@hollware/server 0.6.0 → 0.9.0

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { A as users, C as reviewComments, D as schedules, E as revisions, M as effectiveScopes, N as isRole, O as sites, S as publications, T as revisionTags, _ as entries, b as members, g as deliveries, j as ROLE_SCOPES, k as tokens, l as membershipsOf, n as createInvitation, s as findSession, v as entryEmbeddings, w as reviews, x as outbox, y as invitations } from "./store-CYMjP0iN.mjs";
-import { CHUNKER_VERSION, EVENT_ID_HEADER, HollwareError, OPERATIONS, SCOPES, SIGNATURE_HEADER, TIMESTAMP_HEADER, chunksOf, describeBuiltInContracts, describeResolvedSite, describeSite, generatePersonalToken, generateReadToken, getEntry, getTranslations, hashPersonalToken, isPersonalToken, isReadToken, isScope, isSiteKey, listEntries, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, search, signWebhook, sizeLimitViolation, uniqueSlugViolation, uniqueTranslationViolation } from "@hollware/core";
+import { A as users, C as reviewComments, D as schedules, E as revisions, M as effectiveScopes, N as isRole, O as sites, S as publications, T as revisionTags, _ as entries, b as members, g as deliveries, j as ROLE_SCOPES, k as tokens, l as membershipsOf, n as createInvitation, s as findSession, v as entryEmbeddings, w as reviews, x as outbox, y as invitations } from "./store-C2hiR0yd.mjs";
+import { CHUNKER_VERSION, ConfigError, EVENT_ID_HEADER, HollwareError, OPERATIONS, SCOPES, SIGNATURE_HEADER, TIMESTAMP_HEADER, canonicalJson, chunksOf, compileSites, definitionsFromConfig, describeBuiltInContracts, describeCatalog, describeResolvedSite, describeSite, generatePersonalToken, generateReadToken, getEntry, getTranslations, hashPersonalToken, isPersonalToken, isReadToken, isScope, isSiteKey, listEntries, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, search, signWebhook, siteDefinitionData, sizeLimitViolation, tagsOfChange, uniqueSlugViolation, uniqueTranslationViolation } from "@hollware/core";
 import { Hono } from "hono";
 import { drizzle } from "drizzle-orm/d1";
 import { and, asc, desc, eq, getTableColumns, gt, inArray, isNotNull, isNull, lte, ne, or, sql } from "drizzle-orm";
@@ -10,7 +10,7 @@ import { CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, McpServer, accepted
 import * as z from "zod";
 import { WorkerEntrypoint } from "cloudflare:workers";
 //#region package.json
-var version = "0.6.0";
+var version = "0.9.0";
 //#endregion
 //#region src/auth/responses.ts
 /** The challenge of every 401 and 403 (RFC 6750). */
@@ -389,6 +389,7 @@ const entryFields = {
 	headRev: entries.headRev,
 	publishedRev: entries.publishedRev,
 	publishedAt: entries.publishedAt,
+	scheduledAt: entries.scheduledAt,
 	updatedAt: entries.updatedAt
 };
 /** The columns of `revisions` that `StoredRevision` holds, except its tags. */
@@ -463,6 +464,7 @@ function toEntry(row) {
 		headRevision: row.headRev,
 		publishedRevision: row.publishedRev,
 		publishedAt: row.publishedAt,
+		scheduledAt: row.scheduledAt,
 		updatedAt: row.updatedAt
 	};
 }
@@ -1103,7 +1105,7 @@ async function requestChanges$1(db, clock, site, write) {
 		review
 	};
 }
-function metaOf(text) {
+function metaOf$1(text) {
 	if (text === null) return null;
 	const parsed = JSON.parse(text);
 	return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? Object.fromEntries(Object.entries(parsed)) : null;
@@ -1118,7 +1120,7 @@ function toComment(row) {
 		reviewId: row.reviewId,
 		authorId: row.authorId,
 		authorName: row.authorName,
-		authorMeta: metaOf(row.authorMeta),
+		authorMeta: metaOf$1(row.authorMeta),
 		body: row.body,
 		createdAt: row.createdAt
 	};
@@ -1316,6 +1318,7 @@ async function createEntry(db, clock, site, entry) {
 				headRevision: revisionId,
 				publishedRevision: null,
 				publishedAt: null,
+				scheduledAt: null,
 				updatedAt: now
 			},
 			revision: storedRevision({
@@ -1826,8 +1829,8 @@ function subscribersOf(deps) {
 	const subscribers = site.events.webhooks.map((webhook) => ({
 		name: `webhook:${webhook.name}`,
 		async send(payload, body) {
-			const secret = deps.secret(webhook.secret);
-			if (secret === void 0) throw new Error(`the secret ${webhook.secret} is not set`);
+			const secret = webhook.secret === null ? await deps.ownSecret?.(webhook.name) : deps.secret(webhook.secret);
+			if (secret === void 0) throw new Error(webhook.secret === null ? `the webhook ${webhook.name} has no secret of Hollware's yet: make it with make_webhook_secret` : `the secret ${webhook.secret} is not set`);
 			const timestamp = Math.floor(deps.clock.now().getTime() / 1e3);
 			const request = new Request(webhook.url, {
 				method: "POST",
@@ -1973,6 +1976,148 @@ async function consumeEvents(messages, depsOf) {
 	}
 }
 //#endregion
+//#region src/structure/seal.ts
+/**
+* Sealing a secret of the structure (ADR-033) under the Worker secret `HOLLWARE_SECRET`, so that
+* the database alone never holds one in clear: AES-GCM with a 256-bit key that is the SHA-256 of
+* that secret, and a fresh 96-bit nonce each time. What is stored is `v1.` and the base64url of
+* the nonce and the ciphertext with its tag. A sealed value that was tampered with, or sealed
+* under another `HOLLWARE_SECRET`, does not open.
+*/
+const PREFIX = "v1.";
+function base64url(bytes) {
+	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64url(text) {
+	const padded = text.replace(/-/g, "+").replace(/_/g, "/");
+	return Uint8Array.from(atob(padded + "=".repeat((4 - padded.length % 4) % 4)), (c) => c.charCodeAt(0));
+}
+async function keyOf(master) {
+	if (master.length < 32) throw new Error("HOLLWARE_SECRET is shorter than 32 characters: hollware deploy makes one");
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(master));
+	return crypto.subtle.importKey("raw", digest, "AES-GCM", false, ["encrypt", "decrypt"]);
+}
+async function seal(master, value) {
+	const nonce = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const cipher = new Uint8Array(await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv: nonce
+	}, await keyOf(master), new TextEncoder().encode(value)));
+	const sealed = new Uint8Array(nonce.length + cipher.length);
+	sealed.set(nonce);
+	sealed.set(cipher, nonce.length);
+	return `${PREFIX}${base64url(sealed)}`;
+}
+/** The value of a sealed secret, or `null` when it does not open under `master`. */
+async function unseal(master, sealed) {
+	if (!sealed.startsWith(PREFIX)) return null;
+	try {
+		const bytes = fromBase64url(sealed.slice(3));
+		const plain = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: bytes.slice(0, 12)
+		}, await keyOf(master), bytes.slice(12));
+		return new TextDecoder().decode(plain);
+	} catch {
+		return null;
+	}
+}
+/** A new secret for a webhook: 32 random bytes, hex, behind `whsec_`. */
+function newWebhookSecret() {
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+	return `whsec_${Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+//#endregion
+//#region src/structure/store.ts
+/**
+* The structure of the sites on D1 (ADR-033). Each change is one batch: the row of `sites`, moved
+* only if it is where the caller saw it, and its line of `site_changes`, written only if the row
+* moved, at the version it moved to.
+*/
+function metaOf(actor) {
+	return actor.meta === null ? null : JSON.stringify(actor.meta);
+}
+/** The change a statement before it made, at the site's version now, if that version is new. */
+function appendChange(db, site, actor, now, before, after) {
+	return db.prepare(`INSERT OR IGNORE INTO site_changes (id, site_id, version, actor_user_id, actor_meta, before, after, created_at, updated_at)
+       SELECT ?1, id, version, ?2, ?3, ?4, ${after === "definition" ? "definition" : "NULL"}, ?5, ?5 FROM sites WHERE id = ?6 AND updated_at = ?5`).bind(newId("sit"), actor.userId, metaOf(actor), before, now, site);
+}
+function createStructureStore(db, now) {
+	return {
+		async read(site) {
+			const row = await db.prepare("SELECT version, definition, deleted_at FROM sites WHERE id = ?1").bind(site).first();
+			if (row === null || row.definition === null) return null;
+			return {
+				version: row.version,
+				definition: JSON.parse(row.definition),
+				deletedAt: row.deleted_at
+			};
+		},
+		async write({ site, expected, definition, actor }) {
+			const at = now().toISOString();
+			const before = await db.prepare("SELECT definition FROM sites WHERE id = ?1").bind(site).first("definition");
+			const [moved] = await db.batch([db.prepare("UPDATE sites SET definition = ?1, version = version + 1, updated_at = ?2 WHERE id = ?3 AND version = ?4 AND deleted_at IS NULL").bind(JSON.stringify(definition), at, site, expected), appendChange(db, site, actor, at, before ?? null, "definition")]);
+			return (moved?.meta.changes ?? 0) === 1 ? "written" : "conflict";
+		},
+		async create({ site, definition, actor }) {
+			const at = now().toISOString();
+			const [made] = await db.batch([
+				db.prepare("INSERT INTO sites (id, definition, version, created_at, updated_at) VALUES (?1, ?2, 1, ?3, ?3) ON CONFLICT (id) DO NOTHING").bind(site, JSON.stringify(definition), at),
+				db.prepare(`INSERT INTO members (id, site_id, user_id, role, created_at, updated_at)
+             SELECT ?1, ?2, ?3, 'owner', ?4, ?4 WHERE EXISTS (SELECT 1 FROM sites WHERE id = ?2 AND created_at = ?4 AND version = 1)
+             ON CONFLICT (site_id, user_id) DO NOTHING`).bind(newId("mbr"), site, actor.userId, at),
+				appendChange(db, site, actor, at, null, "definition")
+			]);
+			return (made?.meta.changes ?? 0) === 1 ? "created" : "taken";
+		},
+		async trash(site, actor) {
+			const at = now().toISOString();
+			const before = await db.prepare("SELECT definition FROM sites WHERE id = ?1").bind(site).first("definition");
+			const [moved] = await db.batch([db.prepare("UPDATE sites SET deleted_at = ?1, version = version + 1, updated_at = ?1 WHERE id = ?2 AND deleted_at IS NULL AND definition IS NOT NULL").bind(at, site), appendChange(db, site, actor, at, before ?? null, "null")]);
+			return (moved?.meta.changes ?? 0) === 1;
+		},
+		async restore(site, actor) {
+			const at = now().toISOString();
+			const [moved] = await db.batch([db.prepare("UPDATE sites SET deleted_at = NULL, version = version + 1, updated_at = ?1 WHERE id = ?2 AND deleted_at IS NOT NULL").bind(at, site), appendChange(db, site, actor, at, null, "definition")]);
+			return (moved?.meta.changes ?? 0) === 1;
+		},
+		async roleOf(site, userId) {
+			const role = await db.prepare("SELECT role FROM members WHERE site_id = ?1 AND user_id = ?2").bind(site, userId).first("role");
+			return role === "owner" || role === "editor" || role === "author" ? role : null;
+		},
+		async counts(site) {
+			const [collections, locales] = await db.batch([db.prepare("SELECT collection AS key, count(*) AS n FROM entries WHERE site_id = ?1 GROUP BY collection").bind(site), db.prepare("SELECT locale AS key, count(*) AS n FROM entries WHERE site_id = ?1 GROUP BY locale").bind(site)]);
+			const mapOf = (rows) => new Map((rows ?? []).map((row) => [row.key, row.n]));
+			return {
+				byCollection: mapOf(collections?.results),
+				byLocale: mapOf(locales?.results)
+			};
+		},
+		async frontmatters(site, collection, limit) {
+			const { results } = await db.prepare(`SELECT e.slug AS slug, r.frontmatter AS frontmatter FROM entries e
+           JOIN revisions r ON r.id = e.head_rev AND r.site_id = e.site_id
+           WHERE e.site_id = ?1 AND e.collection = ?2 ORDER BY e.slug LIMIT ?3`).bind(site, collection, limit).all();
+			return results.map((row) => ({
+				slug: row.slug,
+				frontmatter: JSON.parse(row.frontmatter)
+			}));
+		}
+	};
+}
+/** The sealed secrets of the structure of a site (ADR-033), by name. */
+function createSecretStore(db, now) {
+	return {
+		async read(site, name) {
+			return db.prepare("SELECT sealed FROM site_secrets WHERE site_id = ?1 AND name = ?2").bind(site, name).first("sealed");
+		},
+		async write(site, name, sealed) {
+			const at = now().toISOString();
+			await db.prepare(`INSERT INTO site_secrets (id, site_id, name, sealed, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, ?5, ?5)
+           ON CONFLICT (site_id, name) DO UPDATE SET sealed = excluded.sealed, updated_at = excluded.updated_at`).bind(newId("sec"), site, name, sealed, at).run();
+		}
+	};
+}
+//#endregion
 //#region src/mcp/errors.ts
 /**
 * The error a caller gets for anything that is not a `HollwareError`. The message is fixed: what
@@ -2169,6 +2314,24 @@ function installAdmin(app, options) {
 	});
 }
 //#endregion
+//#region src/identity/people.ts
+/** The owners of the site besides `userId`, counted in the statement that changes `userId`. */
+const OTHER_OWNERS = "(SELECT count(*) FROM members WHERE site_id = ?1 AND role = 'owner' AND user_id <> ?2) > 0";
+async function roleOf$1(db, site, userId) {
+	return db.prepare("SELECT role FROM members WHERE site_id = ?1 AND user_id = ?2").bind(site, userId).first("role");
+}
+async function setRole(db, input) {
+	const current = await roleOf$1(db, input.site, input.userId);
+	if (current === null) return "not_member";
+	if (current === input.role) return "unchanged";
+	return (await db.prepare(`UPDATE members SET role = ?3, updated_at = ?4 WHERE site_id = ?1 AND user_id = ?2
+       AND (role <> 'owner' OR ?3 = 'owner' OR ${OTHER_OWNERS})`).bind(input.site, input.userId, input.role, input.now).run()).meta.changes === 1 ? "changed" : "last_owner";
+}
+async function removeMember(db, input) {
+	if (await roleOf$1(db, input.site, input.userId) === null) return "not_member";
+	return (await db.prepare(`DELETE FROM members WHERE site_id = ?1 AND user_id = ?2 AND (role <> 'owner' OR ${OTHER_OWNERS})`).bind(input.site, input.userId).run()).meta.changes === 1 ? "changed" : "last_owner";
+}
+//#endregion
 //#region src/http/admin-api.ts
 /**
 * What only a person in the admin may do (ADR-026): see, make and revoke personal tokens, and
@@ -2186,9 +2349,16 @@ function json$1(body, status = 200) {
 		headers: { "cache-control": "no-store" }
 	});
 }
+/** The code of each refusal: what the input breaks, who may not, what is not there, what clashes. */
+const REFUSAL_CODES = {
+	400: "invalid_input",
+	403: "forbidden",
+	404: "not_found",
+	409: "conflict"
+};
 function refused(message, fix, status = 400) {
 	return json$1({
-		code: status === 400 ? "invalid_input" : "forbidden",
+		code: REFUSAL_CODES[status],
 		message,
 		fix
 	}, status);
@@ -2226,12 +2396,20 @@ function installAdminApi(app, options) {
 			id: users.id,
 			name: users.name
 		}).from(users).where(eq(users.id, person.userId));
-		const sites = (await membershipsOf(db, person.userId)).filter((membership) => options.sites.has(membership.site));
+		const memberships = await membershipsOf(db, person.userId);
+		const sites = memberships.filter((membership) => options.sites.has(membership.site));
+		const { results: trashed } = await c.env.DB.prepare("SELECT id, deleted_at FROM sites WHERE deleted_at IS NOT NULL").all();
+		const owned = new Set(memberships.filter((membership) => membership.role === "owner").map((m) => m.site));
+		const trash = trashed.filter((row) => owned.has(row.id)).map((row) => ({
+			site: row.id,
+			deletedAt: row.deleted_at
+		}));
 		return json$1({
 			user,
 			site: person.site,
 			scopes: person.scopes,
-			sites
+			sites,
+			trash
 		});
 	}, { anyone: true }));
 	app.get("/v1/admin/tokens", admin(async (c, person) => {
@@ -2326,6 +2504,36 @@ function installAdminApi(app, options) {
 			}).from(invitations).where(and(eq(invitations.siteId, person.site), isNull(invitations.usedAt), isNull(invitations.userId), gt(invitations.expiresAt, now))).orderBy(desc(invitations.createdAt))
 		});
 	}));
+	/** What a change of a member answers, by what it did. */
+	const answerOf = (change) => {
+		switch (change) {
+			case "changed":
+			case "unchanged": return json$1({ outcome: change });
+			case "not_member": return refused("That person is no member of this site.", "Pick someone from the list of people.", 404);
+			case "last_owner": return refused("A site keeps at least one owner, and this is its last one.", "Make another person an owner first, then change this one.", 409);
+		}
+	};
+	app.post("/v1/admin/people/role", admin(async (c, person) => {
+		const input = await body(c);
+		const role = input["role"];
+		const userId = input["userId"];
+		if (typeof userId !== "string" || typeof role !== "string" || !isRole(role)) return refused("Give the userId of a member and a role.", `Send { "userId": "usr_…", "role": "owner" | "editor" | "author" }.`);
+		const now = options.clock.now().toISOString();
+		return answerOf(await setRole(c.env.DB, {
+			site: person.site,
+			userId,
+			role,
+			now
+		}));
+	}));
+	app.post("/v1/admin/people/remove", admin(async (c, person) => {
+		const userId = (await body(c))["userId"];
+		if (typeof userId !== "string") return refused("Give the userId of a member.", "Send { \"userId\": \"usr_…\" }.");
+		return answerOf(await removeMember(c.env.DB, {
+			site: person.site,
+			userId
+		}));
+	}));
 	app.post("/v1/admin/invitations", admin(async (c, person) => {
 		const input = await body(c);
 		const role = input["role"];
@@ -2598,7 +2806,8 @@ function installOpsApi(app, options) {
 			requestId,
 			notify: options.notify(c, requestId, site.key),
 			semantic: semanticOfEnv(c.env),
-			analytics: analyticsReaderOf(c.env)
+			analytics: analyticsReaderOf(c.env),
+			...options.structure === void 0 ? {} : { structure: options.structure(c.env.DB, c.env.HOLLWARE_SECRET) }
 		};
 		try {
 			return json(spec.output.parse(await invoke(options.handlers, spec, parsed.data, context)));
@@ -2723,7 +2932,7 @@ function installReadApi(app, options) {
 			if (crossOrigin !== null && !options.corsOrigins(principal.site).includes(crossOrigin)) return c.json({
 				code: "forbidden_origin",
 				message: `The site "${principal.site}" does not let pages of ${crossOrigin} read it.`,
-				fix: `Add "${crossOrigin}" to cors.origins of the site in hollware.config.ts, or read from a server.`
+				fix: `Add "${crossOrigin}" to the cors.origins of the site (in the admin, Site, or with update_site), or read from a server.`
 			}, 403, {
 				vary: "Origin",
 				"access-control-allow-origin": new URL(c.env.HOLLWARE_PUBLIC_URL).origin
@@ -2885,10 +3094,10 @@ function openApiDocument() {
 */
 /**
 * The look of hollware.com and the admin, with nothing to fetch: the page's policy loads no font,
-* so the type is the system's. Ink greys and the mint accent, dark when the device is.
+* so the type is the system's. Dark only, the neutral greys of the theme, white as the primary
+* color and emerald for the mark (tests/conventions/brand.test.ts).
 */
-const STYLE = `:root{color-scheme:light dark;--bg:#f6f7f8;--card:#fff;--fg:#15181b;--muted:#545c66;--line:#d6dadf;--accent:#0c825d;--on-accent:#fff;--danger:#b42318}
-@media (prefers-color-scheme:dark){:root{--bg:#08090a;--card:#0f1113;--fg:#eceef0;--muted:#8a939e;--line:rgb(255 255 255/.1);--accent:#3ee6a8;--on-accent:#04140d;--danger:#ff8a80}}
+const STYLE = `:root{color-scheme:dark;--bg:#0a0a0a;--card:#171717;--fg:#f5f5f5;--muted:#a3a3a3;--line:rgb(255 255 255/.1);--accent:#fafafa;--on-accent:#0a0a0a;--mark:#34d399;--danger:#ff8a80}
 *{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:2rem 1rem;background:var(--bg);color:var(--fg);font:15px/1.6 system-ui,-apple-system,'Segoe UI',sans-serif;-webkit-font-smoothing:antialiased}
 main{width:100%;max-width:26rem;background:var(--card);border:1px solid var(--line);border-radius:14px;padding:2rem}
 .brand{display:flex;align-items:center;gap:.6rem;margin-bottom:1.75rem;font-weight:600;letter-spacing:-.01em}.brand svg{width:26px;height:26px}
@@ -2901,7 +3110,7 @@ button{margin-top:1.25rem;padding:.6rem 1rem;font:inherit;font-weight:500;cursor
 button:not([value=deny]){background:var(--accent);border-color:var(--accent);color:var(--on-accent)}
 [role=alert]{color:var(--danger)}`;
 /** The mark of Hollware, before the title of every page. */
-const BRAND = `<div class="brand"><svg viewBox="0 0 32 32" aria-hidden="true"><rect width="32" height="32" rx="8" fill="currentColor" opacity=".08"/><path d="M9 8v16M23 8v16M9 16h14" stroke="var(--accent)" stroke-width="3" stroke-linecap="round" fill="none"/></svg>Hollware</div>`;
+const BRAND = `<div class="brand"><svg viewBox="0 0 32 32" aria-hidden="true"><rect width="32" height="32" rx="8" fill="currentColor" opacity=".08"/><path d="M9 8v16M23 8v16M9 16h14" stroke="var(--mark)" stroke-width="3" stroke-linecap="round" fill="none"/></svg>Hollware</div>`;
 const POST = `async function post(path, body) {
   const response = await fetch(path, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) })
   const data = await response.json()
@@ -3058,7 +3267,7 @@ function plainPageHeaders() {
 * The ceremonies, with SimpleWebAuthn and its parsers, in a chunk of their own: only these four
 * routes use them, and a Worker that serves MCP never pays for them at startup (`budgets.json`).
 */
-const ceremonies = () => import("./ceremonies-6mZ3u32c.mjs");
+const ceremonies = () => import("./ceremonies-D5dIEbha.mjs");
 /** The cookie of a signed-in person: only `/authorize` reads it (ADR-026). */
 const SESSION_COOKIE = "hollware_session";
 function sessionCookie(secret) {
@@ -3496,7 +3705,7 @@ function installEvents(app, options) {
 		const path = typeof body === "object" && body !== null && "path" in body ? pathOf(body.path) : null;
 		if (site === void 0 || path === null) return refusal(400, "invalid_input", "A beacon is JSON with the key of a site this Hollware serves and the path of a page.", "Send { \"site\": \"<site key>\", \"path\": \"/<path of the page>\" }.");
 		const origin = c.req.header("origin") ?? null;
-		if (origin === null || !pageOriginsOf(site).includes(origin)) return refusal(403, "forbidden_origin", `Only pages of the site "${site.key}" count its views.`, `Set url of the site in hollware.config.ts to the origin of its pages, or add the origin to cors.origins.`);
+		if (origin === null || !pageOriginsOf(site).includes(origin)) return refusal(403, "forbidden_origin", `Only pages of the site "${site.key}" count its views.`, `Set the url of the site to the origin of its pages, or add the origin to its cors.origins: in the admin, Site, or with update_site.`);
 		const cf = Reflect.get(c.req.raw, "cf");
 		const country = typeof cf === "object" && cf !== null && "country" in cf && typeof cf.country === "string" ? cf.country : "XX";
 		analyticsWriterOf(c.env)?.record({
@@ -3552,7 +3761,7 @@ function withRefusalBody(response, refused) {
 */
 function createGateway(options) {
 	const { sites, mcp, clock, log } = options;
-	const siteKeys = new Set(sites.keys());
+	const siteKeys = options.siteKeys ?? new Set(sites.keys());
 	const app = new Hono();
 	/**
 	* The Worker's own context of each request. Hono hands its routes the same object under a
@@ -3589,12 +3798,26 @@ function createGateway(options) {
 			});
 		}));
 	};
+	/** The structure of the sites in D1, and how this isolate sees a change of it at once. */
+	const structureOf = (db, master) => ({
+		store: createStructureStore(db, () => clock.now()),
+		changed: async () => {
+			await options.refresh?.(db, { force: true });
+		},
+		secrets: { make: async (site, name) => {
+			if (master === void 0) return null;
+			const secret = newWebhookSecret();
+			await createSecretStore(db, () => clock.now()).write(site, name, await seal(master, secret));
+			return secret;
+		} }
+	});
 	/**
 	* A protected route: the resource server of `resource` answers a request without a token and a
 	* token it refuses (401, logged with the reason), and `proceed` gets the principal of the rest.
 	*/
 	const protect = async (c, resource, proceed) => {
 		const requestId = c.get("requestId");
+		if (c.req.header("authorization") !== void 0) await options.refresh?.(c.env.DB);
 		/** What the check said besides the answer: why it refused, or what it threw. */
 		const outcome = {
 			refusal: null,
@@ -3621,8 +3844,17 @@ function createGateway(options) {
 		});
 		return withRefusalBody(response, outcome.refusal !== null);
 	};
-	/** Every origin that the config of some site lets read the site from a page. */
-	const corsOrigins = new Set([...sites.values()].flatMap((site) => site.cors.origins));
+	/** A read of the read API, the one kind of request a page of another origin may make. */
+	const isCorsRead = (request) => {
+		const { pathname } = new URL(request.url);
+		return [
+			"GET",
+			"HEAD",
+			"OPTIONS"
+		].includes(request.method) && pathname.startsWith("/v1/") && !pathname.startsWith("/v1/admin/");
+	};
+	/** Whether the definition of some site lets pages of `origin` read it. */
+	const anyCorsOrigin = (origin) => [...sites.values()].some((site) => site.cors.origins.includes(origin));
 	/**
 	* The guard lets a page of such an origin through to the read API alone, and only to read: the
 	* read API then checks the origin against the site of the token.
@@ -3630,11 +3862,7 @@ function createGateway(options) {
 	const readsFromAnyCorsOrigin = (request, origin) => {
 		const { pathname } = new URL(request.url);
 		if (request.method === "POST" && pathname === "/events") return true;
-		return corsOrigins.has(origin) && [
-			"GET",
-			"HEAD",
-			"OPTIONS"
-		].includes(request.method) && pathname.startsWith("/v1/") && !pathname.startsWith("/v1/admin/");
+		return anyCorsOrigin(origin) && isCorsRead(request);
 	};
 	/**
 	* A route for a person or their personal token: a read token reads over the read API alone, so
@@ -3653,10 +3881,20 @@ function createGateway(options) {
 		await next();
 	});
 	app.use("*", async (c, next) => {
+		const origin = c.req.header("origin");
+		if (origin !== void 0 && (isCorsRead(c.req.raw) || readsFromAnyCorsOrigin(c.req.raw, origin))) await options.refresh?.(c.env.DB);
 		const refusal = checkHostAndOrigin(c.req.raw, c.env.HOLLWARE_PUBLIC_URL, readsFromAnyCorsOrigin);
 		if (refusal !== null) return refusal;
 		await next();
 	});
+	for (const path of [
+		"/authorize",
+		"/oauth/*",
+		"/events"
+	]) app.use(path, async (c, next) => {
+		await options.refresh?.(c.env.DB);
+		await next();
+	});
 	app.get("/health", () => Response.json({ ok: true }, { headers: { "cache-control": "no-store" } }));
 	app.all("/mcp", async (c) => protectWrites(c, "mcp", async (principal) => {
 		const requestId = c.get("requestId");
@@ -3673,7 +3911,8 @@ function createGateway(options) {
 				clock,
 				notify: notify(c, requestId, site.key),
 				semantic: semanticOfEnv(c.env),
-				analytics: analyticsReaderOf(c.env)
+				analytics: analyticsReaderOf(c.env),
+				structure: structureOf(db, c.env.HOLLWARE_SECRET)
 			}
 		});
 	}));
@@ -3707,12 +3946,13 @@ function createGateway(options) {
 		log,
 		protect: (c, proceed) => protectWrites(c, "v1", proceed),
 		metadataUrl: (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.v1,
-		notify
+		notify,
+		structure: structureOf
 	});
 	if (options.read !== void 0) installReadApi(app, {
 		read: options.read,
 		corsOrigins: (site) => sites.get(site)?.cors.origins ?? [],
-		anyCorsOrigin: (origin) => corsOrigins.has(origin),
+		anyCorsOrigin,
 		protect: (c, proceed) => protect(c, "v1", proceed),
 		metadataUrl: (c) => oauth(c.env.HOLLWARE_PUBLIC_URL).metadataUrls.v1
 	});
@@ -3919,6 +4159,13 @@ const OUTPUT_TOO_LARGE_FIX = {
 	search: "Ask for less: pass a smaller limit.",
 	unpublish: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
 	update_draft: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
+	create_site: "The site was made and holds little: read it with get_structure from a token of that site.",
+	delete_site: "Nothing to ask for less of: the answer is a count. Try again.",
+	make_webhook_secret: "Nothing to ask for less of: the answer is one secret. Try again.",
+	get_structure: "The structure does not fit in one answer: read the collections with describe_site instead, and change them one at a time with set_collection.",
+	restore_site: "Nothing to ask for less of: the answer is an outcome. Try again.",
+	set_collection: "Too many problems for one answer: fix the first ones and send the collection again.",
+	update_site: "Too many problems for one answer: fix the first ones, or change one collection at a time with set_collection.",
 	validate: "The verdict lists more problems than fit in one answer. Fix the first ones and validate again."
 };
 /**
@@ -4318,10 +4565,15 @@ function forCaller(deps, requestId, method, error) {
 * a call that fails never opens a session.
 */
 async function run(deps, env, method, site, schema, build, handler) {
+	const requestId = crypto.randomUUID();
+	try {
+		await deps.refresh?.(env.DB);
+	} catch (error) {
+		throw forCaller(deps, requestId, method, error);
+	}
 	const served = deps.sites.get(site);
 	if (served === void 0) throw unknownSite(site, deps.sites.keys());
 	const input = parseInput(schema, build());
-	const requestId = crypto.randomUUID();
 	const context = {
 		site: served,
 		principal: BINDING_PRINCIPAL,
@@ -4486,6 +4738,73 @@ async function runDueSchedules(input) {
 		cancelled
 	};
 }
+async function moveConfig(db, seed, now) {
+	const statements = Object.entries(seed).flatMap(([key, definition]) => {
+		const json = JSON.stringify(definition);
+		return [db.prepare(`INSERT INTO sites (id, definition, version, created_at, updated_at) VALUES (?1, ?2, 1, ?3, ?3)
+           ON CONFLICT (id) DO UPDATE SET definition = excluded.definition, version = 1, updated_at = excluded.updated_at
+           WHERE sites.definition IS NULL`).bind(key, json, now), db.prepare(`INSERT OR IGNORE INTO site_changes (id, site_id, version, actor_user_id, actor_meta, before, after, created_at, updated_at)
+           SELECT ?1, ?2, 1, NULL, NULL, NULL, definition, ?3, ?3 FROM sites WHERE id = ?2 AND version = 1`).bind(newId("sit"), key, now)];
+	});
+	if (statements.length > 0) await db.batch(statements);
+}
+function createSiteRegistry(options) {
+	const pollMs = options.pollMs ?? 1e3;
+	const sites = /* @__PURE__ */ new Map();
+	const keys = /* @__PURE__ */ new Set();
+	let compiled = /* @__PURE__ */ new Map();
+	let polledAt = Number.NEGATIVE_INFINITY;
+	let moved = options.seed === void 0;
+	const refresh = async (db, refreshOptions = {}) => {
+		const now = options.now();
+		if (refreshOptions.force !== true && now.getTime() - polledAt < pollMs) return;
+		if (!moved && options.seed !== void 0) {
+			await moveConfig(db, options.seed, now.toISOString());
+			moved = true;
+		}
+		const { results: versions } = await db.prepare("SELECT id, version, (definition IS NOT NULL AND deleted_at IS NULL) AS served FROM sites").all();
+		const stale = versions.filter((row) => row.served === 1 && compiled.get(row.id)?.version !== row.version);
+		const fetched = stale.length === 0 ? [] : (await db.prepare(`SELECT id, version, definition FROM sites WHERE id IN (${stale.map((_, index) => `?${index + 1}`).join(", ")})`).bind(...stale.map((row) => row.id)).all()).results;
+		const next = /* @__PURE__ */ new Map();
+		for (const row of versions) {
+			const current = compiled.get(row.id);
+			if (row.served === 1 && current !== void 0 && current.version >= row.version) next.set(row.id, current);
+		}
+		for (const row of fetched) {
+			if (row.definition === null || (next.get(row.id)?.version ?? -1) >= row.version) continue;
+			try {
+				const definition = JSON.parse(row.definition);
+				const site = compileSites({ [row.id]: definition }).sites.get(row.id);
+				if (site !== void 0) next.set(row.id, {
+					version: row.version,
+					site
+				});
+			} catch (error) {
+				options.log({
+					kind: "site_definition_invalid",
+					site: row.id,
+					version: row.version,
+					message: error instanceof ConfigError ? error.message : String(error)
+				});
+				const previous = compiled.get(row.id);
+				if (previous !== void 0) next.set(row.id, previous);
+			}
+		}
+		compiled = next;
+		sites.clear();
+		keys.clear();
+		for (const [key, value] of next) {
+			sites.set(key, value.site);
+			keys.add(key);
+		}
+		polledAt = now.getTime();
+	};
+	return {
+		sites,
+		keys,
+		refresh
+	};
+}
 //#endregion
 //#region src/compose.ts
 const systemClock = { now: () => /* @__PURE__ */ new Date() };
@@ -4509,9 +4828,10 @@ function writeLog(entry) {
 *
 * Everything that can be built once is built here, when the user's module loads, and never again:
 *
-* - the config is resolved with `resolveConfig`, so a broken `hollware.config.ts` throws its
-*   `ConfigError` here, and the Worker fails at startup with a message that says what to change.
-*   The deployment serves every site of the config, and a token, a grant or a call names one;
+* - the registry of the sites, which reads them from D1 (ADR-033) at the start of each request,
+*   call, cron run and batch. A config of 0.x is turned into definitions here, so one that cannot
+*   move throws its `ConfigError` at startup, and is written to D1 on the first request. The
+*   deployment serves every site of D1 with a definition, and a token, a grant or a call names one;
 * - the MCP endpoint, whose tool schemas are converted once, and the Hono app of the gateway,
 *   which is `fetch`: MCP at `/mcp` behind the guard and the token check, and the other routes
 *   (`http/gateway.ts`);
@@ -4523,9 +4843,16 @@ function writeLog(entry) {
 * included, is one JSON line written with `console.log`.
 */
 function createHollwareWith(config, handlers, options = {}) {
-	const resolved = resolveConfig(config);
-	const sites = resolved.sites;
 	const clock = options.clock ?? systemClock;
+	const moving = config?.sites !== void 0;
+	if (moving) resolveConfig(config);
+	const registry = createSiteRegistry({
+		...moving ? { seed: definitionsFromConfig(config) } : {},
+		now: () => clock.now(),
+		log: writeLog
+	});
+	const { sites } = registry;
+	const refresh = (db, options) => registry.refresh(db, options);
 	const mcp = createMcpEndpoint({
 		handlers,
 		serverInfo: SERVER_INFO,
@@ -4540,11 +4867,19 @@ function createHollwareWith(config, handlers, options = {}) {
 			const value = Reflect.get(env, name);
 			return typeof value === "string" ? value : void 0;
 		},
-		semantic: semanticOfEnv(env)
+		semantic: semanticOfEnv(env),
+		ownSecret: async (webhook) => {
+			const master = env.HOLLWARE_SECRET;
+			if (master === void 0) return void 0;
+			const sealed = await createSecretStore(env.DB, () => clock.now()).read(site.key, `webhook:${webhook}`);
+			return sealed === null ? void 0 : await unseal(master, sealed) ?? void 0;
+		}
 	});
 	return {
 		fetch: createGateway({
 			sites,
+			siteKeys: registry.keys,
+			refresh,
 			mcp,
 			clock,
 			log: writeLog,
@@ -4554,7 +4889,7 @@ function createHollwareWith(config, handlers, options = {}) {
 				clock,
 				log: writeLog
 			}, env),
-			auth: resolved.auth,
+			auth: { dynamicClientRegistration: config?.auth?.dynamicClientRegistration ?? false },
 			handlers
 		}),
 		scheduled: async (controller, env, ctx) => {
@@ -4592,6 +4927,7 @@ function createHollwareWith(config, handlers, options = {}) {
 				});
 			}));
 			ctx.waitUntil((async () => {
+				await refresh(env.DB);
 				for (const site of sites.values()) await each(site).catch((error) => {
 					writeLog({
 						kind: "cron_failed",
@@ -4602,6 +4938,7 @@ function createHollwareWith(config, handlers, options = {}) {
 			})());
 		},
 		queue: async (batch, env) => {
+			await refresh(env.DB);
 			await consumeEvents(batch.messages, (key) => {
 				const site = sites.get(key);
 				return site === void 0 ? void 0 : deliveryDeps(env, site);
@@ -4609,6 +4946,7 @@ function createHollwareWith(config, handlers, options = {}) {
 		},
 		Hollware: createEntrypoint({
 			sites,
+			refresh,
 			handlers,
 			clock,
 			log: writeLog
@@ -4652,6 +4990,7 @@ function entrySummary(view) {
 		tags: [...revision.tags],
 		hasUnpublishedChanges: entry.publishedRevision !== entry.headRevision,
 		publishedAt: entry.publishedAt,
+		scheduledAt: entry.scheduledAt,
 		updatedAt: entry.updatedAt
 	};
 }
@@ -4863,7 +5202,7 @@ function requireLocale(site, locale) {
 function collectionOfEntry(site, entry) {
 	const collection = site.collections.get(entry.collection);
 	if (collection !== void 0) return collection;
-	throw new HollwareError("unknown_collection", `The entry ${entry.id} belongs to the collection ${shown(entry.collection)}, which the config of the site no longer declares.`, `Ask whoever maintains hollware.config.ts to declare the collection ${shown(entry.collection)} again: the entry and its revisions are kept.`);
+	throw new HollwareError("unknown_collection", `The entry ${entry.id} belongs to the collection ${shown(entry.collection)}, which the config of the site no longer declares.`, `Ask an owner of the site to add the collection ${shown(entry.collection)} again, with set_collection or in the admin: the entry and its revisions are kept.`);
 }
 //#endregion
 //#region src/ops/draft.ts
@@ -5171,6 +5510,184 @@ const search$1 = async (input, context) => {
 		}))
 	};
 };
+/** How many slugs of refused entries an answer names. */
+const EXAMPLES = 3;
+function structureOf(context) {
+	if (context.structure === void 0) throw internalError(context, "An operation on the structure ran where the structure is not reachable.");
+	return context.structure;
+}
+function actor(context) {
+	const { userId, meta } = actorOf(context);
+	return {
+		userId,
+		meta
+	};
+}
+/** The problems of a definition for `key`, or none: it compiles as the registry will compile it. */
+function problemsOf(key, definition) {
+	try {
+		compileSites({ [key]: definition });
+		return [];
+	} catch (error) {
+		if (error instanceof ConfigError) return error.problems.map((problem) => ({ ...problem }));
+		throw error;
+	}
+}
+async function impactOf(context, store, current, next) {
+	const site = context.site.key;
+	const counts = await store.counts(site);
+	const removedCollections = Object.keys(current.collections).filter((name) => next.collections[name] === void 0).map((name) => ({
+		name,
+		entries: counts.byCollection.get(name) ?? 0
+	})).filter((removed) => removed.entries > 0);
+	const removedLocales = current.locales.filter((locale) => !next.locales.includes(locale)).map((locale) => ({
+		locale,
+		entries: counts.byLocale.get(locale) ?? 0
+	})).filter((removed) => removed.entries > 0);
+	const compiled = compileSites({ [site]: next }).sites.get(site);
+	const refused = [];
+	for (const [name, collection] of Object.entries(next.collections)) {
+		const before = current.collections[name];
+		if (before === void 0 || canonicalJson(before.schema) === canonicalJson(collection.schema)) continue;
+		const schema = compiled?.collections.get(name)?.schema;
+		if (schema === void 0) continue;
+		const slugs = [];
+		for (const entry of await store.frontmatters(site, name, 500)) if ((await schema["~standard"].validate(entry.frontmatter)).issues !== void 0) slugs.push(entry.slug);
+		if (slugs.length > 0) refused.push({
+			collection: name,
+			entries: slugs.length,
+			examples: slugs.slice(0, EXAMPLES)
+		});
+	}
+	return {
+		removedCollections,
+		removedLocales,
+		refused
+	};
+}
+/** The definition of the site of the call, as stored, with its version. */
+async function currentOf(context) {
+	const stored = await structureOf(context).store.read(context.site.key);
+	if (stored === null) throw internalError(context, `The site ${context.site.key} is served and has no definition in D1.`);
+	return {
+		version: stored.version,
+		definition: siteDefinitionData.parse(stored.definition)
+	};
+}
+/** Replaces the definition of the site of the call with `next`, as update_site answers. */
+async function change(context, version, next, confirm) {
+	const structure = structureOf(context);
+	const problems = problemsOf(context.site.key, next);
+	if (problems.length > 0) return {
+		outcome: "invalid",
+		problems
+	};
+	const current = await currentOf(context);
+	if (current.version !== version) return {
+		outcome: "conflict",
+		currentVersion: current.version
+	};
+	if (canonicalJson(current.definition) === canonicalJson(next)) return {
+		outcome: "unchanged",
+		version
+	};
+	const impact = await impactOf(context, structure.store, current.definition, next);
+	if (impact.removedCollections.length + impact.removedLocales.length + impact.refused.length > 0 && !confirm) return {
+		outcome: "needs_confirmation",
+		impact
+	};
+	if (await structure.store.write({
+		site: context.site.key,
+		expected: version,
+		definition: next,
+		actor: actor(context)
+	}) === "conflict") return {
+		outcome: "conflict",
+		currentVersion: (await currentOf(context)).version
+	};
+	await structure.changed();
+	return {
+		outcome: "updated",
+		version: version + 1
+	};
+}
+const getStructure = async (_input, context) => {
+	const current = await currentOf(context);
+	return {
+		outcome: "ok",
+		site: context.site.key,
+		version: current.version,
+		definition: current.definition,
+		catalog: describeCatalog()
+	};
+};
+const updateSite = (input, context) => change(context, input.version, input.definition, input.confirm);
+const setCollection = async (input, context) => {
+	const current = await currentOf(context);
+	const collections = { ...current.definition.collections };
+	if (input.collection === null) delete collections[input.name];
+	else collections[input.name] = input.collection;
+	return change(context, input.version, {
+		...current.definition,
+		collections
+	}, input.confirm);
+};
+const createSite = async (input, context) => {
+	const structure = structureOf(context);
+	const problems = problemsOf(input.key, input.definition);
+	if (problems.length > 0) return {
+		outcome: "invalid",
+		problems
+	};
+	if (await structure.store.create({
+		site: input.key,
+		definition: input.definition,
+		actor: actor(context)
+	}) === "taken") return { outcome: "taken" };
+	await structure.changed();
+	return {
+		outcome: "created",
+		version: 1
+	};
+};
+/** Whether the person of the call owns `site`; a site they do not own is one they cannot see. */
+async function owns(context, site) {
+	return await structureOf(context).store.roleOf(site, actor(context).userId) === "owner";
+}
+const deleteSite = async (input, context) => {
+	const structure = structureOf(context);
+	const stored = await structure.store.read(input.key);
+	if (stored === null || stored.deletedAt !== null || !await owns(context, input.key)) return { outcome: "not_found" };
+	if (!input.confirm) {
+		const { byCollection } = await structure.store.counts(input.key);
+		return {
+			outcome: "needs_confirmation",
+			entries: [...byCollection.values()].reduce((sum, count) => sum + count, 0)
+		};
+	}
+	if (!await structure.store.trash(input.key, actor(context))) return { outcome: "not_found" };
+	await structure.changed();
+	return { outcome: "trashed" };
+};
+const restoreSite = async (input, context) => {
+	const structure = structureOf(context);
+	const stored = await structure.store.read(input.key);
+	if (stored === null || stored.deletedAt === null || !await owns(context, input.key)) return { outcome: "not_found" };
+	if (!await structure.store.restore(input.key, actor(context))) return { outcome: "not_found" };
+	await structure.changed();
+	return { outcome: "restored" };
+};
+const makeWebhookSecret = async (input, context) => {
+	const structure = structureOf(context);
+	const { definition } = await currentOf(context);
+	const webhook = definition.events.webhooks.find((candidate) => candidate.name === input.webhook);
+	if (webhook === void 0 || webhook.secret !== void 0) return { outcome: "not_found" };
+	const secret = await structure.secrets?.make(context.site.key, `webhook:${webhook.name}`) ?? null;
+	return secret === null ? { outcome: "unavailable" } : {
+		outcome: "made",
+		secret
+	};
+};
 //#endregion
 //#region src/ops/event.ts
 /** The path of an entry: the route of its locale, with its slug in place of `:slug`. */
@@ -5189,7 +5706,8 @@ function eventFor(input) {
 		at: input.at,
 		entry: input.entry,
 		path,
-		url: path === null || input.site.url === null ? null : `${input.site.url}${path}`
+		url: path === null || input.site.url === null ? null : `${input.site.url}${path}`,
+		cacheTags: tagsOfChange(input.entry)
 	};
 	return {
 		id,
@@ -5760,16 +6278,23 @@ const handlers = defineHandlers({
 	comment_review: commentReview,
 	content_stats: contentStats,
 	create_draft: createDraft,
+	create_site: createSite,
+	delete_site: deleteSite,
 	describe_site: describeSite$1,
 	get_entry: getEntry$1,
+	get_structure: getStructure,
 	get_translations: getTranslations$1,
 	list_entries: listEntries$1,
 	search: search$1,
 	list_reviews: listReviews,
+	make_webhook_secret: makeWebhookSecret,
 	publish: publish$1,
 	request_changes: requestChanges,
 	request_review: requestReview,
+	restore_site: restoreSite,
+	set_collection: setCollection,
 	unpublish,
+	update_site: updateSite,
 	update_draft: updateDraft,
 	validate
 });