wuppycms 0.0.0-stage → 0.2.1

package/dist/config-CM8_-x_W.mjs

@@ -0,0 +1,1242 @@
+import { createRequire } from "node:module";
+import { z } from "zod";
+import { access, readFile } from "node:fs/promises";
+import { join, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
+import { createHash, createHmac, createPublicKey, verify } from "node:crypto";
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { canFetch, canReadContent, canReadSecret, canWriteContent, capabilityHash, manifestSchema } from "@wuppycms/plugin-types";
+import { newQuickJSWASMModule } from "quickjs-emscripten";
+
+//#region src/content-types/index.ts
+const FIELD_TYPES = [
+	"string",
+	"text",
+	"date",
+	"image",
+	"boolean",
+	"number",
+	"list",
+	"byline",
+	"taxonomy",
+	"reference",
+	"section",
+	"select",
+	"json",
+	"richText",
+	"repeater",
+	"blocks"
+];
+const fieldOptionsSchema = z.lazy(() => z.object({
+	type: z.enum(FIELD_TYPES),
+	collection: z.string().optional(),
+	taxonomy: z.string().optional(),
+	multiple: z.boolean().default(false),
+	required: z.boolean().default(false),
+	help: z.string().optional(),
+	default: z.unknown().optional(),
+	options: z.array(z.string()).optional(),
+	min: z.number().optional(),
+	max: z.number().optional(),
+	fields: z.record(z.string(), fieldTypeSchema).optional(),
+	blocks: z.record(z.string(), z.record(z.string(), fieldTypeSchema)).optional(),
+	showIf: z.object({
+		field: z.string(),
+		equals: z.unknown()
+	}).optional()
+}));
+const fieldTypeSchema = z.union([z.enum(FIELD_TYPES), fieldOptionsSchema]);
+const collectionSchema = z.object({
+	name: z.string().regex(/^[a-z][a-z0-9-]*$/),
+	dir: z.string().min(1),
+	format: z.enum(["md", "mdx"]).default("md"),
+	kind: z.enum(["posts", "pages"]).optional(),
+	map: z.record(z.string(), z.string()).optional(),
+	route: z.string().startsWith("/").includes("{slug}").optional(),
+	fields: z.record(z.string(), fieldTypeSchema).default({})
+});
+const BASE = {
+	string: z.string().max(500),
+	text: z.string(),
+	richText: z.string(),
+	image: z.string(),
+	boolean: z.boolean(),
+	list: z.array(z.string().max(100)).max(50),
+	number: z.number(),
+	date: z.string().regex(/^\d{4}-\d{2}-\d{2}(T[\d:.]+(Z|[+-]\d{2}:\d{2})?)?$/, "Expected an ISO date"),
+	byline: z.union([z.string().max(200), z.array(z.union([z.string().max(200), z.object({
+		byline: z.string().max(200),
+		role: z.string().max(100).optional()
+	})])).max(50)]),
+	taxonomy: z.union([z.string().max(200), z.array(z.string().max(200)).max(50)]),
+	reference: z.union([z.string().max(200), z.array(z.string().max(200)).max(50)]),
+	section: z.array(z.string().max(200)).max(50),
+	select: z.string(),
+	json: z.json(),
+	repeater: z.array(z.unknown()),
+	blocks: z.array(z.unknown())
+};
+const normalize = (f) => typeof f === "string" ? {
+	type: f,
+	multiple: false,
+	required: false
+} : f;
+/** Zod schema of one field, including its bounds, options and nested fields. */
+function fieldSchema(field) {
+	const f = normalize(field);
+	const { min, max } = f;
+	let schema = BASE[f.type];
+	if (f.type === "select" && f.options) {
+		const one = z.enum(f.options);
+		schema = f.multiple ? z.array(one) : one;
+	} else if (f.type === "number") {
+		let n = z.number();
+		if (min !== void 0) n = n.min(min);
+		if (max !== void 0) n = n.max(max);
+		schema = n;
+	} else if (f.type === "repeater") {
+		let a = z.array(objectSchema(f.fields ?? {}));
+		if (min !== void 0) a = a.min(min);
+		if (max !== void 0) a = a.max(max);
+		schema = a;
+	} else if (f.type === "blocks") {
+		const variants = Object.entries(f.blocks ?? {}).map(([name, fields]) => objectSchema(fields).extend({ type: z.literal(name) }));
+		const item = variants.length ? z.discriminatedUnion("type", variants) : z.unknown();
+		let a = z.array(item);
+		if (min !== void 0) a = a.min(min);
+		if (max !== void 0) a = a.max(max);
+		schema = a;
+	} else if ((f.type === "string" || f.type === "text") && (min !== void 0 || max !== void 0)) {
+		let t = z.string();
+		if (min !== void 0) t = t.min(min);
+		if (max !== void 0) t = t.max(max);
+		schema = t;
+	}
+	return f.required && !f.showIf ? schema : schema.optional();
+}
+function objectSchema(fields) {
+	return z.looseObject(Object.fromEntries(Object.entries(fields).map(([k, f]) => [k, fieldSchema(f)])));
+}
+/** Declared fields are type-checked; undeclared frontmatter passes through untouched. A field hidden by `showIf` is not required. */
+const dataSchema = (c) => objectSchema(c.fields).superRefine((data, ctx) => {
+	for (const [name, field] of Object.entries(c.fields)) {
+		const f = normalize(field);
+		if (!f.required || !f.showIf || data[name] !== void 0) continue;
+		if (data[f.showIf.field] !== f.showIf.equals) continue;
+		ctx.addIssue({
+			code: "custom",
+			path: [name],
+			message: `${name} is required`
+		});
+	}
+});
+const fieldKind = (field) => normalize(field).type;
+
+//#endregion
+//#region src/markdown/index.ts
+let satteri;
+/**
+* Astro's own Markdown/MDX parser, so content is checked exactly as the site will compile it. Loaded from Astro's
+* dependency at runtime: it has a native binding, which cannot be bundled, and the site does not depend on it directly.
+*/
+function loadSatteri(root = process.cwd()) {
+	satteri ??= (async () => {
+		return await import(
+			/* @vite-ignore */
+			pathToFileURL(createRequire(createRequire(createRequire(join(root, "package.json")).resolve("astro/package.json")).resolve("@astrojs/markdown-satteri")).resolve("satteri")).href
+);
+	})();
+	return satteri;
+}
+const DANGEROUS_TAGS = new Set([
+	"script",
+	"iframe",
+	"frame",
+	"frameset",
+	"style",
+	"object",
+	"embed",
+	"applet",
+	"link",
+	"meta",
+	"base",
+	"form",
+	"noscript",
+	"template"
+]);
+const URL_ATTRS = new Set([
+	"href",
+	"src",
+	"action",
+	"formaction",
+	"xlink:href",
+	"poster",
+	"data",
+	"srcset",
+	"background"
+]);
+/** A URL scheme that runs code or smuggles a document: `javascript:`, `vbscript:`, `data:` (images excepted). */
+function badUrl(url, image = false) {
+	const u = [...url].filter((c) => c.charCodeAt(0) > 32).join("").toLowerCase();
+	for (const scheme of [
+		"javascript:",
+		"vbscript:",
+		"data:"
+	]) if (u.startsWith(scheme) && !(image && scheme === "data:" && /^data:image\/(png|jpe?g|gif|webp|avif);/.test(u))) return scheme;
+	return null;
+}
+/** `{/* a comment *\/}` is the only expression allowed on its own: anything else is JavaScript run at build time. */
+const ONLY_COMMENT = /^\s*\/\*(?:(?!\*\/)[\s\S])*\*\/\s*$/;
+/** JSON values (numbers, strings, booleans, arrays, objects) are data, not code: safe as component props. */
+function isJson(source) {
+	try {
+		JSON.parse(source);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Raw HTML in Markdown: dangerous tags, event handlers (`onerror=`) and code URLs in any attribute. */
+function checkHtml(html, found) {
+	for (const m of html.matchAll(/<\s*\/?\s*([A-Za-z][\w:-]*)/g)) {
+		const tag = m[1];
+		if (DANGEROUS_TAGS.has(tag.toLowerCase())) found.add(tag.toLowerCase());
+		else if (/^[A-Z]/.test(tag)) found.add(tag);
+	}
+	for (const m of html.matchAll(/[\s"'/]((?:on|formaction|srcdoc)[\w-]*)\s*=/gi)) found.add(m[1].toLowerCase());
+	for (const m of html.matchAll(/=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/g)) {
+		const scheme = badUrl(m[1] ?? m[2] ?? m[3] ?? "");
+		if (scheme) found.add(scheme);
+	}
+}
+function checkJsx(node, allowedComponents, found) {
+	const name = node.name;
+	if (name) {
+		if (name.includes(".")) found.add(name);
+		else if (/^[A-Z]/.test(name)) {
+			if (!allowedComponents.includes(name)) found.add(name);
+		} else if (DANGEROUS_TAGS.has(name.toLowerCase())) found.add(name);
+	}
+	for (const attr of node.attributes ?? []) {
+		if (attr.type !== "mdxJsxAttribute") {
+			found.add("{...spread}");
+			continue;
+		}
+		const key = attr.name ?? "";
+		const lower = key.toLowerCase();
+		if (lower.startsWith("on") || key.includes(":") || lower === "dangerouslysetinnerhtml" || lower === "srcdoc") found.add(key);
+		const value = attr.value;
+		if (value && typeof value === "object") {
+			if (!isJson(String(value.value ?? ""))) found.add(`${key}={…}`);
+		} else if (typeof value === "string" && URL_ATTRS.has(lower)) {
+			const scheme = badUrl(value, lower === "src" && name === "img");
+			if (scheme) found.add(scheme);
+		}
+	}
+}
+function walk(node, allowedComponents, found) {
+	switch (node.type) {
+		case "mdxjsEsm":
+			found.add(/^\s*export\b/.test(String(node.value)) ? "export" : "import");
+			break;
+		case "mdxFlowExpression":
+		case "mdxTextExpression":
+			if (!ONLY_COMMENT.test(String(node.value ?? ""))) found.add("{expression}");
+			break;
+		case "mdxJsxFlowElement":
+		case "mdxJsxTextElement":
+			checkJsx(node, allowedComponents, found);
+			break;
+		case "html":
+			checkHtml(String(node.value ?? ""), found);
+			break;
+		case "link":
+		case "image":
+		case "definition": {
+			const scheme = badUrl(node.url ?? "", node.type === "image");
+			if (scheme) found.add(scheme);
+			break;
+		}
+	}
+	for (const child of node.children ?? []) walk(child, allowedComponents, found);
+}
+/**
+* What an author may not put in a body: in MDX, imports/exports, JavaScript expressions (props may only be JSON),
+* unlisted components, event handlers, Astro directives and code URLs; in Markdown, dangerous raw HTML, event
+* handlers and code URLs. The body is parsed with the same parser Astro uses, so MDX that would break the build is
+* reported too. Empty means the body is acceptable.
+*/
+async function findDisallowed(body, allowedComponents, format = "mdx") {
+	const parser = await loadSatteri();
+	let tree;
+	try {
+		tree = format === "mdx" ? parser.mdxToMdast(body, { position: false }) : parser.markdownToMdast(body, { position: false });
+	} catch (e) {
+		return [`invalid MDX: ${e.message.split("\n")[0]}`];
+	}
+	const found = /* @__PURE__ */ new Set();
+	walk(tree, allowedComponents, found);
+	return [...found];
+}
+/**
+* Theme sample entries often import their components explicitly. In the site, the generated components map already
+* provides every theme component (and runtime MDX cannot resolve arbitrary imports), so component imports are removed
+* when content enters Wuppy or is rendered live.
+*/
+function stripComponentImports(body) {
+	return body.replace(/^[ \t]*import\s+[^;\n]*?\.astro["']\s*;?[ \t]*$/gm, "").replace(/\n{3,}/g, "\n\n").trimStart();
+}
+/** PascalCase JSX tags in a body, used to promote a Markdown entry to `.mdx` when a component is inserted. */
+async function componentTags(body) {
+	const parser = await loadSatteri();
+	let tree;
+	try {
+		tree = parser.mdxToMdast(body, { position: false });
+	} catch {
+		const html = [];
+		const collect = (node) => {
+			if (node.type === "html") html.push(String(node.value ?? ""));
+			for (const child of node.children ?? []) collect(child);
+		};
+		collect(parser.markdownToMdast(body, { position: false }));
+		return [...new Set(Array.from(html.join("\n").matchAll(/<([A-Z][A-Za-z0-9]*)\b/g), (m) => m[1]))];
+	}
+	const found = /* @__PURE__ */ new Set();
+	const visit = (node) => {
+		if ((node.type === "mdxJsxFlowElement" || node.type === "mdxJsxTextElement") && node.name) {
+			const name = node.name;
+			if (/^[A-Z]/.test(name) && !name.includes(".")) found.add(name);
+		}
+		for (const child of node.children ?? []) visit(child);
+	};
+	visit(tree);
+	return [...found];
+}
+
+//#endregion
+//#region src/security/redact.ts
+/** Masks credentials before text reaches logs or the audit trail. */
+function redact(text, secrets = [process.env.WUPPY_SECRET]) {
+	let out = text.replace(/\bBearer\s+[\w.~+/-]+=*/gi, "Bearer [redacted]").replace(/\b(secret|token|password|api[_-]?key|authorization)(["']?\s*[:=]\s*["']?)[^\s"',;&}]+/gi, "$1$2[redacted]").replace(/\bre_[A-Za-z0-9_]{10,}/g, "[redacted]");
+	for (const s of secrets) if (s && s.length >= 8) out = out.split(s).join("[redacted]");
+	return out;
+}
+
+//#endregion
+//#region src/security/ssrf.ts
+var UnsafeUrlError = class extends Error {};
+/** Loopback, private, link-local (cloud metadata), CGNAT, multicast and unspecified addresses. */
+function isPrivateAddress(ip) {
+	const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(ip);
+	if (mapped) return isPrivateAddress(mapped[1]);
+	if (isIP(ip) === 4) {
+		const [a, b] = ip.split(".").map(Number);
+		return a === 0 || a === 10 || a === 127 || a >= 224 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+	}
+	const v6 = ip.toLowerCase();
+	return v6 === "::" || v6 === "::1" || /^f[cd]/.test(v6) || /^fe[89ab]/.test(v6) || v6.startsWith("ff");
+}
+const resolveAll = async (host) => (await lookup(host, { all: true })).map((r) => r.address);
+/**
+* Throws unless `url` is http(s) and every address its host resolves to is public.
+* shortcut: resolving here and again inside fetch leaves a DNS-rebinding window; pin the address with a custom dispatcher if the URL is attacker-chosen.
+*/
+async function assertPublicUrl(url, resolve = resolveAll) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new UnsafeUrlError("Invalid URL");
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UnsafeUrlError("Only http(s) URLs are allowed");
+	if (parsed.username || parsed.password) throw new UnsafeUrlError("Credentials in URLs are not allowed");
+	const host = parsed.hostname.replace(/^\[|\]$/g, "");
+	const addresses = isIP(host) ? [host] : await resolve(host);
+	if (addresses.length === 0 || addresses.some(isPrivateAddress)) throw new UnsafeUrlError("URL points to a private address");
+	return parsed;
+}
+/** GET a public URL with no redirects, a timeout and a hard byte cap. */
+async function fetchPublic(url, { maxBytes = 10 * 1024 * 1024, timeoutMs = 1e4, resolve } = {}) {
+	const parsed = await assertPublicUrl(url, resolve);
+	const res = await fetch(parsed, {
+		redirect: "error",
+		signal: AbortSignal.timeout(timeoutMs)
+	});
+	if (!res.ok || !res.body) throw new Error(`Download failed (${res.status})`);
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of res.body) {
+		size += chunk.byteLength;
+		if (size > maxBytes) throw new Error("Download exceeds the size limit");
+		chunks.push(chunk);
+	}
+	return {
+		bytes: Buffer.concat(chunks),
+		contentType: res.headers.get("content-type") ?? ""
+	};
+}
+
+//#endregion
+//#region src/webhooks/index.ts
+const EVENT_TYPES = [
+	"content.updated",
+	"content.deleted",
+	"content.reverted",
+	"media.uploaded"
+];
+const webhooksSchema = z.array(z.object({
+	url: z.url({ protocol: /^https?$/ }),
+	secret: z.string().min(8).optional(),
+	events: z.array(z.enum(EVENT_TYPES)).optional()
+})).default([]);
+/** Deliveries are best-effort (no retries) and never throw into the code that caused the event. */
+function createWebhookSender(hooks, { timeoutMs = 5e3, allowPrivate = false } = {}) {
+	return async (event) => {
+		const body = JSON.stringify(event);
+		await Promise.all(hooks.filter((h) => !h.events || h.events.includes(event.type)).map(async (h) => {
+			try {
+				if (!allowPrivate) await assertPublicUrl(h.url);
+				await fetch(h.url, {
+					method: "POST",
+					redirect: "error",
+					signal: AbortSignal.timeout(timeoutMs),
+					headers: {
+						"content-type": "application/json",
+						"x-wuppy-event": event.type,
+						...h.secret ? { "x-wuppy-signature": `sha256=${createHmac("sha256", h.secret).update(body).digest("hex")}` } : {}
+					},
+					body
+				});
+			} catch (e) {
+				console.error(redact(`webhook ${h.url} failed: ${e.message}`));
+			}
+		}));
+	};
+}
+
+//#endregion
+//#region src/redirects/index.ts
+/** Same-site path, or an absolute http(s) URL. Rules out `//host` (open redirect) and `javascript:`. */
+const target = z.string().refine((t) => t.startsWith("/") && !t.startsWith("//") || /^https?:\/\//i.test(t), "Target must be a /path or http(s) URL");
+/** A regex that backtracks catastrophically on crafted paths would stall every request, so nested quantifiers are refused. */
+const NESTED_QUANTIFIER = /\((?:[^()\\]|\\.)*[+*](?:[^()\\]|\\.)*\)[+*{]/;
+function validRegex(source) {
+	if (source.length > 200 || NESTED_QUANTIFIER.test(source)) return false;
+	try {
+		return new RegExp(source) instanceof RegExp;
+	} catch {
+		return false;
+	}
+}
+const rule = z.object({
+	from: z.string().min(1).max(500),
+	to: target,
+	status: z.union([z.literal(301), z.literal(302)]).default(301),
+	match: z.enum([
+		"exact",
+		"wildcard",
+		"regex"
+	]).default("exact"),
+	enabled: z.boolean().default(true),
+	preserveQuery: z.boolean().default(true),
+	note: z.string().max(200).optional()
+}).superRefine((r, ctx) => {
+	if (r.match === "regex") {
+		if (!validRegex(r.from)) ctx.addIssue({
+			code: "custom",
+			path: ["from"],
+			message: "Invalid or unsafe regular expression"
+		});
+	} else if (!r.from.startsWith("/") || r.from.startsWith("//")) ctx.addIssue({
+		code: "custom",
+		path: ["from"],
+		message: "Invalid source"
+	});
+	else if (r.match === "wildcard" && !r.from.endsWith("/*")) ctx.addIssue({
+		code: "custom",
+		path: ["from"],
+		message: "A wildcard source must end in /*"
+	});
+});
+const norm = (p) => p.length > 1 && p.endsWith("/") ? p.slice(0, -1) : p;
+const redirectsSchema = z.array(rule).superRefine((rules, ctx) => {
+	const map = /* @__PURE__ */ new Map();
+	for (const r of rules) {
+		if (r.match !== "exact") continue;
+		const from = norm(r.from);
+		if (map.has(from)) ctx.addIssue({
+			code: "custom",
+			message: `Duplicate redirect source: ${r.from}`
+		});
+		map.set(from, norm(r.to));
+	}
+	for (const start of map.keys()) {
+		const seen = new Set([start]);
+		for (let at = map.get(start); at !== void 0; at = map.get(at)) {
+			if (seen.has(at)) {
+				ctx.addIssue({
+					code: "custom",
+					message: `Redirect loop through ${start}`
+				});
+				break;
+			}
+			seen.add(at);
+		}
+	}
+});
+const fill = (to, groups) => to.replace(/\$(\d)/g, (_, n) => groups[Number(n) - 1] ?? "");
+/**
+* Priority: exact paths, then wildcards (longest prefix first), then regexes in the order listed.
+* Rules from older files without the new fields behave as before (exact, enabled, query kept).
+*/
+function resolveRedirect(rules, pathname, search = "") {
+	const p = norm(pathname);
+	const live = rules.filter((r) => r.enabled !== false);
+	const withQuery = (r, to) => search && r.preserveQuery !== false && !to.includes("?") ? `${to}${search.startsWith("?") ? search : `?${search}`}` : to;
+	const exact = live.find((r) => (r.match ?? "exact") === "exact" && norm(r.from) === p);
+	if (exact) return {
+		to: withQuery(exact, exact.to),
+		status: exact.status
+	};
+	const wild = live.filter((r) => r.match === "wildcard" && p.startsWith(r.from.slice(0, -1))).toSorted((a, b) => b.from.length - a.from.length)[0];
+	if (wild) return {
+		to: withQuery(wild, fill(wild.to, [p.slice(wild.from.length - 1)])),
+		status: wild.status
+	};
+	for (const r of live) {
+		if (r.match !== "regex") continue;
+		const m = new RegExp(r.from).exec(p);
+		if (m) return {
+			to: withQuery(r, fill(r.to, m.slice(1))),
+			status: r.status
+		};
+	}
+	return null;
+}
+const CSV_HEAD = [
+	"from",
+	"to",
+	"status",
+	"match",
+	"enabled",
+	"note"
+];
+const cell = (v) => /[",\n]/.test(v) ? `"${v.replaceAll("\"", "\"\"")}"` : v;
+function redirectsToCsv(rules) {
+	const rows = rules.map((r) => [
+		r.from,
+		r.to,
+		String(r.status),
+		r.match,
+		String(r.enabled),
+		r.note ?? ""
+	].map(cell).join(","));
+	return `${[CSV_HEAD.join(","), ...rows].join("\n")}\n`;
+}
+/** Minimal RFC 4180 reader (quotes, doubled quotes, commas and newlines inside quotes). */
+function parseCsv(text) {
+	const rows = [];
+	let row = [];
+	let field = "";
+	let quoted = false;
+	for (let i = 0; i < text.length; i++) {
+		const ch = text[i];
+		if (quoted) if (ch === "\"" && text[i + 1] === "\"") {
+			field += "\"";
+			i++;
+		} else if (ch === "\"") quoted = false;
+		else field += ch;
+		else if (ch === "\"") quoted = true;
+		else if (ch === ",") {
+			row.push(field);
+			field = "";
+		} else if (ch === "\n" || ch === "\r") {
+			if (ch === "\r" && text[i + 1] === "\n") i++;
+			row.push(field);
+			if (row.some((c) => c !== "")) rows.push(row);
+			row = [];
+			field = "";
+		} else field += ch;
+	}
+	row.push(field);
+	if (row.some((c) => c !== "")) rows.push(row);
+	return rows;
+}
+/** Rows become rules; the header row is optional. Throws with the line number of the first bad row. */
+function parseRedirectsCsv(text) {
+	const rows = parseCsv(text);
+	if (rows[0]?.[0]?.toLowerCase() === "from") rows.shift();
+	return rows.map((cols, i) => {
+		const [from = "", to = "", status = "", match = "", enabled = "", note = ""] = cols.map((c) => c.trim());
+		const parsed = rule.safeParse({
+			from,
+			to,
+			...status ? { status: Number(status) } : {},
+			...match ? { match } : {},
+			...enabled ? { enabled: enabled !== "false" } : {},
+			...note ? { note } : {}
+		});
+		if (!parsed.success) throw new Error(`Row ${i + 1}: ${parsed.error.issues[0]?.message ?? "invalid"}`);
+		return parsed.data;
+	});
+}
+
+//#endregion
+//#region src/plugins/errors.ts
+/** A before-hook said no; `reason` is the plugin's plain-text explanation for the person who tried. */
+var PluginRejectedError = class extends Error {
+	constructor(plugin, reason) {
+		super(`${plugin}: ${reason}`);
+		this.plugin = plugin;
+		this.reason = reason;
+	}
+};
+/** A before-hook failed, timed out or answered nonsense. The change is refused; details go to the plugin's log only. */
+var PluginHookError = class extends Error {
+	constructor(plugin) {
+		super(`Plugin ${plugin} could not check this change`);
+		this.plugin = plugin;
+	}
+};
+
+//#endregion
+//#region src/plugins/host.ts
+/** A before-hook's answer larger than this is refused rather than parsed. */
+const MAX_FILTER_RESULT = 4 * 1024 * 1024;
+const PRELUDE = `
+(() => {
+	const log = __hostLog, get = __hostContentGet, put = __hostContentPut, fetchFn = __hostFetch;
+	const secretFn = __hostSecret, mail = __hostEmail, settingsFn = __hostSettings;
+	for (const n of ["__hostLog", "__hostContentGet", "__hostContentPut", "__hostFetch", "__hostSecret", "__hostEmail", "__hostSettings"]) delete globalThis[n];
+	const ctx = Object.freeze({
+		log: (m) => log(String(m)),
+		content: Object.freeze({
+			get: async (c, s) => JSON.parse(await get(String(c), String(s))),
+			put: async (c, s, doc) => { await put(String(c), String(s), JSON.stringify(doc || {})); },
+		}),
+		fetch: async (u, init) => JSON.parse(await fetchFn(String(u), JSON.stringify(init || {}))),
+		secret: (name) => { const v = secretFn(String(name)); return v === "" ? undefined : v; },
+		email: Object.freeze({ send: async (m) => { await mail(JSON.stringify(m || {})); } }),
+		get settings() { return Object.freeze(JSON.parse(settingsFn())); },
+	});
+	globalThis.__run = async (hook, ev) => {
+		const fn = globalThis.__plugin && globalThis.__plugin[hook];
+		if (typeof fn !== "function") return "null";
+		const out = await fn(JSON.parse(ev), ctx);
+		return out === undefined ? "null" : JSON.stringify(out);
+	};
+	globalThis.__handle = async (method, path, body) => {
+		const fn = globalThis.__plugin && globalThis.__plugin.fetch;
+		if (typeof fn !== "function") return JSON.stringify({ status: 404, body: "" });
+		const res = await fn({ method: String(method), path: String(path), body: body ? JSON.parse(body) : undefined }, ctx);
+		return JSON.stringify(res || { status: 204, body: "" });
+	};
+})();
+`;
+/**
+* Runs untrusted plugin code in QuickJS compiled to WASM: no Node APIs, no ambient network or filesystem.
+* The only way out is `ctx`, and every capability is checked against the manifest here, not in the plugin.
+*/
+async function loadPlugin(manifest, code, deps) {
+	const runtime = (await newQuickJSWASMModule()).newRuntime();
+	runtime.setMemoryLimit(manifest.limits.memoryMb * 1024 * 1024);
+	runtime.setMaxStackSize(256 * 1024);
+	let deadline = Infinity;
+	runtime.setInterruptHandler(() => Date.now() > deadline);
+	const vm = runtime.newContext();
+	let dead = false;
+	let filtering = 0;
+	const dispose = () => {
+		if (dead) return;
+		dead = true;
+		try {
+			vm.dispose();
+			runtime.dispose();
+		} catch {}
+	};
+	const asyncFn = (name, impl) => {
+		const h = vm.newFunction(name, (...argHandles) => {
+			const args = argHandles.map((a) => vm.getString(a));
+			const promise = vm.newPromise();
+			impl(args).then((out) => vm.newString(out).consume((s) => promise.resolve(s)), (err) => vm.newError(err.message).consume((e) => promise.reject(e)));
+			promise.settled.then(() => !dead && runtime.executePendingJobs());
+			return promise.handle;
+		});
+		vm.setProp(vm.global, name, h);
+		h.dispose();
+	};
+	const syncFn = (name, impl) => {
+		const h = vm.newFunction(name, (...argHandles) => {
+			impl(argHandles.map((a) => vm.getString(a)));
+		});
+		vm.setProp(vm.global, name, h);
+		h.dispose();
+	};
+	/** Like `syncFn` but returns a string to the plugin. */
+	const valueFn = (name, impl) => {
+		const h = vm.newFunction(name, (...argHandles) => vm.newString(impl(argHandles.map((a) => vm.getString(a)))));
+		vm.setProp(vm.global, name, h);
+		h.dispose();
+	};
+	syncFn("__hostLog", ([m]) => deps.log(String(m).slice(0, 2e3)));
+	asyncFn("__hostContentGet", async ([collection = "", slug = ""]) => {
+		if (!canReadContent(manifest, collection)) throw new Error(`Content access denied: ${collection}`);
+		return JSON.stringify(await deps.readContent(collection, slug));
+	});
+	asyncFn("__hostContentPut", async ([collection = "", slug = "", raw = "{}"]) => {
+		if (!canWriteContent(manifest, collection)) throw new Error(`Content write denied: ${collection}`);
+		if (filtering > 0) throw new Error("content.put is not available in before-hooks; return the changed entry instead");
+		if (!deps.writeContent) throw new Error("Content writing is unavailable");
+		const doc = JSON.parse(raw);
+		if (typeof doc.body !== "string" || !doc.data || typeof doc.data !== "object" || Array.isArray(doc.data)) throw new Error("content.put needs { data: object, body: string }");
+		await deps.writeContent(manifest.id, collection, slug, {
+			data: doc.data,
+			body: doc.body
+		});
+		return "";
+	});
+	valueFn("__hostSecret", ([name = ""]) => {
+		if (!canReadSecret(manifest, name)) throw new Error(`Secret access denied: ${name}`);
+		return deps.secret?.(manifest.id, name) ?? "";
+	});
+	asyncFn("__hostEmail", async ([raw = "{}"]) => {
+		if (!manifest.capabilities.email) throw new Error("Email access denied");
+		if (!deps.sendEmail) throw new Error("Email is unavailable");
+		const m = JSON.parse(raw);
+		if (typeof m.to !== "string" || typeof m.subject !== "string" || typeof m.text !== "string") throw new Error("email.send needs { to, subject, text } strings");
+		await deps.sendEmail(manifest.id, {
+			to: m.to,
+			subject: m.subject.slice(0, 200),
+			text: m.text.slice(0, 5e3)
+		});
+		return "";
+	});
+	valueFn("__hostSettings", () => JSON.stringify(deps.settings?.(manifest.id) ?? {}));
+	asyncFn("__hostFetch", async ([url = "", rawInit = "{}"]) => {
+		const init = JSON.parse(rawInit);
+		const method = (init.method ?? "GET").toUpperCase();
+		if (!canFetch(manifest, url, method)) throw new Error(`Network access denied: ${method} ${url}`);
+		return JSON.stringify(await deps.fetch(url, {
+			method,
+			body: init.body,
+			headers: init.headers
+		}));
+	});
+	const evalOrThrow = (src, filename, what) => {
+		const r = vm.evalCode(src, filename);
+		if (r.error) {
+			const err = describe(vm, r.error);
+			dispose();
+			throw new Error(`Failed to load plugin (${what}): ${err}`);
+		}
+		r.value.dispose();
+	};
+	deadline = Date.now() + manifest.limits.timeoutMs;
+	evalOrThrow(PRELUDE, "prelude.js", "prelude");
+	evalOrThrow(code, `${manifest.id}.js`, "code");
+	const defined = vm.evalCode(`typeof globalThis.__plugin === "object" && globalThis.__plugin !== null`);
+	const ok = defined.error ? false : vm.dump(defined.value) === true;
+	(defined.error ?? defined.value).dispose();
+	if (!ok) {
+		dispose();
+		throw new Error("Failed to load plugin: it must define globalThis.__plugin");
+	}
+	return {
+		dispose,
+		async request(method, path, body) {
+			if (dead) return {
+				status: 503,
+				body: "Plugin was stopped"
+			};
+			deadline = Date.now() + manifest.limits.timeoutMs;
+			const call = vm.evalCode(`__handle(${JSON.stringify(method)}, ${JSON.stringify(path)}, ${JSON.stringify(body ?? "")})`);
+			if (call.error) return {
+				status: 500,
+				body: describe(vm, call.error)
+			};
+			let timer;
+			const timeout = new Promise((resolve) => timer = setTimeout(() => resolve("timeout"), manifest.limits.timeoutMs));
+			try {
+				const settled = vm.resolvePromise(call.value);
+				runtime.executePendingJobs();
+				const result = await Promise.race([settled, timeout]);
+				if (result === "timeout") {
+					dispose();
+					return {
+						status: 504,
+						body: "Plugin timed out"
+					};
+				}
+				if (result.error) return {
+					status: 500,
+					body: describe(vm, result.error)
+				};
+				const raw = vm.dump(result.value);
+				result.value.dispose();
+				try {
+					const parsed = JSON.parse(raw);
+					return {
+						status: typeof parsed.status === "number" ? parsed.status : 200,
+						headers: parsed.headers,
+						body: typeof parsed.body === "string" ? parsed.body : JSON.stringify(parsed.body ?? "")
+					};
+				} catch {
+					return {
+						status: 200,
+						body: raw
+					};
+				}
+			} finally {
+				clearTimeout(timer);
+				if (!dead) call.value.dispose();
+			}
+		},
+		async dispatch(hook, event) {
+			if (!manifest.hooks.includes(hook)) return {
+				ok: true,
+				skipped: true
+			};
+			const res = await run(hook, event);
+			return res.ok ? { ok: true } : res;
+		},
+		async filter(hook, event) {
+			if (!manifest.hooks.includes(hook)) return {
+				ok: true,
+				value: null
+			};
+			filtering++;
+			try {
+				return await run(hook, event);
+			} finally {
+				filtering--;
+			}
+		}
+	};
+	async function run(hook, event) {
+		if (dead) return {
+			ok: false,
+			error: "Plugin was stopped"
+		};
+		deadline = Date.now() + manifest.limits.timeoutMs;
+		const started = vm.evalCode(`__run(${JSON.stringify(hook)}, ${JSON.stringify(JSON.stringify(event))})`);
+		if (started.error) return fail(describe(vm, started.error));
+		let timer;
+		const timeout = new Promise((r) => timer = setTimeout(() => r("timeout"), manifest.limits.timeoutMs));
+		try {
+			const settled = vm.resolvePromise(started.value);
+			runtime.executePendingJobs();
+			const res = await Promise.race([settled, timeout]);
+			if (res === "timeout") return fail("Plugin timed out");
+			if (res.error) return fail(describe(vm, res.error));
+			const raw = vm.dump(res.value);
+			res.value.dispose();
+			if (typeof raw !== "string") return {
+				ok: true,
+				value: null
+			};
+			if (raw.length > MAX_FILTER_RESULT) return fail("Hook answer is too large");
+			return {
+				ok: true,
+				value: JSON.parse(raw)
+			};
+		} finally {
+			clearTimeout(timer);
+			if (!dead) started.value.dispose();
+		}
+	}
+	function fail(error) {
+		if (/timed out|interrupted|out of memory/i.test(error)) dispose();
+		return {
+			ok: false,
+			error
+		};
+	}
+}
+function describe(vm, handle) {
+	const dumped = vm.dump(handle);
+	handle.dispose();
+	return typeof dumped === "string" ? dumped : `${dumped.name ?? "Error"}: ${dumped.message ?? JSON.stringify(dumped)}`;
+}
+
+//#endregion
+//#region src/plugins/loader.ts
+/** Hash over the *parsed* capabilities, so defaults cannot hide a change. */
+const capabilityHash$1 = (manifest) => capabilityHash(manifest);
+/** Digest of exactly the files that run. Registries pin it; a lock file detects edits after install. */
+const fileDigest = (manifestText, code) => createHash("sha256").update(manifestText).update("\n--\n").update(code).digest("hex");
+const HOOK_FOR = {
+	"content.updated": "onContentUpdated",
+	"content.deleted": "onContentDeleted",
+	"media.uploaded": "onMediaUploaded",
+	"comment.created": "onCommentCreated"
+};
+const reasonOf = (answer) => {
+	if (!answer || typeof answer !== "object" || !("reject" in answer)) return void 0;
+	const raw = answer.reject;
+	const reason = typeof raw === "string" ? raw.replace(/[\p{Cc}\s]+/gu, " ").trim() : "";
+	return reason.length >= 1 && reason.length <= 500 ? reason : null;
+};
+const MAX_LOG_LINES = 100;
+/** Fail closed per plugin: anything not approved, not parseable or outside the project is skipped and reported. */
+async function loadPlugins(root, entries, deps, { approvals = {}, lock = {}, disabled = /* @__PURE__ */ new Set(), now = Date.now } = {}) {
+	const running = [];
+	const rows = [];
+	const errors = [];
+	const base = resolve(root);
+	for (const entry of entries) {
+		const fail = (message, extra = {}) => {
+			errors.push(message);
+			rows.push({
+				dir: entry.dir,
+				id: null,
+				version: null,
+				state: "error",
+				error: message,
+				...extra
+			});
+		};
+		try {
+			const dir = resolve(base, entry.dir);
+			if (!dir.startsWith(base + sep)) throw new Error(`Plugin directory is outside the project: ${entry.dir}`);
+			const manifestText = await readFile(join(dir, "manifest.json"), "utf8");
+			const manifest = manifestSchema.parse(JSON.parse(manifestText));
+			const code = await readFile(join(dir, "plugin.js"), "utf8");
+			const pinned = lock[manifest.id];
+			if (pinned && pinned.sha256 !== fileDigest(manifestText, code)) throw new Error(`Plugin "${manifest.id}" files changed since they were installed; reinstall or update it`);
+			const hash = capabilityHash$1(manifest);
+			if (hash !== (entry.approve ?? approvals[entry.dir])) {
+				const message = `Plugin "${manifest.id}" capabilities are not approved. Review them, then approve ${hash} for ${entry.dir}`;
+				errors.push(message);
+				rows.push({
+					dir: entry.dir,
+					id: manifest.id,
+					version: manifest.version,
+					...manifest.name ? { name: manifest.name } : {},
+					state: "needs-approval",
+					pendingHash: hash,
+					error: message,
+					manifest
+				});
+				continue;
+			}
+			const logs = [];
+			const instance = await loadPlugin(manifest, code, {
+				...deps,
+				log: (m) => {
+					logs.push(`${new Date(now()).toISOString()} ${m}`);
+					if (logs.length > MAX_LOG_LINES) logs.shift();
+					deps.log(`[${manifest.id}] ${m}`);
+				}
+			});
+			running.push({
+				dir: entry.dir,
+				manifest,
+				instance,
+				enabled: !disabled.has(manifest.id),
+				calls: 0,
+				failures: 0,
+				totalMs: 0,
+				window: {
+					start: 0,
+					count: 0
+				},
+				logs
+			});
+		} catch (e) {
+			fail(e.message);
+		}
+	}
+	/** Counts a call against the plugin's per-minute quota. False means over quota. */
+	const admit = (p) => {
+		const t = now();
+		if (t - p.window.start >= 6e4) p.window = {
+			start: t,
+			count: 0
+		};
+		if (p.window.count >= p.manifest.limits.callsPerMinute) return false;
+		p.window.count++;
+		return true;
+	};
+	const record = (p, started, error) => {
+		p.calls++;
+		p.totalMs += now() - started;
+		if (error) {
+			p.failures++;
+			p.lastError = {
+				message: error.slice(0, 500),
+				at: new Date(now()).toISOString()
+			};
+		}
+	};
+	const find = (id) => running.find((p) => p.manifest.id === id);
+	return {
+		loaded: running.map((p) => p.manifest.id),
+		errors,
+		manifests: running.map((p) => p.manifest),
+		statuses() {
+			return [...running.map((p) => {
+				const t = now();
+				return {
+					dir: p.dir,
+					id: p.manifest.id,
+					version: p.manifest.version,
+					...p.manifest.name ? { name: p.manifest.name } : {},
+					state: p.enabled ? "active" : "disabled",
+					manifest: p.manifest,
+					stats: {
+						calls: p.calls,
+						failures: p.failures,
+						callsThisMinute: t - p.window.start < 6e4 ? p.window.count : 0,
+						quota: p.manifest.limits.callsPerMinute,
+						totalMs: p.totalMs
+					},
+					...p.lastError ? { lastError: p.lastError } : {},
+					logs: [...p.logs]
+				};
+			}), ...rows];
+		},
+		setEnabled(id, enabled) {
+			const plugin = find(id);
+			if (!plugin) return false;
+			plugin.enabled = enabled;
+			return true;
+		},
+		async request(id, method, path, body) {
+			const plugin = find(id);
+			if (!plugin) return null;
+			if (!plugin.enabled) return {
+				status: 503,
+				body: "Plugin is disabled"
+			};
+			if (!admit(plugin)) return {
+				status: 429,
+				body: "Plugin call quota exceeded"
+			};
+			const started = now();
+			const res = await plugin.instance.request(method, path, body);
+			record(plugin, started, res.status >= 500 ? `HTTP ${res.status}: ${res.body}` : void 0);
+			return res;
+		},
+		async dispatch(event) {
+			const hook = HOOK_FOR[event.type];
+			if (!hook) return;
+			await Promise.all(running.map(async (p) => {
+				if (!p.enabled || !p.manifest.hooks.includes(hook)) return;
+				if (!admit(p)) {
+					record(p, now(), `Dropped ${hook}: call quota of ${p.manifest.limits.callsPerMinute}/min exceeded`);
+					return;
+				}
+				const started = now();
+				const res = await p.instance.dispatch(hook, event);
+				record(p, started, res.ok ? void 0 : res.error);
+				if (!res.ok) deps.log(`plugin ${p.manifest.id} failed on ${hook}: ${res.error}`);
+			}));
+		},
+		async filter(hook, event, { applies = () => true, apply } = {}) {
+			let current = event;
+			for (const p of running) {
+				if (!p.enabled || !p.manifest.hooks.includes(hook) || !applies(p.manifest)) continue;
+				admit(p);
+				const started = now();
+				const res = await p.instance.filter(hook, current);
+				const refuse = (error) => {
+					record(p, started, `${hook}: ${error}`);
+					deps.log(`plugin ${p.manifest.id} failed on ${hook}: ${error}`);
+					return new PluginHookError(p.manifest.id);
+				};
+				if (!res.ok) throw refuse(res.error);
+				const reason = reasonOf(res.value);
+				if (reason === null) throw refuse("a refusal needs a reason of 1-500 characters");
+				if (reason !== void 0) {
+					record(p, started);
+					throw new PluginRejectedError(p.manifest.id, reason);
+				}
+				if (res.value !== null) {
+					if (!apply) throw refuse("this hook can only refuse ({ reject }) or return nothing");
+					try {
+						current = apply(p.manifest, res.value, current);
+					} catch (e) {
+						throw refuse(e.message);
+					}
+				}
+				record(p, started);
+			}
+			return current;
+		},
+		dispose: () => running.forEach((p) => p.instance.dispose())
+	};
+}
+
+//#endregion
+//#region src/plugins/registry.ts
+const registryConfigSchema = z.object({
+	name: z.string().regex(/^[a-z][a-z0-9-]*$/),
+	url: z.url({ protocol: /^https?$/ }),
+	publicKeys: z.array(z.string().min(20)).default([])
+});
+const indexSchema = z.object({ plugins: z.array(z.object({
+	id: z.string().regex(/^[a-z][a-z0-9-]*$/),
+	name: z.string().max(100).optional(),
+	description: z.string().max(500).optional(),
+	author: z.string().max(200).optional(),
+	version: z.string(),
+	bundle: z.object({
+		url: z.string(),
+		sha256: z.string().length(64)
+	}),
+	signature: z.string().optional()
+})) });
+const bundleSchema = z.object({
+	manifest: z.string(),
+	code: z.string()
+});
+const defaultFetch = async (url) => new TextDecoder().decode((await fetchPublic(url, { maxBytes: 2 * 1024 * 1024 })).bytes);
+/** The message a publisher signs. */
+const signedMessage = (id, version, sha256) => `${id}@${version}:${sha256}`;
+function verifySignature(registry, entry) {
+	if (!entry.signature || registry.publicKeys.length === 0) return false;
+	const message = Buffer.from(signedMessage(entry.id, entry.version, entry.bundle.sha256));
+	const signature = Buffer.from(entry.signature, "base64");
+	return registry.publicKeys.some((key) => {
+		try {
+			return verify(null, message, createPublicKey({
+				key: Buffer.from(key, "base64"),
+				format: "der",
+				type: "spki"
+			}), signature);
+		} catch {
+			return false;
+		}
+	});
+}
+var RegistryClient = class {
+	cache = /* @__PURE__ */ new Map();
+	constructor(registries, fetchText = defaultFetch, ttlMs = 5 * 6e4, now = Date.now) {
+		this.registries = registries;
+		this.fetchText = fetchText;
+		this.ttlMs = ttlMs;
+		this.now = now;
+	}
+	async index(registry) {
+		const hit = this.cache.get(registry.name);
+		if (hit && this.now() - hit.at < this.ttlMs) return hit.entries;
+		const entries = indexSchema.parse(JSON.parse(await this.fetchText(registry.url))).plugins;
+		this.cache.set(registry.name, {
+			at: this.now(),
+			entries
+		});
+		return entries;
+	}
+	/** Matching packages from every registry. A registry that is down is reported, not fatal. */
+	async search(q = "") {
+		const needle = q.trim().toLowerCase();
+		const results = [];
+		const errors = [];
+		for (const registry of this.registries) try {
+			for (const entry of await this.index(registry)) {
+				if (needle && !`${entry.id} ${entry.name ?? ""} ${entry.description ?? ""}`.toLowerCase().includes(needle)) continue;
+				results.push({
+					...entry,
+					registry: registry.name,
+					verified: verifySignature(registry, entry)
+				});
+			}
+		} catch (e) {
+			errors.push(`${registry.name}: ${e.message}`);
+		}
+		return {
+			results,
+			errors
+		};
+	}
+	/**
+	* Downloads and checks a package: digest pinned by the index, signature when the registry has trusted keys,
+	* and a manifest whose id/version match the listing. Nothing is written here.
+	*/
+	async fetchPackage(registryName, id) {
+		const registry = this.registries.find((r) => r.name === registryName);
+		if (!registry) throw new Error(`Unknown registry: ${registryName}`);
+		const entry = (await this.index(registry)).find((e) => e.id === id);
+		if (!entry) throw new Error(`${registryName} has no plugin "${id}"`);
+		const verified = verifySignature(registry, entry);
+		if (registry.publicKeys.length > 0 && !verified) throw new Error(`"${id}" is not signed by a key this site trusts for ${registryName}`);
+		const url = new URL(entry.bundle.url, registry.url).href;
+		const bundle = bundleSchema.parse(JSON.parse(await this.fetchText(url)));
+		const sha256 = fileDigest(bundle.manifest, bundle.code);
+		if (sha256 !== entry.bundle.sha256) throw new Error(`"${id}" does not match the digest published in the index`);
+		const manifest = manifestSchema.parse(JSON.parse(bundle.manifest));
+		if (manifest.id !== entry.id || manifest.version !== entry.version) throw new Error(`"${id}" manifest says ${manifest.id}@${manifest.version}, the index says ${entry.id}@${entry.version}`);
+		return {
+			manifest,
+			manifestText: bundle.manifest,
+			code: bundle.code,
+			sha256,
+			verified,
+			version: entry.version
+		};
+	}
+};
+
+//#endregion
+//#region src/config/index.ts
+const safeDir = collectionSchema.shape.dir.refine((d) => !d.startsWith("/") && !d.split(/[\\/]/).includes(".."), "dir must be relative and stay inside the project");
+const configSchema = z.object({
+	collections: z.array(collectionSchema.extend({ dir: safeDir })).default([]),
+	site: z.object({
+		url: z.url(),
+		name: z.string().min(1)
+	}).optional(),
+	locales: z.array(z.string().regex(/^[a-z]{2,3}(-[A-Za-z0-9]+)*$/)).default([]),
+	components: z.array(z.string().regex(/^[A-Z][A-Za-z0-9]*$/)).default([]),
+	plugins: z.array(z.object({
+		dir: z.string().min(1),
+		approve: z.string().length(64)
+	})).default([]),
+	registries: z.array(registryConfigSchema).default([]),
+	webhooks: webhooksSchema,
+	redirects: redirectsSchema.default([]),
+	git: z.boolean().default(true),
+	admin: z.object({ path: z.string().startsWith("/").default("/admin") }).default({ path: "/admin" })
+}).superRefine((cfg, ctx) => {
+	const seen = /* @__PURE__ */ new Set();
+	for (const c of cfg.collections) {
+		if (seen.has(c.name)) ctx.addIssue({
+			code: "custom",
+			message: `Duplicate collection: ${c.name}`,
+			path: ["collections"]
+		});
+		seen.add(c.name);
+	}
+});
+function defineConfig(input) {
+	const r = configSchema.safeParse(input);
+	if (!r.success) {
+		const lines = r.error.issues.map((i) => `  ${i.path.join(".") || "(root)"}: ${i.message}`);
+		throw new Error(`Invalid wuppy.config:\n${lines.join("\n")}`);
+	}
+	return r.data;
+}
+const FILES = [
+	"wuppy.config.ts",
+	"wuppy.config.mjs",
+	"wuppy.config.js"
+];
+async function loadConfig(root) {
+	for (const f of FILES) {
+		const path = join(root, f);
+		try {
+			await access(path);
+		} catch {
+			continue;
+		}
+		return defineConfig((await import(
+			/* @vite-ignore */
+			pathToFileURL(path).href
+)).default ?? {});
+	}
+	throw new Error(`No wuppy.config found in ${root} (looked for ${FILES.join(", ")})`);
+}
+
+//#endregion
+export { collectionSchema as C, stripComponentImports as S, fieldKind as T, isPrivateAddress as _, loadPlugins as a, findDisallowed as b, parseRedirectsCsv as c, resolveRedirect as d, createWebhookSender as f, fetchPublic as g, assertPublicUrl as h, capabilityHash$1 as i, redirectsSchema as l, UnsafeUrlError as m, loadConfig as n, PluginHookError as o, webhooksSchema as p, RegistryClient as r, PluginRejectedError as s, defineConfig as t, redirectsToCsv as u, redact as v, dataSchema as w, loadSatteri as x, componentTags as y };