@hollware/server 0.10.0 → 0.11.0

package/dist/index.mjs

@@ -1,16 +1,16 @@
-import { A as users, C as reviewComments, D as schedules, E as revisions, M as effectiveScopes, N as isRole, O as sites, S as publications, T as revisionTags, _ as entries, b as members, g as deliveries, j as ROLE_SCOPES, k as tokens, l as membershipsOf, n as createInvitation, s as findSession, v as entryEmbeddings, w as reviews, x as outbox, y as invitations } from "./store-BPr9-wKy.mjs";
-import { CHUNKER_VERSION, ConfigError, EVENT_ID_HEADER, HollwareError, INDEXNOW_KEY, OPERATIONS, SCOPES, SIGNATURE_HEADER, TIMESTAMP_HEADER, canonicalJson, chunksOf, compileSites, definitionsFromConfig, describeBuiltInContracts, describeCatalog, describeResolvedSite, describeSite, generatePersonalToken, generateReadToken, getEntry, getTranslations, hashPersonalToken, isPersonalToken, isReadToken, isScope, isSiteKey, listEntries, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, search, signWebhook, siteDefinitionData, sizeLimitViolation, tagsOfChange, tagsOfSiteChange, uniqueSlugViolation, uniqueTranslationViolation } from "@hollware/core";
+import { A as revisionTags, C as entryEmbeddings, D as publications, E as outbox, F as users, I as ROLE_SCOPES, L as effectiveScopes, M as schedules, N as sites, O as reviewComments, P as tokens, R as isRole, S as entries, T as members, a as dropExpired, f as membershipsOf, g as removePasskey, j as revisions, k as reviews, n as createInvitation, o as endSession, p as passkeySummaries, s as endSessions, u as findSession, w as invitations, x as deliveries } from "./store-DjA9s95l.mjs";
+import { CHUNKER_VERSION, ConfigError, EVENT_ID_HEADER, HollwareError, INDEXNOW_KEY, OPERATIONS, OPERATION_AUDIT_ACTIONS, PREVIEW_QUERY_PARAM, SCOPES, SIGNATURE_HEADER, TIMESTAMP_HEADER, canSignPreviews, canonicalJson, chunksOf, compileSites, definitionsFromConfig, describeBuiltInContracts, describeCatalog, describeResolvedSite, describeSite, generatePersonalToken, generateReadToken, getEntry, getTranslations, hashPersonalToken, isAuditAction, isId, isPersonalToken, isReadToken, isScope, isSiteKey, listEntries, makePreviewToken, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, search, signWebhook, siteDefinitionData, sizeLimitViolation, tagsOfChange, tagsOfSiteChange, uniqueSlugViolation, uniqueTranslationViolation, verifyPreviewToken } from "@hollware/core";
 import { Hono } from "hono";
 import { drizzle } from "drizzle-orm/d1";
 import { and, asc, desc, eq, getTableColumns, gt, inArray, isNotNull, isNull, lte, ne, or, sql } from "drizzle-orm";
 import { alias } from "drizzle-orm/sqlite-core";
-import { AuthorizationError, CimdFetchError, OAuthAuthorizationServer, OAuthResourceServer, authorizationErrorRedirect } from "@cloudflare/workers-oauth-provider";
 import { getCookie } from "hono/cookie";
+import { AuthorizationError, CimdFetchError, OAuthAuthorizationServer, OAuthResourceServer, authorizationErrorRedirect } from "@cloudflare/workers-oauth-provider";
 import { CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, McpServer, acceptedContent, createMcpHandler, inputRequired, inputResponse } from "@modelcontextprotocol/server";
 import * as z from "zod";
 import { WorkerEntrypoint } from "cloudflare:workers";
 //#region package.json
-var version = "0.10.0";
+var version = "0.11.0";
 //#endregion
 //#region src/auth/responses.ts
 /** The challenge of every 401 and 403 (RFC 6750). */
@@ -350,7 +350,7 @@ function parseJson(text) {
 	}
 }
 /** The cursor that continues a `view` listing after `position`. */
-function encodeCursor(view, position) {
+function encodeCursor$1(view, position) {
 	return encodeBase64Url(JSON.stringify({
 		v: view,
 		k: position.key,
@@ -361,7 +361,7 @@ function encodeCursor(view, position) {
 * The position a cursor stands for. A cursor that no listing of this view returned, whatever is
 * wrong with it, is the error `invalid_input` with a fix.
 */
-function decodeCursor(cursor, view) {
+function decodeCursor$1(cursor, view) {
 	const text = decodeBase64Url(cursor);
 	const value = text === null ? void 0 : parseJson(text);
 	if (typeof value === "object" && value !== null && "v" in value && "k" in value && "i" in value && value.v === view && typeof value.k === "string" && typeof value.i === "string") return {
@@ -699,7 +699,7 @@ async function relatedOf(db, site, entryId) {
 }
 async function listEntries$2(db, site, query) {
 	if (!Number.isInteger(query.limit) || query.limit < 1) throw new HollwareError("invalid_input", `The limit ${query.limit} is not a whole number of at least 1.`, "Ask for at least one entry per page.");
-	const cursor = query.cursor === void 0 ? null : decodeCursor(query.cursor, query.view);
+	const cursor = query.cursor === void 0 ? null : decodeCursor$1(query.cursor, query.view);
 	if (query.view === "published" && (query.trashed === true || query.status !== void 0 && query.status !== "published")) return {
 		entries: [],
 		nextCursor: null
@@ -715,7 +715,7 @@ async function listEntries$2(db, site, query) {
 	if (key === null) throw new Error(`The published entry ${last.entry.id} has no published_sort_key`);
 	return {
 		entries: page.map(toEntrySummaryView),
-		nextCursor: encodeCursor(query.view, {
+		nextCursor: encodeCursor$1(query.view, {
 			key,
 			id: last.entry.id
 		})
@@ -2064,16 +2064,191 @@ async function consumeEvents(messages, depsOf) {
 		else message.retry();
 	}
 }
+/** JSON of at most `AUDIT_JSON_MAX` characters: a longer value says only that it was too long. */
+function boundedJson(value) {
+	if (value === null) return null;
+	const text = JSON.stringify(value);
+	return text.length <= 2e3 ? text : JSON.stringify({ truncated: true });
+}
+/**
+* The actor of a principal. A person signed in to the admin is a `user`, with the admin as their
+* client; any other OAuth client is an `oauth_client`; a personal or read token is a `token`.
+*/
+function actorOf$1(principal, meta, adminClientId) {
+	if (principal.kind === "oauth") return {
+		kind: principal.clientId === adminClientId ? "user" : "oauth_client",
+		userId: principal.userId,
+		tokenId: null,
+		clientId: principal.clientId,
+		meta
+	};
+	return {
+		kind: "token",
+		userId: principal.userId,
+		tokenId: principal.tokenId,
+		clientId: null,
+		meta
+	};
+}
+/** A person, signed in with their passkey, on the pages of the Worker. */
+function personActor(userId) {
+	return {
+		kind: "user",
+		userId,
+		tokenId: null,
+		clientId: null,
+		meta: null
+	};
+}
+/** The deployment itself, acting for the person who asked it to: its cron. */
+function systemActor(forUserId) {
+	return {
+		kind: "system",
+		userId: forUserId,
+		tokenId: null,
+		clientId: null,
+		meta: null
+	};
+}
+/**
+* The key of a site that hashes addresses: HKDF-SHA256 of the Worker secret `HOLLWARE_SECRET`,
+* bound to the site, so one address hashes alike within a site and differently in another, and
+* no hash can be checked against the 2³² IPv4 addresses without the secret.
+*/
+async function addressKey(master, site) {
+	const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(master), "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: /* @__PURE__ */ new Uint8Array(0),
+		info: new TextEncoder().encode(`hollware audit address\n${site}`)
+	}, base, {
+		name: "HMAC",
+		hash: "SHA-256",
+		length: 256
+	}, false, ["sign"]);
+}
+/** The hex HMAC-SHA256 of an address under the key of its site. */
+async function hashAddress(master, site, address) {
+	const mac = await crypto.subtle.sign("HMAC", await addressKey(master, site), new TextEncoder().encode(address));
+	return [...new Uint8Array(mac)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function createAuditLog(request) {
+	const addressOf = async (site) => {
+		if (site.audit.ipAddresses !== "hashed" || request.address === null) return null;
+		if (request.master === void 0 || request.master.length < 32) {
+			request.log({
+				kind: "audit_address_unkeyed",
+				site: site.key,
+				requestId: request.requestId
+			});
+			return null;
+		}
+		return hashAddress(request.master, site.key, request.address);
+	};
+	const statement = async (site, line) => {
+		const at = request.now().toISOString();
+		const { actor } = request;
+		return request.db.prepare(`INSERT INTO audit_log (id, site_id, action, outcome, error_code, actor_kind, actor_user_id, actor_token_id, actor_client_id, actor_meta, target_type, target_id, detail, request_id, ip_hash, created_at, updated_at)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16, ?16)`).bind(newId("aud"), site.key, line.action, line.outcome, line.errorCode ?? null, actor.kind, actor.userId, actor.tokenId, actor.clientId, boundedJson(actor.meta), line.target?.type ?? null, line.target?.id ?? null, boundedJson(line.detail ?? null), request.requestId, await addressOf(site), at);
+	};
+	return {
+		statement,
+		async write(site, line) {
+			try {
+				await request.db.batch([await statement(site, line)]);
+			} catch (error) {
+				request.log({
+					kind: "audit_write_failed",
+					site: site.key,
+					action: line.action,
+					requestId: request.requestId,
+					message: String(error)
+				});
+			}
+		}
+	};
+}
+/**
+* Deletes the lines of a site older than its retention, a bounded number per run (ADR-037). A site
+* with no retention keeps every line. The trigger of migrations/0016 refuses any other delete.
+*/
+async function dropExpiredLines(db, site, now) {
+	const days = site.audit.retentionDays;
+	if (days === null) return 0;
+	const before = (/* @__PURE__ */ new Date(now.getTime() - days * 864e5)).toISOString();
+	const [result] = await db.batch([db.prepare(`DELETE FROM audit_log WHERE id IN (SELECT id FROM audit_log WHERE site_id = ?1 AND created_at < ?2 ORDER BY created_at LIMIT ?3)`).bind(site.key, before, 500)]);
+	return result?.meta.changes ?? 0;
+}
+/** The KV key that holds when a grant last rotated its refresh token, in seconds. */
+const rotatedKey = (grantId) => `hollware:rotated:${grantId}`;
+async function sha256(text) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+	return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/** The refresh token of a token request, or `null` for any other request. */
+async function refreshTokenOf(request) {
+	if (request.method !== "POST" || new URL(request.url).pathname !== "/oauth/token") return null;
+	if (!(request.headers.get("content-type") ?? "").startsWith("application/x-www-form-urlencoded")) return null;
+	const form = new URLSearchParams(await request.clone().text());
+	if (form.get("grant_type") !== "refresh_token") return null;
+	const token = form.get("refresh_token") ?? "";
+	const parts = token.split(":");
+	const [userId, grantId] = parts;
+	if (parts.length !== 3 || userId === void 0 || grantId === void 0) return null;
+	return {
+		token,
+		userId,
+		grantId
+	};
+}
+/**
+* The grant a refresh token belongs to when the token was already spent, past the grace: the
+* grant holds it as its previous token, and it rotated more than `REUSE_GRACE_SECONDS` ago (or so
+* long ago that the record of it expired). `null` for a token that is current, or unknown to the
+* grant, which the library answers as it does.
+*/
+async function spentRefresh(kv, refresh, now) {
+	const grant = await kv.get(`grant:${refresh.userId}:${refresh.grantId}`, { type: "json" });
+	if (grant === null || grant["previousRefreshTokenId"] !== await sha256(refresh.token)) return null;
+	const rotated = Number(await kv.get(rotatedKey(refresh.grantId)));
+	if (Number.isFinite(rotated) && rotated > 0 && now - rotated <= 60) return null;
+	const metadata = grant["metadata"];
+	const site = typeof metadata === "object" && metadata !== null ? Reflect.get(metadata, "site") : null;
+	return {
+		userId: refresh.userId,
+		grantId: refresh.grantId,
+		site: typeof site === "string" ? site : null
+	};
+}
+/** Records that a grant rotated its refresh token now, for the grace of a retry. */
+async function recordRotation(kv, grantId, now) {
+	await kv.put(rotatedKey(grantId), String(now), { expirationTtl: 120 });
+}
+/** The answer to a spent refresh token, as the library answers an invalid grant. */
+function reusedAnswer() {
+	return Response.json({
+		error: "invalid_grant",
+		error_description: "This refresh token was already used, so its grant was revoked. Connect the app again."
+	}, {
+		status: 400,
+		headers: { "cache-control": "no-store" }
+	});
+}
 //#endregion
 //#region src/structure/seal.ts
 /**
 * Sealing a secret of the structure (ADR-033) under the Worker secret `HOLLWARE_SECRET`, so that
 * the database alone never holds one in clear: AES-GCM with a 256-bit key that is the SHA-256 of
-* that secret, and a fresh 96-bit nonce each time. What is stored is `v1.` and the base64url of
-* the nonce and the ciphertext with its tag. A sealed value that was tampered with, or sealed
-* under another `HOLLWARE_SECRET`, does not open.
-*/
-const PREFIX = "v1.";
+* that secret, and a fresh 96-bit nonce each time. What is stored is `v2.` and the base64url of
+* the nonce and the ciphertext with its tag, sealed with the site and the name of the secret as
+* associated data: a value moved to another row of D1 does not open there (T-71 of the threat
+* model). One that was tampered with, or sealed under another `HOLLWARE_SECRET`, does not open.
+* A `v1.` value, sealed before the place was bound, still opens wherever it is.
+*/
+const PREFIX = "v2.";
+const BEFORE_PLACES = "v1.";
+const placeOf = (place) => new TextEncoder().encode(`${place.site}\n${place.name}`);
 function base64url(bytes) {
 	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
@@ -2086,25 +2261,28 @@ async function keyOf(master) {
 	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(master));
 	return crypto.subtle.importKey("raw", digest, "AES-GCM", false, ["encrypt", "decrypt"]);
 }
-async function seal(master, value) {
+async function seal(master, value, place) {
 	const nonce = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
 	const cipher = new Uint8Array(await crypto.subtle.encrypt({
 		name: "AES-GCM",
-		iv: nonce
+		iv: nonce,
+		additionalData: placeOf(place)
 	}, await keyOf(master), new TextEncoder().encode(value)));
 	const sealed = new Uint8Array(nonce.length + cipher.length);
 	sealed.set(nonce);
 	sealed.set(cipher, nonce.length);
 	return `${PREFIX}${base64url(sealed)}`;
 }
-/** The value of a sealed secret, or `null` when it does not open under `master`. */
-async function unseal(master, sealed) {
-	if (!sealed.startsWith(PREFIX)) return null;
+/** The value of a sealed secret, or `null` when it does not open under `master` at `place`. */
+async function unseal(master, sealed, place) {
+	const bound = sealed.startsWith(PREFIX);
+	if (!bound && !sealed.startsWith(BEFORE_PLACES)) return null;
 	try {
 		const bytes = fromBase64url(sealed.slice(3));
 		const plain = await crypto.subtle.decrypt({
 			name: "AES-GCM",
-			iv: bytes.slice(0, 12)
+			iv: bytes.slice(0, 12),
+			...bound ? { additionalData: placeOf(place) } : {}
 		}, await keyOf(master), bytes.slice(12));
 		return new TextDecoder().decode(plain);
 	} catch {
@@ -2305,6 +2483,226 @@ function installErrorHandling(app, log) {
 	}));
 }
 //#endregion
+//#region src/identity/pages.ts
+/**
+* The pages a person sees to get in (ADR-026): set up a passkey from a link, and sign in. They
+* are rendered by the Worker, outside the admin's bundle, with one inline script under a nonce
+* and nothing framing them. The script uses the WebAuthn JSON methods of the browser
+* (`PublicKeyCredential.parseCreationOptionsFromJSON`, `credential.toJSON()`), and reads the
+* invitation from the fragment of the address, which no request carries, so neither the page nor
+* a log of a request ever holds it (T-55); a link of before 0.11, with it in the query, still works.
+*/
+/**
+* The look of hollware.com and the admin, with nothing to fetch: the page's policy loads no font,
+* so the type is the system's. Dark only, the neutral greys of the theme, white as the primary
+* color and emerald for the mark (tests/conventions/brand.test.ts).
+*/
+const STYLE = `:root{color-scheme:dark;--bg:#0a0a0a;--card:#171717;--fg:#f5f5f5;--muted:#a3a3a3;--line:rgb(255 255 255/.1);--accent:#fafafa;--on-accent:#0a0a0a;--mark:#34d399;--danger:#ff8a80}
+*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:2rem 1rem;background:var(--bg);color:var(--fg);font:15px/1.6 system-ui,-apple-system,'Segoe UI',sans-serif;-webkit-font-smoothing:antialiased}
+main{width:100%;max-width:26rem;background:var(--card);border:1px solid var(--line);border-radius:14px;padding:2rem}
+.brand{display:flex;align-items:center;gap:.6rem;margin-bottom:1.75rem;font-weight:600;letter-spacing:-.01em}.brand svg{width:26px;height:26px}
+h1{font-size:1.4rem;line-height:1.25;letter-spacing:-.02em;margin:0 0 .5rem}p{color:var(--muted);margin:.5rem 0}strong{color:var(--fg)}
+label{display:block;margin:1rem 0 .35rem;font-size:.9rem;font-weight:500}fieldset label,form>label:has(input[type=checkbox]){font-weight:400;display:flex;align-items:center;gap:.5rem;margin:.5rem 0}
+input{width:100%;padding:.6rem .75rem;font:inherit;color:inherit;background:transparent;border:1px solid var(--line);border-radius:8px}input:focus{outline:2px solid var(--accent);outline-offset:1px}
+label input{width:auto;margin:0}fieldset{border:1px solid var(--line);border-radius:8px;margin:1rem 0;padding:.5rem .9rem}legend{color:var(--muted);font-size:.85rem;padding:0 .3rem}
+code{font:.82em ui-monospace,'SF Mono',Menlo,monospace;color:var(--muted)}
+button{margin-top:1.25rem;padding:.6rem 1rem;font:inherit;font-weight:500;cursor:pointer;border-radius:8px;border:1px solid var(--line);background:transparent;color:var(--fg)}
+button:not([value=deny]){background:var(--accent);border-color:var(--accent);color:var(--on-accent)}
+[role=alert]{color:var(--danger)}`;
+/**
+* The SHA-256 of STYLE, base64: the policy of every page allows that one stylesheet and no other
+* inline style (a test computes it again from STYLE, so the two cannot part).
+*/
+const STYLE_HASH = "sha256-XfLw/v21Jfp0bukRAqh1+Rz82lWrWpdy2GbGduQqpqY=";
+/**
+* What every page of the Worker says besides its policy: no window of another origin keeps a hold
+* on it, no other origin embeds it, and it asks for no device.
+*/
+const PAGE_ISOLATION = {
+	"cross-origin-opener-policy": "same-origin",
+	"cross-origin-resource-policy": "same-origin",
+	"permissions-policy": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=()"
+};
+/** The mark of Hollware, before the title of every page. */
+const BRAND = `<div class="brand"><svg viewBox="0 0 32 32" aria-hidden="true"><rect width="32" height="32" rx="8" fill="currentColor" opacity=".08"/><path d="M9 8v16M23 8v16M9 16h14" stroke="var(--mark)" stroke-width="3" stroke-linecap="round" fill="none"/></svg>Hollware</div>`;
+const POST = `async function post(path, body) {
+  const response = await fetch(path, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) })
+  const data = await response.json()
+  if (!response.ok) throw new Error(data.message + ' ' + (data.fix ?? ''))
+  return data
+}
+function fail(error) { document.getElementById('error').textContent = error.message }`;
+function page(title, nonce, body, script) {
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title} · Hollware</title>
+<style>${STYLE}</style>
+</head>
+<body>
+<main>
+${BRAND}
+<h1>${title}</h1>
+${body}
+<p id="error" role="alert"></p>
+</main>
+<script nonce="${nonce}">${POST}
+${script}<\/script>
+</body>
+</html>
+`;
+}
+/**
+* The invitation of a setup link: in its fragment (`#invitation=…`), which a browser never sends,
+* so no log of a request holds it (T-55); or, in a link made before 0.11, in its query. The page
+* runs its source as it is: it uses nothing but its arguments and the URL of the platform.
+*/
+function invitationOf(hash, search) {
+	return new URLSearchParams(hash.replace(/^#/, "")).get("invitation") ?? new URLSearchParams(search).get("invitation") ?? "";
+}
+function setupPage(nonce) {
+	return page("Set up your passkey", nonce, `<p>A passkey lets you into this Hollware with your device's lock: no password.</p>
+<form id="form">
+<label for="name">Your name</label><input id="name" name="name" autocomplete="name">
+<label for="label">This device</label><input id="label" name="label" value="Passkey">
+<button type="submit">Create the passkey</button>
+</form>`, `const invitationOf = ${invitationOf.toString()}
+document.getElementById('form').addEventListener('submit', async (event) => {
+  event.preventDefault()
+  try {
+    const invitation = invitationOf(location.hash, location.search)
+    const { challengeId, options } = await post('/auth/register/options', { invitation })
+    const credential = await navigator.credentials.create({ publicKey: PublicKeyCredential.parseCreationOptionsFromJSON(options) })
+    await post('/auth/register/verify', { challengeId, response: credential.toJSON(), name: document.getElementById('name').value, label: document.getElementById('label').value })
+    location.href = '/admin/'
+  } catch (error) { fail(error) }
+})`);
+}
+/**
+* Where the sign-in page sends the person after their passkey: the `return_to` it was given, if it
+* is a page of this origin, else the admin. The target is read as the browser will read it, as a
+* URL against the page's own origin, so no way of writing another host (`//`, `/\`, a tab, a
+* scheme) gets through, and only the path, query and fragment it resolves to are used (T-43).
+* The page runs its source as it is: it uses nothing but its arguments and the URL of the platform.
+*/
+function sameOriginTarget(target, origin) {
+	if (target === null) return "/admin/";
+	try {
+		const url = new URL(target, origin);
+		return url.origin === origin ? `${url.pathname}${url.search}${url.hash}` : "/admin/";
+	} catch {
+		return "/admin/";
+	}
+}
+function signInPage(nonce) {
+	return page("Sign in", nonce, `<p>Sign in to this Hollware with your passkey.</p>
+<button id="signin" type="button">Sign in with a passkey</button>`, `const sameOriginTarget = ${sameOriginTarget.toString()}
+document.getElementById('signin').addEventListener('click', async () => {
+  try {
+    const { challengeId, options } = await post('/auth/signin/options', {})
+    const credential = await navigator.credentials.get({ publicKey: PublicKeyCredential.parseRequestOptionsFromJSON(options) })
+    await post('/auth/signin/verify', { challengeId, response: credential.toJSON() })
+    location.href = sameOriginTarget(new URLSearchParams(location.search).get('return_to'), location.origin)
+  } catch (error) { fail(error) }
+})`);
+}
+/** The headers of a page: no framing, only its own script, and no caching. */
+function pageHeaders(nonce) {
+	return {
+		"content-type": "text/html; charset=utf-8",
+		"cache-control": "no-store",
+		"content-security-policy": `default-src 'none'; script-src 'nonce-${nonce}'; style-src '${STYLE_HASH}'; connect-src 'self'; form-action 'none'; base-uri 'none'; frame-ancestors 'none'`,
+		"x-content-type-options": "nosniff",
+		"referrer-policy": "no-referrer",
+		...PAGE_ISOLATION
+	};
+}
+/** Text for HTML: every string a client chose (its name, its redirect host, a scope) goes through it. */
+function escapeHtml(value) {
+	return value.replace(/[&<>"']/g, (char) => `&#${char.charCodeAt(0)};`);
+}
+/** What a scope lets a client do, in the words of the consent page. */
+const SCOPE_WORDS = {
+	"content:read": "Read the content, drafts included",
+	"content:write": "Write drafts",
+	"content:publish": "Publish and unpublish",
+	"schema:admin": "Change the site settings"
+};
+/**
+* The consent page of `/authorize` (ADR-026): which client asks, where the tokens go, and what it
+* may do, with Allow and Deny. It has no script, and it posts the handle that `beginConsent` bound
+* to this browser. Everything the client chose is escaped.
+*/
+function consentPage(view) {
+	const name = escapeHtml(view.clientName);
+	const origin = view.clientDomain === void 0 ? "<p>This app registered itself: its name is not verified.</p>" : `<p>Published by <strong>${escapeHtml(view.clientDomain)}</strong>.</p>`;
+	const loopback = view.redirectIsLoopback ? "<p><strong>This sends access to an app on this computer.</strong> Continue only if you just started to connect it.</p>" : "";
+	const sites = view.sites.length === 1 ? `<input type="hidden" name="site" value="${escapeHtml(view.sites[0] ?? "")}">` : `<fieldset><legend>For the site</legend>${view.sites.map((site, index) => `<label><input type="radio" name="site" value="${escapeHtml(site)}"${index === 0 ? " checked" : ""}> ${escapeHtml(site)}</label>`).join("\n")}</fieldset>`;
+	const scopes = view.scopes.map((scope) => `<label><input type="checkbox" name="scope" value="${escapeHtml(scope)}" checked> ${escapeHtml(SCOPE_WORDS[scope] ?? scope)} <code>${escapeHtml(scope)}</code></label>`).join("\n");
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Allow ${name} · Hollware</title>
+<style>${STYLE}</style>
+</head>
+<body>
+<main>
+${BRAND}
+<h1>Allow ${name} to use this Hollware?</h1>
+${origin}
+<p>Signed in as <strong>${escapeHtml(view.person)}</strong>. Access goes to <strong>${escapeHtml(view.redirectHost)}</strong>.</p>
+${loopback}
+<form method="post" action="/authorize">
+<input type="hidden" name="handle" value="${escapeHtml(view.handle)}">
+${sites}
+${scopes}
+<p><button name="decision" value="approve">Allow</button> <button name="decision" value="deny">Deny</button></p>
+</form>
+</main>
+</body>
+</html>
+`;
+}
+/** A page that only says what went wrong and what to do. */
+function messagePage(title, message) {
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)} · Hollware</title>
+<style>${STYLE}</style>
+</head>
+<body>
+<main>
+${BRAND}
+<h1>${escapeHtml(title)}</h1>
+<p>${escapeHtml(message)}</p>
+</main>
+</body>
+</html>
+`;
+}
+/**
+* The headers of a page without a script: no framing and no caching. The form of the consent page
+* posts to `/authorize`, which redirects to the client, so `form-action` is not restricted: a
+* browser applies it to the redirect too.
+*/
+function plainPageHeaders() {
+	return {
+		"content-type": "text/html; charset=utf-8",
+		"cache-control": "no-store",
+		"content-security-policy": `default-src 'none'; style-src '${STYLE_HASH}'; base-uri 'none'; frame-ancestors 'none'`,
+		"x-content-type-options": "nosniff",
+		"referrer-policy": "no-referrer",
+		...PAGE_ISOLATION
+	};
+}
+//#endregion
 //#region src/oauth/admin.ts
 /**
 * The admin as a client of the OAuth server (ADR-026): a public client, with PKCE, that a person
@@ -2393,6 +2791,7 @@ function installAdmin(app, options) {
 		headers.set("cache-control", "no-store");
 		headers.set("x-content-type-options", "nosniff");
 		headers.set("referrer-policy", "no-referrer");
+		for (const [name, value] of Object.entries(PAGE_ISOLATION)) headers.set(name, value);
 		return new Response(answer.body, {
 			status: 200,
 			headers
@@ -2428,17 +2827,171 @@ async function removeMember(db, input) {
 	return (await db.prepare(`DELETE FROM members WHERE site_id = ?1 AND user_id = ?2 AND (role <> 'owner' OR ${OTHER_OWNERS})`).bind(input.site, input.userId).run()).meta.changes === 1 ? "changed" : "last_owner";
 }
 //#endregion
-//#region src/http/admin-api.ts
-/**
-* What only a person in the admin may do (ADR-026): see, make and revoke personal tokens, and
-* invite people, on the site of their token; and learn who they are and which sites they may switch
-* to (`/v1/admin/me`, the one route for every role). These are no operations, so no agent sees them over MCP, and a request needs an
+//#region src/audit/read.ts
+/** A refusal of a filter or a cursor, with what to do instead. */
+var ActivityInputError = class extends Error {
+	fix;
+	constructor(message, fix) {
+		super(message);
+		this.fix = fix;
+	}
+};
+const INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?Z$/;
+const ID = /^[a-z]{3}_[0-9A-HJKMNP-TV-Z]{26}$/;
+function encodeCursor(at, id) {
+	return btoa(`${at}|${id}`).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function decodeCursor(cursor) {
+	try {
+		const [at = "", id = ""] = atob(cursor.replace(/-/g, "+").replace(/_/g, "/")).split("|");
+		if (INSTANT.test(at) && ID.test(id)) return {
+			at,
+			id
+		};
+	} catch {}
+	throw new ActivityInputError("The cursor is not valid for the activity log.", "Pass the nextCursor of the previous page unchanged, or leave it out for the first page.");
+}
+function instant(name, value) {
+	if (value === void 0) return null;
+	if (!INSTANT.test(value) || Number.isNaN(Date.parse(value))) throw new ActivityInputError(`${name} is not an instant.`, "Give it in UTC as 2026-10-17T00:00:00.000Z.");
+	return new Date(value).toISOString();
+}
+function json$2(text) {
+	if (text === null) return null;
+	try {
+		const value = JSON.parse(text);
+		return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : null;
+	} catch {
+		return null;
+	}
+}
+/** One page of the log of `site`, newest first; at most `limit` lines, 1 to 500. */
+async function readActivity(db, site, filters, page) {
+	if (filters.action !== void 0 && !isAuditAction(filters.action)) throw new ActivityInputError(`There is no action ${filters.action}.`, "Use an action of the activity log, such as publish or token.create.");
+	const limit = Math.min(Math.max(Math.trunc(page.limit), 1), 500);
+	const where = ["a.site_id = ?1"];
+	const binds = [site];
+	const add = (clause, value) => {
+		binds.push(value);
+		where.push(clause(binds.length));
+	};
+	if (filters.actor !== void 0) add((i) => `a.actor_user_id = ?${i}`, filters.actor);
+	if (filters.action !== void 0) add((i) => `a.action = ?${i}`, filters.action);
+	if (filters.targetType !== void 0) add((i) => `a.target_type = ?${i}`, filters.targetType);
+	if (filters.targetId !== void 0) add((i) => `a.target_id = ?${i}`, filters.targetId);
+	const from = instant("from", filters.from);
+	if (from !== null) add((i) => `a.created_at >= ?${i}`, from);
+	const to = instant("to", filters.to);
+	if (to !== null) add((i) => `a.created_at < ?${i}`, to);
+	if (page.cursor !== void 0) {
+		const after = decodeCursor(page.cursor);
+		binds.push(after.at, after.id);
+		where.push(`(a.created_at, a.id) < (?${binds.length - 1}, ?${binds.length})`);
+	}
+	binds.push(limit + 1);
+	const [result] = await db.batch([db.prepare(`SELECT a.id, a.created_at, a.action, a.outcome, a.error_code, a.actor_kind, a.actor_user_id,
+                u.name AS actor_name, a.actor_token_id, t.label AS token_label, a.actor_client_id,
+                a.actor_meta, a.target_type, a.target_id, a.detail, a.request_id, a.ip_hash
+         FROM audit_log a
+         LEFT JOIN users u ON u.id = a.actor_user_id
+         LEFT JOIN tokens t ON t.id = a.actor_token_id AND t.site_id = a.site_id
+         WHERE ${where.join(" AND ")}
+         ORDER BY a.created_at DESC, a.id DESC
+         LIMIT ?${binds.length}`).bind(...binds)]);
+	const rows = result?.results ?? [];
+	const lines = rows.slice(0, limit).map((row) => ({
+		id: row.id,
+		at: row.created_at,
+		action: row.action,
+		outcome: row.outcome,
+		errorCode: row.error_code,
+		actor: {
+			kind: row.actor_kind,
+			userId: row.actor_user_id,
+			name: row.actor_name,
+			tokenId: row.actor_token_id,
+			tokenLabel: row.token_label,
+			clientId: row.actor_client_id,
+			declared: json$2(row.actor_meta)
+		},
+		target: row.target_type === null || row.target_id === null ? null : {
+			type: row.target_type,
+			id: row.target_id
+		},
+		detail: json$2(row.detail),
+		requestId: row.request_id,
+		ipHash: row.ip_hash
+	}));
+	const last = lines.at(-1);
+	return {
+		lines,
+		nextCursor: rows.length > limit && last !== void 0 ? encodeCursor(last.at, last.id) : null
+	};
+}
+/** The columns of the CSV, in order. */
+const ACTIVITY_CSV_COLUMNS = [
+	"at",
+	"action",
+	"outcome",
+	"error_code",
+	"actor_kind",
+	"actor_user_id",
+	"actor_name",
+	"actor_token_id",
+	"actor_token_label",
+	"actor_client_id",
+	"actor_declared",
+	"target_type",
+	"target_id",
+	"detail",
+	"request_id",
+	"ip_hash"
+];
+/**
+* A field of CSV (RFC 4180), with a cell that a spreadsheet would run as a formula (`=`, `+`, `-`,
+* `@`, a tab or a return first) led by an apostrophe: a name or a label is anyone's text.
+*/
+function csvField(value) {
+	if (value === null) return "";
+	const safe = /^[=+\-@\t\r]/.test(value) ? `'${value}` : value;
+	return /[",\r\n]/.test(safe) ? `"${safe.replace(/"/g, "\"\"")}"` : safe;
+}
+function activityCsvRow(line) {
+	const text = (value) => value === null ? null : JSON.stringify(value);
+	return [
+		line.at,
+		line.action,
+		line.outcome,
+		line.errorCode,
+		line.actor.kind,
+		line.actor.userId,
+		line.actor.name,
+		line.actor.tokenId,
+		line.actor.tokenLabel,
+		line.actor.clientId,
+		text(line.actor.declared),
+		line.target?.type ?? null,
+		line.target?.id ?? null,
+		text(line.detail),
+		line.requestId,
+		line.ipHash
+	].map(csvField).join(",");
+}
+//#endregion
+//#region src/http/admin-api.ts
+/**
+* What only a person in the admin may do (ADR-026): see, make and revoke personal tokens, and
+* invite people, on the site of their token; and learn who they are and which sites they may switch
+* to (`/v1/admin/me`), and manage their own sign-in (`/v1/admin/account`: their passkeys, the apps
+* they connected and their sessions), the routes for every role. These are no operations, so no agent sees them over MCP, and a request needs an
 * access token of the admin's own client with `schema:admin`: a personal token, or a token of
 * another client, never reaches them, even an owner's. A leaked token cannot mint the next one.
 */
-/** A personal token lasts this long unless the person says otherwise (as `hollware token create`). */
-const TOKEN_DAYS = 90;
 const INVITATION_DAYS = 7;
+/** The lines of a page of the activity log, unless the admin asks for another number. */
+const ACTIVITY_PAGE = 50;
+/** The most lines one CSV of the activity log holds. */
+const ACTIVITY_CSV_MAX = 1e4;
 function json$1(body, status = 200) {
 	return Response.json(body, {
 		status,
@@ -2452,6 +3005,20 @@ const REFUSAL_CODES = {
 	404: "not_found",
 	409: "conflict"
 };
+/** The code of a refusal by its status, for the activity log. */
+function refusalCode(status) {
+	if (status === 503) return "unavailable";
+	return status === 403 || status === 404 || status === 409 ? REFUSAL_CODES[status] : "internal";
+}
+/**
+* The page of an entry on its site, or `null` when the site has no URL or no route for the locale:
+* the origin and the route of the collection with its slug (the admin's `pageUrl` does the same).
+*/
+function pageUrlOf(site, entry) {
+	const route = site.collections.get(entry.collection)?.routes[entry.locale];
+	if (site.url === null || route === void 0) return null;
+	return `${site.url.replace(/\/+$/, "")}${route.replace(/:slug(?![A-Za-z0-9_])/, entry.slug)}`;
+}
 function refused(message, fix, status = 400) {
 	return json$1({
 		code: REFUSAL_CODES[status],
@@ -2467,26 +3034,87 @@ function parseScopes(json) {
 		return [];
 	}
 }
-function daysFrom(value, fallback) {
+/** The days an invitation lasts: `fallback` when left out, a whole number from 1 to 365, or null. */
+function invitationDays(value, fallback) {
 	if (value === void 0) return fallback;
 	return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 365 ? value : null;
 }
+/**
+* The days a token lasts: none (`null`) when they are left out, so it never expires (T-26: the
+* person chooses), or a whole number from 1 to 365; `undefined` for anything else.
+*/
+function daysFrom(value) {
+	if (value === void 0 || value === null) return null;
+	return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 365 ? value : void 0;
+}
+/** At most this many grants of a person are read: pages of the library's listing, 100 each. */
+const GRANT_PAGES = 10;
+/** Every grant of a person, across the sites of the deployment. */
+async function grantsOf(helpers, userId) {
+	const grants = [];
+	let cursor;
+	for (let page = 0; page < GRANT_PAGES; page++) {
+		const listed = await helpers.listUserGrants(userId, {
+			limit: 100,
+			...cursor === void 0 ? {} : { cursor }
+		});
+		grants.push(...listed.items);
+		cursor = listed.cursor;
+		if (cursor === void 0) break;
+	}
+	return grants;
+}
+/** The name a client gave itself, or its id when it gave none or cannot be read now. */
+async function clientName(helpers, clientId) {
+	try {
+		return (await helpers.lookupClient(clientId))?.clientName ?? clientId;
+	} catch {
+		return clientId;
+	}
+}
+function siteOf(metadata) {
+	if (typeof metadata !== "object" || metadata === null) return null;
+	const site = Reflect.get(metadata, "site");
+	return typeof site === "string" ? site : null;
+}
 function installAdminApi(app, options) {
 	/**
 	* Runs `handle` for a person in the admin with `schema:admin`, or with any scope when `anyone`;
-	* anyone else is refused.
+	* anyone else is refused. A route that changes something names its `action`, and gets one line
+	* of the activity log for each answer but a 400 (ADR-037): `ok` with what `handle` noted, `denied`
+	* for a 403, `failed` for a 404 or a 409. A change of the person's own sign-in (`everySite`) is a
+	* line in each site they are a member of, since a person is of the deployment.
 	*/
-	const admin = (handle, { anyone = false } = {}) => (c) => options.protect(c, async (principal) => {
-		const ours = (await adminClient(options.oauth(c.env.HOLLWARE_PUBLIC_URL), c.env)).clientId;
-		if (principal.kind !== "oauth" || principal.clientId !== ours) return refused("Only the admin may do this.", "Sign in to the admin at /admin/ and do it there.", 403);
-		if (!anyone && !principal.scopes.includes("schema:admin")) return insufficientScope(["schema:admin"], options.metadataUrl(c));
-		return handle(c, principal);
+	const admin = (action, handle, { anyone = false, everySite = false } = {}) => (c) => options.protect(c, async (principal) => {
+		const note = {};
+		const answer = await (async () => {
+			const ours = (await adminClient(options.oauth(c.env.HOLLWARE_PUBLIC_URL), c.env)).clientId;
+			if (principal.kind !== "oauth" || principal.clientId !== ours) return refused("Only the admin may do this.", "Sign in to the admin at /admin/ and do it there.", 403);
+			if (!anyone && !principal.scopes.includes("schema:admin")) return insufficientScope(["schema:admin"], options.metadataUrl(c));
+			return handle(c, principal, note);
+		})();
+		if (action !== null && answer.status !== 400 && principal.kind !== "read") {
+			const keys = everySite ? (await membershipsOf(connect(c.env.DB), principal.userId)).map((m) => m.site) : [principal.site];
+			const log = (await options.audit(c, principal))(null);
+			const line = {
+				action,
+				outcome: answer.ok ? "ok" : answer.status === 403 ? "denied" : "failed",
+				errorCode: answer.ok ? null : answer.status === 403 && answer.headers.has("www-authenticate") ? "insufficient_scope" : refusalCode(answer.status),
+				target: note.target ?? null,
+				detail: note.detail ?? null
+			};
+			for (const key of new Set(keys)) {
+				const site = options.site(key);
+				if (site !== void 0) await log.write(site, line);
+			}
+		}
+		return answer;
 	});
 	const body = async (c) => {
 		const value = await c.req.json().catch(() => null);
 		return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : {};
 	};
-	app.get("/v1/admin/me", admin(async (c, person) => {
+	app.get("/v1/admin/me", admin(null, async (c, person) => {
 		const db = connect(c.env.DB);
 		const [user] = await db.select({
 			id: users.id,
@@ -2508,7 +3136,37 @@ function installAdminApi(app, options) {
 			trash
 		});
 	}, { anyone: true }));
-	app.get("/v1/admin/tokens", admin(async (c, person) => {
+	app.post("/v1/admin/preview", admin("preview.create", async (c, person, note) => {
+		const entryId = (await body(c))["entryId"];
+		if (typeof entryId !== "string" || !isId("ent", entryId)) return refused("Give the id of an entry.", "Send { \"entryId\": \"ent_…\" }.");
+		note.target = {
+			type: "entry",
+			id: entryId
+		};
+		const secret = c.env.HOLLWARE_SECRET;
+		if (!canSignPreviews(secret)) return json$1({
+			code: "unavailable",
+			message: "This Hollware cannot make preview links: it has no signing secret.",
+			fix: "Set the Worker secret HOLLWARE_SECRET to at least 32 characters (`hollware deploy` makes one), then try again."
+		}, 503);
+		const site = options.site(person.site);
+		const found = await createD1Store(c.env.DB).findEntryById(person.site, entryId, "head");
+		if (site === void 0 || found === null) return refused("This site has no such entry.", "Open the entry from its collection in the admin.", 404);
+		const made = await makePreviewToken({
+			secret,
+			site: person.site,
+			entryId,
+			now: options.clock.now()
+		});
+		const page = pageUrlOf(site, found.entry);
+		note.detail = { expiresAt: made.expiresAt };
+		return json$1({
+			token: made.token,
+			expiresAt: made.expiresAt,
+			url: page === null ? null : `${page}?${PREVIEW_QUERY_PARAM}=${made.token}`
+		});
+	}, { anyone: true }));
+	app.get("/v1/admin/tokens", admin(null, async (c, person) => {
 		return json$1({ tokens: (await connect(c.env.DB).select({
 			id: tokens.id,
 			kind: tokens.kind,
@@ -2524,7 +3182,7 @@ function installAdminApi(app, options) {
 			scopes: parseScopes(row.scopes)
 		})) });
 	}));
-	app.post("/v1/admin/tokens", admin(async (c, person) => {
+	app.post("/v1/admin/tokens", admin("token.create", async (c, person, note) => {
 		const input = await body(c);
 		const label = typeof input["label"] === "string" ? input["label"].trim() : "";
 		if (label === "" || label.length > 100) return refused("A token needs a label of 1 to 100 characters.", "Say what the token is for.");
@@ -2534,8 +3192,8 @@ function installAdminApi(app, options) {
 		const asked = kind === "read" ? ["content:read"] : Array.isArray(input["scopes"]) ? input["scopes"].filter((s) => typeof s === "string") : [];
 		const scopes = person.scopes.filter((scope) => asked.includes(scope));
 		if (scopes.length === 0) return refused("A token needs at least one scope that you have.", `Choose among ${person.scopes.join(", ")}.`);
-		const days = daysFrom(input["expiresInDays"], TOKEN_DAYS);
-		if (days === null) return refused("expiresInDays is a whole number from 1 to 365.", "Leave it out for 90 days.");
+		const days = daysFrom(input["expiresInDays"]);
+		if (days === void 0) return refused("expiresInDays is a whole number from 1 to 365.", "Leave it out for a token that never expires.");
 		const now = options.clock.now();
 		const secret = kind === "read" ? generateReadToken() : generatePersonalToken();
 		const row = {
@@ -2546,13 +3204,23 @@ function installAdminApi(app, options) {
 			label,
 			hash: await hashPersonalToken(secret),
 			scopes: JSON.stringify(scopes),
-			expiresAt: new Date(now.getTime() + days * 864e5).toISOString(),
+			expiresAt: days === null ? null : new Date(now.getTime() + days * 864e5).toISOString(),
 			revokedAt: null,
 			lastUsedAt: null,
 			createdAt: now.toISOString(),
 			updatedAt: now.toISOString()
 		};
 		await connect(c.env.DB).insert(tokens).values(row);
+		note.target = {
+			type: "token",
+			id: row.id
+		};
+		note.detail = {
+			kind,
+			label,
+			scopes,
+			expiresAt: row.expiresAt
+		};
 		return json$1({
 			id: row.id,
 			kind,
@@ -2562,10 +3230,14 @@ function installAdminApi(app, options) {
 			secret
 		}, 201);
 	}));
-	app.post("/v1/admin/tokens/:id/revoke", admin(async (c, person) => {
+	app.post("/v1/admin/tokens/:id/revoke", admin("token.revoke", async (c, person, note) => {
 		const now = options.clock.now().toISOString();
 		const db = connect(c.env.DB);
 		const id = c.req.param("id") ?? "";
+		note.target = {
+			type: "token",
+			id
+		};
 		const [revoked] = await db.update(tokens).set({
 			revokedAt: now,
 			updatedAt: now
@@ -2583,7 +3255,7 @@ function installAdminApi(app, options) {
 			revokedAt: row.revokedAt
 		});
 	}));
-	app.get("/v1/admin/people", admin(async (c, person) => {
+	app.get("/v1/admin/people", admin(null, async (c, person) => {
 		const db = connect(c.env.DB);
 		const now = options.clock.now().toISOString();
 		return json$1({
@@ -2609,12 +3281,17 @@ function installAdminApi(app, options) {
 			case "last_owner": return refused("A site keeps at least one owner, and this is its last one.", "Make another person an owner first, then change this one.", 409);
 		}
 	};
-	app.post("/v1/admin/people/role", admin(async (c, person) => {
+	app.post("/v1/admin/people/role", admin("member.role", async (c, person, note) => {
 		const input = await body(c);
 		const role = input["role"];
 		const userId = input["userId"];
 		if (typeof userId !== "string" || typeof role !== "string" || !isRole(role)) return refused("Give the userId of a member and a role.", `Send { "userId": "usr_…", "role": "owner" | "editor" | "author" }.`);
 		const now = options.clock.now().toISOString();
+		note.target = {
+			type: "user",
+			id: userId
+		};
+		note.detail = { role };
 		return answerOf(await setRole(c.env.DB, {
 			site: person.site,
 			userId,
@@ -2622,19 +3299,23 @@ function installAdminApi(app, options) {
 			now
 		}));
 	}));
-	app.post("/v1/admin/people/remove", admin(async (c, person) => {
+	app.post("/v1/admin/people/remove", admin("member.remove", async (c, person, note) => {
 		const userId = (await body(c))["userId"];
 		if (typeof userId !== "string") return refused("Give the userId of a member.", "Send { \"userId\": \"usr_…\" }.");
+		note.target = {
+			type: "user",
+			id: userId
+		};
 		return answerOf(await removeMember(c.env.DB, {
 			site: person.site,
 			userId
 		}));
 	}));
-	app.post("/v1/admin/invitations", admin(async (c, person) => {
+	app.post("/v1/admin/invitations", admin("invitation.create", async (c, person, note) => {
 		const input = await body(c);
 		const role = input["role"];
 		if (typeof role !== "string" || !isRole(role) || role === "owner") return refused("An invitation is for an editor or an author.", `Use role "editor" (${ROLE_SCOPES.editor.join(", ")}) or "author" (${ROLE_SCOPES.author.join(", ")}).`);
-		const days = daysFrom(input["days"], INVITATION_DAYS);
+		const days = invitationDays(input["days"], INVITATION_DAYS);
 		if (days === null) return refused("days is a whole number from 1 to 365.", "Leave it out for 7 days.");
 		const made = await createInvitation(connect(c.env.DB), {
 			site: person.site,
@@ -2643,14 +3324,265 @@ function installAdminApi(app, options) {
 			now: options.clock.now(),
 			days
 		});
+		note.target = {
+			type: "invitation",
+			id: made.id
+		};
+		note.detail = {
+			role,
+			days
+		};
 		const origin = options.oauth(c.env.HOLLWARE_PUBLIC_URL).issuer;
 		return json$1({
 			id: made.id,
 			role,
 			expiresAt: made.expiresAt,
-			link: `${origin}/setup?invitation=${made.secret}`
+			link: `${origin}/setup#invitation=${made.secret}`
 		}, 201);
 	}));
+	const filtersOf = (c) => {
+		const filters = {};
+		for (const name of [
+			"actor",
+			"action",
+			"targetType",
+			"targetId",
+			"from",
+			"to"
+		]) {
+			const value = c.req.query(name);
+			if (value !== void 0 && value !== "") filters[name] = value;
+		}
+		return filters;
+	};
+	/** An answer of the log, or the refusal of a filter or a cursor that is not valid. */
+	const reading = async (read) => {
+		try {
+			return await read();
+		} catch (error) {
+			if (error instanceof ActivityInputError) return refused(error.message, error.fix);
+			throw error;
+		}
+	};
+	app.get("/v1/admin/activity", admin(null, async (c, person) => reading(async () => {
+		const cursor = c.req.query("cursor");
+		const limit = Number(c.req.query("limit") ?? ACTIVITY_PAGE);
+		return json$1(await readActivity(c.env.DB, person.site, filtersOf(c), {
+			...cursor === void 0 ? {} : { cursor },
+			limit: Number.isFinite(limit) ? limit : ACTIVITY_PAGE
+		}));
+	})));
+	app.get("/v1/admin/activity.csv", admin(null, async (c, person) => reading(async () => {
+		const rows = [ACTIVITY_CSV_COLUMNS.join(",")];
+		let cursor;
+		do {
+			const page = await readActivity(c.env.DB, person.site, filtersOf(c), {
+				...cursor === void 0 ? {} : { cursor },
+				limit: 500
+			});
+			rows.push(...page.lines.map(activityCsvRow));
+			cursor = page.nextCursor ?? void 0;
+		} while (cursor !== void 0 && rows.length <= ACTIVITY_CSV_MAX);
+		return new Response(`${rows.join("\r\n")}\r\n`, { headers: {
+			"content-type": "text/csv; charset=utf-8",
+			"content-disposition": `attachment; filename="activity-${person.site}.csv"`,
+			"cache-control": "no-store"
+		} });
+	})));
+	/** The OAuth helpers and the admin's own client, for the public URL of the request. */
+	const grantsApi = async (c) => {
+		const oauth = options.oauth(c.env.HOLLWARE_PUBLIC_URL);
+		return {
+			helpers: oauth.authorizationServer.getOAuthApi(c.env),
+			admin: (await adminClient(oauth, c.env)).clientId
+		};
+	};
+	app.get("/v1/admin/account", admin(null, async (c, person) => {
+		const passkeys = await passkeySummaries(connect(c.env.DB), person.userId);
+		const { helpers, admin: ours } = await grantsApi(c);
+		const grants = await grantsOf(helpers, person.userId);
+		const names = /* @__PURE__ */ new Map();
+		const nameOf = (clientId) => {
+			const known = names.get(clientId);
+			if (known !== void 0) return known;
+			const asked = clientName(helpers, clientId);
+			names.set(clientId, asked);
+			return asked;
+		};
+		const apps = await Promise.all(grants.map(async (grant) => ({
+			grantId: grant.id,
+			clientId: grant.clientId,
+			name: await nameOf(grant.clientId),
+			scopes: grant.scope.filter(isScope),
+			site: siteOf(grant.metadata),
+			createdAt: (/* @__PURE__ */ new Date(grant.createdAt * 1e3)).toISOString(),
+			admin: grant.clientId === ours
+		})));
+		apps.sort((a, b) => b.createdAt.localeCompare(a.createdAt) || a.grantId.localeCompare(b.grantId));
+		return json$1({
+			passkeys,
+			apps
+		});
+	}, { anyone: true }));
+	app.post("/v1/admin/account/passkeys/remove", admin("passkey.remove", async (c, person, note) => {
+		const id = (await body(c))["id"];
+		if (typeof id !== "string") return refused("Give the id of one of your passkeys.", "Send { \"id\": \"pky_…\" }.");
+		note.target = {
+			type: "passkey",
+			id
+		};
+		switch (await removePasskey(c.env.DB, {
+			userId: person.userId,
+			id
+		})) {
+			case "removed": return json$1({
+				outcome: "removed",
+				id
+			});
+			case "not_found": return refused("You have no such passkey.", "List your passkeys and pick one of them.", 404);
+			case "last": return refused("This is your last passkey: without it you could not sign in again.", "Add another passkey first, then remove this one.", 409);
+		}
+	}, {
+		anyone: true,
+		everySite: true
+	}));
+	app.post("/v1/admin/account/apps/revoke", admin("app.revoke", async (c, person, note) => {
+		const grantId = (await body(c))["grantId"];
+		if (typeof grantId !== "string") return refused("Give the grantId of one of your apps.", "Send { \"grantId\": \"…\" }.");
+		note.target = {
+			type: "grant",
+			id: grantId
+		};
+		const { helpers, admin: ours } = await grantsApi(c);
+		const grant = (await grantsOf(helpers, person.userId)).find((g) => g.id === grantId);
+		if (grant === void 0) return refused("You connected no such app.", "List your apps and pick one of them.", 404);
+		if (grant.clientId === ours) return refused("That is this admin: it is not revoked here.", "Sign out from the person menu, or sign out everywhere.", 409);
+		await helpers.revokeGrant(grant.id, person.userId);
+		note.detail = {
+			clientId: grant.clientId,
+			site: siteOf(grant.metadata)
+		};
+		return json$1({
+			outcome: "revoked",
+			grantId: grant.id
+		});
+	}, {
+		anyone: true,
+		everySite: true
+	}));
+	app.post("/v1/admin/account/sessions/end", admin("session.end_all", async (c, person, note) => {
+		const ended = await endSessions(connect(c.env.DB), person.userId);
+		const { helpers, admin: ours } = await grantsApi(c);
+		const admins = (await grantsOf(helpers, person.userId)).filter((g) => g.clientId === ours);
+		for (const grant of admins) await helpers.revokeGrant(grant.id, person.userId);
+		note.target = {
+			type: "user",
+			id: person.userId
+		};
+		note.detail = {
+			sessions: ended,
+			adminGrants: admins.length
+		};
+		return json$1({
+			outcome: "ended",
+			sessions: ended,
+			adminGrants: admins.length
+		});
+	}, {
+		anyone: true,
+		everySite: true
+	}));
+}
+//#endregion
+//#region src/audit/operations.ts
+/**
+* The line of a call of an operation (ADR-037): every operation that is not a read gets one,
+* whether it changed something, was refused or failed. Of the input, only the fields that name
+* what was acted on are kept, each shortened; of the output, its outcome and the id of the entry,
+* review or comment it answers with. Never the Markdown, the frontmatter, or a secret that
+* `make_webhook_secret` shows once.
+*/
+/** The fields of an input that name what an operation acts on. */
+const NAMING_FIELDS = [
+	"site",
+	"collection",
+	"locale",
+	"slug",
+	"id",
+	"entryId",
+	"reviewId",
+	"name"
+];
+const FIELD_MAX = 200;
+function isAudited(name) {
+	return OPERATION_AUDIT_ACTIONS.includes(name);
+}
+function record(value) {
+	return typeof value === "object" && value !== null ? Object.fromEntries(Object.entries(value)) : {};
+}
+function idOf(value) {
+	const id = record(value)["id"];
+	return typeof id === "string" ? id : null;
+}
+/** What the call acted on: the entry, review or comment of its answer, else its site. */
+function targetOf(output, site) {
+	const entry = idOf(output["entry"]);
+	if (entry !== null) return {
+		type: "entry",
+		id: entry
+	};
+	const review = idOf(output["review"]);
+	if (review !== null) return {
+		type: "review",
+		id: review
+	};
+	const comment = idOf(output["comment"]);
+	if (comment !== null) return {
+		type: "comment",
+		id: comment
+	};
+	return {
+		type: "site",
+		id: site
+	};
+}
+/** `denied` when a scope was missing; `failed` for any other error the caller got. */
+function outcomeOfError(code) {
+	return code === "insufficient_scope" ? "denied" : "failed";
+}
+/**
+* The line of a call, or `null` for a read. `result` is the output the caller got, or the code of
+* the error it got instead.
+*/
+function operationLine(spec, input, site, result) {
+	if (!isAudited(spec.name)) return null;
+	const named = {};
+	const given = record(input);
+	for (const field of NAMING_FIELDS) {
+		const value = given[field];
+		if (typeof value === "string") named[field] = value.slice(0, FIELD_MAX);
+	}
+	if ("errorCode" in result) return {
+		action: spec.name,
+		outcome: outcomeOfError(result.errorCode),
+		errorCode: result.errorCode,
+		target: {
+			type: "site",
+			id: site
+		},
+		detail: Object.keys(named).length === 0 ? null : { input: named }
+	};
+	const output = record(result.output);
+	const answer = output["outcome"];
+	return {
+		action: spec.name,
+		outcome: "ok",
+		target: targetOf(output, site),
+		detail: {
+			...typeof answer === "string" ? { answer } : {},
+			...Object.keys(named).length === 0 ? {} : { input: named }
+		}
+	};
 }
 //#endregion
 //#region src/semantic/cloudflare.ts
@@ -2856,6 +3788,8 @@ function invoke(handlers, spec, input, context) {
 }
 //#endregion
 //#region src/http/ops-api.ts
+/** The client of every call of this API: the admin. */
+const CLIENT = { name: "hollware-admin" };
 const STATUS$1 = {
 	invalid_input: 400,
 	unknown_collection: 404,
@@ -2878,8 +3812,15 @@ function installOpsApi(app, options) {
 			message: `There is no operation ${c.req.param("name")}.`,
 			fix: "Use the name of an operation, as tools/list of MCP lists them."
 		}, 404);
+		const site = options.sites.get(principal.site);
+		if (site === void 0) throw new Error(`No site ${principal.site} for a checked token`);
+		const audit = options.audit === void 0 ? null : (await options.audit(c, principal))(CLIENT);
 		const scopes = spec.scopes;
-		if (missingScopes(principal, scopes).length > 0) return insufficientScope(scopes, options.metadataUrl(c));
+		if (missingScopes(principal, scopes).length > 0) {
+			const line = operationLine(spec, null, site.key, { errorCode: "insufficient_scope" });
+			if (line !== null) await audit?.write(site, line);
+			return insufficientScope(scopes, options.metadataUrl(c));
+		}
 		const body = await c.req.json().catch(() => void 0);
 		const parsed = spec.input.safeParse(body ?? {});
 		if (!parsed.success) {
@@ -2890,24 +3831,30 @@ function installOpsApi(app, options) {
 				fix: "Send the input of the operation as its input schema describes it."
 			}, 400);
 		}
-		const site = options.sites.get(principal.site);
-		if (site === void 0) throw new Error(`No site ${principal.site} for a checked token`);
 		const context = {
 			site,
 			principal,
 			view: "head",
 			store: createD1Store(c.env.DB, { clock: options.clock }),
 			clock: options.clock,
-			client: { name: "hollware-admin" },
+			client: CLIENT,
 			requestId,
 			notify: options.notify(c, requestId, site.key),
 			semantic: semanticOfEnv(c.env),
 			analytics: analyticsReaderOf(c.env),
 			...options.structure === void 0 ? {} : { structure: options.structure(c.env.DB, c.env.HOLLWARE_SECRET) }
 		};
+		/** The line of the call, after it answered or failed. */
+		const audited = async (result) => {
+			const line = operationLine(spec, parsed.data, site.key, result);
+			if (line !== null) await audit?.write(site, line);
+		};
 		try {
-			return json(spec.output.parse(await invoke(options.handlers, spec, parsed.data, context)));
+			const output = spec.output.parse(await invoke(options.handlers, spec, parsed.data, context));
+			await audited({ output });
+			return json(output);
 		} catch (error) {
+			await audited({ errorCode: error instanceof HollwareError ? error.code : "internal" });
 			if (error instanceof HollwareError) return json({
 				code: error.code,
 				message: error.message,
@@ -2940,6 +3887,7 @@ function crossOriginOf(c) {
 }
 const STATUS = {
 	invalid_input: 400,
+	invalid_preview: 400,
 	unknown_collection: 404,
 	unknown_locale: 404
 };
@@ -2964,7 +3912,7 @@ function readRoute(handler) {
 				code: error.code,
 				message: error.message,
 				fix: error.fix
-			}, STATUS[error.code] ?? 500);
+			}, STATUS[error.code] ?? 500, c.req.query("preview") === void 0 ? {} : { "cache-control": "no-store" });
 		}
 	};
 }
@@ -2978,9 +3926,16 @@ function matches(header, etag) {
 	if (header === void 0) return false;
 	return header.split(",").map((tag) => tag.trim()).some((tag) => tag === "*" || tag === etag || `W/${tag}` === etag);
 }
-async function answer(c, value) {
+async function answer(c, value, { preview = false } = {}) {
 	const notFound = typeof value === "object" && value !== null && "outcome" in value && value.outcome === "not_found";
 	const body = JSON.stringify(value);
+	if (preview) return new Response(body, {
+		status: notFound ? 404 : 200,
+		headers: {
+			"cache-control": "no-store",
+			"content-type": "application/json"
+		}
+	});
 	const etag = await etagOf(body);
 	const headers = {
 		etag,
@@ -3069,11 +4024,15 @@ function installReadApi(app, options) {
 	app.get("/v1/:collection/translations/:group", readRoute(async (c) => answer(c, await options.read(c.env).getTranslations(c.get("site"), c.req.param("collection"), c.req.param("group")))));
 	app.get("/v1/:collection/:locale/:slug", readRoute(async (c) => {
 		const formats = c.req.query("formats");
-		const related = c.req.query("related") === "true" ? { related: true } : {};
-		return answer(c, await options.read(c.env).getEntry(c.get("site"), c.req.param("collection"), c.req.param("slug"), c.req.param("locale"), formats === void 0 ? related : {
-			...related,
+		const preview = c.req.query("preview");
+		const base = {
+			...c.req.query("related") === "true" ? { related: true } : {},
+			...preview === void 0 ? {} : { preview }
+		};
+		return answer(c, await options.read(c.env).getEntry(c.get("site"), c.req.param("collection"), c.req.param("slug"), c.req.param("locale"), formats === void 0 ? base : {
+			...base,
 			formats: formats.split(",").flatMap((format) => format === "markdown" || format === "document" || format === "html" ? [format] : [])
-		}));
+		}), { preview: preview !== void 0 });
 	}));
 }
 const SEARCH_MODES = [
@@ -3096,282 +4055,102 @@ function openApiDocument() {
 	});
 	const common = {
 		"304": { description: "Not modified: the ETag of If-None-Match is current." },
-		"401": { description: "No token, or one that is unknown, expired or revoked. The challenge names the protected resource metadata." },
-		"403": { description: "The token lacks content:read." }
-	};
-	const param = (name, location, required) => ({
-		name,
-		in: location,
-		required,
-		schema: { type: "string" }
-	});
-	return {
-		openapi: "3.1.0",
-		info: {
-			title: "Hollware read API",
-			version: "1"
-		},
-		components: { securitySchemes: { token: {
-			type: "http",
-			scheme: "bearer"
-		} } },
-		security: [{ token: [] }],
-		paths: {
-			"/v1/site": { get: {
-				operationId: "describe_site",
-				responses: {
-					"200": ok("The site"),
-					...common
-				}
-			} },
-			"/v1/search": { get: {
-				operationId: "search",
-				parameters: [
-					param("q", "query", true),
-					param("collection", "query", false),
-					param("locale", "query", false),
-					param("limit", "query", false),
-					param("mode", "query", false)
-				],
-				responses: {
-					"200": ok("The published entries that match q, best first"),
-					...common
-				}
-			} },
-			"/v1/{collection}": { get: {
-				operationId: "list_entries",
-				parameters: [
-					param("collection", "path", true),
-					param("locale", "query", false),
-					param("tag", "query", false),
-					param("limit", "query", false),
-					param("cursor", "query", false)
-				],
-				responses: {
-					"200": ok("A page of published entries"),
-					...common
-				}
-			} },
-			"/v1/{collection}/translations/{group}": { get: {
-				operationId: "get_translations",
-				parameters: [param("collection", "path", true), param("group", "path", true)],
-				responses: {
-					"200": ok("The published entries of the group"),
-					"404": { description: "No such group" },
-					...common
-				}
-			} },
-			"/v1/{collection}/{locale}/{slug}": { get: {
-				operationId: "get_entry",
-				parameters: [
-					param("collection", "path", true),
-					param("locale", "path", true),
-					param("slug", "path", true),
-					param("formats", "query", false),
-					param("related", "query", false)
-				],
-				responses: {
-					"200": ok("A published entry"),
-					"404": { description: "No such published entry" },
-					...common
-				}
-			} }
-		}
-	};
-}
-//#endregion
-//#region src/identity/pages.ts
-/**
-* The pages a person sees to get in (ADR-026): set up a passkey from a link, and sign in. They
-* are rendered by the Worker, outside the admin's bundle, with one inline script under a nonce
-* and nothing framing them. The script uses the WebAuthn JSON methods of the browser
-* (`PublicKeyCredential.parseCreationOptionsFromJSON`, `credential.toJSON()`), and reads the
-* invitation from the address bar, so the page never prints it.
-*/
-/**
-* The look of hollware.com and the admin, with nothing to fetch: the page's policy loads no font,
-* so the type is the system's. Dark only, the neutral greys of the theme, white as the primary
-* color and emerald for the mark (tests/conventions/brand.test.ts).
-*/
-const STYLE = `:root{color-scheme:dark;--bg:#0a0a0a;--card:#171717;--fg:#f5f5f5;--muted:#a3a3a3;--line:rgb(255 255 255/.1);--accent:#fafafa;--on-accent:#0a0a0a;--mark:#34d399;--danger:#ff8a80}
-*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:2rem 1rem;background:var(--bg);color:var(--fg);font:15px/1.6 system-ui,-apple-system,'Segoe UI',sans-serif;-webkit-font-smoothing:antialiased}
-main{width:100%;max-width:26rem;background:var(--card);border:1px solid var(--line);border-radius:14px;padding:2rem}
-.brand{display:flex;align-items:center;gap:.6rem;margin-bottom:1.75rem;font-weight:600;letter-spacing:-.01em}.brand svg{width:26px;height:26px}
-h1{font-size:1.4rem;line-height:1.25;letter-spacing:-.02em;margin:0 0 .5rem}p{color:var(--muted);margin:.5rem 0}strong{color:var(--fg)}
-label{display:block;margin:1rem 0 .35rem;font-size:.9rem;font-weight:500}fieldset label,form>label:has(input[type=checkbox]){font-weight:400;display:flex;align-items:center;gap:.5rem;margin:.5rem 0}
-input{width:100%;padding:.6rem .75rem;font:inherit;color:inherit;background:transparent;border:1px solid var(--line);border-radius:8px}input:focus{outline:2px solid var(--accent);outline-offset:1px}
-label input{width:auto;margin:0}fieldset{border:1px solid var(--line);border-radius:8px;margin:1rem 0;padding:.5rem .9rem}legend{color:var(--muted);font-size:.85rem;padding:0 .3rem}
-code{font:.82em ui-monospace,'SF Mono',Menlo,monospace;color:var(--muted)}
-button{margin-top:1.25rem;padding:.6rem 1rem;font:inherit;font-weight:500;cursor:pointer;border-radius:8px;border:1px solid var(--line);background:transparent;color:var(--fg)}
-button:not([value=deny]){background:var(--accent);border-color:var(--accent);color:var(--on-accent)}
-[role=alert]{color:var(--danger)}`;
-/** The mark of Hollware, before the title of every page. */
-const BRAND = `<div class="brand"><svg viewBox="0 0 32 32" aria-hidden="true"><rect width="32" height="32" rx="8" fill="currentColor" opacity=".08"/><path d="M9 8v16M23 8v16M9 16h14" stroke="var(--mark)" stroke-width="3" stroke-linecap="round" fill="none"/></svg>Hollware</div>`;
-const POST = `async function post(path, body) {
-  const response = await fetch(path, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) })
-  const data = await response.json()
-  if (!response.ok) throw new Error(data.message + ' ' + (data.fix ?? ''))
-  return data
-}
-function fail(error) { document.getElementById('error').textContent = error.message }`;
-function page(title, nonce, body, script) {
-	return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${title} · Hollware</title>
-<style>${STYLE}</style>
-</head>
-<body>
-<main>
-${BRAND}
-<h1>${title}</h1>
-${body}
-<p id="error" role="alert"></p>
-</main>
-<script nonce="${nonce}">${POST}
-${script}<\/script>
-</body>
-</html>
-`;
-}
-function setupPage(nonce) {
-	return page("Set up your passkey", nonce, `<p>A passkey lets you into this Hollware with your device's lock: no password.</p>
-<form id="form">
-<label for="name">Your name</label><input id="name" name="name" autocomplete="name">
-<label for="label">This device</label><input id="label" name="label" value="Passkey">
-<button type="submit">Create the passkey</button>
-</form>`, `document.getElementById('form').addEventListener('submit', async (event) => {
-  event.preventDefault()
-  try {
-    const invitation = new URLSearchParams(location.search).get('invitation') ?? ''
-    const { challengeId, options } = await post('/auth/register/options', { invitation })
-    const credential = await navigator.credentials.create({ publicKey: PublicKeyCredential.parseCreationOptionsFromJSON(options) })
-    await post('/auth/register/verify', { challengeId, response: credential.toJSON(), name: document.getElementById('name').value, label: document.getElementById('label').value })
-    location.href = '/admin/'
-  } catch (error) { fail(error) }
-})`);
-}
-/**
-* Where the sign-in page sends the person after their passkey: the `return_to` it was given, if it
-* is a page of this origin, else the admin. The target is read as the browser will read it, as a
-* URL against the page's own origin, so no way of writing another host (`//`, `/\`, a tab, a
-* scheme) gets through, and only the path, query and fragment it resolves to are used (T-43).
-* The page runs its source as it is: it uses nothing but its arguments and the URL of the platform.
-*/
-function sameOriginTarget(target, origin) {
-	if (target === null) return "/admin/";
-	try {
-		const url = new URL(target, origin);
-		return url.origin === origin ? `${url.pathname}${url.search}${url.hash}` : "/admin/";
-	} catch {
-		return "/admin/";
-	}
-}
-function signInPage(nonce) {
-	return page("Sign in", nonce, `<p>Sign in to this Hollware with your passkey.</p>
-<button id="signin" type="button">Sign in with a passkey</button>`, `const sameOriginTarget = ${sameOriginTarget.toString()}
-document.getElementById('signin').addEventListener('click', async () => {
-  try {
-    const { challengeId, options } = await post('/auth/signin/options', {})
-    const credential = await navigator.credentials.get({ publicKey: PublicKeyCredential.parseRequestOptionsFromJSON(options) })
-    await post('/auth/signin/verify', { challengeId, response: credential.toJSON() })
-    location.href = sameOriginTarget(new URLSearchParams(location.search).get('return_to'), location.origin)
-  } catch (error) { fail(error) }
-})`);
-}
-/** The headers of a page: no framing, only its own script, and no caching. */
-function pageHeaders(nonce) {
+		"401": { description: "No token, or one that is unknown, expired or revoked. The challenge names the protected resource metadata." },
+		"403": { description: "The token lacks content:read." }
+	};
+	const param = (name, location, required) => ({
+		name,
+		in: location,
+		required,
+		schema: { type: "string" }
+	});
 	return {
-		"content-type": "text/html; charset=utf-8",
-		"cache-control": "no-store",
-		"content-security-policy": `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'unsafe-inline'; connect-src 'self'; form-action 'none'; base-uri 'none'; frame-ancestors 'none'`,
-		"x-content-type-options": "nosniff",
-		"referrer-policy": "no-referrer"
+		openapi: "3.1.0",
+		info: {
+			title: "Hollware read API",
+			version: "1"
+		},
+		components: { securitySchemes: { token: {
+			type: "http",
+			scheme: "bearer"
+		} } },
+		security: [{ token: [] }],
+		paths: {
+			"/v1/site": { get: {
+				operationId: "describe_site",
+				responses: {
+					"200": ok("The site"),
+					...common
+				}
+			} },
+			"/v1/search": { get: {
+				operationId: "search",
+				parameters: [
+					param("q", "query", true),
+					param("collection", "query", false),
+					param("locale", "query", false),
+					param("limit", "query", false),
+					param("mode", "query", false)
+				],
+				responses: {
+					"200": ok("The published entries that match q, best first"),
+					...common
+				}
+			} },
+			"/v1/{collection}": { get: {
+				operationId: "list_entries",
+				parameters: [
+					param("collection", "path", true),
+					param("locale", "query", false),
+					param("tag", "query", false),
+					param("limit", "query", false),
+					param("cursor", "query", false)
+				],
+				responses: {
+					"200": ok("A page of published entries"),
+					...common
+				}
+			} },
+			"/v1/{collection}/translations/{group}": { get: {
+				operationId: "get_translations",
+				parameters: [param("collection", "path", true), param("group", "path", true)],
+				responses: {
+					"200": ok("The published entries of the group"),
+					"404": { description: "No such group" },
+					...common
+				}
+			} },
+			"/v1/{collection}/{locale}/{slug}": { get: {
+				operationId: "get_entry",
+				parameters: [
+					param("collection", "path", true),
+					param("locale", "path", true),
+					param("slug", "path", true),
+					param("formats", "query", false),
+					param("related", "query", false),
+					param("preview", "query", false)
+				],
+				responses: {
+					"200": ok("A published entry; with a valid preview token, its latest revision, uncacheable and with no ETag"),
+					"400": { description: "The preview token is expired, forged or for another entry" },
+					"404": { description: "No such published entry" },
+					...common
+				}
+			} }
+		}
 	};
 }
-/** Text for HTML: every string a client chose (its name, its redirect host, a scope) goes through it. */
-function escapeHtml(value) {
-	return value.replace(/[&<>"']/g, (char) => `&#${char.charCodeAt(0)};`);
-}
-/** What a scope lets a client do, in the words of the consent page. */
-const SCOPE_WORDS = {
-	"content:read": "Read the content, drafts included",
-	"content:write": "Write drafts",
-	"content:publish": "Publish and unpublish",
-	"schema:admin": "Change the site settings"
-};
-/**
-* The consent page of `/authorize` (ADR-026): which client asks, where the tokens go, and what it
-* may do, with Allow and Deny. It has no script, and it posts the handle that `beginConsent` bound
-* to this browser. Everything the client chose is escaped.
-*/
-function consentPage(view) {
-	const name = escapeHtml(view.clientName);
-	const origin = view.clientDomain === void 0 ? "<p>This app registered itself: its name is not verified.</p>" : `<p>Published by <strong>${escapeHtml(view.clientDomain)}</strong>.</p>`;
-	const loopback = view.redirectIsLoopback ? "<p><strong>This sends access to an app on this computer.</strong> Continue only if you just started to connect it.</p>" : "";
-	const sites = view.sites.length === 1 ? `<input type="hidden" name="site" value="${escapeHtml(view.sites[0] ?? "")}">` : `<fieldset><legend>For the site</legend>${view.sites.map((site, index) => `<label><input type="radio" name="site" value="${escapeHtml(site)}"${index === 0 ? " checked" : ""}> ${escapeHtml(site)}</label>`).join("\n")}</fieldset>`;
-	const scopes = view.scopes.map((scope) => `<label><input type="checkbox" name="scope" value="${escapeHtml(scope)}" checked> ${escapeHtml(SCOPE_WORDS[scope] ?? scope)} <code>${escapeHtml(scope)}</code></label>`).join("\n");
-	return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Allow ${name} · Hollware</title>
-<style>${STYLE}</style>
-</head>
-<body>
-<main>
-${BRAND}
-<h1>Allow ${name} to use this Hollware?</h1>
-${origin}
-<p>Signed in as <strong>${escapeHtml(view.person)}</strong>. Access goes to <strong>${escapeHtml(view.redirectHost)}</strong>.</p>
-${loopback}
-<form method="post" action="/authorize">
-<input type="hidden" name="handle" value="${escapeHtml(view.handle)}">
-${sites}
-${scopes}
-<p><button name="decision" value="approve">Allow</button> <button name="decision" value="deny">Deny</button></p>
-</form>
-</main>
-</body>
-</html>
-`;
-}
-/** A page that only says what went wrong and what to do. */
-function messagePage(title, message) {
-	return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${escapeHtml(title)} · Hollware</title>
-<style>${STYLE}</style>
-</head>
-<body>
-<main>
-${BRAND}
-<h1>${escapeHtml(title)}</h1>
-<p>${escapeHtml(message)}</p>
-</main>
-</body>
-</html>
-`;
-}
+//#endregion
+//#region src/audit/person.ts
 /**
-* The headers of a page without a script: no framing and no caching. The form of the consent page
-* posts to `/authorize`, which redirects to the client, so `form-action` is not restricted: a
-* browser applies it to the redirect too.
+* A line about a person's own sign-in, in each site they are a member of (ADR-037): a person is of
+* the deployment, and each owner sees what touched the people of their site.
 */
-function plainPageHeaders() {
-	return {
-		"content-type": "text/html; charset=utf-8",
-		"cache-control": "no-store",
-		"content-security-policy": `default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'`,
-		"x-content-type-options": "nosniff",
-		"referrer-policy": "no-referrer"
-	};
+async function writeForPerson(db, log, siteOf, userId, line) {
+	for (const membership of await membershipsOf(connect(db), userId)) {
+		const site = await siteOf(membership.site);
+		if (site !== void 0) await log.write(site, line);
+	}
 }
 //#endregion
 //#region src/identity/routes.ts
@@ -3379,17 +4158,25 @@ function plainPageHeaders() {
 * The ceremonies, with SimpleWebAuthn and its parsers, in a chunk of their own: only these four
 * routes use them, and a Worker that serves MCP never pays for them at startup (`budgets.json`).
 */
-const ceremonies = () => import("./ceremonies-DDoGdUD7.mjs");
-/** The cookie of a signed-in person: only `/authorize` reads it (ADR-026). */
+const ceremonies = () => import("./ceremonies-CI3DkOEL.mjs");
+/**
+* The cookie of a signed-in person: only `/authorize` reads it (ADR-026), and the sign-out below
+* it, `/authorize/signout`, which the path of the cookie reaches too.
+*/
 const SESSION_COOKIE = "hollware_session";
+/** Where sign-out is: below `/authorize`, the one path a browser sends the cookie to. */
+const SIGN_OUT_PATH = "/authorize/signout";
 function sessionCookie(secret) {
 	return `${SESSION_COOKIE}=${secret}; HttpOnly; Secure; SameSite=Lax; Path=/authorize; Max-Age=43200`;
 }
+/** The cookie as sign-out leaves it: empty, and gone at once. */
+const ENDED_COOKIE = `${SESSION_COOKIE}=; HttpOnly; Secure; SameSite=Lax; Path=/authorize; Max-Age=0`;
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-/** The setup and sign-in pages, and the four steps of the passkey ceremonies. */
 function installIdentity(app, options) {
+	/** A line of the person's own sign-in, in each of their sites. */
+	const audited = (c, userId, line) => writeForPerson(c.env.DB, options.audit(c, personActor(userId)), (key) => options.site(c, key), userId, line);
 	const ceremony = (c) => ({
 		db: connect(c.env.DB),
 		publicUrl: c.env.HOLLWARE_PUBLIC_URL,
@@ -3430,6 +4217,14 @@ function installIdentity(app, options) {
 			name: text(input["name"]),
 			label: text(input["label"])
 		});
+		await audited(c, answer.userId, {
+			action: "invitation.accept",
+			outcome: "ok",
+			target: {
+				type: "user",
+				id: answer.userId
+			}
+		});
 		return c.json({ ok: true }, 200, { "set-cookie": sessionCookie(answer.session) });
 	}));
 	app.post("/auth/signin/options", handle(async (c) => c.json(await (await ceremonies()).authenticationOptions(ceremony(c)))));
@@ -3441,8 +4236,32 @@ function installIdentity(app, options) {
 			challengeId: text(input["challengeId"]),
 			response: JSON.parse(JSON.stringify(response))
 		});
+		await audited(c, answer.userId, {
+			action: "session.sign_in",
+			outcome: "ok",
+			target: {
+				type: "user",
+				id: answer.userId
+			}
+		});
 		return c.json({ ok: true }, 200, { "set-cookie": sessionCookie(answer.session) });
 	}));
+	app.post(SIGN_OUT_PATH, async (c) => {
+		const secret = getCookie(c, SESSION_COOKIE);
+		const userId = secret === void 0 ? null : await endSession(connect(c.env.DB), secret);
+		if (userId !== null) await audited(c, userId, {
+			action: "session.sign_out",
+			outcome: "ok",
+			target: {
+				type: "user",
+				id: userId
+			}
+		});
+		return c.json({ ok: true }, 200, {
+			"set-cookie": ENDED_COOKIE,
+			"cache-control": "no-store"
+		});
+	});
 }
 //#endregion
 //#region src/oauth/authorize.ts
@@ -3613,6 +4432,16 @@ function installAuthorize(app, options) {
 				scope,
 				props
 			});
+			const site = await options.site?.(c, membership.site);
+			if (site !== void 0 && options.audit !== void 0) await options.audit(c, personActor(signedIn.userId)).write(site, {
+				action: "app.allow",
+				outcome: "ok",
+				target: {
+					type: "client",
+					id: approved.request.clientId
+				},
+				detail: { scopes: scope }
+			});
 			approved.headers.set("location", redirectTo);
 			return new Response(null, {
 				status: 302,
@@ -3789,6 +4618,35 @@ function refusal(status, code, message, fix) {
 		headers: { "cache-control": "no-store" }
 	});
 }
+/**
+* The text of a body of at most `limit` bytes, or `null` for a longer one: read no further than
+* the limit, so a large body costs no more memory than a small one (T-08 of the threat model).
+*/
+async function boundedText(request, limit) {
+	const declared = Number(request.headers.get("content-length") ?? NaN);
+	if (Number.isFinite(declared) && declared > limit) return null;
+	if (request.body === null) return "";
+	const reader = request.body.getReader();
+	const chunks = [];
+	let size = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		size += value.byteLength;
+		if (size > limit) {
+			await reader.cancel();
+			return null;
+		}
+		chunks.push(value);
+	}
+	const bytes = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return new TextDecoder().decode(bytes);
+}
 /** The path of a view without its query and fragment, or `null` when it is no path. */
 function pathOf(value) {
 	if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//")) return null;
@@ -3804,8 +4662,8 @@ function pathOf(value) {
 */
 function installEvents(app, options) {
 	app.post("/events", async (c) => {
-		const text = await c.req.text();
-		if (new TextEncoder().encode(text).byteLength > 2048) return refusal(413, "too_large", `A beacon is at most ${MAX_BEACON_BYTES} bytes.`, "Send the site and the path of the page, and nothing else.");
+		const text = await boundedText(c.req.raw, MAX_BEACON_BYTES);
+		if (text === null) return refusal(413, "too_large", `A beacon is at most ${MAX_BEACON_BYTES} bytes.`, "Send the site and the path of the page, and nothing else.");
 		let body;
 		try {
 			body = JSON.parse(text);
@@ -3813,11 +4671,11 @@ function installEvents(app, options) {
 			body = null;
 		}
 		const key = typeof body === "object" && body !== null && "site" in body ? body.site : null;
-		const site = typeof key === "string" ? options.sites.get(key) : void 0;
 		const path = typeof body === "object" && body !== null && "path" in body ? pathOf(body.path) : null;
-		if (site === void 0 || path === null) return refusal(400, "invalid_input", "A beacon is JSON with the key of a site this Hollware serves and the path of a page.", "Send { \"site\": \"<site key>\", \"path\": \"/<path of the page>\" }.");
+		if (typeof key !== "string" || path === null) return refusal(400, "invalid_input", "A beacon is JSON with the key of a site and the path of a page.", "Send { \"site\": \"<site key>\", \"path\": \"/<path of the page>\" }.");
+		const site = options.sites.get(key);
 		const origin = c.req.header("origin") ?? null;
-		if (origin === null || !pageOriginsOf(site).includes(origin)) return refusal(403, "forbidden_origin", `Only pages of the site "${site.key}" count its views.`, `Set the url of the site to the origin of its pages, or add the origin to its cors.origins: in the admin, Site, or with update_site.`);
+		if (site === void 0 || origin === null || !pageOriginsOf(site).includes(origin)) return refusal(403, "forbidden_origin", "This page does not count views of that site.", "Set the url of the site to the origin of its pages, or add the origin to its cors.origins: in the admin, Site, or with update_site.");
 		const cf = Reflect.get(c.req.raw, "cf");
 		const country = typeof cf === "object" && cf !== null && "country" in cf && typeof cf.country === "string" ? cf.country : "XX";
 		analyticsWriterOf(c.env)?.record({
@@ -3919,11 +4777,20 @@ function createGateway(options) {
 		secrets: { make: async (site, name) => {
 			if (master === void 0) return null;
 			const secret = newWebhookSecret();
-			await createSecretStore(db, () => clock.now()).write(site, name, await seal(master, secret));
+			const sealed = await seal(master, secret, {
+				site,
+				name
+			});
+			await createSecretStore(db, () => clock.now()).write(site, name, sealed);
 			return secret;
 		} }
 	});
 	/**
+	* The activity log of a request (ADR-037), for an actor known once the client has said what it
+	* is. A person in the admin is a `user`; any other OAuth client, an `oauth_client`.
+	*/
+	const auditOf = (c, principal, adminClientId) => (meta) => auditAs(c, actorOf$1(principal, meta, adminClientId));
+	/**
 	* A protected route: the resource server of `resource` answers a request without a token and a
 	* token it refuses (401, logged with the reason), and `proceed` gets the principal of the rest.
 	*/
@@ -3991,6 +4858,16 @@ function createGateway(options) {
 	app.use("*", async (c, next) => {
 		c.set("requestId", crypto.randomUUID());
 		await next();
+		const https = c.env.HOLLWARE_PUBLIC_URL?.startsWith("https://") === true;
+		if (!(!c.res.headers.has("x-content-type-options") || https && !c.res.headers.has("strict-transport-security"))) return;
+		const headers = new Headers(c.res.headers);
+		if (!headers.has("x-content-type-options")) headers.set("x-content-type-options", "nosniff");
+		if (https && !headers.has("strict-transport-security")) headers.set("strict-transport-security", "max-age=31536000");
+		c.res = new Response(c.res.body, {
+			status: c.res.status,
+			statusText: c.res.statusText,
+			headers
+		});
 	});
 	app.use("*", async (c, next) => {
 		const origin = c.req.header("origin");
@@ -3999,6 +4876,30 @@ function createGateway(options) {
 		if (refusal !== null) return refusal;
 		await next();
 	});
+	app.use("*", async (c, next) => {
+		const limiter = c.env.HOLLWARE_RATE_LIMIT;
+		const group = limitedRoute(c.req.method, new URL(c.req.url).pathname);
+		if (limiter === void 0 || group === null) return next();
+		const address = c.req.header("cf-connecting-ip") ?? "unknown";
+		const { success } = await limiter.limit({ key: `${group}:${address}` });
+		if (success) return next();
+		log({
+			kind: "rate_limited",
+			requestId: c.get("requestId"),
+			route: group
+		});
+		return Response.json({
+			code: "rate_limited",
+			message: "Too many requests from this address to this route.",
+			fix: "Wait a minute and try again."
+		}, {
+			status: 429,
+			headers: {
+				"retry-after": "60",
+				"cache-control": "no-store"
+			}
+		});
+	});
 	for (const path of [
 		"/authorize",
 		"/oauth/*",
@@ -4025,7 +4926,13 @@ function createGateway(options) {
 				semantic: semanticOfEnv(c.env),
 				analytics: analyticsReaderOf(c.env),
 				structure: structureOf(db, c.env.HOLLWARE_SECRET)
-			}
+			},
+			...principal.kind === "read" ? {} : { audit: {
+				log: auditOf(c, principal, null),
+				defer: (work) => {
+					c.executionCtx.waitUntil(work);
+				}
+			} }
 		});
 	}));
 	for (const resource of ["mcp", "v1"]) app.all(`/.well-known/oauth-protected-resource/${resource}`, async (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).protect(resource, c.req.raw, c.env, workerContext(c), {
@@ -4034,18 +4941,68 @@ function createGateway(options) {
 		defer: () => void 0,
 		failed: () => void 0
 	}));
+	/** The activity log of a request for an actor the route knows itself (ADR-037). */
+	const auditAs = (c, actor) => createAuditLog({
+		db: c.env.DB,
+		actor,
+		requestId: c.get("requestId"),
+		address: c.req.header("cf-connecting-ip") ?? null,
+		master: c.env.HOLLWARE_SECRET,
+		now: () => clock.now(),
+		log
+	});
+	/** A site as the activity log needs it, current with D1: a route of no token refreshed nothing. */
+	const auditSite = async (c, key) => {
+		await options.refresh?.(c.env.DB);
+		return sites.get(key);
+	};
 	installAuthorize(app, {
 		sites: siteKeys,
 		clock,
-		oauth
+		oauth,
+		site: auditSite,
+		audit: auditAs
 	});
 	const authorizationServer = (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).authorizationServer.fetch(c.req.raw, c.env, workerContext(c));
 	app.all("/.well-known/oauth-authorization-server", authorizationServer);
-	app.all("/oauth/*", authorizationServer);
-	installIdentity(app, { clock });
+	app.all("/oauth/*", async (c) => {
+		const refresh = await refreshTokenOf(c.req.raw);
+		if (refresh === null) return authorizationServer(c);
+		const now = Math.floor(clock.now().getTime() / 1e3);
+		const reused = await spentRefresh(c.env.OAUTH_KV, refresh, now);
+		if (reused !== null) {
+			await oauth(c.env.HOLLWARE_PUBLIC_URL).authorizationServer.getOAuthApi(c.env).revokeGrant(reused.grantId, reused.userId);
+			log({
+				kind: "refresh_reused",
+				requestId: c.get("requestId"),
+				grantId: reused.grantId
+			});
+			const site = reused.site === null ? void 0 : await auditSite(c, reused.site);
+			if (site !== void 0) await auditAs(c, systemActor(reused.userId)).write(site, {
+				action: "app.refresh_reused",
+				outcome: "denied",
+				errorCode: "invalid_grant",
+				target: {
+					type: "grant",
+					id: reused.grantId
+				}
+			});
+			return reusedAnswer();
+		}
+		const response = await authorizationServer(c);
+		if (response.ok) await recordRotation(c.env.OAUTH_KV, refresh.grantId, now);
+		return response;
+	});
+	installIdentity(app, {
+		clock,
+		site: auditSite,
+		audit: auditAs
+	});
 	installAdmin(app, { oauth });
 	installAdminApi(app, {
 		sites: siteKeys,
+		site: (key) => sites.get(key),
+		audit: async (c, principal) => auditOf(c, principal, (await adminClient(oauth(c.env.HOLLWARE_PUBLIC_URL), c.env)).clientId),
 		clock,
 		oauth,
 		protect: (c, proceed) => protectWrites(c, "v1", proceed),
@@ -4059,7 +5016,8 @@ function createGateway(options) {
 		protect: (c, proceed) => protectWrites(c, "v1", proceed),
 		metadataUrl: (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.v1,
 		notify,
-		structure: structureOf
+		structure: structureOf,
+		audit: async (c, principal) => auditOf(c, principal, (await adminClient(oauth(c.env.HOLLWARE_PUBLIC_URL), c.env)).clientId)
 	});
 	if (options.read !== void 0) installReadApi(app, {
 		read: options.read,
@@ -4075,6 +5033,14 @@ function createGateway(options) {
 		return await app.fetch(request, env, ctx);
 	};
 }
+/** The group of a route that is rate limited, or `null` for one that is not (T-10). */
+function limitedRoute(method, pathname) {
+	if (method !== "POST") return null;
+	if (pathname.startsWith("/auth/")) return "auth";
+	if (pathname === "/oauth/token" || pathname === "/oauth/register") return "oauth";
+	if (pathname === "/events") return "beacon";
+	return null;
+}
 //#endregion
 //#region src/mcp/annotations.ts
 /**
@@ -4502,6 +5468,7 @@ function createMcpEndpoint(options) {
 			client: declaredClient(envelope)
 		};
 		let outcome = null;
+		let answered = null;
 		let isError = false;
 		let failure = null;
 		let result;
@@ -4509,6 +5476,7 @@ function createMcpEndpoint(options) {
 		const record = (answer) => {
 			outcome = answer.outcome;
 			isError = answer.isError;
+			answered = answer.output;
 			return answer;
 		};
 		/** Runs the handler within the time limit and checks its answer. */
@@ -4541,6 +5509,8 @@ function createMcpEndpoint(options) {
 			isError = true;
 			result = errorResult(failure);
 		}
+		const line = operationLine(spec, input, context.site.key, failure === null ? { output: answered } : { errorCode: failure.code });
+		if (line !== null && call.audit !== void 0) await call.audit.log(context.client).write(context.site, line);
 		emit({
 			kind: "call",
 			requestId: call.requestId,
@@ -4569,16 +5539,20 @@ function createMcpEndpoint(options) {
 			inputSchema: tool.input,
 			outputSchema: tool.output,
 			annotations: EFFECT_ANNOTATIONS[tool.spec.effect],
-			scopeChallenge: scopeChallenge(tool, () => emit({
-				kind: "call",
-				requestId: call.requestId,
-				tool: tool.spec.name,
-				outcome: null,
-				errorCode: "insufficient_scope",
-				isError: true,
-				durationMs: 0,
-				detail: null
-			}))
+			scopeChallenge: scopeChallenge(tool, () => {
+				emit({
+					kind: "call",
+					requestId: call.requestId,
+					tool: tool.spec.name,
+					outcome: null,
+					errorCode: "insufficient_scope",
+					isError: true,
+					durationMs: 0,
+					detail: null
+				});
+				const line = operationLine(tool.spec, null, call.context.site.key, { errorCode: "insufficient_scope" });
+				if (line !== null && call.audit !== void 0) call.audit.defer(call.audit.log(null).write(call.context.site, line));
+			})
 		}, (input, mcp) => runTool(tool.spec, input, mcp, call, request.era));
 		server.registerPrompt(REFRESH_CONTENT.name, {
 			title: REFRESH_CONTENT.title,
@@ -4622,6 +5596,27 @@ function unknownSite(site, served) {
 	const keys = [...served].map((key) => `"${key}"`).join(", ");
 	return new HollwareError("invalid_input", `This Hollware serves no site "${site}": it serves ${keys}.`, `Pass one of ${keys}, the sites this deployment serves, as the site argument.`);
 }
+/** What a caller that presents a preview token that does not hold is told. */
+function previewRefused(message) {
+	return new HollwareError("invalid_preview", message, "Ask for a new preview link: in the admin, open the entry and choose \"Preview on the site\".");
+}
+/**
+* The entry a preview token names, once its signature, its site and its hour hold: the caller gets
+* an error, never the published version in its place, for a token that does not. The reason goes
+* to the log; the caller only learns that the link is not valid.
+*/
+async function checkPreview(deps, env, site, token) {
+	if (typeof token !== "string") throw previewRefused("The preview link is not a string.");
+	const checked = await verifyPreviewToken({
+		secret: env.HOLLWARE_SECRET,
+		site,
+		token,
+		now: deps.clock.now()
+	});
+	if (checked.ok) return checked.entryId;
+	if (checked.reason === "no_secret") throw new HollwareError("invalid_input", "This Hollware cannot check preview links: it has no HOLLWARE_SECRET of 32 characters or more.", "Set the Worker secret HOLLWARE_SECRET (`hollware deploy` makes one), then ask for a new preview link.");
+	throw previewRefused(checked.reason === "expired" ? "This preview link has expired." : "This preview link is not valid.");
+}
 /**
 * The options object of a call, without the keys that hold `undefined`, so that the handler sees
 * the same input as over MCP. A key that is none of `allowed` is an error: the specs are strict
@@ -4678,7 +5673,7 @@ function forCaller(deps, requestId, method, error) {
 * `build` makes the raw input, so a wrong site is answered before anything else is looked at and
 * a call that fails never opens a session.
 */
-async function run(deps, env, method, site, schema, build, handler) {
+async function run(deps, env, method, site, schema, build, handler, viewOf = () => Promise.resolve("published")) {
 	const requestId = crypto.randomUUID();
 	try {
 		await deps.refresh?.(env.DB);
@@ -4688,10 +5683,16 @@ async function run(deps, env, method, site, schema, build, handler) {
 	const served = deps.sites.get(site);
 	if (served === void 0) throw unknownSite(site, deps.sites.keys());
 	const input = parseInput(schema, build());
+	let view;
+	try {
+		view = await viewOf(site);
+	} catch (error) {
+		throw forCaller(deps, requestId, method, error);
+	}
 	const context = {
 		site: served,
 		principal: BINDING_PRINCIPAL,
-		view: "published",
+		view,
 		store: createD1Store(env.DB.withSession("first-unconstrained")),
 		clock: deps.clock,
 		client: null,
@@ -4712,12 +5713,34 @@ async function run(deps, env, method, site, schema, build, handler) {
 */
 function createRpc(deps, env) {
 	return {
-		getEntry: (site, collection, slug, locale, options) => run(deps, env, "getEntry", site, getEntry.input, () => ({
-			collection,
-			locale,
-			slug,
-			...readOptions(options, ["formats", "related"])
-		}), deps.handlers.get_entry),
+		getEntry: (site, collection, slug, locale, options) => {
+			const read = {
+				preview: void 0,
+				entryId: null
+			};
+			return run(deps, env, "getEntry", site, getEntry.input, () => {
+				const { preview, ...rest } = readOptions(options, [
+					"formats",
+					"related",
+					"preview"
+				]);
+				read.preview = preview;
+				return {
+					collection,
+					locale,
+					slug,
+					...rest
+				};
+			}, async (input, context) => {
+				const answer = await deps.handlers.get_entry(input, context);
+				if (read.entryId !== null && answer.entry !== void 0 && answer.entry.id !== read.entryId) return { outcome: "not_found" };
+				return answer;
+			}, async (key) => {
+				if (read.preview === void 0) return "published";
+				read.entryId = await checkPreview(deps, env, key, read.preview);
+				return "head";
+			});
+		},
 		listEntries: (site, collection, options) => run(deps, env, "listEntries", site, listEntries.input, () => ({
 			collection,
 			...readOptions(options, [
@@ -4839,6 +5862,22 @@ async function runDueSchedules(input) {
 			await store.cancelSchedule(site.key, schedule.entryId);
 			cancelled += 1;
 		}
+		await input.audit?.(systemActor(schedule.actor.userId), requestId).write(site, {
+			action: "schedule.publish",
+			outcome: answer.outcome === "published" ? "ok" : "failed",
+			errorCode: answer.outcome === "published" ? null : answer.outcome,
+			target: {
+				type: "entry",
+				id: schedule.entryId
+			},
+			detail: {
+				scheduledAt: schedule.scheduledAt,
+				scheduledBy: {
+					kind: schedule.actor.kind,
+					tokenId: schedule.actor.tokenId
+				}
+			}
+		});
 		log({
 			kind: "schedule",
 			requestId,
@@ -5012,8 +6051,12 @@ function createHollwareWith(config, handlers, options = {}) {
 		ownSecret: async (webhook) => {
 			const master = env.HOLLWARE_SECRET;
 			if (master === void 0) return void 0;
-			const sealed = await createSecretStore(env.DB, () => clock.now()).read(site.key, `webhook:${webhook}`);
-			return sealed === null ? void 0 : await unseal(master, sealed) ?? void 0;
+			const name = `webhook:${webhook}`;
+			const sealed = await createSecretStore(env.DB, () => clock.now()).read(site.key, name);
+			return sealed === null ? void 0 : await unseal(master, sealed, {
+				site: site.key,
+				name
+			}) ?? void 0;
 		}
 	});
 	return {
@@ -5040,8 +6083,18 @@ function createHollwareWith(config, handlers, options = {}) {
 					store: createD1Store(env.DB, { clock }),
 					handlers,
 					clock,
-					log: writeLog
+					log: writeLog,
+					audit: (actor, requestId) => createAuditLog({
+						db: env.DB,
+						actor,
+						requestId,
+						address: null,
+						master: env.HOLLWARE_SECRET,
+						now: () => clock.now(),
+						log: writeLog
+					})
 				});
+				await dropExpiredLines(env.DB, site, clock.now());
 				await sweepOutbox({
 					queue: env.EVENTS,
 					deps: deliveryDeps(env, site)
@@ -5068,6 +6121,13 @@ function createHollwareWith(config, handlers, options = {}) {
 				});
 			}));
 			ctx.waitUntil((async () => {
+				await dropExpired(connect(env.DB), clock.now()).catch((error) => {
+					writeLog({
+						kind: "cron_failed",
+						site: null,
+						message: String(error)
+					});
+				});
 				await refresh(env.DB);
 				for (const site of sites.values()) await each(site).catch((error) => {
 					writeLog({
@@ -5810,13 +6870,35 @@ async function change(context, version, next, confirm) {
 		version: version + 1
 	};
 }
+/**
+* The URL of a webhook as a person who cannot change the structure sees it: its origin only. A
+* webhook's path and query often are its secret (a deploy hook), and `get_structure` asks only
+* for content:read, which authors have (T-70 of docs/security/threat-model.md).
+*/
+function originOnly(url) {
+	try {
+		return new URL(url).origin;
+	} catch {
+		return "";
+	}
+}
 const getStructure = async (_input, context) => {
 	const current = await currentOf(context);
+	const definition = context.principal.scopes.includes("schema:admin") ? current.definition : {
+		...current.definition,
+		events: {
+			...current.definition.events,
+			webhooks: current.definition.events.webhooks.map((webhook) => ({
+				...webhook,
+				url: originOnly(webhook.url)
+			}))
+		}
+	};
 	return {
 		outcome: "ok",
 		site: context.site.key,
 		version: current.version,
-		definition: current.definition,
+		definition,
 		catalog: describeCatalog()
 	};
 };