@hollware/server 0.3.0 → 0.4.0

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { A as isRole, C as revisions, D as users, E as tokens, O as ROLE_SCOPES, S as revisionTags, T as sites, _ as invitations, b as publications, g as entries, h as deliveries, k as effectiveScopes, n as createInvitation, s as findSession, v as members, w as schedules, x as reviews, y as outbox } from "./store-Sq0pwUQv.mjs";
-import { EVENT_ID_HEADER, HollwareError, OPERATIONS, SCOPES, SIGNATURE_HEADER, TIMESTAMP_HEADER, describeBuiltInContracts, describeResolvedSite, describeSite, generatePersonalToken, getEntry, getTranslations, hashPersonalToken, isPersonalToken, isScope, listEntries, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, signWebhook, sizeLimitViolation, uniqueSlugViolation, uniqueTranslationViolation } from "@hollware/core";
+import { A as effectiveScopes, C as revisionTags, D as tokens, E as sites, O as users, S as reviews, T as schedules, _ as entries, b as outbox, g as deliveries, j as isRole, k as ROLE_SCOPES, l as membershipsOf, n as createInvitation, s as findSession, v as invitations, w as revisions, x as publications, y as members } from "./store-CsuER6J7.mjs";
+import { EVENT_ID_HEADER, HollwareError, OPERATIONS, SCOPES, SIGNATURE_HEADER, TIMESTAMP_HEADER, describeBuiltInContracts, describeResolvedSite, describeSite, generatePersonalToken, generateReadToken, getEntry, getTranslations, hashPersonalToken, isPersonalToken, isReadToken, isScope, listEntries, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, signWebhook, sizeLimitViolation, uniqueSlugViolation, uniqueTranslationViolation } from "@hollware/core";
 import { Hono } from "hono";
 import { drizzle } from "drizzle-orm/d1";
 import { and, desc, eq, getTableColumns, gt, inArray, isNull, lte, ne, or, sql } from "drizzle-orm";
@@ -10,7 +10,7 @@ import { CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, McpServer, accepted
 import * as z from "zod";
 import { WorkerEntrypoint } from "cloudflare:workers";
 //#region package.json
-var version = "0.3.0";
+var version = "0.4.0";
 //#endregion
 //#region src/auth/responses.ts
 /** The challenge of every 401 and 403 (RFC 6750). */
@@ -93,7 +93,9 @@ function readPublicUrl(value) {
 *   Any other port is another host.
 * - An `Origin` header that is present and is not the origin of the public URL, scheme and port
 *   included: 403. That covers the opaque `null` origin and an empty value. A request without
-*   `Origin` passes: only browsers send it, and they are what the check is for.
+*   `Origin` passes: only browsers send it, and they are what the check is for. The one exception
+*   is `crossOrigin`: an origin it accepts passes too (the read API, for the origins a site's
+*   config lists; the read API then checks the origin against the site of the token).
 *
 * It returns the response to send, or `null` when the request may go on. No answer repeats the
 * request: the 403s say what to send instead, and the 500 only says what is missing.
@@ -103,8 +105,9 @@ function readPublicUrl(value) {
 * they accept a `Host` such as `user@cms.example.com` or `cms.example.com/x`.
 *
 * @param publicUrl The `HOLLWARE_PUBLIC_URL` variable as the environment holds it.
+* @param crossOrigin Whether a request may come from a page of another origin; never, by default.
 */
-function checkHostAndOrigin(request, publicUrl) {
+function checkHostAndOrigin(request, publicUrl, crossOrigin = () => false) {
 	const expected = readPublicUrl(publicUrl);
 	if (expected === null) return authErrorResponse(500, {
 		code: "misconfigured",
@@ -118,7 +121,7 @@ function checkHostAndOrigin(request, publicUrl) {
 		fix: `Send the request to ${expected.origin}, the public URL of this Hollware (HOLLWARE_PUBLIC_URL).`
 	});
 	const origin = request.headers.get("origin");
-	if (origin !== null && origin.toLowerCase() !== expected.origin) return authErrorResponse(403, {
+	if (origin !== null && origin.toLowerCase() !== expected.origin && !crossOrigin(request, origin)) return authErrorResponse(403, {
 		code: "forbidden_origin",
 		message: "The Origin header of the request is not the public URL of this Hollware.",
 		fix: `Call Hollware from a client that sends no Origin header, or from a page served at ${expected.origin}.`
@@ -141,14 +144,14 @@ function missingScopes(principal, required) {
 /** `last_used_at` of a token is written at most once in this time. */
 const TOUCH_INTERVAL_MS = 36e5;
 /**
-* The token with the role of its user in the token's site, by the hash of the token, in the one
-* site. A user who is no member of the site has no role there, and the token is unknown.
+* The token with the role of its user in the token's site, by the hash of the token, in the
+* deployment. A user who is no member of the site has no role there, and the token is unknown.
 */
 const LOOKUP = `SELECT t.id AS token_id, t.site_id AS site_id, t.user_id AS user_id,
-    t.scopes AS scopes, t.expires_at AS expires_at, t.revoked_at AS revoked_at,
+    t.kind AS kind, t.scopes AS scopes, t.expires_at AS expires_at, t.revoked_at AS revoked_at,
     t.last_used_at AS last_used_at, m.role AS role
   FROM tokens AS t JOIN members AS m ON m.user_id = t.user_id AND m.site_id = t.site_id
-  WHERE t.hash = ?1 AND t.site_id = ?2`;
+  WHERE t.hash = ?1`;
 /**
 * The scopes a token carries, from the JSON array the `tokens` table stores. Anything that is not
 * one of the scopes is left out, and a value that is not an array of scopes has none: a token
@@ -193,12 +196,12 @@ async function recordTokenUse(db, token, now) {
 	}
 }
 /**
-* Authenticates a personal token (ADR-019). A string without the shape of a token is `unknown`
-* without a query. Otherwise one query finds the token by the hash of the whole string, in this
-* site only, together with the role of its user; the answer is, in this order:
+* Authenticates a personal token (ADR-019) or a read token. A string without the shape of either
+* is `unknown` without a query. Otherwise one query finds the token by the hash of the whole
+* string, together with the role of its user in the token's site; the answer is, in this order:
 *
-* - `unknown`: no such token in this site. A token of another site is the same as no token, and
-*   nothing says it exists elsewhere.
+* - `unknown`: no such token in the sites of this deployment. A token of another site is the same as
+*   no token, and nothing says it exists elsewhere.
 * - `revoked`: it has a revocation date, whatever the date says: it is never read, so a clock that
 *   runs ahead of the Worker's, where the token was revoked, cannot keep it alive for a while.
 * - `expired`: its expiry is now or past (see `hasExpired`).
@@ -211,12 +214,13 @@ async function recordTokenUse(db, token, now) {
 * must never read that as a valid token.
 */
 async function checkPersonalToken(db, token, options) {
-	if (!isPersonalToken(token)) return {
+	const kind = isPersonalToken(token) ? "personal" : isReadToken(token) ? "read" : null;
+	if (kind === null) return {
 		ok: false,
 		reason: "unknown"
 	};
-	const row = await db.prepare(LOOKUP).bind(await hashPersonalToken(token), options.site).first();
-	if (row === null) return {
+	const row = await db.prepare(LOOKUP).bind(await hashPersonalToken(token)).first();
+	if (row === null || row.kind !== kind || !options.sites.has(row.site_id)) return {
 		ok: false,
 		reason: "unknown"
 	};
@@ -229,14 +233,22 @@ async function checkPersonalToken(db, token, options) {
 		reason: "expired"
 	};
 	const recent = row.last_used_at !== null && row.last_used_at >= anHourBefore(options.now);
+	const scopes = effectiveScopes(row.role, parseTokenScopes(row.scopes));
+	const identity = {
+		userId: row.user_id,
+		tokenId: row.token_id,
+		site: row.site_id
+	};
 	return {
 		ok: true,
-		principal: {
+		principal: kind === "read" ? {
+			kind: "read",
+			...identity,
+			scopes: scopes.filter((scope) => scope === "content:read")
+		} : {
 			kind: "token",
-			userId: row.user_id,
-			tokenId: row.token_id,
-			site: row.site_id,
-			scopes: effectiveScopes(row.role, parseTokenScopes(row.scopes))
+			...identity,
+			scopes
 		},
 		touch: recent ? null : recordTokenUse(db, {
 			id: row.token_id,
@@ -1636,12 +1648,14 @@ function isEventMessage(body) {
 /**
 * The Queue consumer: delivers each event, acknowledges it once every subscriber has it, and asks
 * for a retry otherwise; after the Queue's retries it lands in the dead-letter queue. A message of
-* another site, or that is no event, is acknowledged and dropped.
+* a site this deployment does not serve (`depsOf` has none for it), or that is no event, is
+* acknowledged and dropped.
 */
-async function consumeEvents(messages, deps) {
+async function consumeEvents(messages, depsOf) {
 	for (const message of messages) {
 		const { body } = message;
-		if (!isEventMessage(body) || body.site !== deps.site.key) {
+		const deps = isEventMessage(body) ? depsOf(body.site) : void 0;
+		if (!isEventMessage(body) || deps === void 0) {
 			message.ack();
 			continue;
 		}
@@ -1849,7 +1863,8 @@ function installAdmin(app, options) {
 //#region src/http/admin-api.ts
 /**
 * What only a person in the admin may do (ADR-026): see, make and revoke personal tokens, and
-* invite people. These are no operations, so no agent sees them over MCP, and a request needs an
+* invite people, on the site of their token; and learn who they are and which sites they may switch
+* to (`/v1/admin/me`, the one route for every role). These are no operations, so no agent sees them over MCP, and a request needs an
 * access token of the admin's own client with `schema:admin`: a personal token, or a token of
 * another client, never reaches them, even an owner's. A leaked token cannot mint the next one.
 */
@@ -1882,20 +1897,38 @@ function daysFrom(value, fallback) {
 	return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 365 ? value : null;
 }
 function installAdminApi(app, options) {
-	/** Runs `handle` for a person in the admin with `schema:admin`; anyone else is refused. */
-	const admin = (handle) => (c) => options.protect(c, async (principal) => {
+	/**
+	* Runs `handle` for a person in the admin with `schema:admin`, or with any scope when `anyone`;
+	* anyone else is refused.
+	*/
+	const admin = (handle, { anyone = false } = {}) => (c) => options.protect(c, async (principal) => {
 		const ours = (await adminClient(options.oauth(c.env.HOLLWARE_PUBLIC_URL), c.env)).clientId;
 		if (principal.kind !== "oauth" || principal.clientId !== ours) return refused("Only the admin may do this.", "Sign in to the admin at /admin/ and do it there.", 403);
-		if (!principal.scopes.includes("schema:admin")) return insufficientScope(["schema:admin"], options.metadataUrl(c));
+		if (!anyone && !principal.scopes.includes("schema:admin")) return insufficientScope(["schema:admin"], options.metadataUrl(c));
 		return handle(c, principal);
 	});
 	const body = async (c) => {
 		const value = await c.req.json().catch(() => null);
 		return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : {};
 	};
-	app.get("/v1/admin/tokens", admin(async (c) => {
+	app.get("/v1/admin/me", admin(async (c, person) => {
+		const db = connect(c.env.DB);
+		const [user] = await db.select({
+			id: users.id,
+			name: users.name
+		}).from(users).where(eq(users.id, person.userId));
+		const sites = (await membershipsOf(db, person.userId)).filter((membership) => options.sites.has(membership.site));
+		return json$1({
+			user,
+			site: person.site,
+			scopes: person.scopes,
+			sites
+		});
+	}, { anyone: true }));
+	app.get("/v1/admin/tokens", admin(async (c, person) => {
 		return json$1({ tokens: (await connect(c.env.DB).select({
 			id: tokens.id,
+			kind: tokens.kind,
 			label: tokens.label,
 			scopes: tokens.scopes,
 			user: users.name,
@@ -1903,7 +1936,7 @@ function installAdminApi(app, options) {
 			revokedAt: tokens.revokedAt,
 			lastUsedAt: tokens.lastUsedAt,
 			createdAt: tokens.createdAt
-		}).from(tokens).innerJoin(users, eq(users.id, tokens.userId)).where(eq(tokens.siteId, options.site)).orderBy(desc(tokens.createdAt), desc(tokens.id))).map((row) => ({
+		}).from(tokens).innerJoin(users, eq(users.id, tokens.userId)).where(eq(tokens.siteId, person.site)).orderBy(desc(tokens.createdAt), desc(tokens.id))).map((row) => ({
 			...row,
 			scopes: parseScopes(row.scopes)
 		})) });
@@ -1912,16 +1945,20 @@ function installAdminApi(app, options) {
 		const input = await body(c);
 		const label = typeof input["label"] === "string" ? input["label"].trim() : "";
 		if (label === "" || label.length > 100) return refused("A token needs a label of 1 to 100 characters.", "Say what the token is for.");
-		const asked = Array.isArray(input["scopes"]) ? input["scopes"].filter((s) => typeof s === "string") : [];
+		const asKind = input["kind"];
+		const kind = asKind === void 0 || asKind === "personal" ? "personal" : asKind === "read" ? "read" : null;
+		if (kind === null) return refused("kind is \"personal\" or \"read\".", "Leave it out for a personal token; \"read\" makes a token that reads published content.");
+		const asked = kind === "read" ? ["content:read"] : Array.isArray(input["scopes"]) ? input["scopes"].filter((s) => typeof s === "string") : [];
 		const scopes = person.scopes.filter((scope) => asked.includes(scope));
 		if (scopes.length === 0) return refused("A token needs at least one scope that you have.", `Choose among ${person.scopes.join(", ")}.`);
 		const days = daysFrom(input["expiresInDays"], TOKEN_DAYS);
 		if (days === null) return refused("expiresInDays is a whole number from 1 to 365.", "Leave it out for 90 days.");
 		const now = options.clock.now();
-		const secret = generatePersonalToken();
+		const secret = kind === "read" ? generateReadToken() : generatePersonalToken();
 		const row = {
 			id: newId("tok"),
-			siteId: options.site,
+			kind,
+			siteId: person.site,
 			userId: person.userId,
 			label,
 			hash: await hashPersonalToken(secret),
@@ -1935,20 +1972,21 @@ function installAdminApi(app, options) {
 		await connect(c.env.DB).insert(tokens).values(row);
 		return json$1({
 			id: row.id,
+			kind,
 			label,
 			scopes,
 			expiresAt: row.expiresAt,
 			secret
 		}, 201);
 	}));
-	app.post("/v1/admin/tokens/:id/revoke", admin(async (c) => {
+	app.post("/v1/admin/tokens/:id/revoke", admin(async (c, person) => {
 		const now = options.clock.now().toISOString();
 		const db = connect(c.env.DB);
 		const id = c.req.param("id") ?? "";
 		const [revoked] = await db.update(tokens).set({
 			revokedAt: now,
 			updatedAt: now
-		}).where(and(eq(tokens.siteId, options.site), eq(tokens.id, id), isNull(tokens.revokedAt))).returning({ id: tokens.id });
+		}).where(and(eq(tokens.siteId, person.site), eq(tokens.id, id), isNull(tokens.revokedAt))).returning({ id: tokens.id });
 		if (revoked !== void 0) return json$1({
 			id: revoked.id,
 			revokedAt: now
@@ -1956,13 +1994,13 @@ function installAdminApi(app, options) {
 		const [row] = await db.select({
 			id: tokens.id,
 			revokedAt: tokens.revokedAt
-		}).from(tokens).where(and(eq(tokens.siteId, options.site), eq(tokens.id, id)));
+		}).from(tokens).where(and(eq(tokens.siteId, person.site), eq(tokens.id, id)));
 		return row === void 0 ? refused("There is no such token.", "List the tokens and pick one of them.", 404) : json$1({
 			id: row.id,
 			revokedAt: row.revokedAt
 		});
 	}));
-	app.get("/v1/admin/people", admin(async (c) => {
+	app.get("/v1/admin/people", admin(async (c, person) => {
 		const db = connect(c.env.DB);
 		const now = options.clock.now().toISOString();
 		return json$1({
@@ -1971,22 +2009,22 @@ function installAdminApi(app, options) {
 				name: users.name,
 				role: members.role,
 				since: members.createdAt
-			}).from(members).innerJoin(users, eq(users.id, members.userId)).where(eq(members.siteId, options.site)).orderBy(members.createdAt, users.id),
+			}).from(members).innerJoin(users, eq(users.id, members.userId)).where(eq(members.siteId, person.site)).orderBy(members.createdAt, users.id),
 			invitations: await db.select({
 				id: invitations.id,
 				role: invitations.role,
 				expiresAt: invitations.expiresAt
-			}).from(invitations).where(and(eq(invitations.siteId, options.site), isNull(invitations.usedAt), isNull(invitations.userId), gt(invitations.expiresAt, now))).orderBy(desc(invitations.createdAt))
+			}).from(invitations).where(and(eq(invitations.siteId, person.site), isNull(invitations.usedAt), isNull(invitations.userId), gt(invitations.expiresAt, now))).orderBy(desc(invitations.createdAt))
 		});
 	}));
-	app.post("/v1/admin/invitations", admin(async (c) => {
+	app.post("/v1/admin/invitations", admin(async (c, person) => {
 		const input = await body(c);
 		const role = input["role"];
 		if (typeof role !== "string" || !isRole(role) || role === "owner") return refused("An invitation is for an editor or an author.", `Use role "editor" (${ROLE_SCOPES.editor.join(", ")}) or "author" (${ROLE_SCOPES.author.join(", ")}).`);
 		const days = daysFrom(input["days"], INVITATION_DAYS);
 		if (days === null) return refused("days is a whole number from 1 to 365.", "Leave it out for 7 days.");
 		const made = await createInvitation(connect(c.env.DB), {
-			site: options.site,
+			site: person.site,
 			role,
 			userId: null,
 			now: options.clock.now(),
@@ -2041,15 +2079,17 @@ function installOpsApi(app, options) {
 				fix: "Send the input of the operation as its input schema describes it."
 			}, 400);
 		}
+		const site = options.sites.get(principal.site);
+		if (site === void 0) throw new Error(`No site ${principal.site} for a checked token`);
 		const context = {
-			site: options.site,
+			site,
 			principal,
 			view: "head",
 			store: createD1Store(c.env.DB, { clock: options.clock }),
 			clock: options.clock,
 			client: { name: "hollware-admin" },
 			requestId,
-			notify: options.notify(c, requestId)
+			notify: options.notify(c, requestId, site.key)
 		};
 		try {
 			return json(spec.output.parse(await invoke$1(options.handlers, spec, parsed.data, context)));
@@ -2076,6 +2116,14 @@ function installOpsApi(app, options) {
 }
 //#endregion
 //#region src/http/read-api.ts
+/** How long a browser keeps the answer of a preflight, in seconds. */
+const PREFLIGHT_MAX_AGE = 600;
+/** The origin of a request from a page of another origin than Hollware's own, or `null`. */
+function crossOriginOf(c) {
+	const origin = c.req.header("origin");
+	if (origin === void 0) return null;
+	return origin.toLowerCase() === new URL(c.env.HOLLWARE_PUBLIC_URL).origin ? null : origin;
+}
 const STATUS = {
 	invalid_input: 400,
 	unknown_collection: 404,
@@ -2112,47 +2160,82 @@ async function answer(c, value) {
 function installReadApi(app, options) {
 	app.use("/v1/*", async (c, next) => {
 		if (c.req.path.startsWith("/v1/ops/") || c.req.path.startsWith("/v1/admin/")) return next();
+		const crossOrigin = crossOriginOf(c);
+		if (c.req.method === "OPTIONS") {
+			const headers = new Headers({
+				allow: "GET, HEAD, OPTIONS",
+				vary: "Origin"
+			});
+			if (crossOrigin !== null && options.anyCorsOrigin(crossOrigin)) {
+				headers.set("access-control-allow-origin", crossOrigin);
+				headers.set("access-control-allow-methods", "GET, HEAD");
+				headers.set("access-control-allow-headers", "authorization, if-none-match");
+				headers.set("access-control-max-age", String(PREFLIGHT_MAX_AGE));
+			}
+			return new Response(null, {
+				status: 204,
+				headers
+			});
+		}
 		if (c.req.method !== "GET" && c.req.method !== "HEAD") return c.json({
 			code: "invalid_input",
 			message: "The read API only reads.",
 			fix: "Use GET."
 		}, 405, { allow: "GET, HEAD" });
 		if (c.req.path === "/v1/openapi.json") return next();
-		return options.protect(c, async (principal) => {
+		c.res = await options.protect(c, async (principal) => {
 			if (!principal.scopes.includes("content:read")) return insufficientScope(["content:read"], options.metadataUrl(c));
-			try {
-				await next();
-				return c.res;
-			} catch (error) {
-				if (!(error instanceof HollwareError)) throw error;
-				return c.json({
-					code: error.code,
-					message: error.message,
-					fix: error.fix
-				}, STATUS[error.code] ?? 500);
-			}
+			c.set("site", principal.site);
+			if (crossOrigin !== null && !options.corsOrigins(principal.site).includes(crossOrigin)) return c.json({
+				code: "forbidden_origin",
+				message: `The site "${principal.site}" does not let pages of ${crossOrigin} read it.`,
+				fix: `Add "${crossOrigin}" to cors.origins of the site in hollware.config.ts, or read from a server.`
+			}, 403, {
+				vary: "Origin",
+				"access-control-allow-origin": new URL(c.env.HOLLWARE_PUBLIC_URL).origin
+			});
+			const answered = await (async () => {
+				try {
+					await next();
+					return c.res;
+				} catch (error) {
+					if (!(error instanceof HollwareError)) throw error;
+					return c.json({
+						code: error.code,
+						message: error.message,
+						fix: error.fix
+					}, STATUS[error.code] ?? 500);
+				}
+			})();
+			if (crossOrigin === null) return answered;
+			const shared = new Response(answered.body, answered);
+			shared.headers.set("access-control-allow-origin", crossOrigin);
+			shared.headers.set("access-control-expose-headers", "etag");
+			shared.headers.append("vary", "Origin");
+			return shared;
 		});
+		return c.res;
 	});
-	app.get("/v1/openapi.json", (c) => c.json(openApiDocument(options.site)));
-	app.get("/v1/site", async (c) => answer(c, await options.read(c.env).describeSite(options.site)));
+	app.get("/v1/openapi.json", (c) => c.json(openApiDocument()));
+	app.get("/v1/site", async (c) => answer(c, await options.read(c.env).describeSite(c.get("site"))));
 	app.get("/v1/:collection", async (c) => {
 		const query = c.req.query();
 		const limit = query["limit"] === void 0 ? void 0 : Number(query["limit"]);
-		return answer(c, await options.read(c.env).listEntries(options.site, c.req.param("collection"), {
+		return answer(c, await options.read(c.env).listEntries(c.get("site"), c.req.param("collection"), {
 			...query["locale"] === void 0 ? {} : { locale: query["locale"] },
 			...query["tag"] === void 0 ? {} : { tag: query["tag"] },
 			...limit === void 0 ? {} : { limit },
 			...query["cursor"] === void 0 ? {} : { cursor: query["cursor"] }
 		}));
 	});
-	app.get("/v1/:collection/translations/:group", async (c) => answer(c, await options.read(c.env).getTranslations(options.site, c.req.param("collection"), c.req.param("group"))));
+	app.get("/v1/:collection/translations/:group", async (c) => answer(c, await options.read(c.env).getTranslations(c.get("site"), c.req.param("collection"), c.req.param("group"))));
 	app.get("/v1/:collection/:locale/:slug", async (c) => {
 		const formats = c.req.query("formats");
-		return answer(c, await options.read(c.env).getEntry(options.site, c.req.param("collection"), c.req.param("slug"), c.req.param("locale"), formats === void 0 ? {} : { formats: formats.split(",").flatMap((format) => format === "markdown" || format === "document" || format === "html" ? [format] : []) }));
+		return answer(c, await options.read(c.env).getEntry(c.get("site"), c.req.param("collection"), c.req.param("slug"), c.req.param("locale"), formats === void 0 ? {} : { formats: formats.split(",").flatMap((format) => format === "markdown" || format === "document" || format === "html" ? [format] : []) }));
 	});
 }
 /** The OpenAPI 3.1 document of the read API. */
-function openApiDocument(site) {
+function openApiDocument() {
 	const ok = (description) => ({
 		description,
 		headers: { ETag: { schema: { type: "string" } } },
@@ -2172,7 +2255,7 @@ function openApiDocument(site) {
 	return {
 		openapi: "3.1.0",
 		info: {
-			title: `Hollware read API (${site})`,
+			title: "Hollware read API",
 			version: "1"
 		},
 		components: { securitySchemes: { token: {
@@ -2237,9 +2320,25 @@ function openApiDocument(site) {
 * (`PublicKeyCredential.parseCreationOptionsFromJSON`, `credential.toJSON()`), and reads the
 * invitation from the address bar, so the page never prints it.
 */
-const STYLE = `body{font:1rem/1.5 system-ui,sans-serif;max-width:28rem;margin:4rem auto;padding:0 1rem;color:#1d1d1f}
-label{display:block;margin:.75rem 0 .25rem}input{width:100%;padding:.5rem;font:inherit}
-button{margin-top:1rem;padding:.6rem 1rem;font:inherit;cursor:pointer}[role=alert]{color:#b00020}`;
+/**
+* The look of hollware.com and the admin, with nothing to fetch: the page's policy loads no font,
+* so the type is the system's. Ink greys and the mint accent, dark when the device is.
+*/
+const STYLE = `:root{color-scheme:light dark;--bg:#f6f7f8;--card:#fff;--fg:#15181b;--muted:#545c66;--line:#d6dadf;--accent:#0c825d;--on-accent:#fff;--danger:#b42318}
+@media (prefers-color-scheme:dark){:root{--bg:#08090a;--card:#0f1113;--fg:#eceef0;--muted:#8a939e;--line:rgb(255 255 255/.1);--accent:#3ee6a8;--on-accent:#04140d;--danger:#ff8a80}}
+*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:2rem 1rem;background:var(--bg);color:var(--fg);font:15px/1.6 system-ui,-apple-system,'Segoe UI',sans-serif;-webkit-font-smoothing:antialiased}
+main{width:100%;max-width:26rem;background:var(--card);border:1px solid var(--line);border-radius:14px;padding:2rem}
+.brand{display:flex;align-items:center;gap:.6rem;margin-bottom:1.75rem;font-weight:600;letter-spacing:-.01em}.brand svg{width:26px;height:26px}
+h1{font-size:1.4rem;line-height:1.25;letter-spacing:-.02em;margin:0 0 .5rem}p{color:var(--muted);margin:.5rem 0}strong{color:var(--fg)}
+label{display:block;margin:1rem 0 .35rem;font-size:.9rem;font-weight:500}fieldset label,form>label:has(input[type=checkbox]){font-weight:400;display:flex;align-items:center;gap:.5rem;margin:.5rem 0}
+input{width:100%;padding:.6rem .75rem;font:inherit;color:inherit;background:transparent;border:1px solid var(--line);border-radius:8px}input:focus{outline:2px solid var(--accent);outline-offset:1px}
+label input{width:auto;margin:0}fieldset{border:1px solid var(--line);border-radius:8px;margin:1rem 0;padding:.5rem .9rem}legend{color:var(--muted);font-size:.85rem;padding:0 .3rem}
+code{font:.82em ui-monospace,'SF Mono',Menlo,monospace;color:var(--muted)}
+button{margin-top:1.25rem;padding:.6rem 1rem;font:inherit;font-weight:500;cursor:pointer;border-radius:8px;border:1px solid var(--line);background:transparent;color:var(--fg)}
+button:not([value=deny]){background:var(--accent);border-color:var(--accent);color:var(--on-accent)}
+[role=alert]{color:var(--danger)}`;
+/** The mark of Hollware, before the title of every page. */
+const BRAND = `<div class="brand"><svg viewBox="0 0 32 32" aria-hidden="true"><rect width="32" height="32" rx="8" fill="currentColor" opacity=".08"/><path d="M9 8v16M23 8v16M9 16h14" stroke="var(--accent)" stroke-width="3" stroke-linecap="round" fill="none"/></svg>Hollware</div>`;
 const POST = `async function post(path, body) {
   const response = await fetch(path, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) })
   const data = await response.json()
@@ -2258,6 +2357,7 @@ function page(title, nonce, body, script) {
 </head>
 <body>
 <main>
+${BRAND}
 <h1>${title}</h1>
 ${body}
 <p id="error" role="alert"></p>
@@ -2327,6 +2427,7 @@ function consentPage(view) {
 	const name = escapeHtml(view.clientName);
 	const origin = view.clientDomain === void 0 ? "<p>This app registered itself: its name is not verified.</p>" : `<p>Published by <strong>${escapeHtml(view.clientDomain)}</strong>.</p>`;
 	const loopback = view.redirectIsLoopback ? "<p><strong>This sends access to an app on this computer.</strong> Continue only if you just started to connect it.</p>" : "";
+	const sites = view.sites.length === 1 ? `<input type="hidden" name="site" value="${escapeHtml(view.sites[0] ?? "")}">` : `<fieldset><legend>For the site</legend>${view.sites.map((site, index) => `<label><input type="radio" name="site" value="${escapeHtml(site)}"${index === 0 ? " checked" : ""}> ${escapeHtml(site)}</label>`).join("\n")}</fieldset>`;
 	const scopes = view.scopes.map((scope) => `<label><input type="checkbox" name="scope" value="${escapeHtml(scope)}" checked> ${escapeHtml(SCOPE_WORDS[scope] ?? scope)} <code>${escapeHtml(scope)}</code></label>`).join("\n");
 	return `<!doctype html>
 <html lang="en">
@@ -2334,16 +2435,18 @@ function consentPage(view) {
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Allow ${name} · Hollware</title>
-<style>${STYLE}label input{width:auto;margin-right:.5rem}</style>
+<style>${STYLE}</style>
 </head>
 <body>
 <main>
+${BRAND}
 <h1>Allow ${name} to use this Hollware?</h1>
 ${origin}
 <p>Signed in as <strong>${escapeHtml(view.person)}</strong>. Access goes to <strong>${escapeHtml(view.redirectHost)}</strong>.</p>
 ${loopback}
 <form method="post" action="/authorize">
 <input type="hidden" name="handle" value="${escapeHtml(view.handle)}">
+${sites}
 ${scopes}
 <p><button name="decision" value="approve">Allow</button> <button name="decision" value="deny">Deny</button></p>
 </form>
@@ -2364,6 +2467,7 @@ function messagePage(title, message) {
 </head>
 <body>
 <main>
+${BRAND}
 <h1>${escapeHtml(title)}</h1>
 <p>${escapeHtml(message)}</p>
 </main>
@@ -2391,7 +2495,7 @@ function plainPageHeaders() {
 * The ceremonies, with SimpleWebAuthn and its parsers, in a chunk of their own: only these four
 * routes use them, and a Worker that serves MCP never pays for them at startup (`budgets.json`).
 */
-const ceremonies = () => import("./ceremonies-D7tsWU3S.mjs");
+const ceremonies = () => import("./ceremonies-V_1BbmZQ.mjs");
 /** The cookie of a signed-in person: only `/authorize` reads it (ADR-026). */
 const SESSION_COOKIE = "hollware_session";
 function sessionCookie(secret) {
@@ -2404,7 +2508,6 @@ function isRecord$1(value) {
 function installIdentity(app, options) {
 	const ceremony = (c) => ({
 		db: connect(c.env.DB),
-		site: options.site,
 		publicUrl: c.env.HOLLWARE_PUBLIC_URL,
 		now: options.clock.now()
 	});
@@ -2508,36 +2611,52 @@ function answerError(error) {
 *   `access_denied`.
 * - The grant stores the person and the site. What its tokens may do is read again on each request
 *   against the person's role then (`server.ts`).
+* - The site is the one `?site=` names, if the person is a member of it; else the only site the
+*   person is a member of; else the consent page asks which (v0.4). The admin names its site, and
+*   takes the first one when it names none.
 */
 function installAuthorize(app, options) {
 	const person = async (c) => {
 		const secret = getCookie(c, SESSION_COOKIE);
 		if (secret === void 0) return null;
-		return await findSession(connect(c.env.DB), options.site, secret, options.clock.now());
+		const db = connect(c.env.DB);
+		const found = await findSession(db, secret, options.clock.now());
+		if (found === null) return null;
+		const memberships = (await membershipsOf(db, found.userId)).filter((membership) => options.sites.has(membership.site));
+		return {
+			...found,
+			memberships
+		};
 	};
 	const signIn = (c) => {
 		const url = new URL(c.req.url);
 		const back = `${url.pathname}${url.search}`;
 		return c.redirect(`/signin?return_to=${encodeURIComponent(back)}`, 302);
 	};
+	const notMember = (site) => html(messagePage("Not a member", site === void 0 ? "You are not a member of any site of this Hollware. Ask an owner for an invitation." : `You are not a member of the site "${site}". Ask its owner for an invitation.`), 403);
 	app.get("/authorize", async (c) => {
-		const oauth = options.oauth(c.env.HOLLWARE_PUBLIC_URL).authorizationServer.getOAuthApi(c.env);
+		const server = options.oauth(c.env.HOLLWARE_PUBLIC_URL);
+		const oauth = server.authorizationServer.getOAuthApi(c.env);
 		try {
 			const request = await oauth.parseAuthRequest(c.req.raw);
 			const signedIn = await person(c);
 			if (signedIn === null) return signIn(c);
-			const server = options.oauth(c.env.HOLLWARE_PUBLIC_URL);
+			const [first] = signedIn.memberships;
+			if (first === void 0) return notMember(void 0);
+			const asked = c.req.query("site");
+			const named = asked === void 0 ? void 0 : signedIn.memberships.find((m) => m.site === asked);
+			if (asked !== void 0 && named === void 0) return notMember(asked);
 			if (request.clientId === (await adminClient(server, c.env)).clientId) {
-				const scope = grantableScopes(signedIn.role, request.scope);
+				const membership = named ?? first;
 				const props = {
 					userId: signedIn.userId,
-					site: options.site
+					site: membership.site
 				};
 				const { redirectTo } = await oauth.completeAuthorization({
 					request,
 					userId: signedIn.userId,
-					metadata: { site: options.site },
-					scope,
+					metadata: { site: membership.site },
+					scope: grantableScopes(membership.role, request.scope),
 					props
 				});
 				return new Response(null, {
@@ -2545,7 +2664,9 @@ function installAuthorize(app, options) {
 					headers: { location: redirectTo }
 				});
 			}
-			const scopes = grantableScopes(signedIn.role, request.scope.length === 0 ? BASELINE : request.scope);
+			const choices = named !== void 0 ? [named] : signedIn.memberships;
+			const asking = request.scope.length === 0 ? BASELINE : request.scope;
+			const scopes = [...new Set(choices.flatMap((m) => grantableScopes(m.role, asking)))];
 			if (scopes.length === 0) {
 				const location = authorizationErrorRedirect(request, "access_denied", "Your role allows none of the scopes this client asked for.");
 				return new Response(null, {
@@ -2562,6 +2683,7 @@ function installAuthorize(app, options) {
 				redirectIsLoopback: details.redirectIsLoopback,
 				person: signedIn.name ?? "you",
 				scopes,
+				sites: choices.map((m) => m.site),
 				handle: consent.handle
 			}), 200, consent.headers);
 		} catch (error) {
@@ -2583,7 +2705,10 @@ function installAuthorize(app, options) {
 					headers: denied.headers
 				});
 			}
-			const scope = grantableScopes(signedIn.role, form.getAll("scope").map(String));
+			const chosen = form.get("site");
+			const membership = signedIn.memberships.find((m) => m.site === chosen);
+			if (membership === void 0) return notMember(typeof chosen === "string" ? chosen : void 0);
+			const scope = grantableScopes(membership.role, form.getAll("scope").map(String));
 			const approved = await oauth.approveConsent(c.req.raw, handle, { scope });
 			if (scope.length === 0) {
 				const location = authorizationErrorRedirect(approved.request, "access_denied", "No scope was allowed.");
@@ -2595,12 +2720,12 @@ function installAuthorize(app, options) {
 			}
 			const props = {
 				userId: signedIn.userId,
-				site: options.site
+				site: membership.site
 			};
 			const { redirectTo } = await oauth.completeAuthorization({
 				request: approved.request,
 				userId: signedIn.userId,
-				metadata: { site: options.site },
+				metadata: { site: membership.site },
 				scope,
 				props
 			});
@@ -2689,9 +2814,9 @@ function build(issuer, options) {
 			pending.get(request)?.refused(reason);
 			return null;
 		};
-		if (isPersonalToken(token)) {
+		if (isPersonalToken(token) || isReadToken(token)) {
 			const check = await checkPersonalToken(env.DB, token, {
-				site: options.site,
+				sites: options.sites,
 				now: options.clock.now()
 			});
 			if (!check.ok) return refuse(check.reason);
@@ -2709,14 +2834,15 @@ function build(issuer, options) {
 		const granted = await authorizationServer.validateToken(resource, token, env);
 		if (granted === null) return refuse("unknown");
 		if (!isGrantProps(granted.props)) return refuse("unknown");
-		if (granted.props.site !== options.site) return refuse("other_site");
-		const role = await roleOf(env.DB, options.site, granted.props.userId);
+		const site = granted.props.site;
+		if (!options.sites.has(site)) return refuse("other_site");
+		const role = await roleOf(env.DB, site, granted.props.userId);
 		if (role === null) return refuse("no_user");
 		const principal = {
 			kind: "oauth",
 			userId: granted.props.userId,
 			clientId: granted.clientId,
-			site: options.site,
+			site,
 			scopes: effectiveScopes(role, granted.scope.filter(isScope))
 		};
 		return {
@@ -2802,7 +2928,8 @@ function withRefusalBody(response, refused) {
 * nothing. A failed D1 query while the token is checked is one of those: it is never a 401.
 */
 function createGateway(options) {
-	const { site, mcp, clock, log } = options;
+	const { sites, mcp, clock, log } = options;
+	const siteKeys = new Set(sites.keys());
 	const app = new Hono();
 	/**
 	* The Worker's own context of each request. Hono hands its routes the same object under a
@@ -2815,7 +2942,7 @@ function createGateway(options) {
 		return ctx;
 	};
 	const oauth = createOAuth({
-		site: site.key,
+		sites: siteKeys,
 		clock,
 		dynamicClientRegistration: options.auth?.dynamicClientRegistration ?? false,
 		log
@@ -2824,11 +2951,11 @@ function createGateway(options) {
 	* What a write hands to the Queue: the events it committed, after the answer (ADR-025). The
 	* cron trigger's sweep catches any that this misses.
 	*/
-	const notify = (c, requestId) => (ids) => {
+	const notify = (c, requestId, site) => (ids) => {
 		c.executionCtx.waitUntil(enqueue({
 			queue: c.env.EVENTS,
 			db: connect(c.env.DB),
-			site: site.key,
+			site,
 			ids,
 			clock
 		}).catch((error) => {
@@ -2871,19 +2998,47 @@ function createGateway(options) {
 		});
 		return withRefusalBody(response, outcome.refusal !== null);
 	};
+	/** Every origin that the config of some site lets read the site from a page. */
+	const corsOrigins = new Set([...sites.values()].flatMap((site) => site.cors.origins));
+	/**
+	* The guard lets a page of such an origin through to the read API alone, and only to read: the
+	* read API then checks the origin against the site of the token.
+	*/
+	const readsFromAnyCorsOrigin = (request, origin) => {
+		const { pathname } = new URL(request.url);
+		return corsOrigins.has(origin) && [
+			"GET",
+			"HEAD",
+			"OPTIONS"
+		].includes(request.method) && pathname.startsWith("/v1/") && !pathname.startsWith("/v1/admin/");
+	};
+	/**
+	* A route for a person or their personal token: a read token reads over the read API alone, so
+	* it is refused here, before anything runs (403, as a token that lacks a scope).
+	*/
+	const protectWrites = (c, resource, proceed) => protect(c, resource, async (principal, auth) => principal.kind === "read" ? Response.json({
+		code: "forbidden",
+		message: "A read token reads published content over GET /v1, and nothing else.",
+		fix: "Use a personal token (hw_pat_) or sign in with OAuth for this."
+	}, {
+		status: 403,
+		headers: { "cache-control": "no-store" }
+	}) : proceed(principal, auth));
 	app.use("*", async (c, next) => {
 		c.set("requestId", crypto.randomUUID());
 		await next();
 	});
 	app.use("*", async (c, next) => {
-		const refusal = checkHostAndOrigin(c.req.raw, c.env.HOLLWARE_PUBLIC_URL);
+		const refusal = checkHostAndOrigin(c.req.raw, c.env.HOLLWARE_PUBLIC_URL, readsFromAnyCorsOrigin);
 		if (refusal !== null) return refusal;
 		await next();
 	});
 	app.get("/health", () => Response.json({ ok: true }, { headers: { "cache-control": "no-store" } }));
-	app.all("/mcp", async (c) => protect(c, "mcp", async (principal) => {
+	app.all("/mcp", async (c) => protectWrites(c, "mcp", async (principal) => {
 		const requestId = c.get("requestId");
 		const db = c.env.DB;
+		const site = sites.get(principal.site);
+		if (site === void 0) throw new Error(`No site ${principal.site} for a checked token`);
 		return await mcp.fetch(c.req.raw, {
 			principal,
 			requestId,
@@ -2892,7 +3047,7 @@ function createGateway(options) {
 				site,
 				store: createD1Store(db, { clock }),
 				clock,
-				notify: notify(c, requestId)
+				notify: notify(c, requestId, site.key)
 			}
 		});
 	}));
@@ -2903,37 +3058,35 @@ function createGateway(options) {
 		failed: () => void 0
 	}));
 	installAuthorize(app, {
-		site: site.key,
+		sites: siteKeys,
 		clock,
 		oauth
 	});
 	const authorizationServer = (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).authorizationServer.fetch(c.req.raw, c.env, workerContext(c));
 	app.all("/.well-known/oauth-authorization-server", authorizationServer);
 	app.all("/oauth/*", authorizationServer);
-	installIdentity(app, {
-		site: site.key,
-		clock
-	});
+	installIdentity(app, { clock });
 	installAdmin(app, { oauth });
 	installAdminApi(app, {
-		site: site.key,
+		sites: siteKeys,
 		clock,
 		oauth,
-		protect: (c, proceed) => protect(c, "v1", proceed),
+		protect: (c, proceed) => protectWrites(c, "v1", proceed),
 		metadataUrl: (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.v1
 	});
 	if (options.handlers !== void 0) installOpsApi(app, {
-		site,
+		sites,
 		handlers: options.handlers,
 		clock,
 		log,
-		protect: (c, proceed) => protect(c, "v1", proceed),
+		protect: (c, proceed) => protectWrites(c, "v1", proceed),
 		metadataUrl: (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.v1,
 		notify
 	});
 	if (options.read !== void 0) installReadApi(app, {
 		read: options.read,
-		site: site.key,
+		corsOrigins: (site) => sites.get(site)?.cors.origins ?? [],
+		anyCorsOrigin: (origin) => corsOrigins.has(origin),
 		protect: (c, proceed) => protect(c, "v1", proceed),
 		metadataUrl: (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.v1
 	});
@@ -3294,7 +3447,7 @@ const TOOLS_LIST_CACHE_HINT = {
 function authInfoOf(principal, resourceMetadataUrl) {
 	return {
 		token: "",
-		clientId: principal.kind === "token" ? principal.tokenId : principal.kind === "oauth" ? principal.clientId : principal.kind,
+		clientId: principal.kind === "token" || principal.kind === "read" ? principal.tokenId : principal.kind === "oauth" ? principal.clientId : principal.kind,
 		scopes: [...principal.scopes],
 		...resourceMetadataUrl === null ? {} : { resourceMetadataUrl }
 	};
@@ -3438,11 +3591,12 @@ const BINDING_PRINCIPAL = Object.freeze({
 	scopes: Object.freeze(["content:read"])
 });
 /**
-* The site of a call is not the site of this deployment. v0.1 serves one site, and the message
-* and the fix both say which, for a caller that only gets one of them.
+* The site of a call is none of the sites of this deployment. The message and the fix both say
+* which sites it serves, for a caller that only gets one of them.
 */
-function wrongSite(served) {
-	return new HollwareError("invalid_input", `This Hollware serves the site "${served}", not the one the call names.`, `Pass "${served}", the site this deployment serves, as the site argument.`);
+function unknownSite(site, served) {
+	const keys = [...served].map((key) => `"${key}"`).join(", ");
+	return new HollwareError("invalid_input", `This Hollware serves no site "${site}": it serves ${keys}.`, `Pass one of ${keys}, the sites this deployment serves, as the site argument.`);
 }
 /**
 * The options object of a call, without the keys that hold `undefined`, so that the handler sees
@@ -3488,7 +3642,7 @@ function forCaller(deps, requestId, method, error) {
 	return new HollwareError(known.code, known.message, known.fix);
 }
 /**
-* One call of an operation over RPC. In this order: the site is the one of this deployment, the
+* One call of an operation over RPC. In this order: the site is one of this deployment, the
 * input is built and parsed by the spec's schema, and the handler runs with
 *
 * - `view: 'published'`, so a draft is never read, and the principal `{ kind: 'binding', scopes:
@@ -3501,11 +3655,12 @@ function forCaller(deps, requestId, method, error) {
 * a call that fails never opens a session.
 */
 async function run(deps, env, method, site, schema, build, handler) {
-	if (site !== deps.site.key) throw wrongSite(deps.site.key);
+	const served = deps.sites.get(site);
+	if (served === void 0) throw unknownSite(site, deps.sites.keys());
 	const input = parseInput(schema, build());
 	const requestId = crypto.randomUUID();
 	const context = {
-		site: deps.site,
+		site: served,
 		principal: BINDING_PRINCIPAL,
 		view: "published",
 		store: createD1Store(env.DB.withSession("first-unconstrained")),
@@ -3676,7 +3831,7 @@ function writeLog(entry) {
 *
 * - the config is resolved with `resolveConfig`, so a broken `hollware.config.ts` throws its
 *   `ConfigError` here, and the Worker fails at startup with a message that says what to change.
-*   v0.1 serves the one site of the config;
+*   The deployment serves every site of the config, and a token, a grant or a call names one;
 * - the MCP endpoint, whose tool schemas are converted once, and the Hono app of the gateway,
 *   which is `fetch`: MCP at `/mcp` behind the guard and the token check, and the other routes
 *   (`http/gateway.ts`);
@@ -3689,15 +3844,14 @@ function writeLog(entry) {
 */
 function createHollwareWith(config, handlers, options = {}) {
 	const resolved = resolveConfig(config);
-	const [site] = resolved.sites.values();
-	if (site === void 0) throw new Error("The resolved config has no site, which resolveConfig never lets through");
+	const sites = resolved.sites;
 	const clock = options.clock ?? systemClock;
 	const mcp = createMcpEndpoint({
 		handlers,
 		serverInfo: SERVER_INFO,
 		log: writeLog
 	});
-	const deliveryDeps = (env) => ({
+	const deliveryDeps = (env, site) => ({
 		db: connect(env.DB),
 		site,
 		clock,
@@ -3709,12 +3863,12 @@ function createHollwareWith(config, handlers, options = {}) {
 	});
 	return {
 		fetch: createGateway({
-			site,
+			sites,
 			mcp,
 			clock,
 			log: writeLog,
 			read: (env) => createRpc({
-				site,
+				sites,
 				handlers,
 				clock,
 				log: writeLog
@@ -3723,28 +3877,37 @@ function createHollwareWith(config, handlers, options = {}) {
 			handlers
 		}),
 		scheduled: async (_controller, env, ctx) => {
-			const deps = deliveryDeps(env);
-			ctx.waitUntil(runDueSchedules({
-				site,
-				store: createD1Store(env.DB, { clock }),
-				handlers,
-				clock,
-				log: writeLog
-			}).then(() => sweepOutbox({
-				queue: env.EVENTS,
-				deps
-			})).then(() => void 0, (error) => {
-				writeLog({
-					kind: "cron_failed",
-					message: String(error)
+			const each = async (site) => {
+				await runDueSchedules({
+					site,
+					store: createD1Store(env.DB, { clock }),
+					handlers,
+					clock,
+					log: writeLog
 				});
-			}));
+				await sweepOutbox({
+					queue: env.EVENTS,
+					deps: deliveryDeps(env, site)
+				});
+			};
+			ctx.waitUntil((async () => {
+				for (const site of sites.values()) await each(site).catch((error) => {
+					writeLog({
+						kind: "cron_failed",
+						site: site.key,
+						message: String(error)
+					});
+				});
+			})());
 		},
 		queue: async (batch, env) => {
-			await consumeEvents(batch.messages, deliveryDeps(env));
+			await consumeEvents(batch.messages, (key) => {
+				const site = sites.get(key);
+				return site === void 0 ? void 0 : deliveryDeps(env, site);
+			});
 		},
 		Hollware: createEntrypoint({
-			site,
+			sites,
 			handlers,
 			clock,
 			log: writeLog