create-hollware 0.2.0 → 0.4.0

package/README.md

@@ -1,18 +1,32 @@
 # create-hollware
 
-Creates a new project for [Hollware](https://github.com/hollware/hollware), an open-source
-headless CMS for the agent era, native to Cloudflare Workers.
+Creates a new project for [Hollware](https://hollware.com), an open-source headless CMS for the
+agent era, native to Cloudflare Workers.
 
-> **Status: pre-alpha, not usable yet.** The binary answers `--help` and `--version`;
-> running it with a directory prints "not implemented yet" and exits with code 1.
+```sh
+npm create hollware my-cms
+pnpm create hollware my-cms --pm pnpm
+```
 
-## What it will be
+It copies the starter into `my-cms`, pins every Hollware package at its own version, runs
+`git init` and the install, applies the migrations to the local database, and makes your site,
+its owner and a first personal token. Then it prints the token once, a link to set up your passkey
+for the admin, and the `claude mcp add` line that connects Claude Code to it.
 
-`npm create hollware <dir>` will copy the starter template into `<dir>` and pin the exact
-Hollware versions it needs.
+| Option             | What it does                                                    |
+| ------------------ | --------------------------------------------------------------- |
+| `--name <name>`    | The name of the Worker and of its database (default: the dir)   |
+| `--site <key>`     | The key of your site in `hollware.config.ts` (default: my-site) |
+| `--pm <npm\|pnpm>` | The package manager that installs (default: npm)                |
+| `--yes`            | Take the defaults; the directory is `my-hollware`               |
+| `--no-install`     | Only write the files                                            |
+| `--no-git`         | Do not run `git init`                                           |
+
+The directory must be new or empty. Node.js 24 or later.
 
 ## Links
 
+- Docs: <https://hollware.com>
 - Repository: <https://github.com/hollware/hollware>
 - Issues: <https://github.com/hollware/hollware/issues>
 - License: MIT

package/dist/index.d.mts

@@ -1,11 +1,33 @@
+//#region src/scaffold.d.ts
+/** What a run of another program left behind. */
+interface RunResult {
+  readonly code: number;
+  readonly stdout: string;
+  readonly stderr: string;
+}
+/** Everything create-hollware takes from the outside world; a test hands in a fake of each part. */
+interface Io {
+  /** One message for stdout. */
+  readonly out: (message: string) => void;
+  /** One message for stderr. */
+  readonly err: (message: string) => void;
+  /** Where the new directory is made, unless it is absolute. */
+  readonly cwd: string;
+  /** The project template this package ships, made from templates/starter. */
+  readonly templateDir: string;
+  /** The version of create-hollware: the version of Hollware the project gets. */
+  readonly version: string;
+  /** Runs a program in a directory, with its output captured. */
+  readonly run: (command: string, args: readonly string[], cwd: string) => Promise<RunResult>;
+}
+export declare const USAGE: string;
+//#endregion
 //#region src/index.d.ts
 /**
- * Runs the CLI and returns its exit code. Each call to `io.out` or `io.err` is one
- * message; whoever owns the streams adds the trailing newline. Only the first
- * argument is looked at.
+ * Runs the CLI and returns its exit code. Each call to `io.out` or `io.err` is one message;
+ * whoever owns the streams adds the trailing newline. `--help` and `--version` need nothing but
+ * the streams; making a project takes the rest of `io`, which `defaults` fills in.
  */
-export declare function main(argv: string[], io: {
-  out: (s: string) => void;
-  err: (s: string) => void;
-}): number;
-//#endregion
+export declare function main(argv: string[], io: Pick<Io, 'out' | 'err'> & Partial<Omit<Io, 'out' | 'err'>>): Promise<number>;
+//#endregion
+export type { Io };

package/dist/index.mjs

@@ -1,29 +1,174 @@
 #!/usr/bin/env node
-import { readFileSync, realpathSync } from "node:fs";
-import { pathToFileURL } from "node:url";
-//#region src/index.ts
+import { spawn } from "node:child_process";
+import { cpSync, existsSync, readFileSync, readdirSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { basename, join, resolve } from "node:path";
+import { parseArgs } from "node:util";
+//#region src/scaffold.ts
 const USAGE = [
-	"Usage: npm create hollware <dir>",
-	"",
-	"Create a new Hollware project in <dir> (not implemented yet).",
+	"Usage: npm create hollware [<dir>] [options]",
 	"",
-	"Pre-alpha: nothing is scaffolded yet.",
+	"Creates a Hollware project in <dir>: a config, a Worker and the Wrangler config that binds",
+	"its database. Then it installs the dependencies, applies the migrations to the local database",
+	"and makes your site, its owner and a first token, and says how to connect your agent.",
 	"",
 	"Options:",
-	"  --help     Show this help",
-	"  --version  Print the version"
+	"  --name <name>    The name of the Worker and of its database (default: the name of <dir>)",
+	"  --site <key>     The key of your site in hollware.config.ts (default: my-site)",
+	"  --pm <npm|pnpm>  The package manager that installs (default: npm)",
+	"  --yes            Take the defaults: <dir> is my-hollware when it is not given",
+	"  --no-install     Do not install, migrate or make the site",
+	"  --no-git         Do not run git init",
+	"  --help           Show this help",
+	"  --version        Print the version"
 ].join("\n");
+/** A mistake in the arguments: the message, then the usage. */
+var UsageError = class extends Error {
+	name = "UsageError";
+};
+/** Anything else that stops the run: one message, no usage. */
+var CreateError = class extends Error {
+	name = "CreateError";
+};
+/** A Worker's name: lowercase letters, digits and hyphens, as Cloudflare takes it. */
+const WORKER_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/** A site key, as hollware.config.ts takes it. */
+const SITE_KEY = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/** What `@hollware/*` and `hollware` say in the template's package.json. */
+const VERSION_PLACEHOLDER = "HOLLWARE_VERSION";
+const TOKEN = /hw_pat_[0-9a-hjkmnp-tv-z]{52}/;
+/** The choices of a run, from its arguments. */
+function readChoices(argv) {
+	const { values, positionals } = (() => {
+		try {
+			return parseArgs({
+				args: [...argv],
+				allowPositionals: true,
+				options: {
+					name: { type: "string" },
+					site: { type: "string" },
+					pm: { type: "string" },
+					yes: { type: "boolean" },
+					"no-install": { type: "boolean" },
+					"no-git": { type: "boolean" }
+				}
+			});
+		} catch (error) {
+			throw new UsageError(error instanceof Error ? error.message : String(error));
+		}
+	})();
+	if (positionals.length > 1) throw new UsageError(`one directory, at most: got ${positionals.join(", ")}`);
+	const [given] = positionals;
+	if (given === void 0 && values.yes !== true) throw new UsageError("name the directory of the project, or pass --yes for \"my-hollware\"");
+	const dir = given ?? "my-hollware";
+	const name = values.name ?? basename(resolve(dir)).toLowerCase();
+	if (!WORKER_NAME.test(name)) throw new UsageError(`"${name}" is no Worker name: use lowercase letters, digits and hyphens, or pass --name`);
+	const site = values.site ?? "my-site";
+	if (!SITE_KEY.test(site)) throw new UsageError(`"${site}" is no site key: use lowercase words joined by hyphens`);
+	const pm = values.pm ?? "npm";
+	if (pm !== "npm" && pm !== "pnpm") throw new UsageError(`--pm is npm or pnpm, not "${pm}"`);
+	return {
+		dir,
+		name,
+		site,
+		pm,
+		install: values["no-install"] !== true,
+		git: values["no-git"] !== true
+	};
+}
+function replaceIn(path, replacements) {
+	let text = readFileSync(path, "utf8");
+	for (const [from, to] of replacements) text = text.split(from).join(to);
+	writeFileSync(path, text);
+}
+/** Copies the template into `target` and makes it this project's. */
+function writeProject(io, target, choices) {
+	cpSync(io.templateDir, target, { recursive: true });
+	renameSync(join(target, "gitignore"), join(target, ".gitignore"));
+	replaceIn(join(target, "package.json"), [["\"name\": \"my-hollware\"", `"name": ${JSON.stringify(choices.name)}`], [`"${VERSION_PLACEHOLDER}"`, JSON.stringify(io.version)]]);
+	replaceIn(join(target, "wrangler.jsonc"), [
+		["\"name\": \"my-hollware\"", `"name": "${choices.name}"`],
+		["\"database_name\": \"my-hollware\"", `"database_name": "${choices.name}"`],
+		["hollware-events", `${choices.name}-events`]
+	]);
+	for (const file of ["hollware.config.ts", "README.md"]) replaceIn(join(target, file), [["my-site", choices.site]]);
+	if (choices.pm === "pnpm") writeFileSync(join(target, "pnpm-workspace.yaml"), PNPM_WORKSPACE);
+}
+/**
+* pnpm runs no build script it was not told about, and fails the install on one. esbuild ships the
+* binary wrangler uses; workerd's binary arrives through optionalDependencies, so its script is
+* not needed.
+*/
+const PNPM_WORKSPACE = `allowBuilds:
+  esbuild: true
+  workerd: false
+`;
+async function step(io, what, command, args, cwd) {
+	const result = await io.run(command, args, cwd);
+	if (result.code !== 0) {
+		const detail = (result.stderr.trim() || result.stdout.trim()).split("\n").slice(-30).join("\n");
+		throw new CreateError(`${what} failed (${command} ${args.join(" ")}):\n${detail}`);
+	}
+	return result;
+}
+/** Makes the project, and everything it needs to run locally. */
+async function create(argv, io) {
+	const choices = readChoices(argv);
+	const target = resolve(io.cwd, choices.dir);
+	if (existsSync(target) && readdirSync(target).length > 0) throw new CreateError(`${target} is not empty: choose a new directory.`);
+	writeProject(io, target, choices);
+	io.out(`Created a Hollware project in ${target}.`);
+	if (choices.git) await step(io, "git init", "git", ["init", "--quiet"], target);
+	if (!choices.install) {
+		io.out([
+			"",
+			"Next:",
+			`  cd ${choices.dir}`,
+			`  ${choices.pm} install`,
+			`  ${choices.pm} exec hollware migrate --local`,
+			`  ${choices.pm} exec hollware init --site ${choices.site} --local`
+		].join("\n"));
+		return 0;
+	}
+	io.out(`Installing with ${choices.pm} ...`);
+	await step(io, "The install", choices.pm, ["install"], target);
+	const hollware = join(target, "node_modules", ".bin", "hollware");
+	await step(io, "The migrations", hollware, ["migrate", "--local"], target);
+	const init = await step(io, "Making the site", hollware, [
+		"init",
+		"--site",
+		choices.site,
+		"--local"
+	], target);
+	io.out(init.stdout.trim());
+	const token = TOKEN.exec(init.stdout)?.[0] ?? "<the token above>";
+	io.out([
+		"",
+		"Start it, and connect your agent (Claude Code):",
+		`  cd ${choices.dir}`,
+		`  ${choices.pm === "npm" ? "npm run dev" : "pnpm dev"}`,
+		`  claude mcp add --transport http hollware http://localhost:5199/mcp --header "Authorization: Bearer ${token}"`,
+		"",
+		"The admin is at http://localhost:5199/admin/. To deploy, log in to Cloudflare and run:",
+		`  ${choices.pm} exec wrangler login`,
+		`  ${choices.pm} run deploy`,
+		"The README says the rest."
+	].join("\n"));
+	return 0;
+}
+//#endregion
+//#region src/index.ts
 function readVersion() {
 	const manifest = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
 	if (typeof manifest.version !== "string") throw new Error("package.json has no version");
 	return manifest.version;
 }
 /**
-* Runs the CLI and returns its exit code. Each call to `io.out` or `io.err` is one
-* message; whoever owns the streams adds the trailing newline. Only the first
-* argument is looked at.
+* Runs the CLI and returns its exit code. Each call to `io.out` or `io.err` is one message;
+* whoever owns the streams adds the trailing newline. `--help` and `--version` need nothing but
+* the streams; making a project takes the rest of `io`, which `defaults` fills in.
 */
-function main(argv, io) {
+async function main(argv, io) {
 	const [first] = argv;
 	if (first === void 0 || first === "--help") {
 		io.out(USAGE);
@@ -33,12 +178,59 @@ function main(argv, io) {
 		io.out(`create-hollware ${readVersion()}`);
 		return 0;
 	}
-	if (first.startsWith("-")) {
-		io.err(`create-hollware: unknown flag "${first}"\n\n${USAGE}`);
-		return 1;
+	try {
+		return await create(argv, {
+			cwd: io.cwd ?? process.cwd(),
+			templateDir: io.templateDir ?? fileURLToPath(new URL("../template", import.meta.url)),
+			version: io.version ?? readVersion(),
+			run: io.run ?? runProgram,
+			out: io.out,
+			err: io.err
+		});
+	} catch (error) {
+		if (error instanceof UsageError) {
+			io.err(`create-hollware: ${error.message}\n\n${USAGE}`);
+			return 1;
+		}
+		if (error instanceof CreateError) {
+			io.err(`create-hollware: ${error.message}`);
+			return 1;
+		}
+		throw error;
 	}
-	io.err("create-hollware: not implemented yet");
-	return 1;
+}
+/** Runs a program with its output captured, and its stdin closed: nothing waits for an answer. */
+function runProgram(command, args, cwd) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(command, [...args], {
+			cwd,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout.setEncoding("utf8");
+		child.stderr.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk;
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk;
+		});
+		child.on("error", (error) => {
+			reject(new CreateError(`could not run ${command}: ${error.message}`));
+		});
+		child.on("close", (code) => {
+			resolve({
+				code: code ?? 1,
+				stdout,
+				stderr
+			});
+		});
+	});
 }
 function isEntryPoint() {
 	const entry = process.argv[1];
@@ -49,9 +241,9 @@ function isEntryPoint() {
 		return false;
 	}
 }
-if (isEntryPoint()) process.exitCode = main(process.argv.slice(2), {
+if (isEntryPoint()) process.exitCode = await main(process.argv.slice(2), {
 	out: (s) => process.stdout.write(`${s}\n`),
 	err: (s) => process.stderr.write(`${s}\n`)
 });
 //#endregion
-export { main };
+export { USAGE, main };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-hollware",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Create a new Hollware project.",
   "homepage": "https://hollware.com",
   "bugs": {
@@ -16,7 +16,8 @@
     "create-hollware": "./dist/index.mjs"
   },
   "files": [
-    "dist"
+    "dist",
+    "template"
   ],
   "type": "module",
   "exports": {
@@ -40,7 +41,7 @@
     "node": ">=24.11.0"
   },
   "scripts": {
-    "build": "vp pack",
+    "build": "node ../../scripts/sync-starter.ts && vp pack",
     "test": "vp test",
     "publint": "publint --strict"
   }

package/template/AGENTS.md

@@ -0,0 +1,14 @@
+# AGENTS.md
+
+This is a Hollware project: a headless CMS on Cloudflare Workers. The content lives in D1 and is
+written over MCP; this repository holds only the config and the Worker.
+
+- `hollware.config.ts` is the source of truth for what content is valid. A change of a schema, a
+  route or a style guide changes what every agent may write; `describe_site` over MCP returns it.
+- `src/worker.ts` stays as it is: `createHollware(config)` is the whole Worker.
+- Content is never edited in files here. Write it through the MCP tools (`create_draft`,
+  `update_draft`, `validate`, `publish`) of the Hollware at `HOLLWARE_PUBLIC_URL` + `/mcp`.
+- Run `pnpm test` and `pnpm exec wrangler types --check` after a change of the config or of
+  `wrangler.jsonc`, and `pnpm exec hollware doctor` when something does not work.
+- Never commit a token. `hollware init` and `hollware token create` print one once.
+- Docs: https://hollware.com

package/template/README.md

@@ -0,0 +1,65 @@
+# My Hollware
+
+A [Hollware](https://hollware.com) project: a headless CMS on Cloudflare Workers that your agents
+write to over MCP. The config says what your content is; every write is checked against it.
+
+## What is inside
+
+| Path                        | What it is                                                                         |
+| --------------------------- | ---------------------------------------------------------------------------------- |
+| `hollware.config.ts`        | Your sites and their collections: the schema of the frontmatter, routes, guidance  |
+| `src/worker.ts`             | The Worker: `createHollware(config)` builds it                                     |
+| `wrangler.jsonc`            | The Worker, its D1 database, its KV namespace, its queues and its public URL       |
+| `vite.config.ts`            | Vite with the Cloudflare plugin, and the admin at `/admin/`                        |
+| `vitest.config.ts`, `test/` | Tests that run inside workerd                                                      |
+| `worker-configuration.d.ts` | The types of the bindings, from `wrangler types`. Refresh it when wrangler changes |
+| `AGENTS.md`                 | What an agent that works on this project needs to know                             |
+
+## Run it locally
+
+```sh
+pnpm dev     # http://localhost:5199: MCP at /mcp, the admin at /admin/
+```
+
+`npm create hollware` already applied the migrations to the local database and made your site,
+its owner and a first token. To do it again on a new local database:
+
+```sh
+pnpm exec hollware migrate --local
+pnpm exec hollware init --site my-site --local
+```
+
+`init` prints a personal token once, and a link to set up your passkey for the admin. Give the
+token to your agent:
+
+```sh
+claude mcp add --transport http hollware http://localhost:5199/mcp --header "Authorization: Bearer <token>"
+```
+
+## Deploy it
+
+```sh
+pnpm exec wrangler login
+pnpm run deploy                              # creates the database, KV and queues, and migrates
+pnpm exec hollware init --site my-site --remote
+```
+
+The first deploy writes the ids of what it created, and the public URL of the Worker, into
+`wrangler.jsonc`: commit it. `pnpm run doctor` checks the project and says what to fix.
+
+## Read it from a site
+
+A Worker on the same account reads what you publish over a service binding, with no network and
+no token. Any other site reads it over HTTP with a read token: `hollware token create --read`.
+
+## Commands
+
+| Command            | What it does                                         |
+| ------------------ | ---------------------------------------------------- |
+| `pnpm dev`         | Serve the Worker locally                             |
+| `pnpm build`       | Build the Worker into `dist/`                        |
+| `pnpm test`        | Run the tests in workerd                             |
+| `pnpm run deploy`  | Deploy to Cloudflare and migrate the remote database |
+| `pnpm run doctor`  | Check the project, its database and its owner        |
+| `pnpm types`       | Regenerate `worker-configuration.d.ts`               |
+| `pnpm types:check` | Fail when `worker-configuration.d.ts` is out of date |

package/template/gitignore

@@ -0,0 +1,5 @@
+node_modules/
+dist/
+.wrangler/
+.dev.vars*
+!.dev.vars.example

package/template/hollware.config.ts

@@ -0,0 +1,36 @@
+import { defineCollection, defineConfig } from '@hollware/core'
+import * as z from 'zod'
+
+/**
+ * The config of your Hollware: one site with a small bilingual blog. Agents read it with
+ * `describe_site` before they write, so everything it says is what they follow: the shape of the
+ * frontmatter, the routes of an entry per locale, and the style guide.
+ *
+ * `my-site` is the key of the site. Create it in your database with `hollware init --site my-site`.
+ */
+const blog = defineCollection({
+  schema: z.object({
+    title: z.string().min(1),
+    description: z.string().min(1).max(160),
+    date: z.iso.date(),
+    tags: z.array(z.string().min(1)).min(1),
+    // The entries of one post in each language share this value.
+    translationGroup: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
+  }),
+  routes: { en: '/blog/:slug/', es: '/es/blog/:slug/' },
+  translations: { groupBy: 'translationGroup' },
+  tags: 'tags',
+  sortBy: 'date',
+  styleGuide: 'Short paragraphs, one idea per section, and an example for every claim.',
+})
+
+export default defineConfig({
+  sites: {
+    'my-site': {
+      locales: ['en', 'es'],
+      defaultLocale: 'en',
+      collections: { blog },
+      styleGuide: 'Plain language, with the reader in the second person.',
+    },
+  },
+})

package/template/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "my-hollware",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vp dev",
+    "build": "vp build",
+    "test": "vp test",
+    "types": "wrangler types",
+    "types:check": "wrangler types --check",
+    "deploy": "hollware deploy",
+    "doctor": "hollware doctor"
+  },
+  "dependencies": {
+    "@hollware/core": "HOLLWARE_VERSION",
+    "@hollware/server": "HOLLWARE_VERSION",
+    "zod": "4.6.5"
+  },
+  "devDependencies": {
+    "@cloudflare/vite-plugin": "1.63.2",
+    "@cloudflare/vitest-plugin": "1.4.1",
+    "@hollware/admin": "HOLLWARE_VERSION",
+    "hollware": "HOLLWARE_VERSION",
+    "typescript": "7.0.2",
+    "vite": "npm:@voidzero-dev/vite-plus-core@1.1.0",
+    "vite-plus": "1.1.0",
+    "vitest": "5.0.3",
+    "wrangler": "4.150.0"
+  },
+  "overrides": {
+    "vite": "$vite"
+  }
+}

package/template/src/worker.ts

@@ -0,0 +1,15 @@
+import { createHollware } from '@hollware/server'
+import config from '../hollware.config.ts'
+
+// This file is the whole Worker: the config goes in, the Worker comes out.
+const hollware = createHollware(config)
+
+// MCP for your agents at /mcp, behind a personal token.
+export default {
+  fetch: hollware.fetch,
+  scheduled: hollware.scheduled,
+  queue: hollware.queue,
+} satisfies ExportedHandler<Env>
+
+// What your sites read over a service binding: four read-only methods, no network, no token.
+export class Hollware extends hollware.Hollware {}

package/template/test/apply-migrations.ts

@@ -0,0 +1,5 @@
+import { applyD1Migrations } from 'cloudflare:test'
+import { env } from 'cloudflare:workers'
+
+// Setup files run before every test file. `applyD1Migrations` skips what is already applied.
+await applyD1Migrations(env.DB, env.TEST_MIGRATIONS)

package/template/test/env.d.ts

@@ -0,0 +1,10 @@
+import type { D1Migration } from 'cloudflare:test'
+
+declare global {
+  namespace Cloudflare {
+    interface Env {
+      /** Added by vitest.config.ts: the migrations of the DB binding, applied by the setup file. */
+      TEST_MIGRATIONS: D1Migration[]
+    }
+  }
+}

package/template/test/worker.workerd.test.ts

@@ -0,0 +1,92 @@
+import type { HollwareRpc } from '@hollware/server'
+import { env, exports } from 'cloudflare:workers'
+import { describe, expect, it } from 'vitest'
+
+import worker from '../src/worker.ts'
+
+// Fails when: src/worker.ts stops exporting `{ fetch: hollware.fetch }` of createHollware(config)
+// as the Worker, so that GET /health for the public URL of wrangler.jsonc (localhost:5199) stops
+// answering 200, or another Host stops being a 403; when it stops exporting the class `Hollware`
+// that sites read over a service binding, or builds it from another config than hollware.config.ts
+// (describeSite must answer the site `my-site`); or when the D1 binding of wrangler.jsonc stops
+// pointing `migrations_dir` at the migrations of @hollware/server, so that its tables are missing.
+
+// A request made inside workerd has no Host header of its own: a browser or curl would send one.
+const PUBLIC_HOST = 'localhost:5199'
+const asHost = (host: string) => ({ headers: { host } })
+
+// Cloudflare's `Service<...>` types every answer that holds `unknown` as `never`, so the stub is
+// read through the interface it implements.
+const rpc: HollwareRpc = exports.Hollware
+
+describe('the module', () => {
+  it('exports the fetch, queue and scheduled handlers of Hollware', () => {
+    expect(Object.keys(worker).sort()).toEqual(['fetch', 'queue', 'scheduled'])
+  })
+})
+
+describe('the Worker over HTTP', () => {
+  it('answers GET /health at its public URL', async () => {
+    const response = await exports.default.fetch(
+      `http://${PUBLIC_HOST}/health`,
+      asHost(PUBLIC_HOST),
+    )
+
+    expect(response.status).toBe(200)
+    expect(await response.text()).toBe('{"ok":true}')
+  })
+
+  it('refuses a request for another Host with 403', async () => {
+    const response = await exports.default.fetch('http://example.com/health', asHost('example.com'))
+
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({ code: 'forbidden_host' })
+  })
+})
+
+describe('the Hollware class', () => {
+  it('serves the site of hollware.config.ts over RPC', async () => {
+    const answer = await rpc.describeSite('my-site')
+
+    expect(answer).toMatchObject({
+      outcome: 'ok',
+      site: {
+        key: 'my-site',
+        locales: ['en', 'es'],
+        defaultLocale: 'en',
+        collections: [{ name: 'blog', routes: { en: '/blog/:slug/', es: '/es/blog/:slug/' } }],
+      },
+    })
+  })
+})
+
+describe('the database', () => {
+  it('has the tables of the @hollware/server migrations, and no others', async () => {
+    const { results } = await env.DB.prepare(
+      `SELECT name FROM sqlite_master
+        WHERE type = 'table' AND name NOT LIKE '\\_cf\\_%' ESCAPE '\\'
+          AND name NOT IN ('d1_migrations', 'sqlite_sequence')
+        ORDER BY name`,
+    ).all<{ name: string }>()
+
+    expect(results.map((row) => row.name)).toEqual([
+      '_hollware_meta',
+      'auth_challenges',
+      'deliveries',
+      'entries',
+      'invitations',
+      'members',
+      'outbox',
+      'passkeys',
+      'publications',
+      'reviews',
+      'revision_tags',
+      'revisions',
+      'schedules',
+      'sessions',
+      'sites',
+      'tokens',
+      'users',
+    ])
+  })
+})