@makerclay/core 1.0.0

package/src/boot.js

@@ -0,0 +1,120 @@
+import { jsonError } from './json-errors.js';
+import { wrap } from './util/express.js';
+import { mountRecoveryUi } from './recovery-ui.js';
+
+// Starting up, and refusing to serve until the host knows it can.
+//
+// Boot work that genuinely cannot be synchronous: finish any interrupted
+// operation, decide whether the overlay is trustworthy, rebuild it if the db is
+// gone, then scan and watch. Every request waits on it, because serving a
+// document before the overlay is reconciled is how a private file gets served
+// public exactly once.
+
+// Recovery mode (§18.3). A half-started server sitting on uncertain privacy
+// metadata is worse than a clearly refused one, so this is a wall, not a warning.
+const RECOVERY_MESSAGE =
+  'makerclay started in recovery mode and is not serving documents. ' +
+  'Run `makerclay doctor` for the repair plan.';
+
+export function mountBoot({
+  app, config, paths, store, storeError, recovery, scanner, ui, logger,
+}) {
+  let state = { state: 'starting' };
+
+  function tenantRealms() {
+    if (!store) return [];
+    try {
+      return store.listTenants().map((tenant) => tenant.username);
+    } catch (error) {
+      logger.warn?.('[makerclay] could not list tenants to scan:', error?.message || error);
+      return [];
+    }
+  }
+
+  async function boot() {
+    if (storeError) {
+      state = {
+        state: 'recover',
+        reason: 'store-open-failed',
+        error: storeError.message || String(storeError),
+      };
+      logger.error?.(`[makerclay] ${RECOVERY_MESSAGE} (${state.reason}): ${state.error}`);
+      return state;
+    }
+    const interrupted = await recovery.recoverOperations();
+    let assessment = await recovery.assess();
+
+    if (assessment.state === 'rebuild') {
+      const rebuilt = await recovery.rebuild();
+      assessment = { state: 'normal', reason: 'rebuilt-from-disk', ...rebuilt };
+    }
+    if (interrupted.ambiguous.length) {
+      assessment = {
+        state: 'recover',
+        reason: 'ambiguous-operations',
+        ambiguous: interrupted.ambiguous,
+      };
+    }
+    state = { ...assessment, interrupted };
+
+    if (state.state === 'recover') {
+      logger.error?.(`[makerclay] ${RECOVERY_MESSAGE} (${state.reason})`);
+      return state;
+    }
+    // Before the scan, always: a record whose path is stale points at nothing,
+    // and the scan is what relocates its row to wherever the bytes actually are,
+    // carrying the flags with it.
+    state.reconciled = await recovery.reconcileMeta();
+    recovery.markInstalled();
+    await ui.ensure();
+    if (config.scan.boot !== false) state.scan = await scanner.scan({ owner: '' });
+    if (config.scan.watch !== false) scanner.watch({ owner: '' });
+    // A tenant realm is a realm. Scanning only the owner's tree meant no tenant
+    // document ever had identity maintenance: a tenant rename was rebound
+    // neither online nor at boot, and the tenant then saved the new path as a
+    // new identity while the history stayed on the missing one.
+    for (const realm of tenantRealms()) {
+      if (config.scan.boot !== false) {
+        // One realm is not the whole host. A tenant directory that was moved or
+        // deleted by hand must cost that realm its scan, never the boot.
+        try {
+          await scanner.scan({ owner: realm });
+        } catch (error) {
+          logger.warn?.(`[makerclay] could not scan the realm of ${realm}:`, error?.message || error);
+        }
+      }
+      if (config.scan.watch !== false) scanner.watch({ owner: realm });
+    }
+    return state;
+  }
+
+  const ready = boot().catch((error) => {
+    logger.error?.('[makerclay] boot failed:', error?.message || error);
+    state = { state: 'recover', reason: 'boot-failed', error: error?.message || String(error) };
+    return state;
+  });
+
+  // Mounted BEFORE the wall, and inert unless the wall is up. Loopback only:
+  // the operator is at the machine. (§18.3)
+  app.use('/_/recover', wrap(async (req, res, next) => { await ready; return next(); }));
+  const recoveryUi = mountRecoveryUi({ app, paths, store, recovery, stateOf: () => state, logger });
+
+  // The key is printed here and nowhere else. That is the whole mechanism: a
+  // proxy on the same box makes every request look like loopback, so reading
+  // this console is what proves the reader is at the machine.
+  ready.then((settled) => {
+    if (settled?.state !== 'recover') return;
+    const where = config.port ? `http://127.0.0.1:${config.port}` : '';
+    logger.error?.(`[makerclay] recovery UI (this machine only): ${where}${recoveryUi.url}`);
+  });
+
+  app.use(wrap(async (req, res, next) => {
+    await ready;
+    if (state.state === 'recover' && req.path !== '/_/health') {
+      return jsonError(res, 'unavailable', RECOVERY_MESSAGE, { reason: state.reason });
+    }
+    return next();
+  }));
+
+  return { ready, recoveryUi, get state() { return state; } };
+}

package/src/client.js

@@ -0,0 +1,99 @@
+import path from 'upath';
+import { createRequire } from 'node:module';
+import { statIfExists } from './util/fsx.js';
+import { jsonError } from './json-errors.js';
+
+// The entry scripts clayjs publishes: `clay.js` and its `clay-*` satellites,
+// plus `sap.js` and `all.js`. Matched by shape rather than listed by name, and
+// shared with the preflight below so the two cannot disagree about which names
+// exist.
+const SATELLITE_PATTERN = /^\/(clay[\w-]*\.js|sap\.js|all\.js)$/;
+
+// The self-hosted client (§17.4).
+//
+// Everything points at /_/clay.js, never at a CDN: an offline or firewalled box
+// works, the client version is pinned to the server version so a conformance
+// claim names a known pair, and loading a page is not reported to a third party.
+//
+// clay.js derives its module base from its own <script src>, then dynamically
+// imports `${base}/src/loader.js` and hands it the query string. Served at
+// /_/clay.js, that resolves to /_/src/loader.js and `?plugins=` passes through
+// untouched, so no rewriting is needed at all.
+//
+// The ACAO header on these two routes is load-bearing rather than decorative: a
+// sandboxed document has an OPAQUE origin, and a dynamic import() from an
+// opaque origin is CORS-subject. Without it, clayjs silently fails to boot
+// inside every isolated instance (§16.3). It is safe precisely because these
+// bytes are a public library and carry nothing user-specific.
+
+function locateClay() {
+  try {
+    const require_ = createRequire(import.meta.url);
+    // The package root, not the entry file's directory. clayjs keeps its public scripts
+    // in entries/ and src/ is their sibling at the package root, so resolving clay.js and
+    // taking its dirname would send every /src/* lookup inside entries/ and 404 the whole
+    // module graph. package.json is the one file guaranteed to sit at the root.
+    return path.dirname(require_.resolve('@panphora/clayjs/package.json'));
+  } catch {
+    return null;
+  }
+}
+
+export function mountClientRoutes({ router, logger = console }) {
+  const root = locateClay();
+  if (!root) {
+    logger.warn?.('[makerclay] @panphora/clayjs is not installed; /_/clay.js will 404');
+  }
+
+  function scriptHeaders(res) {
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Vary', 'Origin');
+    res.setHeader('Content-Type', 'application/javascript; charset=utf-8');
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    // Pinned to the installed version, but an upgrade must not leave a browser
+    // holding stale client code, so revalidate rather than cache blindly.
+    res.setHeader('Cache-Control', 'public, max-age=0, must-revalidate');
+  }
+
+  function sendScript(res, file) {
+    scriptHeaders(res);
+    return res.sendFile(file);
+  }
+
+  // The installed package is the list. A hardcoded set of names has to track
+  // another package's contents, and it did not: clayjs grew `clay-internals.js`
+  // and this host answered 404 for it while its preflight said yes. The shape is
+  // still constrained, and the name can hold no slash, so nothing outside the
+  // package's own entry scripts is reachable.
+  router.get(SATELLITE_PATTERN, async (req, res) => {
+    if (!root) return jsonError(res, 'not-found', 'This host has no bundled client.');
+    const name = req.params[0];
+    // entries/ since clayjs 0.8.0, the package root before it. Try both rather than
+    // sniffing a version, so either installed layout serves.
+    for (const file of [path.join(root, 'entries', name), path.join(root, name)]) {
+      if (await statIfExists(file)) return sendScript(res, file);
+    }
+    return jsonError(res, 'not-found', 'Not found');
+  });
+
+  router.get(/^\/src\/(.+)$/, async (req, res) => {
+    if (!root) return jsonError(res, 'not-found', 'This host has no bundled client.');
+    const rest = req.params[0];
+    if (rest.includes('\0') || rest.split('/').some((segment) => segment === '..' || segment === '.')) {
+      return jsonError(res, 'not-found', 'Not found');
+    }
+    const base = path.join(root, 'src');
+    const file = path.resolve(path.join(base, rest));
+    if (file !== base && !file.startsWith(`${base}/`)) return jsonError(res, 'not-found', 'Not found');
+    if (!(await statIfExists(file))) return jsonError(res, 'not-found', 'Not found');
+    return sendScript(res, file);
+  });
+
+  router.options(/^\/(src\/.+|clay[\w-]*\.js|sap\.js|all\.js)$/, (req, res) => {
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Vary', 'Origin');
+    res.status(204).end();
+  });
+
+  return { root };
+}

package/src/collections/index.js

@@ -0,0 +1,397 @@
+import crypto from 'node:crypto';
+import { can } from '../auth/can.js';
+import { HostError } from '../spec/codes.js';
+import { hashPassword, verifyPassword } from '../auth/passwords.js';
+import { token as mintToken } from '../util/id.js';
+import {
+  atomicWrite, readFileTextIfExists, readdirIfExists, mkdirp, 
+} from '../util/fsx.js';
+
+// Collections: a document plus the submissions people send it.
+//
+// The mechanics are the platform's, with the state moved out of columns on the
+// node and into the `collections` table, so unmarking is one DELETE and the
+// files and records survive it untouched.
+//
+// Three lessons from the platform that the port must not lose:
+//
+//   1. ANTI-SQUAT. A stranger submitting without a write code always gets a
+//      server-generated opaque id, never the key they asked for. Otherwise the
+//      first person to POST `key: "david"` owns that record forever.
+//   2. THE PHONE RULE. A key made only of digits and phone punctuation collapses
+//      to its digits, so `(415) 555-0100` finds `4155550100`.
+//   3. RECORD AUTH SOFT-DELETES WITH ITS RECORD. The platform hard-deletes the
+//      auth row on trash, so a restored keyed record comes back PUBLIC with no
+//      code. Here both go down and come back together.
+
+const MAX_FAILURES = 10;
+const LOCKOUT_MS = 15 * 60 * 1000;
+const CODE_COOKIE_MAX_AGE = 365 * 24 * 60 * 60;
+const SAFE_FILENAME = /^[a-z0-9._@-]{1,80}$/;
+
+export function normalizeKey(raw) {
+  const value = String(raw ?? '').trim();
+  if (!value) return null;
+  // Lesson 2. Only when it is unambiguously a number: a key of "2024" stays a
+  // key, but it has no punctuation to lose either way.
+  if (/^[0-9()+.\-\s]+$/.test(value) && /\d/.test(value)) {
+    const digits = value.replace(/\D/g, '');
+    if (digits.length >= 4) return digits;
+  }
+  return value.toLowerCase().replace(/\s+/g, ' ');
+}
+
+// Byte lengths first, exactly as auth/password.js does it. Padding to a fixed
+// width equalises CHARACTERS, not bytes, so one multi-byte character makes the
+// two buffers different lengths and timingSafeEqual THROWS. On the CSRF-exempt,
+// CORS-open submit lane that turns an unauthorized answer into a 500 for anyone
+// who knows a slug.
+function timingSafeEquals(a, b) {
+  const left = Buffer.from(String(a ?? ''), 'utf8');
+  const right = Buffer.from(String(b ?? ''), 'utf8');
+  if (left.length !== right.length || left.length === 0) return false;
+  return crypto.timingSafeEqual(left, right);
+}
+
+// A filename for a key that may be an email, a phone number or a sentence. Safe
+// keys keep their own name so the records folder stays readable; everything else
+// gets a stable hash, and the real key is inside the file either way.
+export function keyFilename(normalizedKey) {
+  if (SAFE_FILENAME.test(normalizedKey)) return normalizedKey;
+  return `k-${crypto.createHash('sha256').update(normalizedKey).digest('hex').slice(0, 24)}`;
+}
+
+export function createCollections({
+  store, nodes, paths, versions, clock, ids = { token: mintToken }, events, config = {}, logger = console,
+}) {
+  // Defaults live in HOST_DEFAULTS and are deep-merged before this runs, so
+  // there is no second copy of them here to drift.
+  const limits = config.collections;
+
+  function assert(condition, code, message) {
+    if (!condition) throw new HostError(code, message);
+  }
+
+  function requireStore() {
+    assert(store, 'not-found', 'This host keeps no collections.');
+  }
+
+  // ---- marking -----------------------------------------------------------
+
+  async function mark({ actor, owner = '', relPath, ctx = {}, roleMap = null }) {
+    requireStore();
+    const node = nodes.materialize(nodes.resolve(owner, relPath));
+    assert(can(actor, 'admin', node, ctx), 'forbidden', 'Only the owner can make a collection.');
+
+    const existing = store.getCollection(node.id);
+    if (existing) return existing;
+
+    // Numeric ids never resolve, on purpose: a collection address should not be
+    // guessable by counting.
+    const slug = `col_${ids.token(6).replace(/[^a-z0-9]/gi, '').slice(0, 10).toLowerCase()}`;
+    // The slug is the address of a folder of real submissions on disk, and the
+    // slug-to-document binding exists nowhere else. Losing it strands them.
+    await versions.patchMeta(node, { slug }, { create: true });
+    const record = store.insertCollection({
+      nodeId: node.id,
+      slug,
+      submitToken: ids.token(18),
+      accepting: true,
+      roleMap,
+      createdAt: clock.now(),
+    });
+    await mkdirp(paths.recordsDir(slug));
+    events.emit('node-updated', { node, flag: 'collection' });
+    return record;
+  }
+
+  // One DELETE. The document keeps its bytes, the records keep theirs, and
+  // marking it again later gives a new slug over the same folder of records
+  // only if the caller passes the old one.
+  async function unmark({ actor, owner = '', relPath, ctx = {} }) {
+    requireStore();
+    const node = nodes.resolve(owner, relPath);
+    assert(can(actor, 'admin', node, ctx), 'forbidden', 'Only the owner can do that.');
+    const collection = store.getCollection(node.id);
+    assert(collection, 'not-found', 'That is not a collection.');
+    store.deleteCollection(node.id);
+    await versions.patchMeta(node, { slug: null });
+    events.emit('node-updated', { node, flag: 'collection' });
+    return { ok: true, slug: collection.slug, recordsKept: true };
+  }
+
+  function bySlug(slug) {
+    requireStore();
+    const collection = store.getCollectionBySlug(String(slug || ''));
+    assert(collection, 'not-found', 'No such collection.');
+    return collection;
+  }
+
+  function isOwnerOf(actor, collection, ctx) {
+    const node = store.getNodeById(collection.nodeId);
+    return can(actor, 'admin', node, ctx);
+  }
+
+  // ---- record storage ----------------------------------------------------
+
+  function nodeFor(collection, filename, { create = false } = {}) {
+    const nodePath = paths.recordNodePath(collection.slug, filename);
+    const existing = store.getNode('', nodePath) || store.getNodeAnyState('', nodePath);
+    if (existing || !create) return existing;
+    return nodes.materialize({ ...nodes.provisional('', nodePath, 'file'), kind: 'file' });
+  }
+
+  async function readRaw(collection, filename) {
+    const raw = await readFileTextIfExists(paths.recordPath(collection.slug, filename));
+    if (raw == null) return null;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      logger.warn?.(`[makerclay] record ${collection.slug}/${filename} is not valid JSON`);
+      return null;
+    }
+  }
+
+  async function writeRaw(collection, filename, record) {
+    await atomicWrite(paths.recordPath(collection.slug, filename), `${JSON.stringify(record, null, 2)}\n`);
+  }
+
+  async function countRecords(collection) {
+    const names = await readdirIfExists(paths.recordsDir(collection.slug));
+    return names.filter((name) => name.endsWith('.json')).length;
+  }
+
+  // ---- codes -------------------------------------------------------------
+
+  async function checkCode(collection, filename, supplied, { res = null, record = null } = {}) {
+    const row = nodeFor(collection, filename);
+    const auth = row ? store.getRecordAuth(row.id) : null;
+
+    // Store-as-overlay, applied to record codes: the FILE remembers that a
+    // record is protected, the database only holds the hash that proves the
+    // code. Losing the database must therefore fail CLOSED. The alternative is
+    // that deleting makerclay.db republishes every keyed submission, which is
+    // the same bug as lesson 3 arriving through a different door.
+    if (record?.protected && (!auth || auth.deletedAt)) {
+      throw new HostError(
+        'unauthorized',
+        'This record is protected but its code is missing from the database. The owner can reset it.',
+      );
+    }
+
+    // No code was ever set, or the record is gone: nothing to check.
+    if (!auth || auth.deletedAt) return { ok: true, protected: false };
+
+    const now = clock.now();
+    if (auth.lockedUntil && auth.lockedUntil > now) {
+      throw new HostError('rate-limited', 'Too many wrong codes. Try again in a few minutes.');
+    }
+    if (typeof supplied !== 'string' || supplied.length === 0) {
+      return { ok: false, protected: true };
+    }
+    if (await verifyPassword(supplied, auth.codeHash)) {
+      if (auth.failures) store.updateRecordAuth(row.id, { failures: 0, lockedUntil: null });
+      // So nobody has to retype a code they have already proved they know.
+      if (res) {
+        res.cookie(`mk_record_${collection.slug}_${filename}`, supplied, {
+          httpOnly: true, sameSite: 'lax', path: '/', maxAge: CODE_COOKIE_MAX_AGE,
+        });
+      }
+      return { ok: true, protected: true };
+    }
+
+    const failures = (auth.failures || 0) + 1;
+    store.updateRecordAuth(row.id, {
+      failures,
+      lockedUntil: failures >= MAX_FAILURES ? now + LOCKOUT_MS : null,
+    });
+    return { ok: false, protected: true };
+  }
+
+  function cookieCode(req, collection, filename) {
+    return req?.cookies?.[`mk_record_${collection.slug}_${filename}`] ?? null;
+  }
+
+  async function setCode(collection, filename, code) {
+    const row = nodeFor(collection, filename, { create: true });
+    store.upsertRecordAuth({ nodeId: row.id, codeHash: await hashPassword(code) });
+    // The file has to remember that it is protected wherever a code is set, not
+    // only on the submit path, or one caller reintroduces the fail-open.
+    const record = await readRaw(collection, filename);
+    if (record && !record.protected) await writeRaw(collection, filename, { ...record, protected: true });
+    return row;
+  }
+
+  // ---- the lanes ---------------------------------------------------------
+
+  // The public submit lane. The submit token in the BODY is the entire
+  // credential, which is what lets a form on the owner's blog post in here.
+  async function submit({ collection, actor, ctx = {}, key = null, data = {}, code = null, submitToken = null }) {
+    requireStore();
+    assert(collection.accepting, 'forbidden', 'This collection is not accepting submissions.');
+
+    // The token is required of EVERYONE, owner included, and that is what makes
+    // the CSRF exemption safe. Being the owner is ambient (a cookie any page in
+    // that browser can spend); holding the token is deliberate. Identity still
+    // decides which keys you may claim, just below.
+    assert(
+      typeof submitToken === 'string' && timingSafeEquals(submitToken, collection.submitToken),
+      'unauthorized', 'That submit token is not right.',
+    );
+    const owner = isOwnerOf(actor, collection, ctx);
+
+    const total = await countRecords(collection);
+    assert(total < limits.maxRecords, 'too-large', 'This collection is full.');
+
+    // LESSON 1, the anti-squat rule. A requested key is only honored for the
+    // owner, or for someone who set a code on it and can still prove it.
+    let normalized = key ? normalizeKey(key) : null;
+    let filename = normalized ? keyFilename(normalized) : null;
+
+    if (normalized && !owner) {
+      const existing = await readRaw(collection, filename);
+      if (existing) {
+        const verdict = await checkCode(collection, filename, code, { record: existing });
+        if (!verdict.ok) {
+          throw new HostError('unauthorized', 'That name is taken. Send its code to update it.');
+        }
+      } else if (!code) {
+        // Asking for a name without claiming it gets you an opaque id instead.
+        normalized = null;
+        filename = null;
+      }
+    }
+
+    if (!filename) {
+      normalized = ids.token(12).toLowerCase().replace(/[^a-z0-9]/g, '').slice(0, 16);
+      filename = normalized;
+    }
+
+    const now = clock.now();
+    const previous = await readRaw(collection, filename);
+    const record = {
+      key: normalized,
+      opaque: !key || normalized !== normalizeKey(key),
+      protected: previous?.protected || !!(code && !previous),
+      createdAt: previous?.createdAt ?? now,
+      updatedAt: now,
+      data,
+    };
+    await writeRaw(collection, filename, record);
+    nodeFor(collection, filename, { create: true });
+    if (code && !previous) await setCode(collection, filename, code);
+
+    events.emit('record-submitted', { slug: collection.slug, key: normalized });
+    return { key: normalized, filename, record, created: !previous };
+  }
+
+  async function read({ collection, actor, ctx = {}, key, code = null, req = null, res = null }) {
+    requireStore();
+    const normalized = normalizeKey(key);
+    assert(normalized, 'bad-request', 'Which record?');
+    const filename = keyFilename(normalized);
+
+    const row = nodeFor(collection, filename);
+    if (row?.deletedAt) return null;
+
+    const record = await readRaw(collection, filename);
+    if (!record) return null;
+    if (!isOwnerOf(actor, collection, ctx)) {
+      const verdict = await checkCode(
+        collection, filename, code ?? cookieCode(req, collection, filename), { res, record },
+      );
+      if (!verdict.ok) throw new HostError('unauthorized', 'That record needs its code.');
+    }
+    return record;
+  }
+
+  async function list({ collection, actor, ctx = {} }) {
+    requireStore();
+    assert(isOwnerOf(actor, collection, ctx), 'not-found', 'Not found');
+    const names = await readdirIfExists(paths.recordsDir(collection.slug));
+    const out = [];
+    for (const name of names.filter((entry) => entry.endsWith('.json'))) {
+      const filename = name.replace(/\.json$/, '');
+      const row = nodeFor(collection, filename);
+      if (row?.deletedAt) continue;
+      const record = await readRaw(collection, filename);
+      if (!record) continue;
+      const auth = row ? store.getRecordAuth(row.id) : null;
+      out.push({
+        ...record,
+        filename,
+        hasCode: !!auth,
+        // Protected by the file but unprovable by the database: the owner needs
+        // to see that this record is locked out until they reset or delete it.
+        codeMissing: !!record.protected && !auth,
+      });
+    }
+    out.sort((a, b) => b.updatedAt - a.updatedAt);
+    return out;
+  }
+
+  async function update({ collection, actor, ctx = {}, key, data, code = null, req = null, res = null }) {
+    requireStore();
+    const normalized = normalizeKey(key);
+    assert(normalized, 'bad-request', 'Which record?');
+    const filename = keyFilename(normalized);
+    const existing = await readRaw(collection, filename);
+    assert(existing, 'not-found', 'No such record.');
+
+    if (!isOwnerOf(actor, collection, ctx)) {
+      const verdict = await checkCode(
+        collection, filename, code ?? cookieCode(req, collection, filename), { res, record: existing },
+      );
+      if (!verdict.ok) throw new HostError('unauthorized', 'That record needs its code.');
+    }
+
+    const record = { ...existing, data, updatedAt: clock.now() };
+    await writeRaw(collection, filename, record);
+    events.emit('record-updated', { slug: collection.slug, key: normalized });
+    return record;
+  }
+
+  // LESSON 3. The record and its auth go down together and come back together,
+  // so a restored keyed record is never briefly public with no code.
+  async function remove({ collection, actor, ctx = {}, key }) {
+    requireStore();
+    assert(isOwnerOf(actor, collection, ctx), 'not-found', 'Not found');
+    const normalized = normalizeKey(key);
+    const filename = keyFilename(normalized);
+    const row = nodeFor(collection, filename);
+    assert(row, 'not-found', 'No such record.');
+
+    const at = clock.now();
+    store.tx(() => {
+      store.tombstone(row.id, at);
+      if (store.getRecordAuth(row.id)) store.updateRecordAuth(row.id, { deletedAt: at });
+    });
+    return { ok: true };
+  }
+
+  async function restore({ collection, actor, ctx = {}, key }) {
+    requireStore();
+    assert(isOwnerOf(actor, collection, ctx), 'not-found', 'Not found');
+    const filename = keyFilename(normalizeKey(key));
+    const row = nodeFor(collection, filename);
+    assert(row?.deletedAt, 'not-found', 'That record is not deleted.');
+
+    store.tx(() => {
+      store.updateNode(row.id, { deletedAt: null, updatedAt: clock.now() });
+      const auth = store.getRecordAuth(row.id);
+      if (auth?.deletedAt) store.updateRecordAuth(row.id, { deletedAt: null });
+    });
+    return { ok: true };
+  }
+
+  function setAccepting({ actor, collection, ctx = {}, accepting }) {
+    requireStore();
+    assert(isOwnerOf(actor, collection, ctx), 'forbidden', 'Only the owner can do that.');
+    return store.updateCollection(collection.nodeId, { accepting: !!accepting });
+  }
+
+  return {
+    mark, unmark, bySlug, submit, read, list, update, remove, restore,
+    setAccepting, setCode, isOwnerOf, normalizeKey, keyFilename, limits,
+  };
+}