@hollware/server 0.1.0 → 0.2.0

package/dist/index.mjs

@@ -1,13 +1,13 @@
-import { HollwareError, OPERATIONS, describeBuiltInContracts, describeResolvedSite, describeSite, getEntry, getTranslations, hashPersonalToken, isPersonalToken, isScope, listEntries, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, sizeLimitViolation, uniqueSlugViolation, uniqueTranslationViolation } from "@hollware/core";
+import { EVENT_ID_HEADER, HollwareError, OPERATIONS, SIGNATURE_HEADER, TIMESTAMP_HEADER, describeBuiltInContracts, describeResolvedSite, describeSite, getEntry, getTranslations, hashPersonalToken, isPersonalToken, isScope, listEntries, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, signWebhook, sizeLimitViolation, uniqueSlugViolation, uniqueTranslationViolation } from "@hollware/core";
 import { Hono } from "hono";
 import { drizzle } from "drizzle-orm/d1";
-import { and, desc, eq, getTableColumns, ne, or, sql } from "drizzle-orm";
+import { and, desc, eq, getTableColumns, inArray, isNull, lte, ne, or, sql } from "drizzle-orm";
 import { alias, check, foreignKey, index, integer, sqliteTable, text, unique } from "drizzle-orm/sqlite-core";
 import { CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, McpServer, acceptedContent, createMcpHandler, inputRequired, inputResponse } from "@modelcontextprotocol/server";
 import * as z from "zod";
 import { WorkerEntrypoint } from "cloudflare:workers";
 //#region package.json
-var version = "0.1.0";
+var version = "0.2.0";
 //#endregion
 //#region src/auth/bearer.ts
 /**
@@ -65,6 +65,17 @@ function unauthorized(reason) {
 		fix: "Tokens expire and can be revoked. Create a new one with `hollware token create` and send it as \"Authorization: Bearer <token>\"."
 	}, `${REALM}, error="invalid_token"`);
 }
+/**
+* 403 for a token that authenticated but lacks scopes. It names every scope that is missing, in
+* the body and in the challenge (RFC 6750), so that a client asks for all of them at once.
+*/
+function insufficientScope(missing) {
+	return authErrorResponse(403, {
+		code: "insufficient_scope",
+		message: `The token lacks a scope this operation requires. Missing: ${missing.join(", ")}.`,
+		fix: "Send a token that carries every missing scope. Create one with `hollware token create`; a token only gets the scopes its user's role allows."
+	}, `${REALM}, error="insufficient_scope", scope="${missing.join(" ")}"`);
+}
 //#endregion
 //#region src/auth/guard.ts
 /**
@@ -628,6 +639,104 @@ const publications = sqliteTable("publications", {
 	check("publications_actor_kind", sql`${t.actorKind} IN ('token', 'user', 'oauth_client')`),
 	check("publications_json", sql`json_valid(${t.acknowledged}) AND json_type(${t.acknowledged}) = 'array' AND (${t.verdict} IS NULL OR json_valid(${t.verdict})) AND (${t.actorMeta} IS NULL OR json_valid(${t.actorMeta}))`)
 ]);
+/**
+* Scheduled publications (ADR-025): one per entry at most. The cron trigger publishes the entry when
+* `scheduled_at` has passed, if it is still at `version`, with the warnings that were acknowledged
+* when it was scheduled, and in the name of who scheduled it.
+*/
+const schedules = sqliteTable("schedules", {
+	id: id("sch"),
+	siteId: siteId(),
+	entryId: text("entry_id").notNull(),
+	scheduledAt: text("scheduled_at").notNull(),
+	/** The version of the entry once scheduled: a later change cancels the schedule. */
+	version: integer("version").notNull(),
+	/** A JSON array: the warnings acknowledged when the publication was scheduled. */
+	acknowledged: text("acknowledged").notNull(),
+	actorKind: text("actor_kind").notNull(),
+	actorUserId: text("actor_user_id").notNull(),
+	actorTokenId: text("actor_token_id"),
+	actorMeta: text("actor_meta"),
+	...timestamps()
+}, (t) => [
+	unique("schedules_id_site").on(t.id, t.siteId),
+	unique("schedules_entry").on(t.siteId, t.entryId),
+	index("schedules_due").on(t.scheduledAt),
+	foreignKey({
+		name: "schedules_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	foreignKey({
+		name: "schedules_entry_fk",
+		columns: [t.entryId, t.siteId],
+		foreignColumns: [entries.id, entries.siteId]
+	}),
+	foreignKey({
+		name: "schedules_user",
+		columns: [t.actorUserId],
+		foreignColumns: [users.id]
+	}),
+	foreignKey({
+		name: "schedules_token",
+		columns: [t.actorTokenId, t.siteId],
+		foreignColumns: [tokens.id, tokens.siteId]
+	}),
+	check("schedules_actor_kind", sql`${t.actorKind} IN ('token', 'user', 'oauth_client')`),
+	check("schedules_json", sql`json_valid(${t.acknowledged}) AND json_type(${t.acknowledged}) = 'array' AND (${t.actorMeta} IS NULL OR json_valid(${t.actorMeta}))`)
+]);
+/**
+* The effects of a publication (ADR-025), written in the batch that publishes or unpublishes: one
+* row per event. The Queue consumer delivers each event to every subscriber, and records it in
+* `deliveries`; `sent_at` says that the event was put on the Queue.
+*/
+const outbox = sqliteTable("outbox", {
+	id: id("evt"),
+	siteId: siteId(),
+	/** `entry.published` or `entry.unpublished`. */
+	kind: text("kind").notNull(),
+	entryId: text("entry_id").notNull(),
+	/** A JSON object: what subscribers get. */
+	payload: text("payload").notNull(),
+	sentAt: text("sent_at"),
+	...timestamps()
+}, (t) => [
+	unique("outbox_id_site").on(t.id, t.siteId),
+	index("outbox_unsent").on(t.sentAt, t.createdAt),
+	foreignKey({
+		name: "outbox_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	check("outbox_kind", sql`${t.kind} IN ('entry.published', 'entry.unpublished')`),
+	check("outbox_json", sql`json_valid(${t.payload}) AND json_type(${t.payload}) = 'object'`)
+]);
+/** Each delivery of an event to a subscriber, so that a retry never delivers it twice. */
+const deliveries = sqliteTable("deliveries", {
+	id: id("dlv"),
+	siteId: siteId(),
+	eventId: text("event_id").notNull(),
+	/** The subscriber, by its name in the config, such as `webhook:newsletter` or `indexnow`. */
+	subscriber: text("subscriber").notNull(),
+	attempts: integer("attempts").notNull(),
+	deliveredAt: text("delivered_at"),
+	lastError: text("last_error"),
+	...timestamps()
+}, (t) => [
+	unique("deliveries_id_site").on(t.id, t.siteId),
+	unique("deliveries_event_subscriber").on(t.eventId, t.subscriber),
+	foreignKey({
+		name: "deliveries_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	foreignKey({
+		name: "deliveries_event",
+		columns: [t.eventId, t.siteId],
+		foreignColumns: [outbox.id, outbox.siteId]
+	}),
+	check("deliveries_attempts", sql`${t.attempts} >= 0`)
+]);
 //#endregion
 //#region src/db/rows.ts
 /**
@@ -985,50 +1094,6 @@ function lookup(db, site) {
 	};
 }
 //#endregion
-//#region src/db/errors.ts
-/**
-* What D1 says when a statement breaks a unique key: `D1_ERROR: UNIQUE constraint failed:
-* entries.site_id, …: SQLITE_CONSTRAINT`, with the same text again in the `cause`. Inside a batch
-* the error arrives as it is, and the batch has rolled back.
-*/
-function isUniqueViolation(error) {
-	let current = error;
-	for (let depth = 0; depth < 4 && current instanceof Error; depth += 1) {
-		if (current.message.includes("UNIQUE constraint failed")) return true;
-		current = current.cause;
-	}
-	return false;
-}
-//#endregion
-//#region src/db/size.ts
-/**
-* D1 refuses rows over 2 MB, and Miniflare does not enforce it, so the store counts the bytes of
-* a row before writing it and refuses a row over `MAX_ROW_BYTES` (`limits.ts`).
-*/
-const encoder$1 = new TextEncoder();
-/** The bytes of `text` in UTF-8, which is how D1 stores it. */
-function utf8Bytes(text) {
-	return encoder$1.encode(text).byteLength;
-}
-/** What SQLite keeps for an integer, at most. */
-const INTEGER_BYTES = 8;
-/** The bytes of every column of a row: text in UTF-8, an integer as 8 bytes, a null as none. */
-function rowBytes(row) {
-	let bytes = 0;
-	for (const value of Object.values(row)) if (typeof value === "string") bytes += utf8Bytes(value);
-	else if (value !== null) bytes += INTEGER_BYTES;
-	return bytes;
-}
-/** The refusal for a row over the limit, or `null` when it fits. */
-function tooLarge(row) {
-	const bytes = rowBytes(row);
-	return bytes > 19e5 ? {
-		outcome: "too_large",
-		bytes,
-		limit: MAX_ROW_BYTES
-	} : null;
-}
-//#endregion
 //#region src/db/statements.ts
 function actorColumns(actor) {
 	return {
@@ -1122,6 +1187,133 @@ function insertUnpublishIfPublished(db, row) {
 	return db.insert(publications).select(sql`select ${valuesOf(publications, row)} from ${entries} where ${and(eq(entries.id, row.entryId), eq(entries.siteId, row.siteId), eq(entries.status, "published"))}`);
 }
 //#endregion
+//#region src/db/schedules.ts
+/**
+* Scheduled publications (ADR-025). An entry waits in status `scheduled` with its `scheduled_at`,
+* and its row of `schedules` says what was acknowledged and by whom, for the cron trigger that
+* publishes it once the time has passed.
+*/
+/** Statements that drop the schedule of an entry, in the batch of a write that ends it. */
+function dropSchedule(db, site, entryId) {
+	return db.delete(schedules).where(and(eq(schedules.siteId, site), eq(schedules.entryId, entryId)));
+}
+async function schedule(db, clock, site, write) {
+	const now = clock.now().toISOString();
+	const row = {
+		id: newId("sch"),
+		siteId: site,
+		entryId: write.entryId,
+		scheduledAt: write.scheduledAt,
+		version: write.expectedVersion + 1,
+		acknowledged: JSON.stringify(write.acknowledged),
+		...actorColumns(write.actor),
+		createdAt: now,
+		updatedAt: now
+	};
+	const atVersion = and(eq(entries.id, write.entryId), eq(entries.siteId, site), eq(entries.version, write.expectedVersion), sql`${entries.status} <> 'published'`);
+	const results = await db.batch([
+		db.delete(schedules).where(and(eq(schedules.siteId, site), eq(schedules.entryId, write.entryId), sql`exists (select 1 from ${entries} where ${atVersion})`)),
+		db.insert(schedules).select(sql`select ${valuesOf(schedules, row)} from ${entries} where ${atVersion}`),
+		db.update(entries).set({
+			status: "scheduled",
+			scheduledAt: write.scheduledAt,
+			version: sql`${entries.version} + 1`,
+			updatedAt: now
+		}).where(atVersion).returning({ id: entries.id })
+	]);
+	const view = await findEntryById(db, site, write.entryId, "head");
+	if (view === null) return { outcome: "not_found" };
+	if (results[2].length === 0) return {
+		outcome: "conflict",
+		currentVersion: view.entry.version,
+		headRevision: view.entry.headRevision
+	};
+	return {
+		outcome: "scheduled",
+		view
+	};
+}
+/** The schedules of a site whose time has come, oldest first. */
+async function dueSchedules(db, site, now) {
+	return (await db.select().from(schedules).where(and(eq(schedules.siteId, site), lte(schedules.scheduledAt, now))).orderBy(schedules.scheduledAt).limit(50)).map((row) => ({
+		entryId: row.entryId,
+		scheduledAt: row.scheduledAt,
+		version: row.version,
+		acknowledged: parseAcknowledged(row.acknowledged),
+		actor: {
+			kind: "token",
+			userId: row.actorUserId,
+			tokenId: row.actorTokenId,
+			meta: row.actorMeta === null ? null : parseMeta(row.actorMeta)
+		}
+	}));
+}
+/** Takes an entry out of `scheduled`, back to a draft, and drops its schedule. */
+async function cancelSchedule(db, clock, site, entryId) {
+	await db.batch([dropSchedule(db, site, entryId), db.update(entries).set({
+		status: "draft",
+		scheduledAt: null,
+		version: sql`${entries.version} + 1`,
+		updatedAt: clock.now().toISOString()
+	}).where(and(eq(entries.id, entryId), eq(entries.siteId, site), eq(entries.status, "scheduled")))]);
+}
+function parseAcknowledged(text) {
+	const value = JSON.parse(text);
+	if (!Array.isArray(value)) return [];
+	return value.flatMap((item) => typeof item === "object" && item !== null && "contract" in item && "path" in item && typeof item.contract === "string" && typeof item.path === "string" ? [{
+		contract: item.contract,
+		path: item.path
+	}] : []);
+}
+function parseMeta(text) {
+	const value = JSON.parse(text);
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : null;
+}
+//#endregion
+//#region src/db/errors.ts
+/**
+* What D1 says when a statement breaks a unique key: `D1_ERROR: UNIQUE constraint failed:
+* entries.site_id, …: SQLITE_CONSTRAINT`, with the same text again in the `cause`. Inside a batch
+* the error arrives as it is, and the batch has rolled back.
+*/
+function isUniqueViolation(error) {
+	let current = error;
+	for (let depth = 0; depth < 4 && current instanceof Error; depth += 1) {
+		if (current.message.includes("UNIQUE constraint failed")) return true;
+		current = current.cause;
+	}
+	return false;
+}
+//#endregion
+//#region src/db/size.ts
+/**
+* D1 refuses rows over 2 MB, and Miniflare does not enforce it, so the store counts the bytes of
+* a row before writing it and refuses a row over `MAX_ROW_BYTES` (`limits.ts`).
+*/
+const encoder$1 = new TextEncoder();
+/** The bytes of `text` in UTF-8, which is how D1 stores it. */
+function utf8Bytes(text) {
+	return encoder$1.encode(text).byteLength;
+}
+/** What SQLite keeps for an integer, at most. */
+const INTEGER_BYTES = 8;
+/** The bytes of every column of a row: text in UTF-8, an integer as 8 bytes, a null as none. */
+function rowBytes(row) {
+	let bytes = 0;
+	for (const value of Object.values(row)) if (typeof value === "string") bytes += utf8Bytes(value);
+	else if (value !== null) bytes += INTEGER_BYTES;
+	return bytes;
+}
+/** The refusal for a row over the limit, or `null` when it fits. */
+function tooLarge(row) {
+	const bytes = rowBytes(row);
+	return bytes > 19e5 ? {
+		outcome: "too_large",
+		bytes,
+		limit: MAX_ROW_BYTES
+	} : null;
+}
+//#endregion
 //#region src/db/writes.ts
 /**
 * Waits for a write batch. A batch that broke a unique key of `entries` has rolled back, and the
@@ -1325,14 +1517,20 @@ async function publish$2(db, clock, site, write) {
 	});
 	const refusal = tooLarge(row);
 	if (refusal !== null) return refusal;
-	const [changed] = (await db.batch([insertPublishAtVersion(db, row, write.expectedVersion), db.update(entries).set({
-		status: "published",
-		publishedRev: entries.headRev,
-		publishedAt: sql`coalesce(${entries.publishedAt}, ${now})`,
-		publishedSortKey: write.sortKey,
-		version: sql`${entries.version} + 1`,
-		updatedAt: now
-	}).where(and(eq(entries.id, write.entryId), eq(entries.siteId, site), eq(entries.version, write.expectedVersion))).returning(entryFields)]))[1];
+	const [changed] = (await db.batch([
+		insertPublishAtVersion(db, row, write.expectedVersion),
+		dropScheduleAtVersion(db, site, write.entryId, write.expectedVersion),
+		insertEventWhere(db, site, write.entryId, write.event ?? null, "entry.published", now, [eq(entries.version, write.expectedVersion)]),
+		db.update(entries).set({
+			status: "published",
+			scheduledAt: null,
+			publishedRev: entries.headRev,
+			publishedAt: sql`coalesce(${entries.publishedAt}, ${now})`,
+			publishedSortKey: write.sortKey,
+			version: sql`${entries.version} + 1`,
+			updatedAt: now
+		}).where(and(eq(entries.id, write.entryId), eq(entries.siteId, site), eq(entries.version, write.expectedVersion))).returning(entryFields)
+	]))[3];
 	if (changed === void 0) return whyNothingChanged(db, site, write.entryId);
 	const entry = toEntry(changed);
 	const revision = entry.publishedRevision === null ? null : await findRevision(db, site, entry.publishedRevision);
@@ -1345,6 +1543,72 @@ async function publish$2(db, clock, site, write) {
 		}
 	};
 }
+/** The message of the statement that aborts a group publish: SQLite fails to parse it as JSON. */
+const GROUP_MOVED = "hollware: an entry of the group is not at its version";
+/**
+* Publishes a group of entries in one batch, all or none (ADR-024). Each entry gets the two
+* statements of `publish`; a last statement fails the batch, which D1 then rolls back, when fewer
+* publications landed than the group has entries: `json()` of a text that is not JSON raises an
+* error, and it runs only then. A refusal names the entry.
+*/
+async function publishGroup$1(db, clock, site, group) {
+	const now = clock.now().toISOString();
+	const statements = [];
+	const appended = [];
+	for (const write of group) {
+		const row = publicationRow({
+			site,
+			entryId: write.entryId,
+			now,
+			actor: write.actor,
+			publish: {
+				revisionId: newId("rev"),
+				verdict: write.verdict,
+				acknowledged: write.acknowledged
+			}
+		});
+		const refusal = tooLarge(row);
+		if (refusal !== null) return {
+			...refusal,
+			entryId: write.entryId
+		};
+		appended.push(row.id);
+		statements.push(insertPublishAtVersion(db, row, write.expectedVersion), dropScheduleAtVersion(db, site, write.entryId, write.expectedVersion), insertEventWhere(db, site, write.entryId, write.event ?? null, "entry.published", now, [eq(entries.version, write.expectedVersion)]), db.update(entries).set({
+			status: "published",
+			scheduledAt: null,
+			publishedRev: entries.headRev,
+			publishedAt: sql`coalesce(${entries.publishedAt}, ${now})`,
+			publishedSortKey: write.sortKey,
+			version: sql`${entries.version} + 1`,
+			updatedAt: now
+		}).where(and(eq(entries.id, write.entryId), eq(entries.siteId, site), eq(entries.version, write.expectedVersion))));
+	}
+	const guard = db.select({ moved: sql`json(${GROUP_MOVED})` }).from(sites).where(and(eq(sites.id, site), sql`(select count(*) from ${publications} where ${and(eq(publications.siteId, site), inArray(publications.id, appended))}) < ${group.length}`));
+	try {
+		const [first, ...rest] = [...statements, guard];
+		if (first !== void 0) await db.batch([first, ...rest]);
+	} catch (error) {
+		if (!(error instanceof Error) || !/malformed JSON/i.test(`${error.message} ${String(error.cause)}`)) throw error;
+		for (const write of group) {
+			const why = await whyNothingChanged(db, site, write.entryId);
+			if (why.outcome === "not_found" || why.currentVersion !== write.expectedVersion) return {
+				...why,
+				entryId: write.entryId
+			};
+		}
+		throw new Error("A group publish failed, and every entry of the group is at its version", { cause: error });
+	}
+	const views = [];
+	for (const write of group) {
+		const view = await findEntryById(db, site, write.entryId, "published");
+		if (view === null) throw new Error(`Entry ${write.entryId} is not published after its group`);
+		views.push(view);
+	}
+	return {
+		outcome: "published",
+		views
+	};
+}
 async function unpublish$1(db, clock, site, write) {
 	const now = clock.now().toISOString();
 	const row = publicationRow({
@@ -1356,19 +1620,47 @@ async function unpublish$1(db, clock, site, write) {
 	});
 	const refusal = tooLarge(row);
 	if (refusal !== null) return refusal;
-	await db.batch([insertUnpublishIfPublished(db, row), db.update(entries).set({
-		status: "draft",
-		publishedRev: null,
-		publishedSortKey: null,
-		version: sql`${entries.version} + 1`,
-		updatedAt: now
-	}).where(and(eq(entries.id, write.entryId), eq(entries.siteId, site), eq(entries.status, "published")))]);
+	await db.batch([
+		insertUnpublishIfPublished(db, row),
+		insertEventWhere(db, site, write.entryId, write.event ?? null, "entry.unpublished", now, [eq(entries.status, "published")]),
+		dropSchedule(db, site, write.entryId),
+		db.update(entries).set({
+			status: "draft",
+			scheduledAt: null,
+			publishedRev: null,
+			publishedSortKey: null,
+			version: sql`${entries.version} + 1`,
+			updatedAt: now
+		}).where(and(eq(entries.id, write.entryId), eq(entries.siteId, site), inArray(entries.status, ["published", "scheduled"])))
+	]);
 	const view = await findEntryById(db, site, write.entryId, "head");
 	return view === null ? { outcome: "not_found" } : {
 		outcome: "unpublished",
 		view
 	};
 }
+/** Drops the schedule of an entry in the batch that publishes it, if it is at `version`. */
+function dropScheduleAtVersion(db, site, entryId, version) {
+	return db.delete(schedules).where(and(eq(schedules.siteId, site), eq(schedules.entryId, entryId), sql`exists (select 1 from ${entries} where ${and(eq(entries.id, entryId), eq(entries.siteId, site), eq(entries.version, version))})`));
+}
+/**
+* Writes the event of a write to the outbox in its batch, only where the entry is in the state the
+* write expects, so that an event is there exactly when its write is. Nothing when there is no
+* event: a statement that selects nothing, to keep the batch the same shape.
+*/
+function insertEventWhere(db, site, entryId, event, kind, now, conditions) {
+	const row = {
+		id: event?.id ?? "evt_none",
+		siteId: site,
+		kind,
+		entryId,
+		payload: event?.payload ?? "{}",
+		sentAt: null,
+		createdAt: now,
+		updatedAt: now
+	};
+	return db.insert(outbox).select(sql`select ${valuesOf(outbox, row)} from ${entries} where ${and(eq(entries.id, entryId), eq(entries.siteId, site), sql`${event === null ? 0 : 1} = 1`, ...conditions)}`);
+}
 //#endregion
 //#region src/db/store.ts
 const systemClock$1 = { now: () => /* @__PURE__ */ new Date() };
@@ -1390,10 +1682,216 @@ function createD1Store(db, options = {}) {
 		createEntry: (site, entry) => createEntry(database, clock, site, entry),
 		appendRevision: (site, write) => appendRevision(database, clock, site, write),
 		publish: (site, write) => publish$2(database, clock, site, write),
+		publishGroup: (site, group) => publishGroup$1(database, clock, site, group),
+		schedule: (site, write) => schedule(database, clock, site, write),
+		dueSchedules: (site, now) => dueSchedules(database, site, now),
+		cancelSchedule: (site, entryId) => cancelSchedule(database, clock, site, entryId),
 		unpublish: (site, write) => unpublish$1(database, clock, site, write)
 	};
 }
 //#endregion
+//#region src/db/events.ts
+async function findEvent(db, site, id) {
+	const [row] = await db.select({
+		id: outbox.id,
+		kind: outbox.kind,
+		payload: outbox.payload
+	}).from(outbox).where(and(eq(outbox.siteId, site), eq(outbox.id, id))).limit(1);
+	return row ?? null;
+}
+/** The events that were never put on the Queue and are older than `before`, oldest first. */
+async function unsentEvents(db, site, before, limit = 100) {
+	return (await db.select({ id: outbox.id }).from(outbox).where(and(eq(outbox.siteId, site), isNull(outbox.sentAt), lte(outbox.createdAt, before))).orderBy(outbox.createdAt).limit(limit)).map((row) => row.id);
+}
+async function markSent(db, site, ids, now) {
+	if (ids.length === 0) return;
+	await db.update(outbox).set({
+		sentAt: now,
+		updatedAt: now
+	}).where(and(eq(outbox.siteId, site), inArray(outbox.id, [...ids])));
+}
+/** The subscribers that already have an event, so that a retry never delivers it twice. */
+async function deliveredTo(db, site, eventId) {
+	const rows = await db.select({
+		subscriber: deliveries.subscriber,
+		deliveredAt: deliveries.deliveredAt
+	}).from(deliveries).where(and(eq(deliveries.siteId, site), eq(deliveries.eventId, eventId)));
+	return new Set(rows.filter((row) => row.deliveredAt !== null).map((row) => row.subscriber));
+}
+/** Records one attempt to deliver an event to a subscriber, and its result. */
+async function recordAttempt(db, input) {
+	const deliveredAt = input.error === null ? input.now : null;
+	await db.insert(deliveries).values({
+		id: newId("dlv"),
+		siteId: input.site,
+		eventId: input.eventId,
+		subscriber: input.subscriber,
+		attempts: 1,
+		deliveredAt,
+		lastError: input.error,
+		createdAt: input.now,
+		updatedAt: input.now
+	}).onConflictDoUpdate({
+		target: [deliveries.eventId, deliveries.subscriber],
+		set: {
+			attempts: sqlIncrement(),
+			deliveredAt,
+			lastError: input.error,
+			updatedAt: input.now
+		}
+	});
+}
+function sqlIncrement() {
+	return sql`${deliveries.attempts} + 1`;
+}
+//#endregion
+//#region src/events/deliver.ts
+/** Where IndexNow takes the URLs that changed. */
+const INDEXNOW_ENDPOINT = "https://api.indexnow.org/indexnow";
+async function ensureOk(response, what) {
+	if (response.ok) return;
+	throw new Error(`${what} answered ${response.status}`);
+}
+/** The subscribers that the config of the site declares (ADR-025). */
+function subscribersOf(deps) {
+	const { site } = deps;
+	const subscribers = site.events.webhooks.map((webhook) => ({
+		name: `webhook:${webhook.name}`,
+		async send(payload, body) {
+			const secret = deps.secret(webhook.secret);
+			if (secret === void 0) throw new Error(`the secret ${webhook.secret} is not set`);
+			const timestamp = Math.floor(deps.clock.now().getTime() / 1e3);
+			const request = new Request(webhook.url, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					[EVENT_ID_HEADER]: payload.id,
+					[TIMESTAMP_HEADER]: String(timestamp),
+					[SIGNATURE_HEADER]: await signWebhook(secret, timestamp, body)
+				},
+				body
+			});
+			await ensureOk(await deps.fetch(request), `the webhook ${webhook.name}`);
+		}
+	}));
+	const indexNow = site.events.indexNow;
+	if (indexNow !== null && site.url !== null) {
+		const host = new URL(site.url).host;
+		subscribers.push({
+			name: "indexnow",
+			async send(payload) {
+				if (payload.url === null) return;
+				const key = deps.secret(indexNow.key);
+				if (key === void 0) throw new Error(`the secret ${indexNow.key} is not set`);
+				const request = new Request(INDEXNOW_ENDPOINT, {
+					method: "POST",
+					headers: { "content-type": "application/json; charset=utf-8" },
+					body: JSON.stringify({
+						host,
+						key,
+						urlList: [payload.url]
+					})
+				});
+				await ensureOk(await deps.fetch(request), "IndexNow");
+			}
+		});
+	}
+	return subscribers;
+}
+/**
+* Delivers one event of the outbox to every subscriber that does not have it yet, and records each
+* attempt. A subscriber that fails is tried again on the next delivery of the event, and one that
+* succeeded is never sent it again: the caller retries the message while `failed` is not empty.
+* An event that is gone, or a site without subscribers, delivers nothing.
+*/
+async function deliverEvent(deps, eventId) {
+	const event = await findEvent(deps.db, deps.site.key, eventId);
+	if (event === null) return {
+		delivered: [],
+		failed: []
+	};
+	const payload = JSON.parse(event.payload);
+	const done = await deliveredTo(deps.db, deps.site.key, eventId);
+	const delivered = [];
+	const failed = [];
+	for (const subscriber of subscribersOf(deps)) {
+		if (done.has(subscriber.name)) continue;
+		let error = null;
+		try {
+			await subscriber.send(payload, event.payload);
+		} catch (cause) {
+			error = cause instanceof Error ? cause.message : String(cause);
+		}
+		await recordAttempt(deps.db, {
+			site: deps.site.key,
+			eventId,
+			subscriber: subscriber.name,
+			now: deps.clock.now().toISOString(),
+			error
+		});
+		(error === null ? delivered : failed).push(subscriber.name);
+	}
+	return {
+		delivered,
+		failed
+	};
+}
+//#endregion
+//#region src/events/run.ts
+/**
+* Puts events on the Queue and marks them sent. Without a Queue binding nothing is sent: the
+* sweep of the cron trigger delivers them instead, within a minute.
+*/
+async function enqueue(input) {
+	if (input.queue === void 0 || input.ids.length === 0) return;
+	await input.queue.sendBatch(input.ids.map((id) => ({ body: {
+		site: input.site,
+		id
+	} })));
+	await markSent(input.db, input.site, input.ids, input.clock.now().toISOString());
+}
+/**
+* What the cron trigger does with the outbox: an event that was never put on the Queue (its
+* request ended before, or the project has no Queue) is put on it, or, without a Queue, delivered
+* here. An event delivered here is marked sent only when every subscriber has it.
+*/
+async function sweepOutbox(input) {
+	const { deps, queue } = input;
+	const now = deps.clock.now().toISOString();
+	const ids = await unsentEvents(deps.db, deps.site.key, now);
+	if (queue !== void 0) {
+		await enqueue({
+			queue,
+			db: deps.db,
+			site: deps.site.key,
+			ids,
+			clock: deps.clock
+		});
+		return { swept: ids.length };
+	}
+	for (const id of ids) if ((await deliverEvent(deps, id)).failed.length === 0) await markSent(deps.db, deps.site.key, [id], now);
+	return { swept: ids.length };
+}
+function isEventMessage(body) {
+	return typeof body === "object" && body !== null && "site" in body && "id" in body && typeof body.site === "string" && typeof body.id === "string";
+}
+/**
+* The Queue consumer: delivers each event, acknowledges it once every subscriber has it, and asks
+* for a retry otherwise; after the Queue's retries it lands in the dead-letter queue. A message of
+* another site, or that is no event, is acknowledged and dropped.
+*/
+async function consumeEvents(messages, deps) {
+	for (const message of messages) {
+		const { body } = message;
+		if (!isEventMessage(body) || body.site !== deps.site.key) {
+			message.ack();
+			continue;
+		}
+		if ((await deliverEvent(deps, body.id)).failed.length === 0) message.ack();
+		else message.retry();
+	}
+}
+//#endregion
 //#region src/mcp/errors.ts
 /**
 * The error a caller gets for anything that is not a `HollwareError`. The message is fixed: what
@@ -1485,6 +1983,179 @@ function installErrorHandling(app, log) {
 	}));
 }
 //#endregion
+//#region src/http/read-api.ts
+const STATUS = {
+	invalid_input: 400,
+	unknown_collection: 404,
+	unknown_locale: 404
+};
+/** A weak ETag of a body: the first 128 bits of its SHA-256, in hex. */
+async function etagOf(body) {
+	const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(body)));
+	return `W/"${Array.from(digest.slice(0, 16), (byte) => byte.toString(16).padStart(2, "0")).join("")}"`;
+}
+/** Whether `If-None-Match` names this ETag, or is `*`. */
+function matches(header, etag) {
+	if (header === void 0) return false;
+	return header.split(",").map((tag) => tag.trim()).some((tag) => tag === "*" || tag === etag || `W/${tag}` === etag);
+}
+async function answer(c, value) {
+	const notFound = typeof value === "object" && value !== null && "outcome" in value && value.outcome === "not_found";
+	const body = JSON.stringify(value);
+	const etag = await etagOf(body);
+	const headers = {
+		etag,
+		"cache-control": "private, no-cache",
+		"content-type": "application/json"
+	};
+	if (!notFound && matches(c.req.header("if-none-match"), etag)) return new Response(null, {
+		status: 304,
+		headers
+	});
+	return new Response(body, {
+		status: notFound ? 404 : 200,
+		headers
+	});
+}
+function installReadApi(app, options) {
+	app.use("/v1/*", async (c, next) => {
+		if (c.req.method !== "GET" && c.req.method !== "HEAD") return c.json({
+			code: "invalid_input",
+			message: "The read API only reads.",
+			fix: "Use GET."
+		}, 405, { allow: "GET, HEAD" });
+		if (c.req.path === "/v1/openapi.json") return next();
+		const requestId = c.get("requestId");
+		const token = readBearerToken(c.req.raw);
+		if (token === null) {
+			options.log({
+				kind: "auth_refused",
+				requestId,
+				reason: "no_token"
+			});
+			return unauthorized();
+		}
+		const check = await checkPersonalToken(c.env.DB, token, {
+			site: options.site,
+			now: options.clock.now()
+		});
+		if (!check.ok) {
+			options.log({
+				kind: "auth_refused",
+				requestId,
+				reason: check.reason
+			});
+			return unauthorized(check.reason);
+		}
+		if (!check.principal.scopes.includes("content:read")) return insufficientScope(["content:read"]);
+		if (check.touch !== null) c.executionCtx.waitUntil(check.touch);
+		try {
+			return await next();
+		} catch (error) {
+			if (!(error instanceof HollwareError)) throw error;
+			return c.json({
+				code: error.code,
+				message: error.message,
+				fix: error.fix
+			}, STATUS[error.code] ?? 500);
+		}
+	});
+	app.get("/v1/openapi.json", (c) => c.json(openApiDocument(options.site)));
+	app.get("/v1/site", async (c) => answer(c, await options.read(c.env).describeSite(options.site)));
+	app.get("/v1/:collection", async (c) => {
+		const query = c.req.query();
+		const limit = query["limit"] === void 0 ? void 0 : Number(query["limit"]);
+		return answer(c, await options.read(c.env).listEntries(options.site, c.req.param("collection"), {
+			...query["locale"] === void 0 ? {} : { locale: query["locale"] },
+			...query["tag"] === void 0 ? {} : { tag: query["tag"] },
+			...limit === void 0 ? {} : { limit },
+			...query["cursor"] === void 0 ? {} : { cursor: query["cursor"] }
+		}));
+	});
+	app.get("/v1/:collection/translations/:group", async (c) => answer(c, await options.read(c.env).getTranslations(options.site, c.req.param("collection"), c.req.param("group"))));
+	app.get("/v1/:collection/:locale/:slug", async (c) => {
+		const formats = c.req.query("formats");
+		return answer(c, await options.read(c.env).getEntry(options.site, c.req.param("collection"), c.req.param("slug"), c.req.param("locale"), formats === void 0 ? {} : { formats: formats.split(",").flatMap((format) => format === "markdown" || format === "document" || format === "html" ? [format] : []) }));
+	});
+}
+/** The OpenAPI 3.1 document of the read API. */
+function openApiDocument(site) {
+	const ok = (description) => ({
+		description,
+		headers: { ETag: { schema: { type: "string" } } },
+		content: { "application/json": { schema: { type: "object" } } }
+	});
+	const common = {
+		"304": { description: "Not modified: the ETag of If-None-Match is current." },
+		"401": { description: "No token, or one that is unknown, expired or revoked." },
+		"403": { description: "The token lacks content:read." }
+	};
+	const param = (name, location, required) => ({
+		name,
+		in: location,
+		required,
+		schema: { type: "string" }
+	});
+	return {
+		openapi: "3.1.0",
+		info: {
+			title: `Hollware read API (${site})`,
+			version: "1"
+		},
+		components: { securitySchemes: { token: {
+			type: "http",
+			scheme: "bearer"
+		} } },
+		security: [{ token: [] }],
+		paths: {
+			"/v1/site": { get: {
+				operationId: "describe_site",
+				responses: {
+					"200": ok("The site"),
+					...common
+				}
+			} },
+			"/v1/{collection}": { get: {
+				operationId: "list_entries",
+				parameters: [
+					param("collection", "path", true),
+					param("locale", "query", false),
+					param("tag", "query", false),
+					param("limit", "query", false),
+					param("cursor", "query", false)
+				],
+				responses: {
+					"200": ok("A page of published entries"),
+					...common
+				}
+			} },
+			"/v1/{collection}/translations/{group}": { get: {
+				operationId: "get_translations",
+				parameters: [param("collection", "path", true), param("group", "path", true)],
+				responses: {
+					"200": ok("The published entries of the group"),
+					"404": { description: "No such group" },
+					...common
+				}
+			} },
+			"/v1/{collection}/{locale}/{slug}": { get: {
+				operationId: "get_entry",
+				parameters: [
+					param("collection", "path", true),
+					param("locale", "path", true),
+					param("slug", "path", true),
+					param("formats", "query", false)
+				],
+				responses: {
+					"200": ok("A published entry"),
+					"404": { description: "No such published entry" },
+					...common
+				}
+			} }
+		}
+	};
+}
+//#endregion
 //#region src/http/gateway.ts
 /**
 * The HTTP gateway of the Worker (ADR-019): a Hono 5 app, built once, that runs in this order for
@@ -1546,16 +2217,38 @@ function createGateway(options) {
 			return unauthorized(check.reason);
 		}
 		if (check.touch !== null) c.executionCtx.waitUntil(check.touch);
+		const db = c.env.DB;
 		return await mcp.fetch(c.req.raw, {
 			principal: check.principal,
 			requestId,
 			context: {
 				site,
-				store: createD1Store(c.env.DB, { clock }),
-				clock
+				store: createD1Store(db, { clock }),
+				clock,
+				notify: (ids) => {
+					c.executionCtx.waitUntil(enqueue({
+						queue: c.env.EVENTS,
+						db: connect(db),
+						site: site.key,
+						ids,
+						clock
+					}).catch((error) => {
+						log({
+							kind: "enqueue_failed",
+							requestId,
+							message: String(error)
+						});
+					}));
+				}
 			}
 		});
 	});
+	if (options.read !== void 0) installReadApi(app, {
+		read: options.read,
+		site: site.key,
+		clock,
+		log
+	});
 	installErrorHandling(app, log);
 	return async (request, env, ctx) => await app.fetch(request, env, ctx);
 }
@@ -2189,6 +2882,66 @@ function createEntrypoint(deps) {
 	};
 }
 //#endregion
+//#region src/schedule/run.ts
+/** What the publication of a schedule may do: what `publish` needs, in the scheduler's name. */
+const SCHEDULER_SCOPES = [
+	"content:read",
+	"content:write",
+	"content:publish"
+];
+/**
+* Publishes the scheduled entries whose time has come (ADR-025), one by one, through the same
+* handler as `publish`, in the name of who scheduled each one and with the warnings acknowledged
+* then. An entry that cannot be published (it changed after it was scheduled, or the contracts now
+* block it or warn about something new) goes back to a draft, and the log says why. A failure of
+* the database leaves the schedule for the next run.
+*/
+async function runDueSchedules(input) {
+	const { site, store, handlers, clock, log } = input;
+	const due = await store.dueSchedules(site.key, clock.now().toISOString());
+	let published = 0;
+	let cancelled = 0;
+	for (const schedule of due) {
+		const requestId = `cron_${crypto.randomUUID()}`;
+		const answer = await handlers.publish({
+			id: schedule.entryId,
+			version: schedule.version,
+			acknowledgeWarnings: [...schedule.acknowledged],
+			group: []
+		}, {
+			site,
+			principal: {
+				kind: "token",
+				userId: schedule.actor.userId,
+				tokenId: schedule.actor.tokenId ?? "",
+				site: site.key,
+				scopes: SCHEDULER_SCOPES
+			},
+			view: "head",
+			store,
+			clock,
+			client: schedule.actor.meta,
+			requestId
+		});
+		if (answer.outcome === "published") published += 1;
+		else {
+			await store.cancelSchedule(site.key, schedule.entryId);
+			cancelled += 1;
+		}
+		log({
+			kind: "schedule",
+			requestId,
+			entryId: schedule.entryId,
+			scheduledAt: schedule.scheduledAt,
+			outcome: answer.outcome
+		});
+	}
+	return {
+		published,
+		cancelled
+	};
+}
+//#endregion
 //#region src/compose.ts
 const systemClock = { now: () => /* @__PURE__ */ new Date() };
 /** What the MCP endpoint calls the server, in `server/discover` and `initialize`. */
@@ -2224,17 +2977,55 @@ function createHollwareWith(config, handlers, options = {}) {
 	const [site] = resolveConfig(config).sites.values();
 	if (site === void 0) throw new Error("The resolved config has no site, which resolveConfig never lets through");
 	const clock = options.clock ?? systemClock;
+	const mcp = createMcpEndpoint({
+		handlers,
+		serverInfo: SERVER_INFO,
+		log: writeLog
+	});
+	const deliveryDeps = (env) => ({
+		db: connect(env.DB),
+		site,
+		clock,
+		fetch: (request) => fetch(request),
+		secret: (name) => {
+			const value = Reflect.get(env, name);
+			return typeof value === "string" ? value : void 0;
+		}
+	});
 	return {
 		fetch: createGateway({
 			site,
-			mcp: createMcpEndpoint({
+			mcp,
+			clock,
+			log: writeLog,
+			read: (env) => createRpc({
+				site,
 				handlers,
-				serverInfo: SERVER_INFO,
+				clock,
 				log: writeLog
-			}),
-			clock,
-			log: writeLog
+			}, env)
 		}),
+		scheduled: async (_controller, env, ctx) => {
+			const deps = deliveryDeps(env);
+			ctx.waitUntil(runDueSchedules({
+				site,
+				store: createD1Store(env.DB, { clock }),
+				handlers,
+				clock,
+				log: writeLog
+			}).then(() => sweepOutbox({
+				queue: env.EVENTS,
+				deps
+			})).then(() => void 0, (error) => {
+				writeLog({
+					kind: "cron_failed",
+					message: String(error)
+				});
+			}));
+		},
+		queue: async (batch, env) => {
+			await consumeEvents(batch.messages, deliveryDeps(env));
+		},
 		Hollware: createEntrypoint({
 			site,
 			handlers,
@@ -2431,7 +3222,7 @@ function processFor(site, collection, markdown) {
 * saved under; `publish` is what `validate` and `publish` check, with every contract of the
 * collection, against the other entries of the site as they are now.
 */
-function judge(context, collection, target, markdown, phase) {
+function judge(context, collection, target, markdown, phase, entries = context.store.lookup(context.site.key)) {
 	return runContracts({
 		site: context.site,
 		collection,
@@ -2440,7 +3231,7 @@ function judge(context, collection, target, markdown, phase) {
 		entryId: target.entryId,
 		phase,
 		markdown,
-		entries: context.store.lookup(context.site.key)
+		entries
 	});
 }
 /**
@@ -2612,6 +3403,31 @@ const listEntries$1 = async (input, context) => {
 	};
 };
 //#endregion
+//#region src/ops/event.ts
+/** The path of an entry: the route of its locale, with its slug in place of `:slug`. */
+function entryPath(collection, locale, slug) {
+	const route = collection.routes[locale];
+	return route === void 0 ? null : route.replace(/:slug(?![A-Za-z0-9_])/, slug);
+}
+/** The event of a publish or an unpublish, ready for the outbox. */
+function eventFor(input) {
+	const id = newId("evt");
+	const path = entryPath(input.collection, input.entry.locale, input.entry.slug);
+	const payload = {
+		id,
+		kind: input.kind,
+		site: input.site.key,
+		at: input.at,
+		entry: input.entry,
+		path,
+		url: path === null || input.site.url === null ? null : `${input.site.url}${path}`
+	};
+	return {
+		id,
+		payload: JSON.stringify(payload)
+	};
+}
+//#endregion
 //#region src/ops/publish.ts
 /** A warning by what an acknowledgement names: its contract and its path, never its line. */
 function warningKey(warning) {
@@ -2625,6 +3441,7 @@ function warningKey(warning) {
 * verdict as acknowledged (ADR-021).
 */
 const publish$1 = async (input, context) => {
+	if (input.group.length > 0) return publishGroup(input, context);
 	const actor = actorOf(context);
 	const found = await context.store.findEntryById(context.site.key, input.id, "head");
 	if (found === null) return { outcome: "not_found" };
@@ -2657,7 +3474,48 @@ const publish$1 = async (input, context) => {
 		entry: summary,
 		verdict: verdictView(verdict)
 	};
+	const acknowledgedWarnings = verdict.warnings.map(({ contract, path }) => ({
+		contract,
+		path
+	}));
+	if (input.publishAt !== void 0 && Date.parse(input.publishAt) > context.clock.now().getTime()) {
+		if (entry.status === "published") throw new HollwareError("invalid_input", "The entry is published, so its publication cannot be scheduled.", "Publish its changes now, without publishAt, or unpublish it first and then schedule it.");
+		const scheduled = await context.store.schedule(context.site.key, {
+			entryId: entry.id,
+			expectedVersion: input.version,
+			scheduledAt: new Date(input.publishAt).toISOString(),
+			acknowledged: acknowledgedWarnings,
+			actor
+		});
+		switch (scheduled.outcome) {
+			case "scheduled": return {
+				outcome: "scheduled",
+				entry: entrySummary(scheduled.view),
+				verdict: verdictView(verdict)
+			};
+			case "conflict": return {
+				outcome: "conflict",
+				conflict: conflictAt(scheduled.currentVersion, scheduled.headRevision)
+			};
+			case "not_found": return { outcome: "not_found" };
+			default: throw unexpectedAnswer(context, "publish", scheduled);
+		}
+	}
+	const event = eventFor({
+		kind: "entry.published",
+		site: context.site,
+		collection,
+		entry: {
+			id: entry.id,
+			collection: entry.collection,
+			locale: entry.locale,
+			slug: entry.slug,
+			translationGroup: entry.translationGroup
+		},
+		at: context.clock.now().toISOString()
+	});
 	const written = await context.store.publish(context.site.key, {
+		event,
 		entryId: entry.id,
 		expectedVersion: input.version,
 		verdict,
@@ -2669,11 +3527,13 @@ const publish$1 = async (input, context) => {
 		sortKey: sortKeyOf(collection, processed.value.frontmatter) ?? entry.publishedAt ?? context.clock.now().toISOString()
 	});
 	switch (written.outcome) {
-		case "published": return {
-			outcome: "published",
-			entry: entrySummary(written.view),
-			verdict: verdictView(verdict)
-		};
+		case "published":
+			context.notify?.([event.id]);
+			return {
+				outcome: "published",
+				entry: entrySummary(written.view),
+				verdict: verdictView(verdict)
+			};
 		case "conflict": return {
 			outcome: "conflict",
 			conflict: conflictAt(written.currentVersion, written.headRevision)
@@ -2687,6 +3547,139 @@ const publish$1 = async (input, context) => {
 		case "taken": throw unexpectedAnswer(context, "publish", written);
 	}
 };
+/** The lookup of the contracts, with the entries of a group seen as published (ADR-024). */
+function asPublished(lookup, ids) {
+	return {
+		lookupMany: async (refs) => (await lookup.lookupMany(refs)).map((facts) => facts !== null && ids.has(facts.id) ? {
+			...facts,
+			status: "published"
+		} : facts),
+		translations: (collection, group) => lookup.translations(collection, group)
+	};
+}
+/**
+* Publishes an entry and the entries of its group in one step, all or none (ADR-024). Each entry
+* is checked as `publish` checks one, except that the contracts see every entry of the group as
+* published, so links between them resolve. The first entry that stops the group is named in
+* `failedEntry`. An acknowledgement, by contract and path, holds for every entry that reports
+* that warning, and each publication records its own warnings.
+*/
+async function publishGroup(input, context) {
+	if (input.publishAt !== void 0) throw new HollwareError("invalid_input", "A group cannot be scheduled: publishAt schedules one entry.", "Publish the group now, without publishAt, or schedule its entries one by one.");
+	const actor = actorOf(context);
+	const members = [{
+		id: input.id,
+		version: input.version
+	}, ...input.group].filter((member, index, all) => all.findIndex((other) => other.id === member.id) === index);
+	const lookup = asPublished(context.store.lookup(context.site.key), new Set(members.map((member) => member.id)));
+	const checked = [];
+	for (const member of members) {
+		const found = await context.store.findEntryById(context.site.key, member.id, "head");
+		if (found === null) return {
+			outcome: "not_found",
+			failedEntry: member.id
+		};
+		const { entry, revision } = found;
+		if (entry.version !== member.version) return {
+			outcome: "conflict",
+			conflict: conflictAt(entry.version, entry.headRevision),
+			failedEntry: member.id
+		};
+		const collection = collectionOfEntry(context.site, entry);
+		const summary = entrySummary(found);
+		const processed = await processFor(context.site, collection, revision.markdown);
+		if (!processed.ok) return {
+			outcome: "blocked",
+			entry: summary,
+			verdict: refusalVerdict("publish", processed.violations),
+			failedEntry: member.id
+		};
+		const verdict = await judge(context, collection, {
+			locale: entry.locale,
+			slug: entry.slug,
+			entryId: entry.id
+		}, processed.value, "publish", lookup);
+		if (!verdict.ok) return {
+			outcome: "blocked",
+			entry: summary,
+			verdict: verdictView(verdict),
+			failedEntry: member.id
+		};
+		checked.push({
+			summary,
+			collection,
+			verdict,
+			write: {
+				event: eventFor({
+					kind: "entry.published",
+					site: context.site,
+					collection,
+					entry: {
+						id: entry.id,
+						collection: entry.collection,
+						locale: entry.locale,
+						slug: entry.slug,
+						translationGroup: entry.translationGroup
+					},
+					at: context.clock.now().toISOString()
+				}),
+				entryId: entry.id,
+				expectedVersion: member.version,
+				verdict,
+				acknowledged: verdict.warnings.map(({ contract, path }) => ({
+					contract,
+					path
+				})),
+				actor,
+				sortKey: sortKeyOf(collection, processed.value.frontmatter) ?? entry.publishedAt ?? context.clock.now().toISOString()
+			}
+		});
+	}
+	const [main] = checked;
+	if (main === void 0) throw unexpectedAnswer(context, "publish", { outcome: "empty group" });
+	const warnings = new Map(checked.flatMap(({ verdict }) => verdict.warnings).map((warning) => [warningKey(warning), warning]));
+	const acknowledged = new Set(input.acknowledgeWarnings.map(warningKey));
+	if ([...warnings.keys()].some((key) => !acknowledged.has(key))) return {
+		outcome: "needs_acknowledgement",
+		entry: main.summary,
+		verdict: verdictView({
+			...main.verdict,
+			warnings: [...warnings.values()]
+		})
+	};
+	const written = await context.store.publishGroup(context.site.key, checked.map(({ write }) => write));
+	switch (written.outcome) {
+		case "published": {
+			const [view] = written.views;
+			if (view === void 0) throw unexpectedAnswer(context, "publish", written);
+			context.notify?.(checked.flatMap(({ write }) => write.event ? [write.event.id] : []));
+			return {
+				outcome: "published",
+				entry: entrySummary(view),
+				verdict: verdictView(main.verdict)
+			};
+		}
+		case "conflict": return {
+			outcome: "conflict",
+			conflict: conflictAt(written.currentVersion, written.headRevision),
+			failedEntry: written.entryId
+		};
+		case "not_found": return {
+			outcome: "not_found",
+			failedEntry: written.entryId
+		};
+		case "too_large": {
+			const failed = checked.find(({ write }) => write.entryId === written.entryId) ?? main;
+			return {
+				outcome: "blocked",
+				entry: failed.summary,
+				verdict: refusalVerdict("publish", [violationOf(written, failed.collection)]),
+				failedEntry: written.entryId
+			};
+		}
+		case "taken": throw unexpectedAnswer(context, "publish", written);
+	}
+}
 //#endregion
 //#region src/ops/unpublish.ts
 /**
@@ -2695,15 +3688,34 @@ const publish$1 = async (input, context) => {
 */
 const unpublish = async (input, context) => {
 	const actor = actorOf(context);
+	const found = await context.store.findEntryById(context.site.key, input.id, "head");
+	if (found === null) return { outcome: "not_found" };
+	const { entry } = found;
+	const event = eventFor({
+		kind: "entry.unpublished",
+		site: context.site,
+		collection: collectionOfEntry(context.site, entry),
+		entry: {
+			id: entry.id,
+			collection: entry.collection,
+			locale: entry.locale,
+			slug: entry.slug,
+			translationGroup: entry.translationGroup
+		},
+		at: context.clock.now().toISOString()
+	});
 	const written = await context.store.unpublish(context.site.key, {
 		entryId: input.id,
-		actor
+		actor,
+		event
 	});
 	switch (written.outcome) {
-		case "unpublished": return {
-			outcome: "unpublished",
-			entry: entrySummary(written.view)
-		};
+		case "unpublished":
+			if (entry.status === "published") context.notify?.([event.id]);
+			return {
+				outcome: "unpublished",
+				entry: entrySummary(written.view)
+			};
 		case "not_found": return { outcome: "not_found" };
 		case "conflict":
 		case "taken":