@hollware/core 0.9.1 → 0.11.0

package/dist/index.mjs

@@ -55,6 +55,203 @@ var Problems = class {
 	}
 };
 //#endregion
+//#region src/config/values.ts
+/** A value with keys: not null, not an array. */
+function isRecord$4(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** A string as the messages show it: quoted, with what could break a line escaped. */
+function quote$1(text) {
+	return JSON.stringify(text);
+}
+/** Text of an error that someone else wrote, on one line, so that a problem stays one line. */
+function oneLine(text) {
+	return text.replace(/\s+/g, " ").trim();
+}
+/** What a value is, for a message: `"es"`, `42`, `null`, `an array`. */
+function found(value) {
+	if (value === null) return "null";
+	switch (typeof value) {
+		case "string": return quote$1(value);
+		case "number":
+		case "boolean":
+		case "bigint": return String(value);
+		case "function": return "a function";
+		case "symbol": return "a symbol";
+		default: return Array.isArray(value) ? "an array" : "an object";
+	}
+}
+/** `is 42; it must be a string`, or `is missing; …` when the value is not there. */
+function wrongType(value, expected) {
+	return `${value === void 0 ? "is missing" : `is ${found(value)}`}; it must be ${expected}`;
+}
+/** An optional string: `null` when it is absent, and a problem when it is anything else. */
+function readOptionalString(path, value, fix, problems) {
+	if (value === void 0) return null;
+	if (typeof value === "string") return value;
+	problems.add(path, wrongType(value, "a string"), fix);
+	return null;
+}
+const PLAIN_KEY = /^[A-Za-z0-9_-]+$/;
+/** The path of a key inside `parent`: `sites.demo`, or `sites["my site"]` for an odd key. */
+function keyPath(parent, key) {
+	return PLAIN_KEY.test(key) ? `${parent}.${key}` : `${parent}[${quote$1(key)}]`;
+}
+/** The path of an item of an array: `sites.demo.locales[1]`. */
+function itemPath(parent, index) {
+	return `${parent}[${index}]`;
+}
+//#endregion
+//#region src/config/events.ts
+/** The name of a Worker secret or variable: what `wrangler secret put` takes. */
+const BINDING_NAME = /^[A-Z][A-Z0-9_]*$/;
+/**
+* The Worker secrets a definition may not name: Hollware's own (its master secret, its analytics
+* token) and Cloudflare's. A site's definition is written by its owner or an agent with
+* schema:admin, who need not hold the account, so it names only secrets made for its webhooks.
+*/
+const RESERVED_SECRET = /^(HOLLWARE|CLOUDFLARE|CF)_/;
+/**
+* An IndexNow key, which is public by design (search engines fetch it at `/<key>.txt`): the
+* definition holds the key itself, never the name of a Worker secret, so no value of the Worker
+* can be sent to IndexNow (T-69 of docs/security/threat-model.md).
+*/
+const INDEXNOW_KEY = /^[A-Za-z0-9-]{8,128}$/;
+/** A subscriber's name: lowercase words joined by hyphens. */
+const NAME$1 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/** The public URL of a site: an absolute http or https URL with no path, query or fragment. */
+function readSiteUrl(path, raw, problems) {
+	if (raw === void 0) return null;
+	const fix = "Write the public origin of the site, such as \"https://example.com\".";
+	if (typeof raw !== "string" || !URL.canParse(raw)) {
+		problems.add(path, wrongType(raw, "an absolute URL"), fix);
+		return null;
+	}
+	const url = new URL(raw);
+	if (url.protocol !== "https:" && url.protocol !== "http:" || url.pathname !== "/" || url.search !== "" || url.hash !== "") {
+		problems.add(path, `${quote$1(raw)} is not an origin`, fix);
+		return null;
+	}
+	return url.origin;
+}
+/** The origins of a site's pages that may read its published content from the browser. */
+function readCors(path, raw, problems) {
+	if (raw === void 0) return { origins: [] };
+	if (!isRecord$4(raw) || !Array.isArray(raw["origins"])) {
+		problems.add(path, wrongType(raw, "an object with origins"), "Declare it as { origins: [\"https://example.com\"] }, or remove it.");
+		return { origins: [] };
+	}
+	const origins = [];
+	for (const [index, origin] of raw["origins"].entries()) {
+		const read = readSiteUrl(itemPath(keyPath(path, "origins"), index), origin, problems);
+		if (read !== null && !origins.includes(read)) origins.push(read);
+	}
+	return { origins };
+}
+function readBindingName(path, raw, problems) {
+	if (typeof raw === "string" && BINDING_NAME.test(raw) && RESERVED_SECRET.test(raw)) {
+		problems.add(path, `names ${quote$1(raw)}, a secret of Hollware or of Cloudflare, which no webhook may use`, "Leave the secret out, and Hollware makes one for the webhook (make_webhook_secret).");
+		return null;
+	}
+	if (typeof raw === "string" && BINDING_NAME.test(raw)) return raw;
+	problems.add(path, wrongType(raw, "the name of a Worker secret"), "Name the secret that holds the value, such as \"WEBHOOK_SECRET\", and set it with wrangler secret put.");
+	return null;
+}
+function readWebhook(path, raw, problems) {
+	if (!isRecord$4(raw)) {
+		problems.add(path, wrongType(raw, "a webhook"), "Declare it as { name: \"newsletter\", url: \"https://…\", secret: \"WEBHOOK_SECRET\" }.");
+		return null;
+	}
+	const name = raw["name"];
+	if (typeof name !== "string" || !NAME$1.test(name)) problems.add(keyPath(path, "name"), wrongType(name, "a name"), "Name it with lowercase words joined by hyphens, such as \"newsletter\".");
+	const url = raw["url"];
+	const urlOk = typeof url === "string" && URL.canParse(url) && new URL(url).protocol === "https:";
+	if (!urlOk) problems.add(keyPath(path, "url"), wrongType(url, "an https URL"), "Give the https URL that receives the events.");
+	const secret = raw["secret"] === void 0 ? null : readBindingName(keyPath(path, "secret"), raw["secret"], problems);
+	if (typeof name !== "string" || !NAME$1.test(name) || !urlOk) return null;
+	if (raw["secret"] !== void 0 && secret === null) return null;
+	return {
+		name,
+		url: String(url),
+		secret
+	};
+}
+/** Who hears about publications (ADR-025): webhooks, and IndexNow when the site has a URL. */
+function readEvents(path, raw, siteUrl, problems) {
+	const events = {
+		webhooks: [],
+		indexNow: null
+	};
+	if (raw === void 0) return events;
+	if (!isRecord$4(raw)) {
+		problems.add(path, wrongType(raw, "an object"), "Declare { webhooks: [ … ], indexNow: { … } }.");
+		return events;
+	}
+	const webhooks = raw["webhooks"];
+	if (webhooks !== void 0) {
+		if (!Array.isArray(webhooks)) problems.add(keyPath(path, "webhooks"), wrongType(webhooks, "a list"), "List the webhooks.");
+		else {
+			const seen = /* @__PURE__ */ new Set();
+			webhooks.forEach((item, index) => {
+				const webhook = readWebhook(itemPath(keyPath(path, "webhooks"), index), item, problems);
+				if (webhook === null) return;
+				if (seen.has(webhook.name)) {
+					problems.add(itemPath(keyPath(path, "webhooks"), index), `repeats the name ${quote$1(webhook.name)}`, "Give each webhook a name of its own.");
+					return;
+				}
+				seen.add(webhook.name);
+				events.webhooks.push(webhook);
+			});
+		}
+	}
+	const indexNow = raw["indexNow"];
+	if (indexNow !== void 0) {
+		const indexPath = keyPath(path, "indexNow");
+		if (!isRecord$4(indexNow)) problems.add(indexPath, wrongType(indexNow, "an object"), "Declare { key: \"<your IndexNow key>\" }.");
+		else {
+			const raw = indexNow["key"];
+			const key = typeof raw === "string" && INDEXNOW_KEY.test(raw) ? raw : null;
+			if (key === null) problems.add(keyPath(indexPath, "key"), wrongType(raw, "an IndexNow key: 8 to 128 letters, digits or hyphens"), "Put the key itself, the one your site serves at /<key>.txt, not the name of a secret.");
+			if (siteUrl === null) problems.add(indexPath, "needs the URL of the site", "Set url on the site: IndexNow is told the public URLs of the entries.");
+			else if (key !== null) events.indexNow = { key };
+		}
+	}
+	return events;
+}
+//#endregion
+//#region src/config/audit.ts
+/** The fewest days a site may keep its activity log for, when it sets a retention (ADR-037). */
+const AUDIT_RETENTION_MIN_DAYS = 30;
+/** The most days a retention may be: ten years. Beyond that, keep it with no retention. */
+const AUDIT_RETENTION_MAX_DAYS = 3650;
+/** What a site that says nothing keeps: no addresses, and the log for as long as the site exists. */
+const DEFAULT_AUDIT = {
+	ipAddresses: "off",
+	retentionDays: null
+};
+/** What the activity log of a site keeps, as its owner chose (ADR-037). */
+function readAudit(path, raw, problems) {
+	if (raw === void 0 || raw === null) return DEFAULT_AUDIT;
+	if (!isRecord$4(raw)) {
+		problems.add(path, wrongType(raw, "an object"), "Declare it as { ipAddresses: \"off\", retentionDays: null }, or remove it.");
+		return DEFAULT_AUDIT;
+	}
+	let ipAddresses = "off";
+	const addresses = raw["ipAddresses"];
+	if (addresses === "hashed") ipAddresses = "hashed";
+	else if (addresses !== void 0 && addresses !== "off") problems.add(keyPath(path, "ipAddresses"), wrongType(addresses, "\"off\" or \"hashed\""), "Use \"off\" to keep no address, or \"hashed\" to keep a keyed hash of each.");
+	let retentionDays = null;
+	const days = raw["retentionDays"];
+	if (days !== void 0 && days !== null) {
+		if (typeof days !== "number" || !Number.isInteger(days) || days < 30 || days > 3650) problems.add(keyPath(path, "retentionDays"), `${typeof days === "number" ? String(days) : wrongType(days, "a number")} is not a whole number of days from 30 to ${AUDIT_RETENTION_MAX_DAYS}`, "Give the days to keep each line, or null to keep the log for as long as the site exists.");
+		else retentionDays = days;
+	}
+	return {
+		ipAddresses,
+		retentionDays
+	};
+}
+//#endregion
 //#region src/config/constants.ts
 /** The largest Markdown file a collection accepts when its config does not say, 512 KiB. */
 const DEFAULT_MAX_MARKDOWN_BYTES = 524288;
@@ -70,7 +267,7 @@ const MAX_MARKDOWN_BYTES_CEILING = 786432;
 * letter, at most 63 characters. A component name is what Markdown writes after the colons
 * (`::callout`). A site key has its own rule (`site-key.ts`).
 */
-const NAME$1 = /^[a-z][a-z0-9-]{0,62}$/;
+const NAME = /^[a-z][a-z0-9-]{0,62}$/;
 /** A language tag: a language, then an optional script and region: `es`, `pt-BR`, `zh-Hant-TW`. */
 const LOCALE_TAG = /^[a-z]{2,3}(?:-[A-Z][a-z]{3})?(?:-(?:[A-Z]{2}|[0-9]{3}))?$/;
 /** The id of a contract: lowercase words joined by single hyphens. */
@@ -140,7 +337,7 @@ function clip(text, max = MAX_ECHO_LENGTH) {
 	return `${last >= 55296 && last <= 56319 ? head.slice(0, -1) : head}…`;
 }
 /** Text from the entry as a message shows it: clipped, in JSON quotes, control characters escaped. */
-function quote$1(text) {
+function quote(text) {
 	return JSON.stringify(clip(text));
 }
 /** A JSON Pointer (RFC 6901) from its segments: `['tags', '0']` is `/tags/0`, none is the root. */
@@ -264,7 +461,7 @@ function unknownKeys(fragment, value) {
 }
 /** The fix for one issue: imperative, naming the field and what the schema accepts there. */
 function fixForIssue({ subject, schema, input, segments, message }) {
-	const target = segments.length === 0 ? subject.container : `the ${subject.noun} ${quote$1(label(segments))}`;
+	const target = segments.length === 0 ? subject.container : `the ${subject.noun} ${quote(label(segments))}`;
 	const fragment = schema === null ? void 0 : fragmentAt(schema, segments);
 	if (fragment !== void 0) {
 		const unknown = unknownKeys(fragment, valueAt(input, segments));
@@ -272,7 +469,7 @@ function fixForIssue({ subject, schema, input, segments, message }) {
 			const allowed = isRecord$3(fragment.properties) ? Object.keys(fragment.properties) : [];
 			const nouns = unknown.length === 1 ? subject.noun : `${subject.noun}s`;
 			const where = allowed.length === 0 ? `no ${subject.noun}s are allowed there` : `the ${subject.noun}s allowed there are: ${allowed.join(", ")}`;
-			return `Remove the ${nouns} ${unknown.map((key) => quote$1(key)).join(", ")} from ${target}; ${where}.`;
+			return `Remove the ${nouns} ${unknown.map((key) => quote(key)).join(", ")} from ${target}; ${where}.`;
 		}
 	}
 	const expected = fragment === void 0 ? void 0 : expectation(fragment);
@@ -354,15 +551,15 @@ const COMPONENTS = registerBuiltIn({
 			const result = await definition.props["~standard"].validate(use.props);
 			if (!result.issues) continue;
 			const subject = {
-				container: `the component ${quote$1(use.name)}`,
+				container: `the component ${quote(use.name)}`,
 				noun: "prop"
 			};
 			for (const issue of result.issues) {
 				const segments = issueSegments(issue);
-				const which = segments.length === 0 ? "The props" : `The prop ${quote$1(label(segments))}`;
+				const which = segments.length === 0 ? "The props" : `The prop ${quote(label(segments))}`;
 				findings.push({
 					path: "/body",
-					message: `${which} of the component ${quote$1(use.name)} ${segments.length === 0 ? "are" : "is"} invalid: ${issue.message}`,
+					message: `${which} of the component ${quote(use.name)} ${segments.length === 0 ? "are" : "is"} invalid: ${issue.message}`,
 					fix: fixForIssue({
 						subject,
 						schema: schemas.get(use.name) ?? null,
@@ -429,16 +626,16 @@ const RAW_HTML = markerContract("raw-html", "The body holds Markdown and the com
 const UNKNOWN_COMPONENT = markerContract("unknown-component", "The body uses only the components that the collection declares.", (marker, collection) => {
 	const components = allowedComponents(collection);
 	return {
-		message: `The component ${quote$1(marker.name)} does not exist in this collection.`,
+		message: `The component ${quote(marker.name)} does not exist in this collection.`,
 		fix: components.length === 0 ? "This collection allows no components: remove it and use Markdown." : `Use one of the allowed components: ${components.join(", ")}.`
 	};
 });
 const DISALLOWED_ATTRIBUTE = markerContract("disallowed-attribute", "Links, images and code carry only the attributes Markdown produces, and a component only the props its schema declares.", (marker) => ({
-	message: `The attribute ${quote$1(marker.name)} is not allowed.`,
-	fix: `Remove the attribute ${quote$1(marker.name)}. Links keep href and title, images keep src, alt, title, width and height, and a component takes only the props its schema declares.`
+	message: `The attribute ${quote(marker.name)} is not allowed.`,
+	fix: `Remove the attribute ${quote(marker.name)}. Links keep href and title, images keep src, alt, title, width and height, and a component takes only the props its schema declares.`
 }));
 const UNSAFE_URL = markerContract("unsafe-url", "Links and images use an https:, http: or mailto: URL, a path of the site or an anchor.", (marker) => ({
-	message: `The URL ${quote$1(marker.name)} is not allowed.`,
+	message: `The URL ${quote(marker.name)} is not allowed.`,
 	fix: "Use an https: or http: URL, a mailto: address, a path of this site that starts with /, or an anchor that starts with #."
 }));
 //#endregion
@@ -633,11 +830,11 @@ function lengthOf(value) {
 /** A text, or a list, of a field has between `min` and `max` characters or items. */
 function fieldLength(params, options = {}) {
 	const bounds = [params.min === void 0 ? null : `at least ${params.min}`, params.max === void 0 ? null : `at most ${params.max}`].filter((bound) => bound !== null);
-	const unless = params.unless === void 0 ? "" : `, unless ${quote$1(params.unless)} is given`;
+	const unless = params.unless === void 0 ? "" : `, unless ${quote(params.unless)} is given`;
 	return registerBuiltIn({
 		id: options.id ?? "field-length",
 		severity: options.severity ?? "error",
-		description: `${quote$1(params.field)} has ${bounds.join(" and ")} characters or items${unless}.`,
+		description: `${quote(params.field)} has ${bounds.join(" and ")} characters or items${unless}.`,
 		rule: {
 			name: "field-length",
 			params: { ...params }
@@ -651,13 +848,13 @@ function fieldLength(params, options = {}) {
 			const path = `/frontmatter/${params.field}`;
 			if (params.max !== void 0 && length > params.max) return [{
 				path,
-				message: `${quote$1(params.field)} has ${count(length, unit)}; the most is ${params.max}.`,
-				fix: `Shorten ${quote$1(params.field)} to ${count(params.max, unit)} or fewer${params.unless === void 0 ? "" : `, or add ${quote$1(params.unless)}`}.`
+				message: `${quote(params.field)} has ${count(length, unit)}; the most is ${params.max}.`,
+				fix: `Shorten ${quote(params.field)} to ${count(params.max, unit)} or fewer${params.unless === void 0 ? "" : `, or add ${quote(params.unless)}`}.`
 			}];
 			if (params.min !== void 0 && length < params.min) return [{
 				path,
-				message: `${quote$1(params.field)} has ${count(length, unit)}; the least is ${params.min}.`,
-				fix: `Lengthen ${quote$1(params.field)} to ${count(params.min, unit)} or more.`
+				message: `${quote(params.field)} has ${count(length, unit)}; the least is ${params.min}.`,
+				fix: `Lengthen ${quote(params.field)} to ${count(params.min, unit)} or more.`
 			}];
 			return [];
 		}
@@ -669,7 +866,7 @@ function fieldPattern(params, options = {}) {
 	return registerBuiltIn({
 		id: options.id ?? "field-pattern",
 		severity: options.severity ?? "error",
-		description: `${quote$1(params.field)} is ${params.description}.`,
+		description: `${quote(params.field)} is ${params.description}.`,
 		rule: {
 			name: "field-pattern",
 			params: { ...params }
@@ -679,8 +876,8 @@ function fieldPattern(params, options = {}) {
 			if (typeof value !== "string" || pattern.test(value)) return [];
 			return [{
 				path: `/frontmatter/${params.field}`,
-				message: `${quote$1(params.field)} is not ${params.description}.`,
-				fix: `Write ${quote$1(params.field)} as ${params.description}.`
+				message: `${quote(params.field)} is not ${params.description}.`,
+				fix: `Write ${quote(params.field)} as ${params.description}.`
 			}];
 		}
 	}, { readsFrontmatter: true });
@@ -692,15 +889,15 @@ function requiredToPublish(params, options = {}) {
 		id: options.id ?? "required-to-publish",
 		severity: options.severity ?? "error",
 		phases: ["publish"],
-		description: `To publish, ${params.fields.map(quote$1).join(", ")} must have a value.`,
+		description: `To publish, ${params.fields.map(quote).join(", ")} must have a value.`,
 		rule: {
 			name: "required-to-publish",
 			params: { fields: [...params.fields] }
 		},
 		check: ({ frontmatter }) => params.fields.filter((field) => empty(present(frontmatter, field))).map((field) => ({
 			path: `/frontmatter/${field}`,
-			message: `${quote$1(field)} is empty, and the entry cannot be published without it.`,
-			fix: `Give ${quote$1(field)} a value, then publish.`
+			message: `${quote(field)} is empty, and the entry cannot be published without it.`,
+			fix: `Give ${quote(field)} a value, then publish.`
 		}))
 	}, { readsFrontmatter: true });
 }
@@ -716,7 +913,7 @@ function bannedWords(params, options = {}) {
 	return registerBuiltIn({
 		id: options.id ?? "banned-words",
 		severity: options.severity ?? "error",
-		description: `None of these words: ${words.map(quote$1).join(", ")}${because}.`,
+		description: `None of these words: ${words.map(quote).join(", ")}${because}.`,
 		rule: {
 			name: "banned-words",
 			params: {
@@ -732,14 +929,14 @@ function bannedWords(params, options = {}) {
 				if (typeof value !== "string") continue;
 				for (const word of found(value)) findings.push({
 					path: `/frontmatter/${field}`,
-					message: `${quote$1(field)} uses ${quote$1(word)}.`,
-					fix: `Write ${quote$1(field)} without ${quote$1(word)}${because}.`
+					message: `${quote(field)} uses ${quote(word)}.`,
+					fix: `Write ${quote(field)} without ${quote(word)}${because}.`
 				});
 			}
 			for (const word of found(documentText(context.markdown.document))) findings.push({
 				path: "/body",
-				message: `The body uses ${quote$1(word)}.`,
-				fix: `Rewrite the body without ${quote$1(word)}${because}.`
+				message: `The body uses ${quote(word)}.`,
+				fix: `Rewrite the body without ${quote(word)}${because}.`
 			});
 			return findings;
 		}
@@ -778,8 +975,8 @@ function translationPair(options = {}) {
 			const present = /* @__PURE__ */ new Set([context.locale, ...found.map((entry) => entry.locale)]);
 			return site.locales.filter((locale) => !present.has(locale)).map((locale) => ({
 				path,
-				message: `The ${locale} version of the translation group ${quote$1(group)} does not exist.`,
-				fix: `Create the entry in ${locale} with ${field}: ${quote$1(group)} in its frontmatter before publishing.`
+				message: `The ${locale} version of the translation group ${quote(group)} does not exist.`,
+				fix: `Create the entry in ${locale} with ${field}: ${quote(group)} in its frontmatter before publishing.`
 			}));
 		}
 	}, { readsFrontmatter: true });
@@ -826,7 +1023,7 @@ function internalLinksResolve(options = {}) {
 				const entry = `the entry ${clip(`${target.collection}/${target.locale}/${target.slug}`)}`;
 				findings.push({
 					path: "/body",
-					message: found === null ? `The link ${quote$1(link.href)} points at ${entry}, which does not exist.` : `The link ${quote$1(link.href)} points at ${entry}, which is not published yet (${found.status}).`,
+					message: found === null ? `The link ${quote(link.href)} points at ${entry}, which does not exist.` : `The link ${quote(link.href)} points at ${entry}, which is not published yet (${found.status}).`,
 					fix: found === null ? `Create and publish ${entry}, point the link at an entry that is published, or remove the link.` : `Publish ${entry} first, point the link at an entry that is published, or remove the link.`,
 					line: link.line
 				});
@@ -859,7 +1056,7 @@ function imagesHaveAlt(options = {}) {
 		description: "Every image has alt text that describes it.",
 		check: (context) => context.markdown.extracted.images.filter((image) => image.alt.trim() === "").map((image) => ({
 			path: "/body",
-			message: `The image ${quote$1(image.src)} has no alt text.`,
+			message: `The image ${quote(image.src)} has no alt text.`,
 			fix: `Add alt text that describes the image, as in ![a short description](${clip(image.src)}).`,
 			line: image.line
 		}))
@@ -1026,7 +1223,7 @@ function toViolations(contract, findings) {
 		severity: contract.severity,
 		path: finding.path,
 		message: finding.message,
-		fix: finding.fix.trim() === "" ? `Change the entry so that the rule ${quote$1(contract.id)} passes: ${contract.description}` : finding.fix,
+		fix: finding.fix.trim() === "" ? `Change the entry so that the rule ${quote(contract.id)} passes: ${contract.description}` : finding.fix,
 		...finding.line === void 0 ? {} : { line: finding.line }
 	}));
 }
@@ -1043,8 +1240,8 @@ function thrown(contract, error) {
 		contract: contract.id,
 		severity: "error",
 		path: "",
-		message: `The contract ${quote$1(contract.id)} failed with an error while it checked this entry: ${clip(describeError(error), 200)}`,
-		fix: `This is a problem in the config of the site, not in the entry: report it to whoever maintains the config, naming the contract ${quote$1(contract.id)}.`
+		message: `The contract ${quote(contract.id)} failed with an error while it checked this entry: ${clip(describeError(error), 200)}`,
+		fix: `This is a problem in the config of the site, not in the entry: report it to whoever maintains the config, naming the contract ${quote(contract.id)}.`
 	};
 }
 async function settle(contract, context) {
@@ -1169,57 +1366,10 @@ function uniqueTranslationViolation(holder, field) {
 		severity: "error",
 		path: `/frontmatter${pointer([field])}`,
 		message: `Another entry of this collection and locale, ${holder}, already belongs to this translation group.`,
-		fix: `Give ${quote$1(field)} another value, or change the entry ${holder} with update_draft: a translation group holds one entry per locale.`
+		fix: `Give ${quote(field)} another value, or change the entry ${holder} with update_draft: a translation group holds one entry per locale.`
 	};
 }
 //#endregion
-//#region src/config/values.ts
-/** A value with keys: not null, not an array. */
-function isRecord$2(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/** A string as the messages show it: quoted, with what could break a line escaped. */
-function quote(text) {
-	return JSON.stringify(text);
-}
-/** Text of an error that someone else wrote, on one line, so that a problem stays one line. */
-function oneLine(text) {
-	return text.replace(/\s+/g, " ").trim();
-}
-/** What a value is, for a message: `"es"`, `42`, `null`, `an array`. */
-function found(value) {
-	if (value === null) return "null";
-	switch (typeof value) {
-		case "string": return quote(value);
-		case "number":
-		case "boolean":
-		case "bigint": return String(value);
-		case "function": return "a function";
-		case "symbol": return "a symbol";
-		default: return Array.isArray(value) ? "an array" : "an object";
-	}
-}
-/** `is 42; it must be a string`, or `is missing; …` when the value is not there. */
-function wrongType(value, expected) {
-	return `${value === void 0 ? "is missing" : `is ${found(value)}`}; it must be ${expected}`;
-}
-/** An optional string: `null` when it is absent, and a problem when it is anything else. */
-function readOptionalString(path, value, fix, problems) {
-	if (value === void 0) return null;
-	if (typeof value === "string") return value;
-	problems.add(path, wrongType(value, "a string"), fix);
-	return null;
-}
-const PLAIN_KEY = /^[A-Za-z0-9_-]+$/;
-/** The path of a key inside `parent`: `sites.demo`, or `sites["my site"]` for an odd key. */
-function keyPath(parent, key) {
-	return PLAIN_KEY.test(key) ? `${parent}.${key}` : `${parent}[${quote(key)}]`;
-}
-/** The path of an item of an array: `sites.demo.locales[1]`. */
-function itemPath(parent, index) {
-	return `${parent}[${index}]`;
-}
-//#endregion
 //#region src/config/json-schema.ts
 /**
 * JSON Schema as the config uses it: what agents see of a schema, and what the checks read of it
@@ -1233,7 +1383,7 @@ const TARGET = "draft-2020-12";
 */
 function toJsonSchema$1(schema) {
 	const converted = schema["~standard"].jsonSchema.input({ target: TARGET });
-	if (!isRecord$2(converted)) throw new TypeError(`the library ${wrongType(converted, "a JSON Schema object")}`);
+	if (!isRecord$4(converted)) throw new TypeError(`the library ${wrongType(converted, "a JSON Schema object")}`);
 	return JSON.parse(JSON.stringify(converted));
 }
 /** Reference chains longer than this are cycles. */
@@ -1245,7 +1395,7 @@ function pointTo(root, ref) {
 	let node = root;
 	for (const part of ref.slice(2).split("/")) {
 		const key = part.replaceAll("~1", "/").replaceAll("~0", "~");
-		if (!isRecord$2(node) || !Object.hasOwn(node, key)) return void 0;
+		if (!isRecord$4(node) || !Object.hasOwn(node, key)) return void 0;
 		node = node[key];
 	}
 	return node;
@@ -1257,7 +1407,7 @@ function pointTo(root, ref) {
 function resolveSchema(root, schema) {
 	let node = schema;
 	for (let hop = 0; hop <= MAX_REF_HOPS; hop += 1) {
-		if (!isRecord$2(node)) return null;
+		if (!isRecord$4(node)) return null;
 		const ref = node["$ref"];
 		if (typeof ref !== "string") return node;
 		node = pointTo(root, ref);
@@ -1374,14 +1524,14 @@ function standardProps(value) {
 /** A Standard Schema that also converts to JSON Schema, which is what a collection needs. */
 function isDescribedSchema(value) {
 	const standard = standardProps(value);
-	if (!isRecord$2(standard) || typeof standard["validate"] !== "function") return false;
+	if (!isRecord$4(standard) || typeof standard["validate"] !== "function") return false;
 	const converter = standard["jsonSchema"];
-	return isRecord$2(converter) && typeof converter["input"] === "function";
+	return isRecord$4(converter) && typeof converter["input"] === "function";
 }
 /** What `isDescribedSchema` found missing, for the message. */
 function whyNotDescribed(value) {
 	const standard = standardProps(value);
-	if (!isRecord$2(standard)) return wrongType(value, "a Standard Schema with JSON Schema");
+	if (!isRecord$4(standard)) return wrongType(value, "a Standard Schema with JSON Schema");
 	if (typeof standard["validate"] !== "function") return "has no ~standard.validate function, so it is no Standard Schema";
 	return "has no ~standard.jsonSchema.input function, so describe_site could not show it to agents";
 }
@@ -1429,12 +1579,12 @@ const SLUG_PLACEHOLDER = /:slug(?![A-Za-z0-9_])/g;
 function isRoutePattern(path, route, problems) {
 	let valid = true;
 	if (!route.startsWith("/")) {
-		problems.add(path, `${quote(route)} does not start with "/"`, "Write the path from the root of the site, such as \"/blog/:slug/\".");
+		problems.add(path, `${quote$1(route)} does not start with "/"`, "Write the path from the root of the site, such as \"/blog/:slug/\".");
 		valid = false;
 	}
 	const slugs = [...route.matchAll(SLUG_PLACEHOLDER)].length;
 	if (slugs !== 1) {
-		problems.add(path, slugs === 0 ? `${quote(route)} has no :slug` : `${quote(route)} has :slug ${slugs} times`, "Use :slug exactly once, where the slug of the entry goes, such as \"/blog/:slug/\".");
+		problems.add(path, slugs === 0 ? `${quote$1(route)} has no :slug` : `${quote$1(route)} has :slug ${slugs} times`, "Use :slug exactly once, where the slug of the entry goes, such as \"/blog/:slug/\".");
 		valid = false;
 	}
 	return valid;
@@ -1447,11 +1597,11 @@ function claimRoute(route, path, site, problems) {
 		site.routes.set(pattern, path);
 		return;
 	}
-	problems.add(path, `${quote(route)} is the same pattern as the route at ${owner}`, "Give every route of the site its own path: internal links are matched against them.");
+	problems.add(path, `${quote$1(route)} is the same pattern as the route at ${owner}`, "Give every route of the site its own path: internal links are matched against them.");
 }
 /** The route of each locale, in the order of the site's locales. */
 function readRoutes(path, raw, collection, site, problems) {
-	if (!isRecord$2(raw)) {
+	if (!isRecord$4(raw)) {
 		problems.add(path, wrongType(raw, "an object with one path per locale"), ROUTES_FIX);
 		return {};
 	}
@@ -1459,12 +1609,12 @@ function readRoutes(path, raw, collection, site, problems) {
 		const routePath = keyPath(path, locale);
 		const route = raw[locale];
 		const known = !site.localesOk || site.locales.includes(locale);
-		if (!known) problems.add(routePath, `is a route for ${quote(locale)}, which is not a locale of the site (${site.locales.join(", ")})`, `Remove it, or add ${quote(locale)} to the locales of the site.`);
+		if (!known) problems.add(routePath, `is a route for ${quote$1(locale)}, which is not a locale of the site (${site.locales.join(", ")})`, `Remove it, or add ${quote$1(locale)} to the locales of the site.`);
 		if (typeof route !== "string") problems.add(routePath, wrongType(route, "a path such as \"/blog/:slug/\""), ROUTES_FIX);
 		else if (isRoutePattern(routePath, route, problems) && known) claimRoute(route, routePath, site, problems);
 	}
 	if (site.localesOk) {
-		for (const locale of site.locales) if (!Object.hasOwn(raw, locale)) problems.add(path, `has no route for the locale ${quote(locale)}`, `Add ${keyPath("routes", locale)}, a path such as ${quote(`/${locale}/${collection}/:slug/`)}.`);
+		for (const locale of site.locales) if (!Object.hasOwn(raw, locale)) problems.add(path, `has no route for the locale ${quote$1(locale)}`, `Add ${keyPath("routes", locale)}, a path such as ${quote$1(`/${locale}/${collection}/:slug/`)}.`);
 	}
 	const routes = {};
 	for (const locale of site.locales) {
@@ -1476,12 +1626,12 @@ function readRoutes(path, raw, collection, site, problems) {
 const GROUP_BY = {
 	mustBe: "a string",
 	accepts: isStringSchema,
-	fix: (field) => `Declare ${quote(field)} as z.string() in the schema, or name another field.`
+	fix: (field) => `Declare ${quote$1(field)} as z.string() in the schema, or name another field.`
 };
 const TAGS = {
 	mustBe: "an array of strings",
 	accepts: isStringArraySchema,
-	fix: (field) => `Declare ${quote(field)} as z.array(z.string()) in the schema, or name another field.`
+	fix: (field) => `Declare ${quote$1(field)} as z.array(z.string()) in the schema, or name another field.`
 };
 /**
 * Listings sort by this field as text, which is chronological only for ISO 8601 dates. A string
@@ -1490,7 +1640,7 @@ const TAGS = {
 const SORT_BY = {
 	mustBe: "a string with the \"date\" or \"date-time\" format",
 	accepts: isDateSchema,
-	fix: (field) => `Declare ${quote(field)} as z.iso.date() or z.iso.datetime() in the schema, or name another field.`
+	fix: (field) => `Declare ${quote$1(field)} as z.iso.date() or z.iso.datetime() in the schema, or name another field.`
 };
 /** The name of a field of the frontmatter, checked against the schema when there is one. */
 function readField(path, raw, schema, kind, problems) {
@@ -1499,16 +1649,16 @@ function readField(path, raw, schema, kind, problems) {
 		return null;
 	}
 	if (schema === null) return raw;
-	const properties = isRecord$2(schema.object["properties"]) ? schema.object["properties"] : {};
+	const properties = isRecord$4(schema.object["properties"]) ? schema.object["properties"] : {};
 	if (!Object.hasOwn(properties, raw)) {
 		const names = Object.keys(properties);
-		problems.add(path, `${quote(raw)} is not a property of the schema${names.length === 0 ? ", which declares none" : ` (its properties are ${names.map(quote).join(", ")})`}`, `Name a field that the schema declares, or add ${quote(raw)} to the schema.`);
-	} else if (!kind.accepts(schema.document, properties[raw])) problems.add(path, `${quote(raw)} is declared as ${describeShape(schema.document, properties[raw])}, but it must be ${kind.mustBe}`, kind.fix(raw));
+		problems.add(path, `${quote$1(raw)} is not a property of the schema${names.length === 0 ? ", which declares none" : ` (its properties are ${names.map(quote$1).join(", ")})`}`, `Name a field that the schema declares, or add ${quote$1(raw)} to the schema.`);
+	} else if (!kind.accepts(schema.document, properties[raw])) problems.add(path, `${quote$1(raw)} is declared as ${describeShape(schema.document, properties[raw])}, but it must be ${kind.mustBe}`, kind.fix(raw));
 	return raw;
 }
 function readTranslations(path, raw, schema, problems) {
 	if (raw === void 0) return null;
-	if (!isRecord$2(raw)) {
+	if (!isRecord$4(raw)) {
 		problems.add(path, wrongType(raw, "an object like { groupBy: \"translationGroup\" }"), "Set it to { groupBy: \"<field>\" }, the field of the frontmatter that holds the key the translations of an entry share, or remove it.");
 		return null;
 	}
@@ -1516,8 +1666,8 @@ function readTranslations(path, raw, schema, problems) {
 }
 const COMPONENT_FIX = "Declare it with defineComponent({ props: z.strictObject({ … }) }).";
 function readComponent(path, name, raw, problems) {
-	if (!NAME$1.test(name)) problems.add(path, `${quote(name)} is not a valid component name`, nameFix("callout"));
-	if (!isRecord$2(raw)) {
+	if (!NAME.test(name)) problems.add(path, `${quote$1(name)} is not a valid component name`, nameFix("callout"));
+	if (!isRecord$4(raw)) {
 		problems.add(path, wrongType(raw, "a component"), COMPONENT_FIX);
 		return null;
 	}
@@ -1535,7 +1685,7 @@ function readComponent(path, name, raw, problems) {
 function readComponents(path, raw, problems) {
 	const components = /* @__PURE__ */ new Map();
 	if (raw === void 0) return components;
-	if (!isRecord$2(raw)) {
+	if (!isRecord$4(raw)) {
 		problems.add(path, wrongType(raw, "an object that maps each component name to its definition"), COMPONENT_FIX);
 		return components;
 	}
@@ -1567,7 +1717,7 @@ function checkPhases(path, raw, problems) {
 	for (let index = 0; index < phases.length; index += 1) {
 		const phase = phases[index];
 		if (!isPhase(phase)) problems.add(itemPath(path, index), wrongType(phase, "\"write\" or \"publish\""), PHASES_FIX);
-		else if (seen.has(phase)) problems.add(itemPath(path, index), `repeats ${quote(phase)}`, PHASES_FIX);
+		else if (seen.has(phase)) problems.add(itemPath(path, index), `repeats ${quote$1(phase)}`, PHASES_FIX);
 		seen.add(phase);
 	}
 }
@@ -1576,7 +1726,7 @@ function checkPhases(path, raw, problems) {
 * what makes it a `Contract`. Whether it may have its id is a question for `checkIdentity`.
 */
 function isContract(item, path, problems) {
-	if (!isRecord$2(item)) {
+	if (!isRecord$4(item)) {
 		problems.add(path, wrongType(item, "a contract"), "Write it as { id, severity, description, check }.");
 		return false;
 	}
@@ -1599,7 +1749,7 @@ function isContract(item, path, problems) {
 */
 function checkIdentity(id, own, path, ids, problems) {
 	if (RESERVED.has(id) && !own) {
-		problems.add(keyPath(path, "id"), `${quote(id)} is the id of a built-in contract`, `Choose another id: ${BUILT_IN_CONTRACT_IDS.join(", ")} belong to Hollware's built-in contracts, and the opt-in ones are listed as contracts.translationPair(), contracts.internalLinksResolve() and contracts.imagesHaveAlt().`);
+		problems.add(keyPath(path, "id"), `${quote$1(id)} is the id of a built-in contract`, `Choose another id: ${BUILT_IN_CONTRACT_IDS.join(", ")} belong to Hollware's built-in contracts, and the opt-in ones are listed as contracts.translationPair(), contracts.internalLinksResolve() and contracts.imagesHaveAlt().`);
 		return;
 	}
 	const first = ids.get(id);
@@ -1607,7 +1757,7 @@ function checkIdentity(id, own, path, ids, problems) {
 		ids.set(id, path);
 		return;
 	}
-	problems.add(keyPath(path, "id"), `${quote(id)} is already the id of the contract at ${first}`, "Give every contract of the collection its own id.");
+	problems.add(keyPath(path, "id"), `${quote$1(id)} is already the id of the contract at ${first}`, "Give every contract of the collection its own id.");
 }
 function readContracts(path, raw, problems) {
 	const contracts = [];
@@ -1624,7 +1774,7 @@ function readContracts(path, raw, problems) {
 		if (isContract(item, itemAt, problems)) {
 			checkIdentity(item.id, isBuiltInContract(item), itemAt, ids, problems);
 			contracts.push(item);
-		} else if (isRecord$2(item) && typeof item["id"] === "string" && CONTRACT_ID.test(item["id"])) checkIdentity(item["id"], false, itemAt, ids, problems);
+		} else if (isRecord$4(item) && typeof item["id"] === "string" && CONTRACT_ID.test(item["id"])) checkIdentity(item["id"], false, itemAt, ids, problems);
 	}
 	return contracts;
 }
@@ -1639,8 +1789,8 @@ function readMaxMarkdownBytes(path, raw, problems) {
 * problem already: `resolveConfig` throws when there is any, so nothing else keeps track of them.
 */
 function readCollection(path, name, raw, site, problems) {
-	if (!NAME$1.test(name)) problems.add(path, `${quote(name)} is not a valid collection name`, nameFix("blog"));
-	if (!isRecord$2(raw)) {
+	if (!NAME.test(name)) problems.add(path, `${quote$1(name)} is not a valid collection name`, nameFix("blog"));
+	if (!isRecord$4(raw)) {
 		problems.add(path, wrongType(raw, "a collection"), "Declare it with defineCollection({ schema, routes, … }).");
 		return null;
 	}
@@ -1668,105 +1818,6 @@ function readCollection(path, name, raw, site, problems) {
 	};
 }
 //#endregion
-//#region src/config/events.ts
-/** The name of a Worker secret or variable: what `wrangler secret put` takes. */
-const BINDING_NAME = /^[A-Z][A-Z0-9_]*$/;
-/** A subscriber's name: lowercase words joined by hyphens. */
-const NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-/** The public URL of a site: an absolute http or https URL with no path, query or fragment. */
-function readSiteUrl(path, raw, problems) {
-	if (raw === void 0) return null;
-	const fix = "Write the public origin of the site, such as \"https://example.com\".";
-	if (typeof raw !== "string" || !URL.canParse(raw)) {
-		problems.add(path, wrongType(raw, "an absolute URL"), fix);
-		return null;
-	}
-	const url = new URL(raw);
-	if (url.protocol !== "https:" && url.protocol !== "http:" || url.pathname !== "/" || url.search !== "" || url.hash !== "") {
-		problems.add(path, `${quote(raw)} is not an origin`, fix);
-		return null;
-	}
-	return url.origin;
-}
-/** The origins of a site's pages that may read its published content from the browser. */
-function readCors(path, raw, problems) {
-	if (raw === void 0) return { origins: [] };
-	if (!isRecord$2(raw) || !Array.isArray(raw["origins"])) {
-		problems.add(path, wrongType(raw, "an object with origins"), "Declare it as { origins: [\"https://example.com\"] }, or remove it.");
-		return { origins: [] };
-	}
-	const origins = [];
-	for (const [index, origin] of raw["origins"].entries()) {
-		const read = readSiteUrl(itemPath(keyPath(path, "origins"), index), origin, problems);
-		if (read !== null && !origins.includes(read)) origins.push(read);
-	}
-	return { origins };
-}
-function readBindingName(path, raw, problems) {
-	if (typeof raw === "string" && BINDING_NAME.test(raw)) return raw;
-	problems.add(path, wrongType(raw, "the name of a Worker secret"), "Name the secret that holds the value, such as \"WEBHOOK_SECRET\", and set it with wrangler secret put.");
-	return null;
-}
-function readWebhook(path, raw, problems) {
-	if (!isRecord$2(raw)) {
-		problems.add(path, wrongType(raw, "a webhook"), "Declare it as { name: \"newsletter\", url: \"https://…\", secret: \"WEBHOOK_SECRET\" }.");
-		return null;
-	}
-	const name = raw["name"];
-	if (typeof name !== "string" || !NAME.test(name)) problems.add(keyPath(path, "name"), wrongType(name, "a name"), "Name it with lowercase words joined by hyphens, such as \"newsletter\".");
-	const url = raw["url"];
-	const urlOk = typeof url === "string" && URL.canParse(url) && new URL(url).protocol === "https:";
-	if (!urlOk) problems.add(keyPath(path, "url"), wrongType(url, "an https URL"), "Give the https URL that receives the events.");
-	const secret = raw["secret"] === void 0 ? null : readBindingName(keyPath(path, "secret"), raw["secret"], problems);
-	if (typeof name !== "string" || !NAME.test(name) || !urlOk) return null;
-	if (raw["secret"] !== void 0 && secret === null) return null;
-	return {
-		name,
-		url: String(url),
-		secret
-	};
-}
-/** Who hears about publications (ADR-025): webhooks, and IndexNow when the site has a URL. */
-function readEvents(path, raw, siteUrl, problems) {
-	const events = {
-		webhooks: [],
-		indexNow: null
-	};
-	if (raw === void 0) return events;
-	if (!isRecord$2(raw)) {
-		problems.add(path, wrongType(raw, "an object"), "Declare { webhooks: [ … ], indexNow: { … } }.");
-		return events;
-	}
-	const webhooks = raw["webhooks"];
-	if (webhooks !== void 0) {
-		if (!Array.isArray(webhooks)) problems.add(keyPath(path, "webhooks"), wrongType(webhooks, "a list"), "List the webhooks.");
-		else {
-			const seen = /* @__PURE__ */ new Set();
-			webhooks.forEach((item, index) => {
-				const webhook = readWebhook(itemPath(keyPath(path, "webhooks"), index), item, problems);
-				if (webhook === null) return;
-				if (seen.has(webhook.name)) {
-					problems.add(itemPath(keyPath(path, "webhooks"), index), `repeats the name ${quote(webhook.name)}`, "Give each webhook a name of its own.");
-					return;
-				}
-				seen.add(webhook.name);
-				events.webhooks.push(webhook);
-			});
-		}
-	}
-	const indexNow = raw["indexNow"];
-	if (indexNow !== void 0) {
-		const indexPath = keyPath(path, "indexNow");
-		if (!isRecord$2(indexNow)) problems.add(indexPath, wrongType(indexNow, "an object"), "Declare { key: \"INDEXNOW_KEY\" }.");
-		else {
-			const key = readBindingName(keyPath(indexPath, "key"), indexNow["key"], problems);
-			if (siteUrl === null) problems.add(indexPath, "needs the URL of the site", "Set url on the site: IndexNow is told the public URLs of the entries.");
-			else if (key !== null) events.indexNow = { key };
-		}
-	}
-	return events;
-}
-//#endregion
 //#region src/config/site-key.ts
 /**
 * The key of a site, which is the id of its row in the database: lowercase letters and digits
@@ -1816,14 +1867,14 @@ function readLocales(path, raw, problems) {
 		}
 		locales.push(tag);
 		if (!LOCALE_TAG.test(tag)) {
-			problems.add(tagPath, `${quote(tag)} is not a language tag`, LOCALE_FIX);
+			problems.add(tagPath, `${quote$1(tag)} is not a language tag`, LOCALE_FIX);
 			ok = false;
 			continue;
 		}
 		const first = firstAt.get(tag);
 		if (first === void 0) firstAt.set(tag, index);
 		else {
-			problems.add(tagPath, `${quote(tag)} is already listed at ${itemPath(path, first)}`, "List each locale once.");
+			problems.add(tagPath, `${quote$1(tag)} is already listed at ${itemPath(path, first)}`, "List each locale once.");
 			ok = false;
 		}
 	}
@@ -1837,13 +1888,13 @@ function readDefaultLocale(path, raw, locales, problems) {
 		problems.add(path, wrongType(raw, "one of the locales"), "Set it to the main language of the site, one of its locales.");
 		return "";
 	}
-	if (locales.length > 0 && !locales.includes(raw)) problems.add(path, `is ${quote(raw)}, which is not one of the locales (${locales.map(quote).join(", ")})`, `Set it to one of ${locales.map(quote).join(", ")}, or add ${quote(raw)} to locales.`);
+	if (locales.length > 0 && !locales.includes(raw)) problems.add(path, `is ${quote$1(raw)}, which is not one of the locales (${locales.map(quote$1).join(", ")})`, `Set it to one of ${locales.map(quote$1).join(", ")}, or add ${quote$1(raw)} to locales.`);
 	return raw;
 }
 const COLLECTIONS_FIX = "Declare at least one: collections: { blog: defineCollection({ schema, routes }) }.";
 function readCollections(path, raw, site, problems) {
 	const collections = /* @__PURE__ */ new Map();
-	if (!isRecord$2(raw)) {
+	if (!isRecord$4(raw)) {
 		problems.add(path, wrongType(raw, "an object that maps each collection name to its collection"), COLLECTIONS_FIX);
 		return collections;
 	}
@@ -1858,8 +1909,8 @@ function readCollections(path, raw, site, problems) {
 /** Checks one site; `null` when it is no object, which is a problem already. */
 function readSite(key, raw, problems) {
 	const path = keyPath("sites", key);
-	if (!isSiteKey(key)) problems.add(path, `${quote(key)} is not a valid site key`, SITE_KEY_FIX);
-	if (!isRecord$2(raw)) {
+	if (!isSiteKey(key)) problems.add(path, `${quote$1(key)} is not a valid site key`, SITE_KEY_FIX);
+	if (!isRecord$4(raw)) {
 		problems.add(path, wrongType(raw, "a site"), "Declare it as { locales: [\"en\"], defaultLocale: \"en\", collections: { … } }.");
 		return null;
 	}
@@ -1881,12 +1932,13 @@ function readSite(key, raw, problems) {
 		collections,
 		url,
 		cors: readCors(keyPath(path, "cors"), raw["cors"], problems),
-		events: readEvents(keyPath(path, "events"), raw["events"], url, problems)
+		events: readEvents(keyPath(path, "events"), raw["events"], url, problems),
+		audit: readAudit(keyPath(path, "audit"), raw["audit"], problems)
 	};
 }
 function readSites(raw, problems) {
 	const sites = /* @__PURE__ */ new Map();
-	if (!isRecord$2(raw)) {
+	if (!isRecord$4(raw)) {
 		problems.add("sites", wrongType(raw, "an object that maps the site key to the site"), SITE_FIX);
 		return sites;
 	}
@@ -1901,7 +1953,7 @@ function readSites(raw, problems) {
 /** `auth` of the config: absent, or an object whose `dynamicClientRegistration` is a boolean. */
 function readAuth(raw, problems) {
 	if (raw === void 0) return { dynamicClientRegistration: false };
-	if (!isRecord$2(raw)) {
+	if (!isRecord$4(raw)) {
 		problems.add("auth", wrongType(raw, "an object"), "Write auth: { dynamicClientRegistration: true }, or leave auth out.");
 		return { dynamicClientRegistration: false };
 	}
@@ -1943,7 +1995,7 @@ function resolveConfig(config) {
 	const problems = new Problems();
 	let sites = /* @__PURE__ */ new Map();
 	let auth = { dynamicClientRegistration: false };
-	if (isRecord$2(config)) {
+	if (isRecord$4(config)) {
 		sites = readSites(config["sites"], problems);
 		auth = readAuth(config["auth"], problems);
 	} else problems.add("config", wrongType(config, "an object"), "Export the result of defineConfig({ sites: { … } }) from hollware.config.ts.");
@@ -1954,6 +2006,69 @@ function resolveConfig(config) {
 	};
 }
 //#endregion
+//#region src/audit/index.ts
+/**
+* The actions of the activity log (ADR-037). A line names one of these, and nothing else: a new
+* operation or route that changes something is not logged until it is named here.
+*/
+/** Every operation that is not a read: each call of one is a line, whatever its outcome. */
+const OPERATION_AUDIT_ACTIONS = [
+	"create_draft",
+	"update_draft",
+	"publish",
+	"unpublish",
+	"delete_entry",
+	"restore_entry",
+	"approve_review",
+	"request_review",
+	"comment_review",
+	"request_changes",
+	"update_site",
+	"set_collection",
+	"create_site",
+	"delete_site",
+	"restore_site",
+	"make_webhook_secret"
+];
+/** What people do outside the operations: their tokens, members, passkeys, sessions and apps. */
+const IDENTITY_AUDIT_ACTIONS = [
+	"token.create",
+	"preview.create",
+	"token.revoke",
+	"member.role",
+	"member.remove",
+	"invitation.create",
+	"invitation.accept",
+	"session.sign_in",
+	"session.sign_out",
+	"session.end_all",
+	"passkey.remove",
+	"app.allow",
+	"app.revoke",
+	"app.refresh_reused",
+	"schedule.publish"
+];
+const AUDIT_ACTIONS = [...OPERATION_AUDIT_ACTIONS, ...IDENTITY_AUDIT_ACTIONS];
+/** `denied`: a scope or a role was missing; `failed`: any other error the caller got. */
+const AUDIT_OUTCOMES = [
+	"ok",
+	"denied",
+	"failed"
+];
+/**
+* Who acted: a person in the admin, a personal token, an app a person allowed through OAuth, or
+* the deployment itself (its cron).
+*/
+const AUDIT_ACTOR_KINDS = [
+	"user",
+	"token",
+	"oauth_client",
+	"system"
+];
+function isAuditAction(value) {
+	return AUDIT_ACTIONS.includes(value);
+}
+//#endregion
 //#region src/structure/definition.ts
 /**
 * The definition of a site as data (ADR-033): what D1 stores for it and what the operations that
@@ -2003,6 +2118,13 @@ const siteDefinitionData = z.strictObject({
 		webhooks: [],
 		indexNow: null
 	}),
+	audit: z.strictObject({
+		ipAddresses: z.enum(["off", "hashed"]).default("off").describe("Whether the activity log keeps the address of each request, as a hash keyed by the site, or nothing of it."),
+		retentionDays: z.number().int().min(30).max(AUDIT_RETENTION_MAX_DAYS).nullable().default(null).describe("The days each line of the activity log is kept; null keeps it as long as the site.")
+	}).default({
+		ipAddresses: "off",
+		retentionDays: null
+	}).describe("What the activity log of the site keeps (ADR-037). Only an owner should change it."),
 	collections: z.record(z.string(), collectionDefinitionData)
 });
 //#endregion
@@ -2025,19 +2147,19 @@ const SUMMARIES = /* @__PURE__ */ new Set([
 function segmentsOf$1(location) {
 	return location.replace(/^#\/?/, "").split("/").filter((segment) => segment !== "").map((segment) => decodeURIComponent(segment).replaceAll("~1", "/").replaceAll("~0", "~"));
 }
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /** The schema of the object at `segments`, to tell a declared key from an unknown one. */
 function declaredKeys(schema, segments) {
 	let node = schema;
 	for (const segment of segments) {
-		if (!isRecord$1(node)) return /* @__PURE__ */ new Set();
+		if (!isRecord$2(node)) return /* @__PURE__ */ new Set();
 		const properties = node["properties"];
-		node = isRecord$1(properties) && Object.hasOwn(properties, segment) ? properties[segment] : node["items"];
+		node = isRecord$2(properties) && Object.hasOwn(properties, segment) ? properties[segment] : node["items"];
 	}
-	const properties = isRecord$1(node) ? node["properties"] : void 0;
-	return new Set(isRecord$1(properties) ? Object.keys(properties) : []);
+	const properties = isRecord$2(node) ? node["properties"] : void 0;
+	return new Set(isRecord$2(properties) ? Object.keys(properties) : []);
 }
 /** The issues of a validation: one for each part that failed, at the path of the value. */
 function issuesOf(schema, errors) {
@@ -2149,7 +2271,8 @@ function compileSite(path, site, problems) {
 				...webhook.secret === void 0 ? {} : { secret: webhook.secret }
 			})),
 			...site.events.indexNow === null ? {} : { indexNow: site.events.indexNow }
-		}
+		},
+		audit: site.audit
 	};
 }
 /** The definitions of the sites, read from D1 as JSON, checked and resolved. */
@@ -2223,6 +2346,10 @@ function definitionsFromConfig(config) {
 				webhooks: (site.events?.webhooks ?? []).map((webhook) => ({ ...webhook })),
 				indexNow: site.events?.indexNow ?? null
 			},
+			...site.audit === void 0 ? {} : { audit: {
+				ipAddresses: site.audit.ipAddresses ?? "off",
+				retentionDays: site.audit.retentionDays ?? null
+			} },
 			collections: Object.fromEntries(Object.entries(site.collections).map(([name, collection]) => [name, collectionOf(keyPath(keyPath(path, "collections"), name), collection, problems)]))
 		};
 	}
@@ -2370,6 +2497,10 @@ function sitePreset(preset, locales, defaultLocale) {
 			webhooks: [],
 			indexNow: null
 		},
+		audit: {
+			ipAddresses: "off",
+			retentionDays: null
+		},
 		collections
 	};
 }
@@ -2384,6 +2515,7 @@ const ERROR_CODES = [
 	"invalid_input",
 	"unknown_collection",
 	"unknown_locale",
+	"invalid_preview",
 	"insufficient_scope",
 	"output_too_large",
 	"timeout",
@@ -2413,6 +2545,7 @@ var HollwareError = class extends Error {
 const CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
 /** The kinds of ids and their prefixes. A new kind adds its prefix here. */
 const ID_PREFIXES = {
+	auditLine: "aud",
 	challenge: "chl",
 	delivery: "dlv",
 	embedding: "emb",
@@ -3515,7 +3648,7 @@ function utf8ByteLength(text) {
 	}
 	return bytes;
 }
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function describe(value) {
@@ -3548,8 +3681,8 @@ function linesBeforeBody(source, body) {
 function yamlViolation(error, source) {
 	const reason = Reflect.get(error, "reason");
 	const mark = Reflect.get(error, "mark");
-	const markLine = isRecord(mark) ? mark.line : void 0;
-	const markColumn = isRecord(mark) ? mark.column : void 0;
+	const markLine = isRecord$1(mark) ? mark.line : void 0;
+	const markColumn = isRecord$1(mark) ? mark.column : void 0;
 	const firstLine = source.startsWith("---\r\n") ? 1 : 2;
 	return yamlSyntax(typeof reason === "string" ? reason : error.message.split("\n")[0] ?? "it does not parse", typeof markLine === "number" ? markLine + firstLine : void 0, typeof markColumn === "number" ? markColumn + 1 : void 0);
 }
@@ -3575,7 +3708,7 @@ async function run(markdown, options) {
 		};
 	}
 	const frontmatter = split.data;
-	if (!isRecord(frontmatter)) return {
+	if (!isRecord$1(frontmatter)) return {
 		ok: false,
 		violations: [frontmatterNotMapping(describe(frontmatter))]
 	};
@@ -3682,7 +3815,20 @@ const URL_ATTRIBUTES = /* @__PURE__ */ new Set([
 function isProps(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function sanitizeProps(raw) {
+/** The value a path such as `frontmatter.url` names in the data, or `undefined`. */
+function resolvePath(data, path) {
+	let value = data;
+	for (const part of path.split(".")) {
+		if (typeof value !== "object" || value === null || !Object.hasOwn(value, part)) return void 0;
+		value = Reflect.get(value, part);
+	}
+	return value;
+}
+/** The name of an attribute without the `:` or `v-bind:` of a binding. */
+function unbound(key) {
+	return key.startsWith("v-bind:") ? key.slice(7) : key.replace(/^:/, "");
+}
+function sanitizeProps(raw, data) {
 	const props = {};
 	if (!isProps(raw)) return props;
 	for (const key of Object.keys(raw)) {
@@ -3691,8 +3837,15 @@ function sanitizeProps(raw) {
 		if (isForbiddenAttribute(name)) continue;
 		const value = raw[key];
 		if (URL_ATTRIBUTES.has(name)) {
+			const kind = name === "src" ? "image" : "link";
 			const url = urlValue(key, value);
-			if (url === void 0 || !isSafeUrl(url, name === "src" ? "image" : "link")) continue;
+			if (url === void 0) continue;
+			if (isBinding(key) && url === value) {
+				const bound = resolvePath(data, url);
+				if (typeof bound === "string" && isSafeUrl(bound, kind)) setOwn(props, unbound(key), bound.replaceAll("&", "&amp;"));
+				continue;
+			}
+			if (!isSafeUrl(url, kind)) continue;
 		}
 		setOwn(props, key, typeof value === "string" && !isBinding(key) ? value.replaceAll("&", "&amp;") : value);
 	}
@@ -3704,19 +3857,19 @@ function marker(name) {
 		name: TAG_NAME.test(name) ? shorten(name) : "?"
 	}];
 }
-function sanitizeElement(node, depth) {
+function sanitizeElement(node, depth, data) {
 	const tag = node[0];
 	if (typeof tag !== "string") return void 0;
 	if (!NATIVE_TAGS.has(tag) && tag !== "hollware-marker") {
 		if (!TAG_NAME.test(tag) || DANGEROUS_TAGS.has(tag.toLowerCase())) return marker(tag);
 	}
-	const element = [tag, sanitizeProps(node[1])];
+	const element = [tag, sanitizeProps(node[1], data)];
 	if (depth >= 100) return element;
 	for (let at = 2; at < node.length; at++) {
 		const child = node[at];
 		if (typeof child === "string") element.push(child);
 		else if (Array.isArray(child)) {
-			const clean = sanitizeElement(child, depth + 1);
+			const clean = sanitizeElement(child, depth + 1, data);
 			if (clean !== void 0) element.push(clean);
 		}
 	}
@@ -3725,10 +3878,14 @@ function sanitizeElement(node, depth) {
 /** Copies a document through the rules of this file. */
 function sanitizeDocument(document) {
 	const nodes = [];
+	const data = {
+		frontmatter: document.frontmatter,
+		meta: document.meta
+	};
 	if (Array.isArray(document.nodes)) {
 		for (const node of document.nodes) if (typeof node === "string") nodes.push(node);
 		else if (Array.isArray(node)) {
-			const clean = sanitizeElement(node, 1);
+			const clean = sanitizeElement(node, 1, data);
 			if (clean !== void 0) nodes.push(clean);
 		}
 	}
@@ -3828,6 +3985,7 @@ const entrySummary = z.object({
 	hasUnpublishedChanges: z.boolean().describe("Whether the latest revision differs from the published one."),
 	publishedAt: z.string().nullable().describe("When the entry was first published, or null."),
 	scheduledAt: z.string().nullable().describe("When a scheduled entry will be published, or null for one that is not scheduled."),
+	deletedAt: z.string().nullable().describe("When the entry went to the trash, or null for one that is not in the trash."),
 	updatedAt: z.string()
 });
 const publication = z.object({
@@ -3958,12 +4116,13 @@ const describeSite = defineOperation({
 const listEntries = defineOperation({
 	name: "list_entries",
 	title: "List entries",
-	description: "Lists the entries of a collection, newest first, filtered by locale, tag or status. Pass the nextCursor of an answer as cursor to get the next page.",
+	description: "Lists the entries of a collection, newest first, filtered by locale, tag or status. Pass the nextCursor of an answer as cursor to get the next page. Entries in the trash are left out, unless trashed asks for them.",
 	input: z.strictObject({
 		collection: collectionName,
 		locale: locale.optional(),
 		tag: z.string().min(1).optional(),
 		status: entryStatus.optional(),
+		trashed: z.boolean().optional().describe("true to list the entries in the trash, last trashed first, instead of the others."),
 		limit: z.number().int().min(1).max(100).default(20),
 		cursor: z.string().min(1).optional()
 	}),
@@ -4046,7 +4205,7 @@ const getTranslations = defineOperation({
 const createDraft = defineOperation({
 	name: "create_draft",
 	title: "Create a draft",
-	description: "Creates an entry from a Markdown file and saves it as a draft at version 1. Contract errors do not stop the draft: it is saved, and the verdict says what to fix before publishing. It is refused only when it cannot be stored: the file is too large, its frontmatter or syntax does not parse, or the slug or translation is taken.",
+	description: "Creates an entry from a Markdown file and saves it as a draft at version 1. Contract errors do not stop the draft: it is saved, and the verdict says what to fix before publishing. It is refused only when it cannot be stored: the file is too large, its frontmatter or syntax does not parse, or the slug or translation is taken. An entry in the trash keeps its slug and translation: the answer is in_trash with that entry, and restore_entry brings it back.",
 	input: z.strictObject({
 		collection: collectionName,
 		locale,
@@ -4054,15 +4213,20 @@ const createDraft = defineOperation({
 		markdown
 	}),
 	output: z.object({
-		outcome: z.enum(["saved", "refused"]),
-		entry: entrySummary.optional(),
+		outcome: z.enum([
+			"saved",
+			"refused",
+			"in_trash"
+		]),
+		entry: entrySummary.optional().describe("With saved, the new draft; with in_trash, the entry in the trash that holds it."),
 		verdict: verdict.optional()
 	}),
 	scopes: ["content:write"],
 	effect: "write",
 	outcomes: {
 		saved: { isError: false },
-		refused: { isError: true }
+		refused: { isError: true },
+		in_trash: { isError: true }
 	}
 });
 const updateDraft = defineOperation({
@@ -4172,6 +4336,54 @@ const unpublish = defineOperation({
 		not_found: { isError: true }
 	}
 });
+const deleteEntry = defineOperation({
+	name: "delete_entry",
+	title: "Move an entry to the trash",
+	description: "Moves a draft to the trash, if it is still at the version you read: every operation treats it as gone, its pending review is cancelled, and nothing is deleted. It keeps its slug and translation, and restore_entry brings it back as the draft it was. A published or scheduled entry answers published: unpublish it first.",
+	input: z.strictObject({
+		id: entryId,
+		version
+	}),
+	output: z.object({
+		outcome: z.enum([
+			"trashed",
+			"published",
+			"conflict",
+			"not_found"
+		]),
+		entry: entrySummary.optional(),
+		conflict: conflict.optional()
+	}),
+	scopes: ["content:write"],
+	effect: "destructive",
+	outcomes: {
+		trashed: { isError: false },
+		published: { isError: true },
+		conflict: { isError: true },
+		not_found: { isError: true }
+	}
+});
+const restoreEntry = defineOperation({
+	name: "restore_entry",
+	title: "Bring an entry back from the trash",
+	description: "Brings an entry back from the trash as the draft it was, with its revisions, at the next version. An entry that is not in the trash answers not_trashed.",
+	input: z.strictObject({ id: entryId }),
+	output: z.object({
+		outcome: z.enum([
+			"restored",
+			"not_trashed",
+			"not_found"
+		]),
+		entry: entrySummary.optional()
+	}),
+	scopes: ["content:write"],
+	effect: "write",
+	outcomes: {
+		restored: { isError: false },
+		not_trashed: { isError: true },
+		not_found: { isError: true }
+	}
+});
 const listReviews = defineOperation({
 	name: "list_reviews",
 	title: "List the reviews",
@@ -4487,6 +4699,7 @@ const OPERATIONS = [
 	contentStats,
 	createDraft,
 	createSite,
+	deleteEntry,
 	deleteSite,
 	describeSite,
 	getEntry,
@@ -4518,6 +4731,7 @@ const OPERATIONS = [
 	publish,
 	requestChanges,
 	requestReview,
+	restoreEntry,
 	restoreSite,
 	search,
 	setCollection,
@@ -4606,13 +4820,13 @@ const TIMESTAMP_HEADER = "hollware-timestamp";
 const EVENT_ID_HEADER = "hollware-event-id";
 /** How far a timestamp may be from the receiver's clock, by default: five minutes. */
 const TOLERANCE_SECONDS = 300;
-const encoder = new TextEncoder();
+const encoder$1 = new TextEncoder();
 async function hmac(secret, text) {
-	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+	const key = await crypto.subtle.importKey("raw", encoder$1.encode(secret), {
 		name: "HMAC",
 		hash: "SHA-256"
 	}, false, ["sign"]);
-	return [...new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(text)))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+	return [...new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder$1.encode(text)))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 /** The value of `hollware-signature` for a body sent at `timestamp` (seconds). */
 async function signWebhook(secret, timestamp, body) {
@@ -4625,9 +4839,20 @@ function sameText(a, b) {
 	for (let index = 0; index < a.length; index++) difference |= a.charCodeAt(index) ^ b.charCodeAt(index);
 	return difference === 0;
 }
+/** The id of the event a body holds, or `null` when it holds none. */
+function eventIdOf(body) {
+	try {
+		const value = JSON.parse(body);
+		const id = typeof value === "object" && value !== null ? Reflect.get(value, "id") : null;
+		return typeof id === "string" && id !== "" ? id : null;
+	} catch {
+		return null;
+	}
+}
 /**
 * Whether a request is a webhook of Hollware: its signature matches the body and the secret, and
-* its timestamp is within the tolerance, so a captured request cannot be replayed later.
+* its timestamp is within the tolerance, so a captured request cannot be replayed later; with
+* `isNew`, also that its event was not received before, so it cannot be replayed sooner either.
 */
 async function verifyWebhook(check) {
 	const signature = check.headers.get(SIGNATURE_HEADER);
@@ -4635,7 +4860,196 @@ async function verifyWebhook(check) {
 	if (signature === null || !Number.isInteger(timestamp)) return false;
 	const now = check.now ?? Math.floor(Date.now() / 1e3);
 	if (Math.abs(now - timestamp) > (check.toleranceSeconds ?? TOLERANCE_SECONDS)) return false;
-	return sameText(signature, await signWebhook(check.secret, timestamp, check.body));
+	if (!sameText(signature, await signWebhook(check.secret, timestamp, check.body))) return false;
+	if (check.isNew === void 0) return true;
+	const id = eventIdOf(check.body);
+	return id !== null && await check.isNew(id);
+}
+//#endregion
+//#region src/preview.ts
+/**
+* The preview token (T-103 of docs/security/threat-model.md): a signed, stateless proof that a person of a site may read the
+* latest revision of one entry, for one hour. A site that reads published content only (the
+* binding of RPC, the read API) reads that entry's head instead when it presents one.
+*
+*   hw_prv_<payload>.<signature>
+*
+* The payload is base64url of `{ "s": site, "e": entryId, "x": expiresAtSeconds }`, and the
+* signature the base64url HMAC-SHA256 of the payload text under a key that HKDF-SHA256 derives
+* from the Worker secret `HOLLWARE_SECRET`, bound to the site. Nothing is stored: a token cannot
+* be revoked, only wait out its hour, and rotating the secret ends every one.
+*/
+const PREVIEW_TOKEN_PREFIX = "hw_prv_";
+/** The query parameter a site's page takes the token from. */
+const PREVIEW_QUERY_PARAM = "hollware-preview";
+/** How long a token lasts, in seconds. */
+const PREVIEW_TTL_SECONDS = 3600;
+/** The least characters of `HOLLWARE_SECRET` that Hollware signs anything with. */
+const PREVIEW_SECRET_MIN_LENGTH = 32;
+/** Whether a Worker's secret can sign previews: present and long enough. */
+function canSignPreviews(secret) {
+	return secret !== void 0 && secret.length >= 32;
+}
+const encoder = new TextEncoder();
+function toBase64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function fromBase64Url(text) {
+	if (!/^[A-Za-z0-9_-]*$/.test(text)) return null;
+	try {
+		const binary = atob(text.replaceAll("-", "+").replaceAll("_", "/"));
+		return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+	} catch {
+		return null;
+	}
+}
+async function previewKey(secret, site) {
+	const base = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: /* @__PURE__ */ new Uint8Array(0),
+		info: encoder.encode(`hollware preview\n${site}`)
+	}, base, {
+		name: "HMAC",
+		hash: "SHA-256",
+		length: 256
+	}, false, ["sign", "verify"]);
+}
+/** A token for one entry of one site, valid for `PREVIEW_TTL_SECONDS` from `now`. */
+async function makePreviewToken(input) {
+	if (!canSignPreviews(input.secret)) throw new Error(`HOLLWARE_SECRET must be at least 32 characters.`);
+	const expires = Math.floor(input.now.getTime() / 1e3) + PREVIEW_TTL_SECONDS;
+	const payload = toBase64Url(encoder.encode(JSON.stringify({
+		s: input.site,
+		e: input.entryId,
+		x: expires
+	})));
+	const mac = await crypto.subtle.sign("HMAC", await previewKey(input.secret, input.site), encoder.encode(payload));
+	return {
+		token: `${PREVIEW_TOKEN_PREFIX}${payload}.${toBase64Url(new Uint8Array(mac))}`,
+		expiresAt: (/* @__PURE__ */ new Date(expires * 1e3)).toISOString()
+	};
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Checks a token for a site. The signature is verified (in constant time, by `crypto.subtle`)
+* before the payload is parsed, under the key of the site that is asked: a token made for another
+* site fails there. The entry the token names is the caller's to compare with the entry it read.
+*/
+async function verifyPreviewToken(input) {
+	if (!canSignPreviews(input.secret)) return {
+		ok: false,
+		reason: "no_secret"
+	};
+	const { token } = input;
+	if (!token.startsWith("hw_prv_")) return {
+		ok: false,
+		reason: "malformed"
+	};
+	const parts = token.slice(7).split(".");
+	const [payload, signature] = parts;
+	if (parts.length !== 2 || payload === void 0 || signature === void 0) return {
+		ok: false,
+		reason: "malformed"
+	};
+	const mac = fromBase64Url(signature);
+	const body = fromBase64Url(payload);
+	if (mac === null || body === null) return {
+		ok: false,
+		reason: "malformed"
+	};
+	if (!await crypto.subtle.verify("HMAC", await previewKey(input.secret, input.site), mac, encoder.encode(payload))) return {
+		ok: false,
+		reason: "signature"
+	};
+	let claims;
+	try {
+		claims = JSON.parse(new TextDecoder().decode(body));
+	} catch {
+		return {
+			ok: false,
+			reason: "malformed"
+		};
+	}
+	if (!isRecord(claims) || typeof claims["s"] !== "string" || typeof claims["e"] !== "string" || typeof claims["x"] !== "number") return {
+		ok: false,
+		reason: "malformed"
+	};
+	if (claims["s"] !== input.site) return {
+		ok: false,
+		reason: "site"
+	};
+	if (Math.floor(input.now.getTime() / 1e3) >= claims["x"]) return {
+		ok: false,
+		reason: "expired"
+	};
+	return {
+		ok: true,
+		entryId: claims["e"],
+		expiresAt: (/* @__PURE__ */ new Date(claims["x"] * 1e3)).toISOString()
+	};
+}
+//#endregion
+//#region src/events.ts
+/**
+* What Hollware sends to a site's webhooks (ADR-025), signed as `signWebhook` signs it: an event
+* about an entry that was published or unpublished, or about a change of the site's structure
+* (ADR-033). Every event carries the cache tags it invalidates (`@hollware/core`'s cache tags), so
+* a site that caches its pages purges them with no lookup. A receiver checks the signature with
+* `verifyWebhook`, then reads the body with `parseHollwareEvent`. Fields may be added in a minor
+* version, and kinds too: a receiver ignores a kind it does not know.
+*/
+const base = {
+	/** The id of the event: the same on every retry of its delivery. */
+	id: z.string(),
+	/** The key of the site. */
+	site: z.string(),
+	/** When the change was written, in ISO 8601. */
+	at: z.string(),
+	/** The cache tags the change invalidates. */
+	cacheTags: z.array(z.string())
+};
+/** A publish or an unpublish: the entry, and where it lives on the site. */
+const entryEvent = z.object({
+	...base,
+	kind: z.enum(["entry.published", "entry.unpublished"]),
+	entry: z.object({
+		id: z.string(),
+		collection: z.string(),
+		locale: z.string(),
+		slug: z.string(),
+		translationGroup: z.string().nullable()
+	}),
+	/** The path of the entry on the site, from the route of its collection and locale. */
+	path: z.string().nullable(),
+	/** The URL of the entry, when the site has a `url`. */
+	url: z.string().nullable()
+});
+/** A change of the site's structure: no entry, the tags to purge. */
+const siteEvent = z.object({
+	...base,
+	kind: z.literal("site.changed")
+});
+/** Every event a webhook gets. */
+const hollwareEvent = z.discriminatedUnion("kind", [entryEvent, siteEvent]);
+/**
+* The event of a webhook's body, once its signature holds, or `null` for a body that is not one
+* of the events this version knows (a newer kind, say): a receiver skips it.
+*/
+function parseHollwareEvent(body) {
+	let json;
+	try {
+		json = JSON.parse(body);
+	} catch {
+		return null;
+	}
+	const parsed = hollwareEvent.safeParse(json);
+	return parsed.success ? parsed.data : null;
 }
 //#endregion
 //#region src/cache.ts
@@ -4688,8 +5102,19 @@ function tagsOfChange(entry) {
 		...entry.translationGroup === null ? [] : [groupTag(entry.collection, entry.translationGroup)]
 	];
 }
+/**
+* The tags a change of a site's structure invalidates (ADR-033): the pages that show the structure
+* (`site`, such as a navigation), and every list of its collections in each locale and in every
+* locale, as a list may change with a schema, a route or a collection that goes. `collections` and
+* `locales` are those of the definition before and after the change, together.
+*/
+function tagsOfSiteChange(collections, locales) {
+	const tags = /* @__PURE__ */ new Set([SITE_TAG]);
+	for (const collection of collections) for (const locale of [...locales, "*"]) tags.add(listTag(collection, locale));
+	return [...tags];
+}
 //#endregion
 //#region src/index.ts
 const name = "@hollware/core";
 //#endregion
-export { BUILT_IN_CONTRACT_IDS, CATALOG, CHUNKER_VERSION, CHUNK_LIMITS, COMARK_VERSION, ConfigError, DEFAULT_MAX_MARKDOWN_BYTES, ERROR_CODES, EVENT_ID_HEADER, EVERY_LOCALE, HollwareError, ID_PREFIXES, MAX_MARKDOWN_BYTES_CEILING, OPERATIONS, PERSONAL_TOKEN_PREFIX, PERSONAL_TOKEN_TTL_DAYS, PIPELINE_VERSION, PRESETS, READ_TOKEN_PREFIX, REFUSAL_CONTRACT_IDS, SCOPES, SIGNATURE_HEADER, SITE_KEY_MAX_LENGTH, SITE_KEY_PATTERN, SITE_TAG, TIMESTAMP_HEADER, approveReview, canonicalJson, catalogRule, chunksOf, collectionDefinitionData, collectionPreset, commentReview, compileSites, componentDefinitionData, contentStats, contracts, createDraft, defineCollection, defineComponent, defineConfig, defineContract, defineOperation, definitionsFromConfig, describeBuiltInContracts, describeCatalog, describeContract, describeResolvedSite, describeSite, describedSchemaOf, entryTag, generatePersonalToken, generateReadToken, getEntry, getTranslations, groupTag, hashPersonalToken, isBuiltInContract, isId, isPersonalToken, isReadToken, isScope, isSiteKey, listEntries, listReviews, listTag, name, newId, processMarkdown, publish, renderHtml, requestChanges, requestReview, resolveConfig, routesFor, ruleDefinition, runContracts, schemas_exports as schemas, search, signWebhook, siteDefinitionData, sitePreset, sizeLimitViolation, tagsOfChange, tagsOfEntries, ulid, uniqueSlugViolation, uniqueTranslationViolation, unpublish, updateDraft, validate, verifyWebhook, webhookDefinition };
+export { AUDIT_ACTIONS, AUDIT_ACTOR_KINDS, AUDIT_OUTCOMES, AUDIT_RETENTION_MAX_DAYS, AUDIT_RETENTION_MIN_DAYS, BUILT_IN_CONTRACT_IDS, CATALOG, CHUNKER_VERSION, CHUNK_LIMITS, COMARK_VERSION, ConfigError, DEFAULT_AUDIT, DEFAULT_MAX_MARKDOWN_BYTES, ERROR_CODES, EVENT_ID_HEADER, EVERY_LOCALE, HollwareError, IDENTITY_AUDIT_ACTIONS, ID_PREFIXES, INDEXNOW_KEY, MAX_MARKDOWN_BYTES_CEILING, OPERATIONS, OPERATION_AUDIT_ACTIONS, PERSONAL_TOKEN_PREFIX, PERSONAL_TOKEN_TTL_DAYS, PIPELINE_VERSION, PRESETS, PREVIEW_QUERY_PARAM, PREVIEW_SECRET_MIN_LENGTH, PREVIEW_TOKEN_PREFIX, PREVIEW_TTL_SECONDS, READ_TOKEN_PREFIX, REFUSAL_CONTRACT_IDS, SCOPES, SIGNATURE_HEADER, SITE_KEY_MAX_LENGTH, SITE_KEY_PATTERN, SITE_TAG, TIMESTAMP_HEADER, approveReview, canSignPreviews, canonicalJson, catalogRule, chunksOf, collectionDefinitionData, collectionPreset, commentReview, compileSites, componentDefinitionData, contentStats, contracts, createDraft, defineCollection, defineComponent, defineConfig, defineContract, defineOperation, definitionsFromConfig, deleteEntry, describeBuiltInContracts, describeCatalog, describeContract, describeResolvedSite, describeSite, describedSchemaOf, entryEvent, entryTag, generatePersonalToken, generateReadToken, getEntry, getTranslations, groupTag, hashPersonalToken, hollwareEvent, isAuditAction, isBuiltInContract, isId, isPersonalToken, isReadToken, isScope, isSiteKey, listEntries, listReviews, listTag, makePreviewToken, name, newId, parseHollwareEvent, processMarkdown, publish, renderHtml, requestChanges, requestReview, resolveConfig, restoreEntry, routesFor, ruleDefinition, runContracts, schemas_exports as schemas, search, signWebhook, siteDefinitionData, siteEvent, sitePreset, sizeLimitViolation, tagsOfChange, tagsOfEntries, tagsOfSiteChange, ulid, uniqueSlugViolation, uniqueTranslationViolation, unpublish, updateDraft, validate, verifyPreviewToken, verifyWebhook, webhookDefinition };