@vielzeug/codex 26.10.5 → 26.10.7

package/data/llms-full.txt

@@ -1,6 +1,1303 @@
 # Vielzeug: Full Documentation
 
-> Complete documentation for 41 packages. Version: 26.10.4
+> Complete documentation for 42 packages. Version: 26.10.6
+
+---
+
+## @vielzeug/archive
+
+**Category:** utilities
+
+### Overview
+
+## Why Archive?
+
+You can share content entries with ranked browsing, filters, likes and account
+erasure on Cloudflare Workers + D1. `defineArchiveCollection` supplies your JSON
+payload schema and indexing rules; the Worker supplies sessions, guards,
+idempotent publishing, cursors and rate limits.
+
+```ts
+// Before: each deployment repeats validation, indexing and route plumbing.
+
+// After: the deployment is one collection definition plus one factory call.
+import { defineArchiveCollection } from '@vielzeug/archive';
+import { createArchiveWorker } from '@vielzeug/archive/worker';
+import { s } from '@vielzeug/spell';
+
+const notes = defineArchiveCollection({
+  name: 'notes', contentVersion: 1,
+  payloadSchema: s.object({ title: s.string().min(1).max(128) }),
+  index: ({ title }) => ({ title, filter: null, tags: [] }),
+});
+export default createArchiveWorker([notes]);
+```
+
+| Feature                              | Archive                                                  | Hand-rolled Worker                  | BaaS (Firebase/Supabase)              |
+| ------------------------------------ | -------------------------------------------------------- | ------------------------------------ | ------------------------------------- |
+| Bundle size (core)                   |         | Depends on deployment code | Depends on selected SDK |
+| Zero dependencies | No — Spell and jose | Depends on implementation | No — client SDK |
+| Content knowledge in the core        |  none — one collection seam |  baked in |  rules everywhere |
+| Canonical fresh-database D1 schema   |  in the package      | Deployment-owned | Not a D1 backend |
+| Idempotent publish w/ tombstones     |  built-in      |  rebuild it |  rebuild it |
+| GDPR erasure / export endpoints      |  built-in      |  rebuild it |  partial |
+| Strict DTO re-validation on read     |  every entry   |  optional |  optional |
+
+**Use Archive when** an app needs a shareable, ranked, liked community space for
+content entries on Cloudflare Workers + D1, and can express its content as one strict
+payload schema.
+**Consider alternatives when** you need rich queries beyond filter/tag/search, live
+collaboration, or a backend you do not control — Archive is deliberately one narrow,
+hardened surface.
+
+## Installation
+
+```sh [pnpm]
+pnpm add @vielzeug/archive @vielzeug/spell
+```
+
+```sh [npm]
+npm install @vielzeug/archive @vielzeug/spell
+```
+
+```sh [yarn]
+yarn add @vielzeug/archive @vielzeug/spell
+```
+
+## Quick Start
+
+A deployment is one collection definition plus one factory call. The definition
+brings the payload schema and what to index; everything else — the emitted-entry
+envelope, the content hash, the wire contract, the routes — is composed for you.
+
+```ts
+import { defineArchiveCollection } from '@vielzeug/archive';
+import { createArchiveWorker } from '@vielzeug/archive/worker';
+import { s } from '@vielzeug/spell';
+
+// The collection's payload: one strict schema is the whole content contract.
+const payloadSchema = s.object({
+  cuisine: s.enum(['italian', 'japanese']),
+  ingredients: s.array(s.string().trim().min(1).max(64)).min(1).max(20),
+  name: s.string().trim().min(1).max(32),
+});
+
+const recipesCollection = defineArchiveCollection({
+  canonicalize: (payload) => ({ ...payload, ingredients: [...payload.ingredients].sort() }),
+  contentVersion: 1,
+  filters: ['italian', 'japanese'],
+  index: (payload) => ({
+    filter: payload.cuisine,
+    tags: [payload.ingredients.length  ({ title, filter: null, tags: [] }),
+});
+const response = await fetch('/api/v1/collections/notes/entries?sort=liked');
+if (!response.ok) throw new Error('Archive unavailable');
+const parsed = notes.contract.page.parse(await response.json());
+console.log(parsed.entries);
+```
+
+## Features
+
+- `defineArchiveCollection` — the one content seam: payload schema, canonicalization, filter/tag/title derivation, union-typed vocabularies
+- `createArchiveWorker` — the whole routes/auth/limits/SQL stack from registered collections
+- `collection.contract` — entry, page, publish/update input schemas shared by client and Worker
+- `ARCHIVE_LIMITS` + `archiveHealthSchema` — the application bounds, advertised by health and validated on both sides
+- `archiveAuthHealthSchema` + `AUTH_SCHEMA_VERSION` — typed issuer readiness checked against the issuer DDL stamp
+- `archiveErrorResponseSchema` — the one error envelope, code-typed across the wire
+- `createAuthWorker` — scanner-safe confirmation, live session-version enforcement, durable budgets, metadata export and coordinated erasure
+- `AUTH_ISSUER_SERVICE` — required uncached issuer check after local catalog JWT verification
+- `ArchiveDerivationError` — distinguishes faulty collection code from invalid submitted content
+- Moderation — reader reports, the operator soft-hide and the report queue, keyed on a verified `roles` claim
+- `worker.tap()` / `issuer.tap()` — typed sanitized runtime events; neither core logs by default
+- `migrations/` — canonical fresh-database DDL with the storage stamp health reads back; no upgrade framework
+
+## Documentation
+
+- [Usage Guide](./usage.md) — stand up a collection, deploy the Worker, wire the client.
+- [API Reference](./api.md) — every export, all three entry points, the full route table.
+- [Examples](./examples.md) — recipes from first deployment to GDPR erasure.
+- [Migration](./migration.md) — breaking changes after the first release and
+  fresh-database scope.
+
+## See Also
+
+- [Spell](/spell/) — every payload schema here is a spell schema; the core composes envelopes from it.
+- [Courier](/courier/) — the HTTP client shape an app's frontend mirrors to consume these routes.
+- [Rune](/rune/) — the structured logger a deployment points `worker.tap()` events at.
+
+### API Reference
+
+## API Overview
+
+| Symbol | Purpose | Execution mode | Common gotcha |
+| --- | --- | --- | --- |
+| `defineArchiveCollection` | Compose validation, indexing, identity and wire schemas | Sync | Invalid content derives to `null`; callback faults throw |
+| `createArchiveWorker` | Build the catalog Worker | Sync | Collection names must be unique |
+| `createAuthWorker` | Build the passwordless issuer | Sync | `AUTH_ARCHIVE` is required |
+| `worker.tap`, `issuer.tap` | Observe sanitized runtime outcomes | Sync | Neither core logs by default; observer exceptions are swallowed |
+| `ArchiveDerivationError` | Identify a collection implementation/runtime fault | Sync | Faults become sanitized 500s, not content-validation 422s |
+| `ARCHIVE_LIMITS` | Shared application bounds | Sync | Page bounds do not cap total exports |
+| `archiveErrorResponseSchema`, `archiveAuthHealthSchema` | Validate error and issuer-health responses | Sync | Unknown error codes and health states reject |
+| `ArchiveError`, `ArchiveDefinitionError` | Public base and invalid-definition errors | Sync | Thrown locally, not transmitted as error objects |
+| `sessionCookieValue` | Compose shared session-cookie attributes | Sync | Deployments must choose `secure` from their environment |
+| `isWellFormedText` | Check control characters and lone surrogates | Sync | Does not trim or impose a length bound |
+
+## Package Entry Point
+
+| Import | Purpose |
+| --- | --- |
+| `@vielzeug/archive` | Browser-safe collections, constants, schemas and errors |
+| `@vielzeug/archive/worker` | Catalog factory, issuer-session service binding and event types |
+| `@vielzeug/archive/auth` | Issuer factory and binding types |
+
+## Collections
+
+### `defineArchiveCollection`
+
+Creates a frozen collection and its contract; malformed names, versions or vocabularies throw `ArchiveDefinitionError`.
+
+```ts
+function defineArchiveCollection(definition: ArchiveCollectionDefinition): ArchiveCollection;
+```
+
+| Parameter | Contract |
+| --- | --- |
+| `name` | Lowercase `[a-z0-9-]{1,32}` |
+| `contentVersion` | Positive safe integer |
+| `payloadSchema` | Spell schema whose output is a stable JSON object |
+| `filters`, `tags` | Optional readonly arrays; omitted means empty vocabulary |
+| `canonicalize` | Optional pure, idempotent, schema-valid normalization |
+| `index` | Derive `filter`, `tags` and searchable `title` without mutating the payload |
+
+**Returns:** `ArchiveCollection`.
+
+**Example:** define and derive one collection without Worker bindings.
+
+```ts
+import { defineArchiveCollection } from '@vielzeug/archive';
+import { s } from '@vielzeug/spell';
+
+const recipes = defineArchiveCollection({
+  name: 'recipes',
+  contentVersion: 1,
+  payloadSchema: s.object({ name: s.string().min(1).max(32) }),
+  index: (payload) => ({ filter: null, tags: [], title: payload.name }),
+});
+const derived = await recipes.derive({ name: 'Rice' });
+if (derived === null) throw new Error('Invalid recipe');
+console.log(derived.contentHash);
+```
+
+| Method / property | Result |
+| --- | --- |
+| `derive(raw)` | `Promise` |
+| `contract.entry` | Public entry schema |
+| `contract.ownedEntry`, `ownedEntries` | Owner view with `clientKey` and `hidden` |
+| `contract.page` | Entries and the forward cursor |
+| `contract.publishInput`, `updateInput` | Publish and revision-guarded update request schemas |
+| `filters`, `tags` | Frozen vocabulary snapshots |
+
+`derive` returns `null` for invalid JSON objects, schema-invalid input, invalid titles, too many tags and oversized canonical payloads. Unexpected schema, callback or hashing failures throw `ArchiveDerivationError`. Non-idempotent or schema-invalid canonicalization, unstable schema transformations, index mutation and out-of-vocabulary projections are also derivation faults. Routes map `null` to 422 `invalid-payload` and faults to a sanitized 500 `internal`.
+Schema output that is lossy or no longer JSON is a derivation fault, not invalid
+submitted content. Invalid index-result shapes also throw.
+
+Const generics preserve the content-version literal and infer filter/tag unions from vocabulary arrays without `as const`. `NoInfer` prevents `index` from widening those unions; omitted arrays infer `never`, permitting only `filter: null` and empty tags.
+
+Objects serialize with recursively sorted keys; arrays preserve order unless your canonicalizer changes it. SHA-256 hashes the core-owned `{contentVersion, payload}` envelope. Stored payloads are canonical by construction, so the emitted entry schemas embed the plain payload schema.
+
+`filter`, tags and searchable title are persisted projections, not computed during reads. Changing `index` or its vocabulary does not update stored rows. The active definition and persisted dataset must remain consistent; Archive has no projection-update or historical-schema API.
+
+## Worker and Maintenance
+
+### `createArchiveWorker`
+
+Returns the catalog request/scheduled handler and its observation side channel.
+
+```ts
+function createArchiveWorker(
+  collections: readonly ArchiveCollection[],
+): ArchiveWorkerHandler;
+```
+
+**Returns:** `ArchiveWorkerHandler`; duplicate names throw `ArchiveDefinitionError` at registration.
+
+**Example:** export a deployable Worker using the package's structural bindings.
+
+```ts
+import { defineArchiveCollection } from '@vielzeug/archive';
+import { createArchiveWorker, type ArchiveWorkerEnv } from '@vielzeug/archive/worker';
+import { s } from '@vielzeug/spell';
+
+const notes = defineArchiveCollection({
+  name: 'notes', contentVersion: 1,
+  payloadSchema: s.object({ title: s.string().min(1).max(128) }),
+  index: ({ title }) => ({ title, filter: null, tags: [] }),
+});
+export default createArchiveWorker([notes]);
+```
+
+| Method | Contract |
+| --- | --- |
+| `fetch(request, env, ctx)` | Returns `Promise` |
+| `scheduled(controller, env, ctx)` | Sweeps expired retry keys and revocation tombstones; emits failures and rethrows |
+| `tap(handler, { signal? }?)` | Returns unsubscribe; a pre-aborted signal registers nothing |
+
+`AUTH_ISSUER_SERVICE` is a required `fetch`-shaped service binding to the issuer.
+The catalog verifies the signed JWT locally, then asks the issuer to validate its
+current account session version. It does not cache successful issuer verdicts.
+If the service exchange fails or exceeds its fixed 5000 ms timeout (body decoding
+included), the catalog returns `503 auth-unavailable`; the timeout does not cancel
+work already started by the issuer.
+
+Only anonymous entry lists can use the 30-second edge cache. Any `Cookie` or `Authorization` header disables caching, even if invalid or empty. Detail, metadata, private and error responses are `no-store`. Public reads do not verify sessions.
+
+---
+
+### `worker.tap`
+
+Observes typed request, scheduled and cache-failure events without affecting request behavior.
+
+```ts
+tap(handler: (event: ArchiveEvent) => void, options?: { readonly signal?: AbortSignal }): () => void;
+```
+
+**Returns:** an unsubscribe function; abort detaches the observer. Diagnostics contain categories and trusted configuration field names, never raw errors, SQL, subjects, aliases, tokens or URLs.
+
+**Example:** observe a Worker and detach explicitly.
+
+```ts
+import { createArchiveWorker, type ArchiveWorkerEnv } from '@vielzeug/archive/worker';
+
+const worker = createArchiveWorker([]);
+const stop = worker.tap((event) => console.log(JSON.stringify(event)));
+stop();
+```
+
+---
+
+## Identity Issuer
+
+### `createAuthWorker`
+
+Returns the passwordless email issuer with account export and coordinated erasure.
+
+```ts
+function createAuthWorker(): AuthWorkerHandler;
+```
+
+**Returns:** `AuthWorkerHandler`.
+
+**Example:** export an issuer configured through deployment bindings.
+
+```ts
+import { createAuthWorker, type AuthWorkerEnv } from '@vielzeug/archive/auth';
+
+export default createAuthWorker();
+```
+
+| Method | Contract |
+| --- | --- |
+| `fetch(request, env, ctx?)` | Returns `Promise` |
+| `scheduled(controller, env, ctx?)` | Removes expired links, closed send windows and unverified unreferenced accounts |
+| `tap(handler, { signal? }?)` | Observes typed `AuthEvent`; returns unsubscribe; pre-aborted signals are inert |
+
+Magic links expire after 15 minutes and work once. The durable per-email budget allows three sends per hour; consumption, expiration and send failure do not refund it. Ordinary sessions last at most 30 days. Operator sessions use `OPERATOR_SESSION_MAX_AGE_SECONDS` (900 seconds). `OPERATOR_EMAILS` controls newly minted role claims.
+
+The issuer-global admission budget is durable D1 state in `auth_sign_in_budget`:
+20 requests per 60-second window before account creation or email delivery.
+This supplements, rather than replaces, the durable per-email budget. No external
+rate-limiter binding is required.
+Admission spends are not refunded after later database or email failures.
+Request emails are trimmed and lowercased before validation. `SENDER_ADDRESS`
+must already be canonical; `OPERATOR_EMAILS` entries are trimmed and lowercased
+before validation.
+
+Sign-in requests create pending account rows with `lastSignInAt: null`. Successful
+redemption atomically claims the one-use link and stamps the account's sign-in
+time. The sweep deletes expired links and closed per-user send windows, then
+unverified accounts with neither remaining links nor send-budget references.
+Verified accounts are retained until explicit account deletion.
+
+`OPERATOR_SESSION_MAX_AGE_SECONDS = 900` is part of the browser-safe root
+contract; `/auth` exports the factory and issuer binding types.
+
+`AUTH_JWT_PREVIOUS_PUBLIC_JWKS` optionally publishes retired public RS256 keys and verifies sessions minted before rotation; private members reject configuration. The package has no demo sign-in routes.
+
+Opening a magic link performs a safe GET that displays a click-confirmation page,
+not redemption. Only a marked POST from an exact allowed origin or
+`PUBLIC_ORIGIN` consumes `{ token }` and returns 204 with the session cookie. The
+confirmation page navigates to `/signed-in` after success; the POST is not a
+redirect. Confirmation responses are `no-store` with no-referrer and restrictive
+CSP; the page removes the token from the address bar and loads no external assets.
+GET displays confirmation for any syntactically valid token, including a used
+token; only POST establishes whether the link is still redeemable. POST accepts
+exactly `{ token }` and rejects query parameters.
+
+The issuer never logs directly. `tap` emits sanitized request and scheduled
+outcomes; observer failures are swallowed, abort detaches the observer and failed
+scheduled work emits then rethrows. `AuthDiagnostic` reports only a category.
+
+## HTTP Routes
+
+Every route below is mounted under `/api/v1`. Mutation guards require an exact allowed `Origin` and `x-archive-request: 1`. Registered publishers pin `x-archive-publisher` to the identity captured when preparing private requests. The header is a freshness precondition, not authority.
+
+| Route | Contract |
+| --- | --- |
+| `GET /health` | Public catalog readiness; 200 `ok` or 503 `degraded` |
+| `POST /sign-out` | Catalog-local sign-out; `{ ok: true }` and expired session cookie, without issuer access |
+| `GET /collections/:collection` | Collection metadata |
+| `GET /collections/:collection/entries` | `author`, `filter`, `tag`, `search`, `sort`, `cursor`, `limit`; forward entry page |
+| `POST /collections/:collection/entries` | `{ clientKey, payload }`; 201 create or 200 replay |
+| `GET /collections/:collection/entries/:id` | Public entry; always `no-store` |
+| `PUT /collections/:collection/entries/:id` | Owner-only `{ expectedRevision, payload }` |
+| `DELETE /collections/:collection/entries/:id` | Owner or operator removal; 204 |
+| `PUT` / `DELETE /collections/:collection/entries/:id/like` | Like / unlike visible entries only; guarded write and response; like-state response |
+| `POST /collections/:collection/entries/:id/report` | `{ reason }`; idempotent per entry/reporter; 204 |
+| `PUT` / `DELETE /collections/:collection/entries/:id/hidden` | Operator hide / unhide; 204 |
+| `GET /collections/:collection/reports` | Operator page; `status=unresolved` (default) or `resolved`, `cursor`, `limit` |
+| `PUT /collections/:collection/reports/:id/resolved` | Operator resolves report by its unique report ID; idempotent 204 |
+| `DELETE /publishers/:id` | Operator erases Archive profile; not issuer account |
+| `GET /moderation-log` | Operator forward page; `cursor`, `limit` |
+| `GET` / `POST` / `PUT /me` | Identity, register with optional `{ name }`, rename with required `{ name }` |
+| `DELETE /me` | Profile-only cascade; 204; does not clear cookie |
+| `DELETE /me/account` | Revoke issuer/subject and atomically erase profile; 204; coordinated issuer-erasure seam |
+| `GET /me/publications?collection=…` | Owner entries including hidden state and retry keys |
+| `GET /me/likes` | Forward page `{ ids, cursor }`; `cursor`, `limit` |
+| `GET /me/likes?ids=…` | Subset lookup `{ ids }`; at most `likeStateIds` input IDs |
+| `GET /me/reports` | Own forward report page across collections; `cursor`, `limit` |
+| `GET /auth/health` | Public issuer readiness; typed `AuthHealth`, 200 `ok` or 503 `degraded`; no email or peer probe |
+| `GET /auth/session` | Internal issuer-session check for the catalog service binding; exact `{ ok: true }`, `no-store`, no PII; 401 for an invalid, stale or absent-account session |
+| `POST /auth/sign-out-all` | Requires marker, exact origin, session and captured `ACCOUNT_HEADER`; atomically increments `session_version`, deletes outstanding links, preserves account and catalog data; 200 `{ ok: true }` with an expired cookie only on durable success |
+| `GET /auth/jwks.json` | Active and configured retired public verification keys |
+| `POST /auth/sign-in` | `{ email }` (trimmed and lowercased); 202 `{ ok: true }` |
+| `GET /auth/verify?token=…` | Safe no-store click-confirmation page; no token consumption or session change |
+| `POST /auth/verify` | JSON `{ token }`, marker and exact allowed origin or `PUBLIC_ORIGIN`; consume once; 204 with session cookie |
+| `GET /auth/account` | `{ id, email, createdAt, lastSignInAt }`; no tokens or budget data |
+| `DELETE /auth/account` | Requires `ACCOUNT_HEADER` with the captured issuer account UUID; catalog `/me/account` via `AUTH_ARCHIVE`, require exact 204, then issuer user and cookie clear; 204 |
+
+Forward pages are newest first with opaque context-bound keyset cursors. Keep the same query context when following a cursor; end at `cursor: null`. `maxPageSize` bounds each page, not the total number of liked IDs, reports or audit actions you can export. The subset-like query is not a page and cannot combine `ids` with `cursor` or `limit`.
+
+Full erasure creates an issuer/subject revocation tombstone for 30 days plus ten
+seconds and deletes the profile in the same transaction. Catalog authentication
+rejects that subject with 401 on ordinary private routes; registration also checks
+revocation in SQL to prevent resurrection races. Only `DELETE /me/account` may
+bypass the issuer session lookup, and only to retry erasure with the original
+signed session of the same principal while its existing revocation tombstone is
+valid; JWT signature and claims are still verified. It is not a general
+stale-session exception: initial erasure validates the issuer session. The
+issuer-facing `DELETE /auth/account` always checks the current session version
+before calling the catalog, so retrying it after completed erasure returns 401
+because the account is absent.
+Direct profile-only `DELETE /me` allows later registration using the same session.
+The sweep removes expired tombstones. Re-enrollment through the reference issuer
+creates a fresh account UUID subject; an external issuer must issue a new subject
+to re-enroll during the revocation window.
+
+The issuer stores `auth_users.session_version` as a safe non-negative integer,
+defaulting to `0`. Every session JWT carries the current value as the required
+`sessionVersion` claim. Each ordinary issuer-authenticated route compares that
+claim to the current account row; a mismatch is unauthenticated. `POST
+/api/v1/auth/sign-out-all` checks the captured issuer account UUID against the
+verified subject before atomically incrementing the version and deleting pending
+links. A changed account answers 409 `account-changed`; a failed request does not
+clear the cookie. This revokes all sessions, including the caller's, after a
+successful response. Requests authorized before revocation may finish; there is
+no cross-database transactional or in-flight cancellation guarantee.
+
+The catalog requires `AUTH_ISSUER_SERVICE`, a service binding to the issuer. After
+local JWT signature/claims verification, it requests
+`GET /api/v1/auth/session` through that binding on every private request. Only a
+strictly validated 401 `unauthenticated` remains a 401. Malformed, unexpected,
+provider and 5xx responses become 503 `auth-unavailable`; there is no authority
+cache. Both service directions use a fixed 5000 ms timeout that includes body
+decoding. The issuer's `/api/v1/auth/session` is an internal
+service contract, not a frontend session API.
+
+Issuer readiness is independent of catalog readiness. `GET
+/api/v1/auth/health` returns `archiveAuthHealthSchema` as `AuthHealth`; its
+read-only probe checks configuration, a signing and verification key proof,
+binding shapes, the singleton `auth_schema_meta` stamp against
+`AUTH_SCHEMA_VERSION`, and readability of expected tables, columns and triggers.
+It does not write, send email or probe the catalog service. Responses are
+sanitized.
+Configuration failure, database failure and schema mismatch return HTTP 503
+with `status: 'degraded'` and the corresponding reason.
+
+Effective hide, unhide, operator removal and publisher erasure append audit rows atomically with the state transition. Concurrent idempotent no-ops append nothing. Audit rows contain opaque IDs, not names or content, and have no foreign keys so they outlive erasure. Resolving a report sets `resolvedAt`; it is not one of the four audit action kinds.
+
+## Constants and Schemas
+
+| Export | Value or parsed output |
+| --- | --- |
+| `ARCHIVE_CONTRACT_VERSION`, `ARCHIVE_SCHEMA_VERSION` | Both debut at `1`; wire and storage versions are independent |
+| `AUTH_SCHEMA_VERSION` | `1`; issuer DDL stamp checked by `/auth/health` |
+| `ARCHIVE_COLLECTION_NAME_PATTERN` | `/^[a-z0-9-]{1,32}$/` |
+| `ARCHIVE_OPERATOR_ROLE` | `'archive-operator'` |
+| `SESSION_COOKIE_NAME`, `SESSION_COOKIE_PATH` | `'archive_session'`, `'/api/v1'` |
+| `SESSION_MAX_AGE_SECONDS` | `2592000` |
+| `OPERATOR_SESSION_MAX_AGE_SECONDS` | `900`; shared root contract |
+| `ACCOUNT_HEADER` | `'X-Archive-Account'`; required issuer-account UUID on coordinated erasure |
+| `PUBLISHER_HEADER`, `REQUEST_MARKER_HEADER` | `'x-archive-publisher'`, `'x-archive-request'` |
+| `ILL_FORMED_TEXT`, `isWellFormedText(value: string): boolean` | Reject control characters and lone UTF-16 surrogates |
+| `uuidSchema`, `isoTimestampSchema`, `hex64Schema` | UUID, ISO timestamp, lowercase SHA-256 hex strings |
+| `archiveAliasSchema` | Trimmed, well-formed alias of at most 24 characters |
+| `archiveAuthorSchema` | `{ id: string; name: string }` |
+| `archiveIdentitySchema` | `ArchiveIdentity` |
+| `archiveAccountSchema` | `ArchiveAccount`; issuer metadata, excluding private fields |
+| `archiveLimitsSchema` | All numeric `ARCHIVE_LIMITS` fields |
+| `archiveHealthSchema` | `ArchiveHealth` |
+| `archiveAuthHealthSchema` | `AuthHealth` |
+| `archiveErrorResponseSchema` | `ArchiveErrorResponse` |
+| `archiveOkSchema` | `{ ok: true }` |
+| `archiveCollectionMetaSchema` | `ArchiveCollectionMeta` |
+| `archiveLikedIdsSchema` | `{ ids: string[] }` subset response |
+| `archiveLikesPageSchema` | `ArchiveLikesPage` |
+| `archiveLikeStateSchema` | `{ id: string; likeCount: number; liked: boolean }` |
+| `archiveReportsSchema`, `archiveOwnReportsSchema` | `ArchiveReports`, `ArchiveOwnReports` |
+| `archiveModerationLogSchema` | `ArchiveModerationLog` |
+| `archiveSortSchema` | `ArchiveSort` |
+| `ARCHIVE_ERROR_CODES` | Values of `ArchiveErrorCode` below |
+| `ARCHIVE_MODERATION_ACTIONS` | `['hide', 'unhide', 'remove', 'erase-publisher']` |
+
+### `sessionCookieValue`
+
+Composes a session cookie using the shared security attributes.
+
+```ts
+function sessionCookieValue(token: string, options: { maxAgeSeconds: number; secure: boolean }): string;
+```
+
+| Parameter | Contract |
+| --- | --- |
+| `token` | Session token, or empty string when clearing |
+| `options.maxAgeSeconds` | Cookie lifetime; `0` clears it |
+| `options.secure` | Include `Secure` for production HTTPS |
+
+**Returns:** the `Set-Cookie` value with `HttpOnly`, `SameSite=Strict`, the shared path and optional `Secure`.
+
+**Example:** clear the production cookie.
+
+```ts
+import { sessionCookieValue } from '@vielzeug/archive';
+
+const expiredCookie = sessionCookieValue('', { maxAgeSeconds: 0, secure: true });
+console.log(expiredCookie);
+```
+
+---
+
+### `isWellFormedText`
+
+Checks text for control characters and lone UTF-16 surrogates.
+
+```ts
+function isWellFormedText(value: string): boolean;
+```
+
+**Returns:** `true` when `ILL_FORMED_TEXT` does not match; it does not trim or impose bounds.
+
+**Example:** validate text independently of the alias schema.
+
+```ts
+import { isWellFormedText } from '@vielzeug/archive';
+
+console.log(isWellFormedText('Rice'), isWellFormedText('\u0000'));
+```
+
+### `ARCHIVE_LIMITS`
+
+`ARCHIVE_LIMITS` is frozen with these values:
+
+```ts
+const limits = {
+  aliasChars: 24, cursorChars: 1024, idempotencyRetentionMs: 172800000,
+  likeStateIds: 50, maxPageSize: 50, maxPublications: 50, pageSize: 10,
+  payloadBytes: 8192, publicCacheSeconds: 30, reportReasonChars: 256,
+  requestBytes: 12288, searchChars: 64, searchTerms: 6, tagsPerEntry: 16,
+  titleChars: 128, vocabChars: 64,
+};
+```
+
+## Types
+
+The following definitions use `Schema` from `@vielzeug/spell`. Schema-derived aliases show their complete output shape.
+
+```ts
+interface ArchiveIndexing {
+  filter: F | null;
+  tags: readonly T[];
+  title: string;
+}
+interface ArchiveCollectionDefinition {
+  canonicalize?(payload: P): P;
+  contentVersion: C;
+  filters?: readonly F[];
+  index(payload: P): ArchiveIndexing, NoInfer>;
+  name: string;
+  payloadSchema: Schema;
+  tags?: readonly T[];
+}
+interface ArchiveDerivation {
+  canonicalJson: string;
+  contentHash: string;
+  contentVersion: number;
+  filter: string | null;
+  tags: readonly string[];
+  title: string;
+}
+interface ArchiveEntry {
+  author: { id: string; name: string };
+  contentHash: string;
+  contentVersion: C;
+  id: string;
+  likeCount: number;
+  payload: P;
+  publishedAt: string;
+  revision: number;
+  schemaVersion: typeof ARCHIVE_CONTRACT_VERSION;
+  updatedAt: string;
+}
+interface ArchiveOwnedEntry extends ArchiveEntry {
+  clientKey: string;
+  hidden: boolean;
+}
+interface ArchiveContract {
+  entry: Schema>;
+  ownedEntries: Schema[] }>;
+  ownedEntry: Schema>;
+  page: Schema>>;
+  publishInput: Schema;
+  updateInput: Schema;
+}
+interface ArchiveCollection {
+  readonly contentVersion: C;
+  readonly contract: ArchiveContract;
+  readonly derive: (raw: unknown) => Promise;
+  readonly filters: readonly string[];
+  readonly name: string;
+  readonly tags: readonly string[];
+}
+interface ArchivePage {
+  cursor: string | null;
+  entries: readonly T[];
+}
+type ArchiveSort = 'liked' | 'recent';
+type ArchiveDerivationStage = 'canonicalize' | 'hash' | 'index' | 'schema';
+type ArchiveIdentity = { id: string; name: string; operator: boolean } | null;
+type ArchiveAccount = {
+  id: string; email: string; createdAt: string; lastSignInAt: string | null;
+};
+type ArchiveCollectionMeta = { filters: string[]; name: string; tags: string[] };
+type ArchiveLikesPage = { cursor: string | null; ids: string[] };
+type ArchiveErrorCode =
+  | 'account-changed' | 'auth-unavailable' | 'bad-request' | 'conflict' | 'forbidden' | 'gone'
+  | 'internal' | 'invalid-payload' | 'likes-disabled' | 'method-not-allowed'
+  | 'not-found' | 'publisher-changed' | 'publishing-disabled' | 'quota'
+  | 'rate-limited' | 'record-unavailable' | 'timeout' | 'too-large'
+  | 'unauthenticated' | 'unavailable' | 'unsupported-media';
+type ArchiveErrorResponse = {
+  error: { code: ArchiveErrorCode; message: string; requestId: string };
+};
+type ArchiveHealth = {
+  dbSchemaVersion: number | null;
+  features: { likes: boolean; publishing: boolean };
+  limits: {
+    aliasChars: number; cursorChars: number; idempotencyRetentionMs: number;
+    likeStateIds: number; maxPageSize: number; maxPublications: number;
+    pageSize: number; payloadBytes: number; publicCacheSeconds: number;
+    reportReasonChars: number; requestBytes: number; searchChars: number;
+    searchTerms: number; tagsPerEntry: number; titleChars: number; vocabChars: number;
+  };
+  schemaVersion: 1;
+  status: 'ok' | 'degraded';
+  reason: 'database-unavailable' | 'schema-mismatch' | null;
+};
+type AuthHealth = {
+  dbSchemaVersion: number | null;
+  schemaVersion: 1;
+  status: 'ok' | 'degraded';
+  reason: 'configuration-unavailable' | 'database-unavailable' | 'schema-mismatch' | null;
+};
+type ArchiveReports = {
+  cursor: string | null;
+  reports: {
+    id: string; createdAt: string; entryId: string; entryTitle: string;
+    reason: string; reporter: { id: string; name: string }; resolvedAt: string | null;
+  }[];
+};
+type ArchiveOwnReports = {
+  cursor: string | null;
+  reports: {
+    collection: string; createdAt: string; entryId: string; id: string;
+    reason: string; resolvedAt: string | null;
+  }[];
+};
+type ArchiveModerationAction = 'hide' | 'unhide' | 'remove' | 'erase-publisher';
+type ArchiveModerationLog = {
+  cursor: string | null;
+  actions: {
+    id: string; action: ArchiveModerationAction; collection: string | null;
+    createdAt: string; operatorId: string; targetId: string;
+  }[];
+};
+```
+
+Worker subpath types model only the binding methods the catalog calls.
+
+```ts
+interface D1Statement {
+  all(): Promise;
+  bind(...params: (string | number | null)[]): D1Statement;
+  first(): Promise;
+  run(): Promise;
+}
+interface D1Like {
+  batch(statements: D1Statement[]): Promise;
+  prepare(sql: string): D1Statement;
+}
+interface RateLimiterBinding {
+  limit(input: { key: string }): Promise;
+}
+interface ArchiveWorkerEnv {
+  AUTH_ISSUER_SERVICE: AuthIssuerServiceBinding;
+  ALLOWED_ORIGINS: string;
+  APP_ENV: string;
+  DB: D1Like;
+  JWT_AUDIENCE: string;
+  JWT_ISSUER: string;
+  JWT_JWKS_URL: string;
+  LIKES_ENABLED: string;
+  PUBLISHING_ENABLED: string;
+  RATE_LIMIT_KEY_SECRET: string;
+  READ_LIMIT: RateLimiterBinding;
+  WRITE_LIMIT: RateLimiterBinding;
+}
+interface AuthIssuerServiceBinding {
+  fetch(request: Request): Promise;
+}
+interface ArchiveExecutionContext {
+  waitUntil(promise: Promise): void;
+}
+type ArchiveDiagnostic =
+  | { readonly kind: 'configuration'; readonly field: string }
+  | { readonly kind: 'database' | 'record' | 'schema' | 'internal' | 'cache' | 'collection' };
+interface ArchiveRequestEvent {
+  code: ArchiveErrorCode | 'ok';
+  diagnostic?: ArchiveDiagnostic;
+  ms: number;
+  requestId: string;
+  route: string;
+  status: number;
+  type: 'request';
+}
+type ArchiveScheduledEvent =
+  | { removed: number; type: 'scheduled'; status: 'ok' }
+  | { type: 'scheduled'; status: 'failed'; diagnostic: ArchiveDiagnostic };
+type ArchiveEvent =
+  | ArchiveRequestEvent
+  | ArchiveScheduledEvent
+  | { readonly type: 'cache-error'; readonly diagnostic: ArchiveDiagnostic };
+interface ArchiveWorkerHandler {
+  fetch(request: Request, env: E, ctx: ArchiveExecutionContext): Promise;
+  scheduled?(controller: unknown, env: E, ctx: ArchiveExecutionContext): void | Promise;
+  tap(handler: (event: ArchiveEvent) => void, options?: { readonly signal?: AbortSignal }): () => void;
+}
+```
+
+Scheduled `removed` counts the combined expired retry-key and revocation rows.
+
+Auth subpath types describe the sibling issuer and its required service binding.
+
+```ts
+interface SendEmail {
+  send(message: { from: string; html?: string; subject: string; text: string; to: string }): Promise;
+}
+interface AuthArchiveBinding {
+  fetch(request: Request): Promise;
+}
+interface AuthWorkerEnv {
+  ALLOWED_ORIGINS: string;
+  APP_ENV: string;
+  APP_NAME: string;
+  AUDIENCE: string;
+  AUTH_ARCHIVE: AuthArchiveBinding;
+  AUTH_DB: D1Like;
+  AUTH_EMAIL: SendEmail;
+  AUTH_ISSUER: string;
+  AUTH_JWT_PREVIOUS_PUBLIC_JWKS?: string;
+  AUTH_JWT_PRIVATE_JWK: string;
+  OPERATOR_EMAILS: string;
+  PUBLIC_ORIGIN: string;
+  SENDER_ADDRESS: string;
+}
+interface AuthWorkerHandler {
+  fetch(request: Request, env: E, ctx?: ArchiveExecutionContext): Promise;
+  scheduled(controller: unknown, env: E, ctx?: ArchiveExecutionContext): Promise;
+  tap(handler: (event: AuthEvent) => void, options?: { readonly signal?: AbortSignal }): () => void;
+}
+type AuthDiagnostic = {
+  readonly kind: 'configuration' | 'database' | 'email' | 'catalog' | 'internal';
+};
+type AuthEvent =
+  | {
+      readonly type: 'request';
+      readonly requestId: string;
+      readonly route:
+        | '/auth/account'
+        | '/auth/health'
+        | '/auth/jwks.json'
+        | '/auth/session'
+        | '/auth/sign-in'
+        | '/auth/sign-out-all'
+        | '/auth/verify'
+        | 'unmatched';
+      readonly status: number;
+      readonly code: ArchiveErrorCode | 'ok';
+      readonly ms: number;
+      readonly diagnostic?: AuthDiagnostic;
+    }
+  | { readonly type: 'scheduled'; readonly status: 'ok'; readonly removed: number }
+  | { readonly type: 'scheduled'; readonly status: 'failed'; readonly diagnostic: AuthDiagnostic };
+```
+
+Issuer scheduled `removed` counts expired token rows, closed per-user send windows
+and deleted unverified accounts. The singleton admission row is retained and its
+window resets atomically on a later sign-in request.
+
+## Errors
+
+| Exported class | Trigger | Properties |
+| --- | --- | --- |
+| `ArchiveError` | Base for public package errors | `name`, `message`, optional `cause` |
+| `ArchiveDefinitionError` | Invalid collection definition or duplicate registered collection names | Extends `ArchiveError` |
+| `ArchiveDerivationError` | Unexpected schema/canonicalization/index/hash fault or violated collection invariant | Extends `ArchiveError`; readonly `stage: ArchiveDerivationStage`; optional `cause` |
+
+`ArchiveError` and `ArchiveDefinitionError` accept `(message: string, opts?: ErrorOptions)`.
+`ArchiveDerivationError` accepts `(stage: ArchiveDerivationStage, message: string, opts?: ErrorOptions)`.
+Its message and cause are local diagnostics, not response content. Worker request
+failures use the wire envelope, not these thrown classes. Internal `ApiError` and
+`AuthOperationError` are not exported.
+
+Stored entries that fail the current wire schema return 503 `record-unavailable`.
+Stored payloads are canonical by construction, so the emitted entry schemas embed
+the plain payload schema: parsing a response re-runs that schema, and an
+exception from one of its callbacks becomes a sanitized 500.
+
+The complete public error signatures are:
+
+```ts
+class ArchiveError extends Error {
+  constructor(message: string, opts?: ErrorOptions);
+}
+class ArchiveDefinitionError extends ArchiveError {}
+class ArchiveDerivationError extends ArchiveError {
+  readonly stage: ArchiveDerivationStage;
+  constructor(stage: ArchiveDerivationStage, message: string, opts?: ErrorOptions);
+}
+```
+
+Catalog rate-limit responses use `Retry-After: 60`; configure catalog limiter periods to 60 seconds. Issuer admission/send-budget responses instead carry seconds until their durable window reopens. Health's degraded response is the health DTO, not an error envelope: schema mismatch reports the observed version; database unavailability reports `dbSchemaVersion: null`.
+
+### Usage Guide
+
+## Basic Usage
+
+A deployment is a collection definition plus one factory call. Put the definition in a
+module both sides import — the browser needs the composed schemas, the Worker needs
+the collection itself.
+
+```ts
+// recipes-collection.ts — the one content contract, shared by both sides.
+import { defineArchiveCollection } from '@vielzeug/archive';
+import { s } from '@vielzeug/spell';
+
+const payloadSchema = s.object({
+  cuisine: s.enum(['italian', 'japanese']),
+  ingredients: s.array(s.string().trim().min(1).max(64)).min(1).max(20),
+  name: s.string().trim().min(1).max(32),
+});
+
+export const recipesCollection = defineArchiveCollection({
+  // Ingredient order is not identity: the canonical form sorts, so reordered
+  // content hashes identically and updates as a no-op.
+  canonicalize: (payload) => ({ ...payload, ingredients: [...payload.ingredients].sort() }),
+  contentVersion: 1,
+  filters: ['italian', 'japanese'],
+  index: (payload) => ({
+    filter: payload.cuisine,
+    tags: [payload.ingredients.length  console.log(JSON.stringify(event)));
+
+export default worker;
+```
+
+The browser imports the same collection for its schemas — never the worker subpath:
+
+```ts
+import { recipesCollection } from './recipes-collection';
+import { archiveIdentitySchema, PUBLISHER_HEADER } from '@vielzeug/archive';
+
+const response = await fetch('/api/v1/collections/recipes/entries');
+if (!response.ok) throw new Error('Archive unavailable');
+const page = recipesCollection.contract.page.parse(await response.json());
+const meResponse = await fetch('/api/v1/me', { credentials: 'same-origin' });
+if (!meResponse.ok) throw new Error('Identity unavailable');
+const me = archiveIdentitySchema.parse(await meResponse.json());
+if (me === null) throw new Error('Register a publisher first');
+const mineResponse = await fetch('/api/v1/me/publications?collection=recipes', {
+  credentials: 'same-origin', headers: { [PUBLISHER_HEADER]: me.id },
+});
+if (!mineResponse.ok) throw new Error('Own publications unavailable');
+const owned = recipesCollection.contract.ownedEntries.parse(await mineResponse.json());
+console.log(page.entries, owned.entries);
+```
+
+## The collection contract
+
+`defineArchiveCollection` is the only place content knowledge lives. The definition is
+validated at registration — a bad `name`, `contentVersion`, or any vocabulary value
+(well-formed text, 1..`vocabChars` chars) throws there, never mid-request — and every
+ordinary invalid content returns `null` → `422 invalid-payload`. Collection
+implementation faults instead throw `ArchiveDerivationError` → sanitized
+`500 internal`:
+
+- **Parse** — accept stable JSON objects only; schema outputs must remain JSON.
+- **Canonicalize** — optional; a result that leaves the payload schema throws, so a
+  broken normalizer can never store invalid content.
+- **Index** — the returned `filter` must be declared in `filters`, every `tag` in
+  `tags` (duplicates collapse), and the `title` is trimmed and bounded
+  (`titleChars`, well-formed text). A derivation outside the declared vocabulary
+  would store a row no list query can reach — it throws instead.
+- **Size** — the canonical JSON must fit `payloadBytes`.
+- **Identity** — the content hash is SHA-256 over `{contentVersion, payload}`:
+  identical content hashes identically, a real edit always re-identifies, and the
+  core owns the envelope so collections cannot drift it.
+
+Declare vocabularies with readonly arrays (`['fire', 'ice']`) for automatic
+literal-union inference. Const generics retain the version literal and vocabulary
+unions; `NoInfer` prevents the index callback from widening them. Omitted arrays
+mean empty vocabularies: return `null` for
+the filter and no tags. Object keys are recursively sorted by the core; schema
+transformations must stabilize and `canonicalize` must be pure and idempotent.
+Non-JSON input returns `null`. Unexpected callback, schema or hashing failures,
+unstable transformations, non-idempotent canonicalization and index mutation throw
+`ArchiveDerivationError`; its `stage` identifies the failing phase.
+Lossy or non-JSON schema output and invalid index-result shapes also throw.
+
+`contentVersion` participates in content identity. Request handling validates
+only the current collection definition; it does not interpret historical schemas.
+Archive provides no content-upgrade APIs: a new definition never reinterprets
+stored rows.
+
+Filters, tags and searchable titles are persisted data derived at publish/update
+time. Editing `index` or its vocabularies does not recompute existing projections.
+Keep the active definition and dataset consistent. For a development
+deployment, deliberately reset and reseed a fresh database when you change payload
+or projection semantics; the package does not supply a migration framework.
+Resetting destroys existing data. Perform it only as an explicit, deliberate
+development operation, not automatically during startup or deployment.
+
+**Payloads carry decisions, not content.** The payload schema should accept
+user-authored choices expressed as IDs plus user-written text — never the content's
+own copyrighted expression (card text, artwork, rules), never more than the game's
+own identifiers. For games with paid or DLC content this is the whole answer:
+ownership resolves on each viewer's device against their own library, the service
+never learns what anyone owns, and the strict schema is the enforcement seam —
+use a strict schema that rejects unknown fields, so a collection that only models IDs cannot
+accidentally start shipping paid content. For example, published game builds can
+reference cards, equipment and potions by ID plus a user-written name. The client
+renders pieces the viewer does not own as unavailable. Keep the browser-safe
+publication contract in a shared domain module consumed by both the frontend and
+its backend, without importing frontend application code into the Worker.
+
+## The Worker and its environment
+
+`createArchiveWorker(collections)` returns the full handler: anonymous public reads,
+cookie-authenticated mutations behind exact-origin and request-marker guards, local
+RS256/JWKS verification followed by an uncached issuer session-version check,
+per-IP read limits and per-subject write limits keyed by peppered HMACs, the
+30-second anonymous cache on public entry lists only, operator moderation, and a
+scheduled expiry sweep for retired publish retry keys and revocation tombstones.
+Health sits outside the rate-limit and session pipelines: probes never burn the
+anonymous read budget or call the issuer.
+
+The Worker reads its environment fail-closed — every binding must be present and
+well-formed, or the route answers 503 without naming what is missing:
+
+| Variable                 | Meaning                                                          |
+| ------------------------ | ---------------------------------------------------------------- |
+| `APP_ENV`                | `local` or `production` (transport rules and the pepper policy)   |
+| `ALLOWED_ORIGINS`        | Exact canonical origins; never wildcards                          |
+| `JWT_ISSUER` / `JWT_AUDIENCE` / `JWT_JWKS_URL` | Your identity provider |
+| `AUTH_ISSUER_SERVICE`    | Required issuer service binding for live session-version checks   |
+| `LIKES_ENABLED` / `PUBLISHING_ENABLED`        | Feature flags                     |
+| `RATE_LIMIT_KEY_SECRET`  | HMAC pepper. Required ≥ 32 chars in production; local may fall back |
+| `DB` / `READ_LIMIT` / `WRITE_LIMIT`           | D1 + rate-limit bindings |
+
+Both limiter bindings must run 60-second windows (`simple` limiters:
+`period: 60`): the platform binding does not expose its period at runtime, so the
+Worker's 429 `Retry-After` header is fixed at 60 seconds — a longer window would
+make the header lie.
+
+Generated Env types (wrangler's `worker-configuration.d.ts`) satisfy the package's
+structural `ArchiveWorkerEnv` — no `@cloudflare/workers-types` dependency, no casts.
+
+## The auth issuer
+
+`createAuthWorker()` from `@vielzeug/archive/auth` is the reference passwordless
+identity issuer a deployment runs beside the catalog Worker: one POST with an email
+sends a single-use magic link, and explicitly confirming it sets the `archive_session`
+cookie. The catalog verifies the JWT locally, then calls the issuer through
+`AUTH_ISSUER_SERVICE` to check the account's current session version. Requests create
+pending account rows; explicit link redemption atomically stamps the account's
+sign-in time and claims the token. The issuer's D1 schema ships at
+`node_modules/@vielzeug/archive/migrations/auth/`; point the issuer's
+`migrations_dir` there. The catalog's `JWT_ISSUER` and `JWT_JWKS_URL` must identify
+the issuer, and its audience must match the issuer's `AUDIENCE`.
+
+| Variable | Meaning |
+| --- | --- |
+| `APP_NAME` | The app's display name: the magic-link email's subject and copy name it |
+| `ALLOWED_ORIGINS` | Exact origins allowed to trigger unsafe routes (the app origin(s)) |
+| `APP_ENV` | `local` or `production` — production requires HTTPS and sets Secure cookies |
+| `AUDIENCE` / `AUTH_ISSUER` | The claims every minted session carries; the catalog verifies the same pair |
+| `AUTH_DB` / `AUTH_EMAIL` | The issuer's D1 and send-email bindings |
+| `AUTH_ARCHIVE` | Required service binding to the catalog Worker; deletion calls its profile-erasure route |
+| `AUTH_JWT_PRIVATE_JWK` | The RS256 private key as a JWK JSON string: a wrangler secret in production |
+| `AUTH_JWT_PREVIOUS_PUBLIC_JWKS` | Optional retired public RS256 JWKS; publish during rotation until old sessions expire |
+| `OPERATOR_EMAILS` | Comma-separated emails whose newly minted sessions carry the operator role |
+| `PUBLIC_ORIGIN` | App origin for links, confirmation POST origin checks and client navigation after sign-in |
+| `SENDER_ADDRESS` | The address magic links come from: a domain onboarded to Cloudflare Email Service |
+
+Under `wrangler dev` the send-email binding is simulated — the link prints to the
+issuer's console, so that console is the inbox. Demo-only Alice/Bob routes are
+deployment wrappers, not package APIs.
+
+The issuer first admits sign-in requests through its singleton durable
+`auth_sign_in_budget` table: 20 requests per 60 seconds before creating accounts
+or delivering email. No rate-limiter binding is required. It then
+permits three sign-in emails per email in an hourly durable window.
+Later database or delivery failures do not refund global admission.
+Using or expiring a link never refunds sends; failed delivery also spends the
+allowance. Links expire after 15 minutes. Operator sessions expire after 900
+seconds, ordinary sessions after at most 30 days. Retain retired public keys during
+rotation; the active private key signs every new session. Sign-in input trims and
+lowercases email before validation. `SENDER_ADDRESS` must already be canonical;
+`OPERATOR_EMAILS` entries are trimmed and lowercased before validation.
+
+The scheduled sweep deletes expired links and closed per-user send windows, then
+pending accounts only when neither a link nor send-budget row still references
+them. Failed delivery deletes the unusable token but retains the spent allowance;
+it does not immediately remove the pending account. Verified accounts stay until
+explicit erasure. The singleton admission row remains and resets its window on a
+later admitted request.
+
+Opening `GET /auth/verify?token=…` renders a no-store confirmation page and does
+not consume the link or change the session, so email scanners cannot sign in by
+fetching it. A deliberate click sends `POST /auth/verify` with JSON `{ token }`,
+the request marker and an exact allowed origin or `PUBLIC_ORIGIN`.
+Success is 204 with Set-Cookie; the page then navigates to `/signed-in`. The
+redemption update and account sign-in stamp are trigger-backed and atomic.
+The page removes the token from the address bar, loads no external assets, and
+sets a restrictive CSP and `Referrer-Policy: no-referrer`.
+
+`GET /auth/account` exports account metadata only. For full erasure, call
+`DELETE /auth/account` with `ACCOUNT_HEADER` (`X-Archive-Account`) set to the
+issuer account UUID captured from `GET /auth/account` before confirmation.
+The issuer rejects missing or invalid UUIDs with 400 and a different signed-in
+account with 409 `account-changed`, before any erasure. This guard applies even
+before publisher registration and must stay pinned across retries.
+The issuer forwards the caller's session and publisher
+precondition through `AUTH_ARCHIVE` to `DELETE /me/account`, requires exactly 204,
+then deletes its
+own user and clears the cookie. Failure preserves the session for retry. Direct
+`DELETE /me` removes only the Archive profile and leaves the cookie intact.
+
+Several game frontends can share one issuer and catalog. Keep the cookie
+host-only on the central API host, use `credentials: 'include'` from same-site
+HTTPS game subdomains, and allow each exact frontend origin in both Workers.
+Do not share cookies through a parent-domain `Domain` attribute. The
+[multi-collection recipe](./examples/multi-collection-deployment.md) describes
+the topology, session revalidation and platform-wide account boundary.
+
+`DELETE /me/account` atomically revokes the issuer/subject and cascades profile
+deletion. Its tombstone lasts 30 days plus ten seconds; old sessions cannot read
+private data or register again, including a racing registration. The dedicated
+account-erasure route alone may bypass the issuer lookup, and only to retry with
+the same principal's original signed session while its existing tombstone is
+valid; signature and claims are still verified, and initial erasure validates the
+issuer. The issuer's `DELETE /auth/account` checks the current version before
+starting erasure; after completed erasure a retry there returns 401. A fresh
+issuer account gets a new UUID subject. External issuers must use a new subject to
+re-enroll during the revocation window. Profile-only deletion does not revoke the
+subject and permits re-registration with existing credentials.
+
+Each JWT also carries the issuer account's required safe-integer `sessionVersion`.
+The issuer compares it with `auth_users.session_version` on every ordinary
+authenticated route. A JWT with an old version is unauthenticated even before its
+expiry; the catalog asks the issuer on every private request and does not cache a
+successful verdict. A valid local JWT with an unavailable, malformed, 5xx or
+timed-out (fixed 5000 ms, including body decoding) issuer response becomes
+`503 auth-unavailable`, not anonymous identity.
+
+## The database
+
+The package ships the canonical catalog migration:
+`node_modules/@vielzeug/archive/migrations/0001_community_archive.sql` — the whole schema,
+moderation included, as one designed file. The runtime SQL in the package is
+written against exactly this schema, and the package's own integration suite runs
+against the same file. Point wrangler at the directory:
+
+```jsonc
+// wrangler.jsonc — the deployment owns its D1 database, not its DDL.
+{
+  "d1_databases": [
+    {
+      "binding": "DB",
+      "database_name": "my-app",
+      "migrations_dir": "./node_modules/@vielzeug/archive/migrations"
+    }
+  ]
+}
+```
+
+The issuer points to
+`node_modules/@vielzeug/archive/migrations/auth/0001_auth.sql`. Both files are
+fresh-database initialization definitions, not upgrades. The issuer DDL initializes
+`auth_users.session_version` to `0` and stamps `auth_schema_meta.applied` as
+`AUTH_SCHEMA_VERSION` (`1`). Neither file automatically deletes or resets data.
+Archive's canonical initial schemas are edited directly. Reset and reseed a
+development database deliberately when its schema or collection semantics no
+longer match; reapplying the initial file does not update an existing dataset.
+The initialization file also stamps the storage schema
+(`archive_schema_meta`) at `ARCHIVE_SCHEMA_VERSION`, and health reads it back: a
+database with a mismatched stamp answers `status: 'degraded'` with the
+observed `dbSchemaVersion` and HTTP 503 (`reason: 'schema-mismatch'`).
+An unavailable database produces HTTP 503 with `dbSchemaVersion: null` and
+`reason: 'database-unavailable'`. The debut storage stamp is `1`. A unit
+test pins the shipped DDL's `CHECK` bounds to `ARCHIVE_LIMITS`, so the two can never
+drift silently. The stamp does not detect changes in your collection's payload
+schema, vocabulary or indexing function; you own that dataset consistency.
+
+## Routes and wire names
+
+```
+GET    /api/v1/health
+POST   /api/v1/sign-out
+GET    /api/v1/auth/health
+GET    /api/v1/auth/session                              (internal issuer check)
+POST   /api/v1/auth/sign-out-all                         (revoke every session)
+GET    /api/v1/collections/:collection                        (self-description)
+GET    /api/v1/collections/:collection/entries                (author, filter, tag, search, sort, cursor, limit)
+POST   /api/v1/collections/:collection/entries
+GET    /api/v1/collections/:collection/entries/:id
+PUT    /api/v1/collections/:collection/entries/:id            (expectedRevision)
+DELETE /api/v1/collections/:collection/entries/:id
+PUT    /api/v1/collections/:collection/entries/:id/like
+DELETE /api/v1/collections/:collection/entries/:id/like
+POST   /api/v1/collections/:collection/entries/:id/report     (reason)
+PUT    /api/v1/collections/:collection/entries/:id/hidden     (operator)
+DELETE /api/v1/collections/:collection/entries/:id/hidden     (operator)
+GET    /api/v1/collections/:collection/reports               (operator: status, cursor, limit)
+PUT    /api/v1/collections/:collection/reports/:id/resolved  (operator: report ID)
+DELETE /api/v1/publishers/:id                               (operator: erase any publisher)
+GET    /api/v1/moderation-log                               (operator: cursor, limit)
+GET    /api/v1/me             POST /me    PUT /me    DELETE /me
+GET    /api/v1/me/publications?collection=:collection     GET /api/v1/me/likes[?ids=…]
+GET    /api/v1/me/reports                                   (cursor, limit)
+GET    /api/v1/auth/account
+GET    /api/v1/auth/jwks.json
+POST   /api/v1/auth/sign-in                                 (email)
+DELETE /api/v1/auth/account                                (coordinated full erasure)
+DELETE /api/v1/me/account                                  (issuer erasure seam; revokes subject)
+GET    /api/v1/auth/verify?token=…                          (confirmation only)
+POST   /api/v1/auth/verify                                 (guarded {token} redemption)
+```
+
+Publishing is bounded by `maxPublications` live entries per `(collection, owner)`.
+The quota check runs inside the guarded insert.
+
+Every list — entry pages, `/me/likes` without `ids`, `/me/reports`, operator
+reports and `/moderation-log` — pages forward-only: follow `cursor` until `null`,
+preserving query context; a cursor minted for another query is a 400. `limit`
+defaults to `pageSize` and is at most `maxPageSize`; there is no total export
+bound. `/me/likes?ids=…` remains a subset lookup returning `{ ids }`, not a
+page, and cannot combine `ids` with `cursor` or `limit`.
+
+Shared wire names live in the package — `archive_session` cookie,
+`x-archive-publisher` and `x-archive-request` headers, `ARCHIVE_ERROR_CODES`, and
+`ARCHIVE_LIMITS` — so a client and the Worker cannot drift. Parse failures with the
+collection's composed schemas; parse errors with `archiveErrorResponseSchema`, the
+sign-out body with `archiveOkSchema`, a collection's self-description with
+`archiveCollectionMetaSchema` and the operator queue with `archiveReportsSchema`.
+Every entry's `schemaVersion` is the archive contract's version, not the
+collection's; the collection's own format version lives in its hash envelope and in
+each entry's `contentVersion`.
+
+Only anonymous entry lists carry a 30-second edge-cache contract
+(`publicCacheSeconds`). Detail is always `no-store`. Any Cookie or Authorization
+header disables caching, regardless of validity; metadata, private and error
+responses also use `no-store`.
+
+Implement UI ownership checks in your application by comparing the current
+publisher ID to the entry's `author.id`; there is no package action-policy helper.
+Server mutations remain authoritative.
+
+`POST /api/v1/sign-out` is deliberately local: it clears only this browser's
+cookie and does not contact the issuer or revoke copied sessions. To revoke every
+session, post to `/api/v1/auth/sign-out-all` with the mutation marker, an exact
+allowed `Origin`, and the issuer account UUID captured from
+`GET /api/v1/auth/account` in `X-Archive-Account`. The issuer returns 409
+`account-changed` if the active subject differs. On success it atomically increments
+`session_version`, deletes outstanding links, preserves account and catalog data,
+and returns `{ ok: true }` with an expired cookie. Requests authorized before
+revocation may finish; there is no cross-database cancellation guarantee.
+
+`GET /api/v1/auth/health` is public and read-only. It validates issuer
+configuration, key signing/verification, binding shapes, the `auth_schema_meta`
+stamp and expected tables, columns and triggers, returns `AuthHealth` through
+`archiveAuthHealthSchema`, and answers 503 `degraded` for configuration,
+database or schema failures. It never writes, sends email or probes the catalog.
+
+## Moderation
+
+Operator authority is the session token's optional `roles` claim carrying
+`ARCHIVE_OPERATOR_ROLE` (`'archive-operator'`) — minted by your issuer, verified with
+the same signature, audience and issuer checks as any session, and never a separate
+credential. Moderation routes additionally require a registered publisher row: one
+accountable identity per action.
+
+- **Report** — any registered publisher reports a visible entry with a bounded
+  free-text reason (`reportReasonChars`). Idempotent per (entry, reporter): the same
+  report twice is the same 204. Missing or hidden entries answer 404 — there is
+  nothing left to report.
+- **Hide** — an operator removes an entry from every public surface (list, detail,
+  likes) with a soft-hide: the row, its likes and its retry key stay intact. The
+  owner still sees the entry in `/me/publications` with `hidden: true`, edits and
+  key replay are frozen (403), removal stays allowed, and unhiding restores
+  everything. Already hidden or already visible answer the same 204.
+- **Queue** — the operator pages newest reports with entry title and reporter
+  identity; `status` is `unresolved` (default) or `resolved`. Each report has its
+  own `id` and nullable `resolvedAt`. Resolve it with
+  `PUT /collections/:collection/reports/:id/resolved`; repeating is a 204 no-op.
+- **Log** — every effective moderation action (hide, unhide, removal, publisher
+  erasure) appends one accountability row in the same transaction that applies it,
+  and `GET /api/v1/moderation-log` pages the newest actions to
+  operators. Rows carry only ids, the action kind and the time — no names (they
+  change), no content — and no foreign keys: the audit must outlive the erasures it
+  records. Idempotent repeats (hiding an already-hidden entry, erasing an
+  already-erased publisher) answer the same 204 with no new row, including
+  concurrent repeats: audit insertion tests the effective state inside the batch.
+
+Like and unlike both require a visible entry. Their SQL guards visibility during
+the mutation, and the response checks it again; hiding or deleting an entry
+cannot turn a racing unlike into a successful response for unavailable content.
+
+## Observability
+
+The core never logs. `worker.tap(handler, { signal? })` emits one `ArchiveEvent` per
+request — `{ type: 'request', code, ms, requestId, route, status, diagnostic? }` —
+and successful sweep — `{ type: 'scheduled', status: 'ok', removed }`. Failed
+sweeps emit `{ type: 'scheduled', status: 'failed', diagnostic }` and rethrow so
+the runtime sees failure. Cache failures emit `{ type: 'cache-error', diagnostic }`.
+The Worker swallows observer errors so
+observability cannot affect the Worker. With no handlers registered there is zero
+work. Route is a finite class like `/collections/:collection/entries`, never a
+raw path; no event carries a URL, cookie, subject, alias or token. Diagnostics are
+typed sanitized categories, not raw exceptions. A pre-aborted tap signal is inert.
+The sweep's `removed` counts expired retry keys and revocation tombstones together.
+
+The issuer also exposes `tap()` with `AuthEvent` from `@vielzeug/archive/auth`.
+It never logs directly. Events contain finite route labels, codes, counts,
+duration and sanitized `AuthDiagnostic` categories, never emails, tokens or raw
+exceptions. Scheduled failures emit then rethrow; pre-aborted taps are inert.
+Issuer sweep counts include expired tokens, closed per-user send windows and
+removed pending accounts; the singleton admission row is not removed.
+
+```ts
+import { createLogger } from '@vielzeug/rune';
+import { createArchiveWorker } from '@vielzeug/archive/worker';
+import { recipesCollection } from './recipes-collection';
+
+const log = createLogger({ namespace: 'recipes' });
+const worker = createArchiveWorker([recipesCollection]);
+worker.tap((event) => log.debug(event, `archive:${event.type}`));
+export default worker;
+```
+
+## Testing
+
+The package proves itself against real workerd + local D1:
+
+```sh
+pnpm vitest run packages/archive/src/__tests__/          # fast unit suite
+pnpm --filter @vielzeug/archive test:integration         # real workerd + local D1 + issuer coverage
+pnpm --filter @vielzeug/archive test:types               # strict types over src and the integration suite
+```
+
+Prove your own collection the way the reference deployment does: a slim deployment
+suite that publishes over your real vocabulary and asserts the derivation, plus the
+package's generic suite for the core behavior. A collection with an `index` that can
+drift out of vocabulary should unit-test `derive` directly: ordinary invalid input
+returns `null`, while implementation faults throw `ArchiveDerivationError`.
+Direct DDL tests exercise the shipped schema rather than a duplicate schema.
+
+## Framework Integration
+
+The root entry is plain TypeScript with no framework coupling; Vue, React and Svelte
+apps all consume the composed schemas the same way. A Vue 3 composable that pages a
+collection:
+
+```ts
+// useRecipes.ts — one collection's typed client in any component tree.
+import { recipesCollection } from './recipes-collection';
+import { ref, shallowRef } from 'vue';
+
+export function useRecipes() {
+  const entries = shallowRef[]>([]);
+  const cursor = ref(null);
+  async function load(sort: 'liked' | 'recent') {
+    const params = new URLSearchParams({ sort });
+    if (cursor.value !== null) params.set('cursor', cursor.value);
+    const response = await fetch(`/api/v1/collections/recipes/entries?${params}`);
+    if (!response.ok) throw new Error('The archive is unavailable.');
+    const page = recipesCollection.contract.page.parse(await response.json());
+    entries.value = [...entries.value, ...page.entries];
+    cursor.value = page.cursor;
+  }
+  return { cursor, entries, load };
+}
+```
+
+## Working with Other Vielzeug Libraries
+
+- [Spell](/spell/) — the payload schema a collection declares; the core composes the
+  envelope schemas from it, so the wire and the types cannot drift.
+- [Courier](/courier/) — the HTTP client shape an app's frontend mirrors to consume
+  these routes: strict response schemas over one typed port.
+- [Rune](/rune/) — the structured logger a deployment points `tap()` events at.
+
+## Best Practices
+
+- Compose client schemas from `collection.contract`; never hand-write the envelope.
+- Declare exactly the vocabulary your `index` derives, with union types where you
+  have them; a value outside it rejects loudly.
+- Keep `canonicalize` pure and schema-true: reordered lists in, canonical form out.
+- Initialize fresh databases with the shipped DDL and deliberately reset/reseed
+  development data when collection or storage semantics change.
+- Treat `ARCHIVE_ERROR_CODES` and `archiveErrorResponseSchema` as one tested contract.
+- Pin the expected-publisher header from the identity you captured at sign-in, never from storage alone.
+- Grant the operator role claim only through your issuer, and only to accounts that
+  are also registered publishers.
+- Wire a sanitized `tap()` sink and register the rate-limit pepper as a production secret.
+
+### Examples
+
+- [Stand Up a Content Archive](./examples/stand-up-a-content-archive.md)
+- [Content Identity and Versions](./examples/content-identity-and-versions.md)
+- [Multi-Collection Deployment](./examples/multi-collection-deployment.md)
+- [Moderate Content](./examples/moderate-content.md)
+- [Client Error Mapping](./examples/client-error-mapping.md)
+- [GDPR Erasure and Export](./examples/gdpr-erasure-and-export.md)
 
 ---
 
@@ -119,6 +1416,8 @@ console.log(byRole, health, profile);
 | `allocate` | Lossless proportional distribution | Sync | Available from `/math` |
 | `isEqual` | Structural equality | Sync | Root export |
 | `hash` | Deterministic serialization for cache keys | Sync | Available from `/object` |
+| `compressBytes` / `decompressBytes` | Native byte compression with bounded decompression | Async | Requires native compression streams; decoding requires an output limit |
+| `pack` / `unpack` | Versioned, compressed, URL-safe payload envelope | Async | Both sides bound the payload with `maxBytes`; compression falls back to raw |
 
 ## Package Entry Points
 
@@ -128,6 +1427,7 @@ console.log(byRole, health, profile);
 | `@vielzeug/arsenal/array` | Immutable transforms, set operations, sorting, fuzzy search |
 | `@vielzeug/arsenal/async` | Retry, cancellation, task pool, timing |
 | `@vielzeug/arsenal/cache` | In-memory cache and memoization |
+| `@vielzeug/arsenal/encoding` | Base64url and native byte compression |
 | `@vielzeug/arsenal/function` | Assertions, composition, timing, teardown |
 | `@vielzeug/arsenal/guards` | Type guards, predicate combinators, equality guards |
 | `@vielzeug/arsenal/math` | Ranges, aggregation, statistics, interpolation, exact allocation |
@@ -245,6 +1545,101 @@ base64UrlToBytes(code); // throws on characters outside the alphabet
 utf8Bytes('Hunter äöü'); // 11: byte length of a UTF-8 string
 ```
 
+### compressBytes
+
+```ts
+compressBytes(bytes: Uint8Array, options?: CompressionOptions): Promise
+```
+
+Compresses bytes using the native `CompressionStream` API without modifying the input.
+
+| Option | Type | Default | Meaning |
+| --- | --- | --- | --- |
+| `format` | `CompressionFormat` | `'deflate-raw'` | Compression format; the receiver must use the same format |
+
+**Returns:** Compressed bytes. Rejects with `ArsenalSerializationError` when the format or capability is unavailable, or stream processing fails. Does not fall back to another format.
+
+**Example:** Encode compressed bytes for a URL.
+
+```ts
+import { bytesToBase64Url, compressBytes } from '@vielzeug/arsenal';
+
+const bytes = new TextEncoder().encode(JSON.stringify({ name: 'Hunters' }));
+const code = bytesToBase64Url(await compressBytes(bytes));
+```
+
+---
+
+### decompressBytes
+
+```ts
+decompressBytes(bytes: Uint8Array, options: DecompressionOptions): Promise
+```
+
+Decompresses bytes using the native `DecompressionStream` API, enforcing the output limit while reading chunks.
+
+| Option | Type | Default | Meaning |
+| --- | --- | --- | --- |
+| `format` | `CompressionFormat` | `'deflate-raw'` | Format used by the sender |
+| `maxOutputBytes` | `number` | Required | Non-negative safe integer; maximum decoded byte length |
+
+**Returns:** Decompressed bytes. Rejects with `ArsenalSerializationError` for invalid limits, corrupt or truncated data, unavailable formats/capabilities, or output exceeding the limit. A failed stream is canceled and its reader lock released. Bound encoded input separately before calling this function.
+
+**Example:** Decode text within an application-defined byte limit.
+
+```ts
+import { compressBytes, decompressBytes } from '@vielzeug/arsenal';
+
+const compressed = await compressBytes(new TextEncoder().encode('Hunters'));
+const bytes = await decompressBytes(compressed, { maxOutputBytes: 8192 });
+const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+```
+
+---
+
+### pack
+
+```ts
+pack(payload: unknown, options: ShareCodeOptions): Promise
+```
+
+Serializes `payload` as JSON and encodes it into a compact share code: `prefix` + mode marker + base64url bytes, compressed with raw DEFLATE when the compressed form is shorter and the runtime supports the streams.
+
+| Option | Type | Meaning |
+| --- | --- | --- |
+| `maxBytes` | `number` | Positive safe integer; maximum serialized payload size |
+| `prefix` | `string` | 1–8 alphanumeric characters identifying the code family and version |
+
+**Returns:** The shorter of the raw (`prefix` + `r`) and compressed (`prefix` + `d`) representations. Throws `ShareCodeError` (`too-large`, `invalid`) for oversized payloads and misconfigured options.
+
+**Example:** Encode a shareable build as a code small enough for a URL.
+
+```ts
+import { pack } from '@vielzeug/arsenal';
+
+const code = await pack({ cards: ['slash', 'guard'] }, { maxBytes: 8192, prefix: 'ab1' });
+```
+
+---
+
+### unpack
+
+```ts
+unpack(code: string, options: ShareCodeOptions): Promise
+```
+
+Decodes a share code produced by `pack` with the same options. Both sides are bounded: input longer than `maxBytes` could carry is refused up front, streamed decompression stops at `maxBytes`, and non-canonical base64url is rejected by round-trip.
+
+**Returns:** The parsed JSON payload. Throws `ShareCodeError` (`invalid` for foreign or malformed codes, `too-large` for budget overruns, `compression-unavailable` when a compressed code arrives on a runtime without `DecompressionStream`). Underlying compression failures surface as `ArsenalSerializationError`.
+
+**Example:** Decode untrusted input within the byte budget.
+
+```ts
+import { unpack } from '@vielzeug/arsenal';
+
+const payload = await unpack(code, { maxBytes: 8192, prefix: 'ab1' });
+```
+
 ## Object
 
 ### tryParseJson
@@ -327,13 +1722,22 @@ type CacheOptions = {
   now?: () => number;
   ttlMs?: number;
 };
+
+interface CompressionOptions {
+  format?: CompressionFormat;
+}
+
+interface DecompressionOptions extends CompressionOptions {
+  maxOutputBytes: number;
+}
 ```
 
 ## Errors
 
 - `RangeError`: invalid numeric bounds, capacity, concurrency, or retry count.
 - `TypeError`: invalid value types, unsupported comparison, or required path missing.
-- `ArsenalSerializationError`: memo or hash cannot serialize supplied input.
+- `ArsenalSerializationError`: memo or hash cannot serialize supplied input; compression fails, is unavailable, receives an invalid output limit, or exceeds that limit. Stream failures retain the original error as `cause`.
+- `ShareCodeError`: a share code cannot be encoded or decoded; the `reason` field is `invalid`, `too-large`, or `compression-unavailable`.
 
 ### Usage Guide
 
@@ -500,6 +1904,27 @@ const payload = JSON.parse(base64UrlToText(code));
 
 Decoding throws on characters outside the base64url alphabet, so corrupted input fails loudly instead of decoding to garbage.
 
+## Compress Share Payloads
+
+Compress UTF-8 bytes before Base64url encoding. Set a decoded-byte limit before accepting compressed input from another device.
+
+```ts
+import { base64UrlToBytes, bytesToBase64Url, compressBytes, decompressBytes } from '@vielzeug/arsenal';
+
+const payload = JSON.stringify({ name: 'Hunters', notes: 'An expedition through Alborea. '.repeat(20) });
+const compressed = await compressBytes(new TextEncoder().encode(payload));
+const code = bytesToBase64Url(compressed);
+const bytes = await decompressBytes(base64UrlToBytes(code), { maxOutputBytes: 8192 });
+const restored = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+console.log(restored === payload);
+```
+
+Both helpers default to `deflate-raw`. You can explicitly select `gzip` or `deflate`; use the same format at both ends. The helpers reject when native streams do not support the selected format. They do not choose a fallback or define a wire protocol.
+
+For a complete versioned envelope over these primitives — prefix, compression mode marker, byte budgets on both sides — see [`pack` / `unpack`](./api.md#pack).
+
+Compression can enlarge small inputs. Compare the final encoded strings, including any format marker, before choosing a representation. Bound input size before decoding Base64url and validate decompressed JSON against your schema. The decompression limit bounds retained output, not native stream working memory.
+
 ## Working with Other Vielzeug Libraries
 
 Use Spell after `tryParseJson` for typed external data. Use Vault instead of `cache` when data must survive reloads or process restart.
@@ -533,6 +1958,7 @@ const settings = parsed.ok ? Settings.parse(parsed.value) : { theme: 'system' };
 - [Array utilities](./examples/array.md)
 - [Async utilities](./examples/async.md)
 - [Cache utilities](./examples/cache.md)
+- [Encoding utilities](./examples/encoding.md)
 - [Function utilities](./examples/function.md)
 - [Guards / Typed predicates](./examples/typed.md)
 - [Math utilities](./examples/math.md)
@@ -555,6 +1981,7 @@ const settings = parsed.ok ? Settings.parse(parsed.value) : { theme: 'system' };
 - taskPool - Bounded concurrent work (id: `async-queue`)
 - retry - Retry failed operations (id: `async-retry`)
 - waitFor - Poll until condition is true or timeout/abort fires (id: `async-waitFor`)
+- compressBytes - Bounded share payload compression (id: `encoding-compression`)
 - debounce - Trailing (default) and leading-edge options (id: `function-debounce`)
 - memo - LRU cache with size tracking and invalidation (id: `function-memo`)
 - pipe - Left-to-right function composition (id: `function-pipe`)
@@ -3207,7 +4634,13 @@ Sends one HTTP request. `config.method` defaults to `GET`; pass any method (incl
 | `timeout` | `number` | Integer milliseconds from 1 to 2,147,483,647, or `Infinity`; overrides default |
 | `fetchInit` | `Omit` | Raw fetch options for advanced use |
 
-**Returns:** Parsed response body (or `undefined` for empty bodies).
+**Returns:** Parsed response body (or `undefined` for empty bodies). With
+`responseType: 'raw'` the resolved value is the `Response` itself; a `204`/`205`
+answer whose transport carried an unexpected empty body stream is normalized to
+`body: null` — the stray stream is cancelled and headers, status, statusText,
+URL, redirect and type metadata are preserved (on the response and its clones).
+A null-body raw response owns no pending resource, so no consumption is required
+to release the request.
 
 ```ts
 const created = await courier.request('/users', {
@@ -3487,7 +4920,7 @@ Concurrent callers share physical work but own their own signal and timeout. One
 
 ## Response Parsing
 
-Courier parses successful 2xx response bodies automatically based on `content-type`, unless you set `responseType` explicitly (`'json'`, `'text'`, `'blob'`, `'arrayBuffer'`, or `'raw'` for the `Response` itself). Empty JSON bodies return `undefined` instead of throwing. Raw response bodies remain owned by Courier until consumed or cancelled, so `cancelAll()` and `dispose()` still abort them. Raw responses cannot be combined with `schema`. Always consume or cancel the body to release request ownership, and set `timeout: Infinity` for intentionally long-lived streams. Courier preserves URL, redirect, and type metadata on tracked responses and their clones.
+Courier parses successful 2xx response bodies automatically based on `content-type`, unless you set `responseType` explicitly (`'json'`, `'text'`, `'blob'`, `'arrayBuffer'`, or `'raw'` for the `Response` itself). Empty JSON bodies return `undefined` instead of throwing. Raw response bodies remain owned by Courier until consumed or cancelled, so `cancelAll()` and `dispose()` still abort them. Raw responses cannot be combined with `schema`. Always consume or cancel the body to release request ownership, and set `timeout: Infinity` for intentionally long-lived streams. Courier preserves URL, redirect, and type metadata on tracked responses and their clones. A `204`/`205` raw answer is normalized to `body: null` — a stray empty transport stream is cancelled for you — so a null-body raw response never carries pending body ownership and needs no consumption.
 
 ```ts
 const buffer = await courier.request('/files/{id}', {
@@ -3670,6 +5103,7 @@ There is no `use()` method. To change middleware, create a new client. This keep
 ## Examples
 
 - [Authentication](./examples/authentication.md)
+- [Service Discovery and Custom Fetch](./examples/service-discovery-and-custom-fetch.md)
 - [CRUD Operations](./examples/crud-operations.md)
 - [Disposal](./examples/disposal.md)
 - [Error Handling Patterns](./examples/error-handling-patterns.md)
@@ -16668,7 +18102,7 @@ const chart = createScatterChart(host, {
 chart.dispose();
 ```
 
-Scatter interaction reports one datum and series rather than a `values` array. Keyboard navigation visits points across series in x order.
+Scatter interaction reports the datum and series of the point nearest the pointer in two dimensions, without a `values` array. Keyboard navigation visits points across series in x order. Tooltip `titleFormat` receives the x-value and `valueFormat` the y-value. On mount, points grow from radius zero at their final positions; updates slide existing points and grow new ones.
 
 ### `createBarChart()`
 
@@ -16992,7 +18426,7 @@ export interface TransitionConfig {
   easing?: EasingName | ((t: number) => number);
   /** `system` skips animation when reduced motion is preferred. */
   preference?: 'always' | 'never' | 'system';
-  /** Per-bar delay on bar charts or per-series delay on radar charts. */
+  /** Per-bar delay on bar charts, per-entering-point delay (x order) on scatter charts, or per-series delay on radar charts. Bar and scatter charts cap the total added delay at about 400 ms. */
   stagger?: number;
 }
 
@@ -17171,6 +18605,7 @@ export interface AxisConfig {
   position?: TPosition;
   tickCount?: number;
   tickFormat?: (value: Date | number | string) => string;
+  tickValues?: ReadonlyArray;
 }
 
 export type XAxisConfig = AxisConfig;
@@ -17179,6 +18614,8 @@ export type YAxisConfig = AxisConfig;
 export interface TooltipConfig {
   offset?: number;
   render?: (datum: Datum, series: Series) => Node | string;
+  titleFormat?: (key: Date | number | string) => string;
+  valueFormat?: (value: number, datum: Datum, series: Series) => string;
 }
 
 export interface CrosshairConfig {
@@ -17196,7 +18633,11 @@ export interface LegendConfig {
 
 The crosshair defaults to a vertical line that snaps to the nearest datum; the horizontal line is hidden by default. With `snap: false`, only the guide follows the pointer—tooltip and callback data still refer to the nearest datum.
 
-Tooltip strings are assigned as text, not parsed as HTML. For a radar chart, `tooltip.render` receives a datum whose `meta` contains the active axis, all series values, and the default announcement text.
+`tickValues` renders exactly the given ticks instead of scale-generated ones, and gridlines follow the same list. Values must match the axis's scale kind (numbers on a linear axis, `Date`s on a time axis, category strings on a band axis); an off-scale value warns in development. Without it, ticks come from the scale as before.
+
+Numeric tick labels at a magnitude of 1e5 or above default to compact notation (`123K`, `1.23M`) so long numbers fit the default value-axis margin; pass `tickFormat: String` for raw labels. Supplying a partial `yAxis` (or the value axis of a horizontal bar chart) merges over the default, so `{ tickFormat }` alone keeps the default grid lines.
+
+`titleFormat` and `valueFormat` shape the default comparison tooltip on line, area, and bar charts—the title from the focused key and each row's value—and the same formatting is applied to the tooltip's spoken summary. `render` still replaces the whole tooltip body and takes precedence. Tooltip strings are assigned as text, not parsed as HTML. For a radar chart, `tooltip.render` receives a datum whose `meta` contains the active axis, all series values, and the default announcement text.
 
 ### Chart Configuration Types
 
@@ -17519,7 +18960,17 @@ const chart = createLineChart(container, {
 chart.dispose();
 ```
 
-`tickFormat` formats axis labels only. Tooltip content and accessibility announcements use the underlying keys and values.
+`tickFormat` formats axis labels only. Tooltip content and accessibility announcements use the underlying keys and values. To render an exact set of ticks instead of scale-generated ones, pass `tickValues`; gridlines follow the same list. Values must match the axis's scale kind, and an off-scale value warns in development:
+
+```ts
+// Force a tick on the last month, which nice-stepped ticks can skip.
+const chart = createLineChart(container, {
+  series: [{ data: [{ key: 0, value: 90 }, { key: 11, value: 128 }], name: 'Costs' }],
+  xAxis: { tickValues: [0, 6, 11] },
+});
+```
+
+Numeric tick labels at a magnitude of `1e5` or above default to compact notation (`123K`, `1.23M`) so long numbers fit the default value-axis margin; pass `tickFormat: String` for raw labels. Supplying a partial value-axis config merges over its default, so `yAxis: { tickFormat }` alone keeps the default grid lines.
 
 ## Bar Charts
 
@@ -17577,7 +19028,7 @@ chart.dispose();
 
 ## Scatter Charts
 
-Scatter charts treat every datum as an independent point: `key` is the numeric x-value and `value` is the y-value. The scales fit the observed values rather than forcing the y-domain to include zero. Set `pointRadius` on a series to change its marker size.
+Scatter charts treat every datum as an independent point: `key` is the numeric or `Date` x-value and `value` is the y-value. The scales fit the observed values rather than forcing the y-domain to include zero. Set `pointRadius` on a series to change its marker size (default `3`).
 
 ```ts
 import { createScatterChart } from '@vielzeug/prism';
@@ -17599,7 +19050,7 @@ const chart = createScatterChart(container, {
 chart.dispose();
 ```
 
-Scatter callbacks identify one nearest point and do not provide cross-series `values`, because points do not share a category key.
+Scatter callbacks identify the nearest point in two dimensions and do not provide cross-series `values`, because points do not share a category key. Keyboard navigation visits every point across series in x order. With a tooltip, `titleFormat` formats the x-value and `valueFormat` the y-value, in both the visible row and the spoken summary.
 
 ## Forecast and Emphasis Styling
 
@@ -17716,7 +19167,7 @@ For a stacked sparkline, each segment can set `value`, `color`, and `label`. Spa
 
 ## Interaction
 
-Set `tooltip: true` to show Prism's default tooltip, or pass a `TooltipConfig` to format its content. A `render` callback receives the active `Datum` and `Series`. Returned strings are inserted as text; return a DOM `Node` for structured content.
+Set `tooltip: true` to show Prism's default tooltip, or pass a `TooltipConfig` to format its content. `titleFormat` and `valueFormat` shape the default comparison tooltip on line, area, and bar charts—the title from the focused key and each row's value—without rebuilding its markup, and the same formatting is applied to the tooltip's spoken summary. A `render` callback receives the active `Datum` and `Series` and replaces the whole body, taking precedence over the formatters. Returned strings are inserted as text; return a DOM `Node` for structured content.
 
 ```ts
 import { createLineChart } from '@vielzeug/prism';
@@ -17725,17 +19176,21 @@ const container = document.createElement('div');
 container.style.cssText = 'width:640px;height:320px';
 document.body.append(container);
 
+const compact = new Intl.NumberFormat(undefined, { notation: 'compact' });
+const months = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+
 const chart = createLineChart(container, {
-  series: [{ data: [{ key: 1, value: 4200 }, { key: 2, value: 5100 }], name: 'Revenue' }],
+  series: [{ data: [{ key: 11, value: 128000 }], name: 'EC2' }],
   tooltip: {
-    render: (datum, series) => `${series.name}: ${new Intl.NumberFormat().format(datum.value)}`,
+    titleFormat: (key) => months[Number(key)] ?? String(key),
+    valueFormat: (value) => compact.format(value),
   },
 });
 
 chart.dispose();
 ```
 
-`onHover` receives an event while a point, category, slice, or radar axis is active, then `null` when the interaction clears. `onClick` receives the selected event. For line, area, and bar charts, `ChartEvent.values` contains each series' datum at that shared key; a missing datum is `undefined`. Scatter, pie, radar, and sparkline use their chart-specific event types.
+`onHover` receives an event while a point, category, slice, or radar axis is active, then `null` when the interaction clears. `onClick` receives the selected event. For line, area, and bar charts, `ChartEvent.values` contains each series' datum at that shared key; a missing datum is `undefined`. Scatter events are `ChartEvent` objects without `values`; pie, radar, and sparkline use their chart-specific event types.
 
 `crosshair` is available on line, area, and scatter charts. By default it shows a vertical guide and snaps the line to the nearest datum. Set `horizontal: true` to add a horizontal guide or `vertical: false` to hide the vertical one. Set `snap: false` to make the guide follow the pointer; tooltip and callback data still come from the nearest datum.
 
@@ -17766,11 +19221,11 @@ chart.dispose();
 
 Columns grow together from their baseline by default over 300 ms. Lines trace their final curve over 420 ms, uncovering point markers along the way without fading or shifting the series. Line data updates retain the default 300 ms geometry transition; an explicit `duration` overrides both timings.
 
-`preference: 'system'` (the default) disables JavaScript motion when the user prefers reduced motion. Use `'always'` to ignore that preference or `'never'` to disable motion. `stagger` sets an optional delay between bars or radar series; bar charts cap the effective delay so long category axes do not add unbounded time. Named easing values are `ease-in`, `ease-in-out`, `ease-out`, `back-out`, `expo-out`, and `linear`; you can also provide an easing function.
+`preference: 'system'` (the default) disables JavaScript motion when the user prefers reduced motion. Use `'always'` to ignore that preference or `'never'` to disable motion. `stagger` sets an optional delay between bars, entering scatter points (in x order), or radar series; bar and scatter charts cap the effective delay so many marks do not add unbounded time. Named easing values are `ease-in`, `ease-in-out`, `ease-out`, `back-out`, `expo-out`, and `linear`; you can also provide an easing function.
 
 ## Responsive Layout and Lifecycle
 
-Size the host with CSS. Prism observes its content box and updates the SVG dimensions and chart layout when it changes. Bar and line resize redraws apply immediately rather than animating between layout sizes; entrance animations and explicit data-update transitions remain enabled. The legend is rendered as container chrome outside the SVG and included in resize calculations.
+Size the host with CSS. Prism observes its content box and updates the SVG dimensions and chart layout when it changes. Bar, line, and scatter resize redraws apply immediately rather than animating between layout sizes; entrance animations and explicit data-update transitions remain enabled. The legend is rendered as container chrome outside the SVG and included in resize calculations.
 
 Call `dispose()` when the view no longer owns the chart. Disposal is idempotent: it removes the SVG, tooltip, legend, and resize observation, stops in-flight chart motion, and aborts `disposalSignal`. `chart[Symbol.dispose]()` calls the same cleanup method.
 
@@ -18939,7 +20394,7 @@ Component registration happens through side-effect imports such as `@vielzeug/re
 
 **Feedback:** `ore-alert`, `ore-async`, `ore-badge`, `ore-chip`, `ore-cookie-banner`, `ore-password-strength`, `ore-progress`, `ore-skeleton`, `ore-toast`, `ore-typing-indicator`
 
-**Inputs:** `ore-button`, `ore-button-group`, `ore-calendar`, `ore-checkbox`, `ore-checkbox-group`, `ore-column`, `ore-combobox`, `ore-counter`, `ore-datagrid`, `ore-date-picker`, `ore-file-input`, `ore-input`, `ore-message-composer`, `ore-number-input`, `ore-otp-input`, `ore-qr-scanner`, `ore-radio`, `ore-radio-group`, `ore-rating`, `ore-select`, `ore-slider`, `ore-switch`, `ore-textarea`, `ore-time-picker`
+**Inputs:** `ore-button`, `ore-button-group`, `ore-calendar`, `ore-checkbox`, `ore-checkbox-group`, `ore-column`, `ore-combobox`, `ore-counter`, `ore-datagrid`, `ore-date-picker`, `ore-file-input`, `ore-input`, `ore-message-composer`, `ore-number-input`, `ore-otp-input`, `ore-qr-scanner`, `ore-query-bar`, `ore-radio`, `ore-radio-group`, `ore-rating`, `ore-select`, `ore-slider`, `ore-switch`, `ore-textarea`, `ore-time-picker`
 
 **Layout:** `ore-box`, `ore-grid`, `ore-grid-item`, `ore-navbar`, `ore-sidebar`
 
@@ -19045,7 +20500,7 @@ import type { OreButtonProps } from '@vielzeug/refine/button';
 | Content | `avatar`, `avatar-group`, `breadcrumb`, `card`, `carousel`, `chat-message`, `code-window`, `copy-command`, `icon`, `keyboard-key`, `list`, `list-item`, `marquee`, `pagination`, `separator`, `speech-player`, `stats`, `step`, `stepper`, `table`, `text` |
 | Disclosure | `accordion`, `accordion-item`, `tabs`, `tab-item`, `tab-panel` |
 | Feedback | `alert`, `async`, `badge`, `chip`, `cookie-banner`, `password-strength`, `progress`, `skeleton`, `toast`, `typing-indicator` |
-| Inputs | `button`, `button-group`, `calendar`, `checkbox`, `checkbox-group`, `combobox`, `counter`, `datagrid`, `date-picker`, `file-input`, `input`, `message-composer`, `number-input`, `otp-input`, `radio`, `radio-group`, `rating`, `select`, `slider`, `switch`, `textarea`, `time-picker` |
+| Inputs | `button`, `button-group`, `calendar`, `checkbox`, `checkbox-group`, `combobox`, `counter`, `datagrid`, `date-picker`, `file-input`, `input`, `message-composer`, `number-input`, `otp-input`, `query-bar`, `radio`, `radio-group`, `rating`, `select`, `slider`, `switch`, `textarea`, `time-picker` |
 | Layout | `box`, `grid`, `grid-item`, `navbar`, `sidebar` |
 | Overlays | `command-palette`, `dialog`, `drawer`, `menu`, `navigation-menu`, `popover`, `tooltip` |
 
@@ -28979,6 +30434,7 @@ useEffect(() => {
 ## Examples
 
 - [Sync a Vault Store](./examples/sync-a-vault-store.md)
+- [Make Store Commands Undoable](./examples/make-store-commands-undoable.md)
 - [Keep Deletions from Resurrecting](./examples/keep-deletions-from-resurrecting.md)
 - [Switch Accounts Safely](./examples/switch-accounts-safely.md)