@hollware/server 0.2.0 → 0.4.0

package/dist/index.mjs

@@ -1,35 +1,16 @@
-import { EVENT_ID_HEADER, HollwareError, OPERATIONS, SIGNATURE_HEADER, TIMESTAMP_HEADER, describeBuiltInContracts, describeResolvedSite, describeSite, getEntry, getTranslations, hashPersonalToken, isPersonalToken, isScope, listEntries, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, signWebhook, sizeLimitViolation, uniqueSlugViolation, uniqueTranslationViolation } from "@hollware/core";
+import { A as effectiveScopes, C as revisionTags, D as tokens, E as sites, O as users, S as reviews, T as schedules, _ as entries, b as outbox, g as deliveries, j as isRole, k as ROLE_SCOPES, l as membershipsOf, n as createInvitation, s as findSession, v as invitations, w as revisions, x as publications, y as members } from "./store-CsuER6J7.mjs";
+import { EVENT_ID_HEADER, HollwareError, OPERATIONS, SCOPES, SIGNATURE_HEADER, TIMESTAMP_HEADER, describeBuiltInContracts, describeResolvedSite, describeSite, generatePersonalToken, generateReadToken, getEntry, getTranslations, hashPersonalToken, isPersonalToken, isReadToken, isScope, listEntries, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, signWebhook, sizeLimitViolation, uniqueSlugViolation, uniqueTranslationViolation } from "@hollware/core";
 import { Hono } from "hono";
 import { drizzle } from "drizzle-orm/d1";
-import { and, desc, eq, getTableColumns, inArray, isNull, lte, ne, or, sql } from "drizzle-orm";
-import { alias, check, foreignKey, index, integer, sqliteTable, text, unique } from "drizzle-orm/sqlite-core";
+import { and, desc, eq, getTableColumns, gt, inArray, isNull, lte, ne, or, sql } from "drizzle-orm";
+import { alias } from "drizzle-orm/sqlite-core";
+import { AuthorizationError, CimdFetchError, OAuthAuthorizationServer, OAuthResourceServer, authorizationErrorRedirect } from "@cloudflare/workers-oauth-provider";
+import { getCookie } from "hono/cookie";
 import { CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, McpServer, acceptedContent, createMcpHandler, inputRequired, inputResponse } from "@modelcontextprotocol/server";
 import * as z from "zod";
 import { WorkerEntrypoint } from "cloudflare:workers";
 //#region package.json
-var version = "0.2.0";
-//#endregion
-//#region src/auth/bearer.ts
-/**
-* `Bearer`, one or more spaces, then one token with no whitespace in it, and nothing else. The
-* scheme is case-insensitive (RFC 7235); the runtime has already trimmed the whole value.
-*/
-const BEARER = /^bearer +(\S+)$/i;
-/**
-* The token of an `Authorization: Bearer <token>` header, as sent, or `null` when the request
-* presents none: no header, another scheme, no token, or more than one (two headers arrive joined
-* with a comma, so they read as two tokens). It never looks at the URL: a token in a query string
-* ends up in logs, referrers and history, so Hollware does not accept one.
-*
-* It does not judge the token. A string that is not a personal token is a token that was
-* presented and refused, which `checkPersonalToken` says and `unauthorized` answers differently
-* from a request without credentials.
-*/
-function readBearerToken(request) {
-	const header = request.headers.get("authorization");
-	if (header === null) return null;
-	return BEARER.exec(header)?.[1] ?? null;
-}
+var version = "0.4.0";
 //#endregion
 //#region src/auth/responses.ts
 /** The challenge of every 401 and 403 (RFC 6750). */
@@ -56,25 +37,27 @@ function authErrorResponse(status, body, challenge) {
 function unauthorized(reason) {
 	if (reason === void 0) return authErrorResponse(401, {
 		code: "unauthorized",
-		message: "The request carries no personal token.",
-		fix: "Send a personal token as \"Authorization: Bearer <token>\". Create one with `hollware token create`."
+		message: "The request carries no token.",
+		fix: "Send a personal token as \"Authorization: Bearer <token>\" (create one with `hollware token create`), or sign in through OAuth: the challenge names where."
 	}, REALM);
 	return authErrorResponse(401, {
 		code: "unauthorized",
-		message: "The personal token was not accepted.",
-		fix: "Tokens expire and can be revoked. Create a new one with `hollware token create` and send it as \"Authorization: Bearer <token>\"."
+		message: "The token was not accepted.",
+		fix: "Tokens expire and can be revoked. Create a new personal token with `hollware token create`, or sign in through OAuth again, and send it as \"Authorization: Bearer <token>\"."
 	}, `${REALM}, error="invalid_token"`);
 }
 /**
 * 403 for a token that authenticated but lacks scopes. It names every scope that is missing, in
-* the body and in the challenge (RFC 6750), so that a client asks for all of them at once.
+* the body and in the challenge (RFC 6750), so that a client asks for all of them at once, and,
+* when there is one, the protected resource metadata where it learns how (RFC 9728).
 */
-function insufficientScope(missing) {
+function insufficientScope(missing, resourceMetadataUrl) {
+	const metadata = resourceMetadataUrl === void 0 ? "" : `, resource_metadata="${resourceMetadataUrl}"`;
 	return authErrorResponse(403, {
 		code: "insufficient_scope",
 		message: `The token lacks a scope this operation requires. Missing: ${missing.join(", ")}.`,
-		fix: "Send a token that carries every missing scope. Create one with `hollware token create`; a token only gets the scopes its user's role allows."
-	}, `${REALM}, error="insufficient_scope", scope="${missing.join(" ")}"`);
+		fix: "Send a token that carries every missing scope: create one with `hollware token create`, or authorize the client again for them. A token only gets the scopes its user's role allows."
+	}, `${REALM}${metadata}, error="insufficient_scope", scope="${missing.join(" ")}"`);
 }
 //#endregion
 //#region src/auth/guard.ts
@@ -110,7 +93,9 @@ function readPublicUrl(value) {
 *   Any other port is another host.
 * - An `Origin` header that is present and is not the origin of the public URL, scheme and port
 *   included: 403. That covers the opaque `null` origin and an empty value. A request without
-*   `Origin` passes: only browsers send it, and they are what the check is for.
+*   `Origin` passes: only browsers send it, and they are what the check is for. The one exception
+*   is `crossOrigin`: an origin it accepts passes too (the read API, for the origins a site's
+*   config lists; the read API then checks the origin against the site of the token).
 *
 * It returns the response to send, or `null` when the request may go on. No answer repeats the
 * request: the 403s say what to send instead, and the 500 only says what is missing.
@@ -120,8 +105,9 @@ function readPublicUrl(value) {
 * they accept a `Host` such as `user@cms.example.com` or `cms.example.com/x`.
 *
 * @param publicUrl The `HOLLWARE_PUBLIC_URL` variable as the environment holds it.
+* @param crossOrigin Whether a request may come from a page of another origin; never, by default.
 */
-function checkHostAndOrigin(request, publicUrl) {
+function checkHostAndOrigin(request, publicUrl, crossOrigin = () => false) {
 	const expected = readPublicUrl(publicUrl);
 	if (expected === null) return authErrorResponse(500, {
 		code: "misconfigured",
@@ -135,7 +121,7 @@ function checkHostAndOrigin(request, publicUrl) {
 		fix: `Send the request to ${expected.origin}, the public URL of this Hollware (HOLLWARE_PUBLIC_URL).`
 	});
 	const origin = request.headers.get("origin");
-	if (origin !== null && origin.toLowerCase() !== expected.origin) return authErrorResponse(403, {
+	if (origin !== null && origin.toLowerCase() !== expected.origin && !crossOrigin(request, origin)) return authErrorResponse(403, {
 		code: "forbidden_origin",
 		message: "The Origin header of the request is not the public URL of this Hollware.",
 		fix: `Call Hollware from a client that sends no Origin header, or from a page served at ${expected.origin}.`
@@ -143,61 +129,29 @@ function checkHostAndOrigin(request, publicUrl) {
 	return null;
 }
 //#endregion
-//#region src/auth/roles.ts
-/**
-* The roles of a user, as the `users_role` CHECK of the schema lists them. In v0.1 only the owner
-* exists: `hollware init` creates it. The other two are in the CHECK already, so that v0.3 can
-* invite people without a rebuild of the table (ADR-023).
-*/
-const ROLES = [
-	"owner",
-	"editor",
-	"reviewer"
-];
-/** Whether a string is one of the roles. */
-function isRole(value) {
-	return ROLES.some((role) => role === value);
-}
-/**
-* The scopes each role allows. What a token may do is its own scopes intersected with these,
-* read from the user's current role on every request (ADR-005, ADR-019). An operation asks for
-* scopes, never for a role.
-*
-* - `owner` may do everything: all four scopes.
-* - `editor` and `reviewer` allow none in v0.1. Nothing creates such a user yet, and which scopes
-*   each one gets (an editor writes, a reviewer approves) is for v0.3 to decide, together with
-*   the admin that invites them. Until then a token of such a user authenticates, but every
-*   operation answers 403 `insufficient_scope`.
-*/
-const ROLE_SCOPES = {
-	owner: [
-		"content:read",
-		"content:write",
-		"content:publish",
-		"schema:admin"
-	],
-	editor: [],
-	reviewer: []
-};
+//#region src/auth/scopes.ts
 /**
-* The scopes a token really has: those it carries that the role of its user allows, in the order
-* of the role. A role that is not one of the roles allows nothing, so a role added to the schema
-* before this table knows it grants no access.
+* The scopes an operation requires that the principal lacks, in the order the operation lists
+* them. Empty means the principal may call it; otherwise the answer is `insufficientScope` with
+* all of them, so that a client asks for everything it needs in one go.
 */
-function effectiveScopes(role, tokenScopes) {
-	if (!isRole(role)) return [];
-	return ROLE_SCOPES[role].filter((scope) => tokenScopes.includes(scope));
+function missingScopes(principal, required) {
+	const granted = principal.scopes;
+	return required.filter((scope) => !granted.includes(scope));
 }
 //#endregion
 //#region src/auth/token.ts
 /** `last_used_at` of a token is written at most once in this time. */
 const TOUCH_INTERVAL_MS = 36e5;
-/** The token with the role of its user, by the hash of the token, in the one site. */
+/**
+* The token with the role of its user in the token's site, by the hash of the token, in the
+* deployment. A user who is no member of the site has no role there, and the token is unknown.
+*/
 const LOOKUP = `SELECT t.id AS token_id, t.site_id AS site_id, t.user_id AS user_id,
-    t.scopes AS scopes, t.expires_at AS expires_at, t.revoked_at AS revoked_at,
-    t.last_used_at AS last_used_at, u.role AS role
-  FROM tokens AS t JOIN users AS u ON u.id = t.user_id
-  WHERE t.hash = ?1 AND t.site_id = ?2`;
+    t.kind AS kind, t.scopes AS scopes, t.expires_at AS expires_at, t.revoked_at AS revoked_at,
+    t.last_used_at AS last_used_at, m.role AS role
+  FROM tokens AS t JOIN members AS m ON m.user_id = t.user_id AND m.site_id = t.site_id
+  WHERE t.hash = ?1`;
 /**
 * The scopes a token carries, from the JSON array the `tokens` table stores. Anything that is not
 * one of the scopes is left out, and a value that is not an array of scopes has none: a token
@@ -242,12 +196,12 @@ async function recordTokenUse(db, token, now) {
 	}
 }
 /**
-* Authenticates a personal token (ADR-019). A string without the shape of a token is `unknown`
-* without a query. Otherwise one query finds the token by the hash of the whole string, in this
-* site only, together with the role of its user; the answer is, in this order:
+* Authenticates a personal token (ADR-019) or a read token. A string without the shape of either
+* is `unknown` without a query. Otherwise one query finds the token by the hash of the whole
+* string, together with the role of its user in the token's site; the answer is, in this order:
 *
-* - `unknown`: no such token in this site. A token of another site is the same as no token, and
-*   nothing says it exists elsewhere.
+* - `unknown`: no such token in the sites of this deployment. A token of another site is the same as
+*   no token, and nothing says it exists elsewhere.
 * - `revoked`: it has a revocation date, whatever the date says: it is never read, so a clock that
 *   runs ahead of the Worker's, where the token was revoked, cannot keep it alive for a while.
 * - `expired`: its expiry is now or past (see `hasExpired`).
@@ -260,12 +214,13 @@ async function recordTokenUse(db, token, now) {
 * must never read that as a valid token.
 */
 async function checkPersonalToken(db, token, options) {
-	if (!isPersonalToken(token)) return {
+	const kind = isPersonalToken(token) ? "personal" : isReadToken(token) ? "read" : null;
+	if (kind === null) return {
 		ok: false,
 		reason: "unknown"
 	};
-	const row = await db.prepare(LOOKUP).bind(await hashPersonalToken(token), options.site).first();
-	if (row === null) return {
+	const row = await db.prepare(LOOKUP).bind(await hashPersonalToken(token)).first();
+	if (row === null || row.kind !== kind || !options.sites.has(row.site_id)) return {
 		ok: false,
 		reason: "unknown"
 	};
@@ -278,14 +233,22 @@ async function checkPersonalToken(db, token, options) {
 		reason: "expired"
 	};
 	const recent = row.last_used_at !== null && row.last_used_at >= anHourBefore(options.now);
+	const scopes = effectiveScopes(row.role, parseTokenScopes(row.scopes));
+	const identity = {
+		userId: row.user_id,
+		tokenId: row.token_id,
+		site: row.site_id
+	};
 	return {
 		ok: true,
-		principal: {
+		principal: kind === "read" ? {
+			kind: "read",
+			...identity,
+			scopes: scopes.filter((scope) => scope === "content:read")
+		} : {
 			kind: "token",
-			userId: row.user_id,
-			tokenId: row.token_id,
-			site: row.site_id,
-			scopes: effectiveScopes(row.role, parseTokenScopes(row.scopes))
+			...identity,
+			scopes
 		},
 		touch: recent ? null : recordTokenUse(db, {
 			id: row.token_id,
@@ -408,336 +371,6 @@ function decodeCursor(cursor, view) {
 	throw invalidCursor();
 }
 //#endregion
-//#region src/db/columns.ts
-/**
-* The columns every table shares. Each helper returns a new builder, because a Drizzle column
-* belongs to one table. Only the repository functions write rows, so these defaults are what
-* every row gets.
-*/
-/** The current time in UTC, as ISO 8601 with milliseconds: `2026-10-12T18:30:00.000Z`. */
-function nowIso() {
-	return (/* @__PURE__ */ new Date()).toISOString();
-}
-/** The primary key: a prefixed ULID, such as `ent_01JAB3XQ8ZK4M6N2P5R7S9T0VW`. */
-function id(prefix) {
-	return text("id").primaryKey().$defaultFn(() => newId(prefix));
-}
-/**
-* The site a row belongs to: the site's key in `hollware.config.ts`, which is also the id of its
-* row in `sites`. Every table but the deployment-wide ones carries it (ADR-006).
-*/
-function siteId() {
-	return text("site_id").notNull();
-}
-/** `created_at` and `updated_at`, in UTC; `updated_at` moves on every update. */
-function timestamps() {
-	return {
-		createdAt: text("created_at").notNull().$defaultFn(nowIso),
-		updatedAt: text("updated_at").notNull().$defaultFn(nowIso).$onUpdateFn(nowIso)
-	};
-}
-sqliteTable("_hollware_meta", {
-	key: text("key").primaryKey().notNull(),
-	value: text("value").notNull()
-});
-/** The sites of the deployment. The id is the site's key in `hollware.config.ts`. */
-const sites = sqliteTable("sites", {
-	id: text("id").primaryKey(),
-	...timestamps()
-});
-/** People. A user belongs to the deployment; tokens carry the site. */
-const users = sqliteTable("users", {
-	id: id("usr"),
-	name: text("name"),
-	role: text("role").notNull(),
-	...timestamps()
-}, (t) => [check("users_role", sql`${t.role} IN ('owner', 'editor', 'reviewer')`)]);
-/** Personal tokens (ADR-019): only the hash is stored. */
-const tokens = sqliteTable("tokens", {
-	id: id("tok"),
-	siteId: siteId(),
-	userId: text("user_id").notNull(),
-	label: text("label").notNull(),
-	hash: text("hash").notNull(),
-	/** A JSON array of scopes. */
-	scopes: text("scopes").notNull(),
-	expiresAt: text("expires_at"),
-	revokedAt: text("revoked_at"),
-	lastUsedAt: text("last_used_at"),
-	...timestamps()
-}, (t) => [
-	unique("tokens_id_site").on(t.id, t.siteId),
-	unique("tokens_hash").on(t.hash),
-	foreignKey({
-		name: "tokens_site",
-		columns: [t.siteId],
-		foreignColumns: [sites.id]
-	}),
-	foreignKey({
-		name: "tokens_user",
-		columns: [t.userId],
-		foreignColumns: [users.id]
-	}),
-	check("tokens_scopes", sql`json_valid(${t.scopes}) AND json_type(${t.scopes}) = 'array'`)
-]);
-/** One entry per site, collection, locale and slug; its content lives in `revisions`. */
-const entries = sqliteTable("entries", {
-	id: id("ent"),
-	siteId: siteId(),
-	collection: text("collection").notNull(),
-	locale: text("locale").notNull(),
-	slug: text("slug").notNull(),
-	translationGroup: text("translation_group"),
-	status: text("status").notNull(),
-	/** Bumped by every change of the entry: the optimistic write compares it. */
-	version: integer("version").notNull(),
-	headRev: text("head_rev").notNull(),
-	publishedRev: text("published_rev"),
-	publishedAt: text("published_at"),
-	publishedSortKey: text("published_sort_key"),
-	scheduledAt: text("scheduled_at"),
-	...timestamps()
-}, (t) => [
-	unique("entries_id_site").on(t.id, t.siteId),
-	unique("entries_slug").on(t.siteId, t.collection, t.locale, t.slug),
-	unique("entries_translation").on(t.siteId, t.collection, t.translationGroup, t.locale),
-	index("entries_head").on(t.siteId, t.collection, t.updatedAt, t.id),
-	index("entries_head_locale").on(t.siteId, t.collection, t.locale, t.updatedAt, t.id),
-	index("entries_published").on(t.siteId, t.collection, t.locale, t.publishedSortKey, t.id).where(sql`${t.status} = 'published'`),
-	foreignKey({
-		name: "entries_site",
-		columns: [t.siteId],
-		foreignColumns: [sites.id]
-	}),
-	check("entries_status", sql`${t.status} IN ('draft', 'scheduled', 'published')`),
-	check("entries_version", sql`${t.version} >= 1`),
-	check("entries_draft", sql`${t.status} <> 'draft' OR (${t.publishedRev} IS NULL AND ${t.publishedSortKey} IS NULL AND ${t.scheduledAt} IS NULL)`),
-	check("entries_published", sql`${t.status} <> 'published' OR (${t.publishedRev} IS NOT NULL AND ${t.publishedAt} IS NOT NULL AND ${t.publishedSortKey} IS NOT NULL)`),
-	check("entries_scheduled", sql`${t.status} <> 'scheduled' OR ${t.scheduledAt} IS NOT NULL`)
-]);
-/**
-* Every version of an entry, appended and never changed (ADR-021). `markdown` is the whole file,
-* frontmatter included; the derived columns can be rebuilt by `reparse`.
-*/
-const revisions = sqliteTable("revisions", {
-	id: id("rev"),
-	siteId: siteId(),
-	entryId: text("entry_id").notNull(),
-	markdown: text("markdown").notNull(),
-	/** Derived: the frontmatter as JSON. */
-	frontmatter: text("frontmatter").notNull(),
-	/** Derived: the Comark document as JSON. */
-	document: text("document").notNull(),
-	comarkVersion: text("comark_version").notNull(),
-	pipelineVersion: text("pipeline_version").notNull(),
-	wordCount: integer("word_count").notNull(),
-	/** The verdict of the contracts when the revision was written, as JSON. */
-	verdict: text("verdict").notNull(),
-	actorKind: text("actor_kind").notNull(),
-	actorUserId: text("actor_user_id").notNull(),
-	actorTokenId: text("actor_token_id"),
-	/** The client and, when it says, the model behind the write, as JSON. */
-	actorMeta: text("actor_meta"),
-	...timestamps()
-}, (t) => [
-	unique("revisions_id_site").on(t.id, t.siteId),
-	index("revisions_entry").on(t.entryId, t.createdAt),
-	foreignKey({
-		name: "revisions_site",
-		columns: [t.siteId],
-		foreignColumns: [sites.id]
-	}),
-	foreignKey({
-		name: "revisions_entry",
-		columns: [t.entryId, t.siteId],
-		foreignColumns: [entries.id, entries.siteId]
-	}),
-	foreignKey({
-		name: "revisions_user",
-		columns: [t.actorUserId],
-		foreignColumns: [users.id]
-	}),
-	foreignKey({
-		name: "revisions_token",
-		columns: [t.actorTokenId, t.siteId],
-		foreignColumns: [tokens.id, tokens.siteId]
-	}),
-	check("revisions_actor_kind", sql`${t.actorKind} IN ('token', 'user', 'oauth_client')`),
-	check("revisions_json", sql`json_valid(${t.frontmatter}) AND json_valid(${t.document}) AND json_valid(${t.verdict}) AND (${t.actorMeta} IS NULL OR json_valid(${t.actorMeta}))`),
-	check("revisions_word_count", sql`${t.wordCount} >= 0`)
-]);
-/** The tags of a revision, for listing published entries by tag. Append-only, like revisions. */
-const revisionTags = sqliteTable("revision_tags", {
-	id: id("tag"),
-	siteId: siteId(),
-	revisionId: text("revision_id").notNull(),
-	tag: text("tag").notNull(),
-	...timestamps()
-}, (t) => [
-	unique("revision_tags_id_site").on(t.id, t.siteId),
-	unique("revision_tags_tag").on(t.revisionId, t.tag),
-	index("revision_tags_by_tag").on(t.siteId, t.tag),
-	foreignKey({
-		name: "revision_tags_site",
-		columns: [t.siteId],
-		foreignColumns: [sites.id]
-	}),
-	foreignKey({
-		name: "revision_tags_revision",
-		columns: [t.revisionId, t.siteId],
-		foreignColumns: [revisions.id, revisions.siteId]
-	})
-]);
-/**
-* Every publish and unpublish, appended: the verdict of the publish phase and the warnings the
-* caller acknowledged (ADR-021).
-*/
-const publications = sqliteTable("publications", {
-	id: id("pub"),
-	siteId: siteId(),
-	entryId: text("entry_id").notNull(),
-	action: text("action").notNull(),
-	revisionId: text("revision_id"),
-	verdict: text("verdict"),
-	/** A JSON array: the warnings the caller acknowledged to publish. */
-	acknowledged: text("acknowledged").notNull(),
-	actorKind: text("actor_kind").notNull(),
-	actorUserId: text("actor_user_id").notNull(),
-	actorTokenId: text("actor_token_id"),
-	actorMeta: text("actor_meta"),
-	...timestamps()
-}, (t) => [
-	unique("publications_id_site").on(t.id, t.siteId),
-	index("publications_entry").on(t.entryId, t.createdAt),
-	foreignKey({
-		name: "publications_site",
-		columns: [t.siteId],
-		foreignColumns: [sites.id]
-	}),
-	foreignKey({
-		name: "publications_entry",
-		columns: [t.entryId, t.siteId],
-		foreignColumns: [entries.id, entries.siteId]
-	}),
-	foreignKey({
-		name: "publications_revision",
-		columns: [t.revisionId, t.siteId],
-		foreignColumns: [revisions.id, revisions.siteId]
-	}),
-	foreignKey({
-		name: "publications_user",
-		columns: [t.actorUserId],
-		foreignColumns: [users.id]
-	}),
-	foreignKey({
-		name: "publications_token",
-		columns: [t.actorTokenId, t.siteId],
-		foreignColumns: [tokens.id, tokens.siteId]
-	}),
-	check("publications_action", sql`${t.action} IN ('publish', 'unpublish')`),
-	check("publications_shape", sql`(${t.action} = 'publish' AND ${t.revisionId} IS NOT NULL AND ${t.verdict} IS NOT NULL) OR (${t.action} = 'unpublish' AND ${t.revisionId} IS NULL AND ${t.verdict} IS NULL)`),
-	check("publications_actor_kind", sql`${t.actorKind} IN ('token', 'user', 'oauth_client')`),
-	check("publications_json", sql`json_valid(${t.acknowledged}) AND json_type(${t.acknowledged}) = 'array' AND (${t.verdict} IS NULL OR json_valid(${t.verdict})) AND (${t.actorMeta} IS NULL OR json_valid(${t.actorMeta}))`)
-]);
-/**
-* Scheduled publications (ADR-025): one per entry at most. The cron trigger publishes the entry when
-* `scheduled_at` has passed, if it is still at `version`, with the warnings that were acknowledged
-* when it was scheduled, and in the name of who scheduled it.
-*/
-const schedules = sqliteTable("schedules", {
-	id: id("sch"),
-	siteId: siteId(),
-	entryId: text("entry_id").notNull(),
-	scheduledAt: text("scheduled_at").notNull(),
-	/** The version of the entry once scheduled: a later change cancels the schedule. */
-	version: integer("version").notNull(),
-	/** A JSON array: the warnings acknowledged when the publication was scheduled. */
-	acknowledged: text("acknowledged").notNull(),
-	actorKind: text("actor_kind").notNull(),
-	actorUserId: text("actor_user_id").notNull(),
-	actorTokenId: text("actor_token_id"),
-	actorMeta: text("actor_meta"),
-	...timestamps()
-}, (t) => [
-	unique("schedules_id_site").on(t.id, t.siteId),
-	unique("schedules_entry").on(t.siteId, t.entryId),
-	index("schedules_due").on(t.scheduledAt),
-	foreignKey({
-		name: "schedules_site",
-		columns: [t.siteId],
-		foreignColumns: [sites.id]
-	}),
-	foreignKey({
-		name: "schedules_entry_fk",
-		columns: [t.entryId, t.siteId],
-		foreignColumns: [entries.id, entries.siteId]
-	}),
-	foreignKey({
-		name: "schedules_user",
-		columns: [t.actorUserId],
-		foreignColumns: [users.id]
-	}),
-	foreignKey({
-		name: "schedules_token",
-		columns: [t.actorTokenId, t.siteId],
-		foreignColumns: [tokens.id, tokens.siteId]
-	}),
-	check("schedules_actor_kind", sql`${t.actorKind} IN ('token', 'user', 'oauth_client')`),
-	check("schedules_json", sql`json_valid(${t.acknowledged}) AND json_type(${t.acknowledged}) = 'array' AND (${t.actorMeta} IS NULL OR json_valid(${t.actorMeta}))`)
-]);
-/**
-* The effects of a publication (ADR-025), written in the batch that publishes or unpublishes: one
-* row per event. The Queue consumer delivers each event to every subscriber, and records it in
-* `deliveries`; `sent_at` says that the event was put on the Queue.
-*/
-const outbox = sqliteTable("outbox", {
-	id: id("evt"),
-	siteId: siteId(),
-	/** `entry.published` or `entry.unpublished`. */
-	kind: text("kind").notNull(),
-	entryId: text("entry_id").notNull(),
-	/** A JSON object: what subscribers get. */
-	payload: text("payload").notNull(),
-	sentAt: text("sent_at"),
-	...timestamps()
-}, (t) => [
-	unique("outbox_id_site").on(t.id, t.siteId),
-	index("outbox_unsent").on(t.sentAt, t.createdAt),
-	foreignKey({
-		name: "outbox_site",
-		columns: [t.siteId],
-		foreignColumns: [sites.id]
-	}),
-	check("outbox_kind", sql`${t.kind} IN ('entry.published', 'entry.unpublished')`),
-	check("outbox_json", sql`json_valid(${t.payload}) AND json_type(${t.payload}) = 'object'`)
-]);
-/** Each delivery of an event to a subscriber, so that a retry never delivers it twice. */
-const deliveries = sqliteTable("deliveries", {
-	id: id("dlv"),
-	siteId: siteId(),
-	eventId: text("event_id").notNull(),
-	/** The subscriber, by its name in the config, such as `webhook:newsletter` or `indexnow`. */
-	subscriber: text("subscriber").notNull(),
-	attempts: integer("attempts").notNull(),
-	deliveredAt: text("delivered_at"),
-	lastError: text("last_error"),
-	...timestamps()
-}, (t) => [
-	unique("deliveries_id_site").on(t.id, t.siteId),
-	unique("deliveries_event_subscriber").on(t.eventId, t.subscriber),
-	foreignKey({
-		name: "deliveries_site",
-		columns: [t.siteId],
-		foreignColumns: [sites.id]
-	}),
-	foreignKey({
-		name: "deliveries_event",
-		columns: [t.eventId, t.siteId],
-		foreignColumns: [outbox.id, outbox.siteId]
-	}),
-	check("deliveries_attempts", sql`${t.attempts} >= 0`)
-]);
-//#endregion
 //#region src/db/rows.ts
 /**
 * The columns the store reads and how they become the types of `ports.ts`. The JSON columns come
@@ -1094,6 +727,21 @@ function lookup(db, site) {
 	};
 }
 //#endregion
+//#region src/db/errors.ts
+/**
+* What D1 says when a statement breaks a unique key: `D1_ERROR: UNIQUE constraint failed:
+* entries.site_id, …: SQLITE_CONSTRAINT`, with the same text again in the `cause`. Inside a batch
+* the error arrives as it is, and the batch has rolled back.
+*/
+function isUniqueViolation(error) {
+	let current = error;
+	for (let depth = 0; depth < 4 && current instanceof Error; depth += 1) {
+		if (current.message.includes("UNIQUE constraint failed")) return true;
+		current = current.cause;
+	}
+	return false;
+}
+//#endregion
 //#region src/db/statements.ts
 function actorColumns(actor) {
 	return {
@@ -1241,7 +889,7 @@ async function dueSchedules(db, site, now) {
 		version: row.version,
 		acknowledged: parseAcknowledged(row.acknowledged),
 		actor: {
-			kind: "token",
+			kind: actorKindOf(row.actorKind),
 			userId: row.actorUserId,
 			tokenId: row.actorTokenId,
 			meta: row.actorMeta === null ? null : parseMeta(row.actorMeta)
@@ -1265,24 +913,140 @@ function parseAcknowledged(text) {
 		path: item.path
 	}] : []);
 }
+/** The kind of an actor as the `*_actor_kind` checks allow it. */
+function actorKindOf(value) {
+	if (value === "token" || value === "user" || value === "oauth_client") return value;
+	throw new Error(`A schedule has the actor kind ${value}, which is no kind`);
+}
 function parseMeta(text) {
 	const value = JSON.parse(text);
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : null;
 }
 //#endregion
-//#region src/db/errors.ts
+//#region src/db/reviews.ts
 /**
-* What D1 says when a statement breaks a unique key: `D1_ERROR: UNIQUE constraint failed:
-* entries.site_id, …: SQLITE_CONSTRAINT`, with the same text again in the `cause`. Inside a batch
-* the error arrives as it is, and the batch has rolled back.
+* Reviews (v0.3). A person who may write but not publish asks for the head revision of an entry
+* to be published; a person who may publish approves it, which publishes it, or asks for changes.
+* The partial unique index `reviews_pending` keeps one pending review per entry. A write that
+* moves the entry closes the pending review in its own batch: a new revision cancels it
+* (`cancelPendingReview`), a publication approves it (`approvePendingReview`).
 */
-function isUniqueViolation(error) {
-	let current = error;
-	for (let depth = 0; depth < 4 && current instanceof Error; depth += 1) {
-		if (current.message.includes("UNIQUE constraint failed")) return true;
-		current = current.cause;
+const STATUSES = [
+	"pending",
+	"approved",
+	"changes_requested",
+	"cancelled"
+];
+function statusOf(value) {
+	const status = STATUSES.find((known) => known === value);
+	if (status === void 0) throw new Error(`A review has the status ${value}, which is no status`);
+	return status;
+}
+/** The columns of a review, and the name of who asked for it. */
+const COLUMNS = {
+	...getTableColumns(reviews),
+	requestedByName: users.name
+};
+function toReview(row) {
+	return {
+		id: row.id,
+		entryId: row.entryId,
+		revisionId: row.revisionId,
+		status: statusOf(row.status),
+		acknowledged: parseAcknowledged(row.acknowledged),
+		requestedBy: row.requestedBy,
+		requestedByName: row.requestedByName,
+		requestedAt: row.createdAt,
+		decidedBy: row.decidedBy,
+		decidedAt: row.decidedAt,
+		note: row.note
+	};
+}
+/** The entry is still at `version`: the condition of every statement a write adds to its batch. */
+function entryAt(site, entryId, version) {
+	return sql`exists (select 1 from ${entries} where ${and(eq(entries.id, entryId), eq(entries.siteId, site), eq(entries.version, version))})`;
+}
+/** In the batch of a new revision: the pending review asked for another one, so it is cancelled. */
+function cancelPendingReview(db, site, entryId, version, now) {
+	return db.update(reviews).set({
+		status: "cancelled",
+		updatedAt: now
+	}).where(and(eq(reviews.siteId, site), eq(reviews.entryId, entryId), eq(reviews.status, "pending"), entryAt(site, entryId, version)));
+}
+/** In the batch of a publication: what the pending review asked for is published, by `userId`. */
+function approvePendingReview(db, site, entryId, version, userId, now) {
+	return db.update(reviews).set({
+		status: "approved",
+		decidedBy: userId,
+		decidedAt: now,
+		updatedAt: now
+	}).where(and(eq(reviews.siteId, site), eq(reviews.entryId, entryId), eq(reviews.status, "pending"), sql`${reviews.revisionId} = (select ${entries.headRev} from ${entries} where ${and(eq(entries.id, entryId), eq(entries.siteId, site), eq(entries.version, version))})`));
+}
+async function pendingOf(db, site, entryId) {
+	const [row] = await db.select(COLUMNS).from(reviews).innerJoin(users, eq(users.id, reviews.requestedBy)).where(and(eq(reviews.siteId, site), eq(reviews.entryId, entryId), eq(reviews.status, "pending"))).limit(1);
+	return row === void 0 ? null : toReview(row);
+}
+async function requestReview(db, clock, site, write, whyNothingChanged) {
+	const now = clock.now().toISOString();
+	const row = {
+		id: newId("rvw"),
+		siteId: site,
+		entryId: write.entryId,
+		revisionId: entries.headRev,
+		status: "pending",
+		acknowledged: JSON.stringify(write.acknowledged),
+		requestedBy: write.actor.userId,
+		requestedMeta: write.actor.meta === null ? null : JSON.stringify(write.actor.meta),
+		decidedBy: null,
+		decidedAt: null,
+		note: null,
+		createdAt: now,
+		updatedAt: now
+	};
+	let inserted;
+	try {
+		inserted = await db.insert(reviews).select(sql`select ${valuesOf(reviews, row)} from ${entries} where ${and(eq(entries.id, write.entryId), eq(entries.siteId, site), eq(entries.version, write.expectedVersion))}`).returning({ id: reviews.id });
+	} catch (error) {
+		const pending = isUniqueViolation(error) ? await pendingOf(db, site, write.entryId) : null;
+		if (pending === null) throw error;
+		return {
+			outcome: "pending_review",
+			review: pending
+		};
 	}
-	return false;
+	if (inserted.length === 0) return whyNothingChanged();
+	const review = await findReview(db, site, row.id);
+	if (review === null) throw new Error(`The review ${row.id} that was just written is not there`);
+	return {
+		outcome: "pending_review",
+		review
+	};
+}
+async function findReview(db, site, id) {
+	const [row] = await db.select(COLUMNS).from(reviews).innerJoin(users, eq(users.id, reviews.requestedBy)).where(and(eq(reviews.siteId, site), eq(reviews.id, id))).limit(1);
+	return row === void 0 ? null : toReview(row);
+}
+async function listReviews$1(db, site, query) {
+	return (await db.select(COLUMNS).from(reviews).innerJoin(users, eq(users.id, reviews.requestedBy)).where(and(eq(reviews.siteId, site), eq(reviews.status, query.status))).orderBy(desc(reviews.createdAt), desc(reviews.id)).limit(query.limit)).map(toReview);
+}
+async function requestChanges$1(db, clock, site, write) {
+	const now = clock.now().toISOString();
+	const [row] = await db.update(reviews).set({
+		status: "changes_requested",
+		note: write.note,
+		decidedBy: write.userId,
+		decidedAt: now,
+		updatedAt: now
+	}).where(and(eq(reviews.siteId, site), eq(reviews.id, write.id), eq(reviews.status, "pending"))).returning({ id: reviews.id });
+	const review = await findReview(db, site, write.id);
+	if (row !== void 0 && review !== null) return {
+		outcome: "changes_requested",
+		review
+	};
+	return review === null ? { outcome: "not_found" } : {
+		outcome: "not_pending",
+		review
+	};
 }
 //#endregion
 //#region src/db/size.ts
@@ -1477,6 +1241,7 @@ async function appendRevision(db, clock, site, write) {
 			tags,
 			now
 		}),
+		cancelPendingReview(db, site, write.entryId, write.expectedVersion, now),
 		db.update(entries).set({
 			version: sql`${entries.version} + 1`,
 			headRev: revisionId,
@@ -1521,6 +1286,7 @@ async function publish$2(db, clock, site, write) {
 		insertPublishAtVersion(db, row, write.expectedVersion),
 		dropScheduleAtVersion(db, site, write.entryId, write.expectedVersion),
 		insertEventWhere(db, site, write.entryId, write.event ?? null, "entry.published", now, [eq(entries.version, write.expectedVersion)]),
+		approvePendingReview(db, site, write.entryId, write.expectedVersion, write.actor.userId, now),
 		db.update(entries).set({
 			status: "published",
 			scheduledAt: null,
@@ -1530,7 +1296,7 @@ async function publish$2(db, clock, site, write) {
 			version: sql`${entries.version} + 1`,
 			updatedAt: now
 		}).where(and(eq(entries.id, write.entryId), eq(entries.siteId, site), eq(entries.version, write.expectedVersion))).returning(entryFields)
-	]))[3];
+	]))[4];
 	if (changed === void 0) return whyNothingChanged(db, site, write.entryId);
 	const entry = toEntry(changed);
 	const revision = entry.publishedRevision === null ? null : await findRevision(db, site, entry.publishedRevision);
@@ -1573,7 +1339,7 @@ async function publishGroup$1(db, clock, site, group) {
 			entryId: write.entryId
 		};
 		appended.push(row.id);
-		statements.push(insertPublishAtVersion(db, row, write.expectedVersion), dropScheduleAtVersion(db, site, write.entryId, write.expectedVersion), insertEventWhere(db, site, write.entryId, write.event ?? null, "entry.published", now, [eq(entries.version, write.expectedVersion)]), db.update(entries).set({
+		statements.push(insertPublishAtVersion(db, row, write.expectedVersion), dropScheduleAtVersion(db, site, write.entryId, write.expectedVersion), insertEventWhere(db, site, write.entryId, write.event ?? null, "entry.published", now, [eq(entries.version, write.expectedVersion)]), approvePendingReview(db, site, write.entryId, write.expectedVersion, write.actor.userId, now), db.update(entries).set({
 			status: "published",
 			scheduledAt: null,
 			publishedRev: entries.headRev,
@@ -1686,7 +1452,11 @@ function createD1Store(db, options = {}) {
 		schedule: (site, write) => schedule(database, clock, site, write),
 		dueSchedules: (site, now) => dueSchedules(database, site, now),
 		cancelSchedule: (site, entryId) => cancelSchedule(database, clock, site, entryId),
-		unpublish: (site, write) => unpublish$1(database, clock, site, write)
+		unpublish: (site, write) => unpublish$1(database, clock, site, write),
+		requestReview: (site, write) => requestReview(database, clock, site, write, () => whyNothingChanged(database, site, write.entryId)),
+		findReview: (site, id) => findReview(database, site, id),
+		listReviews: (site, query) => listReviews$1(database, site, query),
+		requestChanges: (site, write) => requestChanges$1(database, clock, site, write)
 	};
 }
 //#endregion
@@ -1878,12 +1648,14 @@ function isEventMessage(body) {
 /**
 * The Queue consumer: delivers each event, acknowledges it once every subscriber has it, and asks
 * for a retry otherwise; after the Queue's retries it lands in the dead-letter queue. A message of
-* another site, or that is no event, is acknowledged and dropped.
+* a site this deployment does not serve (`depsOf` has none for it), or that is no event, is
+* acknowledged and dropped.
 */
-async function consumeEvents(messages, deps) {
+async function consumeEvents(messages, depsOf) {
 	for (const message of messages) {
 		const { body } = message;
-		if (!isEventMessage(body) || body.site !== deps.site.key) {
+		const deps = isEventMessage(body) ? depsOf(body.site) : void 0;
+		if (!isEventMessage(body) || deps === void 0) {
 			message.ack();
 			continue;
 		}
@@ -1983,7 +1755,375 @@ function installErrorHandling(app, log) {
 	}));
 }
 //#endregion
+//#region src/oauth/admin.ts
+/**
+* The admin as a client of the OAuth server (ADR-026): a public client, with PKCE, that a person
+* never has to allow. It is registered once per issuer, with `createClient`, and its id is kept in
+* `OAUTH_KV` beside the library's own records. A Client ID Metadata Document would need an `https`
+* URL that the Worker fetches from itself, which local development does not have.
+*/
+/** Where the admin's id is kept, by issuer. The library's own keys never start with it. */
+const KEY = "hollware:admin-client:";
+/**
+* The admin's client, registered on first use. Two first requests at once may both register one:
+* the last id written wins, and the other client is never used.
+*/
+async function adminClient(oauth, env) {
+	const redirectUri = `${oauth.issuer}/admin/callback`;
+	const stored = await env.OAUTH_KV.get(`${KEY}${oauth.issuer}`);
+	if (stored !== null) return {
+		clientId: stored,
+		redirectUri
+	};
+	const client = await oauth.authorizationServer.getOAuthApi(env).createClient({
+		clientName: "Hollware admin",
+		redirectUris: [redirectUri],
+		tokenEndpointAuthMethod: "none"
+	});
+	await env.OAUTH_KV.put(`${KEY}${oauth.issuer}`, client.clientId);
+	return {
+		clientId: client.clientId,
+		redirectUri
+	};
+}
+//#endregion
+//#region src/http/admin.ts
+/**
+* The admin at `/admin/` (ADR-026). Its hashed files are static assets that never reach the
+* Worker (`run_worker_first` in wrangler.jsonc); its page does, so that it goes out with the
+* policy below, and so does every path of the single-page app, which all get the same page. The
+* page learns how to sign in from `/admin/config.json`.
+*/
+/**
+* What the admin's page may do: its own scripts and styles (CodeMirror and Nuxt UI write style
+* elements and attributes, hence `unsafe-inline` for styles only), images of the content from
+* anywhere over https, and requests to this origin alone. Nothing frames it.
+*/
+const POLICY = [
+	"default-src 'self'",
+	"script-src 'self'",
+	"style-src 'self' 'unsafe-inline'",
+	"img-src 'self' data: https:",
+	"connect-src 'self'",
+	"font-src 'self' data:",
+	"base-uri 'none'",
+	"form-action 'self'",
+	"frame-ancestors 'none'"
+].join("; ");
+function notInstalled() {
+	return Response.json({
+		code: "not_found",
+		message: "The admin is not installed in this Worker.",
+		fix: "Bind the static assets as ASSETS and serve the files of @hollware/admin (adminAssets()), as the starter does."
+	}, {
+		status: 404,
+		headers: { "cache-control": "no-store" }
+	});
+}
+function installAdmin(app, options) {
+	app.get("/admin/config.json", async (c) => {
+		const oauth = options.oauth(c.env.HOLLWARE_PUBLIC_URL);
+		const client = await adminClient(oauth, c.env);
+		return c.json({
+			issuer: oauth.issuer,
+			clientId: client.clientId,
+			redirectUri: client.redirectUri,
+			resource: oauth.resources.v1,
+			scope: SCOPES.join(" ")
+		}, 200, { "cache-control": "no-store" });
+	});
+	const page = async (c) => {
+		const assets = c.env.ASSETS;
+		if (assets === void 0) return notInstalled();
+		const origin = options.oauth(c.env.HOLLWARE_PUBLIC_URL).issuer;
+		const answer = await assets.fetch(new Request(`${origin}/admin/`));
+		if (!answer.ok) return notInstalled();
+		const headers = new Headers(answer.headers);
+		headers.set("content-security-policy", POLICY);
+		headers.set("cache-control", "no-store");
+		headers.set("x-content-type-options", "nosniff");
+		headers.set("referrer-policy", "no-referrer");
+		return new Response(answer.body, {
+			status: 200,
+			headers
+		});
+	};
+	app.get("/admin", (c) => c.redirect("/admin/", 301));
+	app.get("/admin/", page);
+	app.get("/admin/*", async (c) => {
+		if (/\.[a-z0-9]+$/i.test(c.req.path)) {
+			const assets = c.env.ASSETS;
+			if (assets === void 0) return notInstalled();
+			return assets.fetch(c.req.raw);
+		}
+		return page(c);
+	});
+}
+//#endregion
+//#region src/http/admin-api.ts
+/**
+* What only a person in the admin may do (ADR-026): see, make and revoke personal tokens, and
+* invite people, on the site of their token; and learn who they are and which sites they may switch
+* to (`/v1/admin/me`, the one route for every role). These are no operations, so no agent sees them over MCP, and a request needs an
+* access token of the admin's own client with `schema:admin`: a personal token, or a token of
+* another client, never reaches them, even an owner's. A leaked token cannot mint the next one.
+*/
+/** A personal token lasts this long unless the person says otherwise (as `hollware token create`). */
+const TOKEN_DAYS = 90;
+const INVITATION_DAYS = 7;
+function json$1(body, status = 200) {
+	return Response.json(body, {
+		status,
+		headers: { "cache-control": "no-store" }
+	});
+}
+function refused(message, fix, status = 400) {
+	return json$1({
+		code: status === 400 ? "invalid_input" : "forbidden",
+		message,
+		fix
+	}, status);
+}
+function parseScopes(json) {
+	try {
+		const value = JSON.parse(json);
+		return Array.isArray(value) ? value.filter((scope) => typeof scope === "string" && isScope(scope)) : [];
+	} catch {
+		return [];
+	}
+}
+function daysFrom(value, fallback) {
+	if (value === void 0) return fallback;
+	return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 365 ? value : null;
+}
+function installAdminApi(app, options) {
+	/**
+	* Runs `handle` for a person in the admin with `schema:admin`, or with any scope when `anyone`;
+	* anyone else is refused.
+	*/
+	const admin = (handle, { anyone = false } = {}) => (c) => options.protect(c, async (principal) => {
+		const ours = (await adminClient(options.oauth(c.env.HOLLWARE_PUBLIC_URL), c.env)).clientId;
+		if (principal.kind !== "oauth" || principal.clientId !== ours) return refused("Only the admin may do this.", "Sign in to the admin at /admin/ and do it there.", 403);
+		if (!anyone && !principal.scopes.includes("schema:admin")) return insufficientScope(["schema:admin"], options.metadataUrl(c));
+		return handle(c, principal);
+	});
+	const body = async (c) => {
+		const value = await c.req.json().catch(() => null);
+		return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : {};
+	};
+	app.get("/v1/admin/me", admin(async (c, person) => {
+		const db = connect(c.env.DB);
+		const [user] = await db.select({
+			id: users.id,
+			name: users.name
+		}).from(users).where(eq(users.id, person.userId));
+		const sites = (await membershipsOf(db, person.userId)).filter((membership) => options.sites.has(membership.site));
+		return json$1({
+			user,
+			site: person.site,
+			scopes: person.scopes,
+			sites
+		});
+	}, { anyone: true }));
+	app.get("/v1/admin/tokens", admin(async (c, person) => {
+		return json$1({ tokens: (await connect(c.env.DB).select({
+			id: tokens.id,
+			kind: tokens.kind,
+			label: tokens.label,
+			scopes: tokens.scopes,
+			user: users.name,
+			expiresAt: tokens.expiresAt,
+			revokedAt: tokens.revokedAt,
+			lastUsedAt: tokens.lastUsedAt,
+			createdAt: tokens.createdAt
+		}).from(tokens).innerJoin(users, eq(users.id, tokens.userId)).where(eq(tokens.siteId, person.site)).orderBy(desc(tokens.createdAt), desc(tokens.id))).map((row) => ({
+			...row,
+			scopes: parseScopes(row.scopes)
+		})) });
+	}));
+	app.post("/v1/admin/tokens", admin(async (c, person) => {
+		const input = await body(c);
+		const label = typeof input["label"] === "string" ? input["label"].trim() : "";
+		if (label === "" || label.length > 100) return refused("A token needs a label of 1 to 100 characters.", "Say what the token is for.");
+		const asKind = input["kind"];
+		const kind = asKind === void 0 || asKind === "personal" ? "personal" : asKind === "read" ? "read" : null;
+		if (kind === null) return refused("kind is \"personal\" or \"read\".", "Leave it out for a personal token; \"read\" makes a token that reads published content.");
+		const asked = kind === "read" ? ["content:read"] : Array.isArray(input["scopes"]) ? input["scopes"].filter((s) => typeof s === "string") : [];
+		const scopes = person.scopes.filter((scope) => asked.includes(scope));
+		if (scopes.length === 0) return refused("A token needs at least one scope that you have.", `Choose among ${person.scopes.join(", ")}.`);
+		const days = daysFrom(input["expiresInDays"], TOKEN_DAYS);
+		if (days === null) return refused("expiresInDays is a whole number from 1 to 365.", "Leave it out for 90 days.");
+		const now = options.clock.now();
+		const secret = kind === "read" ? generateReadToken() : generatePersonalToken();
+		const row = {
+			id: newId("tok"),
+			kind,
+			siteId: person.site,
+			userId: person.userId,
+			label,
+			hash: await hashPersonalToken(secret),
+			scopes: JSON.stringify(scopes),
+			expiresAt: new Date(now.getTime() + days * 864e5).toISOString(),
+			revokedAt: null,
+			lastUsedAt: null,
+			createdAt: now.toISOString(),
+			updatedAt: now.toISOString()
+		};
+		await connect(c.env.DB).insert(tokens).values(row);
+		return json$1({
+			id: row.id,
+			kind,
+			label,
+			scopes,
+			expiresAt: row.expiresAt,
+			secret
+		}, 201);
+	}));
+	app.post("/v1/admin/tokens/:id/revoke", admin(async (c, person) => {
+		const now = options.clock.now().toISOString();
+		const db = connect(c.env.DB);
+		const id = c.req.param("id") ?? "";
+		const [revoked] = await db.update(tokens).set({
+			revokedAt: now,
+			updatedAt: now
+		}).where(and(eq(tokens.siteId, person.site), eq(tokens.id, id), isNull(tokens.revokedAt))).returning({ id: tokens.id });
+		if (revoked !== void 0) return json$1({
+			id: revoked.id,
+			revokedAt: now
+		});
+		const [row] = await db.select({
+			id: tokens.id,
+			revokedAt: tokens.revokedAt
+		}).from(tokens).where(and(eq(tokens.siteId, person.site), eq(tokens.id, id)));
+		return row === void 0 ? refused("There is no such token.", "List the tokens and pick one of them.", 404) : json$1({
+			id: row.id,
+			revokedAt: row.revokedAt
+		});
+	}));
+	app.get("/v1/admin/people", admin(async (c, person) => {
+		const db = connect(c.env.DB);
+		const now = options.clock.now().toISOString();
+		return json$1({
+			people: await db.select({
+				id: users.id,
+				name: users.name,
+				role: members.role,
+				since: members.createdAt
+			}).from(members).innerJoin(users, eq(users.id, members.userId)).where(eq(members.siteId, person.site)).orderBy(members.createdAt, users.id),
+			invitations: await db.select({
+				id: invitations.id,
+				role: invitations.role,
+				expiresAt: invitations.expiresAt
+			}).from(invitations).where(and(eq(invitations.siteId, person.site), isNull(invitations.usedAt), isNull(invitations.userId), gt(invitations.expiresAt, now))).orderBy(desc(invitations.createdAt))
+		});
+	}));
+	app.post("/v1/admin/invitations", admin(async (c, person) => {
+		const input = await body(c);
+		const role = input["role"];
+		if (typeof role !== "string" || !isRole(role) || role === "owner") return refused("An invitation is for an editor or an author.", `Use role "editor" (${ROLE_SCOPES.editor.join(", ")}) or "author" (${ROLE_SCOPES.author.join(", ")}).`);
+		const days = daysFrom(input["days"], INVITATION_DAYS);
+		if (days === null) return refused("days is a whole number from 1 to 365.", "Leave it out for 7 days.");
+		const made = await createInvitation(connect(c.env.DB), {
+			site: person.site,
+			role,
+			userId: null,
+			now: options.clock.now(),
+			days
+		});
+		const origin = options.oauth(c.env.HOLLWARE_PUBLIC_URL).issuer;
+		return json$1({
+			id: made.id,
+			role,
+			expiresAt: made.expiresAt,
+			link: `${origin}/setup?invitation=${made.secret}`
+		}, 201);
+	}));
+}
+//#endregion
+//#region src/http/ops-api.ts
+const STATUS$1 = {
+	invalid_input: 400,
+	unknown_collection: 404,
+	unknown_locale: 404,
+	timeout: 504
+};
+function json(body, status = 200) {
+	return Response.json(body, {
+		status,
+		headers: { "cache-control": "no-store" }
+	});
+}
+/** Calls the handler of an operation with input its spec has parsed. */
+function invoke$1(handlers, spec, input, context) {
+	const handler = handlers[spec.name];
+	return handler(input, context);
+}
+function installOpsApi(app, options) {
+	app.post("/v1/ops/:name", async (c) => options.protect(c, async (principal) => {
+		const requestId = c.get("requestId");
+		const spec = OPERATIONS.find((operation) => operation.name === c.req.param("name"));
+		if (spec === void 0) return json({
+			code: "invalid_input",
+			message: `There is no operation ${c.req.param("name")}.`,
+			fix: "Use the name of an operation, as tools/list of MCP lists them."
+		}, 404);
+		const scopes = spec.scopes;
+		if (missingScopes(principal, scopes).length > 0) return insufficientScope(scopes, options.metadataUrl(c));
+		const body = await c.req.json().catch(() => void 0);
+		const parsed = spec.input.safeParse(body ?? {});
+		if (!parsed.success) {
+			const issues = parsed.error.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`);
+			return json({
+				code: "invalid_input",
+				message: `The input of ${spec.name} is not valid: ${issues.join("; ")}`,
+				fix: "Send the input of the operation as its input schema describes it."
+			}, 400);
+		}
+		const site = options.sites.get(principal.site);
+		if (site === void 0) throw new Error(`No site ${principal.site} for a checked token`);
+		const context = {
+			site,
+			principal,
+			view: "head",
+			store: createD1Store(c.env.DB, { clock: options.clock }),
+			clock: options.clock,
+			client: { name: "hollware-admin" },
+			requestId,
+			notify: options.notify(c, requestId, site.key)
+		};
+		try {
+			return json(spec.output.parse(await invoke$1(options.handlers, spec, parsed.data, context)));
+		} catch (error) {
+			if (error instanceof HollwareError) return json({
+				code: error.code,
+				message: error.message,
+				fix: error.fix
+			}, STATUS$1[error.code] ?? 500);
+			options.log({
+				kind: "request_error",
+				requestId,
+				method: "POST",
+				path: c.req.path,
+				detail: describeError(error)
+			});
+			return json({
+				code: "internal",
+				message: "The operation failed on the server.",
+				fix: `Try again. If it keeps failing, give the site operator this request id: ${requestId}.`
+			}, 500);
+		}
+	}));
+}
+//#endregion
 //#region src/http/read-api.ts
+/** How long a browser keeps the answer of a preflight, in seconds. */
+const PREFLIGHT_MAX_AGE = 600;
+/** The origin of a request from a page of another origin than Hollware's own, or `null`. */
+function crossOriginOf(c) {
+	const origin = c.req.header("origin");
+	if (origin === void 0) return null;
+	return origin.toLowerCase() === new URL(c.env.HOLLWARE_PUBLIC_URL).origin ? null : origin;
+}
 const STATUS = {
 	invalid_input: 400,
 	unknown_collection: 404,
@@ -2019,67 +2159,83 @@ async function answer(c, value) {
 }
 function installReadApi(app, options) {
 	app.use("/v1/*", async (c, next) => {
+		if (c.req.path.startsWith("/v1/ops/") || c.req.path.startsWith("/v1/admin/")) return next();
+		const crossOrigin = crossOriginOf(c);
+		if (c.req.method === "OPTIONS") {
+			const headers = new Headers({
+				allow: "GET, HEAD, OPTIONS",
+				vary: "Origin"
+			});
+			if (crossOrigin !== null && options.anyCorsOrigin(crossOrigin)) {
+				headers.set("access-control-allow-origin", crossOrigin);
+				headers.set("access-control-allow-methods", "GET, HEAD");
+				headers.set("access-control-allow-headers", "authorization, if-none-match");
+				headers.set("access-control-max-age", String(PREFLIGHT_MAX_AGE));
+			}
+			return new Response(null, {
+				status: 204,
+				headers
+			});
+		}
 		if (c.req.method !== "GET" && c.req.method !== "HEAD") return c.json({
 			code: "invalid_input",
 			message: "The read API only reads.",
 			fix: "Use GET."
 		}, 405, { allow: "GET, HEAD" });
 		if (c.req.path === "/v1/openapi.json") return next();
-		const requestId = c.get("requestId");
-		const token = readBearerToken(c.req.raw);
-		if (token === null) {
-			options.log({
-				kind: "auth_refused",
-				requestId,
-				reason: "no_token"
+		c.res = await options.protect(c, async (principal) => {
+			if (!principal.scopes.includes("content:read")) return insufficientScope(["content:read"], options.metadataUrl(c));
+			c.set("site", principal.site);
+			if (crossOrigin !== null && !options.corsOrigins(principal.site).includes(crossOrigin)) return c.json({
+				code: "forbidden_origin",
+				message: `The site "${principal.site}" does not let pages of ${crossOrigin} read it.`,
+				fix: `Add "${crossOrigin}" to cors.origins of the site in hollware.config.ts, or read from a server.`
+			}, 403, {
+				vary: "Origin",
+				"access-control-allow-origin": new URL(c.env.HOLLWARE_PUBLIC_URL).origin
 			});
-			return unauthorized();
-		}
-		const check = await checkPersonalToken(c.env.DB, token, {
-			site: options.site,
-			now: options.clock.now()
+			const answered = await (async () => {
+				try {
+					await next();
+					return c.res;
+				} catch (error) {
+					if (!(error instanceof HollwareError)) throw error;
+					return c.json({
+						code: error.code,
+						message: error.message,
+						fix: error.fix
+					}, STATUS[error.code] ?? 500);
+				}
+			})();
+			if (crossOrigin === null) return answered;
+			const shared = new Response(answered.body, answered);
+			shared.headers.set("access-control-allow-origin", crossOrigin);
+			shared.headers.set("access-control-expose-headers", "etag");
+			shared.headers.append("vary", "Origin");
+			return shared;
 		});
-		if (!check.ok) {
-			options.log({
-				kind: "auth_refused",
-				requestId,
-				reason: check.reason
-			});
-			return unauthorized(check.reason);
-		}
-		if (!check.principal.scopes.includes("content:read")) return insufficientScope(["content:read"]);
-		if (check.touch !== null) c.executionCtx.waitUntil(check.touch);
-		try {
-			return await next();
-		} catch (error) {
-			if (!(error instanceof HollwareError)) throw error;
-			return c.json({
-				code: error.code,
-				message: error.message,
-				fix: error.fix
-			}, STATUS[error.code] ?? 500);
-		}
+		return c.res;
 	});
-	app.get("/v1/openapi.json", (c) => c.json(openApiDocument(options.site)));
-	app.get("/v1/site", async (c) => answer(c, await options.read(c.env).describeSite(options.site)));
+	app.get("/v1/openapi.json", (c) => c.json(openApiDocument()));
+	app.get("/v1/site", async (c) => answer(c, await options.read(c.env).describeSite(c.get("site"))));
 	app.get("/v1/:collection", async (c) => {
 		const query = c.req.query();
 		const limit = query["limit"] === void 0 ? void 0 : Number(query["limit"]);
-		return answer(c, await options.read(c.env).listEntries(options.site, c.req.param("collection"), {
+		return answer(c, await options.read(c.env).listEntries(c.get("site"), c.req.param("collection"), {
 			...query["locale"] === void 0 ? {} : { locale: query["locale"] },
 			...query["tag"] === void 0 ? {} : { tag: query["tag"] },
 			...limit === void 0 ? {} : { limit },
 			...query["cursor"] === void 0 ? {} : { cursor: query["cursor"] }
 		}));
 	});
-	app.get("/v1/:collection/translations/:group", async (c) => answer(c, await options.read(c.env).getTranslations(options.site, c.req.param("collection"), c.req.param("group"))));
+	app.get("/v1/:collection/translations/:group", async (c) => answer(c, await options.read(c.env).getTranslations(c.get("site"), c.req.param("collection"), c.req.param("group"))));
 	app.get("/v1/:collection/:locale/:slug", async (c) => {
 		const formats = c.req.query("formats");
-		return answer(c, await options.read(c.env).getEntry(options.site, c.req.param("collection"), c.req.param("slug"), c.req.param("locale"), formats === void 0 ? {} : { formats: formats.split(",").flatMap((format) => format === "markdown" || format === "document" || format === "html" ? [format] : []) }));
+		return answer(c, await options.read(c.env).getEntry(c.get("site"), c.req.param("collection"), c.req.param("slug"), c.req.param("locale"), formats === void 0 ? {} : { formats: formats.split(",").flatMap((format) => format === "markdown" || format === "document" || format === "html" ? [format] : []) }));
 	});
 }
 /** The OpenAPI 3.1 document of the read API. */
-function openApiDocument(site) {
+function openApiDocument() {
 	const ok = (description) => ({
 		description,
 		headers: { ETag: { schema: { type: "string" } } },
@@ -2087,7 +2243,7 @@ function openApiDocument(site) {
 	});
 	const common = {
 		"304": { description: "Not modified: the ETag of If-None-Match is current." },
-		"401": { description: "No token, or one that is unknown, expired or revoked." },
+		"401": { description: "No token, or one that is unknown, expired or revoked. The challenge names the protected resource metadata." },
 		"403": { description: "The token lacks content:read." }
 	};
 	const param = (name, location, required) => ({
@@ -2099,7 +2255,7 @@ function openApiDocument(site) {
 	return {
 		openapi: "3.1.0",
 		info: {
-			title: `Hollware read API (${site})`,
+			title: "Hollware read API",
 			version: "1"
 		},
 		components: { securitySchemes: { token: {
@@ -2156,8 +2312,599 @@ function openApiDocument(site) {
 	};
 }
 //#endregion
+//#region src/identity/pages.ts
+/**
+* The pages a person sees to get in (ADR-026): set up a passkey from a link, and sign in. They
+* are rendered by the Worker, outside the admin's bundle, with one inline script under a nonce
+* and nothing framing them. The script uses the WebAuthn JSON methods of the browser
+* (`PublicKeyCredential.parseCreationOptionsFromJSON`, `credential.toJSON()`), and reads the
+* invitation from the address bar, so the page never prints it.
+*/
+/**
+* The look of hollware.com and the admin, with nothing to fetch: the page's policy loads no font,
+* so the type is the system's. Ink greys and the mint accent, dark when the device is.
+*/
+const STYLE = `:root{color-scheme:light dark;--bg:#f6f7f8;--card:#fff;--fg:#15181b;--muted:#545c66;--line:#d6dadf;--accent:#0c825d;--on-accent:#fff;--danger:#b42318}
+@media (prefers-color-scheme:dark){:root{--bg:#08090a;--card:#0f1113;--fg:#eceef0;--muted:#8a939e;--line:rgb(255 255 255/.1);--accent:#3ee6a8;--on-accent:#04140d;--danger:#ff8a80}}
+*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:2rem 1rem;background:var(--bg);color:var(--fg);font:15px/1.6 system-ui,-apple-system,'Segoe UI',sans-serif;-webkit-font-smoothing:antialiased}
+main{width:100%;max-width:26rem;background:var(--card);border:1px solid var(--line);border-radius:14px;padding:2rem}
+.brand{display:flex;align-items:center;gap:.6rem;margin-bottom:1.75rem;font-weight:600;letter-spacing:-.01em}.brand svg{width:26px;height:26px}
+h1{font-size:1.4rem;line-height:1.25;letter-spacing:-.02em;margin:0 0 .5rem}p{color:var(--muted);margin:.5rem 0}strong{color:var(--fg)}
+label{display:block;margin:1rem 0 .35rem;font-size:.9rem;font-weight:500}fieldset label,form>label:has(input[type=checkbox]){font-weight:400;display:flex;align-items:center;gap:.5rem;margin:.5rem 0}
+input{width:100%;padding:.6rem .75rem;font:inherit;color:inherit;background:transparent;border:1px solid var(--line);border-radius:8px}input:focus{outline:2px solid var(--accent);outline-offset:1px}
+label input{width:auto;margin:0}fieldset{border:1px solid var(--line);border-radius:8px;margin:1rem 0;padding:.5rem .9rem}legend{color:var(--muted);font-size:.85rem;padding:0 .3rem}
+code{font:.82em ui-monospace,'SF Mono',Menlo,monospace;color:var(--muted)}
+button{margin-top:1.25rem;padding:.6rem 1rem;font:inherit;font-weight:500;cursor:pointer;border-radius:8px;border:1px solid var(--line);background:transparent;color:var(--fg)}
+button:not([value=deny]){background:var(--accent);border-color:var(--accent);color:var(--on-accent)}
+[role=alert]{color:var(--danger)}`;
+/** The mark of Hollware, before the title of every page. */
+const BRAND = `<div class="brand"><svg viewBox="0 0 32 32" aria-hidden="true"><rect width="32" height="32" rx="8" fill="currentColor" opacity=".08"/><path d="M9 8v16M23 8v16M9 16h14" stroke="var(--accent)" stroke-width="3" stroke-linecap="round" fill="none"/></svg>Hollware</div>`;
+const POST = `async function post(path, body) {
+  const response = await fetch(path, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) })
+  const data = await response.json()
+  if (!response.ok) throw new Error(data.message + ' ' + (data.fix ?? ''))
+  return data
+}
+function fail(error) { document.getElementById('error').textContent = error.message }`;
+function page(title, nonce, body, script) {
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title} · Hollware</title>
+<style>${STYLE}</style>
+</head>
+<body>
+<main>
+${BRAND}
+<h1>${title}</h1>
+${body}
+<p id="error" role="alert"></p>
+</main>
+<script nonce="${nonce}">${POST}
+${script}<\/script>
+</body>
+</html>
+`;
+}
+function setupPage(nonce) {
+	return page("Set up your passkey", nonce, `<p>A passkey lets you into this Hollware with your device's lock: no password.</p>
+<form id="form">
+<label for="name">Your name</label><input id="name" name="name" autocomplete="name">
+<label for="label">This device</label><input id="label" name="label" value="Passkey">
+<button type="submit">Create the passkey</button>
+</form>`, `document.getElementById('form').addEventListener('submit', async (event) => {
+  event.preventDefault()
+  try {
+    const invitation = new URLSearchParams(location.search).get('invitation') ?? ''
+    const { challengeId, options } = await post('/auth/register/options', { invitation })
+    const credential = await navigator.credentials.create({ publicKey: PublicKeyCredential.parseCreationOptionsFromJSON(options) })
+    await post('/auth/register/verify', { challengeId, response: credential.toJSON(), name: document.getElementById('name').value, label: document.getElementById('label').value })
+    location.href = '/admin/'
+  } catch (error) { fail(error) }
+})`);
+}
+function signInPage(nonce) {
+	return page("Sign in", nonce, `<p>Sign in to this Hollware with your passkey.</p>
+<button id="signin" type="button">Sign in with a passkey</button>`, `document.getElementById('signin').addEventListener('click', async () => {
+  try {
+    const { challengeId, options } = await post('/auth/signin/options', {})
+    const credential = await navigator.credentials.get({ publicKey: PublicKeyCredential.parseRequestOptionsFromJSON(options) })
+    await post('/auth/signin/verify', { challengeId, response: credential.toJSON() })
+    const target = new URLSearchParams(location.search).get('return_to') ?? '/admin/'
+    location.href = target.startsWith('/') && !target.startsWith('//') ? target : '/admin/'
+  } catch (error) { fail(error) }
+})`);
+}
+/** The headers of a page: no framing, only its own script, and no caching. */
+function pageHeaders(nonce) {
+	return {
+		"content-type": "text/html; charset=utf-8",
+		"cache-control": "no-store",
+		"content-security-policy": `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'unsafe-inline'; connect-src 'self'; form-action 'none'; base-uri 'none'; frame-ancestors 'none'`,
+		"x-content-type-options": "nosniff",
+		"referrer-policy": "no-referrer"
+	};
+}
+/** Text for HTML: every string a client chose (its name, its redirect host, a scope) goes through it. */
+function escapeHtml(value) {
+	return value.replace(/[&<>"']/g, (char) => `&#${char.charCodeAt(0)};`);
+}
+/** What a scope lets a client do, in the words of the consent page. */
+const SCOPE_WORDS = {
+	"content:read": "Read the content, drafts included",
+	"content:write": "Write drafts",
+	"content:publish": "Publish and unpublish",
+	"schema:admin": "Change the site settings"
+};
+/**
+* The consent page of `/authorize` (ADR-026): which client asks, where the tokens go, and what it
+* may do, with Allow and Deny. It has no script, and it posts the handle that `beginConsent` bound
+* to this browser. Everything the client chose is escaped.
+*/
+function consentPage(view) {
+	const name = escapeHtml(view.clientName);
+	const origin = view.clientDomain === void 0 ? "<p>This app registered itself: its name is not verified.</p>" : `<p>Published by <strong>${escapeHtml(view.clientDomain)}</strong>.</p>`;
+	const loopback = view.redirectIsLoopback ? "<p><strong>This sends access to an app on this computer.</strong> Continue only if you just started to connect it.</p>" : "";
+	const sites = view.sites.length === 1 ? `<input type="hidden" name="site" value="${escapeHtml(view.sites[0] ?? "")}">` : `<fieldset><legend>For the site</legend>${view.sites.map((site, index) => `<label><input type="radio" name="site" value="${escapeHtml(site)}"${index === 0 ? " checked" : ""}> ${escapeHtml(site)}</label>`).join("\n")}</fieldset>`;
+	const scopes = view.scopes.map((scope) => `<label><input type="checkbox" name="scope" value="${escapeHtml(scope)}" checked> ${escapeHtml(SCOPE_WORDS[scope] ?? scope)} <code>${escapeHtml(scope)}</code></label>`).join("\n");
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Allow ${name} · Hollware</title>
+<style>${STYLE}</style>
+</head>
+<body>
+<main>
+${BRAND}
+<h1>Allow ${name} to use this Hollware?</h1>
+${origin}
+<p>Signed in as <strong>${escapeHtml(view.person)}</strong>. Access goes to <strong>${escapeHtml(view.redirectHost)}</strong>.</p>
+${loopback}
+<form method="post" action="/authorize">
+<input type="hidden" name="handle" value="${escapeHtml(view.handle)}">
+${sites}
+${scopes}
+<p><button name="decision" value="approve">Allow</button> <button name="decision" value="deny">Deny</button></p>
+</form>
+</main>
+</body>
+</html>
+`;
+}
+/** A page that only says what went wrong and what to do. */
+function messagePage(title, message) {
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)} · Hollware</title>
+<style>${STYLE}</style>
+</head>
+<body>
+<main>
+${BRAND}
+<h1>${escapeHtml(title)}</h1>
+<p>${escapeHtml(message)}</p>
+</main>
+</body>
+</html>
+`;
+}
+/**
+* The headers of a page without a script: no framing and no caching. The form of the consent page
+* posts to `/authorize`, which redirects to the client, so `form-action` is not restricted: a
+* browser applies it to the redirect too.
+*/
+function plainPageHeaders() {
+	return {
+		"content-type": "text/html; charset=utf-8",
+		"cache-control": "no-store",
+		"content-security-policy": `default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'`,
+		"x-content-type-options": "nosniff",
+		"referrer-policy": "no-referrer"
+	};
+}
+//#endregion
+//#region src/identity/routes.ts
+/**
+* The ceremonies, with SimpleWebAuthn and its parsers, in a chunk of their own: only these four
+* routes use them, and a Worker that serves MCP never pays for them at startup (`budgets.json`).
+*/
+const ceremonies = () => import("./ceremonies-V_1BbmZQ.mjs");
+/** The cookie of a signed-in person: only `/authorize` reads it (ADR-026). */
+const SESSION_COOKIE = "hollware_session";
+function sessionCookie(secret) {
+	return `${SESSION_COOKIE}=${secret}; HttpOnly; Secure; SameSite=Lax; Path=/authorize; Max-Age=43200`;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The setup and sign-in pages, and the four steps of the passkey ceremonies. */
+function installIdentity(app, options) {
+	const ceremony = (c) => ({
+		db: connect(c.env.DB),
+		publicUrl: c.env.HOLLWARE_PUBLIC_URL,
+		now: options.clock.now()
+	});
+	const body = async (c) => {
+		const value = await c.req.json().catch(() => null);
+		if (!isRecord$1(value)) throw new HollwareError("invalid_input", "The body is not a JSON object.", "Send a JSON object.");
+		return value;
+	};
+	const text = (value) => typeof value === "string" ? value : "";
+	const handle = (step) => async (c) => {
+		try {
+			return await step(c);
+		} catch (error) {
+			if (!(error instanceof HollwareError)) throw error;
+			return c.json({
+				code: error.code,
+				message: error.message,
+				fix: error.fix
+			}, 400);
+		}
+	};
+	const html = (render) => () => {
+		const nonce = crypto.randomUUID().replace(/-/g, "");
+		return new Response(render(nonce), { headers: pageHeaders(nonce) });
+	};
+	app.get("/setup", html(setupPage));
+	app.get("/signin", html(signInPage));
+	app.post("/auth/register/options", handle(async (c) => c.json(await (await ceremonies()).registrationOptions(ceremony(c), text((await body(c))["invitation"])))));
+	app.post("/auth/register/verify", handle(async (c) => {
+		const input = await body(c);
+		const response = input["response"];
+		if (!isRecord$1(response)) throw new HollwareError("invalid_input", "The body has no passkey.", "Send the credential as JSON.");
+		const answer = await (await ceremonies()).verifyRegistration(ceremony(c), {
+			challengeId: text(input["challengeId"]),
+			response: JSON.parse(JSON.stringify(response)),
+			name: text(input["name"]),
+			label: text(input["label"])
+		});
+		return c.json({ ok: true }, 200, { "set-cookie": sessionCookie(answer.session) });
+	}));
+	app.post("/auth/signin/options", handle(async (c) => c.json(await (await ceremonies()).authenticationOptions(ceremony(c)))));
+	app.post("/auth/signin/verify", handle(async (c) => {
+		const input = await body(c);
+		const response = input["response"];
+		if (!isRecord$1(response)) throw new HollwareError("invalid_input", "The body has no passkey.", "Send the credential as JSON.");
+		const answer = await (await ceremonies()).verifyAuthentication(ceremony(c), {
+			challengeId: text(input["challengeId"]),
+			response: JSON.parse(JSON.stringify(response))
+		});
+		return c.json({ ok: true }, 200, { "set-cookie": sessionCookie(answer.session) });
+	}));
+}
+//#endregion
+//#region src/oauth/authorize.ts
+/** What a client gets when it asks for no scope: the baseline that `/mcp` and `/v1` name. */
+const BASELINE = ["content:read"];
+/**
+* The scopes a person may grant: those asked for that the person's role allows, in the order of
+* the role. Anything that is not a scope of Hollware is left out.
+*/
+function grantableScopes(role, asked) {
+	if (!isRole(role)) return [];
+	const scopes = asked.filter(isScope);
+	return ROLE_SCOPES[role].filter((scope) => scopes.includes(scope));
+}
+function html(body, status = 200, extra) {
+	const headers = new Headers(plainPageHeaders());
+	extra?.forEach((value, name) => {
+		if (name.toLowerCase() === "set-cookie") headers.append(name, value);
+	});
+	return new Response(body, {
+		status,
+		headers
+	});
+}
+/**
+* An error of the authorization endpoint, as the consent page guide says: a redirect back to the
+* client only when the library validated the client and its exact redirect URI, and a page of our
+* own otherwise. Anything else is a bug or an outage, and goes on to the error handler.
+*/
+function answerError(error) {
+	if (error instanceof AuthorizationError && error.redirectTo !== void 0) return new Response(null, {
+		status: 302,
+		headers: { location: error.redirectTo }
+	});
+	if (error instanceof AuthorizationError) return html(messagePage("This request cannot go on", error.description), 400);
+	if (error instanceof CimdFetchError) return html(messagePage("This app could not be verified", "Its metadata document could not be fetched or is not valid. Try again later, or ask its developer."), 400);
+	throw error;
+}
+/**
+* The authorization endpoint of the OAuth server (ADR-026), which is Hollware's page and not the
+* library's: the library parses and validates the request, and this page signs the person in,
+* shows what the client asks for, and completes the authorization with what the person allowed.
+*
+* - A person without a session is sent to `/signin`, which comes back here once they are in. The
+*   session cookie is only sent to `/authorize`.
+* - The admin, Hollware's own client (`admin.ts`), gets what it asks for within the role, with no
+*   consent page.
+* - The page offers the scopes the client asked for that the person's role allows, each checked;
+*   the person may untick any. A request that would get no scope at all is refused with
+*   `access_denied`.
+* - The grant stores the person and the site. What its tokens may do is read again on each request
+*   against the person's role then (`server.ts`).
+* - The site is the one `?site=` names, if the person is a member of it; else the only site the
+*   person is a member of; else the consent page asks which (v0.4). The admin names its site, and
+*   takes the first one when it names none.
+*/
+function installAuthorize(app, options) {
+	const person = async (c) => {
+		const secret = getCookie(c, SESSION_COOKIE);
+		if (secret === void 0) return null;
+		const db = connect(c.env.DB);
+		const found = await findSession(db, secret, options.clock.now());
+		if (found === null) return null;
+		const memberships = (await membershipsOf(db, found.userId)).filter((membership) => options.sites.has(membership.site));
+		return {
+			...found,
+			memberships
+		};
+	};
+	const signIn = (c) => {
+		const url = new URL(c.req.url);
+		const back = `${url.pathname}${url.search}`;
+		return c.redirect(`/signin?return_to=${encodeURIComponent(back)}`, 302);
+	};
+	const notMember = (site) => html(messagePage("Not a member", site === void 0 ? "You are not a member of any site of this Hollware. Ask an owner for an invitation." : `You are not a member of the site "${site}". Ask its owner for an invitation.`), 403);
+	app.get("/authorize", async (c) => {
+		const server = options.oauth(c.env.HOLLWARE_PUBLIC_URL);
+		const oauth = server.authorizationServer.getOAuthApi(c.env);
+		try {
+			const request = await oauth.parseAuthRequest(c.req.raw);
+			const signedIn = await person(c);
+			if (signedIn === null) return signIn(c);
+			const [first] = signedIn.memberships;
+			if (first === void 0) return notMember(void 0);
+			const asked = c.req.query("site");
+			const named = asked === void 0 ? void 0 : signedIn.memberships.find((m) => m.site === asked);
+			if (asked !== void 0 && named === void 0) return notMember(asked);
+			if (request.clientId === (await adminClient(server, c.env)).clientId) {
+				const membership = named ?? first;
+				const props = {
+					userId: signedIn.userId,
+					site: membership.site
+				};
+				const { redirectTo } = await oauth.completeAuthorization({
+					request,
+					userId: signedIn.userId,
+					metadata: { site: membership.site },
+					scope: grantableScopes(membership.role, request.scope),
+					props
+				});
+				return new Response(null, {
+					status: 302,
+					headers: { location: redirectTo }
+				});
+			}
+			const choices = named !== void 0 ? [named] : signedIn.memberships;
+			const asking = request.scope.length === 0 ? BASELINE : request.scope;
+			const scopes = [...new Set(choices.flatMap((m) => grantableScopes(m.role, asking)))];
+			if (scopes.length === 0) {
+				const location = authorizationErrorRedirect(request, "access_denied", "Your role allows none of the scopes this client asked for.");
+				return new Response(null, {
+					status: 302,
+					headers: { location }
+				});
+			}
+			const details = await oauth.describeConsent(request);
+			const consent = await oauth.beginConsent(request);
+			return html(consentPage({
+				clientName: details.clientName,
+				clientDomain: details.clientDomain,
+				redirectHost: details.redirectHost,
+				redirectIsLoopback: details.redirectIsLoopback,
+				person: signedIn.name ?? "you",
+				scopes,
+				sites: choices.map((m) => m.site),
+				handle: consent.handle
+			}), 200, consent.headers);
+		} catch (error) {
+			return answerError(error);
+		}
+	});
+	app.post("/authorize", async (c) => {
+		const oauth = options.oauth(c.env.HOLLWARE_PUBLIC_URL).authorizationServer.getOAuthApi(c.env);
+		try {
+			const signedIn = await person(c);
+			if (signedIn === null) return html(messagePage("Your session ended", "Sign in again, then start from the app."), 401);
+			const form = await c.req.formData();
+			const value = form.get("handle");
+			const handle = typeof value === "string" ? value : "";
+			if (form.get("decision") !== "approve") {
+				const denied = await oauth.denyConsent(c.req.raw, handle);
+				return new Response(null, {
+					status: 302,
+					headers: denied.headers
+				});
+			}
+			const chosen = form.get("site");
+			const membership = signedIn.memberships.find((m) => m.site === chosen);
+			if (membership === void 0) return notMember(typeof chosen === "string" ? chosen : void 0);
+			const scope = grantableScopes(membership.role, form.getAll("scope").map(String));
+			const approved = await oauth.approveConsent(c.req.raw, handle, { scope });
+			if (scope.length === 0) {
+				const location = authorizationErrorRedirect(approved.request, "access_denied", "No scope was allowed.");
+				approved.headers.set("location", location);
+				return new Response(null, {
+					status: 302,
+					headers: approved.headers
+				});
+			}
+			const props = {
+				userId: signedIn.userId,
+				site: membership.site
+			};
+			const { redirectTo } = await oauth.completeAuthorization({
+				request: approved.request,
+				userId: signedIn.userId,
+				metadata: { site: membership.site },
+				scope,
+				props
+			});
+			approved.headers.set("location", redirectTo);
+			return new Response(null, {
+				status: 302,
+				headers: approved.headers
+			});
+		} catch (error) {
+			return answerError(error);
+		}
+	});
+}
+//#endregion
+//#region src/oauth/server.ts
+/** Access tokens live an hour, and a grant thirty days from its code, refreshed or not (ADR-026). */
+const ACCESS_TOKEN_TTL_SECONDS = 3600;
+const REFRESH_TOKEN_TTL_SECONDS = 2592e3;
+/** The role of a member of the site, read on every request: a change of role takes effect at once. */
+async function roleOf(db, site, userId) {
+	return (await db.prepare("SELECT role FROM members WHERE site_id = ?1 AND user_id = ?2").bind(site, userId).first())?.role ?? null;
+}
+function isGrantProps(value) {
+	return typeof value === "object" && value !== null && typeof Reflect.get(value, "userId") === "string" && typeof Reflect.get(value, "site") === "string";
+}
+/**
+* Builds the OAuth server of a deployment (ADR-026), once for each public URL it is asked about:
+* the issuer and the resources are that URL's, and the Worker learns it from its environment, on
+* the first request. One Worker holds both roles: an `OAuthAuthorizationServer`, whose
+* `/authorize` is Hollware's own page (`authorize.ts`), and an `OAuthResourceServer` for `/mcp`
+* and for `/v1`.
+*
+* A resource accepts two kinds of token, told apart by their shape. A personal token
+* (`hw_pat_…`) is looked up in D1 as before, and never reaches the OAuth server; any other token
+* is the OAuth server's to validate, for that resource alone. Either way the principal's scopes
+* are what the token carries intersected with what the user's role allows now.
+*/
+function createOAuth(options) {
+	const built = /* @__PURE__ */ new Map();
+	return (publicUrl) => {
+		const issuer = new URL(publicUrl).origin;
+		const existing = built.get(issuer);
+		if (existing !== void 0) return existing;
+		const oauth = build(issuer, options);
+		built.set(issuer, oauth);
+		return oauth;
+	};
+}
+function build(issuer, options) {
+	const resources = {
+		mcp: `${issuer}/mcp`,
+		v1: `${issuer}/v1`
+	};
+	const metadataUrls = {
+		mcp: `${issuer}/.well-known/oauth-protected-resource/mcp`,
+		v1: `${issuer}/.well-known/oauth-protected-resource/v1`
+	};
+	const authorizationServer = new OAuthAuthorizationServer({
+		issuer,
+		resources: [resources.mcp, resources.v1],
+		scopesSupported: [...SCOPES],
+		accessTokenTTL: ACCESS_TOKEN_TTL_SECONDS,
+		refreshTokenTTL: REFRESH_TOKEN_TTL_SECONDS,
+		clientIdMetadataDocumentEnabled: true,
+		...options.dynamicClientRegistration ? { clientRegistrationEndpoint: "/oauth/register" } : {},
+		onError: ({ code, internal }) => {
+			options.log({
+				kind: "oauth_error",
+				code,
+				reason: internal?.reason ?? null
+			});
+		}
+	});
+	/** The protected routes in flight, by their request: the resource server hands it on as it is. */
+	const pending = /* @__PURE__ */ new WeakMap();
+	const validate = (env, request) => async (resource, token) => {
+		try {
+			return await check(env, request, resource, token);
+		} catch (error) {
+			pending.get(request)?.failed(error);
+			throw error;
+		}
+	};
+	const check = async (env, request, resource, token) => {
+		const refuse = (reason) => {
+			pending.get(request)?.refused(reason);
+			return null;
+		};
+		if (isPersonalToken(token) || isReadToken(token)) {
+			const check = await checkPersonalToken(env.DB, token, {
+				sites: options.sites,
+				now: options.clock.now()
+			});
+			if (!check.ok) return refuse(check.reason);
+			if (check.touch !== null) {
+				const route = pending.get(request);
+				if (route === void 0) await check.touch;
+				else route.defer(check.touch);
+			}
+			return {
+				props: check.principal,
+				audience: resource,
+				scope: [...check.principal.scopes]
+			};
+		}
+		const granted = await authorizationServer.validateToken(resource, token, env);
+		if (granted === null) return refuse("unknown");
+		if (!isGrantProps(granted.props)) return refuse("unknown");
+		const site = granted.props.site;
+		if (!options.sites.has(site)) return refuse("other_site");
+		const role = await roleOf(env.DB, site, granted.props.userId);
+		if (role === null) return refuse("no_user");
+		const principal = {
+			kind: "oauth",
+			userId: granted.props.userId,
+			clientId: granted.clientId,
+			site,
+			scopes: effectiveScopes(role, granted.scope.filter(isScope))
+		};
+		return {
+			props: principal,
+			audience: granted.audience,
+			expiresAt: granted.expiresAt,
+			scope: [...principal.scopes],
+			userId: principal.userId,
+			clientId: principal.clientId
+		};
+	};
+	const resourceServer = (name) => new OAuthResourceServer({
+		resourceMetadata: {
+			resource: resources[name],
+			authorization_servers: [issuer],
+			resource_name: name === "mcp" ? "Hollware MCP" : "Hollware read API"
+		},
+		requiredScopes: ["content:read"],
+		validateToken: validate,
+		handler: { fetch: async (request, _env, ctx) => {
+			const route = pending.get(request);
+			if (route === void 0) throw new Error("A protected route was reached without the gateway in front of it");
+			return await route.proceed(ctx.props, ctx.auth);
+		} }
+	});
+	const servers = {
+		mcp: resourceServer("mcp"),
+		v1: resourceServer("v1")
+	};
+	return {
+		issuer,
+		authorizationServer,
+		resources,
+		metadataUrls,
+		protect: async (resource, request, env, ctx, route) => {
+			pending.set(request, route);
+			try {
+				return await servers[resource].fetch(request, env, ctx);
+			} finally {
+				pending.delete(request);
+			}
+		}
+	};
+}
+//#endregion
 //#region src/http/gateway.ts
 /**
+* A 401 of a resource server, with Hollware's body: the same JSON as every other refusal, and the
+* challenge of the resource server, which names its metadata (RFC 9728) and the baseline scope.
+*/
+function withRefusalBody(response, refused) {
+	const ours = unauthorized(refused ? "unknown" : void 0);
+	const headers = new Headers(response.headers);
+	headers.set("content-type", "application/json");
+	const challenge = headers.get("www-authenticate");
+	if (challenge !== null) headers.set("www-authenticate", challenge.replace("realm=\"OAuth\"", "realm=\"hollware\""));
+	return new Response(ours.body, {
+		status: 401,
+		headers
+	});
+}
+/**
 * The HTTP gateway of the Worker (ADR-019): a Hono 5 app, built once, that runs in this order for
 * every request:
 *
@@ -2181,76 +2928,173 @@ function openApiDocument(site) {
 * nothing. A failed D1 query while the token is checked is one of those: it is never a 401.
 */
 function createGateway(options) {
-	const { site, mcp, clock, log } = options;
+	const { sites, mcp, clock, log } = options;
+	const siteKeys = new Set(sites.keys());
 	const app = new Hono();
+	/**
+	* The Worker's own context of each request. Hono hands its routes the same object under a
+	* narrower type of its own, and the OAuth library wants the Worker's.
+	*/
+	const contexts = /* @__PURE__ */ new WeakMap();
+	const workerContext = (c) => {
+		const ctx = contexts.get(c.req.raw);
+		if (ctx === void 0) throw new Error("A request reached a route without its context");
+		return ctx;
+	};
+	const oauth = createOAuth({
+		sites: siteKeys,
+		clock,
+		dynamicClientRegistration: options.auth?.dynamicClientRegistration ?? false,
+		log
+	});
+	/**
+	* What a write hands to the Queue: the events it committed, after the answer (ADR-025). The
+	* cron trigger's sweep catches any that this misses.
+	*/
+	const notify = (c, requestId, site) => (ids) => {
+		c.executionCtx.waitUntil(enqueue({
+			queue: c.env.EVENTS,
+			db: connect(c.env.DB),
+			site,
+			ids,
+			clock
+		}).catch((error) => {
+			log({
+				kind: "enqueue_failed",
+				requestId,
+				message: String(error)
+			});
+		}));
+	};
+	/**
+	* A protected route: the resource server of `resource` answers a request without a token and a
+	* token it refuses (401, logged with the reason), and `proceed` gets the principal of the rest.
+	*/
+	const protect = async (c, resource, proceed) => {
+		const requestId = c.get("requestId");
+		/** What the check said besides the answer: why it refused, or what it threw. */
+		const outcome = {
+			refusal: null,
+			failure: null
+		};
+		const response = await oauth(c.env.HOLLWARE_PUBLIC_URL).protect(resource, c.req.raw, c.env, workerContext(c), {
+			proceed,
+			refused: (reason) => {
+				outcome.refusal = reason;
+			},
+			defer: (promise) => {
+				workerContext(c).waitUntil(promise);
+			},
+			failed: (error) => {
+				outcome.failure = { error };
+			}
+		});
+		if (outcome.failure !== null) throw outcome.failure.error;
+		if (response.status !== 401) return response;
+		log({
+			kind: "auth_refused",
+			requestId,
+			reason: outcome.refusal ?? "no_token"
+		});
+		return withRefusalBody(response, outcome.refusal !== null);
+	};
+	/** Every origin that the config of some site lets read the site from a page. */
+	const corsOrigins = new Set([...sites.values()].flatMap((site) => site.cors.origins));
+	/**
+	* The guard lets a page of such an origin through to the read API alone, and only to read: the
+	* read API then checks the origin against the site of the token.
+	*/
+	const readsFromAnyCorsOrigin = (request, origin) => {
+		const { pathname } = new URL(request.url);
+		return corsOrigins.has(origin) && [
+			"GET",
+			"HEAD",
+			"OPTIONS"
+		].includes(request.method) && pathname.startsWith("/v1/") && !pathname.startsWith("/v1/admin/");
+	};
+	/**
+	* A route for a person or their personal token: a read token reads over the read API alone, so
+	* it is refused here, before anything runs (403, as a token that lacks a scope).
+	*/
+	const protectWrites = (c, resource, proceed) => protect(c, resource, async (principal, auth) => principal.kind === "read" ? Response.json({
+		code: "forbidden",
+		message: "A read token reads published content over GET /v1, and nothing else.",
+		fix: "Use a personal token (hw_pat_) or sign in with OAuth for this."
+	}, {
+		status: 403,
+		headers: { "cache-control": "no-store" }
+	}) : proceed(principal, auth));
 	app.use("*", async (c, next) => {
 		c.set("requestId", crypto.randomUUID());
 		await next();
 	});
 	app.use("*", async (c, next) => {
-		const refusal = checkHostAndOrigin(c.req.raw, c.env.HOLLWARE_PUBLIC_URL);
+		const refusal = checkHostAndOrigin(c.req.raw, c.env.HOLLWARE_PUBLIC_URL, readsFromAnyCorsOrigin);
 		if (refusal !== null) return refusal;
 		await next();
 	});
 	app.get("/health", () => Response.json({ ok: true }, { headers: { "cache-control": "no-store" } }));
-	app.all("/mcp", async (c) => {
+	app.all("/mcp", async (c) => protectWrites(c, "mcp", async (principal) => {
 		const requestId = c.get("requestId");
-		const token = readBearerToken(c.req.raw);
-		if (token === null) {
-			log({
-				kind: "auth_refused",
-				requestId,
-				reason: "no_token"
-			});
-			return unauthorized();
-		}
-		const check = await checkPersonalToken(c.env.DB, token, {
-			site: site.key,
-			now: clock.now()
-		});
-		if (!check.ok) {
-			log({
-				kind: "auth_refused",
-				requestId,
-				reason: check.reason
-			});
-			return unauthorized(check.reason);
-		}
-		if (check.touch !== null) c.executionCtx.waitUntil(check.touch);
 		const db = c.env.DB;
+		const site = sites.get(principal.site);
+		if (site === void 0) throw new Error(`No site ${principal.site} for a checked token`);
 		return await mcp.fetch(c.req.raw, {
-			principal: check.principal,
+			principal,
 			requestId,
+			resourceMetadataUrl: oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.mcp,
 			context: {
 				site,
 				store: createD1Store(db, { clock }),
 				clock,
-				notify: (ids) => {
-					c.executionCtx.waitUntil(enqueue({
-						queue: c.env.EVENTS,
-						db: connect(db),
-						site: site.key,
-						ids,
-						clock
-					}).catch((error) => {
-						log({
-							kind: "enqueue_failed",
-							requestId,
-							message: String(error)
-						});
-					}));
-				}
+				notify: notify(c, requestId, site.key)
 			}
 		});
+	}));
+	for (const resource of ["mcp", "v1"]) app.all(`/.well-known/oauth-protected-resource/${resource}`, async (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).protect(resource, c.req.raw, c.env, workerContext(c), {
+		proceed: () => Promise.resolve(new Response(null, { status: 404 })),
+		refused: () => void 0,
+		defer: () => void 0,
+		failed: () => void 0
+	}));
+	installAuthorize(app, {
+		sites: siteKeys,
+		clock,
+		oauth
+	});
+	const authorizationServer = (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).authorizationServer.fetch(c.req.raw, c.env, workerContext(c));
+	app.all("/.well-known/oauth-authorization-server", authorizationServer);
+	app.all("/oauth/*", authorizationServer);
+	installIdentity(app, { clock });
+	installAdmin(app, { oauth });
+	installAdminApi(app, {
+		sites: siteKeys,
+		clock,
+		oauth,
+		protect: (c, proceed) => protectWrites(c, "v1", proceed),
+		metadataUrl: (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.v1
+	});
+	if (options.handlers !== void 0) installOpsApi(app, {
+		sites,
+		handlers: options.handlers,
+		clock,
+		log,
+		protect: (c, proceed) => protectWrites(c, "v1", proceed),
+		metadataUrl: (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.v1,
+		notify
 	});
 	if (options.read !== void 0) installReadApi(app, {
 		read: options.read,
-		site: site.key,
-		clock,
-		log
+		corsOrigins: (site) => sites.get(site)?.cors.origins ?? [],
+		anyCorsOrigin: (origin) => corsOrigins.has(origin),
+		protect: (c, proceed) => protect(c, "v1", proceed),
+		metadataUrl: (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.v1
 	});
 	installErrorHandling(app, log);
-	return async (request, env, ctx) => await app.fetch(request, env, ctx);
+	return async (request, env, ctx) => {
+		contexts.set(request, ctx);
+		return await app.fetch(request, env, ctx);
+	};
 }
 //#endregion
 //#region src/mcp/annotations.ts
@@ -2433,12 +3277,15 @@ const encoder = new TextEncoder();
 * has already run when its answer turns out too large, so it says to look at the state it left.
 */
 const OUTPUT_TOO_LARGE_FIX = {
+	approve_review: "The operation ran and its change may have been applied: read the review with list_reviews before you repeat it.",
 	create_draft: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
 	describe_site: "The description of the site does not fit in one answer. Document fewer collections, components and contracts, or shorten their descriptions.",
 	get_entry: "Ask for one format at a time with formats: markdown, document or html, instead of several together.",
 	get_translations: "The translations do not fit in one answer. Read each one with get_entry instead.",
 	list_entries: "Ask for less: pass a smaller limit, or narrow the list with locale, tag or status.",
+	list_reviews: "Ask for less: pass a smaller limit.",
 	publish: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
+	request_changes: "The operation ran and its change may have been applied: read the review with list_reviews before you repeat it.",
 	unpublish: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
 	update_draft: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
 	validate: "The verdict lists more problems than fit in one answer. Fix the first ones and validate again."
@@ -2593,14 +3440,16 @@ const TOOLS_LIST_CACHE_HINT = {
 	cacheScope: "public"
 };
 /**
-* What the SDK is told about a principal: its scopes, which are the effective ones, and the id of
-* its token as the client. It carries no token: the gateway checked it, and nothing here needs it.
+* What the SDK is told about a principal: its scopes, which are the effective ones, the id of its
+* token or of its OAuth client as the client, and where its protected resource metadata is. It
+* carries no token: the gateway checked it, and nothing here needs it.
 */
-function authInfoOf(principal) {
+function authInfoOf(principal, resourceMetadataUrl) {
 	return {
 		token: "",
-		clientId: principal.kind === "token" ? principal.tokenId : principal.kind,
-		scopes: [...principal.scopes]
+		clientId: principal.kind === "token" || principal.kind === "read" ? principal.tokenId : principal.kind === "oauth" ? principal.clientId : principal.kind,
+		scopes: [...principal.scopes],
+		...resourceMetadataUrl === null ? {} : { resourceMetadataUrl }
 	};
 }
 /**
@@ -2726,7 +3575,7 @@ function createMcpEndpoint(options) {
 	}) });
 	return { async fetch(request, call) {
 		if (!call?.principal) throw new Error("The MCP endpoint serves a request only as the principal the gateway found");
-		const authInfo = authInfoOf(call.principal);
+		const authInfo = authInfoOf(call.principal, call.resourceMetadataUrl ?? null);
 		calls.set(authInfo, call);
 		return handler.fetch(request, { authInfo });
 	} };
@@ -2742,11 +3591,12 @@ const BINDING_PRINCIPAL = Object.freeze({
 	scopes: Object.freeze(["content:read"])
 });
 /**
-* The site of a call is not the site of this deployment. v0.1 serves one site, and the message
-* and the fix both say which, for a caller that only gets one of them.
+* The site of a call is none of the sites of this deployment. The message and the fix both say
+* which sites it serves, for a caller that only gets one of them.
 */
-function wrongSite(served) {
-	return new HollwareError("invalid_input", `This Hollware serves the site "${served}", not the one the call names.`, `Pass "${served}", the site this deployment serves, as the site argument.`);
+function unknownSite(site, served) {
+	const keys = [...served].map((key) => `"${key}"`).join(", ");
+	return new HollwareError("invalid_input", `This Hollware serves no site "${site}": it serves ${keys}.`, `Pass one of ${keys}, the sites this deployment serves, as the site argument.`);
 }
 /**
 * The options object of a call, without the keys that hold `undefined`, so that the handler sees
@@ -2792,7 +3642,7 @@ function forCaller(deps, requestId, method, error) {
 	return new HollwareError(known.code, known.message, known.fix);
 }
 /**
-* One call of an operation over RPC. In this order: the site is the one of this deployment, the
+* One call of an operation over RPC. In this order: the site is one of this deployment, the
 * input is built and parsed by the spec's schema, and the handler runs with
 *
 * - `view: 'published'`, so a draft is never read, and the principal `{ kind: 'binding', scopes:
@@ -2805,11 +3655,12 @@ function forCaller(deps, requestId, method, error) {
 * a call that fails never opens a session.
 */
 async function run(deps, env, method, site, schema, build, handler) {
-	if (site !== deps.site.key) throw wrongSite(deps.site.key);
+	const served = deps.sites.get(site);
+	if (served === void 0) throw unknownSite(site, deps.sites.keys());
 	const input = parseInput(schema, build());
 	const requestId = crypto.randomUUID();
 	const context = {
-		site: deps.site,
+		site: served,
 		principal: BINDING_PRINCIPAL,
 		view: "published",
 		store: createD1Store(env.DB.withSession("first-unconstrained")),
@@ -2890,6 +3741,30 @@ const SCHEDULER_SCOPES = [
 	"content:publish"
 ];
 /**
+* The principal a schedule publishes as: the token, or the OAuth client, that scheduled it, with
+* the scopes a publication needs. An OAuth client is known by the id its actor kept (ADR-026).
+*/
+function principalOf(actor, site) {
+	if (actor.kind === "oauth_client") {
+		const client = actor.meta?.["oauthClient"];
+		return {
+			kind: "oauth",
+			userId: actor.userId,
+			clientId: typeof client === "string" ? client : "unknown",
+			site,
+			scopes: SCHEDULER_SCOPES
+		};
+	}
+	if (actor.tokenId === null) throw new Error(`A schedule of a ${actor.kind} has no token to publish with`);
+	return {
+		kind: "token",
+		userId: actor.userId,
+		tokenId: actor.tokenId,
+		site,
+		scopes: SCHEDULER_SCOPES
+	};
+}
+/**
 * Publishes the scheduled entries whose time has come (ADR-025), one by one, through the same
 * handler as `publish`, in the name of who scheduled each one and with the warnings acknowledged
 * then. An entry that cannot be published (it changed after it was scheduled, or the contracts now
@@ -2910,13 +3785,7 @@ async function runDueSchedules(input) {
 			group: []
 		}, {
 			site,
-			principal: {
-				kind: "token",
-				userId: schedule.actor.userId,
-				tokenId: schedule.actor.tokenId ?? "",
-				site: site.key,
-				scopes: SCHEDULER_SCOPES
-			},
+			principal: principalOf(schedule.actor, site.key),
 			view: "head",
 			store,
 			clock,
@@ -2962,7 +3831,7 @@ function writeLog(entry) {
 *
 * - the config is resolved with `resolveConfig`, so a broken `hollware.config.ts` throws its
 *   `ConfigError` here, and the Worker fails at startup with a message that says what to change.
-*   v0.1 serves the one site of the config;
+*   The deployment serves every site of the config, and a token, a grant or a call names one;
 * - the MCP endpoint, whose tool schemas are converted once, and the Hono app of the gateway,
 *   which is `fetch`: MCP at `/mcp` behind the guard and the token check, and the other routes
 *   (`http/gateway.ts`);
@@ -2974,15 +3843,15 @@ function writeLog(entry) {
 * included, is one JSON line written with `console.log`.
 */
 function createHollwareWith(config, handlers, options = {}) {
-	const [site] = resolveConfig(config).sites.values();
-	if (site === void 0) throw new Error("The resolved config has no site, which resolveConfig never lets through");
+	const resolved = resolveConfig(config);
+	const sites = resolved.sites;
 	const clock = options.clock ?? systemClock;
 	const mcp = createMcpEndpoint({
 		handlers,
 		serverInfo: SERVER_INFO,
 		log: writeLog
 	});
-	const deliveryDeps = (env) => ({
+	const deliveryDeps = (env, site) => ({
 		db: connect(env.DB),
 		site,
 		clock,
@@ -2994,40 +3863,51 @@ function createHollwareWith(config, handlers, options = {}) {
 	});
 	return {
 		fetch: createGateway({
-			site,
+			sites,
 			mcp,
 			clock,
 			log: writeLog,
 			read: (env) => createRpc({
-				site,
+				sites,
 				handlers,
 				clock,
 				log: writeLog
-			}, env)
+			}, env),
+			auth: resolved.auth,
+			handlers
 		}),
 		scheduled: async (_controller, env, ctx) => {
-			const deps = deliveryDeps(env);
-			ctx.waitUntil(runDueSchedules({
-				site,
-				store: createD1Store(env.DB, { clock }),
-				handlers,
-				clock,
-				log: writeLog
-			}).then(() => sweepOutbox({
-				queue: env.EVENTS,
-				deps
-			})).then(() => void 0, (error) => {
-				writeLog({
-					kind: "cron_failed",
-					message: String(error)
+			const each = async (site) => {
+				await runDueSchedules({
+					site,
+					store: createD1Store(env.DB, { clock }),
+					handlers,
+					clock,
+					log: writeLog
 				});
-			}));
+				await sweepOutbox({
+					queue: env.EVENTS,
+					deps: deliveryDeps(env, site)
+				});
+			};
+			ctx.waitUntil((async () => {
+				for (const site of sites.values()) await each(site).catch((error) => {
+					writeLog({
+						kind: "cron_failed",
+						site: site.key,
+						message: String(error)
+					});
+				});
+			})());
 		},
 		queue: async (batch, env) => {
-			await consumeEvents(batch.messages, deliveryDeps(env));
+			await consumeEvents(batch.messages, (key) => {
+				const site = sites.get(key);
+				return site === void 0 ? void 0 : deliveryDeps(env, site);
+			});
 		},
 		Hollware: createEntrypoint({
-			site,
+			sites,
 			handlers,
 			clock,
 			log: writeLog
@@ -3055,23 +3935,49 @@ function unexpectedAnswer(context, call, answer) {
 //#endregion
 //#region src/ops/actor.ts
 /**
-* Who a write is made by: the token of the call, with what its client said about itself. Only a
-* personal token writes (ADR-019). The adapters check the scopes of the operation before any
-* handler runs and never route a write for another principal, so reaching one with a principal
-* that is not a token is a bug, answered as `internal` before anything is read or written.
+* Who a write is made by: the person behind the token of the call, with what its client said
+* about itself. A personal token writes as itself (ADR-019); an OAuth access token writes as the
+* client the person allowed, whose id goes with what the client said (ADR-026). The adapters check
+* the scopes of the operation before any handler runs and never route a write for the RPC
+* binding, so reaching one with it is a bug, answered as `internal` before anything is read or
+* written.
 */
 function actorOf(context) {
 	const { principal } = context;
-	if (principal.kind !== "token") throw internalError(context, `A write was routed for a principal of kind ${principal.kind}; only a token writes.`);
-	return {
+	if (principal.kind === "token") return {
 		kind: "token",
 		userId: principal.userId,
 		tokenId: principal.tokenId,
 		meta: context.client
 	};
+	if (principal.kind === "oauth") return {
+		kind: "oauth_client",
+		userId: principal.userId,
+		tokenId: null,
+		meta: {
+			...context.client,
+			oauthClient: principal.clientId
+		}
+	};
+	throw internalError(context, `A write was routed for a principal of kind ${principal.kind}; only a person writes.`);
 }
 //#endregion
 //#region src/ops/answers.ts
+/** A review as an output. */
+function reviewView(review) {
+	return {
+		id: review.id,
+		entryId: review.entryId,
+		revision: review.revisionId,
+		status: review.status,
+		requestedBy: review.requestedBy,
+		requestedByName: review.requestedByName,
+		requestedAt: review.requestedAt,
+		decidedBy: review.decidedBy,
+		decidedAt: review.decidedAt,
+		note: review.note
+	};
+}
 /**
 * The summary of an entry, from a listing (`EntrySummaryView`) or from a read of one entry
 * (`EntryView`, which has all of the summary's fields and more). `hasUnpublishedChanges` says
@@ -3341,8 +4247,8 @@ const describeSite$1 = async (_input, context) => ({
 //#endregion
 //#region src/ops/get-entry.ts
 /**
-* Reads an entry in the view of the call, `head` over MCP and `published` over RPC, with only the
-* formats that were asked for.
+* Reads an entry in the view of the call, `head` over MCP and `published` over RPC, or in the
+* published view when the input asks for it, with only the formats that were asked for.
 */
 const getEntry$1 = async (input, context) => {
 	requireCollection(context.site, input.collection);
@@ -3351,7 +4257,7 @@ const getEntry$1 = async (input, context) => {
 		collection: input.collection,
 		locale: input.locale,
 		slug: input.slug
-	}, context.view);
+	}, input.published ? "published" : context.view);
 	if (found === null) return { outcome: "not_found" };
 	const { entry, revision } = found;
 	const publication = await context.store.lastPublication(context.site.key, entry.id);
@@ -3439,8 +4345,14 @@ function warningKey(warning) {
 * changed since the draft was saved: an error blocks, and a warning has to be acknowledged, by
 * contract and path, before the publication is made. The publication records every warning of its
 * verdict as acknowledged (ADR-021).
+*
+* A caller without `content:publish` goes through the same checks, and then asks for a review
+* instead of publishing (v0.3): the answer is `pending_review`, and a person who may publish
+* decides. A review is for one entry, now.
 */
 const publish$1 = async (input, context) => {
+	const mayPublish = context.principal.scopes.includes("content:publish");
+	if (!mayPublish && (input.group.length > 0 || input.publishAt !== void 0)) throw new HollwareError("invalid_input", "Without content:publish, publish asks for a review of one entry, now: not of a group, and not at a time.", "Publish each entry on its own, without group and publishAt; a person who may publish approves it.");
 	if (input.group.length > 0) return publishGroup(input, context);
 	const actor = actorOf(context);
 	const found = await context.store.findEntryById(context.site.key, input.id, "head");
@@ -3478,6 +4390,28 @@ const publish$1 = async (input, context) => {
 		contract,
 		path
 	}));
+	if (!mayPublish) {
+		const asked = await context.store.requestReview(context.site.key, {
+			entryId: entry.id,
+			expectedVersion: input.version,
+			acknowledged: acknowledgedWarnings,
+			actor
+		});
+		switch (asked.outcome) {
+			case "pending_review": return {
+				outcome: "pending_review",
+				entry: summary,
+				verdict: verdictView(verdict),
+				review: reviewView(asked.review)
+			};
+			case "conflict": return {
+				outcome: "conflict",
+				conflict: conflictAt(asked.currentVersion, asked.headRevision)
+			};
+			case "not_found": return { outcome: "not_found" };
+			default: throw unexpectedAnswer(context, "publish", asked);
+		}
+	}
 	if (input.publishAt !== void 0 && Date.parse(input.publishAt) > context.clock.now().getTime()) {
 		if (entry.status === "published") throw new HollwareError("invalid_input", "The entry is published, so its publication cannot be scheduled.", "Publish its changes now, without publishAt, or unpublish it first and then schedule it.");
 		const scheduled = await context.store.schedule(context.site.key, {
@@ -3637,15 +4571,13 @@ async function publishGroup(input, context) {
 	}
 	const [main] = checked;
 	if (main === void 0) throw unexpectedAnswer(context, "publish", { outcome: "empty group" });
-	const warnings = new Map(checked.flatMap(({ verdict }) => verdict.warnings).map((warning) => [warningKey(warning), warning]));
 	const acknowledged = new Set(input.acknowledgeWarnings.map(warningKey));
-	if ([...warnings.keys()].some((key) => !acknowledged.has(key))) return {
+	const pending = checked.find(({ verdict }) => verdict.warnings.some((warning) => !acknowledged.has(warningKey(warning))));
+	if (pending !== void 0) return {
 		outcome: "needs_acknowledgement",
-		entry: main.summary,
-		verdict: verdictView({
-			...main.verdict,
-			warnings: [...warnings.values()]
-		})
+		entry: pending.summary,
+		verdict: verdictView(pending.verdict),
+		failedEntry: pending.write.entryId
 	};
 	const written = await context.store.publishGroup(context.site.key, checked.map(({ write }) => write));
 	switch (written.outcome) {
@@ -3681,6 +4613,91 @@ async function publishGroup(input, context) {
 	}
 }
 //#endregion
+//#region src/ops/reviews.ts
+/**
+* The reviews of v0.3: what a person who may publish does with the requests of those who may
+* only write. `publish` makes a request (`pending_review`); these list them, approve one, which
+* publishes it through `publish` itself, or close one with a note.
+*/
+/** The requests of one status, newest first, each with its entry as it is now. */
+const listReviews = async (input, context) => {
+	const found = await context.store.listReviews(context.site.key, {
+		status: input.status,
+		limit: input.limit
+	});
+	const reviews = [];
+	for (const review of found) {
+		const view = await context.store.findEntryById(context.site.key, review.entryId, "head");
+		if (view === null) throw unexpectedAnswer(context, "list_reviews", { outcome: "no entry" });
+		reviews.push({
+			...reviewView(review),
+			entry: entrySummary(view)
+		});
+	}
+	return {
+		outcome: "ok",
+		reviews
+	};
+};
+/**
+* Publishes what a pending review asked for, through `publish`, in the approver's name: the
+* contracts run again, and the warnings the request acknowledged count as acknowledged. The
+* publication approves the review in its own batch. A review that is no longer pending answers
+* `not_pending`.
+*/
+const approveReview = async (input, context) => {
+	const site = context.site.key;
+	const review = await context.store.findReview(site, input.id);
+	if (review === null) return { outcome: "not_found" };
+	if (review.status !== "pending") return {
+		outcome: "not_pending",
+		review: reviewView(review)
+	};
+	const found = await context.store.findEntryById(site, review.entryId, "head");
+	if (found === null) return { outcome: "not_found" };
+	const answer = await publish$1({
+		id: found.entry.id,
+		version: found.entry.version,
+		acknowledgeWarnings: [...review.acknowledged, ...input.acknowledgeWarnings],
+		group: []
+	}, context);
+	switch (answer.outcome) {
+		case "published": return {
+			outcome: "published",
+			review: reviewView(await context.store.findReview(site, review.id) ?? review),
+			...answer.entry === void 0 ? {} : { entry: answer.entry },
+			...answer.verdict === void 0 ? {} : { verdict: answer.verdict }
+		};
+		case "blocked":
+		case "needs_acknowledgement": return {
+			outcome: answer.outcome,
+			review: reviewView(review),
+			...answer.entry === void 0 ? {} : { entry: answer.entry },
+			...answer.verdict === void 0 ? {} : { verdict: answer.verdict }
+		};
+		case "conflict": return {
+			outcome: "not_pending",
+			review: reviewView(await context.store.findReview(site, review.id) ?? review)
+		};
+		case "not_found": return { outcome: "not_found" };
+		default: throw unexpectedAnswer(context, "approve_review", answer);
+	}
+};
+/** Closes a pending review with a note, without publishing. */
+const requestChanges = async (input, context) => {
+	const { userId } = actorOf(context);
+	const closed = await context.store.requestChanges(context.site.key, {
+		id: input.id,
+		note: input.note,
+		userId
+	});
+	if (closed.outcome === "not_found") return { outcome: "not_found" };
+	return {
+		outcome: closed.outcome,
+		review: reviewView(closed.review)
+	};
+};
+//#endregion
 //#region src/ops/unpublish.ts
 /**
 * Takes an entry off the public site and keeps it, with its revisions, as a draft. The store
@@ -3819,17 +4836,20 @@ function defineHandlers(handlers) {
 //#endregion
 //#region src/ops/index.ts
 /**
-* The handler of every operation of v0.1, paired with its spec of `@hollware/core` by type
+* The handler of every operation, paired with its spec of `@hollware/core` by type
 * (ADR-017). Adapters check the scopes and build the `OperationContext`; a handler never sees a
 * request, and reads and writes only the site of its context.
 */
 const handlers = defineHandlers({
+	approve_review: approveReview,
 	create_draft: createDraft,
 	describe_site: describeSite$1,
 	get_entry: getEntry$1,
 	get_translations: getTranslations$1,
 	list_entries: listEntries$1,
+	list_reviews: listReviews,
 	publish: publish$1,
+	request_changes: requestChanges,
 	unpublish,
 	update_draft: updateDraft,
 	validate