
+pnpm run release   # exact publish set + pinned Gitleaks on PATH
+```
+
+To call the binary directly, use `pnpm exec anc build`, or `npx --no anc build` under
+npm: `--no` makes `npx` refuse rather than fetch from the registry when the local
+install is missing. After publication the registry form will be
+`npx @wxxb789/anc build`. **Do not type bare `npx anc`:** outside a project with the
+tarball installed it falls back to the registry, where the unscoped `anc` is an
+unrelated third-party package that `npx` would offer to download and run.
+
+## How publication is decided
+
+**Everything publishes unless you exclude it.** There is no allowlist and no
+`publish: true` to opt in with. Two mechanisms withhold a note, and when they
+disagree the one pointing at *not publishing* wins:
+
+![How anc decides publication: every Markdown file in the repository publishes by default, publish: false and exclude globs withhold notes, a glob matching nothing fails the build, the public dist/ receives the site, and a private content-report.json under .git/ receives the withheld names](docs/assets/publication-flow.webp)
+
+```markdown
+---
+publish: false
+---
+```
+
+```yaml
+# publish.config.yaml
+title: Field Notes
+origin: https://notes.example.org/
+exclude:
+  - "drafts/**"
+  - "clients/**"
+```
+
+A pattern that matches nothing stops the build. That is deliberate: `draft/**` typed
+for `drafts/**` would otherwise build green while the drafts went live. A link to a
+withheld note keeps the full label and path you wrote, resolves to `/private/`, and is
+reported; the withheld note's own body, title, and excerpt reach nothing.
+
+The build prints counts and no filenames. The list of dropped files goes to
+`content-report.json` under `<git-dir>/publish-report/` (or your user state directory
+outside git), which `git add -A` cannot reach and which is never copied into `dist/`.
+A workflow log on a public repository is world-readable, so a withheld file's path is
+a disclosure there; that is why the names and the counts are split.
+
+## Links, tags, and metadata
+
+- Five link spellings resolve in one pass, following Obsidian's own order: `[[note]]`,
+  `[[./sibling]]`, `[[folder/note]]`, `[text](../other.md)`, and `[[note|shown]]`.
+- Tags come from a frontmatter list, and each one gets a `/tags/<key>/` page. The
+  first folder under the content root becomes the flat collection.
+- Git history supplies `created` and `updated`; frontmatter does not.
+- Frontmatter can set `slug`, `language`, `description`, `tags`, and `aliases`.
+  Aliases are public, searchable metadata with no route of their own — deliberately
+  not alternate link targets.
+- Non-Markdown files are never published. There is no asset pipeline, so an embedded
+  image degrades to text and is reported.
+
+## Architecture
+
+Long-term architecture is documented in [`docs/core-design/`](docs/core-design/README.md);
+bounded development outcomes and their completion evidence live in
+[`docs/goals/`](docs/goals/README.md). Markdown stays canonical, the compiler IR stays
+private, static HTML delivers pages, and Pagefind owns full-text search.
+
+- Astro `output: "static"`; the build output is `dist/`.
+- Content is produced by `scripts/markdown-to-artifact.ts` and `scripts/resolve-links.ts`,
+  then validated against `src/lib/schema.ts` before anything renders.
+- The one public relational and preview index is `data/site.<sha256>.sqlite`, holding
+  `nodes`, `edges`, `aliases`, `tags`, and `node_tags`. It contains no page body and no
+  SQLite FTS; the browser fetches it lazily in a read-only Worker for hover previews,
+  tag browsing, and graph exploration.
+- Base interactive surfaces are a few KB gzip of vanilla script. Pages containing math
+  or diagrams lazy-load the accepted client renderers; both have source fallbacks.
+- No D1, R2, Functions, analytics, comments, or build-time data service. A runtime
+  application server is not required.
+
+## Working on the tool
+
+```bash
+pnpm install
+pnpm run verify          # lint, check, build, inventory, secret/residue scans, tests
+pnpm run build           # the build chain alone
+pnpm run build:fixture   # rebuild against the 32-note corpus
+pnpm run build:example   # build example/ into .tmp/example-dist
+pnpm run preview:example # serve the example build locally
+pnpm run pack:tarball    # compile TypeScript and pack the installable tarball
+pnpm run smoke:tarball   # install that tarball in a foreign repo and read it
+```
+
+`pnpm run verify` requires the exact Gitleaks version exported by
+`scripts/scan-secrets.ts` on `PATH`; an ordinary `pnpm run build` does not.
+`packageManager` in `package.json` pins the pnpm version, which `corepack enable`
+honours. Dependencies install into a symlinked `node_modules`, so a package not
+declared in `package.json` does not resolve — a boundary rather than a preference.
+
+Read [`AGENTS.md`](AGENTS.md) before changing anything. It carries the verification
+contract, what runs where, and what is known stale and whose it is. The synthetic
+corpus under [`example/`](example/) is the smallest useful feature tour, with public
+notes, both exclusion mechanisms, links and backlinks, rich Markdown, math, and Mermaid.
+
+## Adoption and hosting
+
+The GitHub Action at the repository root runs a release build on a supported Linux
+runner, installs the checksum-pinned secret scanner, and writes a static `dist/`. Any
+static host serves that directory, at the root of a domain: a site under a path such
+as `https://<user>.github.io/<repo>/` is not supported. `dist/_headers` carries a
+Content-Security-Policy and three other security headers in Cloudflare Pages' format;
+a host that ignores that file still gets the policy from each page's `<meta>` tag,
+except `frame-ancestors`, and serves the other headers only if configured to.
+
+Publication is an explicit external side effect. Building does not deploy, and nothing
+in this repository can. [`docs/adoption.md`](docs/adoption.md) covers both the Action
+and a hand-assembled GitHub Pages example, with no secrets required.
+
+## FAQ
+
+**Can anc publish an Obsidian vault?**
+Yes: point `--content` at the vault. anc reads Obsidian-style `[[wikilinks]]`,
+`[[note|shown text]]`, note embeds, and callouts; keeping the vault in git also gives
+each page its created and updated dates. Plugins and non-Markdown attachments are not
+processed.
+
+**Do I need a server, a database, or an account?**
+No. The output is static files. Search runs from a Pagefind index and relationships
+from one SQLite file, both fetched by the reader's browser only when used.
+
+**How do I keep a note private?**
+Add `publish: false` to its frontmatter, or match its path with an `exclude:` glob in
+`publish.config.yaml`. See [How publication is decided](#how-publication-is-decided).
+
+**Does the site work without JavaScript?**
+Reading, navigation, backlinks, and the link graph's table fallback are plain HTML.
+Search, hover previews, math, and diagrams need JavaScript.
+
+**Where can I host it?**
+Any static host at the root of a domain: GitHub Pages, Cloudflare Pages, Netlify, or
+your own web server. See [Adoption and hosting](#adoption-and-hosting).
+
+## Documentation
+
+- [`docs/adoption.md`](docs/adoption.md) — what a stranger with a notes repository does.
+- [`docs/core-design/`](docs/core-design/README.md) — authoritative long-term architecture.
+- [`docs/goals/`](docs/goals/README.md) — active goals and the completed-goal archive.
+- [`docs/gate-reading.md`](docs/gate-reading.md) — the seven ways an instrument lies
+  about itself.
+- [`AGENTS.md`](AGENTS.md) — contributor workflow and the verification contract.
+- [`example/`](example/) — a synthetic corpus demonstrating every public surface.
+
+[Astro documentation](https://docs.astro.build) · [Pagefind documentation](https://pagefind.app/docs/)
+
+## License
+
+Released under the [MIT License](LICENSE).
+
+---
+
+[English](README.md) · [简体中文](README_zh-cn.md)

package/astro.config.mjs

@@ -0,0 +1,255 @@
+// @ts-check
+import { defineConfig } from 'astro/config';
+import { readFileSync } from 'node:fs';
+import { wasmModuleUrl } from './src/lib/wasm-asset.js';
+import { configuredSnapshotWorkspace } from './src/lib/snapshot.js';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { DIAGRAM_MODE } from './src/lib/diagram-mode.js';
+import { MATH_MODE } from './src/lib/math-mode.js';
+import { configForBuild } from './scripts/load-config.js';
+import { vendorProvenancePlugin } from './scripts/vendor-provenance.js';
+
+/**
+ * The private snapshot workspace this build staged into.
+ *
+ * The empty-as-unset choice lives in `configuredSnapshotWorkspace`, shared with
+ * `snapshot-reader.ts`; the `??` this line used to carry resolved an empty
+ * value to the working directory while the reader fell back to the default, so
+ * the binding below was substituted as `null` and the Worker silently never
+ * started.
+ */
+const SNAPSHOT_WORKSPACE = resolve(process.cwd(), configuredSnapshotWorkspace(process.env['SNAPSHOT_WORKSPACE']));
+
+/** Read once: the binding and its module URL come from the same file. */
+const STAGED_WASM = readStaged('wasm.json');
+
+/**
+ * Read one staged binding from the private snapshot workspace.
+ *
+ * The design calls for a private generated binding rather than a public manifest
+ * (`docs/core-design/build-and-runtime.md`). `vite.define` substitutes the
+ * digest-named same-origin URLs into the hashed client/worker bundles at build
+ * time: it carries no local path and no corpus data, and a build with no staging
+ * (dev, unit tests) substitutes `null`, so the Worker fails closed and fetches
+ * nothing. A virtual module was tried first and rejected: Vite's worker
+ * environment did not run the plugin's resolver for it.
+ *
+ * @param {string} name
+ * @returns {Record<string, any> | null}
+ */
+function readStaged(name) {
+  try {
+    return JSON.parse(readFileSync(resolve(SNAPSHOT_WORKSPACE, name), 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Keep a client runtime out of the build unless client mode wants it.
+ *
+ * `src/pages/notes/[slug].astro` has Astro `<script>` tags importing
+ * `src/scripts/diagram.ts` and `src/scripts/math.ts`, and Astro bundles such a
+ * script **eagerly**: wrapping the tag in a condition or guarding the import at
+ * runtime does not keep it out of `dist/`. Measured, not assumed — the guarded
+ * version emitted 99 Mermaid chunks on a build whose mode was `build-time`,
+ * orphaned and referenced by no page, and tripped the privacy residue scan on
+ * `[[` byte sequences inside the parser.
+ *
+ * A plugin rather than `resolve.alias`, because an alias is matched against the
+ * *raw specifier* — here `../../scripts/diagram.ts` — before resolution, so a
+ * pattern written against the real path never fires. `resolveId` runs after the
+ * path is known, which is the only place the question "is this that module" can
+ * be asked reliably.
+ *
+ * Typed structurally rather than as `import('vite').Plugin`: `vite` reaches this
+ * tree through Astro and is not a declared dependency, and under pnpm an
+ * undeclared package does not resolve — which is the boundary `AGENTS.md` names
+ * as a feature. Adding `vite` to `package.json` to annotate one function would
+ * spend a dependency on a type.
+ *
+ * @param {'diagram' | 'math'} runtime
+ * @param {'build-time' | 'client'} mode
+ * @returns {{
+ *   name: string,
+ *   enforce: 'pre',
+ *   resolveId: (
+ *     this: { resolve: (source: string, importer: string | undefined, options: object) =>
+ *       Promise<{ id: string } | null> },
+ *     source: string,
+ *     importer: string | undefined,
+ *     options: object,
+ *   ) => Promise<string | null>,
+ * }}
+ */
+function clientRuntimePlugin(runtime, mode) {
+  const stub = fileURLToPath(new URL(`src/scripts/${runtime}-disabled.ts`, import.meta.url));
+  // The extension is matched loosely because it is not the same in both trees:
+  // this repository runs `diagram.ts` directly, while the packaged tarball ships
+  // it compiled to `diagram.js` (`scripts/compile-package.ts`). Pinning `.ts`
+  // here meant the redirect silently stopped firing once installed — Mermaid's
+  // whole runtime was then bundled into a `build-time` site, which the residue
+  // scan caught on `[[` byte sequences inside the parser. Matching either
+  // extension keeps one rule true of both trees.
+  //
+  // **Parameterised over the runtime rather than duplicated**, because math
+  // needs exactly this arrangement for exactly this reason and a second copy is
+  // a second place for the `.ts`/`.js` lesson above to be relearned. The two
+  // modes are separate constants (`DIAGRAM_MODE`, `MATH_MODE`) — the costs and
+  // the evidence differ, so one switch must not carry the other's consequences —
+  // but the mechanism that keeps an unselected runtime out of `dist/` is one.
+  const target = new RegExp(String.raw`[\\/]src[\\/]scripts[\\/]${runtime}\.(?:ts|js)$`);
+  return {
+    name: `anc:${runtime}-mode`,
+    // Ahead of Vite's own resolver, so the redirect happens before the module
+    // is loaded and its imports crawled.
+    enforce: 'pre',
+    async resolveId(source, importer, options) {
+      if (mode === 'client') return null;
+      const resolved = await this.resolve(source, importer, { ...options, skipSelf: true });
+      return resolved !== null && target.test(resolved.id) ? stub : null;
+    },
+  };
+}
+
+/**
+ * THE ONE PLACE A SITE'S PUBLIC ORIGIN IS WRITTEN DOWN.
+ *
+ * **`.localhost` rather than `.invalid`, and the change is the point of
+ * TK-31.** RFC 6761 reserves `.localhost` and requires resolvers to map the
+ * name *and all its subdomains* to loopback, so this is a name that cannot
+ * resolve to anybody else's server — the property `.invalid` was chosen for —
+ * and that additionally *works*: a preview build's canonical links, feed, and
+ * sitemap all point at a local origin a browser can actually follow.
+ *
+ * The value it replaced was this project's own name under `.invalid`, which was safe and
+ * was still one owner's name on every stranger's site. That is the whole of
+ * plan decision D2. `.invalid` was never wrong about *safety* — TK-24's gate
+ * was right that a reserved name cannot misdirect a crawler — it was wrong
+ * about *whose*, and a default that belongs to nobody is what this ticket owes
+ * every user who configures nothing.
+ *
+ * **Deliberately no port**, per plan §5.5: a canonical URL, a feed id, and a
+ * `<loc>` should not carry a development port, and they are not deployable
+ * anyway. `astro dev` serves `http://localhost:4321/` regardless; what this
+ * governs is the absolute URLs written *into* the built documents.
+ *
+ * **This is a preview origin, not a publishable one, and nothing here can tell
+ * the difference.** A site built with it is complete and correct and obviously
+ * local at a glance — which is a property `.invalid` gave up by producing URLs
+ * that looked plausible. Refusing to *deploy* it belongs to the deploy step,
+ * which this repository does not have and does not perform.
+ *
+ * **A user's own `publish.config.yaml` overrides it, and this stays the
+ * fallback rather than moving into the loader.** That is the point of the
+ * arrangement rather than an accident of it: a build of *this* repository, and
+ * a stranger's build before they have configured anything, both need an origin,
+ * and there is exactly one place to read it from. `scripts/load-config.ts`
+ * deliberately returns `undefined` for an unconfigured origin — a default there
+ * would be a second home for this value. `tests/metadata.test.ts` fails if the
+ * host appears in any file under `src/`, `scripts/`, `tests/`, or `public/`
+ * other than this one.
+ */
+const DEFAULT_ORIGIN = 'http://publish.localhost/';
+
+/**
+ * The user's configuration, read once at config evaluation.
+ *
+ * `configForBuild` resolves the directory from `PUBLISH_CONFIG_DIR`, falling
+ * back to the working directory. A packaged build has already changed its
+ * working directory to the installed package by the time this runs, which is
+ * why the variable exists at all; `bin/anc.mjs` documents the
+ * same boundary for `CONTENT_ARTIFACT`. For a build of *this* repository the
+ * fallback is the repository root — so a `publish.config.yaml` committed here
+ * would reconfigure this repository's own build, which is the honest
+ * description and not a bug: this repository is the tool, and there is no such
+ * file in it.
+ *
+ * A malformed config stops the build before a single page is generated — the
+ * ordering `docs/plans/ssg-generalisation-plan.md` §4.3 asks for, where a config
+ * error cannot be masked by a build that otherwise succeeded.
+ *
+ * **Caught rather than thrown, because this module scope has no boundary above
+ * it that knows how to print one.** `bin/anc.mjs` prints a
+ * `BuildFailure`'s own message and nothing else; a `astro build` or `astro dev`
+ * run directly has only Astro's config loader, which was measured printing the
+ * composed message *plus* a stack trace carrying four absolute host paths —
+ * `at refuse (Q:/…/scripts/load-config.ts:313:8)` and three more. TK-25 §2.3
+ * forbids a discovered filesystem path on that stream, and `astro dev`
+ * evaluates this same scope, so the leak is not confined to the packaged path.
+ * Printing the message and exiting keeps the diagnostic and drops the trace.
+ */
+function loadUserConfig() {
+  try {
+    return configForBuild();
+  } catch (error) {
+    // Only a message composed under the disclosure rule may be printed. Anything
+    // else is a string this project did not write, on a world-readable stream.
+    if (error instanceof Error && error.name === 'BuildFailure') {
+      console.error(error.message);
+    } else {
+      console.error('the configuration file could not be read');
+    }
+    process.exit(1);
+  }
+}
+
+const config = loadUserConfig();
+
+/**
+ * Hand the configured title to the page modules.
+ *
+ * `src/lib/site.ts` reads it from here and cannot read it from anywhere else:
+ * importing `scripts/load-config.ts` from `src/lib/` breaks the build, because
+ * Astro evaluates that module out of `dist/.prerender/` and the loader's
+ * dependency reads `../package.json` relative to its own URL — measured,
+ * `ENOENT: … dist\.prerender\package.json` at "generating static routes". The
+ * variable is the same seam `CONTENT_ARTIFACT` already uses across the same
+ * boundary, and that module documents the mechanism at length.
+ *
+ * Set here rather than in `bin/anc.mjs` because this is the
+ * one scope that runs for *every* way a build starts — the packaged binary,
+ * `astro build` in a checkout, and `astro dev` — and each of them needs the
+ * title. `config.title` always holds a value: `loadConfig` applies its own
+ * default when the user configured nothing, which is why there is no `??` here
+ * and why an unconfigured build still gets a legible name.
+ *
+ * **The name is spelled out rather than imported, deliberately.** Importing
+ * `SITE_TITLE_VARIABLE` from `src/lib/site.ts` would evaluate that module here,
+ * at config time, *before* this line runs — so its `SITE_NAME` would be
+ * computed from an unset variable, giving one process two module instances that
+ * disagree about the site's name. A literal has no such ordering. The cost is a
+ * second copy of the spelling, and it is paid the way this repository already
+ * pays it for `theme-init.js`: `tests/site-identity.test.ts` reads both files
+ * and fails if they name different variables, so a rename cannot half-apply.
+ */
+process.env['PUBLISH_SITE_TITLE'] = config.title;
+
+// https://astro.build/config
+export default defineConfig({
+  site: config.origin ?? DEFAULT_ORIGIN,
+  output: 'static',
+  trailingSlash: 'always',
+  vite: {
+    define: {
+      __ANC_SNAPSHOT_BINDING__: JSON.stringify(readStaged('binding.json')),
+      __ANC_WASM_BINDING__: JSON.stringify(STAGED_WASM),
+      __ANC_WASM_MODULE_URL__: JSON.stringify(STAGED_WASM?.['moduleUrl'] ?? wasmModuleUrl()),
+    },
+    plugins: [
+      clientRuntimePlugin('diagram', DIAGRAM_MODE),
+      clientRuntimePlugin('math', MATH_MODE),
+      vendorProvenancePlugin(fileURLToPath(new URL('.', import.meta.url))),
+    ],
+    build: {
+      // Load-bearing for the CSP, not a size preference. Above 0, Vite inlines
+      // a small `?url` asset as a `data:` URL — and `src/scripts/theme-init.js`
+      // is exactly that, imported by `Layout.astro`. A `data:` script violates
+      // `script-src 'self'`, so the theme would never apply. The
+      // `every script is loaded from this origin` test in
+      // `tests/built-output.test.ts` fails if this is ever raised.
+      assetsInlineLimit: 0,
+    },
+  },
+});