@hollware/server 0.1.0 → 0.3.0

package/dist/index.mjs

@@ -1,35 +1,16 @@
-import { HollwareError, OPERATIONS, describeBuiltInContracts, describeResolvedSite, describeSite, getEntry, getTranslations, hashPersonalToken, isPersonalToken, isScope, listEntries, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, sizeLimitViolation, uniqueSlugViolation, uniqueTranslationViolation } from "@hollware/core";
+import { A as isRole, C as revisions, D as users, E as tokens, O as ROLE_SCOPES, S as revisionTags, T as sites, _ as invitations, b as publications, g as entries, h as deliveries, k as effectiveScopes, n as createInvitation, s as findSession, v as members, w as schedules, x as reviews, y as outbox } from "./store-Sq0pwUQv.mjs";
+import { EVENT_ID_HEADER, HollwareError, OPERATIONS, SCOPES, SIGNATURE_HEADER, TIMESTAMP_HEADER, describeBuiltInContracts, describeResolvedSite, describeSite, generatePersonalToken, getEntry, getTranslations, hashPersonalToken, isPersonalToken, isScope, listEntries, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, signWebhook, sizeLimitViolation, uniqueSlugViolation, uniqueTranslationViolation } from "@hollware/core";
 import { Hono } from "hono";
 import { drizzle } from "drizzle-orm/d1";
-import { and, desc, eq, getTableColumns, ne, or, sql } from "drizzle-orm";
-import { alias, check, foreignKey, index, integer, sqliteTable, text, unique } from "drizzle-orm/sqlite-core";
+import { and, desc, eq, getTableColumns, gt, inArray, isNull, lte, ne, or, sql } from "drizzle-orm";
+import { alias } from "drizzle-orm/sqlite-core";
+import { AuthorizationError, CimdFetchError, OAuthAuthorizationServer, OAuthResourceServer, authorizationErrorRedirect } from "@cloudflare/workers-oauth-provider";
+import { getCookie } from "hono/cookie";
 import { CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, McpServer, acceptedContent, createMcpHandler, inputRequired, inputResponse } from "@modelcontextprotocol/server";
 import * as z from "zod";
 import { WorkerEntrypoint } from "cloudflare:workers";
 //#region package.json
-var version = "0.1.0";
-//#endregion
-//#region src/auth/bearer.ts
-/**
-* `Bearer`, one or more spaces, then one token with no whitespace in it, and nothing else. The
-* scheme is case-insensitive (RFC 7235); the runtime has already trimmed the whole value.
-*/
-const BEARER = /^bearer +(\S+)$/i;
-/**
-* The token of an `Authorization: Bearer <token>` header, as sent, or `null` when the request
-* presents none: no header, another scheme, no token, or more than one (two headers arrive joined
-* with a comma, so they read as two tokens). It never looks at the URL: a token in a query string
-* ends up in logs, referrers and history, so Hollware does not accept one.
-*
-* It does not judge the token. A string that is not a personal token is a token that was
-* presented and refused, which `checkPersonalToken` says and `unauthorized` answers differently
-* from a request without credentials.
-*/
-function readBearerToken(request) {
-	const header = request.headers.get("authorization");
-	if (header === null) return null;
-	return BEARER.exec(header)?.[1] ?? null;
-}
+var version = "0.3.0";
 //#endregion
 //#region src/auth/responses.ts
 /** The challenge of every 401 and 403 (RFC 6750). */
@@ -56,15 +37,28 @@ function authErrorResponse(status, body, challenge) {
 function unauthorized(reason) {
 	if (reason === void 0) return authErrorResponse(401, {
 		code: "unauthorized",
-		message: "The request carries no personal token.",
-		fix: "Send a personal token as \"Authorization: Bearer <token>\". Create one with `hollware token create`."
+		message: "The request carries no token.",
+		fix: "Send a personal token as \"Authorization: Bearer <token>\" (create one with `hollware token create`), or sign in through OAuth: the challenge names where."
 	}, REALM);
 	return authErrorResponse(401, {
 		code: "unauthorized",
-		message: "The personal token was not accepted.",
-		fix: "Tokens expire and can be revoked. Create a new one with `hollware token create` and send it as \"Authorization: Bearer <token>\"."
+		message: "The token was not accepted.",
+		fix: "Tokens expire and can be revoked. Create a new personal token with `hollware token create`, or sign in through OAuth again, and send it as \"Authorization: Bearer <token>\"."
 	}, `${REALM}, error="invalid_token"`);
 }
+/**
+* 403 for a token that authenticated but lacks scopes. It names every scope that is missing, in
+* the body and in the challenge (RFC 6750), so that a client asks for all of them at once, and,
+* when there is one, the protected resource metadata where it learns how (RFC 9728).
+*/
+function insufficientScope(missing, resourceMetadataUrl) {
+	const metadata = resourceMetadataUrl === void 0 ? "" : `, resource_metadata="${resourceMetadataUrl}"`;
+	return authErrorResponse(403, {
+		code: "insufficient_scope",
+		message: `The token lacks a scope this operation requires. Missing: ${missing.join(", ")}.`,
+		fix: "Send a token that carries every missing scope: create one with `hollware token create`, or authorize the client again for them. A token only gets the scopes its user's role allows."
+	}, `${REALM}${metadata}, error="insufficient_scope", scope="${missing.join(" ")}"`);
+}
 //#endregion
 //#region src/auth/guard.ts
 /**
@@ -132,60 +126,28 @@ function checkHostAndOrigin(request, publicUrl) {
 	return null;
 }
 //#endregion
-//#region src/auth/roles.ts
+//#region src/auth/scopes.ts
 /**
-* The roles of a user, as the `users_role` CHECK of the schema lists them. In v0.1 only the owner
-* exists: `hollware init` creates it. The other two are in the CHECK already, so that v0.3 can
-* invite people without a rebuild of the table (ADR-023).
+* The scopes an operation requires that the principal lacks, in the order the operation lists
+* them. Empty means the principal may call it; otherwise the answer is `insufficientScope` with
+* all of them, so that a client asks for everything it needs in one go.
 */
-const ROLES = [
-	"owner",
-	"editor",
-	"reviewer"
-];
-/** Whether a string is one of the roles. */
-function isRole(value) {
-	return ROLES.some((role) => role === value);
-}
-/**
-* The scopes each role allows. What a token may do is its own scopes intersected with these,
-* read from the user's current role on every request (ADR-005, ADR-019). An operation asks for
-* scopes, never for a role.
-*
-* - `owner` may do everything: all four scopes.
-* - `editor` and `reviewer` allow none in v0.1. Nothing creates such a user yet, and which scopes
-*   each one gets (an editor writes, a reviewer approves) is for v0.3 to decide, together with
-*   the admin that invites them. Until then a token of such a user authenticates, but every
-*   operation answers 403 `insufficient_scope`.
-*/
-const ROLE_SCOPES = {
-	owner: [
-		"content:read",
-		"content:write",
-		"content:publish",
-		"schema:admin"
-	],
-	editor: [],
-	reviewer: []
-};
-/**
-* The scopes a token really has: those it carries that the role of its user allows, in the order
-* of the role. A role that is not one of the roles allows nothing, so a role added to the schema
-* before this table knows it grants no access.
-*/
-function effectiveScopes(role, tokenScopes) {
-	if (!isRole(role)) return [];
-	return ROLE_SCOPES[role].filter((scope) => tokenScopes.includes(scope));
+function missingScopes(principal, required) {
+	const granted = principal.scopes;
+	return required.filter((scope) => !granted.includes(scope));
 }
 //#endregion
 //#region src/auth/token.ts
 /** `last_used_at` of a token is written at most once in this time. */
 const TOUCH_INTERVAL_MS = 36e5;
-/** The token with the role of its user, by the hash of the token, in the one site. */
+/**
+* The token with the role of its user in the token's site, by the hash of the token, in the one
+* site. A user who is no member of the site has no role there, and the token is unknown.
+*/
 const LOOKUP = `SELECT t.id AS token_id, t.site_id AS site_id, t.user_id AS user_id,
     t.scopes AS scopes, t.expires_at AS expires_at, t.revoked_at AS revoked_at,
-    t.last_used_at AS last_used_at, u.role AS role
-  FROM tokens AS t JOIN users AS u ON u.id = t.user_id
+    t.last_used_at AS last_used_at, m.role AS role
+  FROM tokens AS t JOIN members AS m ON m.user_id = t.user_id AND m.site_id = t.site_id
   WHERE t.hash = ?1 AND t.site_id = ?2`;
 /**
 * The scopes a token carries, from the JSON array the `tokens` table stores. Anything that is not
@@ -397,238 +359,6 @@ function decodeCursor(cursor, view) {
 	throw invalidCursor();
 }
 //#endregion
-//#region src/db/columns.ts
-/**
-* The columns every table shares. Each helper returns a new builder, because a Drizzle column
-* belongs to one table. Only the repository functions write rows, so these defaults are what
-* every row gets.
-*/
-/** The current time in UTC, as ISO 8601 with milliseconds: `2026-10-12T18:30:00.000Z`. */
-function nowIso() {
-	return (/* @__PURE__ */ new Date()).toISOString();
-}
-/** The primary key: a prefixed ULID, such as `ent_01JAB3XQ8ZK4M6N2P5R7S9T0VW`. */
-function id(prefix) {
-	return text("id").primaryKey().$defaultFn(() => newId(prefix));
-}
-/**
-* The site a row belongs to: the site's key in `hollware.config.ts`, which is also the id of its
-* row in `sites`. Every table but the deployment-wide ones carries it (ADR-006).
-*/
-function siteId() {
-	return text("site_id").notNull();
-}
-/** `created_at` and `updated_at`, in UTC; `updated_at` moves on every update. */
-function timestamps() {
-	return {
-		createdAt: text("created_at").notNull().$defaultFn(nowIso),
-		updatedAt: text("updated_at").notNull().$defaultFn(nowIso).$onUpdateFn(nowIso)
-	};
-}
-sqliteTable("_hollware_meta", {
-	key: text("key").primaryKey().notNull(),
-	value: text("value").notNull()
-});
-/** The sites of the deployment. The id is the site's key in `hollware.config.ts`. */
-const sites = sqliteTable("sites", {
-	id: text("id").primaryKey(),
-	...timestamps()
-});
-/** People. A user belongs to the deployment; tokens carry the site. */
-const users = sqliteTable("users", {
-	id: id("usr"),
-	name: text("name"),
-	role: text("role").notNull(),
-	...timestamps()
-}, (t) => [check("users_role", sql`${t.role} IN ('owner', 'editor', 'reviewer')`)]);
-/** Personal tokens (ADR-019): only the hash is stored. */
-const tokens = sqliteTable("tokens", {
-	id: id("tok"),
-	siteId: siteId(),
-	userId: text("user_id").notNull(),
-	label: text("label").notNull(),
-	hash: text("hash").notNull(),
-	/** A JSON array of scopes. */
-	scopes: text("scopes").notNull(),
-	expiresAt: text("expires_at"),
-	revokedAt: text("revoked_at"),
-	lastUsedAt: text("last_used_at"),
-	...timestamps()
-}, (t) => [
-	unique("tokens_id_site").on(t.id, t.siteId),
-	unique("tokens_hash").on(t.hash),
-	foreignKey({
-		name: "tokens_site",
-		columns: [t.siteId],
-		foreignColumns: [sites.id]
-	}),
-	foreignKey({
-		name: "tokens_user",
-		columns: [t.userId],
-		foreignColumns: [users.id]
-	}),
-	check("tokens_scopes", sql`json_valid(${t.scopes}) AND json_type(${t.scopes}) = 'array'`)
-]);
-/** One entry per site, collection, locale and slug; its content lives in `revisions`. */
-const entries = sqliteTable("entries", {
-	id: id("ent"),
-	siteId: siteId(),
-	collection: text("collection").notNull(),
-	locale: text("locale").notNull(),
-	slug: text("slug").notNull(),
-	translationGroup: text("translation_group"),
-	status: text("status").notNull(),
-	/** Bumped by every change of the entry: the optimistic write compares it. */
-	version: integer("version").notNull(),
-	headRev: text("head_rev").notNull(),
-	publishedRev: text("published_rev"),
-	publishedAt: text("published_at"),
-	publishedSortKey: text("published_sort_key"),
-	scheduledAt: text("scheduled_at"),
-	...timestamps()
-}, (t) => [
-	unique("entries_id_site").on(t.id, t.siteId),
-	unique("entries_slug").on(t.siteId, t.collection, t.locale, t.slug),
-	unique("entries_translation").on(t.siteId, t.collection, t.translationGroup, t.locale),
-	index("entries_head").on(t.siteId, t.collection, t.updatedAt, t.id),
-	index("entries_head_locale").on(t.siteId, t.collection, t.locale, t.updatedAt, t.id),
-	index("entries_published").on(t.siteId, t.collection, t.locale, t.publishedSortKey, t.id).where(sql`${t.status} = 'published'`),
-	foreignKey({
-		name: "entries_site",
-		columns: [t.siteId],
-		foreignColumns: [sites.id]
-	}),
-	check("entries_status", sql`${t.status} IN ('draft', 'scheduled', 'published')`),
-	check("entries_version", sql`${t.version} >= 1`),
-	check("entries_draft", sql`${t.status} <> 'draft' OR (${t.publishedRev} IS NULL AND ${t.publishedSortKey} IS NULL AND ${t.scheduledAt} IS NULL)`),
-	check("entries_published", sql`${t.status} <> 'published' OR (${t.publishedRev} IS NOT NULL AND ${t.publishedAt} IS NOT NULL AND ${t.publishedSortKey} IS NOT NULL)`),
-	check("entries_scheduled", sql`${t.status} <> 'scheduled' OR ${t.scheduledAt} IS NOT NULL`)
-]);
-/**
-* Every version of an entry, appended and never changed (ADR-021). `markdown` is the whole file,
-* frontmatter included; the derived columns can be rebuilt by `reparse`.
-*/
-const revisions = sqliteTable("revisions", {
-	id: id("rev"),
-	siteId: siteId(),
-	entryId: text("entry_id").notNull(),
-	markdown: text("markdown").notNull(),
-	/** Derived: the frontmatter as JSON. */
-	frontmatter: text("frontmatter").notNull(),
-	/** Derived: the Comark document as JSON. */
-	document: text("document").notNull(),
-	comarkVersion: text("comark_version").notNull(),
-	pipelineVersion: text("pipeline_version").notNull(),
-	wordCount: integer("word_count").notNull(),
-	/** The verdict of the contracts when the revision was written, as JSON. */
-	verdict: text("verdict").notNull(),
-	actorKind: text("actor_kind").notNull(),
-	actorUserId: text("actor_user_id").notNull(),
-	actorTokenId: text("actor_token_id"),
-	/** The client and, when it says, the model behind the write, as JSON. */
-	actorMeta: text("actor_meta"),
-	...timestamps()
-}, (t) => [
-	unique("revisions_id_site").on(t.id, t.siteId),
-	index("revisions_entry").on(t.entryId, t.createdAt),
-	foreignKey({
-		name: "revisions_site",
-		columns: [t.siteId],
-		foreignColumns: [sites.id]
-	}),
-	foreignKey({
-		name: "revisions_entry",
-		columns: [t.entryId, t.siteId],
-		foreignColumns: [entries.id, entries.siteId]
-	}),
-	foreignKey({
-		name: "revisions_user",
-		columns: [t.actorUserId],
-		foreignColumns: [users.id]
-	}),
-	foreignKey({
-		name: "revisions_token",
-		columns: [t.actorTokenId, t.siteId],
-		foreignColumns: [tokens.id, tokens.siteId]
-	}),
-	check("revisions_actor_kind", sql`${t.actorKind} IN ('token', 'user', 'oauth_client')`),
-	check("revisions_json", sql`json_valid(${t.frontmatter}) AND json_valid(${t.document}) AND json_valid(${t.verdict}) AND (${t.actorMeta} IS NULL OR json_valid(${t.actorMeta}))`),
-	check("revisions_word_count", sql`${t.wordCount} >= 0`)
-]);
-/** The tags of a revision, for listing published entries by tag. Append-only, like revisions. */
-const revisionTags = sqliteTable("revision_tags", {
-	id: id("tag"),
-	siteId: siteId(),
-	revisionId: text("revision_id").notNull(),
-	tag: text("tag").notNull(),
-	...timestamps()
-}, (t) => [
-	unique("revision_tags_id_site").on(t.id, t.siteId),
-	unique("revision_tags_tag").on(t.revisionId, t.tag),
-	index("revision_tags_by_tag").on(t.siteId, t.tag),
-	foreignKey({
-		name: "revision_tags_site",
-		columns: [t.siteId],
-		foreignColumns: [sites.id]
-	}),
-	foreignKey({
-		name: "revision_tags_revision",
-		columns: [t.revisionId, t.siteId],
-		foreignColumns: [revisions.id, revisions.siteId]
-	})
-]);
-/**
-* Every publish and unpublish, appended: the verdict of the publish phase and the warnings the
-* caller acknowledged (ADR-021).
-*/
-const publications = sqliteTable("publications", {
-	id: id("pub"),
-	siteId: siteId(),
-	entryId: text("entry_id").notNull(),
-	action: text("action").notNull(),
-	revisionId: text("revision_id"),
-	verdict: text("verdict"),
-	/** A JSON array: the warnings the caller acknowledged to publish. */
-	acknowledged: text("acknowledged").notNull(),
-	actorKind: text("actor_kind").notNull(),
-	actorUserId: text("actor_user_id").notNull(),
-	actorTokenId: text("actor_token_id"),
-	actorMeta: text("actor_meta"),
-	...timestamps()
-}, (t) => [
-	unique("publications_id_site").on(t.id, t.siteId),
-	index("publications_entry").on(t.entryId, t.createdAt),
-	foreignKey({
-		name: "publications_site",
-		columns: [t.siteId],
-		foreignColumns: [sites.id]
-	}),
-	foreignKey({
-		name: "publications_entry",
-		columns: [t.entryId, t.siteId],
-		foreignColumns: [entries.id, entries.siteId]
-	}),
-	foreignKey({
-		name: "publications_revision",
-		columns: [t.revisionId, t.siteId],
-		foreignColumns: [revisions.id, revisions.siteId]
-	}),
-	foreignKey({
-		name: "publications_user",
-		columns: [t.actorUserId],
-		foreignColumns: [users.id]
-	}),
-	foreignKey({
-		name: "publications_token",
-		columns: [t.actorTokenId, t.siteId],
-		foreignColumns: [tokens.id, tokens.siteId]
-	}),
-	check("publications_action", sql`${t.action} IN ('publish', 'unpublish')`),
-	check("publications_shape", sql`(${t.action} = 'publish' AND ${t.revisionId} IS NOT NULL AND ${t.verdict} IS NOT NULL) OR (${t.action} = 'unpublish' AND ${t.revisionId} IS NULL AND ${t.verdict} IS NULL)`),
-	check("publications_actor_kind", sql`${t.actorKind} IN ('token', 'user', 'oauth_client')`),
-	check("publications_json", sql`json_valid(${t.acknowledged}) AND json_type(${t.acknowledged}) = 'array' AND (${t.verdict} IS NULL OR json_valid(${t.verdict})) AND (${t.actorMeta} IS NULL OR json_valid(${t.actorMeta}))`)
-]);
-//#endregion
 //#region src/db/rows.ts
 /**
 * The columns the store reads and how they become the types of `ports.ts`. The JSON columns come
@@ -1000,35 +730,6 @@ function isUniqueViolation(error) {
 	return false;
 }
 //#endregion
-//#region src/db/size.ts
-/**
-* D1 refuses rows over 2 MB, and Miniflare does not enforce it, so the store counts the bytes of
-* a row before writing it and refuses a row over `MAX_ROW_BYTES` (`limits.ts`).
-*/
-const encoder$1 = new TextEncoder();
-/** The bytes of `text` in UTF-8, which is how D1 stores it. */
-function utf8Bytes(text) {
-	return encoder$1.encode(text).byteLength;
-}
-/** What SQLite keeps for an integer, at most. */
-const INTEGER_BYTES = 8;
-/** The bytes of every column of a row: text in UTF-8, an integer as 8 bytes, a null as none. */
-function rowBytes(row) {
-	let bytes = 0;
-	for (const value of Object.values(row)) if (typeof value === "string") bytes += utf8Bytes(value);
-	else if (value !== null) bytes += INTEGER_BYTES;
-	return bytes;
-}
-/** The refusal for a row over the limit, or `null` when it fits. */
-function tooLarge(row) {
-	const bytes = rowBytes(row);
-	return bytes > 19e5 ? {
-		outcome: "too_large",
-		bytes,
-		limit: MAX_ROW_BYTES
-	} : null;
-}
-//#endregion
 //#region src/db/statements.ts
 function actorColumns(actor) {
 	return {
@@ -1122,6 +823,249 @@ function insertUnpublishIfPublished(db, row) {
 	return db.insert(publications).select(sql`select ${valuesOf(publications, row)} from ${entries} where ${and(eq(entries.id, row.entryId), eq(entries.siteId, row.siteId), eq(entries.status, "published"))}`);
 }
 //#endregion
+//#region src/db/schedules.ts
+/**
+* Scheduled publications (ADR-025). An entry waits in status `scheduled` with its `scheduled_at`,
+* and its row of `schedules` says what was acknowledged and by whom, for the cron trigger that
+* publishes it once the time has passed.
+*/
+/** Statements that drop the schedule of an entry, in the batch of a write that ends it. */
+function dropSchedule(db, site, entryId) {
+	return db.delete(schedules).where(and(eq(schedules.siteId, site), eq(schedules.entryId, entryId)));
+}
+async function schedule(db, clock, site, write) {
+	const now = clock.now().toISOString();
+	const row = {
+		id: newId("sch"),
+		siteId: site,
+		entryId: write.entryId,
+		scheduledAt: write.scheduledAt,
+		version: write.expectedVersion + 1,
+		acknowledged: JSON.stringify(write.acknowledged),
+		...actorColumns(write.actor),
+		createdAt: now,
+		updatedAt: now
+	};
+	const atVersion = and(eq(entries.id, write.entryId), eq(entries.siteId, site), eq(entries.version, write.expectedVersion), sql`${entries.status} <> 'published'`);
+	const results = await db.batch([
+		db.delete(schedules).where(and(eq(schedules.siteId, site), eq(schedules.entryId, write.entryId), sql`exists (select 1 from ${entries} where ${atVersion})`)),
+		db.insert(schedules).select(sql`select ${valuesOf(schedules, row)} from ${entries} where ${atVersion}`),
+		db.update(entries).set({
+			status: "scheduled",
+			scheduledAt: write.scheduledAt,
+			version: sql`${entries.version} + 1`,
+			updatedAt: now
+		}).where(atVersion).returning({ id: entries.id })
+	]);
+	const view = await findEntryById(db, site, write.entryId, "head");
+	if (view === null) return { outcome: "not_found" };
+	if (results[2].length === 0) return {
+		outcome: "conflict",
+		currentVersion: view.entry.version,
+		headRevision: view.entry.headRevision
+	};
+	return {
+		outcome: "scheduled",
+		view
+	};
+}
+/** The schedules of a site whose time has come, oldest first. */
+async function dueSchedules(db, site, now) {
+	return (await db.select().from(schedules).where(and(eq(schedules.siteId, site), lte(schedules.scheduledAt, now))).orderBy(schedules.scheduledAt).limit(50)).map((row) => ({
+		entryId: row.entryId,
+		scheduledAt: row.scheduledAt,
+		version: row.version,
+		acknowledged: parseAcknowledged(row.acknowledged),
+		actor: {
+			kind: actorKindOf(row.actorKind),
+			userId: row.actorUserId,
+			tokenId: row.actorTokenId,
+			meta: row.actorMeta === null ? null : parseMeta(row.actorMeta)
+		}
+	}));
+}
+/** Takes an entry out of `scheduled`, back to a draft, and drops its schedule. */
+async function cancelSchedule(db, clock, site, entryId) {
+	await db.batch([dropSchedule(db, site, entryId), db.update(entries).set({
+		status: "draft",
+		scheduledAt: null,
+		version: sql`${entries.version} + 1`,
+		updatedAt: clock.now().toISOString()
+	}).where(and(eq(entries.id, entryId), eq(entries.siteId, site), eq(entries.status, "scheduled")))]);
+}
+function parseAcknowledged(text) {
+	const value = JSON.parse(text);
+	if (!Array.isArray(value)) return [];
+	return value.flatMap((item) => typeof item === "object" && item !== null && "contract" in item && "path" in item && typeof item.contract === "string" && typeof item.path === "string" ? [{
+		contract: item.contract,
+		path: item.path
+	}] : []);
+}
+/** The kind of an actor as the `*_actor_kind` checks allow it. */
+function actorKindOf(value) {
+	if (value === "token" || value === "user" || value === "oauth_client") return value;
+	throw new Error(`A schedule has the actor kind ${value}, which is no kind`);
+}
+function parseMeta(text) {
+	const value = JSON.parse(text);
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : null;
+}
+//#endregion
+//#region src/db/reviews.ts
+/**
+* Reviews (v0.3). A person who may write but not publish asks for the head revision of an entry
+* to be published; a person who may publish approves it, which publishes it, or asks for changes.
+* The partial unique index `reviews_pending` keeps one pending review per entry. A write that
+* moves the entry closes the pending review in its own batch: a new revision cancels it
+* (`cancelPendingReview`), a publication approves it (`approvePendingReview`).
+*/
+const STATUSES = [
+	"pending",
+	"approved",
+	"changes_requested",
+	"cancelled"
+];
+function statusOf(value) {
+	const status = STATUSES.find((known) => known === value);
+	if (status === void 0) throw new Error(`A review has the status ${value}, which is no status`);
+	return status;
+}
+/** The columns of a review, and the name of who asked for it. */
+const COLUMNS = {
+	...getTableColumns(reviews),
+	requestedByName: users.name
+};
+function toReview(row) {
+	return {
+		id: row.id,
+		entryId: row.entryId,
+		revisionId: row.revisionId,
+		status: statusOf(row.status),
+		acknowledged: parseAcknowledged(row.acknowledged),
+		requestedBy: row.requestedBy,
+		requestedByName: row.requestedByName,
+		requestedAt: row.createdAt,
+		decidedBy: row.decidedBy,
+		decidedAt: row.decidedAt,
+		note: row.note
+	};
+}
+/** The entry is still at `version`: the condition of every statement a write adds to its batch. */
+function entryAt(site, entryId, version) {
+	return sql`exists (select 1 from ${entries} where ${and(eq(entries.id, entryId), eq(entries.siteId, site), eq(entries.version, version))})`;
+}
+/** In the batch of a new revision: the pending review asked for another one, so it is cancelled. */
+function cancelPendingReview(db, site, entryId, version, now) {
+	return db.update(reviews).set({
+		status: "cancelled",
+		updatedAt: now
+	}).where(and(eq(reviews.siteId, site), eq(reviews.entryId, entryId), eq(reviews.status, "pending"), entryAt(site, entryId, version)));
+}
+/** In the batch of a publication: what the pending review asked for is published, by `userId`. */
+function approvePendingReview(db, site, entryId, version, userId, now) {
+	return db.update(reviews).set({
+		status: "approved",
+		decidedBy: userId,
+		decidedAt: now,
+		updatedAt: now
+	}).where(and(eq(reviews.siteId, site), eq(reviews.entryId, entryId), eq(reviews.status, "pending"), sql`${reviews.revisionId} = (select ${entries.headRev} from ${entries} where ${and(eq(entries.id, entryId), eq(entries.siteId, site), eq(entries.version, version))})`));
+}
+async function pendingOf(db, site, entryId) {
+	const [row] = await db.select(COLUMNS).from(reviews).innerJoin(users, eq(users.id, reviews.requestedBy)).where(and(eq(reviews.siteId, site), eq(reviews.entryId, entryId), eq(reviews.status, "pending"))).limit(1);
+	return row === void 0 ? null : toReview(row);
+}
+async function requestReview(db, clock, site, write, whyNothingChanged) {
+	const now = clock.now().toISOString();
+	const row = {
+		id: newId("rvw"),
+		siteId: site,
+		entryId: write.entryId,
+		revisionId: entries.headRev,
+		status: "pending",
+		acknowledged: JSON.stringify(write.acknowledged),
+		requestedBy: write.actor.userId,
+		requestedMeta: write.actor.meta === null ? null : JSON.stringify(write.actor.meta),
+		decidedBy: null,
+		decidedAt: null,
+		note: null,
+		createdAt: now,
+		updatedAt: now
+	};
+	let inserted;
+	try {
+		inserted = await db.insert(reviews).select(sql`select ${valuesOf(reviews, row)} from ${entries} where ${and(eq(entries.id, write.entryId), eq(entries.siteId, site), eq(entries.version, write.expectedVersion))}`).returning({ id: reviews.id });
+	} catch (error) {
+		const pending = isUniqueViolation(error) ? await pendingOf(db, site, write.entryId) : null;
+		if (pending === null) throw error;
+		return {
+			outcome: "pending_review",
+			review: pending
+		};
+	}
+	if (inserted.length === 0) return whyNothingChanged();
+	const review = await findReview(db, site, row.id);
+	if (review === null) throw new Error(`The review ${row.id} that was just written is not there`);
+	return {
+		outcome: "pending_review",
+		review
+	};
+}
+async function findReview(db, site, id) {
+	const [row] = await db.select(COLUMNS).from(reviews).innerJoin(users, eq(users.id, reviews.requestedBy)).where(and(eq(reviews.siteId, site), eq(reviews.id, id))).limit(1);
+	return row === void 0 ? null : toReview(row);
+}
+async function listReviews$1(db, site, query) {
+	return (await db.select(COLUMNS).from(reviews).innerJoin(users, eq(users.id, reviews.requestedBy)).where(and(eq(reviews.siteId, site), eq(reviews.status, query.status))).orderBy(desc(reviews.createdAt), desc(reviews.id)).limit(query.limit)).map(toReview);
+}
+async function requestChanges$1(db, clock, site, write) {
+	const now = clock.now().toISOString();
+	const [row] = await db.update(reviews).set({
+		status: "changes_requested",
+		note: write.note,
+		decidedBy: write.userId,
+		decidedAt: now,
+		updatedAt: now
+	}).where(and(eq(reviews.siteId, site), eq(reviews.id, write.id), eq(reviews.status, "pending"))).returning({ id: reviews.id });
+	const review = await findReview(db, site, write.id);
+	if (row !== void 0 && review !== null) return {
+		outcome: "changes_requested",
+		review
+	};
+	return review === null ? { outcome: "not_found" } : {
+		outcome: "not_pending",
+		review
+	};
+}
+//#endregion
+//#region src/db/size.ts
+/**
+* D1 refuses rows over 2 MB, and Miniflare does not enforce it, so the store counts the bytes of
+* a row before writing it and refuses a row over `MAX_ROW_BYTES` (`limits.ts`).
+*/
+const encoder$1 = new TextEncoder();
+/** The bytes of `text` in UTF-8, which is how D1 stores it. */
+function utf8Bytes(text) {
+	return encoder$1.encode(text).byteLength;
+}
+/** What SQLite keeps for an integer, at most. */
+const INTEGER_BYTES = 8;
+/** The bytes of every column of a row: text in UTF-8, an integer as 8 bytes, a null as none. */
+function rowBytes(row) {
+	let bytes = 0;
+	for (const value of Object.values(row)) if (typeof value === "string") bytes += utf8Bytes(value);
+	else if (value !== null) bytes += INTEGER_BYTES;
+	return bytes;
+}
+/** The refusal for a row over the limit, or `null` when it fits. */
+function tooLarge(row) {
+	const bytes = rowBytes(row);
+	return bytes > 19e5 ? {
+		outcome: "too_large",
+		bytes,
+		limit: MAX_ROW_BYTES
+	} : null;
+}
+//#endregion
 //#region src/db/writes.ts
 /**
 * Waits for a write batch. A batch that broke a unique key of `entries` has rolled back, and the
@@ -1285,6 +1229,7 @@ async function appendRevision(db, clock, site, write) {
 			tags,
 			now
 		}),
+		cancelPendingReview(db, site, write.entryId, write.expectedVersion, now),
 		db.update(entries).set({
 			version: sql`${entries.version} + 1`,
 			headRev: revisionId,
@@ -1325,14 +1270,21 @@ async function publish$2(db, clock, site, write) {
 	});
 	const refusal = tooLarge(row);
 	if (refusal !== null) return refusal;
-	const [changed] = (await db.batch([insertPublishAtVersion(db, row, write.expectedVersion), db.update(entries).set({
-		status: "published",
-		publishedRev: entries.headRev,
-		publishedAt: sql`coalesce(${entries.publishedAt}, ${now})`,
-		publishedSortKey: write.sortKey,
-		version: sql`${entries.version} + 1`,
-		updatedAt: now
-	}).where(and(eq(entries.id, write.entryId), eq(entries.siteId, site), eq(entries.version, write.expectedVersion))).returning(entryFields)]))[1];
+	const [changed] = (await db.batch([
+		insertPublishAtVersion(db, row, write.expectedVersion),
+		dropScheduleAtVersion(db, site, write.entryId, write.expectedVersion),
+		insertEventWhere(db, site, write.entryId, write.event ?? null, "entry.published", now, [eq(entries.version, write.expectedVersion)]),
+		approvePendingReview(db, site, write.entryId, write.expectedVersion, write.actor.userId, now),
+		db.update(entries).set({
+			status: "published",
+			scheduledAt: null,
+			publishedRev: entries.headRev,
+			publishedAt: sql`coalesce(${entries.publishedAt}, ${now})`,
+			publishedSortKey: write.sortKey,
+			version: sql`${entries.version} + 1`,
+			updatedAt: now
+		}).where(and(eq(entries.id, write.entryId), eq(entries.siteId, site), eq(entries.version, write.expectedVersion))).returning(entryFields)
+	]))[4];
 	if (changed === void 0) return whyNothingChanged(db, site, write.entryId);
 	const entry = toEntry(changed);
 	const revision = entry.publishedRevision === null ? null : await findRevision(db, site, entry.publishedRevision);
@@ -1345,6 +1297,72 @@ async function publish$2(db, clock, site, write) {
 		}
 	};
 }
+/** The message of the statement that aborts a group publish: SQLite fails to parse it as JSON. */
+const GROUP_MOVED = "hollware: an entry of the group is not at its version";
+/**
+* Publishes a group of entries in one batch, all or none (ADR-024). Each entry gets the two
+* statements of `publish`; a last statement fails the batch, which D1 then rolls back, when fewer
+* publications landed than the group has entries: `json()` of a text that is not JSON raises an
+* error, and it runs only then. A refusal names the entry.
+*/
+async function publishGroup$1(db, clock, site, group) {
+	const now = clock.now().toISOString();
+	const statements = [];
+	const appended = [];
+	for (const write of group) {
+		const row = publicationRow({
+			site,
+			entryId: write.entryId,
+			now,
+			actor: write.actor,
+			publish: {
+				revisionId: newId("rev"),
+				verdict: write.verdict,
+				acknowledged: write.acknowledged
+			}
+		});
+		const refusal = tooLarge(row);
+		if (refusal !== null) return {
+			...refusal,
+			entryId: write.entryId
+		};
+		appended.push(row.id);
+		statements.push(insertPublishAtVersion(db, row, write.expectedVersion), dropScheduleAtVersion(db, site, write.entryId, write.expectedVersion), insertEventWhere(db, site, write.entryId, write.event ?? null, "entry.published", now, [eq(entries.version, write.expectedVersion)]), approvePendingReview(db, site, write.entryId, write.expectedVersion, write.actor.userId, now), db.update(entries).set({
+			status: "published",
+			scheduledAt: null,
+			publishedRev: entries.headRev,
+			publishedAt: sql`coalesce(${entries.publishedAt}, ${now})`,
+			publishedSortKey: write.sortKey,
+			version: sql`${entries.version} + 1`,
+			updatedAt: now
+		}).where(and(eq(entries.id, write.entryId), eq(entries.siteId, site), eq(entries.version, write.expectedVersion))));
+	}
+	const guard = db.select({ moved: sql`json(${GROUP_MOVED})` }).from(sites).where(and(eq(sites.id, site), sql`(select count(*) from ${publications} where ${and(eq(publications.siteId, site), inArray(publications.id, appended))}) < ${group.length}`));
+	try {
+		const [first, ...rest] = [...statements, guard];
+		if (first !== void 0) await db.batch([first, ...rest]);
+	} catch (error) {
+		if (!(error instanceof Error) || !/malformed JSON/i.test(`${error.message} ${String(error.cause)}`)) throw error;
+		for (const write of group) {
+			const why = await whyNothingChanged(db, site, write.entryId);
+			if (why.outcome === "not_found" || why.currentVersion !== write.expectedVersion) return {
+				...why,
+				entryId: write.entryId
+			};
+		}
+		throw new Error("A group publish failed, and every entry of the group is at its version", { cause: error });
+	}
+	const views = [];
+	for (const write of group) {
+		const view = await findEntryById(db, site, write.entryId, "published");
+		if (view === null) throw new Error(`Entry ${write.entryId} is not published after its group`);
+		views.push(view);
+	}
+	return {
+		outcome: "published",
+		views
+	};
+}
 async function unpublish$1(db, clock, site, write) {
 	const now = clock.now().toISOString();
 	const row = publicationRow({
@@ -1356,19 +1374,47 @@ async function unpublish$1(db, clock, site, write) {
 	});
 	const refusal = tooLarge(row);
 	if (refusal !== null) return refusal;
-	await db.batch([insertUnpublishIfPublished(db, row), db.update(entries).set({
-		status: "draft",
-		publishedRev: null,
-		publishedSortKey: null,
-		version: sql`${entries.version} + 1`,
-		updatedAt: now
-	}).where(and(eq(entries.id, write.entryId), eq(entries.siteId, site), eq(entries.status, "published")))]);
+	await db.batch([
+		insertUnpublishIfPublished(db, row),
+		insertEventWhere(db, site, write.entryId, write.event ?? null, "entry.unpublished", now, [eq(entries.status, "published")]),
+		dropSchedule(db, site, write.entryId),
+		db.update(entries).set({
+			status: "draft",
+			scheduledAt: null,
+			publishedRev: null,
+			publishedSortKey: null,
+			version: sql`${entries.version} + 1`,
+			updatedAt: now
+		}).where(and(eq(entries.id, write.entryId), eq(entries.siteId, site), inArray(entries.status, ["published", "scheduled"])))
+	]);
 	const view = await findEntryById(db, site, write.entryId, "head");
 	return view === null ? { outcome: "not_found" } : {
 		outcome: "unpublished",
 		view
 	};
 }
+/** Drops the schedule of an entry in the batch that publishes it, if it is at `version`. */
+function dropScheduleAtVersion(db, site, entryId, version) {
+	return db.delete(schedules).where(and(eq(schedules.siteId, site), eq(schedules.entryId, entryId), sql`exists (select 1 from ${entries} where ${and(eq(entries.id, entryId), eq(entries.siteId, site), eq(entries.version, version))})`));
+}
+/**
+* Writes the event of a write to the outbox in its batch, only where the entry is in the state the
+* write expects, so that an event is there exactly when its write is. Nothing when there is no
+* event: a statement that selects nothing, to keep the batch the same shape.
+*/
+function insertEventWhere(db, site, entryId, event, kind, now, conditions) {
+	const row = {
+		id: event?.id ?? "evt_none",
+		siteId: site,
+		kind,
+		entryId,
+		payload: event?.payload ?? "{}",
+		sentAt: null,
+		createdAt: now,
+		updatedAt: now
+	};
+	return db.insert(outbox).select(sql`select ${valuesOf(outbox, row)} from ${entries} where ${and(eq(entries.id, entryId), eq(entries.siteId, site), sql`${event === null ? 0 : 1} = 1`, ...conditions)}`);
+}
 //#endregion
 //#region src/db/store.ts
 const systemClock$1 = { now: () => /* @__PURE__ */ new Date() };
@@ -1390,10 +1436,220 @@ function createD1Store(db, options = {}) {
 		createEntry: (site, entry) => createEntry(database, clock, site, entry),
 		appendRevision: (site, write) => appendRevision(database, clock, site, write),
 		publish: (site, write) => publish$2(database, clock, site, write),
-		unpublish: (site, write) => unpublish$1(database, clock, site, write)
+		publishGroup: (site, group) => publishGroup$1(database, clock, site, group),
+		schedule: (site, write) => schedule(database, clock, site, write),
+		dueSchedules: (site, now) => dueSchedules(database, site, now),
+		cancelSchedule: (site, entryId) => cancelSchedule(database, clock, site, entryId),
+		unpublish: (site, write) => unpublish$1(database, clock, site, write),
+		requestReview: (site, write) => requestReview(database, clock, site, write, () => whyNothingChanged(database, site, write.entryId)),
+		findReview: (site, id) => findReview(database, site, id),
+		listReviews: (site, query) => listReviews$1(database, site, query),
+		requestChanges: (site, write) => requestChanges$1(database, clock, site, write)
+	};
+}
+//#endregion
+//#region src/db/events.ts
+async function findEvent(db, site, id) {
+	const [row] = await db.select({
+		id: outbox.id,
+		kind: outbox.kind,
+		payload: outbox.payload
+	}).from(outbox).where(and(eq(outbox.siteId, site), eq(outbox.id, id))).limit(1);
+	return row ?? null;
+}
+/** The events that were never put on the Queue and are older than `before`, oldest first. */
+async function unsentEvents(db, site, before, limit = 100) {
+	return (await db.select({ id: outbox.id }).from(outbox).where(and(eq(outbox.siteId, site), isNull(outbox.sentAt), lte(outbox.createdAt, before))).orderBy(outbox.createdAt).limit(limit)).map((row) => row.id);
+}
+async function markSent(db, site, ids, now) {
+	if (ids.length === 0) return;
+	await db.update(outbox).set({
+		sentAt: now,
+		updatedAt: now
+	}).where(and(eq(outbox.siteId, site), inArray(outbox.id, [...ids])));
+}
+/** The subscribers that already have an event, so that a retry never delivers it twice. */
+async function deliveredTo(db, site, eventId) {
+	const rows = await db.select({
+		subscriber: deliveries.subscriber,
+		deliveredAt: deliveries.deliveredAt
+	}).from(deliveries).where(and(eq(deliveries.siteId, site), eq(deliveries.eventId, eventId)));
+	return new Set(rows.filter((row) => row.deliveredAt !== null).map((row) => row.subscriber));
+}
+/** Records one attempt to deliver an event to a subscriber, and its result. */
+async function recordAttempt(db, input) {
+	const deliveredAt = input.error === null ? input.now : null;
+	await db.insert(deliveries).values({
+		id: newId("dlv"),
+		siteId: input.site,
+		eventId: input.eventId,
+		subscriber: input.subscriber,
+		attempts: 1,
+		deliveredAt,
+		lastError: input.error,
+		createdAt: input.now,
+		updatedAt: input.now
+	}).onConflictDoUpdate({
+		target: [deliveries.eventId, deliveries.subscriber],
+		set: {
+			attempts: sqlIncrement(),
+			deliveredAt,
+			lastError: input.error,
+			updatedAt: input.now
+		}
+	});
+}
+function sqlIncrement() {
+	return sql`${deliveries.attempts} + 1`;
+}
+//#endregion
+//#region src/events/deliver.ts
+/** Where IndexNow takes the URLs that changed. */
+const INDEXNOW_ENDPOINT = "https://api.indexnow.org/indexnow";
+async function ensureOk(response, what) {
+	if (response.ok) return;
+	throw new Error(`${what} answered ${response.status}`);
+}
+/** The subscribers that the config of the site declares (ADR-025). */
+function subscribersOf(deps) {
+	const { site } = deps;
+	const subscribers = site.events.webhooks.map((webhook) => ({
+		name: `webhook:${webhook.name}`,
+		async send(payload, body) {
+			const secret = deps.secret(webhook.secret);
+			if (secret === void 0) throw new Error(`the secret ${webhook.secret} is not set`);
+			const timestamp = Math.floor(deps.clock.now().getTime() / 1e3);
+			const request = new Request(webhook.url, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					[EVENT_ID_HEADER]: payload.id,
+					[TIMESTAMP_HEADER]: String(timestamp),
+					[SIGNATURE_HEADER]: await signWebhook(secret, timestamp, body)
+				},
+				body
+			});
+			await ensureOk(await deps.fetch(request), `the webhook ${webhook.name}`);
+		}
+	}));
+	const indexNow = site.events.indexNow;
+	if (indexNow !== null && site.url !== null) {
+		const host = new URL(site.url).host;
+		subscribers.push({
+			name: "indexnow",
+			async send(payload) {
+				if (payload.url === null) return;
+				const key = deps.secret(indexNow.key);
+				if (key === void 0) throw new Error(`the secret ${indexNow.key} is not set`);
+				const request = new Request(INDEXNOW_ENDPOINT, {
+					method: "POST",
+					headers: { "content-type": "application/json; charset=utf-8" },
+					body: JSON.stringify({
+						host,
+						key,
+						urlList: [payload.url]
+					})
+				});
+				await ensureOk(await deps.fetch(request), "IndexNow");
+			}
+		});
+	}
+	return subscribers;
+}
+/**
+* Delivers one event of the outbox to every subscriber that does not have it yet, and records each
+* attempt. A subscriber that fails is tried again on the next delivery of the event, and one that
+* succeeded is never sent it again: the caller retries the message while `failed` is not empty.
+* An event that is gone, or a site without subscribers, delivers nothing.
+*/
+async function deliverEvent(deps, eventId) {
+	const event = await findEvent(deps.db, deps.site.key, eventId);
+	if (event === null) return {
+		delivered: [],
+		failed: []
+	};
+	const payload = JSON.parse(event.payload);
+	const done = await deliveredTo(deps.db, deps.site.key, eventId);
+	const delivered = [];
+	const failed = [];
+	for (const subscriber of subscribersOf(deps)) {
+		if (done.has(subscriber.name)) continue;
+		let error = null;
+		try {
+			await subscriber.send(payload, event.payload);
+		} catch (cause) {
+			error = cause instanceof Error ? cause.message : String(cause);
+		}
+		await recordAttempt(deps.db, {
+			site: deps.site.key,
+			eventId,
+			subscriber: subscriber.name,
+			now: deps.clock.now().toISOString(),
+			error
+		});
+		(error === null ? delivered : failed).push(subscriber.name);
+	}
+	return {
+		delivered,
+		failed
 	};
 }
 //#endregion
+//#region src/events/run.ts
+/**
+* Puts events on the Queue and marks them sent. Without a Queue binding nothing is sent: the
+* sweep of the cron trigger delivers them instead, within a minute.
+*/
+async function enqueue(input) {
+	if (input.queue === void 0 || input.ids.length === 0) return;
+	await input.queue.sendBatch(input.ids.map((id) => ({ body: {
+		site: input.site,
+		id
+	} })));
+	await markSent(input.db, input.site, input.ids, input.clock.now().toISOString());
+}
+/**
+* What the cron trigger does with the outbox: an event that was never put on the Queue (its
+* request ended before, or the project has no Queue) is put on it, or, without a Queue, delivered
+* here. An event delivered here is marked sent only when every subscriber has it.
+*/
+async function sweepOutbox(input) {
+	const { deps, queue } = input;
+	const now = deps.clock.now().toISOString();
+	const ids = await unsentEvents(deps.db, deps.site.key, now);
+	if (queue !== void 0) {
+		await enqueue({
+			queue,
+			db: deps.db,
+			site: deps.site.key,
+			ids,
+			clock: deps.clock
+		});
+		return { swept: ids.length };
+	}
+	for (const id of ids) if ((await deliverEvent(deps, id)).failed.length === 0) await markSent(deps.db, deps.site.key, [id], now);
+	return { swept: ids.length };
+}
+function isEventMessage(body) {
+	return typeof body === "object" && body !== null && "site" in body && "id" in body && typeof body.site === "string" && typeof body.id === "string";
+}
+/**
+* The Queue consumer: delivers each event, acknowledges it once every subscriber has it, and asks
+* for a retry otherwise; after the Queue's retries it lands in the dead-letter queue. A message of
+* another site, or that is no event, is acknowledged and dropped.
+*/
+async function consumeEvents(messages, deps) {
+	for (const message of messages) {
+		const { body } = message;
+		if (!isEventMessage(body) || body.site !== deps.site.key) {
+			message.ack();
+			continue;
+		}
+		if ((await deliverEvent(deps, body.id)).failed.length === 0) message.ack();
+		else message.retry();
+	}
+}
+//#endregion
 //#region src/mcp/errors.ts
 /**
 * The error a caller gets for anything that is not a `HollwareError`. The message is fixed: what
@@ -1448,45 +1704,1081 @@ function gatewayError(status, body) {
 	});
 }
 /**
-* Everything that differs between Hono 4 and Hono 5 error handling lives in this file (spike S1).
-*
-* Hono 4: `app.onError((error, c) => Response)`, one handler for the app.
-* Hono 5: `app.onError((c, next) => Response)` registers error middleware, and the error is
-* `c.error`. A Hono 4 handler registered on Hono 5 is not rejected: it is called with the context
-* where it expects the error, throws, and the app answers a plain-text 500. So the tests read the
-* JSON body of both answers.
+* Everything that differs between Hono 4 and Hono 5 error handling lives in this file (spike S1).
+*
+* Hono 4: `app.onError((error, c) => Response)`, one handler for the app.
+* Hono 5: `app.onError((c, next) => Response)` registers error middleware, and the error is
+* `c.error`. A Hono 4 handler registered on Hono 5 is not rejected: it is called with the context
+* where it expects the error, throws, and the app answers a plain-text 500. So the tests read the
+* JSON body of both answers.
+*
+* - An error that a route throws is a JSON 500 with a fixed message, and the id of the request
+*   in its fix, which is how the operator finds the line of the log that has the cause. The cause
+*   goes to the log and never to the caller, whose agent could repeat it to a person or to another
+*   system. This holds for every error, a failed D1 query included: nothing turns one into a 401.
+* - A path that no route has is a JSON 404.
+*/
+function installErrorHandling(app, log) {
+	app.onError((c) => {
+		const requestId = c.get("requestId");
+		log({
+			kind: "request_error",
+			requestId,
+			method: c.req.method,
+			path: c.req.path,
+			detail: describeError(c.error)
+		});
+		return gatewayError(500, {
+			code: "internal",
+			message: "The request failed on the server.",
+			fix: `Try again. If it keeps failing, give the site operator this request id: ${requestId}.`
+		});
+	});
+	app.notFound(() => gatewayError(404, {
+		code: "not_found",
+		message: "This Hollware has no route for that path.",
+		fix: "Send MCP requests to /mcp with \"Authorization: Bearer <token>\". GET /health tells whether the Worker is up."
+	}));
+}
+//#endregion
+//#region src/oauth/admin.ts
+/**
+* The admin as a client of the OAuth server (ADR-026): a public client, with PKCE, that a person
+* never has to allow. It is registered once per issuer, with `createClient`, and its id is kept in
+* `OAUTH_KV` beside the library's own records. A Client ID Metadata Document would need an `https`
+* URL that the Worker fetches from itself, which local development does not have.
+*/
+/** Where the admin's id is kept, by issuer. The library's own keys never start with it. */
+const KEY = "hollware:admin-client:";
+/**
+* The admin's client, registered on first use. Two first requests at once may both register one:
+* the last id written wins, and the other client is never used.
+*/
+async function adminClient(oauth, env) {
+	const redirectUri = `${oauth.issuer}/admin/callback`;
+	const stored = await env.OAUTH_KV.get(`${KEY}${oauth.issuer}`);
+	if (stored !== null) return {
+		clientId: stored,
+		redirectUri
+	};
+	const client = await oauth.authorizationServer.getOAuthApi(env).createClient({
+		clientName: "Hollware admin",
+		redirectUris: [redirectUri],
+		tokenEndpointAuthMethod: "none"
+	});
+	await env.OAUTH_KV.put(`${KEY}${oauth.issuer}`, client.clientId);
+	return {
+		clientId: client.clientId,
+		redirectUri
+	};
+}
+//#endregion
+//#region src/http/admin.ts
+/**
+* The admin at `/admin/` (ADR-026). Its hashed files are static assets that never reach the
+* Worker (`run_worker_first` in wrangler.jsonc); its page does, so that it goes out with the
+* policy below, and so does every path of the single-page app, which all get the same page. The
+* page learns how to sign in from `/admin/config.json`.
+*/
+/**
+* What the admin's page may do: its own scripts and styles (CodeMirror and Nuxt UI write style
+* elements and attributes, hence `unsafe-inline` for styles only), images of the content from
+* anywhere over https, and requests to this origin alone. Nothing frames it.
+*/
+const POLICY = [
+	"default-src 'self'",
+	"script-src 'self'",
+	"style-src 'self' 'unsafe-inline'",
+	"img-src 'self' data: https:",
+	"connect-src 'self'",
+	"font-src 'self' data:",
+	"base-uri 'none'",
+	"form-action 'self'",
+	"frame-ancestors 'none'"
+].join("; ");
+function notInstalled() {
+	return Response.json({
+		code: "not_found",
+		message: "The admin is not installed in this Worker.",
+		fix: "Bind the static assets as ASSETS and serve the files of @hollware/admin (adminAssets()), as the starter does."
+	}, {
+		status: 404,
+		headers: { "cache-control": "no-store" }
+	});
+}
+function installAdmin(app, options) {
+	app.get("/admin/config.json", async (c) => {
+		const oauth = options.oauth(c.env.HOLLWARE_PUBLIC_URL);
+		const client = await adminClient(oauth, c.env);
+		return c.json({
+			issuer: oauth.issuer,
+			clientId: client.clientId,
+			redirectUri: client.redirectUri,
+			resource: oauth.resources.v1,
+			scope: SCOPES.join(" ")
+		}, 200, { "cache-control": "no-store" });
+	});
+	const page = async (c) => {
+		const assets = c.env.ASSETS;
+		if (assets === void 0) return notInstalled();
+		const origin = options.oauth(c.env.HOLLWARE_PUBLIC_URL).issuer;
+		const answer = await assets.fetch(new Request(`${origin}/admin/`));
+		if (!answer.ok) return notInstalled();
+		const headers = new Headers(answer.headers);
+		headers.set("content-security-policy", POLICY);
+		headers.set("cache-control", "no-store");
+		headers.set("x-content-type-options", "nosniff");
+		headers.set("referrer-policy", "no-referrer");
+		return new Response(answer.body, {
+			status: 200,
+			headers
+		});
+	};
+	app.get("/admin", (c) => c.redirect("/admin/", 301));
+	app.get("/admin/", page);
+	app.get("/admin/*", async (c) => {
+		if (/\.[a-z0-9]+$/i.test(c.req.path)) {
+			const assets = c.env.ASSETS;
+			if (assets === void 0) return notInstalled();
+			return assets.fetch(c.req.raw);
+		}
+		return page(c);
+	});
+}
+//#endregion
+//#region src/http/admin-api.ts
+/**
+* What only a person in the admin may do (ADR-026): see, make and revoke personal tokens, and
+* invite people. These are no operations, so no agent sees them over MCP, and a request needs an
+* access token of the admin's own client with `schema:admin`: a personal token, or a token of
+* another client, never reaches them, even an owner's. A leaked token cannot mint the next one.
+*/
+/** A personal token lasts this long unless the person says otherwise (as `hollware token create`). */
+const TOKEN_DAYS = 90;
+const INVITATION_DAYS = 7;
+function json$1(body, status = 200) {
+	return Response.json(body, {
+		status,
+		headers: { "cache-control": "no-store" }
+	});
+}
+function refused(message, fix, status = 400) {
+	return json$1({
+		code: status === 400 ? "invalid_input" : "forbidden",
+		message,
+		fix
+	}, status);
+}
+function parseScopes(json) {
+	try {
+		const value = JSON.parse(json);
+		return Array.isArray(value) ? value.filter((scope) => typeof scope === "string" && isScope(scope)) : [];
+	} catch {
+		return [];
+	}
+}
+function daysFrom(value, fallback) {
+	if (value === void 0) return fallback;
+	return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 365 ? value : null;
+}
+function installAdminApi(app, options) {
+	/** Runs `handle` for a person in the admin with `schema:admin`; anyone else is refused. */
+	const admin = (handle) => (c) => options.protect(c, async (principal) => {
+		const ours = (await adminClient(options.oauth(c.env.HOLLWARE_PUBLIC_URL), c.env)).clientId;
+		if (principal.kind !== "oauth" || principal.clientId !== ours) return refused("Only the admin may do this.", "Sign in to the admin at /admin/ and do it there.", 403);
+		if (!principal.scopes.includes("schema:admin")) return insufficientScope(["schema:admin"], options.metadataUrl(c));
+		return handle(c, principal);
+	});
+	const body = async (c) => {
+		const value = await c.req.json().catch(() => null);
+		return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : {};
+	};
+	app.get("/v1/admin/tokens", admin(async (c) => {
+		return json$1({ tokens: (await connect(c.env.DB).select({
+			id: tokens.id,
+			label: tokens.label,
+			scopes: tokens.scopes,
+			user: users.name,
+			expiresAt: tokens.expiresAt,
+			revokedAt: tokens.revokedAt,
+			lastUsedAt: tokens.lastUsedAt,
+			createdAt: tokens.createdAt
+		}).from(tokens).innerJoin(users, eq(users.id, tokens.userId)).where(eq(tokens.siteId, options.site)).orderBy(desc(tokens.createdAt), desc(tokens.id))).map((row) => ({
+			...row,
+			scopes: parseScopes(row.scopes)
+		})) });
+	}));
+	app.post("/v1/admin/tokens", admin(async (c, person) => {
+		const input = await body(c);
+		const label = typeof input["label"] === "string" ? input["label"].trim() : "";
+		if (label === "" || label.length > 100) return refused("A token needs a label of 1 to 100 characters.", "Say what the token is for.");
+		const asked = Array.isArray(input["scopes"]) ? input["scopes"].filter((s) => typeof s === "string") : [];
+		const scopes = person.scopes.filter((scope) => asked.includes(scope));
+		if (scopes.length === 0) return refused("A token needs at least one scope that you have.", `Choose among ${person.scopes.join(", ")}.`);
+		const days = daysFrom(input["expiresInDays"], TOKEN_DAYS);
+		if (days === null) return refused("expiresInDays is a whole number from 1 to 365.", "Leave it out for 90 days.");
+		const now = options.clock.now();
+		const secret = generatePersonalToken();
+		const row = {
+			id: newId("tok"),
+			siteId: options.site,
+			userId: person.userId,
+			label,
+			hash: await hashPersonalToken(secret),
+			scopes: JSON.stringify(scopes),
+			expiresAt: new Date(now.getTime() + days * 864e5).toISOString(),
+			revokedAt: null,
+			lastUsedAt: null,
+			createdAt: now.toISOString(),
+			updatedAt: now.toISOString()
+		};
+		await connect(c.env.DB).insert(tokens).values(row);
+		return json$1({
+			id: row.id,
+			label,
+			scopes,
+			expiresAt: row.expiresAt,
+			secret
+		}, 201);
+	}));
+	app.post("/v1/admin/tokens/:id/revoke", admin(async (c) => {
+		const now = options.clock.now().toISOString();
+		const db = connect(c.env.DB);
+		const id = c.req.param("id") ?? "";
+		const [revoked] = await db.update(tokens).set({
+			revokedAt: now,
+			updatedAt: now
+		}).where(and(eq(tokens.siteId, options.site), eq(tokens.id, id), isNull(tokens.revokedAt))).returning({ id: tokens.id });
+		if (revoked !== void 0) return json$1({
+			id: revoked.id,
+			revokedAt: now
+		});
+		const [row] = await db.select({
+			id: tokens.id,
+			revokedAt: tokens.revokedAt
+		}).from(tokens).where(and(eq(tokens.siteId, options.site), eq(tokens.id, id)));
+		return row === void 0 ? refused("There is no such token.", "List the tokens and pick one of them.", 404) : json$1({
+			id: row.id,
+			revokedAt: row.revokedAt
+		});
+	}));
+	app.get("/v1/admin/people", admin(async (c) => {
+		const db = connect(c.env.DB);
+		const now = options.clock.now().toISOString();
+		return json$1({
+			people: await db.select({
+				id: users.id,
+				name: users.name,
+				role: members.role,
+				since: members.createdAt
+			}).from(members).innerJoin(users, eq(users.id, members.userId)).where(eq(members.siteId, options.site)).orderBy(members.createdAt, users.id),
+			invitations: await db.select({
+				id: invitations.id,
+				role: invitations.role,
+				expiresAt: invitations.expiresAt
+			}).from(invitations).where(and(eq(invitations.siteId, options.site), isNull(invitations.usedAt), isNull(invitations.userId), gt(invitations.expiresAt, now))).orderBy(desc(invitations.createdAt))
+		});
+	}));
+	app.post("/v1/admin/invitations", admin(async (c) => {
+		const input = await body(c);
+		const role = input["role"];
+		if (typeof role !== "string" || !isRole(role) || role === "owner") return refused("An invitation is for an editor or an author.", `Use role "editor" (${ROLE_SCOPES.editor.join(", ")}) or "author" (${ROLE_SCOPES.author.join(", ")}).`);
+		const days = daysFrom(input["days"], INVITATION_DAYS);
+		if (days === null) return refused("days is a whole number from 1 to 365.", "Leave it out for 7 days.");
+		const made = await createInvitation(connect(c.env.DB), {
+			site: options.site,
+			role,
+			userId: null,
+			now: options.clock.now(),
+			days
+		});
+		const origin = options.oauth(c.env.HOLLWARE_PUBLIC_URL).issuer;
+		return json$1({
+			id: made.id,
+			role,
+			expiresAt: made.expiresAt,
+			link: `${origin}/setup?invitation=${made.secret}`
+		}, 201);
+	}));
+}
+//#endregion
+//#region src/http/ops-api.ts
+const STATUS$1 = {
+	invalid_input: 400,
+	unknown_collection: 404,
+	unknown_locale: 404,
+	timeout: 504
+};
+function json(body, status = 200) {
+	return Response.json(body, {
+		status,
+		headers: { "cache-control": "no-store" }
+	});
+}
+/** Calls the handler of an operation with input its spec has parsed. */
+function invoke$1(handlers, spec, input, context) {
+	const handler = handlers[spec.name];
+	return handler(input, context);
+}
+function installOpsApi(app, options) {
+	app.post("/v1/ops/:name", async (c) => options.protect(c, async (principal) => {
+		const requestId = c.get("requestId");
+		const spec = OPERATIONS.find((operation) => operation.name === c.req.param("name"));
+		if (spec === void 0) return json({
+			code: "invalid_input",
+			message: `There is no operation ${c.req.param("name")}.`,
+			fix: "Use the name of an operation, as tools/list of MCP lists them."
+		}, 404);
+		const scopes = spec.scopes;
+		if (missingScopes(principal, scopes).length > 0) return insufficientScope(scopes, options.metadataUrl(c));
+		const body = await c.req.json().catch(() => void 0);
+		const parsed = spec.input.safeParse(body ?? {});
+		if (!parsed.success) {
+			const issues = parsed.error.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`);
+			return json({
+				code: "invalid_input",
+				message: `The input of ${spec.name} is not valid: ${issues.join("; ")}`,
+				fix: "Send the input of the operation as its input schema describes it."
+			}, 400);
+		}
+		const context = {
+			site: options.site,
+			principal,
+			view: "head",
+			store: createD1Store(c.env.DB, { clock: options.clock }),
+			clock: options.clock,
+			client: { name: "hollware-admin" },
+			requestId,
+			notify: options.notify(c, requestId)
+		};
+		try {
+			return json(spec.output.parse(await invoke$1(options.handlers, spec, parsed.data, context)));
+		} catch (error) {
+			if (error instanceof HollwareError) return json({
+				code: error.code,
+				message: error.message,
+				fix: error.fix
+			}, STATUS$1[error.code] ?? 500);
+			options.log({
+				kind: "request_error",
+				requestId,
+				method: "POST",
+				path: c.req.path,
+				detail: describeError(error)
+			});
+			return json({
+				code: "internal",
+				message: "The operation failed on the server.",
+				fix: `Try again. If it keeps failing, give the site operator this request id: ${requestId}.`
+			}, 500);
+		}
+	}));
+}
+//#endregion
+//#region src/http/read-api.ts
+const STATUS = {
+	invalid_input: 400,
+	unknown_collection: 404,
+	unknown_locale: 404
+};
+/** A weak ETag of a body: the first 128 bits of its SHA-256, in hex. */
+async function etagOf(body) {
+	const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(body)));
+	return `W/"${Array.from(digest.slice(0, 16), (byte) => byte.toString(16).padStart(2, "0")).join("")}"`;
+}
+/** Whether `If-None-Match` names this ETag, or is `*`. */
+function matches(header, etag) {
+	if (header === void 0) return false;
+	return header.split(",").map((tag) => tag.trim()).some((tag) => tag === "*" || tag === etag || `W/${tag}` === etag);
+}
+async function answer(c, value) {
+	const notFound = typeof value === "object" && value !== null && "outcome" in value && value.outcome === "not_found";
+	const body = JSON.stringify(value);
+	const etag = await etagOf(body);
+	const headers = {
+		etag,
+		"cache-control": "private, no-cache",
+		"content-type": "application/json"
+	};
+	if (!notFound && matches(c.req.header("if-none-match"), etag)) return new Response(null, {
+		status: 304,
+		headers
+	});
+	return new Response(body, {
+		status: notFound ? 404 : 200,
+		headers
+	});
+}
+function installReadApi(app, options) {
+	app.use("/v1/*", async (c, next) => {
+		if (c.req.path.startsWith("/v1/ops/") || c.req.path.startsWith("/v1/admin/")) return next();
+		if (c.req.method !== "GET" && c.req.method !== "HEAD") return c.json({
+			code: "invalid_input",
+			message: "The read API only reads.",
+			fix: "Use GET."
+		}, 405, { allow: "GET, HEAD" });
+		if (c.req.path === "/v1/openapi.json") return next();
+		return options.protect(c, async (principal) => {
+			if (!principal.scopes.includes("content:read")) return insufficientScope(["content:read"], options.metadataUrl(c));
+			try {
+				await next();
+				return c.res;
+			} catch (error) {
+				if (!(error instanceof HollwareError)) throw error;
+				return c.json({
+					code: error.code,
+					message: error.message,
+					fix: error.fix
+				}, STATUS[error.code] ?? 500);
+			}
+		});
+	});
+	app.get("/v1/openapi.json", (c) => c.json(openApiDocument(options.site)));
+	app.get("/v1/site", async (c) => answer(c, await options.read(c.env).describeSite(options.site)));
+	app.get("/v1/:collection", async (c) => {
+		const query = c.req.query();
+		const limit = query["limit"] === void 0 ? void 0 : Number(query["limit"]);
+		return answer(c, await options.read(c.env).listEntries(options.site, c.req.param("collection"), {
+			...query["locale"] === void 0 ? {} : { locale: query["locale"] },
+			...query["tag"] === void 0 ? {} : { tag: query["tag"] },
+			...limit === void 0 ? {} : { limit },
+			...query["cursor"] === void 0 ? {} : { cursor: query["cursor"] }
+		}));
+	});
+	app.get("/v1/:collection/translations/:group", async (c) => answer(c, await options.read(c.env).getTranslations(options.site, c.req.param("collection"), c.req.param("group"))));
+	app.get("/v1/:collection/:locale/:slug", async (c) => {
+		const formats = c.req.query("formats");
+		return answer(c, await options.read(c.env).getEntry(options.site, c.req.param("collection"), c.req.param("slug"), c.req.param("locale"), formats === void 0 ? {} : { formats: formats.split(",").flatMap((format) => format === "markdown" || format === "document" || format === "html" ? [format] : []) }));
+	});
+}
+/** The OpenAPI 3.1 document of the read API. */
+function openApiDocument(site) {
+	const ok = (description) => ({
+		description,
+		headers: { ETag: { schema: { type: "string" } } },
+		content: { "application/json": { schema: { type: "object" } } }
+	});
+	const common = {
+		"304": { description: "Not modified: the ETag of If-None-Match is current." },
+		"401": { description: "No token, or one that is unknown, expired or revoked. The challenge names the protected resource metadata." },
+		"403": { description: "The token lacks content:read." }
+	};
+	const param = (name, location, required) => ({
+		name,
+		in: location,
+		required,
+		schema: { type: "string" }
+	});
+	return {
+		openapi: "3.1.0",
+		info: {
+			title: `Hollware read API (${site})`,
+			version: "1"
+		},
+		components: { securitySchemes: { token: {
+			type: "http",
+			scheme: "bearer"
+		} } },
+		security: [{ token: [] }],
+		paths: {
+			"/v1/site": { get: {
+				operationId: "describe_site",
+				responses: {
+					"200": ok("The site"),
+					...common
+				}
+			} },
+			"/v1/{collection}": { get: {
+				operationId: "list_entries",
+				parameters: [
+					param("collection", "path", true),
+					param("locale", "query", false),
+					param("tag", "query", false),
+					param("limit", "query", false),
+					param("cursor", "query", false)
+				],
+				responses: {
+					"200": ok("A page of published entries"),
+					...common
+				}
+			} },
+			"/v1/{collection}/translations/{group}": { get: {
+				operationId: "get_translations",
+				parameters: [param("collection", "path", true), param("group", "path", true)],
+				responses: {
+					"200": ok("The published entries of the group"),
+					"404": { description: "No such group" },
+					...common
+				}
+			} },
+			"/v1/{collection}/{locale}/{slug}": { get: {
+				operationId: "get_entry",
+				parameters: [
+					param("collection", "path", true),
+					param("locale", "path", true),
+					param("slug", "path", true),
+					param("formats", "query", false)
+				],
+				responses: {
+					"200": ok("A published entry"),
+					"404": { description: "No such published entry" },
+					...common
+				}
+			} }
+		}
+	};
+}
+//#endregion
+//#region src/identity/pages.ts
+/**
+* The pages a person sees to get in (ADR-026): set up a passkey from a link, and sign in. They
+* are rendered by the Worker, outside the admin's bundle, with one inline script under a nonce
+* and nothing framing them. The script uses the WebAuthn JSON methods of the browser
+* (`PublicKeyCredential.parseCreationOptionsFromJSON`, `credential.toJSON()`), and reads the
+* invitation from the address bar, so the page never prints it.
+*/
+const STYLE = `body{font:1rem/1.5 system-ui,sans-serif;max-width:28rem;margin:4rem auto;padding:0 1rem;color:#1d1d1f}
+label{display:block;margin:.75rem 0 .25rem}input{width:100%;padding:.5rem;font:inherit}
+button{margin-top:1rem;padding:.6rem 1rem;font:inherit;cursor:pointer}[role=alert]{color:#b00020}`;
+const POST = `async function post(path, body) {
+  const response = await fetch(path, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) })
+  const data = await response.json()
+  if (!response.ok) throw new Error(data.message + ' ' + (data.fix ?? ''))
+  return data
+}
+function fail(error) { document.getElementById('error').textContent = error.message }`;
+function page(title, nonce, body, script) {
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title} · Hollware</title>
+<style>${STYLE}</style>
+</head>
+<body>
+<main>
+<h1>${title}</h1>
+${body}
+<p id="error" role="alert"></p>
+</main>
+<script nonce="${nonce}">${POST}
+${script}<\/script>
+</body>
+</html>
+`;
+}
+function setupPage(nonce) {
+	return page("Set up your passkey", nonce, `<p>A passkey lets you into this Hollware with your device's lock: no password.</p>
+<form id="form">
+<label for="name">Your name</label><input id="name" name="name" autocomplete="name">
+<label for="label">This device</label><input id="label" name="label" value="Passkey">
+<button type="submit">Create the passkey</button>
+</form>`, `document.getElementById('form').addEventListener('submit', async (event) => {
+  event.preventDefault()
+  try {
+    const invitation = new URLSearchParams(location.search).get('invitation') ?? ''
+    const { challengeId, options } = await post('/auth/register/options', { invitation })
+    const credential = await navigator.credentials.create({ publicKey: PublicKeyCredential.parseCreationOptionsFromJSON(options) })
+    await post('/auth/register/verify', { challengeId, response: credential.toJSON(), name: document.getElementById('name').value, label: document.getElementById('label').value })
+    location.href = '/admin/'
+  } catch (error) { fail(error) }
+})`);
+}
+function signInPage(nonce) {
+	return page("Sign in", nonce, `<p>Sign in to this Hollware with your passkey.</p>
+<button id="signin" type="button">Sign in with a passkey</button>`, `document.getElementById('signin').addEventListener('click', async () => {
+  try {
+    const { challengeId, options } = await post('/auth/signin/options', {})
+    const credential = await navigator.credentials.get({ publicKey: PublicKeyCredential.parseRequestOptionsFromJSON(options) })
+    await post('/auth/signin/verify', { challengeId, response: credential.toJSON() })
+    const target = new URLSearchParams(location.search).get('return_to') ?? '/admin/'
+    location.href = target.startsWith('/') && !target.startsWith('//') ? target : '/admin/'
+  } catch (error) { fail(error) }
+})`);
+}
+/** The headers of a page: no framing, only its own script, and no caching. */
+function pageHeaders(nonce) {
+	return {
+		"content-type": "text/html; charset=utf-8",
+		"cache-control": "no-store",
+		"content-security-policy": `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'unsafe-inline'; connect-src 'self'; form-action 'none'; base-uri 'none'; frame-ancestors 'none'`,
+		"x-content-type-options": "nosniff",
+		"referrer-policy": "no-referrer"
+	};
+}
+/** Text for HTML: every string a client chose (its name, its redirect host, a scope) goes through it. */
+function escapeHtml(value) {
+	return value.replace(/[&<>"']/g, (char) => `&#${char.charCodeAt(0)};`);
+}
+/** What a scope lets a client do, in the words of the consent page. */
+const SCOPE_WORDS = {
+	"content:read": "Read the content, drafts included",
+	"content:write": "Write drafts",
+	"content:publish": "Publish and unpublish",
+	"schema:admin": "Change the site settings"
+};
+/**
+* The consent page of `/authorize` (ADR-026): which client asks, where the tokens go, and what it
+* may do, with Allow and Deny. It has no script, and it posts the handle that `beginConsent` bound
+* to this browser. Everything the client chose is escaped.
+*/
+function consentPage(view) {
+	const name = escapeHtml(view.clientName);
+	const origin = view.clientDomain === void 0 ? "<p>This app registered itself: its name is not verified.</p>" : `<p>Published by <strong>${escapeHtml(view.clientDomain)}</strong>.</p>`;
+	const loopback = view.redirectIsLoopback ? "<p><strong>This sends access to an app on this computer.</strong> Continue only if you just started to connect it.</p>" : "";
+	const scopes = view.scopes.map((scope) => `<label><input type="checkbox" name="scope" value="${escapeHtml(scope)}" checked> ${escapeHtml(SCOPE_WORDS[scope] ?? scope)} <code>${escapeHtml(scope)}</code></label>`).join("\n");
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Allow ${name} · Hollware</title>
+<style>${STYLE}label input{width:auto;margin-right:.5rem}</style>
+</head>
+<body>
+<main>
+<h1>Allow ${name} to use this Hollware?</h1>
+${origin}
+<p>Signed in as <strong>${escapeHtml(view.person)}</strong>. Access goes to <strong>${escapeHtml(view.redirectHost)}</strong>.</p>
+${loopback}
+<form method="post" action="/authorize">
+<input type="hidden" name="handle" value="${escapeHtml(view.handle)}">
+${scopes}
+<p><button name="decision" value="approve">Allow</button> <button name="decision" value="deny">Deny</button></p>
+</form>
+</main>
+</body>
+</html>
+`;
+}
+/** A page that only says what went wrong and what to do. */
+function messagePage(title, message) {
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)} · Hollware</title>
+<style>${STYLE}</style>
+</head>
+<body>
+<main>
+<h1>${escapeHtml(title)}</h1>
+<p>${escapeHtml(message)}</p>
+</main>
+</body>
+</html>
+`;
+}
+/**
+* The headers of a page without a script: no framing and no caching. The form of the consent page
+* posts to `/authorize`, which redirects to the client, so `form-action` is not restricted: a
+* browser applies it to the redirect too.
+*/
+function plainPageHeaders() {
+	return {
+		"content-type": "text/html; charset=utf-8",
+		"cache-control": "no-store",
+		"content-security-policy": `default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'`,
+		"x-content-type-options": "nosniff",
+		"referrer-policy": "no-referrer"
+	};
+}
+//#endregion
+//#region src/identity/routes.ts
+/**
+* The ceremonies, with SimpleWebAuthn and its parsers, in a chunk of their own: only these four
+* routes use them, and a Worker that serves MCP never pays for them at startup (`budgets.json`).
+*/
+const ceremonies = () => import("./ceremonies-D7tsWU3S.mjs");
+/** The cookie of a signed-in person: only `/authorize` reads it (ADR-026). */
+const SESSION_COOKIE = "hollware_session";
+function sessionCookie(secret) {
+	return `${SESSION_COOKIE}=${secret}; HttpOnly; Secure; SameSite=Lax; Path=/authorize; Max-Age=43200`;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The setup and sign-in pages, and the four steps of the passkey ceremonies. */
+function installIdentity(app, options) {
+	const ceremony = (c) => ({
+		db: connect(c.env.DB),
+		site: options.site,
+		publicUrl: c.env.HOLLWARE_PUBLIC_URL,
+		now: options.clock.now()
+	});
+	const body = async (c) => {
+		const value = await c.req.json().catch(() => null);
+		if (!isRecord$1(value)) throw new HollwareError("invalid_input", "The body is not a JSON object.", "Send a JSON object.");
+		return value;
+	};
+	const text = (value) => typeof value === "string" ? value : "";
+	const handle = (step) => async (c) => {
+		try {
+			return await step(c);
+		} catch (error) {
+			if (!(error instanceof HollwareError)) throw error;
+			return c.json({
+				code: error.code,
+				message: error.message,
+				fix: error.fix
+			}, 400);
+		}
+	};
+	const html = (render) => () => {
+		const nonce = crypto.randomUUID().replace(/-/g, "");
+		return new Response(render(nonce), { headers: pageHeaders(nonce) });
+	};
+	app.get("/setup", html(setupPage));
+	app.get("/signin", html(signInPage));
+	app.post("/auth/register/options", handle(async (c) => c.json(await (await ceremonies()).registrationOptions(ceremony(c), text((await body(c))["invitation"])))));
+	app.post("/auth/register/verify", handle(async (c) => {
+		const input = await body(c);
+		const response = input["response"];
+		if (!isRecord$1(response)) throw new HollwareError("invalid_input", "The body has no passkey.", "Send the credential as JSON.");
+		const answer = await (await ceremonies()).verifyRegistration(ceremony(c), {
+			challengeId: text(input["challengeId"]),
+			response: JSON.parse(JSON.stringify(response)),
+			name: text(input["name"]),
+			label: text(input["label"])
+		});
+		return c.json({ ok: true }, 200, { "set-cookie": sessionCookie(answer.session) });
+	}));
+	app.post("/auth/signin/options", handle(async (c) => c.json(await (await ceremonies()).authenticationOptions(ceremony(c)))));
+	app.post("/auth/signin/verify", handle(async (c) => {
+		const input = await body(c);
+		const response = input["response"];
+		if (!isRecord$1(response)) throw new HollwareError("invalid_input", "The body has no passkey.", "Send the credential as JSON.");
+		const answer = await (await ceremonies()).verifyAuthentication(ceremony(c), {
+			challengeId: text(input["challengeId"]),
+			response: JSON.parse(JSON.stringify(response))
+		});
+		return c.json({ ok: true }, 200, { "set-cookie": sessionCookie(answer.session) });
+	}));
+}
+//#endregion
+//#region src/oauth/authorize.ts
+/** What a client gets when it asks for no scope: the baseline that `/mcp` and `/v1` name. */
+const BASELINE = ["content:read"];
+/**
+* The scopes a person may grant: those asked for that the person's role allows, in the order of
+* the role. Anything that is not a scope of Hollware is left out.
+*/
+function grantableScopes(role, asked) {
+	if (!isRole(role)) return [];
+	const scopes = asked.filter(isScope);
+	return ROLE_SCOPES[role].filter((scope) => scopes.includes(scope));
+}
+function html(body, status = 200, extra) {
+	const headers = new Headers(plainPageHeaders());
+	extra?.forEach((value, name) => {
+		if (name.toLowerCase() === "set-cookie") headers.append(name, value);
+	});
+	return new Response(body, {
+		status,
+		headers
+	});
+}
+/**
+* An error of the authorization endpoint, as the consent page guide says: a redirect back to the
+* client only when the library validated the client and its exact redirect URI, and a page of our
+* own otherwise. Anything else is a bug or an outage, and goes on to the error handler.
+*/
+function answerError(error) {
+	if (error instanceof AuthorizationError && error.redirectTo !== void 0) return new Response(null, {
+		status: 302,
+		headers: { location: error.redirectTo }
+	});
+	if (error instanceof AuthorizationError) return html(messagePage("This request cannot go on", error.description), 400);
+	if (error instanceof CimdFetchError) return html(messagePage("This app could not be verified", "Its metadata document could not be fetched or is not valid. Try again later, or ask its developer."), 400);
+	throw error;
+}
+/**
+* The authorization endpoint of the OAuth server (ADR-026), which is Hollware's page and not the
+* library's: the library parses and validates the request, and this page signs the person in,
+* shows what the client asks for, and completes the authorization with what the person allowed.
+*
+* - A person without a session is sent to `/signin`, which comes back here once they are in. The
+*   session cookie is only sent to `/authorize`.
+* - The admin, Hollware's own client (`admin.ts`), gets what it asks for within the role, with no
+*   consent page.
+* - The page offers the scopes the client asked for that the person's role allows, each checked;
+*   the person may untick any. A request that would get no scope at all is refused with
+*   `access_denied`.
+* - The grant stores the person and the site. What its tokens may do is read again on each request
+*   against the person's role then (`server.ts`).
+*/
+function installAuthorize(app, options) {
+	const person = async (c) => {
+		const secret = getCookie(c, SESSION_COOKIE);
+		if (secret === void 0) return null;
+		return await findSession(connect(c.env.DB), options.site, secret, options.clock.now());
+	};
+	const signIn = (c) => {
+		const url = new URL(c.req.url);
+		const back = `${url.pathname}${url.search}`;
+		return c.redirect(`/signin?return_to=${encodeURIComponent(back)}`, 302);
+	};
+	app.get("/authorize", async (c) => {
+		const oauth = options.oauth(c.env.HOLLWARE_PUBLIC_URL).authorizationServer.getOAuthApi(c.env);
+		try {
+			const request = await oauth.parseAuthRequest(c.req.raw);
+			const signedIn = await person(c);
+			if (signedIn === null) return signIn(c);
+			const server = options.oauth(c.env.HOLLWARE_PUBLIC_URL);
+			if (request.clientId === (await adminClient(server, c.env)).clientId) {
+				const scope = grantableScopes(signedIn.role, request.scope);
+				const props = {
+					userId: signedIn.userId,
+					site: options.site
+				};
+				const { redirectTo } = await oauth.completeAuthorization({
+					request,
+					userId: signedIn.userId,
+					metadata: { site: options.site },
+					scope,
+					props
+				});
+				return new Response(null, {
+					status: 302,
+					headers: { location: redirectTo }
+				});
+			}
+			const scopes = grantableScopes(signedIn.role, request.scope.length === 0 ? BASELINE : request.scope);
+			if (scopes.length === 0) {
+				const location = authorizationErrorRedirect(request, "access_denied", "Your role allows none of the scopes this client asked for.");
+				return new Response(null, {
+					status: 302,
+					headers: { location }
+				});
+			}
+			const details = await oauth.describeConsent(request);
+			const consent = await oauth.beginConsent(request);
+			return html(consentPage({
+				clientName: details.clientName,
+				clientDomain: details.clientDomain,
+				redirectHost: details.redirectHost,
+				redirectIsLoopback: details.redirectIsLoopback,
+				person: signedIn.name ?? "you",
+				scopes,
+				handle: consent.handle
+			}), 200, consent.headers);
+		} catch (error) {
+			return answerError(error);
+		}
+	});
+	app.post("/authorize", async (c) => {
+		const oauth = options.oauth(c.env.HOLLWARE_PUBLIC_URL).authorizationServer.getOAuthApi(c.env);
+		try {
+			const signedIn = await person(c);
+			if (signedIn === null) return html(messagePage("Your session ended", "Sign in again, then start from the app."), 401);
+			const form = await c.req.formData();
+			const value = form.get("handle");
+			const handle = typeof value === "string" ? value : "";
+			if (form.get("decision") !== "approve") {
+				const denied = await oauth.denyConsent(c.req.raw, handle);
+				return new Response(null, {
+					status: 302,
+					headers: denied.headers
+				});
+			}
+			const scope = grantableScopes(signedIn.role, form.getAll("scope").map(String));
+			const approved = await oauth.approveConsent(c.req.raw, handle, { scope });
+			if (scope.length === 0) {
+				const location = authorizationErrorRedirect(approved.request, "access_denied", "No scope was allowed.");
+				approved.headers.set("location", location);
+				return new Response(null, {
+					status: 302,
+					headers: approved.headers
+				});
+			}
+			const props = {
+				userId: signedIn.userId,
+				site: options.site
+			};
+			const { redirectTo } = await oauth.completeAuthorization({
+				request: approved.request,
+				userId: signedIn.userId,
+				metadata: { site: options.site },
+				scope,
+				props
+			});
+			approved.headers.set("location", redirectTo);
+			return new Response(null, {
+				status: 302,
+				headers: approved.headers
+			});
+		} catch (error) {
+			return answerError(error);
+		}
+	});
+}
+//#endregion
+//#region src/oauth/server.ts
+/** Access tokens live an hour, and a grant thirty days from its code, refreshed or not (ADR-026). */
+const ACCESS_TOKEN_TTL_SECONDS = 3600;
+const REFRESH_TOKEN_TTL_SECONDS = 2592e3;
+/** The role of a member of the site, read on every request: a change of role takes effect at once. */
+async function roleOf(db, site, userId) {
+	return (await db.prepare("SELECT role FROM members WHERE site_id = ?1 AND user_id = ?2").bind(site, userId).first())?.role ?? null;
+}
+function isGrantProps(value) {
+	return typeof value === "object" && value !== null && typeof Reflect.get(value, "userId") === "string" && typeof Reflect.get(value, "site") === "string";
+}
+/**
+* Builds the OAuth server of a deployment (ADR-026), once for each public URL it is asked about:
+* the issuer and the resources are that URL's, and the Worker learns it from its environment, on
+* the first request. One Worker holds both roles: an `OAuthAuthorizationServer`, whose
+* `/authorize` is Hollware's own page (`authorize.ts`), and an `OAuthResourceServer` for `/mcp`
+* and for `/v1`.
 *
-* - An error that a route throws is a JSON 500 with a fixed message, and the id of the request
-*   in its fix, which is how the operator finds the line of the log that has the cause. The cause
-*   goes to the log and never to the caller, whose agent could repeat it to a person or to another
-*   system. This holds for every error, a failed D1 query included: nothing turns one into a 401.
-* - A path that no route has is a JSON 404.
+* A resource accepts two kinds of token, told apart by their shape. A personal token
+* (`hw_pat_…`) is looked up in D1 as before, and never reaches the OAuth server; any other token
+* is the OAuth server's to validate, for that resource alone. Either way the principal's scopes
+* are what the token carries intersected with what the user's role allows now.
 */
-function installErrorHandling(app, log) {
-	app.onError((c) => {
-		const requestId = c.get("requestId");
-		log({
-			kind: "request_error",
-			requestId,
-			method: c.req.method,
-			path: c.req.path,
-			detail: describeError(c.error)
-		});
-		return gatewayError(500, {
-			code: "internal",
-			message: "The request failed on the server.",
-			fix: `Try again. If it keeps failing, give the site operator this request id: ${requestId}.`
-		});
+function createOAuth(options) {
+	const built = /* @__PURE__ */ new Map();
+	return (publicUrl) => {
+		const issuer = new URL(publicUrl).origin;
+		const existing = built.get(issuer);
+		if (existing !== void 0) return existing;
+		const oauth = build(issuer, options);
+		built.set(issuer, oauth);
+		return oauth;
+	};
+}
+function build(issuer, options) {
+	const resources = {
+		mcp: `${issuer}/mcp`,
+		v1: `${issuer}/v1`
+	};
+	const metadataUrls = {
+		mcp: `${issuer}/.well-known/oauth-protected-resource/mcp`,
+		v1: `${issuer}/.well-known/oauth-protected-resource/v1`
+	};
+	const authorizationServer = new OAuthAuthorizationServer({
+		issuer,
+		resources: [resources.mcp, resources.v1],
+		scopesSupported: [...SCOPES],
+		accessTokenTTL: ACCESS_TOKEN_TTL_SECONDS,
+		refreshTokenTTL: REFRESH_TOKEN_TTL_SECONDS,
+		clientIdMetadataDocumentEnabled: true,
+		...options.dynamicClientRegistration ? { clientRegistrationEndpoint: "/oauth/register" } : {},
+		onError: ({ code, internal }) => {
+			options.log({
+				kind: "oauth_error",
+				code,
+				reason: internal?.reason ?? null
+			});
+		}
 	});
-	app.notFound(() => gatewayError(404, {
-		code: "not_found",
-		message: "This Hollware has no route for that path.",
-		fix: "Send MCP requests to /mcp with \"Authorization: Bearer <token>\". GET /health tells whether the Worker is up."
-	}));
+	/** The protected routes in flight, by their request: the resource server hands it on as it is. */
+	const pending = /* @__PURE__ */ new WeakMap();
+	const validate = (env, request) => async (resource, token) => {
+		try {
+			return await check(env, request, resource, token);
+		} catch (error) {
+			pending.get(request)?.failed(error);
+			throw error;
+		}
+	};
+	const check = async (env, request, resource, token) => {
+		const refuse = (reason) => {
+			pending.get(request)?.refused(reason);
+			return null;
+		};
+		if (isPersonalToken(token)) {
+			const check = await checkPersonalToken(env.DB, token, {
+				site: options.site,
+				now: options.clock.now()
+			});
+			if (!check.ok) return refuse(check.reason);
+			if (check.touch !== null) {
+				const route = pending.get(request);
+				if (route === void 0) await check.touch;
+				else route.defer(check.touch);
+			}
+			return {
+				props: check.principal,
+				audience: resource,
+				scope: [...check.principal.scopes]
+			};
+		}
+		const granted = await authorizationServer.validateToken(resource, token, env);
+		if (granted === null) return refuse("unknown");
+		if (!isGrantProps(granted.props)) return refuse("unknown");
+		if (granted.props.site !== options.site) return refuse("other_site");
+		const role = await roleOf(env.DB, options.site, granted.props.userId);
+		if (role === null) return refuse("no_user");
+		const principal = {
+			kind: "oauth",
+			userId: granted.props.userId,
+			clientId: granted.clientId,
+			site: options.site,
+			scopes: effectiveScopes(role, granted.scope.filter(isScope))
+		};
+		return {
+			props: principal,
+			audience: granted.audience,
+			expiresAt: granted.expiresAt,
+			scope: [...principal.scopes],
+			userId: principal.userId,
+			clientId: principal.clientId
+		};
+	};
+	const resourceServer = (name) => new OAuthResourceServer({
+		resourceMetadata: {
+			resource: resources[name],
+			authorization_servers: [issuer],
+			resource_name: name === "mcp" ? "Hollware MCP" : "Hollware read API"
+		},
+		requiredScopes: ["content:read"],
+		validateToken: validate,
+		handler: { fetch: async (request, _env, ctx) => {
+			const route = pending.get(request);
+			if (route === void 0) throw new Error("A protected route was reached without the gateway in front of it");
+			return await route.proceed(ctx.props, ctx.auth);
+		} }
+	});
+	const servers = {
+		mcp: resourceServer("mcp"),
+		v1: resourceServer("v1")
+	};
+	return {
+		issuer,
+		authorizationServer,
+		resources,
+		metadataUrls,
+		protect: async (resource, request, env, ctx, route) => {
+			pending.set(request, route);
+			try {
+				return await servers[resource].fetch(request, env, ctx);
+			} finally {
+				pending.delete(request);
+			}
+		}
+	};
 }
 //#endregion
 //#region src/http/gateway.ts
 /**
+* A 401 of a resource server, with Hollware's body: the same JSON as every other refusal, and the
+* challenge of the resource server, which names its metadata (RFC 9728) and the baseline scope.
+*/
+function withRefusalBody(response, refused) {
+	const ours = unauthorized(refused ? "unknown" : void 0);
+	const headers = new Headers(response.headers);
+	headers.set("content-type", "application/json");
+	const challenge = headers.get("www-authenticate");
+	if (challenge !== null) headers.set("www-authenticate", challenge.replace("realm=\"OAuth\"", "realm=\"hollware\""));
+	return new Response(ours.body, {
+		status: 401,
+		headers
+	});
+}
+/**
 * The HTTP gateway of the Worker (ADR-019): a Hono 5 app, built once, that runs in this order for
 * every request:
 *
@@ -1512,6 +2804,73 @@ function installErrorHandling(app, log) {
 function createGateway(options) {
 	const { site, mcp, clock, log } = options;
 	const app = new Hono();
+	/**
+	* The Worker's own context of each request. Hono hands its routes the same object under a
+	* narrower type of its own, and the OAuth library wants the Worker's.
+	*/
+	const contexts = /* @__PURE__ */ new WeakMap();
+	const workerContext = (c) => {
+		const ctx = contexts.get(c.req.raw);
+		if (ctx === void 0) throw new Error("A request reached a route without its context");
+		return ctx;
+	};
+	const oauth = createOAuth({
+		site: site.key,
+		clock,
+		dynamicClientRegistration: options.auth?.dynamicClientRegistration ?? false,
+		log
+	});
+	/**
+	* What a write hands to the Queue: the events it committed, after the answer (ADR-025). The
+	* cron trigger's sweep catches any that this misses.
+	*/
+	const notify = (c, requestId) => (ids) => {
+		c.executionCtx.waitUntil(enqueue({
+			queue: c.env.EVENTS,
+			db: connect(c.env.DB),
+			site: site.key,
+			ids,
+			clock
+		}).catch((error) => {
+			log({
+				kind: "enqueue_failed",
+				requestId,
+				message: String(error)
+			});
+		}));
+	};
+	/**
+	* A protected route: the resource server of `resource` answers a request without a token and a
+	* token it refuses (401, logged with the reason), and `proceed` gets the principal of the rest.
+	*/
+	const protect = async (c, resource, proceed) => {
+		const requestId = c.get("requestId");
+		/** What the check said besides the answer: why it refused, or what it threw. */
+		const outcome = {
+			refusal: null,
+			failure: null
+		};
+		const response = await oauth(c.env.HOLLWARE_PUBLIC_URL).protect(resource, c.req.raw, c.env, workerContext(c), {
+			proceed,
+			refused: (reason) => {
+				outcome.refusal = reason;
+			},
+			defer: (promise) => {
+				workerContext(c).waitUntil(promise);
+			},
+			failed: (error) => {
+				outcome.failure = { error };
+			}
+		});
+		if (outcome.failure !== null) throw outcome.failure.error;
+		if (response.status !== 401) return response;
+		log({
+			kind: "auth_refused",
+			requestId,
+			reason: outcome.refusal ?? "no_token"
+		});
+		return withRefusalBody(response, outcome.refusal !== null);
+	};
 	app.use("*", async (c, next) => {
 		c.set("requestId", crypto.randomUUID());
 		await next();
@@ -1522,42 +2881,67 @@ function createGateway(options) {
 		await next();
 	});
 	app.get("/health", () => Response.json({ ok: true }, { headers: { "cache-control": "no-store" } }));
-	app.all("/mcp", async (c) => {
+	app.all("/mcp", async (c) => protect(c, "mcp", async (principal) => {
 		const requestId = c.get("requestId");
-		const token = readBearerToken(c.req.raw);
-		if (token === null) {
-			log({
-				kind: "auth_refused",
-				requestId,
-				reason: "no_token"
-			});
-			return unauthorized();
-		}
-		const check = await checkPersonalToken(c.env.DB, token, {
-			site: site.key,
-			now: clock.now()
-		});
-		if (!check.ok) {
-			log({
-				kind: "auth_refused",
-				requestId,
-				reason: check.reason
-			});
-			return unauthorized(check.reason);
-		}
-		if (check.touch !== null) c.executionCtx.waitUntil(check.touch);
+		const db = c.env.DB;
 		return await mcp.fetch(c.req.raw, {
-			principal: check.principal,
+			principal,
 			requestId,
+			resourceMetadataUrl: oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.mcp,
 			context: {
 				site,
-				store: createD1Store(c.env.DB, { clock }),
-				clock
+				store: createD1Store(db, { clock }),
+				clock,
+				notify: notify(c, requestId)
 			}
 		});
+	}));
+	for (const resource of ["mcp", "v1"]) app.all(`/.well-known/oauth-protected-resource/${resource}`, async (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).protect(resource, c.req.raw, c.env, workerContext(c), {
+		proceed: () => Promise.resolve(new Response(null, { status: 404 })),
+		refused: () => void 0,
+		defer: () => void 0,
+		failed: () => void 0
+	}));
+	installAuthorize(app, {
+		site: site.key,
+		clock,
+		oauth
+	});
+	const authorizationServer = (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).authorizationServer.fetch(c.req.raw, c.env, workerContext(c));
+	app.all("/.well-known/oauth-authorization-server", authorizationServer);
+	app.all("/oauth/*", authorizationServer);
+	installIdentity(app, {
+		site: site.key,
+		clock
+	});
+	installAdmin(app, { oauth });
+	installAdminApi(app, {
+		site: site.key,
+		clock,
+		oauth,
+		protect: (c, proceed) => protect(c, "v1", proceed),
+		metadataUrl: (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.v1
+	});
+	if (options.handlers !== void 0) installOpsApi(app, {
+		site,
+		handlers: options.handlers,
+		clock,
+		log,
+		protect: (c, proceed) => protect(c, "v1", proceed),
+		metadataUrl: (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.v1,
+		notify
+	});
+	if (options.read !== void 0) installReadApi(app, {
+		read: options.read,
+		site: site.key,
+		protect: (c, proceed) => protect(c, "v1", proceed),
+		metadataUrl: (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.v1
 	});
 	installErrorHandling(app, log);
-	return async (request, env, ctx) => await app.fetch(request, env, ctx);
+	return async (request, env, ctx) => {
+		contexts.set(request, ctx);
+		return await app.fetch(request, env, ctx);
+	};
 }
 //#endregion
 //#region src/mcp/annotations.ts
@@ -1740,12 +3124,15 @@ const encoder = new TextEncoder();
 * has already run when its answer turns out too large, so it says to look at the state it left.
 */
 const OUTPUT_TOO_LARGE_FIX = {
+	approve_review: "The operation ran and its change may have been applied: read the review with list_reviews before you repeat it.",
 	create_draft: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
 	describe_site: "The description of the site does not fit in one answer. Document fewer collections, components and contracts, or shorten their descriptions.",
 	get_entry: "Ask for one format at a time with formats: markdown, document or html, instead of several together.",
 	get_translations: "The translations do not fit in one answer. Read each one with get_entry instead.",
 	list_entries: "Ask for less: pass a smaller limit, or narrow the list with locale, tag or status.",
+	list_reviews: "Ask for less: pass a smaller limit.",
 	publish: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
+	request_changes: "The operation ran and its change may have been applied: read the review with list_reviews before you repeat it.",
 	unpublish: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
 	update_draft: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
 	validate: "The verdict lists more problems than fit in one answer. Fix the first ones and validate again."
@@ -1900,14 +3287,16 @@ const TOOLS_LIST_CACHE_HINT = {
 	cacheScope: "public"
 };
 /**
-* What the SDK is told about a principal: its scopes, which are the effective ones, and the id of
-* its token as the client. It carries no token: the gateway checked it, and nothing here needs it.
+* What the SDK is told about a principal: its scopes, which are the effective ones, the id of its
+* token or of its OAuth client as the client, and where its protected resource metadata is. It
+* carries no token: the gateway checked it, and nothing here needs it.
 */
-function authInfoOf(principal) {
+function authInfoOf(principal, resourceMetadataUrl) {
 	return {
 		token: "",
-		clientId: principal.kind === "token" ? principal.tokenId : principal.kind,
-		scopes: [...principal.scopes]
+		clientId: principal.kind === "token" ? principal.tokenId : principal.kind === "oauth" ? principal.clientId : principal.kind,
+		scopes: [...principal.scopes],
+		...resourceMetadataUrl === null ? {} : { resourceMetadataUrl }
 	};
 }
 /**
@@ -2033,7 +3422,7 @@ function createMcpEndpoint(options) {
 	}) });
 	return { async fetch(request, call) {
 		if (!call?.principal) throw new Error("The MCP endpoint serves a request only as the principal the gateway found");
-		const authInfo = authInfoOf(call.principal);
+		const authInfo = authInfoOf(call.principal, call.resourceMetadataUrl ?? null);
 		calls.set(authInfo, call);
 		return handler.fetch(request, { authInfo });
 	} };
@@ -2189,6 +3578,84 @@ function createEntrypoint(deps) {
 	};
 }
 //#endregion
+//#region src/schedule/run.ts
+/** What the publication of a schedule may do: what `publish` needs, in the scheduler's name. */
+const SCHEDULER_SCOPES = [
+	"content:read",
+	"content:write",
+	"content:publish"
+];
+/**
+* The principal a schedule publishes as: the token, or the OAuth client, that scheduled it, with
+* the scopes a publication needs. An OAuth client is known by the id its actor kept (ADR-026).
+*/
+function principalOf(actor, site) {
+	if (actor.kind === "oauth_client") {
+		const client = actor.meta?.["oauthClient"];
+		return {
+			kind: "oauth",
+			userId: actor.userId,
+			clientId: typeof client === "string" ? client : "unknown",
+			site,
+			scopes: SCHEDULER_SCOPES
+		};
+	}
+	if (actor.tokenId === null) throw new Error(`A schedule of a ${actor.kind} has no token to publish with`);
+	return {
+		kind: "token",
+		userId: actor.userId,
+		tokenId: actor.tokenId,
+		site,
+		scopes: SCHEDULER_SCOPES
+	};
+}
+/**
+* Publishes the scheduled entries whose time has come (ADR-025), one by one, through the same
+* handler as `publish`, in the name of who scheduled each one and with the warnings acknowledged
+* then. An entry that cannot be published (it changed after it was scheduled, or the contracts now
+* block it or warn about something new) goes back to a draft, and the log says why. A failure of
+* the database leaves the schedule for the next run.
+*/
+async function runDueSchedules(input) {
+	const { site, store, handlers, clock, log } = input;
+	const due = await store.dueSchedules(site.key, clock.now().toISOString());
+	let published = 0;
+	let cancelled = 0;
+	for (const schedule of due) {
+		const requestId = `cron_${crypto.randomUUID()}`;
+		const answer = await handlers.publish({
+			id: schedule.entryId,
+			version: schedule.version,
+			acknowledgeWarnings: [...schedule.acknowledged],
+			group: []
+		}, {
+			site,
+			principal: principalOf(schedule.actor, site.key),
+			view: "head",
+			store,
+			clock,
+			client: schedule.actor.meta,
+			requestId
+		});
+		if (answer.outcome === "published") published += 1;
+		else {
+			await store.cancelSchedule(site.key, schedule.entryId);
+			cancelled += 1;
+		}
+		log({
+			kind: "schedule",
+			requestId,
+			entryId: schedule.entryId,
+			scheduledAt: schedule.scheduledAt,
+			outcome: answer.outcome
+		});
+	}
+	return {
+		published,
+		cancelled
+	};
+}
+//#endregion
 //#region src/compose.ts
 const systemClock = { now: () => /* @__PURE__ */ new Date() };
 /** What the MCP endpoint calls the server, in `server/discover` and `initialize`. */
@@ -2221,20 +3688,61 @@ function writeLog(entry) {
 * included, is one JSON line written with `console.log`.
 */
 function createHollwareWith(config, handlers, options = {}) {
-	const [site] = resolveConfig(config).sites.values();
+	const resolved = resolveConfig(config);
+	const [site] = resolved.sites.values();
 	if (site === void 0) throw new Error("The resolved config has no site, which resolveConfig never lets through");
 	const clock = options.clock ?? systemClock;
+	const mcp = createMcpEndpoint({
+		handlers,
+		serverInfo: SERVER_INFO,
+		log: writeLog
+	});
+	const deliveryDeps = (env) => ({
+		db: connect(env.DB),
+		site,
+		clock,
+		fetch: (request) => fetch(request),
+		secret: (name) => {
+			const value = Reflect.get(env, name);
+			return typeof value === "string" ? value : void 0;
+		}
+	});
 	return {
 		fetch: createGateway({
 			site,
-			mcp: createMcpEndpoint({
+			mcp,
+			clock,
+			log: writeLog,
+			read: (env) => createRpc({
+				site,
 				handlers,
-				serverInfo: SERVER_INFO,
+				clock,
 				log: writeLog
-			}),
-			clock,
-			log: writeLog
+			}, env),
+			auth: resolved.auth,
+			handlers
 		}),
+		scheduled: async (_controller, env, ctx) => {
+			const deps = deliveryDeps(env);
+			ctx.waitUntil(runDueSchedules({
+				site,
+				store: createD1Store(env.DB, { clock }),
+				handlers,
+				clock,
+				log: writeLog
+			}).then(() => sweepOutbox({
+				queue: env.EVENTS,
+				deps
+			})).then(() => void 0, (error) => {
+				writeLog({
+					kind: "cron_failed",
+					message: String(error)
+				});
+			}));
+		},
+		queue: async (batch, env) => {
+			await consumeEvents(batch.messages, deliveryDeps(env));
+		},
 		Hollware: createEntrypoint({
 			site,
 			handlers,
@@ -2264,23 +3772,49 @@ function unexpectedAnswer(context, call, answer) {
 //#endregion
 //#region src/ops/actor.ts
 /**
-* Who a write is made by: the token of the call, with what its client said about itself. Only a
-* personal token writes (ADR-019). The adapters check the scopes of the operation before any
-* handler runs and never route a write for another principal, so reaching one with a principal
-* that is not a token is a bug, answered as `internal` before anything is read or written.
+* Who a write is made by: the person behind the token of the call, with what its client said
+* about itself. A personal token writes as itself (ADR-019); an OAuth access token writes as the
+* client the person allowed, whose id goes with what the client said (ADR-026). The adapters check
+* the scopes of the operation before any handler runs and never route a write for the RPC
+* binding, so reaching one with it is a bug, answered as `internal` before anything is read or
+* written.
 */
 function actorOf(context) {
 	const { principal } = context;
-	if (principal.kind !== "token") throw internalError(context, `A write was routed for a principal of kind ${principal.kind}; only a token writes.`);
-	return {
+	if (principal.kind === "token") return {
 		kind: "token",
 		userId: principal.userId,
 		tokenId: principal.tokenId,
 		meta: context.client
 	};
+	if (principal.kind === "oauth") return {
+		kind: "oauth_client",
+		userId: principal.userId,
+		tokenId: null,
+		meta: {
+			...context.client,
+			oauthClient: principal.clientId
+		}
+	};
+	throw internalError(context, `A write was routed for a principal of kind ${principal.kind}; only a person writes.`);
 }
 //#endregion
 //#region src/ops/answers.ts
+/** A review as an output. */
+function reviewView(review) {
+	return {
+		id: review.id,
+		entryId: review.entryId,
+		revision: review.revisionId,
+		status: review.status,
+		requestedBy: review.requestedBy,
+		requestedByName: review.requestedByName,
+		requestedAt: review.requestedAt,
+		decidedBy: review.decidedBy,
+		decidedAt: review.decidedAt,
+		note: review.note
+	};
+}
 /**
 * The summary of an entry, from a listing (`EntrySummaryView`) or from a read of one entry
 * (`EntryView`, which has all of the summary's fields and more). `hasUnpublishedChanges` says
@@ -2431,7 +3965,7 @@ function processFor(site, collection, markdown) {
 * saved under; `publish` is what `validate` and `publish` check, with every contract of the
 * collection, against the other entries of the site as they are now.
 */
-function judge(context, collection, target, markdown, phase) {
+function judge(context, collection, target, markdown, phase, entries = context.store.lookup(context.site.key)) {
 	return runContracts({
 		site: context.site,
 		collection,
@@ -2440,7 +3974,7 @@ function judge(context, collection, target, markdown, phase) {
 		entryId: target.entryId,
 		phase,
 		markdown,
-		entries: context.store.lookup(context.site.key)
+		entries
 	});
 }
 /**
@@ -2550,8 +4084,8 @@ const describeSite$1 = async (_input, context) => ({
 //#endregion
 //#region src/ops/get-entry.ts
 /**
-* Reads an entry in the view of the call, `head` over MCP and `published` over RPC, with only the
-* formats that were asked for.
+* Reads an entry in the view of the call, `head` over MCP and `published` over RPC, or in the
+* published view when the input asks for it, with only the formats that were asked for.
 */
 const getEntry$1 = async (input, context) => {
 	requireCollection(context.site, input.collection);
@@ -2560,7 +4094,7 @@ const getEntry$1 = async (input, context) => {
 		collection: input.collection,
 		locale: input.locale,
 		slug: input.slug
-	}, context.view);
+	}, input.published ? "published" : context.view);
 	if (found === null) return { outcome: "not_found" };
 	const { entry, revision } = found;
 	const publication = await context.store.lastPublication(context.site.key, entry.id);
@@ -2612,6 +4146,31 @@ const listEntries$1 = async (input, context) => {
 	};
 };
 //#endregion
+//#region src/ops/event.ts
+/** The path of an entry: the route of its locale, with its slug in place of `:slug`. */
+function entryPath(collection, locale, slug) {
+	const route = collection.routes[locale];
+	return route === void 0 ? null : route.replace(/:slug(?![A-Za-z0-9_])/, slug);
+}
+/** The event of a publish or an unpublish, ready for the outbox. */
+function eventFor(input) {
+	const id = newId("evt");
+	const path = entryPath(input.collection, input.entry.locale, input.entry.slug);
+	const payload = {
+		id,
+		kind: input.kind,
+		site: input.site.key,
+		at: input.at,
+		entry: input.entry,
+		path,
+		url: path === null || input.site.url === null ? null : `${input.site.url}${path}`
+	};
+	return {
+		id,
+		payload: JSON.stringify(payload)
+	};
+}
+//#endregion
 //#region src/ops/publish.ts
 /** A warning by what an acknowledgement names: its contract and its path, never its line. */
 function warningKey(warning) {
@@ -2623,8 +4182,15 @@ function warningKey(warning) {
 * changed since the draft was saved: an error blocks, and a warning has to be acknowledged, by
 * contract and path, before the publication is made. The publication records every warning of its
 * verdict as acknowledged (ADR-021).
+*
+* A caller without `content:publish` goes through the same checks, and then asks for a review
+* instead of publishing (v0.3): the answer is `pending_review`, and a person who may publish
+* decides. A review is for one entry, now.
 */
 const publish$1 = async (input, context) => {
+	const mayPublish = context.principal.scopes.includes("content:publish");
+	if (!mayPublish && (input.group.length > 0 || input.publishAt !== void 0)) throw new HollwareError("invalid_input", "Without content:publish, publish asks for a review of one entry, now: not of a group, and not at a time.", "Publish each entry on its own, without group and publishAt; a person who may publish approves it.");
+	if (input.group.length > 0) return publishGroup(input, context);
 	const actor = actorOf(context);
 	const found = await context.store.findEntryById(context.site.key, input.id, "head");
 	if (found === null) return { outcome: "not_found" };
@@ -2657,7 +4223,70 @@ const publish$1 = async (input, context) => {
 		entry: summary,
 		verdict: verdictView(verdict)
 	};
+	const acknowledgedWarnings = verdict.warnings.map(({ contract, path }) => ({
+		contract,
+		path
+	}));
+	if (!mayPublish) {
+		const asked = await context.store.requestReview(context.site.key, {
+			entryId: entry.id,
+			expectedVersion: input.version,
+			acknowledged: acknowledgedWarnings,
+			actor
+		});
+		switch (asked.outcome) {
+			case "pending_review": return {
+				outcome: "pending_review",
+				entry: summary,
+				verdict: verdictView(verdict),
+				review: reviewView(asked.review)
+			};
+			case "conflict": return {
+				outcome: "conflict",
+				conflict: conflictAt(asked.currentVersion, asked.headRevision)
+			};
+			case "not_found": return { outcome: "not_found" };
+			default: throw unexpectedAnswer(context, "publish", asked);
+		}
+	}
+	if (input.publishAt !== void 0 && Date.parse(input.publishAt) > context.clock.now().getTime()) {
+		if (entry.status === "published") throw new HollwareError("invalid_input", "The entry is published, so its publication cannot be scheduled.", "Publish its changes now, without publishAt, or unpublish it first and then schedule it.");
+		const scheduled = await context.store.schedule(context.site.key, {
+			entryId: entry.id,
+			expectedVersion: input.version,
+			scheduledAt: new Date(input.publishAt).toISOString(),
+			acknowledged: acknowledgedWarnings,
+			actor
+		});
+		switch (scheduled.outcome) {
+			case "scheduled": return {
+				outcome: "scheduled",
+				entry: entrySummary(scheduled.view),
+				verdict: verdictView(verdict)
+			};
+			case "conflict": return {
+				outcome: "conflict",
+				conflict: conflictAt(scheduled.currentVersion, scheduled.headRevision)
+			};
+			case "not_found": return { outcome: "not_found" };
+			default: throw unexpectedAnswer(context, "publish", scheduled);
+		}
+	}
+	const event = eventFor({
+		kind: "entry.published",
+		site: context.site,
+		collection,
+		entry: {
+			id: entry.id,
+			collection: entry.collection,
+			locale: entry.locale,
+			slug: entry.slug,
+			translationGroup: entry.translationGroup
+		},
+		at: context.clock.now().toISOString()
+	});
 	const written = await context.store.publish(context.site.key, {
+		event,
 		entryId: entry.id,
 		expectedVersion: input.version,
 		verdict,
@@ -2669,11 +4298,13 @@ const publish$1 = async (input, context) => {
 		sortKey: sortKeyOf(collection, processed.value.frontmatter) ?? entry.publishedAt ?? context.clock.now().toISOString()
 	});
 	switch (written.outcome) {
-		case "published": return {
-			outcome: "published",
-			entry: entrySummary(written.view),
-			verdict: verdictView(verdict)
-		};
+		case "published":
+			context.notify?.([event.id]);
+			return {
+				outcome: "published",
+				entry: entrySummary(written.view),
+				verdict: verdictView(verdict)
+			};
 		case "conflict": return {
 			outcome: "conflict",
 			conflict: conflictAt(written.currentVersion, written.headRevision)
@@ -2687,6 +4318,222 @@ const publish$1 = async (input, context) => {
 		case "taken": throw unexpectedAnswer(context, "publish", written);
 	}
 };
+/** The lookup of the contracts, with the entries of a group seen as published (ADR-024). */
+function asPublished(lookup, ids) {
+	return {
+		lookupMany: async (refs) => (await lookup.lookupMany(refs)).map((facts) => facts !== null && ids.has(facts.id) ? {
+			...facts,
+			status: "published"
+		} : facts),
+		translations: (collection, group) => lookup.translations(collection, group)
+	};
+}
+/**
+* Publishes an entry and the entries of its group in one step, all or none (ADR-024). Each entry
+* is checked as `publish` checks one, except that the contracts see every entry of the group as
+* published, so links between them resolve. The first entry that stops the group is named in
+* `failedEntry`. An acknowledgement, by contract and path, holds for every entry that reports
+* that warning, and each publication records its own warnings.
+*/
+async function publishGroup(input, context) {
+	if (input.publishAt !== void 0) throw new HollwareError("invalid_input", "A group cannot be scheduled: publishAt schedules one entry.", "Publish the group now, without publishAt, or schedule its entries one by one.");
+	const actor = actorOf(context);
+	const members = [{
+		id: input.id,
+		version: input.version
+	}, ...input.group].filter((member, index, all) => all.findIndex((other) => other.id === member.id) === index);
+	const lookup = asPublished(context.store.lookup(context.site.key), new Set(members.map((member) => member.id)));
+	const checked = [];
+	for (const member of members) {
+		const found = await context.store.findEntryById(context.site.key, member.id, "head");
+		if (found === null) return {
+			outcome: "not_found",
+			failedEntry: member.id
+		};
+		const { entry, revision } = found;
+		if (entry.version !== member.version) return {
+			outcome: "conflict",
+			conflict: conflictAt(entry.version, entry.headRevision),
+			failedEntry: member.id
+		};
+		const collection = collectionOfEntry(context.site, entry);
+		const summary = entrySummary(found);
+		const processed = await processFor(context.site, collection, revision.markdown);
+		if (!processed.ok) return {
+			outcome: "blocked",
+			entry: summary,
+			verdict: refusalVerdict("publish", processed.violations),
+			failedEntry: member.id
+		};
+		const verdict = await judge(context, collection, {
+			locale: entry.locale,
+			slug: entry.slug,
+			entryId: entry.id
+		}, processed.value, "publish", lookup);
+		if (!verdict.ok) return {
+			outcome: "blocked",
+			entry: summary,
+			verdict: verdictView(verdict),
+			failedEntry: member.id
+		};
+		checked.push({
+			summary,
+			collection,
+			verdict,
+			write: {
+				event: eventFor({
+					kind: "entry.published",
+					site: context.site,
+					collection,
+					entry: {
+						id: entry.id,
+						collection: entry.collection,
+						locale: entry.locale,
+						slug: entry.slug,
+						translationGroup: entry.translationGroup
+					},
+					at: context.clock.now().toISOString()
+				}),
+				entryId: entry.id,
+				expectedVersion: member.version,
+				verdict,
+				acknowledged: verdict.warnings.map(({ contract, path }) => ({
+					contract,
+					path
+				})),
+				actor,
+				sortKey: sortKeyOf(collection, processed.value.frontmatter) ?? entry.publishedAt ?? context.clock.now().toISOString()
+			}
+		});
+	}
+	const [main] = checked;
+	if (main === void 0) throw unexpectedAnswer(context, "publish", { outcome: "empty group" });
+	const acknowledged = new Set(input.acknowledgeWarnings.map(warningKey));
+	const pending = checked.find(({ verdict }) => verdict.warnings.some((warning) => !acknowledged.has(warningKey(warning))));
+	if (pending !== void 0) return {
+		outcome: "needs_acknowledgement",
+		entry: pending.summary,
+		verdict: verdictView(pending.verdict),
+		failedEntry: pending.write.entryId
+	};
+	const written = await context.store.publishGroup(context.site.key, checked.map(({ write }) => write));
+	switch (written.outcome) {
+		case "published": {
+			const [view] = written.views;
+			if (view === void 0) throw unexpectedAnswer(context, "publish", written);
+			context.notify?.(checked.flatMap(({ write }) => write.event ? [write.event.id] : []));
+			return {
+				outcome: "published",
+				entry: entrySummary(view),
+				verdict: verdictView(main.verdict)
+			};
+		}
+		case "conflict": return {
+			outcome: "conflict",
+			conflict: conflictAt(written.currentVersion, written.headRevision),
+			failedEntry: written.entryId
+		};
+		case "not_found": return {
+			outcome: "not_found",
+			failedEntry: written.entryId
+		};
+		case "too_large": {
+			const failed = checked.find(({ write }) => write.entryId === written.entryId) ?? main;
+			return {
+				outcome: "blocked",
+				entry: failed.summary,
+				verdict: refusalVerdict("publish", [violationOf(written, failed.collection)]),
+				failedEntry: written.entryId
+			};
+		}
+		case "taken": throw unexpectedAnswer(context, "publish", written);
+	}
+}
+//#endregion
+//#region src/ops/reviews.ts
+/**
+* The reviews of v0.3: what a person who may publish does with the requests of those who may
+* only write. `publish` makes a request (`pending_review`); these list them, approve one, which
+* publishes it through `publish` itself, or close one with a note.
+*/
+/** The requests of one status, newest first, each with its entry as it is now. */
+const listReviews = async (input, context) => {
+	const found = await context.store.listReviews(context.site.key, {
+		status: input.status,
+		limit: input.limit
+	});
+	const reviews = [];
+	for (const review of found) {
+		const view = await context.store.findEntryById(context.site.key, review.entryId, "head");
+		if (view === null) throw unexpectedAnswer(context, "list_reviews", { outcome: "no entry" });
+		reviews.push({
+			...reviewView(review),
+			entry: entrySummary(view)
+		});
+	}
+	return {
+		outcome: "ok",
+		reviews
+	};
+};
+/**
+* Publishes what a pending review asked for, through `publish`, in the approver's name: the
+* contracts run again, and the warnings the request acknowledged count as acknowledged. The
+* publication approves the review in its own batch. A review that is no longer pending answers
+* `not_pending`.
+*/
+const approveReview = async (input, context) => {
+	const site = context.site.key;
+	const review = await context.store.findReview(site, input.id);
+	if (review === null) return { outcome: "not_found" };
+	if (review.status !== "pending") return {
+		outcome: "not_pending",
+		review: reviewView(review)
+	};
+	const found = await context.store.findEntryById(site, review.entryId, "head");
+	if (found === null) return { outcome: "not_found" };
+	const answer = await publish$1({
+		id: found.entry.id,
+		version: found.entry.version,
+		acknowledgeWarnings: [...review.acknowledged, ...input.acknowledgeWarnings],
+		group: []
+	}, context);
+	switch (answer.outcome) {
+		case "published": return {
+			outcome: "published",
+			review: reviewView(await context.store.findReview(site, review.id) ?? review),
+			...answer.entry === void 0 ? {} : { entry: answer.entry },
+			...answer.verdict === void 0 ? {} : { verdict: answer.verdict }
+		};
+		case "blocked":
+		case "needs_acknowledgement": return {
+			outcome: answer.outcome,
+			review: reviewView(review),
+			...answer.entry === void 0 ? {} : { entry: answer.entry },
+			...answer.verdict === void 0 ? {} : { verdict: answer.verdict }
+		};
+		case "conflict": return {
+			outcome: "not_pending",
+			review: reviewView(await context.store.findReview(site, review.id) ?? review)
+		};
+		case "not_found": return { outcome: "not_found" };
+		default: throw unexpectedAnswer(context, "approve_review", answer);
+	}
+};
+/** Closes a pending review with a note, without publishing. */
+const requestChanges = async (input, context) => {
+	const { userId } = actorOf(context);
+	const closed = await context.store.requestChanges(context.site.key, {
+		id: input.id,
+		note: input.note,
+		userId
+	});
+	if (closed.outcome === "not_found") return { outcome: "not_found" };
+	return {
+		outcome: closed.outcome,
+		review: reviewView(closed.review)
+	};
+};
 //#endregion
 //#region src/ops/unpublish.ts
 /**
@@ -2695,15 +4542,34 @@ const publish$1 = async (input, context) => {
 */
 const unpublish = async (input, context) => {
 	const actor = actorOf(context);
+	const found = await context.store.findEntryById(context.site.key, input.id, "head");
+	if (found === null) return { outcome: "not_found" };
+	const { entry } = found;
+	const event = eventFor({
+		kind: "entry.unpublished",
+		site: context.site,
+		collection: collectionOfEntry(context.site, entry),
+		entry: {
+			id: entry.id,
+			collection: entry.collection,
+			locale: entry.locale,
+			slug: entry.slug,
+			translationGroup: entry.translationGroup
+		},
+		at: context.clock.now().toISOString()
+	});
 	const written = await context.store.unpublish(context.site.key, {
 		entryId: input.id,
-		actor
+		actor,
+		event
 	});
 	switch (written.outcome) {
-		case "unpublished": return {
-			outcome: "unpublished",
-			entry: entrySummary(written.view)
-		};
+		case "unpublished":
+			if (entry.status === "published") context.notify?.([event.id]);
+			return {
+				outcome: "unpublished",
+				entry: entrySummary(written.view)
+			};
 		case "not_found": return { outcome: "not_found" };
 		case "conflict":
 		case "taken":
@@ -2807,17 +4673,20 @@ function defineHandlers(handlers) {
 //#endregion
 //#region src/ops/index.ts
 /**
-* The handler of every operation of v0.1, paired with its spec of `@hollware/core` by type
+* The handler of every operation, paired with its spec of `@hollware/core` by type
 * (ADR-017). Adapters check the scopes and build the `OperationContext`; a handler never sees a
 * request, and reads and writes only the site of its context.
 */
 const handlers = defineHandlers({
+	approve_review: approveReview,
 	create_draft: createDraft,
 	describe_site: describeSite$1,
 	get_entry: getEntry$1,
 	get_translations: getTranslations$1,
 	list_entries: listEntries$1,
+	list_reviews: listReviews,
 	publish: publish$1,
+	request_changes: requestChanges,
 	unpublish,
 	update_draft: updateDraft,
 	validate