@hollware/server 0.9.1 → 0.10.0

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { A as users, C as reviewComments, D as schedules, E as revisions, M as effectiveScopes, N as isRole, O as sites, S as publications, T as revisionTags, _ as entries, b as members, g as deliveries, j as ROLE_SCOPES, k as tokens, l as membershipsOf, n as createInvitation, s as findSession, v as entryEmbeddings, w as reviews, x as outbox, y as invitations } from "./store-C2hiR0yd.mjs";
-import { CHUNKER_VERSION, ConfigError, EVENT_ID_HEADER, HollwareError, OPERATIONS, SCOPES, SIGNATURE_HEADER, TIMESTAMP_HEADER, canonicalJson, chunksOf, compileSites, definitionsFromConfig, describeBuiltInContracts, describeCatalog, describeResolvedSite, describeSite, generatePersonalToken, generateReadToken, getEntry, getTranslations, hashPersonalToken, isPersonalToken, isReadToken, isScope, isSiteKey, listEntries, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, search, signWebhook, siteDefinitionData, sizeLimitViolation, tagsOfChange, uniqueSlugViolation, uniqueTranslationViolation } from "@hollware/core";
+import { A as users, C as reviewComments, D as schedules, E as revisions, M as effectiveScopes, N as isRole, O as sites, S as publications, T as revisionTags, _ as entries, b as members, g as deliveries, j as ROLE_SCOPES, k as tokens, l as membershipsOf, n as createInvitation, s as findSession, v as entryEmbeddings, w as reviews, x as outbox, y as invitations } from "./store-BPr9-wKy.mjs";
+import { CHUNKER_VERSION, ConfigError, EVENT_ID_HEADER, HollwareError, INDEXNOW_KEY, OPERATIONS, SCOPES, SIGNATURE_HEADER, TIMESTAMP_HEADER, canonicalJson, chunksOf, compileSites, definitionsFromConfig, describeBuiltInContracts, describeCatalog, describeResolvedSite, describeSite, generatePersonalToken, generateReadToken, getEntry, getTranslations, hashPersonalToken, isPersonalToken, isReadToken, isScope, isSiteKey, listEntries, newId, processMarkdown, publish, renderHtml, resolveConfig, runContracts, search, signWebhook, siteDefinitionData, sizeLimitViolation, tagsOfChange, tagsOfSiteChange, uniqueSlugViolation, uniqueTranslationViolation } from "@hollware/core";
 import { Hono } from "hono";
 import { drizzle } from "drizzle-orm/d1";
 import { and, asc, desc, eq, getTableColumns, gt, inArray, isNotNull, isNull, lte, ne, or, sql } from "drizzle-orm";
@@ -10,7 +10,7 @@ import { CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, McpServer, accepted
 import * as z from "zod";
 import { WorkerEntrypoint } from "cloudflare:workers";
 //#region package.json
-var version = "0.9.1";
+var version = "0.10.0";
 //#endregion
 //#region src/auth/responses.ts
 /** The challenge of every 401 and 403 (RFC 6750). */
@@ -390,6 +390,7 @@ const entryFields = {
 	publishedRev: entries.publishedRev,
 	publishedAt: entries.publishedAt,
 	scheduledAt: entries.scheduledAt,
+	deletedAt: entries.deletedAt,
 	updatedAt: entries.updatedAt
 };
 /** The columns of `revisions` that `StoredRevision` holds, except its tags. */
@@ -465,6 +466,7 @@ function toEntry(row) {
 		publishedRevision: row.publishedRev,
 		publishedAt: row.publishedAt,
 		scheduledAt: row.scheduledAt,
+		deletedAt: row.deletedAt,
 		updatedAt: row.updatedAt
 	};
 }
@@ -544,9 +546,15 @@ function revisionOf$1(view) {
 	const revisionId = view === "head" ? entries.headRev : entries.publishedRev;
 	return and(eq(revisions.id, revisionId), eq(revisions.siteId, entries.siteId));
 }
-/** What picks the entries of a view: the caller's conditions, and in the published view only published ones. */
-function viewWhere(view, conditions) {
-	return and(...conditions, view === "published" ? publishedOnly : void 0);
+/**
+* What picks the entries of a view: the caller's conditions, and in the published view only
+* published ones. The head view leaves out the entries in the trash, or lists only them when
+* `trashed` asks for the trash. The published view needs no such condition: only a draft goes to
+* the trash, and it stays a draft there.
+*/
+function viewWhere(view, conditions, trashed = false) {
+	if (view === "published") return and(...conditions, publishedOnly);
+	return and(...conditions, trashed ? isNotNull(entries.deletedAt) : isNull(entries.deletedAt));
 }
 /**
 * The entries of a site with the whole revision of a view, for the reads of one entry. The caller
@@ -570,13 +578,13 @@ function toEntryView(row) {
 * the revision only its id, its frontmatter and its tags. The sort key of the published view
 * comes along for the cursor.
 */
-function summaryQuery(db, view, conditions) {
+function summaryQuery(db, view, conditions, trashed = false) {
 	return db.select({
 		entry: entryFields,
 		revision: revisionSummaryFields,
 		tags: tagsOf$1(revisions),
 		sortKey: entries.publishedSortKey
-	}).from(entries).innerJoin(revisions, revisionOf$1(view)).where(viewWhere(view, conditions));
+	}).from(entries).innerJoin(revisions, revisionOf$1(view)).where(viewWhere(view, conditions, trashed));
 }
 function toEntrySummaryView(row) {
 	return {
@@ -632,7 +640,7 @@ function listEntriesQuery(db, site, query, cursor) {
 		query.view === "head" && query.status !== void 0 ? eq(entries.status, query.status) : void 0,
 		query.tag === void 0 ? void 0 : hasTag(site, query.tag),
 		cursor === null ? void 0 : sql`(${sortKey}, ${entries.id}) < (${cursor.key}, ${cursor.id})`
-	]).orderBy(desc(sortKey), desc(entries.id)).limit(query.limit + 1);
+	], query.trashed === true).orderBy(desc(sortKey), desc(entries.id)).limit(query.limit + 1);
 }
 /**
 * The FTS5 query of what someone typed: each of its words as a quoted string, so that FTS5's own
@@ -692,7 +700,7 @@ async function relatedOf(db, site, entryId) {
 async function listEntries$2(db, site, query) {
 	if (!Number.isInteger(query.limit) || query.limit < 1) throw new HollwareError("invalid_input", `The limit ${query.limit} is not a whole number of at least 1.`, "Ask for at least one entry per page.");
 	const cursor = query.cursor === void 0 ? null : decodeCursor(query.cursor, query.view);
-	if (query.view === "published" && query.status !== void 0 && query.status !== "published") return {
+	if (query.view === "published" && (query.trashed === true || query.status !== void 0 && query.status !== "published")) return {
 		entries: [],
 		nextCursor: null
 	};
@@ -753,7 +761,7 @@ function refKey(ref) {
 function refMatches(ref) {
 	return and(eq(entries.collection, ref.collection), eq(entries.locale, ref.locale), eq(entries.slug, ref.slug));
 }
-/** What cross-entry contracts read, scoped to one site. */
+/** What cross-entry contracts read, scoped to one site; an entry in the trash is not there. */
 function lookup(db, site) {
 	return {
 		/**
@@ -761,7 +769,7 @@ function lookup(db, site) {
 		* more, under D1's limit of bound values. A ref asked twice is asked once.
 		*/
 		async lookupMany(refs) {
-			const [first, ...rest] = chunk([...new Map(refs.map((ref) => [refKey(ref), ref])).values()], rowsPerStatement(1, 3)).map((group) => db.select(factFields).from(entries).where(and(eq(entries.siteId, site), or(...group.map(refMatches)))));
+			const [first, ...rest] = chunk([...new Map(refs.map((ref) => [refKey(ref), ref])).values()], rowsPerStatement(1, 3)).map((group) => db.select(factFields).from(entries).where(and(eq(entries.siteId, site), isNull(entries.deletedAt), or(...group.map(refMatches)))));
 			if (first === void 0) return [];
 			const found = /* @__PURE__ */ new Map();
 			for (const row of (await db.batch([first, ...rest])).flat()) found.set(refKey(row), {
@@ -772,7 +780,7 @@ function lookup(db, site) {
 			return refs.map((ref) => found.get(refKey(ref)) ?? null);
 		},
 		async translations(collection, translationGroup) {
-			return (await db.select(factFields).from(entries).where(and(eq(entries.siteId, site), eq(entries.collection, collection), eq(entries.translationGroup, translationGroup))).orderBy(entries.locale)).map((row) => ({
+			return (await db.select(factFields).from(entries).where(and(eq(entries.siteId, site), eq(entries.collection, collection), eq(entries.translationGroup, translationGroup), isNull(entries.deletedAt))).orderBy(entries.locale)).map((row) => ({
 				collection: row.collection,
 				locale: row.locale,
 				slug: row.slug,
@@ -1019,16 +1027,22 @@ function toReview(row) {
 		note: row.note
 	};
 }
-/** The entry is still at `version`: the condition of every statement a write adds to its batch. */
-function entryAt(site, entryId, version) {
-	return sql`exists (select 1 from ${entries} where ${and(eq(entries.id, entryId), eq(entries.siteId, site), eq(entries.version, version))})`;
+/**
+* The entry is still at `version`, and in the state `also` says: the condition of every statement
+* a write adds to its batch.
+*/
+function entryAt(site, entryId, version, also = []) {
+	return sql`exists (select 1 from ${entries} where ${and(eq(entries.id, entryId), eq(entries.siteId, site), eq(entries.version, version), ...also)})`;
 }
-/** In the batch of a new revision: the pending review asked for another one, so it is cancelled. */
-function cancelPendingReview(db, site, entryId, version, now) {
+/**
+* In the batch of a new revision: the pending review asked for another one, so it is cancelled.
+* In the batch of a trashing, too, where `also` holds what makes the entry one the trash takes.
+*/
+function cancelPendingReview(db, site, entryId, version, now, also = []) {
 	return db.update(reviews).set({
 		status: "cancelled",
 		updatedAt: now
-	}).where(and(eq(reviews.siteId, site), eq(reviews.entryId, entryId), eq(reviews.status, "pending"), entryAt(site, entryId, version)));
+	}).where(and(eq(reviews.siteId, site), eq(reviews.entryId, entryId), eq(reviews.status, "pending"), entryAt(site, entryId, version, also)));
 }
 /** In the batch of a publication: what the pending review asked for is published, by `userId`. */
 function approvePendingReview(db, site, entryId, version, userId, now) {
@@ -1203,23 +1217,33 @@ async function attempt(batch, holder) {
 		return { taken };
 	}
 }
-/** The entry that holds the slug or the translation that a new entry asks for; the slug first. */
+/**
+* The entry that holds the slug or the translation that a new entry asks for; the slug first. An
+* entry in the trash keeps both, and is named as `in_trash`, so that the caller restores it.
+*/
 async function holderOfNewEntry(db, site, entry) {
 	const rows = await db.select({
 		id: entries.id,
-		slug: entries.slug
+		slug: entries.slug,
+		deletedAt: entries.deletedAt
 	}).from(entries).where(and(eq(entries.siteId, site), eq(entries.collection, entry.collection), eq(entries.locale, entry.locale), or(eq(entries.slug, entry.slug), entry.translationGroup === null ? void 0 : eq(entries.translationGroup, entry.translationGroup))));
-	const bySlug = rows.find((row) => row.slug === entry.slug);
-	if (bySlug !== void 0) return {
+	const holder = rows.find((row) => row.slug === entry.slug) ?? rows[0];
+	if (holder === void 0) return null;
+	if (holder.deletedAt !== null) {
+		const view = await findTrashed(db, site, holder.id);
+		if (view !== null) return {
+			outcome: "in_trash",
+			view
+		};
+	}
+	return holder.slug === entry.slug ? {
 		outcome: "taken",
 		field: "slug",
-		by: bySlug.id
-	};
-	const [byGroup] = rows;
-	return byGroup === void 0 ? null : {
+		by: holder.id
+	} : {
 		outcome: "taken",
 		field: "translationGroup",
-		by: byGroup.id
+		by: holder.id
 	};
 }
 /** The other entry of the collection and locale of `entryId` that is in `translationGroup`. */
@@ -1319,6 +1343,7 @@ async function createEntry(db, clock, site, entry) {
 				publishedRevision: null,
 				publishedAt: null,
 				scheduledAt: null,
+				deletedAt: null,
 				updatedAt: now
 			},
 			revision: storedRevision({
@@ -1516,6 +1541,68 @@ async function unpublish$1(db, clock, site, write) {
 		view
 	};
 }
+/**
+* Moves a draft to the trash in one batch: its pending review is cancelled, and the entry gets its
+* `deleted_at` and the next version, both only while it is a draft out of the trash at
+* `expectedVersion`. When the update touches nothing, one read tells why.
+*/
+async function trashEntry(db, clock, site, write) {
+	const now = clock.now().toISOString();
+	const trashable = [eq(entries.status, "draft"), isNull(entries.deletedAt)];
+	const [, updated] = await db.batch([cancelPendingReview(db, site, write.entryId, write.expectedVersion, now, trashable), db.update(entries).set({
+		deletedAt: now,
+		version: sql`${entries.version} + 1`,
+		updatedAt: now
+	}).where(and(eq(entries.id, write.entryId), eq(entries.siteId, site), eq(entries.version, write.expectedVersion), ...trashable)).returning({ id: entries.id })]);
+	if (updated.length === 0) {
+		const view = await findEntryById(db, site, write.entryId, "head");
+		if (view === null) return { outcome: "not_found" };
+		if (view.entry.version !== write.expectedVersion) return {
+			outcome: "conflict",
+			currentVersion: view.entry.version,
+			headRevision: view.entry.headRevision
+		};
+		return {
+			outcome: "not_draft",
+			view
+		};
+	}
+	const view = await findTrashed(db, site, write.entryId);
+	if (view === null) throw new Error(`Entry ${write.entryId} is not in the trash after its trashing`);
+	return {
+		outcome: "trashed",
+		view
+	};
+}
+/** Brings an entry back from the trash as the draft it was, at the next version. */
+async function restoreEntry$1(db, clock, site, entryId) {
+	const now = clock.now().toISOString();
+	const updated = await db.update(entries).set({
+		deletedAt: null,
+		version: sql`${entries.version} + 1`,
+		updatedAt: now
+	}).where(and(eq(entries.id, entryId), eq(entries.siteId, site), isNotNull(entries.deletedAt))).returning({ id: entries.id });
+	const view = await findEntryById(db, site, entryId, "head");
+	if (view === null) return { outcome: "not_found" };
+	return {
+		outcome: updated.length === 0 ? "not_trashed" : "restored",
+		view
+	};
+}
+/** An entry in the trash with its head revision, which the reads of the store leave out. */
+async function findTrashed(db, site, entryId) {
+	const [row] = await db.select({
+		entry: entryFields,
+		headRev: entries.headRev
+	}).from(entries).where(and(eq(entries.id, entryId), eq(entries.siteId, site), isNotNull(entries.deletedAt))).limit(1);
+	if (row === void 0) return null;
+	const revision = await findRevision(db, site, row.headRev);
+	if (revision === null) throw new Error(`The head revision of entry ${entryId} is not there`);
+	return {
+		entry: toEntry(row.entry),
+		revision
+	};
+}
 /** Drops the schedule of an entry in the batch that publishes it, if it is at `version`. */
 function dropScheduleAtVersion(db, site, entryId, version) {
 	return db.delete(schedules).where(and(eq(schedules.siteId, site), eq(schedules.entryId, entryId), sql`exists (select 1 from ${entries} where ${and(eq(entries.id, entryId), eq(entries.siteId, site), eq(entries.version, version))})`));
@@ -1567,6 +1654,8 @@ function createD1Store(db, options = {}) {
 		dueSchedules: (site, now) => dueSchedules(database, site, now),
 		cancelSchedule: (site, entryId) => cancelSchedule(database, clock, site, entryId),
 		unpublish: (site, write) => unpublish$1(database, clock, site, write),
+		trashEntry: (site, write) => trashEntry(database, clock, site, write),
+		restoreEntry: (site, entryId) => restoreEntry$1(database, clock, site, entryId),
 		requestReview: (site, write) => requestReview$1(database, clock, site, write, () => whyNothingChanged(database, site, write.entryId)),
 		findReview: (site, id) => findReview(database, site, id),
 		listReviews: (site, query) => listReviews$1(database, site, query),
@@ -1851,9 +1940,8 @@ function subscribersOf(deps) {
 		subscribers.push({
 			name: "indexnow",
 			async send(payload) {
-				if (payload.url === null) return;
-				const key = deps.secret(indexNow.key);
-				if (key === void 0) throw new Error(`the secret ${indexNow.key} is not set`);
+				if (payload.kind === "site.changed" || payload.url === null) return;
+				const key = indexNow.key;
 				const request = new Request(INDEXNOW_ENDPOINT, {
 					method: "POST",
 					headers: { "content-type": "application/json; charset=utf-8" },
@@ -1871,6 +1959,7 @@ function subscribersOf(deps) {
 	if (semantic !== void 0 && semantic !== null) subscribers.push({
 		name: "vectors",
 		async send(payload) {
+			if (payload.kind === "site.changed") return;
 			await syncEntryVectors(deps.db, semantic, {
 				site: site.key,
 				entryId: payload.entry.id,
@@ -2038,9 +2127,9 @@ function metaOf(actor) {
 	return actor.meta === null ? null : JSON.stringify(actor.meta);
 }
 /** The change a statement before it made, at the site's version now, if that version is new. */
-function appendChange(db, site, actor, now, before, after) {
+function appendChange(db, site, actor, now, before, after, id = newId("sit")) {
 	return db.prepare(`INSERT OR IGNORE INTO site_changes (id, site_id, version, actor_user_id, actor_meta, before, after, created_at, updated_at)
-       SELECT ?1, id, version, ?2, ?3, ?4, ${after === "definition" ? "definition" : "NULL"}, ?5, ?5 FROM sites WHERE id = ?6 AND updated_at = ?5`).bind(newId("sit"), actor.userId, metaOf(actor), before, now, site);
+       SELECT ?1, id, version, ?2, ?3, ?4, ${after === "definition" ? "definition" : "NULL"}, ?5, ?5 FROM sites WHERE id = ?6 AND updated_at = ?5`).bind(id, actor.userId, metaOf(actor), before, now, site);
 }
 function createStructureStore(db, now) {
 	return {
@@ -2053,10 +2142,17 @@ function createStructureStore(db, now) {
 				deletedAt: row.deleted_at
 			};
 		},
-		async write({ site, expected, definition, actor }) {
+		async write({ site, expected, definition, actor, event }) {
 			const at = now().toISOString();
+			const change = newId("sit");
 			const before = await db.prepare("SELECT definition FROM sites WHERE id = ?1").bind(site).first("definition");
-			const [moved] = await db.batch([db.prepare("UPDATE sites SET definition = ?1, version = version + 1, updated_at = ?2 WHERE id = ?3 AND version = ?4 AND deleted_at IS NULL").bind(JSON.stringify(definition), at, site, expected), appendChange(db, site, actor, at, before ?? null, "definition")]);
+			const [moved] = await db.batch([
+				db.prepare("UPDATE sites SET definition = ?1, version = version + 1, updated_at = ?2 WHERE id = ?3 AND version = ?4 AND deleted_at IS NULL").bind(JSON.stringify(definition), at, site, expected),
+				appendChange(db, site, actor, at, before ?? null, "definition", change),
+				...event === void 0 ? [] : [db.prepare(`INSERT INTO outbox (id, site_id, kind, entry_id, payload, sent_at, created_at, updated_at)
+                   SELECT ?1, ?2, 'site.changed', NULL, ?3, NULL, ?4, ?4
+                   WHERE EXISTS (SELECT 1 FROM site_changes WHERE id = ?5 AND site_id = ?2)`).bind(event.id, site, event.payload, at, change)]
+			]);
 			return (moved?.meta.changes ?? 0) === 1 ? "written" : "conflict";
 		},
 		async create({ site, definition, actor }) {
@@ -3157,15 +3253,31 @@ function setupPage(nonce) {
   } catch (error) { fail(error) }
 })`);
 }
+/**
+* Where the sign-in page sends the person after their passkey: the `return_to` it was given, if it
+* is a page of this origin, else the admin. The target is read as the browser will read it, as a
+* URL against the page's own origin, so no way of writing another host (`//`, `/\`, a tab, a
+* scheme) gets through, and only the path, query and fragment it resolves to are used (T-43).
+* The page runs its source as it is: it uses nothing but its arguments and the URL of the platform.
+*/
+function sameOriginTarget(target, origin) {
+	if (target === null) return "/admin/";
+	try {
+		const url = new URL(target, origin);
+		return url.origin === origin ? `${url.pathname}${url.search}${url.hash}` : "/admin/";
+	} catch {
+		return "/admin/";
+	}
+}
 function signInPage(nonce) {
 	return page("Sign in", nonce, `<p>Sign in to this Hollware with your passkey.</p>
-<button id="signin" type="button">Sign in with a passkey</button>`, `document.getElementById('signin').addEventListener('click', async () => {
+<button id="signin" type="button">Sign in with a passkey</button>`, `const sameOriginTarget = ${sameOriginTarget.toString()}
+document.getElementById('signin').addEventListener('click', async () => {
   try {
     const { challengeId, options } = await post('/auth/signin/options', {})
     const credential = await navigator.credentials.get({ publicKey: PublicKeyCredential.parseRequestOptionsFromJSON(options) })
     await post('/auth/signin/verify', { challengeId, response: credential.toJSON() })
-    const target = new URLSearchParams(location.search).get('return_to') ?? '/admin/'
-    location.href = target.startsWith('/') && !target.startsWith('//') ? target : '/admin/'
+    location.href = sameOriginTarget(new URLSearchParams(location.search).get('return_to'), location.origin)
   } catch (error) { fail(error) }
 })`);
 }
@@ -3267,7 +3379,7 @@ function plainPageHeaders() {
 * The ceremonies, with SimpleWebAuthn and its parsers, in a chunk of their own: only these four
 * routes use them, and a Worker that serves MCP never pays for them at startup (`budgets.json`).
 */
-const ceremonies = () => import("./ceremonies-D5dIEbha.mjs");
+const ceremonies = () => import("./ceremonies-DDoGdUD7.mjs");
 /** The cookie of a signed-in person: only `/authorize` reads it (ADR-026). */
 const SESSION_COOKIE = "hollware_session";
 function sessionCookie(secret) {
@@ -4161,6 +4273,8 @@ const OUTPUT_TOO_LARGE_FIX = {
 	update_draft: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
 	create_site: "The site was made and holds little: read it with get_structure from a token of that site.",
 	delete_site: "Nothing to ask for less of: the answer is a count. Try again.",
+	delete_entry: "The operation ran and its change may have been applied: list the trash with list_entries and trashed before you repeat it.",
+	restore_entry: "The operation ran and its change may have been applied: read the entry with get_entry before you repeat it.",
 	make_webhook_secret: "Nothing to ask for less of: the answer is one secret. Try again.",
 	get_structure: "The structure does not fit in one answer: read the collections with describe_site instead, and change them one at a time with set_collection.",
 	restore_site: "Nothing to ask for less of: the answer is an outcome. Try again.",
@@ -4773,7 +4887,7 @@ function createSiteRegistry(options) {
 		for (const row of fetched) {
 			if (row.definition === null || (next.get(row.id)?.version ?? -1) >= row.version) continue;
 			try {
-				const definition = JSON.parse(row.definition);
+				const definition = withoutStaleIndexNow(row.id, JSON.parse(row.definition), options.log);
 				const site = compileSites({ [row.id]: definition }).sites.get(row.id);
 				if (site !== void 0) next.set(row.id, {
 					version: row.version,
@@ -4805,6 +4919,33 @@ function createSiteRegistry(options) {
 		refresh
 	};
 }
+/**
+* A definition stored before 0.10 named the Worker secret of its IndexNow key; since then it holds
+* the key itself (T-69 of docs/security/threat-model.md). A stored one of the old form is served
+* with IndexNow off, and says so, instead of failing to compile and leaving its site unserved: its
+* owner sets the key itself in the admin or with update_site, which refuses the old form.
+*/
+function withoutStaleIndexNow(site, definition, log) {
+	if (typeof definition !== "object" || definition === null) return definition;
+	const events = Reflect.get(definition, "events");
+	if (typeof events !== "object" || events === null) return definition;
+	const indexNow = Reflect.get(events, "indexNow");
+	if (typeof indexNow !== "object" || indexNow === null) return definition;
+	const key = Reflect.get(indexNow, "key");
+	if (typeof key === "string" && INDEXNOW_KEY.test(key)) return definition;
+	log({
+		kind: "indexnow_off",
+		site,
+		reason: "the definition names a secret, not the key itself"
+	});
+	return {
+		...definition,
+		events: {
+			...events,
+			indexNow: null
+		}
+	};
+}
 //#endregion
 //#region src/compose.ts
 const systemClock = { now: () => /* @__PURE__ */ new Date() };
@@ -4991,6 +5132,7 @@ function entrySummary(view) {
 		hasUnpublishedChanges: entry.publishedRevision !== entry.headRevision,
 		publishedAt: entry.publishedAt,
 		scheduledAt: entry.scheduledAt,
+		deletedAt: entry.deletedAt,
 		updatedAt: entry.updatedAt
 	};
 }
@@ -5326,6 +5468,10 @@ const createDraft = async (input, context) => {
 			entry: entrySummary(written.view),
 			verdict: verdictView(verdict)
 		};
+		case "in_trash": return {
+			outcome: "in_trash",
+			entry: entrySummary(written.view)
+		};
 		case "taken":
 		case "too_large": return {
 			outcome: "refused",
@@ -5413,6 +5559,7 @@ const listEntries$1 = async (input, context) => {
 		locale: input.locale,
 		tag: input.tag,
 		status: input.status,
+		trashed: input.trashed,
 		view: context.view,
 		limit: input.limit,
 		cursor: input.cursor
@@ -5510,6 +5657,50 @@ const search$1 = async (input, context) => {
 		}))
 	};
 };
+//#endregion
+//#region src/ops/event.ts
+/** The path of an entry: the route of its locale, with its slug in place of `:slug`. */
+function entryPath(collection, locale, slug) {
+	const route = collection.routes[locale];
+	return route === void 0 ? null : route.replace(/:slug(?![A-Za-z0-9_])/, slug);
+}
+/** The event of a publish or an unpublish, ready for the outbox. */
+function eventFor(input) {
+	const id = newId("evt");
+	const path = entryPath(input.collection, input.entry.locale, input.entry.slug);
+	const payload = {
+		id,
+		kind: input.kind,
+		site: input.site.key,
+		at: input.at,
+		entry: input.entry,
+		path,
+		url: path === null || input.site.url === null ? null : `${input.site.url}${path}`,
+		cacheTags: tagsOfChange(input.entry)
+	};
+	return {
+		id,
+		payload: JSON.stringify(payload)
+	};
+}
+/**
+* The event of a change of a site's structure, ready for the outbox: the tags of the site and of
+* every list of the collections and locales of its definition before and after the change.
+*/
+function siteEventFor(input) {
+	const id = newId("evt");
+	const payload = {
+		id,
+		kind: "site.changed",
+		site: input.site,
+		at: input.at,
+		cacheTags: tagsOfSiteChange(input.collections, input.locales)
+	};
+	return {
+		id,
+		payload: JSON.stringify(payload)
+	};
+}
 /** How many slugs of refused entries an answer names. */
 const EXAMPLES = 3;
 function structureOf(context) {
@@ -5596,15 +5787,23 @@ async function change(context, version, next, confirm) {
 		outcome: "needs_confirmation",
 		impact
 	};
+	const event = siteEventFor({
+		site: context.site.key,
+		at: context.clock.now().toISOString(),
+		collections: [.../* @__PURE__ */ new Set([...Object.keys(current.definition.collections), ...Object.keys(next.collections)])],
+		locales: [.../* @__PURE__ */ new Set([...current.definition.locales, ...next.locales])]
+	});
 	if (await structure.store.write({
 		site: context.site.key,
 		expected: version,
 		definition: next,
-		actor: actor(context)
+		actor: actor(context),
+		event
 	}) === "conflict") return {
 		outcome: "conflict",
 		currentVersion: (await currentOf(context)).version
 	};
+	context.notify?.([event.id]);
 	await structure.changed();
 	return {
 		outcome: "updated",
@@ -5689,32 +5888,6 @@ const makeWebhookSecret = async (input, context) => {
 	};
 };
 //#endregion
-//#region src/ops/event.ts
-/** The path of an entry: the route of its locale, with its slug in place of `:slug`. */
-function entryPath(collection, locale, slug) {
-	const route = collection.routes[locale];
-	return route === void 0 ? null : route.replace(/:slug(?![A-Za-z0-9_])/, slug);
-}
-/** The event of a publish or an unpublish, ready for the outbox. */
-function eventFor(input) {
-	const id = newId("evt");
-	const path = entryPath(input.collection, input.entry.locale, input.entry.slug);
-	const payload = {
-		id,
-		kind: input.kind,
-		site: input.site.key,
-		at: input.at,
-		entry: input.entry,
-		path,
-		url: path === null || input.site.url === null ? null : `${input.site.url}${path}`,
-		cacheTags: tagsOfChange(input.entry)
-	};
-	return {
-		id,
-		payload: JSON.stringify(payload)
-	};
-}
-//#endregion
 //#region src/ops/publish.ts
 /** A warning by what an acknowledgement names: its contract and its path, never its line. */
 function warningKey(warning) {
@@ -6010,7 +6183,7 @@ const listReviews = async (input, context) => {
 	const reviews = [];
 	for (const review of found) {
 		const view = await context.store.findEntryById(context.site.key, review.entryId, "head");
-		if (view === null) throw unexpectedAnswer(context, "list_reviews", { outcome: "no entry" });
+		if (view === null) continue;
 		reviews.push({
 			...reviewView(review),
 			entry: entrySummary(view),
@@ -6131,6 +6304,52 @@ const requestReview = async (input, context) => {
 	}
 };
 //#endregion
+//#region src/ops/trash.ts
+/**
+* The trash of entries. Only a draft goes there: a published or scheduled entry is unpublished
+* first. Nothing is deleted, since revisions, tags and publications are append-only (ADR-021): the
+* entry gets its `deletedAt`, every read leaves it out, and it keeps its slug and translation
+* until it is restored as the draft it was.
+*/
+/**
+* Moves a draft to the trash, if it is still at the version the caller read. The store checks it
+* all in the write: an entry that is not there (or is in the trash already) is `not_found`, another
+* version is `conflict`, and what is published or scheduled is taken off the site first.
+*/
+const deleteEntry = async (input, context) => {
+	const written = await context.store.trashEntry(context.site.key, {
+		entryId: input.id,
+		expectedVersion: input.version
+	});
+	switch (written.outcome) {
+		case "trashed": return {
+			outcome: "trashed",
+			entry: entrySummary(written.view)
+		};
+		case "not_draft": return {
+			outcome: "published",
+			entry: entrySummary(written.view)
+		};
+		case "conflict": return {
+			outcome: "conflict",
+			conflict: conflictAt(written.currentVersion, written.headRevision)
+		};
+		case "not_found": return { outcome: "not_found" };
+	}
+};
+/** Brings an entry back from the trash as the draft it was. */
+const restoreEntry = async (input, context) => {
+	const written = await context.store.restoreEntry(context.site.key, input.id);
+	switch (written.outcome) {
+		case "restored":
+		case "not_trashed": return {
+			outcome: written.outcome,
+			entry: entrySummary(written.view)
+		};
+		case "not_found": return { outcome: "not_found" };
+	}
+};
+//#endregion
 //#region src/ops/unpublish.ts
 /**
 * Takes an entry off the public site and keeps it, with its revisions, as a draft. The store
@@ -6279,6 +6498,7 @@ const handlers = defineHandlers({
 	content_stats: contentStats,
 	create_draft: createDraft,
 	create_site: createSite,
+	delete_entry: deleteEntry,
 	delete_site: deleteSite,
 	describe_site: describeSite$1,
 	get_entry: getEntry$1,
@@ -6291,6 +6511,7 @@ const handlers = defineHandlers({
 	publish: publish$1,
 	request_changes: requestChanges,
 	request_review: requestReview,
+	restore_entry: restoreEntry,
 	restore_site: restoreSite,
 	set_collection: setCollection,
 	unpublish,

package/dist/{store-C2hiR0yd.mjs → store-BPr9-wKy.mjs}

@@ -189,6 +189,11 @@ const entries = sqliteTable("entries", {
 	publishedAt: text("published_at"),
 	publishedSortKey: text("published_sort_key"),
 	scheduledAt: text("scheduled_at"),
+	/**
+	* When the entry went to the trash, or null. A trashed entry keeps its row, its slug and its
+	* translation group: only a draft goes there, and it comes back as the draft it was.
+	*/
+	deletedAt: text("deleted_at"),
 	...timestamps()
 }, (t) => [
 	unique("entries_id_site").on(t.id, t.siteId),
@@ -381,14 +386,16 @@ const schedules = sqliteTable("schedules", {
 /**
 * The effects of a publication (ADR-025), written in the batch that publishes or unpublishes: one
 * row per event. The Queue consumer delivers each event to every subscriber, and records it in
-* `deliveries`; `sent_at` says that the event was put on the Queue.
+* `deliveries`; `sent_at` says that the event was put on the Queue. A change of the structure of
+* the site (ADR-033) is an event too, `site.changed`, about no entry.
 */
 const outbox = sqliteTable("outbox", {
 	id: id("evt"),
 	siteId: siteId(),
-	/** `entry.published` or `entry.unpublished`. */
+	/** `entry.published`, `entry.unpublished`, or `site.changed`. */
 	kind: text("kind").notNull(),
-	entryId: text("entry_id").notNull(),
+	/** The entry of an event about one, and none for `site.changed`. */
+	entryId: text("entry_id"),
 	/** A JSON object: what subscribers get. */
 	payload: text("payload").notNull(),
 	sentAt: text("sent_at"),
@@ -401,7 +408,8 @@ const outbox = sqliteTable("outbox", {
 		columns: [t.siteId],
 		foreignColumns: [sites.id]
 	}),
-	check("outbox_kind", sql`${t.kind} IN ('entry.published', 'entry.unpublished')`),
+	check("outbox_kind", sql`${t.kind} IN ('entry.published', 'entry.unpublished', 'site.changed')`),
+	check("outbox_entry", sql`(${t.kind} = 'site.changed') = (${t.entryId} IS NULL)`),
 	check("outbox_json", sql`json_valid(${t.payload}) AND json_type(${t.payload}) = 'object'`)
 ]);
 /** Each delivery of an event to a subscriber, so that a retry never delivers it twice. */