@hollware/server 0.3.0 → 0.5.0

package/dist/index.mjs

@@ -1,8 +1,8 @@
-import { A as isRole, C as revisions, D as users, E as tokens, O as ROLE_SCOPES, S as revisionTags, T as sites, _ as invitations, b as publications, g as entries, h as deliveries, k as effectiveScopes, n as createInvitation, s as findSession, v as members, w as schedules, x as reviews, y as outbox } from "./store-Sq0pwUQv.mjs";
-import { EVENT_ID_HEADER, HollwareError, OPERATIONS, SCOPES, SIGNATURE_HEADER, TIMESTAMP_HEADER, describeBuiltInContracts, describeResolvedSite, describeSite, generatePersonalToken, getEntry, getTranslations, hashPersonalToken, isPersonalToken, isScope, listEntries, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, signWebhook, sizeLimitViolation, uniqueSlugViolation, uniqueTranslationViolation } from "@hollware/core";
+import { A as ROLE_SCOPES, C as reviews, D as sites, E as schedules, M as isRole, O as tokens, S as publications, T as revisions, _ as entries, b as members, g as deliveries, j as effectiveScopes, k as users, l as membershipsOf, n as createInvitation, s as findSession, v as entryEmbeddings, w as revisionTags, x as outbox, y as invitations } from "./store-DiS8UFI2.mjs";
+import { CHUNKER_VERSION, EVENT_ID_HEADER, HollwareError, OPERATIONS, SCOPES, SIGNATURE_HEADER, TIMESTAMP_HEADER, chunksOf, describeBuiltInContracts, describeResolvedSite, describeSite, generatePersonalToken, generateReadToken, getEntry, getTranslations, hashPersonalToken, isPersonalToken, isReadToken, isScope, isSiteKey, listEntries, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, search, signWebhook, sizeLimitViolation, uniqueSlugViolation, uniqueTranslationViolation } from "@hollware/core";
 import { Hono } from "hono";
 import { drizzle } from "drizzle-orm/d1";
-import { and, desc, eq, getTableColumns, gt, inArray, isNull, lte, ne, or, sql } from "drizzle-orm";
+import { and, desc, eq, getTableColumns, gt, inArray, isNotNull, isNull, lte, ne, or, sql } from "drizzle-orm";
 import { alias } from "drizzle-orm/sqlite-core";
 import { AuthorizationError, CimdFetchError, OAuthAuthorizationServer, OAuthResourceServer, authorizationErrorRedirect } from "@cloudflare/workers-oauth-provider";
 import { getCookie } from "hono/cookie";
@@ -10,7 +10,7 @@ import { CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, McpServer, accepted
 import * as z from "zod";
 import { WorkerEntrypoint } from "cloudflare:workers";
 //#region package.json
-var version = "0.3.0";
+var version = "0.5.0";
 //#endregion
 //#region src/auth/responses.ts
 /** The challenge of every 401 and 403 (RFC 6750). */
@@ -93,7 +93,9 @@ function readPublicUrl(value) {
 *   Any other port is another host.
 * - An `Origin` header that is present and is not the origin of the public URL, scheme and port
 *   included: 403. That covers the opaque `null` origin and an empty value. A request without
-*   `Origin` passes: only browsers send it, and they are what the check is for.
+*   `Origin` passes: only browsers send it, and they are what the check is for. The one exception
+*   is `crossOrigin`: an origin it accepts passes too (the read API, for the origins a site's
+*   config lists; the read API then checks the origin against the site of the token).
 *
 * It returns the response to send, or `null` when the request may go on. No answer repeats the
 * request: the 403s say what to send instead, and the 500 only says what is missing.
@@ -103,8 +105,9 @@ function readPublicUrl(value) {
 * they accept a `Host` such as `user@cms.example.com` or `cms.example.com/x`.
 *
 * @param publicUrl The `HOLLWARE_PUBLIC_URL` variable as the environment holds it.
+* @param crossOrigin Whether a request may come from a page of another origin; never, by default.
 */
-function checkHostAndOrigin(request, publicUrl) {
+function checkHostAndOrigin(request, publicUrl, crossOrigin = () => false) {
 	const expected = readPublicUrl(publicUrl);
 	if (expected === null) return authErrorResponse(500, {
 		code: "misconfigured",
@@ -118,7 +121,7 @@ function checkHostAndOrigin(request, publicUrl) {
 		fix: `Send the request to ${expected.origin}, the public URL of this Hollware (HOLLWARE_PUBLIC_URL).`
 	});
 	const origin = request.headers.get("origin");
-	if (origin !== null && origin.toLowerCase() !== expected.origin) return authErrorResponse(403, {
+	if (origin !== null && origin.toLowerCase() !== expected.origin && !crossOrigin(request, origin)) return authErrorResponse(403, {
 		code: "forbidden_origin",
 		message: "The Origin header of the request is not the public URL of this Hollware.",
 		fix: `Call Hollware from a client that sends no Origin header, or from a page served at ${expected.origin}.`
@@ -141,14 +144,14 @@ function missingScopes(principal, required) {
 /** `last_used_at` of a token is written at most once in this time. */
 const TOUCH_INTERVAL_MS = 36e5;
 /**
-* The token with the role of its user in the token's site, by the hash of the token, in the one
-* site. A user who is no member of the site has no role there, and the token is unknown.
+* The token with the role of its user in the token's site, by the hash of the token, in the
+* deployment. A user who is no member of the site has no role there, and the token is unknown.
 */
 const LOOKUP = `SELECT t.id AS token_id, t.site_id AS site_id, t.user_id AS user_id,
-    t.scopes AS scopes, t.expires_at AS expires_at, t.revoked_at AS revoked_at,
+    t.kind AS kind, t.scopes AS scopes, t.expires_at AS expires_at, t.revoked_at AS revoked_at,
     t.last_used_at AS last_used_at, m.role AS role
   FROM tokens AS t JOIN members AS m ON m.user_id = t.user_id AND m.site_id = t.site_id
-  WHERE t.hash = ?1 AND t.site_id = ?2`;
+  WHERE t.hash = ?1`;
 /**
 * The scopes a token carries, from the JSON array the `tokens` table stores. Anything that is not
 * one of the scopes is left out, and a value that is not an array of scopes has none: a token
@@ -193,12 +196,12 @@ async function recordTokenUse(db, token, now) {
 	}
 }
 /**
-* Authenticates a personal token (ADR-019). A string without the shape of a token is `unknown`
-* without a query. Otherwise one query finds the token by the hash of the whole string, in this
-* site only, together with the role of its user; the answer is, in this order:
+* Authenticates a personal token (ADR-019) or a read token. A string without the shape of either
+* is `unknown` without a query. Otherwise one query finds the token by the hash of the whole
+* string, together with the role of its user in the token's site; the answer is, in this order:
 *
-* - `unknown`: no such token in this site. A token of another site is the same as no token, and
-*   nothing says it exists elsewhere.
+* - `unknown`: no such token in the sites of this deployment. A token of another site is the same as
+*   no token, and nothing says it exists elsewhere.
 * - `revoked`: it has a revocation date, whatever the date says: it is never read, so a clock that
 *   runs ahead of the Worker's, where the token was revoked, cannot keep it alive for a while.
 * - `expired`: its expiry is now or past (see `hasExpired`).
@@ -211,12 +214,13 @@ async function recordTokenUse(db, token, now) {
 * must never read that as a valid token.
 */
 async function checkPersonalToken(db, token, options) {
-	if (!isPersonalToken(token)) return {
+	const kind = isPersonalToken(token) ? "personal" : isReadToken(token) ? "read" : null;
+	if (kind === null) return {
 		ok: false,
 		reason: "unknown"
 	};
-	const row = await db.prepare(LOOKUP).bind(await hashPersonalToken(token), options.site).first();
-	if (row === null) return {
+	const row = await db.prepare(LOOKUP).bind(await hashPersonalToken(token)).first();
+	if (row === null || row.kind !== kind || !options.sites.has(row.site_id)) return {
 		ok: false,
 		reason: "unknown"
 	};
@@ -229,14 +233,22 @@ async function checkPersonalToken(db, token, options) {
 		reason: "expired"
 	};
 	const recent = row.last_used_at !== null && row.last_used_at >= anHourBefore(options.now);
+	const scopes = effectiveScopes(row.role, parseTokenScopes(row.scopes));
+	const identity = {
+		userId: row.user_id,
+		tokenId: row.token_id,
+		site: row.site_id
+	};
 	return {
 		ok: true,
-		principal: {
+		principal: kind === "read" ? {
+			kind: "read",
+			...identity,
+			scopes: scopes.filter((scope) => scope === "content:read")
+		} : {
 			kind: "token",
-			userId: row.user_id,
-			tokenId: row.token_id,
-			site: row.site_id,
-			scopes: effectiveScopes(row.role, parseTokenScopes(row.scopes))
+			...identity,
+			scopes
 		},
 		touch: recent ? null : recordTokenUse(db, {
 			id: row.token_id,
@@ -620,6 +632,61 @@ function listEntriesQuery(db, site, query, cursor) {
 		cursor === null ? void 0 : sql`(${sortKey}, ${entries.id}) < (${cursor.key}, ${cursor.id})`
 	]).orderBy(desc(sortKey), desc(entries.id)).limit(query.limit + 1);
 }
+/**
+* The FTS5 query of what someone typed: each of its words as a quoted string, so that FTS5's own
+* syntax (`AND`, `NEAR`, `*`, quotes) is never read from it, and every word must match. Empty when
+* it holds no word.
+*/
+function ftsQuery(text) {
+	return (text.match(/[\p{L}\p{N}_]+/gu) ?? []).map((word) => `"${word}"`).join(" ");
+}
+/** The weights of the columns of `entries_fts` in bm25: title, tags, then the text. */
+const BM25 = sql.raw("bm25(entries_fts, 10.0, 4.0, 1.0)");
+async function searchEntries(db, site, query) {
+	const match = ftsQuery(query.text);
+	if (match === "") return [];
+	const hits = await db.all(sql`
+    select entry_id, snippet(entries_fts, 2, '[', ']', '…', 16) as snippet, ${BM25} as rank
+    from entries_fts
+    where entries_fts match ${match} and site_id = ${site}
+      ${query.collection === void 0 ? sql`` : sql`and collection = ${query.collection}`}
+      ${query.locale === void 0 ? sql`` : sql`and locale = ${query.locale}`}
+    order by rank
+    limit ${query.limit}
+  `);
+	if (hits.length === 0) return [];
+	const rows = await summaryQuery(db, "published", [eq(entries.siteId, site), inArray(entries.id, hits.map((hit) => hit.entry_id))]);
+	const byId = new Map(rows.map((row) => [row.entry.id, toEntrySummaryView(row)]));
+	return hits.flatMap((hit) => {
+		const entry = byId.get(hit.entry_id);
+		return entry === void 0 ? [] : [{
+			entry,
+			snippet: hit.snippet,
+			score: -hit.rank
+		}];
+	});
+}
+/** The entries of those ids that the view has, in the order of the ids; the others are left out. */
+async function findSummaries(db, site, ids, view) {
+	if (ids.length === 0) return [];
+	const rows = await summaryQuery(db, view, [eq(entries.siteId, site), inArray(entries.id, [...ids])]);
+	const byId = new Map(rows.map((row) => [row.entry.id, toEntrySummaryView(row)]));
+	return ids.flatMap((id) => {
+		const entry = byId.get(id);
+		return entry === void 0 ? [] : [entry];
+	});
+}
+/** The entries closest to one, closest first, as its vectors found them (ADR-030); `[]` without. */
+async function relatedOf(db, site, entryId) {
+	const [row] = await db.select({ related: entryEmbeddings.related }).from(entryEmbeddings).where(and(eq(entryEmbeddings.siteId, site), eq(entryEmbeddings.entryId, entryId))).limit(1);
+	if (row === void 0) return [];
+	const parsed = JSON.parse(row.related);
+	if (!Array.isArray(parsed)) return [];
+	return parsed.flatMap((item) => typeof item === "object" && item !== null && "id" in item && "score" in item && typeof item.id === "string" && typeof item.score === "number" ? [{
+		id: item.id,
+		score: item.score
+	}] : []);
+}
 async function listEntries$2(db, site, query) {
 	if (!Number.isInteger(query.limit) || query.limit < 1) throw new HollwareError("invalid_input", `The limit ${query.limit} is not a whole number of at least 1.`, "Ask for at least one entry per page.");
 	const cursor = query.cursor === void 0 ? null : decodeCursor(query.cursor, query.view);
@@ -1430,6 +1497,9 @@ function createD1Store(db, options = {}) {
 		findEntry: (site, ref, view) => findEntry(database, site, ref, view),
 		findEntryById: (site, id, view) => findEntryById(database, site, id, view),
 		listEntries: (site, query) => listEntries$2(database, site, query),
+		searchEntries: (site, query) => searchEntries(database, site, query),
+		findSummaries: (site, ids, view) => findSummaries(database, site, ids, view),
+		relatedOf: (site, entryId) => relatedOf(database, site, entryId),
 		listTranslations: (site, collection, translationGroup, view) => listTranslations(database, site, collection, translationGroup, view),
 		lookup: (site) => lookup(database, site),
 		lastPublication: (site, entryId) => lastPublication(database, site, entryId),
@@ -1503,6 +1573,191 @@ function sqlIncrement() {
 	return sql`${deliveries.attempts} + 1`;
 }
 //#endregion
+//#region src/semantic/index-entry.ts
+/** The id of a piece's vector. */
+function vectorId(entryId, piece) {
+	return `${entryId}:${piece}`;
+}
+function excerptOf(text) {
+	if (text.length <= 200) return text;
+	const cut = text.slice(0, 200);
+	const lastSpace = cut.lastIndexOf(" ");
+	return `${(lastSpace > 0 ? cut.slice(0, lastSpace) : cut).trim()}…`;
+}
+function stringOf(value) {
+	return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+/** The ids of the vectors of `pieces` pieces of an entry, from `from` on. */
+function idsOf(entryId, from, pieces) {
+	return Array.from({ length: Math.max(0, pieces - from) }, (_, offset) => vectorId(entryId, from + offset));
+}
+/** The entries nearest to an entry's summary, in its collection and locale; itself left out. */
+async function nearestTo(semantic, input) {
+	return (await semantic.index.query(input.summary, {
+		topK: 6,
+		site: input.site,
+		collection: input.collection,
+		locale: input.locale,
+		summariesOnly: true
+	})).filter((match) => match.metadata.entry !== input.entryId).slice(0, 5).map((match) => ({
+		id: match.metadata.entry,
+		score: match.score
+	}));
+}
+/**
+* Brings the vectors of one entry in line with what it has published: the pieces of its published
+* revision, embedded with the model of `semantic`. It reads the entry as it is now, so it is right
+* whichever event called it and however late: an entry whose vectors already are of its published
+* revision, model and chunker is `current` and costs no embedding; an entry with nothing published
+* (unpublished, deleted, gone) loses its vectors and its row.
+*/
+async function syncEntryVectors(db, semantic, input) {
+	const { site, entryId, now } = input;
+	const [published] = await db.select({
+		collection: entries.collection,
+		locale: entries.locale,
+		revisionId: revisions.id,
+		frontmatter: revisions.frontmatter,
+		document: revisions.document
+	}).from(entries).innerJoin(revisions, and(eq(revisions.id, entries.publishedRev), eq(revisions.siteId, entries.siteId))).where(and(eq(entries.siteId, site), eq(entries.id, entryId))).limit(1);
+	const [stored] = await db.select({
+		revisionId: entryEmbeddings.revisionId,
+		model: entryEmbeddings.model,
+		chunkerVersion: entryEmbeddings.chunkerVersion,
+		pieces: entryEmbeddings.pieces
+	}).from(entryEmbeddings).where(and(eq(entryEmbeddings.siteId, site), eq(entryEmbeddings.entryId, entryId))).limit(1);
+	if (published === void 0) {
+		if (stored === void 0) return "absent";
+		await semantic.index.remove(idsOf(entryId, 0, stored.pieces));
+		await db.delete(entryEmbeddings).where(and(eq(entryEmbeddings.siteId, site), eq(entryEmbeddings.entryId, entryId)));
+		return "removed";
+	}
+	if (stored !== void 0 && stored.revisionId === published.revisionId && stored.model === semantic.embedder.model && stored.chunkerVersion === CHUNKER_VERSION) return "current";
+	const frontmatter = JSON.parse(published.frontmatter);
+	const document = JSON.parse(published.document);
+	const description = stringOf(frontmatter["description"]);
+	const chunks = chunksOf({
+		title: stringOf(frontmatter["title"]) ?? "",
+		...description === void 0 ? {} : { description },
+		document
+	});
+	const vectors = await semantic.embedder.embed(chunks.map((chunk) => chunk.text));
+	await semantic.index.upsert(chunks.map((chunk) => ({
+		id: vectorId(entryId, chunk.index),
+		values: vectors[chunk.index] ?? [],
+		metadata: {
+			site,
+			entry: entryId,
+			collection: published.collection,
+			locale: published.locale,
+			piece: chunk.index,
+			excerpt: excerptOf(chunk.text)
+		}
+	})));
+	if (stored !== void 0) await semantic.index.remove(idsOf(entryId, chunks.length, stored.pieces));
+	const related = await nearestTo(semantic, {
+		site,
+		entryId,
+		collection: published.collection,
+		locale: published.locale,
+		summary: vectors[0] ?? []
+	});
+	const row = {
+		related: JSON.stringify(related),
+		revisionId: published.revisionId,
+		model: semantic.embedder.model,
+		chunkerVersion: CHUNKER_VERSION,
+		pieces: chunks.length,
+		updatedAt: now
+	};
+	await db.insert(entryEmbeddings).values({
+		id: newId("emb"),
+		siteId: site,
+		entryId,
+		createdAt: now,
+		...row
+	}).onConflictDoUpdate({
+		target: [entryEmbeddings.siteId, entryEmbeddings.entryId],
+		set: row
+	});
+	return "indexed";
+}
+/**
+* The entries whose vectors are not those of what they publish: published with no vectors (before
+* the Worker had semantic search, or an event that never reached the subscriber), of another
+* revision, model or chunker; and entries with vectors and nothing published. At most `limit`.
+*/
+async function staleEntries(db, input) {
+	const { site, model, limit } = input;
+	const published = await db.select({ id: entries.id }).from(entries).leftJoin(entryEmbeddings, and(eq(entryEmbeddings.entryId, entries.id), eq(entryEmbeddings.siteId, entries.siteId))).where(and(eq(entries.siteId, site), isNotNull(entries.publishedRev), or(isNull(entryEmbeddings.id), ne(entryEmbeddings.revisionId, entries.publishedRev), ne(entryEmbeddings.model, model), ne(entryEmbeddings.chunkerVersion, CHUNKER_VERSION)))).limit(limit);
+	const left = limit - published.length;
+	const orphans = left <= 0 ? [] : await db.select({ id: entryEmbeddings.entryId }).from(entryEmbeddings).innerJoin(entries, and(eq(entries.id, entryEmbeddings.entryId), eq(entries.siteId, entryEmbeddings.siteId))).where(and(eq(entryEmbeddings.siteId, site), isNull(entries.publishedRev))).limit(left);
+	return [...published, ...orphans].map((row) => row.id);
+}
+/**
+* What the cron trigger does for the vectors of a site: brings at most `limit` stale entries in
+* line, so that a site that turns semantic search on, or changes its model, is indexed a few
+* entries a minute without a command. An entry that fails is left for the next run.
+*/
+async function healVectors(db, semantic, input) {
+	const ids = await staleEntries(db, {
+		site: input.site,
+		model: semantic.embedder.model,
+		limit: input.limit ?? 20
+	});
+	let failed = 0;
+	for (const entryId of ids) await syncEntryVectors(db, semantic, {
+		site: input.site,
+		entryId,
+		now: input.now
+	}).catch(() => {
+		failed += 1;
+	});
+	return {
+		synced: ids.length - failed,
+		failed
+	};
+}
+/** How long an entry with no related entries waits before they are looked for again. */
+const RELATED_RETRY_MS = 6e5;
+/** How old the related entries of an entry may grow before they are looked for again. */
+const RELATED_REFRESH_MS = 864e5;
+/**
+* What the cron trigger does for related entries: it finds them again for at most `limit`
+* entries of the site, oldest first, whose related entries are a day old, or empty for ten
+* minutes. Vectorize shows a vector seconds after it was written, so entries indexed together
+* miss each other at first; and an entry published later belongs among the related entries of
+* those before it. Each keeps its vectors: only its summary is read back and compared.
+*/
+async function refreshRelated(db, semantic, input) {
+	const now = Date.parse(input.now);
+	const retryBefore = (/* @__PURE__ */ new Date(now - RELATED_RETRY_MS)).toISOString();
+	const refreshBefore = (/* @__PURE__ */ new Date(now - RELATED_REFRESH_MS)).toISOString();
+	const rows = await db.select({
+		entryId: entryEmbeddings.entryId,
+		collection: entries.collection,
+		locale: entries.locale
+	}).from(entryEmbeddings).innerJoin(entries, and(eq(entries.id, entryEmbeddings.entryId), eq(entries.siteId, entryEmbeddings.siteId))).where(and(eq(entryEmbeddings.siteId, input.site), isNotNull(entries.publishedRev), or(and(eq(entryEmbeddings.related, "[]"), lte(entryEmbeddings.updatedAt, retryBefore)), lte(entryEmbeddings.updatedAt, refreshBefore)))).orderBy(entryEmbeddings.updatedAt).limit(input.limit ?? 10);
+	if (rows.length === 0) return 0;
+	const summaries = new Map((await semantic.index.get(rows.map((row) => vectorId(row.entryId, 0)))).map((vector) => [vector.id, vector.values]));
+	let refreshed = 0;
+	for (const row of rows) {
+		const summary = summaries.get(vectorId(row.entryId, 0));
+		if (summary === void 0) continue;
+		const related = await nearestTo(semantic, {
+			site: input.site,
+			...row,
+			summary
+		});
+		await db.update(entryEmbeddings).set({
+			related: JSON.stringify(related),
+			updatedAt: input.now
+		}).where(and(eq(entryEmbeddings.siteId, input.site), eq(entryEmbeddings.entryId, row.entryId)));
+		refreshed += 1;
+	}
+	return refreshed;
+}
+//#endregion
 //#region src/events/deliver.ts
 /** Where IndexNow takes the URLs that changed. */
 const INDEXNOW_ENDPOINT = "https://api.indexnow.org/indexnow";
@@ -1554,6 +1809,17 @@ function subscribersOf(deps) {
 			}
 		});
 	}
+	const semantic = deps.semantic;
+	if (semantic !== void 0 && semantic !== null) subscribers.push({
+		name: "vectors",
+		async send(payload) {
+			await syncEntryVectors(deps.db, semantic, {
+				site: site.key,
+				entryId: payload.entry.id,
+				now: deps.clock.now().toISOString()
+			});
+		}
+	});
 	return subscribers;
 }
 /**
@@ -1636,12 +1902,14 @@ function isEventMessage(body) {
 /**
 * The Queue consumer: delivers each event, acknowledges it once every subscriber has it, and asks
 * for a retry otherwise; after the Queue's retries it lands in the dead-letter queue. A message of
-* another site, or that is no event, is acknowledged and dropped.
+* a site this deployment does not serve (`depsOf` has none for it), or that is no event, is
+* acknowledged and dropped.
 */
-async function consumeEvents(messages, deps) {
+async function consumeEvents(messages, depsOf) {
 	for (const message of messages) {
 		const { body } = message;
-		if (!isEventMessage(body) || body.site !== deps.site.key) {
+		const deps = isEventMessage(body) ? depsOf(body.site) : void 0;
+		if (!isEventMessage(body) || deps === void 0) {
 			message.ack();
 			continue;
 		}
@@ -1849,7 +2117,8 @@ function installAdmin(app, options) {
 //#region src/http/admin-api.ts
 /**
 * What only a person in the admin may do (ADR-026): see, make and revoke personal tokens, and
-* invite people. These are no operations, so no agent sees them over MCP, and a request needs an
+* invite people, on the site of their token; and learn who they are and which sites they may switch
+* to (`/v1/admin/me`, the one route for every role). These are no operations, so no agent sees them over MCP, and a request needs an
 * access token of the admin's own client with `schema:admin`: a personal token, or a token of
 * another client, never reaches them, even an owner's. A leaked token cannot mint the next one.
 */
@@ -1882,20 +2151,38 @@ function daysFrom(value, fallback) {
 	return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 365 ? value : null;
 }
 function installAdminApi(app, options) {
-	/** Runs `handle` for a person in the admin with `schema:admin`; anyone else is refused. */
-	const admin = (handle) => (c) => options.protect(c, async (principal) => {
+	/**
+	* Runs `handle` for a person in the admin with `schema:admin`, or with any scope when `anyone`;
+	* anyone else is refused.
+	*/
+	const admin = (handle, { anyone = false } = {}) => (c) => options.protect(c, async (principal) => {
 		const ours = (await adminClient(options.oauth(c.env.HOLLWARE_PUBLIC_URL), c.env)).clientId;
 		if (principal.kind !== "oauth" || principal.clientId !== ours) return refused("Only the admin may do this.", "Sign in to the admin at /admin/ and do it there.", 403);
-		if (!principal.scopes.includes("schema:admin")) return insufficientScope(["schema:admin"], options.metadataUrl(c));
+		if (!anyone && !principal.scopes.includes("schema:admin")) return insufficientScope(["schema:admin"], options.metadataUrl(c));
 		return handle(c, principal);
 	});
 	const body = async (c) => {
 		const value = await c.req.json().catch(() => null);
 		return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : {};
 	};
-	app.get("/v1/admin/tokens", admin(async (c) => {
+	app.get("/v1/admin/me", admin(async (c, person) => {
+		const db = connect(c.env.DB);
+		const [user] = await db.select({
+			id: users.id,
+			name: users.name
+		}).from(users).where(eq(users.id, person.userId));
+		const sites = (await membershipsOf(db, person.userId)).filter((membership) => options.sites.has(membership.site));
+		return json$1({
+			user,
+			site: person.site,
+			scopes: person.scopes,
+			sites
+		});
+	}, { anyone: true }));
+	app.get("/v1/admin/tokens", admin(async (c, person) => {
 		return json$1({ tokens: (await connect(c.env.DB).select({
 			id: tokens.id,
+			kind: tokens.kind,
 			label: tokens.label,
 			scopes: tokens.scopes,
 			user: users.name,
@@ -1903,7 +2190,7 @@ function installAdminApi(app, options) {
 			revokedAt: tokens.revokedAt,
 			lastUsedAt: tokens.lastUsedAt,
 			createdAt: tokens.createdAt
-		}).from(tokens).innerJoin(users, eq(users.id, tokens.userId)).where(eq(tokens.siteId, options.site)).orderBy(desc(tokens.createdAt), desc(tokens.id))).map((row) => ({
+		}).from(tokens).innerJoin(users, eq(users.id, tokens.userId)).where(eq(tokens.siteId, person.site)).orderBy(desc(tokens.createdAt), desc(tokens.id))).map((row) => ({
 			...row,
 			scopes: parseScopes(row.scopes)
 		})) });
@@ -1912,16 +2199,20 @@ function installAdminApi(app, options) {
 		const input = await body(c);
 		const label = typeof input["label"] === "string" ? input["label"].trim() : "";
 		if (label === "" || label.length > 100) return refused("A token needs a label of 1 to 100 characters.", "Say what the token is for.");
-		const asked = Array.isArray(input["scopes"]) ? input["scopes"].filter((s) => typeof s === "string") : [];
+		const asKind = input["kind"];
+		const kind = asKind === void 0 || asKind === "personal" ? "personal" : asKind === "read" ? "read" : null;
+		if (kind === null) return refused("kind is \"personal\" or \"read\".", "Leave it out for a personal token; \"read\" makes a token that reads published content.");
+		const asked = kind === "read" ? ["content:read"] : Array.isArray(input["scopes"]) ? input["scopes"].filter((s) => typeof s === "string") : [];
 		const scopes = person.scopes.filter((scope) => asked.includes(scope));
 		if (scopes.length === 0) return refused("A token needs at least one scope that you have.", `Choose among ${person.scopes.join(", ")}.`);
 		const days = daysFrom(input["expiresInDays"], TOKEN_DAYS);
 		if (days === null) return refused("expiresInDays is a whole number from 1 to 365.", "Leave it out for 90 days.");
 		const now = options.clock.now();
-		const secret = generatePersonalToken();
+		const secret = kind === "read" ? generateReadToken() : generatePersonalToken();
 		const row = {
 			id: newId("tok"),
-			siteId: options.site,
+			kind,
+			siteId: person.site,
 			userId: person.userId,
 			label,
 			hash: await hashPersonalToken(secret),
@@ -1935,20 +2226,21 @@ function installAdminApi(app, options) {
 		await connect(c.env.DB).insert(tokens).values(row);
 		return json$1({
 			id: row.id,
+			kind,
 			label,
 			scopes,
 			expiresAt: row.expiresAt,
 			secret
 		}, 201);
 	}));
-	app.post("/v1/admin/tokens/:id/revoke", admin(async (c) => {
+	app.post("/v1/admin/tokens/:id/revoke", admin(async (c, person) => {
 		const now = options.clock.now().toISOString();
 		const db = connect(c.env.DB);
 		const id = c.req.param("id") ?? "";
 		const [revoked] = await db.update(tokens).set({
 			revokedAt: now,
 			updatedAt: now
-		}).where(and(eq(tokens.siteId, options.site), eq(tokens.id, id), isNull(tokens.revokedAt))).returning({ id: tokens.id });
+		}).where(and(eq(tokens.siteId, person.site), eq(tokens.id, id), isNull(tokens.revokedAt))).returning({ id: tokens.id });
 		if (revoked !== void 0) return json$1({
 			id: revoked.id,
 			revokedAt: now
@@ -1956,13 +2248,13 @@ function installAdminApi(app, options) {
 		const [row] = await db.select({
 			id: tokens.id,
 			revokedAt: tokens.revokedAt
-		}).from(tokens).where(and(eq(tokens.siteId, options.site), eq(tokens.id, id)));
+		}).from(tokens).where(and(eq(tokens.siteId, person.site), eq(tokens.id, id)));
 		return row === void 0 ? refused("There is no such token.", "List the tokens and pick one of them.", 404) : json$1({
 			id: row.id,
 			revokedAt: row.revokedAt
 		});
 	}));
-	app.get("/v1/admin/people", admin(async (c) => {
+	app.get("/v1/admin/people", admin(async (c, person) => {
 		const db = connect(c.env.DB);
 		const now = options.clock.now().toISOString();
 		return json$1({
@@ -1971,22 +2263,22 @@ function installAdminApi(app, options) {
 				name: users.name,
 				role: members.role,
 				since: members.createdAt
-			}).from(members).innerJoin(users, eq(users.id, members.userId)).where(eq(members.siteId, options.site)).orderBy(members.createdAt, users.id),
+			}).from(members).innerJoin(users, eq(users.id, members.userId)).where(eq(members.siteId, person.site)).orderBy(members.createdAt, users.id),
 			invitations: await db.select({
 				id: invitations.id,
 				role: invitations.role,
 				expiresAt: invitations.expiresAt
-			}).from(invitations).where(and(eq(invitations.siteId, options.site), isNull(invitations.usedAt), isNull(invitations.userId), gt(invitations.expiresAt, now))).orderBy(desc(invitations.createdAt))
+			}).from(invitations).where(and(eq(invitations.siteId, person.site), isNull(invitations.usedAt), isNull(invitations.userId), gt(invitations.expiresAt, now))).orderBy(desc(invitations.createdAt))
 		});
 	}));
-	app.post("/v1/admin/invitations", admin(async (c) => {
+	app.post("/v1/admin/invitations", admin(async (c, person) => {
 		const input = await body(c);
 		const role = input["role"];
 		if (typeof role !== "string" || !isRole(role) || role === "owner") return refused("An invitation is for an editor or an author.", `Use role "editor" (${ROLE_SCOPES.editor.join(", ")}) or "author" (${ROLE_SCOPES.author.join(", ")}).`);
 		const days = daysFrom(input["days"], INVITATION_DAYS);
 		if (days === null) return refused("days is a whole number from 1 to 365.", "Leave it out for 7 days.");
 		const made = await createInvitation(connect(c.env.DB), {
-			site: options.site,
+			site: person.site,
 			role,
 			userId: null,
 			now: options.clock.now(),
@@ -2002,6 +2294,197 @@ function installAdminApi(app, options) {
 	}));
 }
 //#endregion
+//#region src/semantic/cloudflare.ts
+/** The embedding model when the config names none: multilingual, so Spanish finds English. */
+const DEFAULT_EMBEDDING_MODEL = "@cf/baai/bge-m3";
+function isRecord$3(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Workers AI as an embedder: `{ data: number[][] }` for a batch of texts. */
+function workersAiEmbedder(ai, model) {
+	return {
+		model,
+		async embed(texts) {
+			if (texts.length === 0) return [];
+			const answer = await ai.run(model, { text: [...texts] });
+			const data = isRecord$3(answer) ? answer["data"] : void 0;
+			if (!Array.isArray(data) || data.length !== texts.length) throw new Error(`${model} answered no vector for each of ${texts.length} texts`);
+			return data.map((vector) => {
+				if (!Array.isArray(vector)) throw new Error(`${model} answered a vector that is no list`);
+				return vector.map(Number);
+			});
+		}
+	};
+}
+function metadataOf(raw) {
+	if (raw === void 0) return null;
+	const { site, entry, collection, locale, piece, excerpt } = raw;
+	if (typeof excerpt !== "string" || typeof site !== "string" || typeof entry !== "string" || typeof collection !== "string" || typeof locale !== "string" || typeof piece !== "number") return null;
+	return {
+		site,
+		entry,
+		collection,
+		locale,
+		piece,
+		excerpt
+	};
+}
+/** Vectorize as the index. Its metadata indexes on site, collection, locale and piece filter. */
+function vectorizeIndex(binding) {
+	return {
+		async upsert(vectors) {
+			if (vectors.length === 0) return;
+			await binding.upsert(vectors.map((vector) => ({
+				id: vector.id,
+				values: [...vector.values],
+				metadata: { ...vector.metadata }
+			})));
+		},
+		async remove(ids) {
+			if (ids.length > 0) await binding.deleteByIds([...ids]);
+		},
+		async get(ids) {
+			if (ids.length === 0) return [];
+			return (await binding.getByIds([...ids])).map((vector) => ({
+				id: vector.id,
+				values: Array.from(vector.values)
+			}));
+		},
+		async query(values, options) {
+			return (await binding.query([...values], {
+				topK: options.topK,
+				returnMetadata: "all",
+				filter: {
+					site: options.site,
+					...options.collection === void 0 ? {} : { collection: options.collection },
+					...options.locale === void 0 ? {} : { locale: options.locale },
+					...options.summariesOnly === true ? { piece: 0 } : {}
+				}
+			})).matches.flatMap((match) => {
+				const metadata = metadataOf(match.metadata);
+				return metadata === null ? [] : [{
+					id: match.id,
+					score: match.score,
+					metadata
+				}];
+			});
+		}
+	};
+}
+/** Semantic search over the Worker's bindings, or `null` when it does not have both. */
+function semanticOf(env, model) {
+	const ai = Reflect.get(env, "AI");
+	const vectorize = Reflect.get(env, "VECTORIZE");
+	if (!isRecord$3(ai) || typeof ai["run"] !== "function") return null;
+	if (!isRecord$3(vectorize) || typeof vectorize["query"] !== "function") return null;
+	return {
+		embedder: workersAiEmbedder(ai, model),
+		index: vectorizeIndex(vectorize)
+	};
+}
+/**
+* Semantic search over the Worker's bindings, or `null` without them. The model is the variable
+* `HOLLWARE_EMBEDDING_MODEL`, or `DEFAULT_EMBEDDING_MODEL`; the Vectorize index must have been
+* made for its dimensions, so a new model needs a new index.
+*/
+function semanticOfEnv(env) {
+	const model = Reflect.get(env, "HOLLWARE_EMBEDDING_MODEL");
+	return semanticOf(env, typeof model === "string" && model !== "" ? model : DEFAULT_EMBEDDING_MODEL);
+}
+//#endregion
+//#region src/analytics/cloudflare.ts
+/** The dataset of Analytics Engine when the Worker names none. */
+const DEFAULT_ANALYTICS_DATASET = "hollware_page_views";
+/** Where the SQL API of Analytics Engine answers. */
+function sqlApiUrl(accountId) {
+	return `https://api.cloudflare.com/client/v4/accounts/${accountId}/analytics_engine/sql`;
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Analytics Engine as the writer: one data point per view, indexed by the site (its sampling key),
+* with the path and the country as blobs and a count of 1.
+*/
+function analyticsEngineWriter(binding) {
+	return { record(view) {
+		binding.writeDataPoint({
+			indexes: [view.site],
+			blobs: [view.path, view.country],
+			doubles: [1]
+		});
+	} };
+}
+/**
+* The query of the most read paths. The SQL API takes no parameters, so every value in it is
+* checked first: a site key (`[a-z0-9-]`), a dataset name and two whole numbers.
+*/
+function topPagesSql(dataset, site, query) {
+	if (!/^[a-z_][a-z0-9_]{0,63}$/i.test(dataset)) throw new Error(`No dataset is named ${dataset}`);
+	if (!isSiteKey(site)) throw new Error(`No site key is ${String(site)}`);
+	if (!Number.isInteger(query.days) || query.days < 1 || query.days > 90) throw new Error(`${query.days} days is not a whole number from 1 to 90`);
+	if (!Number.isInteger(query.limit) || query.limit < 1 || query.limit > 50) throw new Error(`${query.limit} pages is not a whole number from 1 to 50`);
+	return [
+		"SELECT blob1 AS path, SUM(_sample_interval) AS views",
+		`FROM ${dataset}`,
+		`WHERE index1 = '${site}' AND timestamp > NOW() - INTERVAL '${query.days}' DAY`,
+		"GROUP BY path",
+		"ORDER BY views DESC",
+		`LIMIT ${query.limit}`,
+		"FORMAT JSON"
+	].join(" ");
+}
+/** The SQL API of Analytics Engine as the reader, its answers kept for ten minutes. */
+function sqlApiReader(options) {
+	return { async topPages(site, query) {
+		const sql = topPagesSql(options.dataset, site, query);
+		const key = new Request(`https://hollware.invalid/content-stats/${options.dataset}/${site}?days=${query.days}&limit=${query.limit}`);
+		const cached = await options.cache?.match(key);
+		const answer = cached ?? await options.fetch(new Request(sqlApiUrl(options.accountId), {
+			method: "POST",
+			headers: { authorization: `Bearer ${options.token}` },
+			body: sql
+		}));
+		if (!answer.ok) throw new Error(`The SQL API of Analytics Engine answered ${answer.status}`);
+		const text = await answer.text();
+		if (cached === void 0 && options.cache !== null) await options.cache.put(key, new Response(text, { headers: { "cache-control": `max-age=600` } }));
+		const body = JSON.parse(text);
+		return (isRecord$2(body) && Array.isArray(body["data"]) ? body["data"] : []).flatMap((row) => {
+			if (!isRecord$2(row) || typeof row["path"] !== "string") return [];
+			const views = Number(row["views"]);
+			return Number.isFinite(views) ? [{
+				path: row["path"],
+				views
+			}] : [];
+		});
+	} };
+}
+/** The writer over the Worker's `ANALYTICS` binding, or `null` without one. */
+function analyticsWriterOf(env) {
+	const binding = Reflect.get(env, "ANALYTICS");
+	if (!isRecord$2(binding) || typeof binding["writeDataPoint"] !== "function") return null;
+	return analyticsEngineWriter(binding);
+}
+/**
+* The reader over the Worker's variables: `HOLLWARE_ANALYTICS_ACCOUNT_ID` and the secret
+* `HOLLWARE_ANALYTICS_TOKEN` (an API token with Account Analytics Read), and the dataset of
+* `HOLLWARE_ANALYTICS_DATASET` or the default one. `null` without the account or the token.
+*/
+function analyticsReaderOf(env) {
+	const accountId = Reflect.get(env, "HOLLWARE_ANALYTICS_ACCOUNT_ID");
+	const token = Reflect.get(env, "HOLLWARE_ANALYTICS_TOKEN");
+	const dataset = Reflect.get(env, "HOLLWARE_ANALYTICS_DATASET");
+	if (typeof accountId !== "string" || accountId === "") return null;
+	if (typeof token !== "string" || token === "") return null;
+	return sqlApiReader({
+		accountId,
+		token,
+		dataset: typeof dataset === "string" && dataset !== "" ? dataset : DEFAULT_ANALYTICS_DATASET,
+		fetch: (request) => fetch(request),
+		cache: typeof caches === "undefined" ? null : caches.default
+	});
+}
+//#endregion
 //#region src/http/ops-api.ts
 const STATUS$1 = {
 	invalid_input: 400,
@@ -2041,15 +2524,19 @@ function installOpsApi(app, options) {
 				fix: "Send the input of the operation as its input schema describes it."
 			}, 400);
 		}
+		const site = options.sites.get(principal.site);
+		if (site === void 0) throw new Error(`No site ${principal.site} for a checked token`);
 		const context = {
-			site: options.site,
+			site,
 			principal,
 			view: "head",
 			store: createD1Store(c.env.DB, { clock: options.clock }),
 			clock: options.clock,
 			client: { name: "hollware-admin" },
 			requestId,
-			notify: options.notify(c, requestId)
+			notify: options.notify(c, requestId, site.key),
+			semantic: semanticOfEnv(c.env),
+			analytics: analyticsReaderOf(c.env)
 		};
 		try {
 			return json(spec.output.parse(await invoke$1(options.handlers, spec, parsed.data, context)));
@@ -2076,11 +2563,44 @@ function installOpsApi(app, options) {
 }
 //#endregion
 //#region src/http/read-api.ts
+/** How long a browser keeps the answer of a preflight, in seconds. */
+const PREFLIGHT_MAX_AGE = 600;
+/** The origin of a request from a page of another origin than Hollware's own, or `null`. */
+function crossOriginOf(c) {
+	const origin = c.req.header("origin");
+	if (origin === void 0) return null;
+	return origin.toLowerCase() === new URL(c.env.HOLLWARE_PUBLIC_URL).origin ? null : origin;
+}
 const STATUS = {
 	invalid_input: 400,
 	unknown_collection: 404,
 	unknown_locale: 404
 };
+/**
+* A route of the read API whose `HollwareError` (an unknown collection, a limit out of range) is
+* the caller's to read, with its status. It is caught here, in the route: Hono 5 hands an error
+* that a route throws to the app's error handler before any middleware around it sees it, and
+* that handler answers every error with the same 500. The answer says how long the read took on
+* the server, after the token was checked (`Server-Timing: read;dur=<ms>`), so that a client can
+* tell the server's time from the network's.
+*/
+function readRoute(handler) {
+	return async (c) => {
+		const started = Date.now();
+		try {
+			const response = await handler(c);
+			response.headers.set("server-timing", `read;dur=${Date.now() - started}`);
+			return response;
+		} catch (error) {
+			if (!(error instanceof HollwareError)) throw error;
+			return c.json({
+				code: error.code,
+				message: error.message,
+				fix: error.fix
+			}, STATUS[error.code] ?? 500);
+		}
+	};
+}
 /** A weak ETag of a body: the first 128 bits of its SHA-256, in hex. */
 async function etagOf(body) {
 	const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(body)));
@@ -2112,47 +2632,96 @@ async function answer(c, value) {
 function installReadApi(app, options) {
 	app.use("/v1/*", async (c, next) => {
 		if (c.req.path.startsWith("/v1/ops/") || c.req.path.startsWith("/v1/admin/")) return next();
+		const crossOrigin = crossOriginOf(c);
+		if (c.req.method === "OPTIONS") {
+			const headers = new Headers({
+				allow: "GET, HEAD, OPTIONS",
+				vary: "Origin"
+			});
+			if (crossOrigin !== null && options.anyCorsOrigin(crossOrigin)) {
+				headers.set("access-control-allow-origin", crossOrigin);
+				headers.set("access-control-allow-methods", "GET, HEAD");
+				headers.set("access-control-allow-headers", "authorization, if-none-match");
+				headers.set("access-control-max-age", String(PREFLIGHT_MAX_AGE));
+			}
+			return new Response(null, {
+				status: 204,
+				headers
+			});
+		}
 		if (c.req.method !== "GET" && c.req.method !== "HEAD") return c.json({
 			code: "invalid_input",
 			message: "The read API only reads.",
 			fix: "Use GET."
 		}, 405, { allow: "GET, HEAD" });
 		if (c.req.path === "/v1/openapi.json") return next();
-		return options.protect(c, async (principal) => {
+		c.res = await options.protect(c, async (principal) => {
 			if (!principal.scopes.includes("content:read")) return insufficientScope(["content:read"], options.metadataUrl(c));
-			try {
-				await next();
-				return c.res;
-			} catch (error) {
-				if (!(error instanceof HollwareError)) throw error;
-				return c.json({
-					code: error.code,
-					message: error.message,
-					fix: error.fix
-				}, STATUS[error.code] ?? 500);
-			}
+			c.set("site", principal.site);
+			if (crossOrigin !== null && !options.corsOrigins(principal.site).includes(crossOrigin)) return c.json({
+				code: "forbidden_origin",
+				message: `The site "${principal.site}" does not let pages of ${crossOrigin} read it.`,
+				fix: `Add "${crossOrigin}" to cors.origins of the site in hollware.config.ts, or read from a server.`
+			}, 403, {
+				vary: "Origin",
+				"access-control-allow-origin": new URL(c.env.HOLLWARE_PUBLIC_URL).origin
+			});
+			await next();
+			const answered = c.res;
+			if (crossOrigin === null) return answered;
+			const shared = new Response(answered.body, answered);
+			shared.headers.set("access-control-allow-origin", crossOrigin);
+			shared.headers.set("access-control-expose-headers", "etag");
+			shared.headers.append("vary", "Origin");
+			return shared;
 		});
+		return c.res;
 	});
-	app.get("/v1/openapi.json", (c) => c.json(openApiDocument(options.site)));
-	app.get("/v1/site", async (c) => answer(c, await options.read(c.env).describeSite(options.site)));
-	app.get("/v1/:collection", async (c) => {
+	app.get("/v1/openapi.json", (c) => c.json(openApiDocument()));
+	app.get("/v1/site", readRoute(async (c) => answer(c, await options.read(c.env).describeSite(c.get("site")))));
+	app.get("/v1/search", readRoute(async (c) => {
+		const query = c.req.query();
+		const limit = query["limit"] === void 0 ? void 0 : Number(query["limit"]);
+		return answer(c, await options.read(c.env).search(c.get("site"), query["q"] ?? "", {
+			...query["collection"] === void 0 ? {} : { collection: query["collection"] },
+			...query["locale"] === void 0 ? {} : { locale: query["locale"] },
+			...limit === void 0 ? {} : { limit },
+			...query["mode"] === void 0 ? {} : { mode: searchModeOf(query["mode"]) }
+		}));
+	}));
+	app.get("/v1/:collection", readRoute(async (c) => {
 		const query = c.req.query();
 		const limit = query["limit"] === void 0 ? void 0 : Number(query["limit"]);
-		return answer(c, await options.read(c.env).listEntries(options.site, c.req.param("collection"), {
+		return answer(c, await options.read(c.env).listEntries(c.get("site"), c.req.param("collection"), {
 			...query["locale"] === void 0 ? {} : { locale: query["locale"] },
 			...query["tag"] === void 0 ? {} : { tag: query["tag"] },
 			...limit === void 0 ? {} : { limit },
 			...query["cursor"] === void 0 ? {} : { cursor: query["cursor"] }
 		}));
-	});
-	app.get("/v1/:collection/translations/:group", async (c) => answer(c, await options.read(c.env).getTranslations(options.site, c.req.param("collection"), c.req.param("group"))));
-	app.get("/v1/:collection/:locale/:slug", async (c) => {
+	}));
+	app.get("/v1/:collection/translations/:group", readRoute(async (c) => answer(c, await options.read(c.env).getTranslations(c.get("site"), c.req.param("collection"), c.req.param("group")))));
+	app.get("/v1/:collection/:locale/:slug", readRoute(async (c) => {
 		const formats = c.req.query("formats");
-		return answer(c, await options.read(c.env).getEntry(options.site, c.req.param("collection"), c.req.param("slug"), c.req.param("locale"), formats === void 0 ? {} : { formats: formats.split(",").flatMap((format) => format === "markdown" || format === "document" || format === "html" ? [format] : []) }));
-	});
+		const related = c.req.query("related") === "true" ? { related: true } : {};
+		return answer(c, await options.read(c.env).getEntry(c.get("site"), c.req.param("collection"), c.req.param("slug"), c.req.param("locale"), formats === void 0 ? related : {
+			...related,
+			formats: formats.split(",").flatMap((format) => format === "markdown" || format === "document" || format === "html" ? [format] : [])
+		}));
+	}));
+}
+const SEARCH_MODES = [
+	"fulltext",
+	"semantic",
+	"hybrid"
+];
+/** The `mode` of a search from the query string, or the error that names the ones there are. */
+function searchModeOf(value) {
+	const mode = SEARCH_MODES.find((known) => known === value);
+	if (mode === void 0) throw new HollwareError("invalid_input", `The search mode ${value} is not one Hollware knows.`, `Pass mode as one of ${SEARCH_MODES.join(", ")}, or leave it out for hybrid.`);
+	return mode;
 }
 /** The OpenAPI 3.1 document of the read API. */
-function openApiDocument(site) {
+function openApiDocument() {
 	const ok = (description) => ({
 		description,
 		headers: { ETag: { schema: { type: "string" } } },
@@ -2172,7 +2741,7 @@ function openApiDocument(site) {
 	return {
 		openapi: "3.1.0",
 		info: {
-			title: `Hollware read API (${site})`,
+			title: "Hollware read API",
 			version: "1"
 		},
 		components: { securitySchemes: { token: {
@@ -2188,6 +2757,20 @@ function openApiDocument(site) {
 					...common
 				}
 			} },
+			"/v1/search": { get: {
+				operationId: "search",
+				parameters: [
+					param("q", "query", true),
+					param("collection", "query", false),
+					param("locale", "query", false),
+					param("limit", "query", false),
+					param("mode", "query", false)
+				],
+				responses: {
+					"200": ok("The published entries that match q, best first"),
+					...common
+				}
+			} },
 			"/v1/{collection}": { get: {
 				operationId: "list_entries",
 				parameters: [
@@ -2217,7 +2800,8 @@ function openApiDocument(site) {
 					param("collection", "path", true),
 					param("locale", "path", true),
 					param("slug", "path", true),
-					param("formats", "query", false)
+					param("formats", "query", false),
+					param("related", "query", false)
 				],
 				responses: {
 					"200": ok("A published entry"),
@@ -2237,9 +2821,25 @@ function openApiDocument(site) {
 * (`PublicKeyCredential.parseCreationOptionsFromJSON`, `credential.toJSON()`), and reads the
 * invitation from the address bar, so the page never prints it.
 */
-const STYLE = `body{font:1rem/1.5 system-ui,sans-serif;max-width:28rem;margin:4rem auto;padding:0 1rem;color:#1d1d1f}
-label{display:block;margin:.75rem 0 .25rem}input{width:100%;padding:.5rem;font:inherit}
-button{margin-top:1rem;padding:.6rem 1rem;font:inherit;cursor:pointer}[role=alert]{color:#b00020}`;
+/**
+* The look of hollware.com and the admin, with nothing to fetch: the page's policy loads no font,
+* so the type is the system's. Ink greys and the mint accent, dark when the device is.
+*/
+const STYLE = `:root{color-scheme:light dark;--bg:#f6f7f8;--card:#fff;--fg:#15181b;--muted:#545c66;--line:#d6dadf;--accent:#0c825d;--on-accent:#fff;--danger:#b42318}
+@media (prefers-color-scheme:dark){:root{--bg:#08090a;--card:#0f1113;--fg:#eceef0;--muted:#8a939e;--line:rgb(255 255 255/.1);--accent:#3ee6a8;--on-accent:#04140d;--danger:#ff8a80}}
+*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:2rem 1rem;background:var(--bg);color:var(--fg);font:15px/1.6 system-ui,-apple-system,'Segoe UI',sans-serif;-webkit-font-smoothing:antialiased}
+main{width:100%;max-width:26rem;background:var(--card);border:1px solid var(--line);border-radius:14px;padding:2rem}
+.brand{display:flex;align-items:center;gap:.6rem;margin-bottom:1.75rem;font-weight:600;letter-spacing:-.01em}.brand svg{width:26px;height:26px}
+h1{font-size:1.4rem;line-height:1.25;letter-spacing:-.02em;margin:0 0 .5rem}p{color:var(--muted);margin:.5rem 0}strong{color:var(--fg)}
+label{display:block;margin:1rem 0 .35rem;font-size:.9rem;font-weight:500}fieldset label,form>label:has(input[type=checkbox]){font-weight:400;display:flex;align-items:center;gap:.5rem;margin:.5rem 0}
+input{width:100%;padding:.6rem .75rem;font:inherit;color:inherit;background:transparent;border:1px solid var(--line);border-radius:8px}input:focus{outline:2px solid var(--accent);outline-offset:1px}
+label input{width:auto;margin:0}fieldset{border:1px solid var(--line);border-radius:8px;margin:1rem 0;padding:.5rem .9rem}legend{color:var(--muted);font-size:.85rem;padding:0 .3rem}
+code{font:.82em ui-monospace,'SF Mono',Menlo,monospace;color:var(--muted)}
+button{margin-top:1.25rem;padding:.6rem 1rem;font:inherit;font-weight:500;cursor:pointer;border-radius:8px;border:1px solid var(--line);background:transparent;color:var(--fg)}
+button:not([value=deny]){background:var(--accent);border-color:var(--accent);color:var(--on-accent)}
+[role=alert]{color:var(--danger)}`;
+/** The mark of Hollware, before the title of every page. */
+const BRAND = `<div class="brand"><svg viewBox="0 0 32 32" aria-hidden="true"><rect width="32" height="32" rx="8" fill="currentColor" opacity=".08"/><path d="M9 8v16M23 8v16M9 16h14" stroke="var(--accent)" stroke-width="3" stroke-linecap="round" fill="none"/></svg>Hollware</div>`;
 const POST = `async function post(path, body) {
   const response = await fetch(path, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) })
   const data = await response.json()
@@ -2258,6 +2858,7 @@ function page(title, nonce, body, script) {
 </head>
 <body>
 <main>
+${BRAND}
 <h1>${title}</h1>
 ${body}
 <p id="error" role="alert"></p>
@@ -2327,6 +2928,7 @@ function consentPage(view) {
 	const name = escapeHtml(view.clientName);
 	const origin = view.clientDomain === void 0 ? "<p>This app registered itself: its name is not verified.</p>" : `<p>Published by <strong>${escapeHtml(view.clientDomain)}</strong>.</p>`;
 	const loopback = view.redirectIsLoopback ? "<p><strong>This sends access to an app on this computer.</strong> Continue only if you just started to connect it.</p>" : "";
+	const sites = view.sites.length === 1 ? `<input type="hidden" name="site" value="${escapeHtml(view.sites[0] ?? "")}">` : `<fieldset><legend>For the site</legend>${view.sites.map((site, index) => `<label><input type="radio" name="site" value="${escapeHtml(site)}"${index === 0 ? " checked" : ""}> ${escapeHtml(site)}</label>`).join("\n")}</fieldset>`;
 	const scopes = view.scopes.map((scope) => `<label><input type="checkbox" name="scope" value="${escapeHtml(scope)}" checked> ${escapeHtml(SCOPE_WORDS[scope] ?? scope)} <code>${escapeHtml(scope)}</code></label>`).join("\n");
 	return `<!doctype html>
 <html lang="en">
@@ -2334,16 +2936,18 @@ function consentPage(view) {
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Allow ${name} · Hollware</title>
-<style>${STYLE}label input{width:auto;margin-right:.5rem}</style>
+<style>${STYLE}</style>
 </head>
 <body>
 <main>
+${BRAND}
 <h1>Allow ${name} to use this Hollware?</h1>
 ${origin}
 <p>Signed in as <strong>${escapeHtml(view.person)}</strong>. Access goes to <strong>${escapeHtml(view.redirectHost)}</strong>.</p>
 ${loopback}
 <form method="post" action="/authorize">
 <input type="hidden" name="handle" value="${escapeHtml(view.handle)}">
+${sites}
 ${scopes}
 <p><button name="decision" value="approve">Allow</button> <button name="decision" value="deny">Deny</button></p>
 </form>
@@ -2364,6 +2968,7 @@ function messagePage(title, message) {
 </head>
 <body>
 <main>
+${BRAND}
 <h1>${escapeHtml(title)}</h1>
 <p>${escapeHtml(message)}</p>
 </main>
@@ -2391,7 +2996,7 @@ function plainPageHeaders() {
 * The ceremonies, with SimpleWebAuthn and its parsers, in a chunk of their own: only these four
 * routes use them, and a Worker that serves MCP never pays for them at startup (`budgets.json`).
 */
-const ceremonies = () => import("./ceremonies-D7tsWU3S.mjs");
+const ceremonies = () => import("./ceremonies-BM9G03lZ.mjs");
 /** The cookie of a signed-in person: only `/authorize` reads it (ADR-026). */
 const SESSION_COOKIE = "hollware_session";
 function sessionCookie(secret) {
@@ -2404,7 +3009,6 @@ function isRecord$1(value) {
 function installIdentity(app, options) {
 	const ceremony = (c) => ({
 		db: connect(c.env.DB),
-		site: options.site,
 		publicUrl: c.env.HOLLWARE_PUBLIC_URL,
 		now: options.clock.now()
 	});
@@ -2508,36 +3112,52 @@ function answerError(error) {
 *   `access_denied`.
 * - The grant stores the person and the site. What its tokens may do is read again on each request
 *   against the person's role then (`server.ts`).
+* - The site is the one `?site=` names, if the person is a member of it; else the only site the
+*   person is a member of; else the consent page asks which (v0.4). The admin names its site, and
+*   takes the first one when it names none.
 */
 function installAuthorize(app, options) {
 	const person = async (c) => {
 		const secret = getCookie(c, SESSION_COOKIE);
 		if (secret === void 0) return null;
-		return await findSession(connect(c.env.DB), options.site, secret, options.clock.now());
+		const db = connect(c.env.DB);
+		const found = await findSession(db, secret, options.clock.now());
+		if (found === null) return null;
+		const memberships = (await membershipsOf(db, found.userId)).filter((membership) => options.sites.has(membership.site));
+		return {
+			...found,
+			memberships
+		};
 	};
 	const signIn = (c) => {
 		const url = new URL(c.req.url);
 		const back = `${url.pathname}${url.search}`;
 		return c.redirect(`/signin?return_to=${encodeURIComponent(back)}`, 302);
 	};
+	const notMember = (site) => html(messagePage("Not a member", site === void 0 ? "You are not a member of any site of this Hollware. Ask an owner for an invitation." : `You are not a member of the site "${site}". Ask its owner for an invitation.`), 403);
 	app.get("/authorize", async (c) => {
-		const oauth = options.oauth(c.env.HOLLWARE_PUBLIC_URL).authorizationServer.getOAuthApi(c.env);
+		const server = options.oauth(c.env.HOLLWARE_PUBLIC_URL);
+		const oauth = server.authorizationServer.getOAuthApi(c.env);
 		try {
 			const request = await oauth.parseAuthRequest(c.req.raw);
 			const signedIn = await person(c);
 			if (signedIn === null) return signIn(c);
-			const server = options.oauth(c.env.HOLLWARE_PUBLIC_URL);
+			const [first] = signedIn.memberships;
+			if (first === void 0) return notMember(void 0);
+			const asked = c.req.query("site");
+			const named = asked === void 0 ? void 0 : signedIn.memberships.find((m) => m.site === asked);
+			if (asked !== void 0 && named === void 0) return notMember(asked);
 			if (request.clientId === (await adminClient(server, c.env)).clientId) {
-				const scope = grantableScopes(signedIn.role, request.scope);
+				const membership = named ?? first;
 				const props = {
 					userId: signedIn.userId,
-					site: options.site
+					site: membership.site
 				};
 				const { redirectTo } = await oauth.completeAuthorization({
 					request,
 					userId: signedIn.userId,
-					metadata: { site: options.site },
-					scope,
+					metadata: { site: membership.site },
+					scope: grantableScopes(membership.role, request.scope),
 					props
 				});
 				return new Response(null, {
@@ -2545,7 +3165,9 @@ function installAuthorize(app, options) {
 					headers: { location: redirectTo }
 				});
 			}
-			const scopes = grantableScopes(signedIn.role, request.scope.length === 0 ? BASELINE : request.scope);
+			const choices = named !== void 0 ? [named] : signedIn.memberships;
+			const asking = request.scope.length === 0 ? BASELINE : request.scope;
+			const scopes = [...new Set(choices.flatMap((m) => grantableScopes(m.role, asking)))];
 			if (scopes.length === 0) {
 				const location = authorizationErrorRedirect(request, "access_denied", "Your role allows none of the scopes this client asked for.");
 				return new Response(null, {
@@ -2562,6 +3184,7 @@ function installAuthorize(app, options) {
 				redirectIsLoopback: details.redirectIsLoopback,
 				person: signedIn.name ?? "you",
 				scopes,
+				sites: choices.map((m) => m.site),
 				handle: consent.handle
 			}), 200, consent.headers);
 		} catch (error) {
@@ -2583,7 +3206,10 @@ function installAuthorize(app, options) {
 					headers: denied.headers
 				});
 			}
-			const scope = grantableScopes(signedIn.role, form.getAll("scope").map(String));
+			const chosen = form.get("site");
+			const membership = signedIn.memberships.find((m) => m.site === chosen);
+			if (membership === void 0) return notMember(typeof chosen === "string" ? chosen : void 0);
+			const scope = grantableScopes(membership.role, form.getAll("scope").map(String));
 			const approved = await oauth.approveConsent(c.req.raw, handle, { scope });
 			if (scope.length === 0) {
 				const location = authorizationErrorRedirect(approved.request, "access_denied", "No scope was allowed.");
@@ -2595,12 +3221,12 @@ function installAuthorize(app, options) {
 			}
 			const props = {
 				userId: signedIn.userId,
-				site: options.site
+				site: membership.site
 			};
 			const { redirectTo } = await oauth.completeAuthorization({
 				request: approved.request,
 				userId: signedIn.userId,
-				metadata: { site: options.site },
+				metadata: { site: membership.site },
 				scope,
 				props
 			});
@@ -2689,9 +3315,9 @@ function build(issuer, options) {
 			pending.get(request)?.refused(reason);
 			return null;
 		};
-		if (isPersonalToken(token)) {
+		if (isPersonalToken(token) || isReadToken(token)) {
 			const check = await checkPersonalToken(env.DB, token, {
-				site: options.site,
+				sites: options.sites,
 				now: options.clock.now()
 			});
 			if (!check.ok) return refuse(check.reason);
@@ -2709,14 +3335,15 @@ function build(issuer, options) {
 		const granted = await authorizationServer.validateToken(resource, token, env);
 		if (granted === null) return refuse("unknown");
 		if (!isGrantProps(granted.props)) return refuse("unknown");
-		if (granted.props.site !== options.site) return refuse("other_site");
-		const role = await roleOf(env.DB, options.site, granted.props.userId);
+		const site = granted.props.site;
+		if (!options.sites.has(site)) return refuse("other_site");
+		const role = await roleOf(env.DB, site, granted.props.userId);
 		if (role === null) return refuse("no_user");
 		const principal = {
 			kind: "oauth",
 			userId: granted.props.userId,
 			clientId: granted.clientId,
-			site: options.site,
+			site,
 			scopes: effectiveScopes(role, granted.scope.filter(isScope))
 		};
 		return {
@@ -2762,6 +3389,66 @@ function build(issuer, options) {
 	};
 }
 //#endregion
+//#region src/http/events.ts
+/** The largest beacon the route reads: a site key and a path, with room to spare. */
+const MAX_BEACON_BYTES = 2048;
+/** The origins whose pages may count views of a site: its own URL and its `cors.origins`. */
+function pageOriginsOf(site) {
+	return [...site.url === null ? [] : [new URL(site.url).origin], ...site.cors.origins];
+}
+function refusal(status, code, message, fix) {
+	return Response.json({
+		code,
+		message,
+		fix
+	}, {
+		status,
+		headers: { "cache-control": "no-store" }
+	});
+}
+/** The path of a view without its query and fragment, or `null` when it is no path. */
+function pathOf(value) {
+	if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//")) return null;
+	const { pathname } = new URL(value, "https://hollware.invalid");
+	return pathname.length > 512 ? null : pathname;
+}
+/**
+* `POST /events`, the beacon of the sites (ADR-031): `{ "site": "<key>", "path": "/<path>" }`, sent
+* by a page with `navigator.sendBeacon`, so with no token. It counts a view of the path when the
+* page is of one of the site's origins (its URL or its `cors.origins`), and keeps the site, the
+* path and the country Cloudflare gives the request: never a cookie, an IP or a user agent. It
+* answers 204 whether or not the Worker has an `ANALYTICS` binding, so that a page cannot tell.
+*/
+function installEvents(app, options) {
+	app.post("/events", async (c) => {
+		const text = await c.req.text();
+		if (new TextEncoder().encode(text).byteLength > 2048) return refusal(413, "too_large", `A beacon is at most ${MAX_BEACON_BYTES} bytes.`, "Send the site and the path of the page, and nothing else.");
+		let body;
+		try {
+			body = JSON.parse(text);
+		} catch {
+			body = null;
+		}
+		const key = typeof body === "object" && body !== null && "site" in body ? body.site : null;
+		const site = typeof key === "string" ? options.sites.get(key) : void 0;
+		const path = typeof body === "object" && body !== null && "path" in body ? pathOf(body.path) : null;
+		if (site === void 0 || path === null) return refusal(400, "invalid_input", "A beacon is JSON with the key of a site this Hollware serves and the path of a page.", "Send { \"site\": \"<site key>\", \"path\": \"/<path of the page>\" }.");
+		const origin = c.req.header("origin") ?? null;
+		if (origin === null || !pageOriginsOf(site).includes(origin)) return refusal(403, "forbidden_origin", `Only pages of the site "${site.key}" count its views.`, `Set url of the site in hollware.config.ts to the origin of its pages, or add the origin to cors.origins.`);
+		const cf = Reflect.get(c.req.raw, "cf");
+		const country = typeof cf === "object" && cf !== null && "country" in cf && typeof cf.country === "string" ? cf.country : "XX";
+		analyticsWriterOf(c.env)?.record({
+			site: site.key,
+			path,
+			country
+		});
+		return new Response(null, {
+			status: 204,
+			headers: { "cache-control": "no-store" }
+		});
+	});
+}
+//#endregion
 //#region src/http/gateway.ts
 /**
 * A 401 of a resource server, with Hollware's body: the same JSON as every other refusal, and the
@@ -2802,7 +3489,8 @@ function withRefusalBody(response, refused) {
 * nothing. A failed D1 query while the token is checked is one of those: it is never a 401.
 */
 function createGateway(options) {
-	const { site, mcp, clock, log } = options;
+	const { sites, mcp, clock, log } = options;
+	const siteKeys = new Set(sites.keys());
 	const app = new Hono();
 	/**
 	* The Worker's own context of each request. Hono hands its routes the same object under a
@@ -2815,7 +3503,7 @@ function createGateway(options) {
 		return ctx;
 	};
 	const oauth = createOAuth({
-		site: site.key,
+		sites: siteKeys,
 		clock,
 		dynamicClientRegistration: options.auth?.dynamicClientRegistration ?? false,
 		log
@@ -2824,11 +3512,11 @@ function createGateway(options) {
 	* What a write hands to the Queue: the events it committed, after the answer (ADR-025). The
 	* cron trigger's sweep catches any that this misses.
 	*/
-	const notify = (c, requestId) => (ids) => {
+	const notify = (c, requestId, site) => (ids) => {
 		c.executionCtx.waitUntil(enqueue({
 			queue: c.env.EVENTS,
 			db: connect(c.env.DB),
-			site: site.key,
+			site,
 			ids,
 			clock
 		}).catch((error) => {
@@ -2871,19 +3559,48 @@ function createGateway(options) {
 		});
 		return withRefusalBody(response, outcome.refusal !== null);
 	};
+	/** Every origin that the config of some site lets read the site from a page. */
+	const corsOrigins = new Set([...sites.values()].flatMap((site) => site.cors.origins));
+	/**
+	* The guard lets a page of such an origin through to the read API alone, and only to read: the
+	* read API then checks the origin against the site of the token.
+	*/
+	const readsFromAnyCorsOrigin = (request, origin) => {
+		const { pathname } = new URL(request.url);
+		if (request.method === "POST" && pathname === "/events") return true;
+		return corsOrigins.has(origin) && [
+			"GET",
+			"HEAD",
+			"OPTIONS"
+		].includes(request.method) && pathname.startsWith("/v1/") && !pathname.startsWith("/v1/admin/");
+	};
+	/**
+	* A route for a person or their personal token: a read token reads over the read API alone, so
+	* it is refused here, before anything runs (403, as a token that lacks a scope).
+	*/
+	const protectWrites = (c, resource, proceed) => protect(c, resource, async (principal, auth) => principal.kind === "read" ? Response.json({
+		code: "forbidden",
+		message: "A read token reads published content over GET /v1, and nothing else.",
+		fix: "Use a personal token (hw_pat_) or sign in with OAuth for this."
+	}, {
+		status: 403,
+		headers: { "cache-control": "no-store" }
+	}) : proceed(principal, auth));
 	app.use("*", async (c, next) => {
 		c.set("requestId", crypto.randomUUID());
 		await next();
 	});
 	app.use("*", async (c, next) => {
-		const refusal = checkHostAndOrigin(c.req.raw, c.env.HOLLWARE_PUBLIC_URL);
+		const refusal = checkHostAndOrigin(c.req.raw, c.env.HOLLWARE_PUBLIC_URL, readsFromAnyCorsOrigin);
 		if (refusal !== null) return refusal;
 		await next();
 	});
 	app.get("/health", () => Response.json({ ok: true }, { headers: { "cache-control": "no-store" } }));
-	app.all("/mcp", async (c) => protect(c, "mcp", async (principal) => {
+	app.all("/mcp", async (c) => protectWrites(c, "mcp", async (principal) => {
 		const requestId = c.get("requestId");
 		const db = c.env.DB;
+		const site = sites.get(principal.site);
+		if (site === void 0) throw new Error(`No site ${principal.site} for a checked token`);
 		return await mcp.fetch(c.req.raw, {
 			principal,
 			requestId,
@@ -2892,7 +3609,9 @@ function createGateway(options) {
 				site,
 				store: createD1Store(db, { clock }),
 				clock,
-				notify: notify(c, requestId)
+				notify: notify(c, requestId, site.key),
+				semantic: semanticOfEnv(c.env),
+				analytics: analyticsReaderOf(c.env)
 			}
 		});
 	}));
@@ -2903,40 +3622,39 @@ function createGateway(options) {
 		failed: () => void 0
 	}));
 	installAuthorize(app, {
-		site: site.key,
+		sites: siteKeys,
 		clock,
 		oauth
 	});
 	const authorizationServer = (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).authorizationServer.fetch(c.req.raw, c.env, workerContext(c));
 	app.all("/.well-known/oauth-authorization-server", authorizationServer);
 	app.all("/oauth/*", authorizationServer);
-	installIdentity(app, {
-		site: site.key,
-		clock
-	});
+	installIdentity(app, { clock });
 	installAdmin(app, { oauth });
 	installAdminApi(app, {
-		site: site.key,
+		sites: siteKeys,
 		clock,
 		oauth,
-		protect: (c, proceed) => protect(c, "v1", proceed),
+		protect: (c, proceed) => protectWrites(c, "v1", proceed),
 		metadataUrl: (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.v1
 	});
 	if (options.handlers !== void 0) installOpsApi(app, {
-		site,
+		sites,
 		handlers: options.handlers,
 		clock,
 		log,
-		protect: (c, proceed) => protect(c, "v1", proceed),
+		protect: (c, proceed) => protectWrites(c, "v1", proceed),
 		metadataUrl: (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.v1,
 		notify
 	});
 	if (options.read !== void 0) installReadApi(app, {
 		read: options.read,
-		site: site.key,
+		corsOrigins: (site) => sites.get(site)?.cors.origins ?? [],
+		anyCorsOrigin: (origin) => corsOrigins.has(origin),
 		protect: (c, proceed) => protect(c, "v1", proceed),
 		metadataUrl: (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.v1
 	});
+	installEvents(app, { sites });
 	installErrorHandling(app, log);
 	return async (request, env, ctx) => {
 		contexts.set(request, ctx);
@@ -3125,6 +3843,7 @@ const encoder = new TextEncoder();
 */
 const OUTPUT_TOO_LARGE_FIX = {
 	approve_review: "The operation ran and its change may have been applied: read the review with list_reviews before you repeat it.",
+	content_stats: "Ask for less: pass a smaller limit.",
 	create_draft: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
 	describe_site: "The description of the site does not fit in one answer. Document fewer collections, components and contracts, or shorten their descriptions.",
 	get_entry: "Ask for one format at a time with formats: markdown, document or html, instead of several together.",
@@ -3133,6 +3852,7 @@ const OUTPUT_TOO_LARGE_FIX = {
 	list_reviews: "Ask for less: pass a smaller limit.",
 	publish: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
 	request_changes: "The operation ran and its change may have been applied: read the review with list_reviews before you repeat it.",
+	search: "Ask for less: pass a smaller limit.",
 	unpublish: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
 	update_draft: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
 	validate: "The verdict lists more problems than fit in one answer. Fix the first ones and validate again."
@@ -3273,6 +3993,33 @@ function createToolTable(operations = OPERATIONS) {
 	});
 }
 //#endregion
+//#region src/mcp/prompts.ts
+/**
+* The prompts of the MCP endpoint: workflows that an agent's user picks by name, written once
+* here. A prompt only says what to do; every step is a tool, checked as any call is.
+*/
+const REFRESH_CONTENT = {
+	name: "refresh_content",
+	title: "Refresh what readers read",
+	description: "Pick a much-read entry whose content has aged, find what the site already says on its subject, and update it through the contracts, ready to publish.",
+	args: z.object({ days: z.string().regex(/^[1-9][0-9]?$/).optional().describe("How many days of reading to look at, 1 to 90; 30 when not given.") })
+};
+/** The text of `refresh_content`: the steps, each with the tool that takes it. */
+function refreshContentText(days) {
+	return [
+		`Refresh the content that readers read most, from the last ${days} days.`,
+		"",
+		`1. Call content_stats with days: ${days}. Pick an entry from the pages with the most views: prefer one whose updatedAt is oldest, or whose subject has moved on. Skip pages with no entry.`,
+		"2. Read it with get_entry, with related: true, and read describe_site for its collection: its schema, contracts and style guide.",
+		"3. Call search with the subject of the entry in your own words (mode hybrid) to find what the site already says, so that the update links to it instead of repeating it.",
+		"4. Write the update: correct what is out of date, add what is missing, link the related entries where they help. Keep the voice of the style guide.",
+		"5. Save it with update_draft at the version you read. Fix every error of the verdict, and the warnings you can, saving again; validate checks a version without saving it.",
+		"6. Call publish. Without content:publish it asks for a review: say so, with the link it answers. With warnings left, say which and why before you acknowledge them.",
+		"",
+		"Report the entry you picked and why, what you changed, and how the publish ended."
+	].join("\n");
+}
+//#endregion
 //#region src/mcp/endpoint.ts
 /**
 * `tools/list` is the same for every client and changes only when the Worker is deployed again:
@@ -3294,7 +4041,7 @@ const TOOLS_LIST_CACHE_HINT = {
 function authInfoOf(principal, resourceMetadataUrl) {
 	return {
 		token: "",
-		clientId: principal.kind === "token" ? principal.tokenId : principal.kind === "oauth" ? principal.clientId : principal.kind,
+		clientId: principal.kind === "token" || principal.kind === "read" ? principal.tokenId : principal.kind === "oauth" ? principal.clientId : principal.kind,
 		scopes: [...principal.scopes],
 		...resourceMetadataUrl === null ? {} : { resourceMetadataUrl }
 	};
@@ -3394,7 +4141,10 @@ function createMcpEndpoint(options) {
 		const call = request.authInfo === void 0 ? void 0 : calls.get(request.authInfo);
 		if (call === void 0) throw new Error("A request reached the MCP server without the call the gateway made for it");
 		const server = new McpServer(options.serverInfo, {
-			capabilities: { tools: { listChanged: false } },
+			capabilities: {
+				tools: { listChanged: false },
+				prompts: { listChanged: false }
+			},
 			cacheHints: { "tools/list": TOOLS_LIST_CACHE_HINT }
 		});
 		for (const tool of tools) server.registerTool(tool.spec.name, {
@@ -3414,6 +4164,17 @@ function createMcpEndpoint(options) {
 				detail: null
 			}))
 		}, (input, mcp) => runTool(tool.spec, input, mcp, call, request.era));
+		server.registerPrompt(REFRESH_CONTENT.name, {
+			title: REFRESH_CONTENT.title,
+			description: REFRESH_CONTENT.description,
+			argsSchema: REFRESH_CONTENT.args
+		}, ({ days }) => ({ messages: [{
+			role: "user",
+			content: {
+				type: "text",
+				text: refreshContentText(days === void 0 ? 30 : Number(days))
+			}
+		}] }));
 		return server;
 	};
 	const handler = createMcpHandler(buildServer, { onerror: (error) => emit({
@@ -3438,11 +4199,12 @@ const BINDING_PRINCIPAL = Object.freeze({
 	scopes: Object.freeze(["content:read"])
 });
 /**
-* The site of a call is not the site of this deployment. v0.1 serves one site, and the message
-* and the fix both say which, for a caller that only gets one of them.
+* The site of a call is none of the sites of this deployment. The message and the fix both say
+* which sites it serves, for a caller that only gets one of them.
 */
-function wrongSite(served) {
-	return new HollwareError("invalid_input", `This Hollware serves the site "${served}", not the one the call names.`, `Pass "${served}", the site this deployment serves, as the site argument.`);
+function unknownSite(site, served) {
+	const keys = [...served].map((key) => `"${key}"`).join(", ");
+	return new HollwareError("invalid_input", `This Hollware serves no site "${site}": it serves ${keys}.`, `Pass one of ${keys}, the sites this deployment serves, as the site argument.`);
 }
 /**
 * The options object of a call, without the keys that hold `undefined`, so that the handler sees
@@ -3488,7 +4250,7 @@ function forCaller(deps, requestId, method, error) {
 	return new HollwareError(known.code, known.message, known.fix);
 }
 /**
-* One call of an operation over RPC. In this order: the site is the one of this deployment, the
+* One call of an operation over RPC. In this order: the site is one of this deployment, the
 * input is built and parsed by the spec's schema, and the handler runs with
 *
 * - `view: 'published'`, so a draft is never read, and the principal `{ kind: 'binding', scopes:
@@ -3501,17 +4263,19 @@ function forCaller(deps, requestId, method, error) {
 * a call that fails never opens a session.
 */
 async function run(deps, env, method, site, schema, build, handler) {
-	if (site !== deps.site.key) throw wrongSite(deps.site.key);
+	const served = deps.sites.get(site);
+	if (served === void 0) throw unknownSite(site, deps.sites.keys());
 	const input = parseInput(schema, build());
 	const requestId = crypto.randomUUID();
 	const context = {
-		site: deps.site,
+		site: served,
 		principal: BINDING_PRINCIPAL,
 		view: "published",
 		store: createD1Store(env.DB.withSession("first-unconstrained")),
 		clock: deps.clock,
 		client: null,
-		requestId
+		requestId,
+		semantic: semanticOfEnv(env)
 	};
 	try {
 		return await handler(input, context);
@@ -3531,7 +4295,7 @@ function createRpc(deps, env) {
 			collection,
 			locale,
 			slug,
-			...readOptions(options, ["formats"])
+			...readOptions(options, ["formats", "related"])
 		}), deps.handlers.get_entry),
 		listEntries: (site, collection, options) => run(deps, env, "listEntries", site, listEntries.input, () => ({
 			collection,
@@ -3546,7 +4310,16 @@ function createRpc(deps, env) {
 			collection,
 			translationGroup
 		}), deps.handlers.get_translations),
-		describeSite: (site) => run(deps, env, "describeSite", site, describeSite.input, () => ({}), deps.handlers.describe_site)
+		describeSite: (site) => run(deps, env, "describeSite", site, describeSite.input, () => ({}), deps.handlers.describe_site),
+		search: (site, query, options) => run(deps, env, "search", site, search.input, () => ({
+			query,
+			...readOptions(options, [
+				"collection",
+				"locale",
+				"limit",
+				"mode"
+			])
+		}), deps.handlers.search)
 	};
 }
 //#endregion
@@ -3575,6 +4348,9 @@ function createEntrypoint(deps) {
 		describeSite(...args) {
 			return createRpc(deps, this.env).describeSite(...args);
 		}
+		search(...args) {
+			return createRpc(deps, this.env).search(...args);
+		}
 	};
 }
 //#endregion
@@ -3676,7 +4452,7 @@ function writeLog(entry) {
 *
 * - the config is resolved with `resolveConfig`, so a broken `hollware.config.ts` throws its
 *   `ConfigError` here, and the Worker fails at startup with a message that says what to change.
-*   v0.1 serves the one site of the config;
+*   The deployment serves every site of the config, and a token, a grant or a call names one;
 * - the MCP endpoint, whose tool schemas are converted once, and the Hono app of the gateway,
 *   which is `fetch`: MCP at `/mcp` behind the guard and the token check, and the other routes
 *   (`http/gateway.ts`);
@@ -3689,15 +4465,14 @@ function writeLog(entry) {
 */
 function createHollwareWith(config, handlers, options = {}) {
 	const resolved = resolveConfig(config);
-	const [site] = resolved.sites.values();
-	if (site === void 0) throw new Error("The resolved config has no site, which resolveConfig never lets through");
+	const sites = resolved.sites;
 	const clock = options.clock ?? systemClock;
 	const mcp = createMcpEndpoint({
 		handlers,
 		serverInfo: SERVER_INFO,
 		log: writeLog
 	});
-	const deliveryDeps = (env) => ({
+	const deliveryDeps = (env, site) => ({
 		db: connect(env.DB),
 		site,
 		clock,
@@ -3705,16 +4480,17 @@ function createHollwareWith(config, handlers, options = {}) {
 		secret: (name) => {
 			const value = Reflect.get(env, name);
 			return typeof value === "string" ? value : void 0;
-		}
+		},
+		semantic: semanticOfEnv(env)
 	});
 	return {
 		fetch: createGateway({
-			site,
+			sites,
 			mcp,
 			clock,
 			log: writeLog,
 			read: (env) => createRpc({
-				site,
+				sites,
 				handlers,
 				clock,
 				log: writeLog
@@ -3723,28 +4499,49 @@ function createHollwareWith(config, handlers, options = {}) {
 			handlers
 		}),
 		scheduled: async (_controller, env, ctx) => {
-			const deps = deliveryDeps(env);
-			ctx.waitUntil(runDueSchedules({
-				site,
-				store: createD1Store(env.DB, { clock }),
-				handlers,
-				clock,
-				log: writeLog
-			}).then(() => sweepOutbox({
-				queue: env.EVENTS,
-				deps
-			})).then(() => void 0, (error) => {
-				writeLog({
-					kind: "cron_failed",
-					message: String(error)
+			const each = async (site) => {
+				await runDueSchedules({
+					site,
+					store: createD1Store(env.DB, { clock }),
+					handlers,
+					clock,
+					log: writeLog
 				});
-			}));
+				await sweepOutbox({
+					queue: env.EVENTS,
+					deps: deliveryDeps(env, site)
+				});
+				const semantic = semanticOfEnv(env);
+				if (semantic !== null) {
+					const now = clock.now().toISOString();
+					await healVectors(connect(env.DB), semantic, {
+						site: site.key,
+						now
+					});
+					await refreshRelated(connect(env.DB), semantic, {
+						site: site.key,
+						now
+					});
+				}
+			};
+			ctx.waitUntil((async () => {
+				for (const site of sites.values()) await each(site).catch((error) => {
+					writeLog({
+						kind: "cron_failed",
+						site: site.key,
+						message: String(error)
+					});
+				});
+			})());
 		},
 		queue: async (batch, env) => {
-			await consumeEvents(batch.messages, deliveryDeps(env));
+			await consumeEvents(batch.messages, (key) => {
+				const site = sites.get(key);
+				return site === void 0 ? void 0 : deliveryDeps(env, site);
+			});
 		},
 		Hollware: createEntrypoint({
-			site,
+			sites,
 			handlers,
 			clock,
 			log: writeLog
@@ -3752,53 +4549,6 @@ function createHollwareWith(config, handlers, options = {}) {
 	};
 }
 //#endregion
-//#region src/ops/errors.ts
-/**
-* The error of something that must never happen: a bug of Hollware, not a mistake of the caller.
-* Like the `internal` error of the adapters, its message says nothing about the cause, which goes
-* to the log through `cause`, and its fix names the request id the operator finds the log line by.
-*/
-function internalError(context, cause) {
-	return new HollwareError("internal", "The operation failed on the server.", `Try again. If it keeps failing, give the site operator this request id: ${context.requestId}.`, { cause: new Error(cause) });
-}
-/**
-* The error for an answer of the store that the call it came from can never get: an entry that
-* is created cannot conflict, a publish has no slug to take. It is a bug, not an outcome of the
-* operation, so it is not one of the outcomes of its spec.
-*/
-function unexpectedAnswer(context, call, answer) {
-	return internalError(context, `The store answered ${answer.outcome} to ${call}, which it never does.`);
-}
-//#endregion
-//#region src/ops/actor.ts
-/**
-* Who a write is made by: the person behind the token of the call, with what its client said
-* about itself. A personal token writes as itself (ADR-019); an OAuth access token writes as the
-* client the person allowed, whose id goes with what the client said (ADR-026). The adapters check
-* the scopes of the operation before any handler runs and never route a write for the RPC
-* binding, so reaching one with it is a bug, answered as `internal` before anything is read or
-* written.
-*/
-function actorOf(context) {
-	const { principal } = context;
-	if (principal.kind === "token") return {
-		kind: "token",
-		userId: principal.userId,
-		tokenId: principal.tokenId,
-		meta: context.client
-	};
-	if (principal.kind === "oauth") return {
-		kind: "oauth_client",
-		userId: principal.userId,
-		tokenId: null,
-		meta: {
-			...context.client,
-			oauthClient: principal.clientId
-		}
-	};
-	throw internalError(context, `A write was routed for a principal of kind ${principal.kind}; only a person writes.`);
-}
-//#endregion
 //#region src/ops/answers.ts
 /** A review as an output. */
 function reviewView(review) {
@@ -3900,6 +4650,105 @@ function publicationView(publication) {
 	};
 }
 //#endregion
+//#region src/ops/content-stats.ts
+/** A path without its trailing slash, so that `/blog/a` and `/blog/a/` are one page. */
+function trimmed(path) {
+	return path.length > 1 ? path.replace(/\/+$/, "") : path;
+}
+/**
+* The entry that a path of the site shows, by the routes of its collections: the slug is the part
+* of the path where the route has `:slug`. `null` for a path that no route has.
+*/
+function entryRefOf(site, path) {
+	const wanted = trimmed(path);
+	for (const [collection, resolved] of site.collections) for (const [locale, route] of Object.entries(resolved.routes)) {
+		const [before, after, ...rest] = trimmed(route).split(":slug");
+		if (before === void 0 || after === void 0 || rest.length > 0) continue;
+		if (!wanted.startsWith(before) || !wanted.endsWith(after)) continue;
+		const slug = wanted.slice(before.length, wanted.length - after.length);
+		if (slug !== "" && !slug.includes("/")) return {
+			collection,
+			locale,
+			slug
+		};
+	}
+	return null;
+}
+/**
+* The most read pages of the site, from the counts of its beacons (ADR-031), each with the
+* published entry it shows. `unavailable` when the deployment cannot read the counts.
+*/
+const contentStats = async (input, context) => {
+	const analytics = context.analytics ?? null;
+	if (analytics === null) return { outcome: "unavailable" };
+	const site = context.site;
+	const counts = await analytics.topPages(site.key, {
+		days: input.days,
+		limit: input.limit
+	});
+	const pages = await Promise.all(counts.map(async (count) => {
+		const ref = entryRefOf(site, count.path);
+		const found = ref === null ? null : await context.store.findEntry(site.key, ref, "published");
+		return {
+			path: count.path,
+			views: count.views,
+			entry: found === null ? null : entrySummary(found)
+		};
+	}));
+	return {
+		outcome: "ok",
+		since: (/* @__PURE__ */ new Date(context.clock.now().getTime() - input.days * 864e5)).toISOString(),
+		pages
+	};
+};
+//#endregion
+//#region src/ops/errors.ts
+/**
+* The error of something that must never happen: a bug of Hollware, not a mistake of the caller.
+* Like the `internal` error of the adapters, its message says nothing about the cause, which goes
+* to the log through `cause`, and its fix names the request id the operator finds the log line by.
+*/
+function internalError(context, cause) {
+	return new HollwareError("internal", "The operation failed on the server.", `Try again. If it keeps failing, give the site operator this request id: ${context.requestId}.`, { cause: new Error(cause) });
+}
+/**
+* The error for an answer of the store that the call it came from can never get: an entry that
+* is created cannot conflict, a publish has no slug to take. It is a bug, not an outcome of the
+* operation, so it is not one of the outcomes of its spec.
+*/
+function unexpectedAnswer(context, call, answer) {
+	return internalError(context, `The store answered ${answer.outcome} to ${call}, which it never does.`);
+}
+//#endregion
+//#region src/ops/actor.ts
+/**
+* Who a write is made by: the person behind the token of the call, with what its client said
+* about itself. A personal token writes as itself (ADR-019); an OAuth access token writes as the
+* client the person allowed, whose id goes with what the client said (ADR-026). The adapters check
+* the scopes of the operation before any handler runs and never route a write for the RPC
+* binding, so reaching one with it is a bug, answered as `internal` before anything is read or
+* written.
+*/
+function actorOf(context) {
+	const { principal } = context;
+	if (principal.kind === "token") return {
+		kind: "token",
+		userId: principal.userId,
+		tokenId: principal.tokenId,
+		meta: context.client
+	};
+	if (principal.kind === "oauth") return {
+		kind: "oauth_client",
+		userId: principal.userId,
+		tokenId: null,
+		meta: {
+			...context.client,
+			oauthClient: principal.clientId
+		}
+	};
+	throw internalError(context, `A write was routed for a principal of kind ${principal.kind}; only a person writes.`);
+}
+//#endregion
 //#region src/ops/collections.ts
 /**
 * Which collection and locale a call names, checked against the config of the site before
@@ -4098,6 +4947,7 @@ const getEntry$1 = async (input, context) => {
 	if (found === null) return { outcome: "not_found" };
 	const { entry, revision } = found;
 	const publication = await context.store.lastPublication(context.site.key, entry.id);
+	const related = input.related ? await relatedEntries(context, entry.id) : void 0;
 	return {
 		outcome: "ok",
 		entry: {
@@ -4108,9 +4958,19 @@ const getEntry$1 = async (input, context) => {
 			...input.formats.includes("markdown") ? { markdown: revision.markdown } : {},
 			...input.formats.includes("document") ? { document: revision.document } : {},
 			...input.formats.includes("html") ? { html: await renderHtml(revision.document) } : {}
-		}
+		},
+		...related === void 0 ? {} : { related }
 	};
 };
+/**
+* The published entries closest to one, as its vectors found them when it was indexed: none when
+* the deployment has no semantic search, and none that is no longer published.
+*/
+async function relatedEntries(context, entryId) {
+	if ((context.semantic ?? null) === null) return [];
+	const related = await context.store.relatedOf(context.site.key, entryId);
+	return (await context.store.findSummaries(context.site.key, related.map((item) => item.id), "published")).map(entrySummary);
+}
 //#endregion
 //#region src/ops/get-translations.ts
 /** Reads the entries of a translation group in the view of the call, one per locale. */
@@ -4145,6 +5005,93 @@ const listEntries$1 = async (input, context) => {
 		nextCursor: page.nextCursor
 	};
 };
+/** The published entries closest to the meaning of the query, closest first. */
+async function semanticSearch(semantic, store, site, query) {
+	const [vector] = await semantic.embedder.embed([query.text]);
+	const matches = await semantic.index.query(vector ?? [], {
+		topK: 20,
+		site,
+		...query.collection === void 0 ? {} : { collection: query.collection },
+		...query.locale === void 0 ? {} : { locale: query.locale }
+	});
+	const best = /* @__PURE__ */ new Map();
+	for (const match of matches) {
+		const kept = best.get(match.metadata.entry);
+		if (kept === void 0 || match.score > kept.score) best.set(match.metadata.entry, match);
+	}
+	const ranked = [...best.values()].sort((a, b) => b.score - a.score).slice(0, query.limit);
+	const summaries = await store.findSummaries(site, ranked.map((match) => match.metadata.entry), "published");
+	const byId = new Map(summaries.map((summary) => [summary.entry.id, summary]));
+	return ranked.flatMap((match) => {
+		const entry = byId.get(match.metadata.entry);
+		return entry === void 0 ? [] : [{
+			entry,
+			snippet: match.metadata.excerpt,
+			score: match.score
+		}];
+	});
+}
+/**
+* Merges rankings by reciprocal rank fusion: an entry scores `1 / (FUSION_K + place)` in each list
+* it is in, places counted from 1. An entry keeps the snippet of the first list that has it, so
+* the words found by full text win over the excerpt of a match by meaning.
+*/
+function fuse(lists, limit) {
+	const merged = /* @__PURE__ */ new Map();
+	for (const list of lists) list.forEach((hit, place) => {
+		const gain = 1 / (60 + place + 1);
+		const kept = merged.get(hit.entry.entry.id);
+		merged.set(hit.entry.entry.id, kept === void 0 ? {
+			...hit,
+			score: gain
+		} : {
+			...kept,
+			score: kept.score + gain
+		});
+	});
+	return [...merged.values()].sort((a, b) => b.score - a.score).slice(0, limit);
+}
+//#endregion
+//#region src/ops/search.ts
+/**
+* The published entries of the site that match the query, best first: by its words, by meaning,
+* or both (ADR-030). Without the semantic search of the deployment, every mode is full text, and
+* the answer's `mode` says which one ran.
+*/
+const search$1 = async (input, context) => {
+	if (input.collection !== void 0) requireCollection(context.site, input.collection);
+	if (input.locale !== void 0) requireLocale(context.site, input.locale);
+	const query = {
+		text: input.query,
+		collection: input.collection,
+		locale: input.locale,
+		limit: input.limit
+	};
+	const semantic = context.semantic ?? null;
+	const asked = input.mode ?? "hybrid";
+	const mode = semantic === null ? "fulltext" : asked;
+	const site = context.site.key;
+	let hits;
+	if (semantic === null || mode === "fulltext") hits = await context.store.searchEntries(site, query);
+	else if (mode === "semantic") hits = await semanticSearch(semantic, context.store, site, query);
+	else {
+		const wide = {
+			...query,
+			limit: Math.max(query.limit, 20)
+		};
+		const [words, meaning] = await Promise.all([context.store.searchEntries(site, wide), semanticSearch(semantic, context.store, site, wide)]);
+		hits = fuse([words, meaning], query.limit);
+	}
+	return {
+		outcome: "ok",
+		mode,
+		results: hits.map((hit) => ({
+			entry: entrySummary(hit.entry),
+			snippet: hit.snippet,
+			score: hit.score
+		}))
+	};
+};
 //#endregion
 //#region src/ops/event.ts
 /** The path of an entry: the route of its locale, with its slug in place of `:slug`. */
@@ -4679,11 +5626,13 @@ function defineHandlers(handlers) {
 */
 const handlers = defineHandlers({
 	approve_review: approveReview,
+	content_stats: contentStats,
 	create_draft: createDraft,
 	describe_site: describeSite$1,
 	get_entry: getEntry$1,
 	get_translations: getTranslations$1,
 	list_entries: listEntries$1,
+	search: search$1,
 	list_reviews: listReviews,
 	publish: publish$1,
 	request_changes: requestChanges,