@micelio/strapi-plugin-core 0.1.0 → 0.2.0

package/dist/server/index.mjs

@@ -2,9 +2,9 @@ import { z } from "zod";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes } from "node:crypto";
 import { factories } from "@strapi/strapi";
+import { errors } from "@strapi/utils";
 import { createRequire } from "node:module";
 import path from "node:path";
-import { errors } from "@strapi/utils";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createGzip, createGunzip } from "node:zlib";
@@ -12,7 +12,7 @@ import { createReadStream, createWriteStream, statSync } from "node:fs";
 import { mkdtemp, rm } from "node:fs/promises";
 import os from "node:os";
 import { once } from "node:events";
-const SITE_UID = "plugin::micelio.site";
+const SITE_UID$1 = "plugin::micelio.site";
 const SITE_COMPONENT_CATEGORY = "micelio-site";
 const DEFAULT_SITE_SLUG = "default";
 const LOCALISED_LOCALES = ["en", "es"];
@@ -113,7 +113,7 @@ function parseExportSection(value) {
 function missingLocales(value) {
   return LOCALISED_LOCALES.filter((locale) => !value[locale]?.trim());
 }
-const attributeOf = (id2) => `${SITE_SECTION_ATTRIBUTE_PREFIX}${id2.replace(/-/g, "_")}`;
+const attributeOf$1 = (id2) => `${SITE_SECTION_ATTRIBUTE_PREFIX}${id2.replace(/-/g, "_")}`;
 function createExtensionRegistry(strapi) {
   const pages = [];
   const sections = [];
@@ -150,8 +150,8 @@ function createExtensionRegistry(strapi) {
           "micelio: registerSiteSection: call it in `register`, before the models are built"
         );
       }
-      const attribute = attributeOf(section.id);
-      strapi.get("content-types").extend(SITE_UID, (contentType) => {
+      const attribute = attributeOf$1(section.id);
+      strapi.get("content-types").extend(SITE_UID$1, (contentType) => {
         Object.assign(contentType.attributes, {
           [attribute]: {
             type: "component",
@@ -180,7 +180,7 @@ function createExtensionRegistry(strapi) {
     siteSections: () => [...sections],
     statusChecks: () => [...checks],
     exportSections: () => [...exports],
-    siteSectionAttribute: attributeOf,
+    siteSectionAttribute: attributeOf$1,
     async runStatusChecks(sites) {
       for (const registration of checks) {
         const found = [];
@@ -204,12 +204,12 @@ function createExtensionRegistry(strapi) {
   };
 }
 function hasDatabaseModels(strapi) {
-  return strapi.db.metadata.has(SITE_UID);
+  return strapi.db.metadata.has(SITE_UID$1);
 }
 function extensionsOf(strapi) {
   return strapi.plugin("micelio").service("extensions");
 }
-const SITE$1 = SITE_UID;
+const SITE$1 = SITE_UID$1;
 function siteSectionInstances(strapi) {
   return async (context, next) => {
     if (context.uid === SITE$1 && context.action === "create") {
@@ -342,7 +342,7 @@ function deepFreeze(value) {
   }
   return value;
 }
-const SITE_ATTRIBUTE = "site";
+const SITE_ATTRIBUTE$1 = "site";
 const SITE_SCOPE_MIDDLEWARE = "plugin::micelio.site-scope";
 function withSiteScope(schema) {
   return {
@@ -353,10 +353,10 @@ function withSiteScope(schema) {
     },
     attributes: {
       ...schema.attributes,
-      [SITE_ATTRIBUTE]: {
+      [SITE_ATTRIBUTE$1]: {
         type: "relation",
         relation: "manyToOne",
-        target: SITE_UID,
+        target: SITE_UID$1,
         required: true,
         pluginOptions: { i18n: { localized: false } }
       }
@@ -381,7 +381,8 @@ const TRANSITIONS = [
   { from: "draft", to: "scheduled" },
   { from: "scheduled", to: "draft" },
   { from: "scheduled", to: "published" },
-  { from: "published", to: "draft" }
+  { from: "published", to: "draft" },
+  { from: "published", to: "published" }
 ];
 const SYSTEM_TRANSITIONS = /* @__PURE__ */ new Set(["scheduled->published"]);
 const SUPER_ADMIN = "strapi-super-admin";
@@ -393,7 +394,8 @@ const DEFAULT_EDITORIAL_POLICY = {
   "in_review->published": [EDITOR, SUPER_ADMIN],
   "draft->scheduled": [EDITOR, SUPER_ADMIN],
   "scheduled->draft": [EDITOR, SUPER_ADMIN],
-  "published->draft": [EDITOR, SUPER_ADMIN]
+  "published->draft": [EDITOR, SUPER_ADMIN],
+  "published->published": [EDITOR, SUPER_ADMIN]
 };
 function transitionKey({ from, to }) {
   return `${from}->${to}`;
@@ -449,7 +451,7 @@ async function performTransition(strapi, request) {
     status: "draft",
     populate: {
       [EDITORIAL_ATTRIBUTE]: { populate: ["reviewedBy", "publishedBy"] },
-      [SITE_ATTRIBUTE]: { fields: ["documentId", "editorialPolicy"] },
+      [SITE_ATTRIBUTE$1]: { fields: ["documentId", "editorialPolicy"] },
       createdBy: true
     }
   });
@@ -508,7 +510,9 @@ async function performTransition(strapi, request) {
     throw new TransitionError(409, "editorialTransitionRefused", refusalMessage(error));
   }
   await runAsTransition(async () => {
-    if (transition.from === "published") await documents.unpublish(target);
+    if (transition.from === "published" && transition.to !== "published") {
+      await documents.unpublish(target);
+    }
     await documents.update({ ...target, data: { [EDITORIAL_ATTRIBUTE]: editorial2 } });
     if (transition.to === "published") await documents.publish(target);
   });
@@ -1035,10 +1039,10 @@ async function storedFingerprint(strapi) {
 }
 const SITE_LOCALES = ["en", "es"];
 async function ensureDefaultSite(strapi) {
-  if (await strapi.db.query(SITE_UID).count() > 0) return false;
+  if (await strapi.db.query(SITE_UID$1).count() > 0) return false;
   const locales = strapi.plugin("i18n").service("locales");
   const locale = await locales.getDefaultLocale();
-  await strapi.documents(SITE_UID).create({
+  await strapi.documents(SITE_UID$1).create({
     locale,
     data: {
       name: "Micelio",
@@ -1052,6 +1056,28 @@ async function ensureDefaultSite(strapi) {
   });
   return true;
 }
+const SITE_UID = "plugin::micelio.site";
+const SITE_ATTRIBUTE = "site";
+const BACKFILLED = ["plugin::micelio.category", "plugin::micelio.tag"];
+async function backfillSite(strapi) {
+  const site2 = await strapi.db.query(SITE_UID).findOne({
+    where: { isDefault: true },
+    select: ["id"]
+  });
+  if (!site2) return 0;
+  let linked = 0;
+  for (const uid of BACKFILLED) {
+    const rows = await strapi.db.query(uid).findMany({
+      where: { [SITE_ATTRIBUTE]: null },
+      select: ["id"]
+    });
+    for (const row of rows) {
+      await strapi.db.query(uid).update({ where: { id: row.id }, data: { [SITE_ATTRIBUTE]: site2.id } });
+    }
+    linked += rows.length;
+  }
+  return linked;
+}
 async function registerPreviewPermission(strapi) {
   await strapi.service("admin::permission").actionProvider.registerMany([
     {
@@ -1062,9 +1088,13 @@ async function registerPreviewPermission(strapi) {
     }
   ]);
 }
+const ADMIN_LOGOUT_HANDLER = "authentication.logout";
 function registerPreviewRevocation(strapi) {
-  strapi.eventHub.on("admin.logout", async (event) => {
-    const id2 = event.user?.id;
+  strapi.server.use(async (ctx, next) => {
+    await next();
+    const route = ctx.state.route;
+    if (route?.info?.pluginName !== "admin" || route.handler !== ADMIN_LOGOUT_HANDLER) return;
+    const id2 = ctx.state.user?.id;
     if (typeof id2 !== "number") return;
     try {
       await strapi.plugin("micelio").service("preview").revoke(id2);
@@ -1087,6 +1117,9 @@ async function registerStatusPermission(strapi) {
 }
 const bootstrap = async ({ strapi }) => {
   await ensureDefaultSite(strapi);
+  const backfilled = await backfillSite(strapi);
+  if (backfilled > 0)
+    strapi.log.info(`[micelio] gave the default site to ${backfilled} categories and tags`);
   await ensureSiteSections(strapi);
   await strapi.plugin("micelio").service("hostCheck").enforce();
   registerScheduler(strapi);
@@ -1100,7 +1133,7 @@ const DEFAULT_CONFIG = {
   scheduledPublishRule: "* * * * *",
   statusRefreshRule: "0 4 * * *"
 };
-const config = {
+const config$1 = {
   default: DEFAULT_CONFIG,
   validator(config2) {
     for (const key of ["scheduledPublishRule", "statusRefreshRule"]) {
@@ -1111,13 +1144,41 @@ const config = {
     }
   }
 };
+const kind$3 = "collectionType";
+const collectionName$a = "categories";
+const info$a = { "singularName": "category", "pluralName": "categories", "displayName": "Category", "description": "Organize your content into categories" };
+const options$a = { "draftAndPublish": false };
+const pluginOptions$3 = { "content-manager": { "visible": true }, "i18n": { "localized": true } };
+const attributes$a = { "name": { "type": "string", "pluginOptions": { "i18n": { "localized": true } } }, "slug": { "type": "uid", "regex": "^(?!\\.{1,2}$)[A-Za-z0-9-_.~]*$", "pluginOptions": { "i18n": { "localized": false } } }, "description": { "type": "text", "pluginOptions": { "i18n": { "localized": true } } }, "order": { "type": "integer", "pluginOptions": { "i18n": { "localized": false } } }, "featured": { "type": "boolean", "default": false, "pluginOptions": { "i18n": { "localized": false } } }, "color": { "type": "integer", "min": 1, "max": 5, "pluginOptions": { "i18n": { "localized": false } } } };
+const category = {
+  kind: kind$3,
+  collectionName: collectionName$a,
+  info: info$a,
+  options: options$a,
+  pluginOptions: pluginOptions$3,
+  attributes: attributes$a
+};
+const kind$2 = "collectionType";
+const collectionName$9 = "micelio_preview_credentials";
+const info$9 = { "singularName": "preview-credential", "pluralName": "preview-credentials", "displayName": "Preview credential", "description": "A preview token, grant or system grant of ADR-0019, stored as the hash of its value and bound to one draft (and, but for a system grant, to one admin user)" };
+const options$9 = { "draftAndPublish": false };
+const pluginOptions$2 = { "content-manager": { "visible": false }, "content-type-builder": { "visible": false }, "i18n": { "localized": false }, "micelio": { "export": "never" } };
+const attributes$9 = { "kind": { "type": "enumeration", "enum": ["token", "grant", "system"], "required": true }, "hash": { "type": "string", "required": true, "unique": true, "private": true }, "adminUser": { "type": "integer" }, "adminOrigin": { "type": "string" }, "entryVersion": { "type": "string" }, "siteDocumentId": { "type": "string", "required": true }, "contentType": { "type": "string", "required": true }, "entryDocumentId": { "type": "string", "required": true }, "entryLocale": { "type": "string" }, "expiresAt": { "type": "datetime", "required": true }, "usedAt": { "type": "datetime" }, "revokedAt": { "type": "datetime" } };
+const previewCredential = {
+  kind: kind$2,
+  collectionName: collectionName$9,
+  info: info$9,
+  options: options$9,
+  pluginOptions: pluginOptions$2,
+  attributes: attributes$9
+};
 const kind$1 = "collectionType";
-const collectionName$8 = "micelio_preview_credentials";
-const info$8 = { "singularName": "preview-credential", "pluralName": "preview-credentials", "displayName": "Preview credential", "description": "A preview token or grant of ADR-0019, stored as the hash of its value and bound to one admin user and one draft" };
+const collectionName$8 = "micelio_sites";
+const info$8 = { "singularName": "site", "pluralName": "sites", "displayName": "Site", "description": "One site the CMS serves: its identity, its host names and the modules the frontend turns on" };
 const options$8 = { "draftAndPublish": false };
-const pluginOptions$1 = { "content-manager": { "visible": false }, "content-type-builder": { "visible": false }, "i18n": { "localized": false }, "micelio": { "export": "never" } };
-const attributes$8 = { "kind": { "type": "enumeration", "enum": ["token", "grant"], "required": true }, "hash": { "type": "string", "required": true, "unique": true, "private": true }, "adminUser": { "type": "integer", "required": true }, "adminOrigin": { "type": "string", "required": true }, "siteDocumentId": { "type": "string", "required": true }, "contentType": { "type": "string", "required": true }, "entryDocumentId": { "type": "string", "required": true }, "entryLocale": { "type": "string" }, "expiresAt": { "type": "datetime", "required": true }, "usedAt": { "type": "datetime" }, "revokedAt": { "type": "datetime" } };
-const previewCredential = {
+const pluginOptions$1 = { "content-manager": { "visible": true }, "content-type-builder": { "visible": false }, "i18n": { "localized": true } };
+const attributes$8 = { "name": { "type": "string", "required": true, "pluginOptions": { "i18n": { "localized": true } } }, "slug": { "type": "string", "regex": "^[a-z0-9]+(?:-[a-z0-9]+)*$", "maxLength": 64, "required": true, "unique": true, "pluginOptions": { "i18n": { "localized": false } } }, "hosts": { "type": "json", "pluginOptions": { "i18n": { "localized": false } } }, "isDefault": { "type": "boolean", "default": false, "required": true, "pluginOptions": { "i18n": { "localized": false } } }, "editorialPolicy": { "type": "json", "pluginOptions": { "i18n": { "localized": false } } }, "description": { "type": "text", "pluginOptions": { "i18n": { "localized": true } } }, "tagline": { "type": "string", "pluginOptions": { "i18n": { "localized": true } } }, "url": { "type": "string", "regex": "^https?://\\S+$", "pluginOptions": { "i18n": { "localized": false } } }, "defaultLocale": { "type": "enumeration", "enum": ["en", "es"], "default": "en", "required": true, "pluginOptions": { "i18n": { "localized": false } } }, "author": { "type": "component", "repeatable": false, "component": "micelio-site.author", "pluginOptions": { "i18n": { "localized": false } } }, "logo": { "type": "media", "multiple": false, "allowedTypes": ["images"], "pluginOptions": { "i18n": { "localized": false } } }, "favicon": { "type": "media", "multiple": false, "allowedTypes": ["images"], "pluginOptions": { "i18n": { "localized": false } } }, "defaultOgImage": { "type": "media", "multiple": false, "allowedTypes": ["images"], "pluginOptions": { "i18n": { "localized": false } } }, "socialLinks": { "type": "component", "repeatable": true, "component": "micelio-site.social-link", "pluginOptions": { "i18n": { "localized": false } } }, "contactEmail": { "type": "email", "pluginOptions": { "i18n": { "localized": false } } }, "privacyContactEmail": { "type": "email", "pluginOptions": { "i18n": { "localized": false } } }, "securityContact": { "type": "string", "maxLength": 512, "pluginOptions": { "i18n": { "localized": false } } }, "privacyJurisdiction": { "type": "enumeration", "enum": ["colombia"], "pluginOptions": { "i18n": { "localized": false } } }, "privacyUpdatedAt": { "type": "datetime", "pluginOptions": { "i18n": { "localized": false } } }, "supportHandle": { "type": "string", "regex": "^[A-Za-z0-9_-]+$", "pluginOptions": { "i18n": { "localized": false } } }, "timezone": { "type": "string", "regex": "^[A-Za-z][A-Za-z0-9]*(?:[/_+-][A-Za-z0-9]+)*$", "pluginOptions": { "i18n": { "localized": false } } }, "addressLocality": { "type": "string", "pluginOptions": { "i18n": { "localized": true } } }, "modules": { "type": "component", "repeatable": false, "component": "micelio-site.modules", "required": true, "pluginOptions": { "i18n": { "localized": false } } }, "theme": { "type": "component", "repeatable": false, "component": "micelio-site.theme", "pluginOptions": { "i18n": { "localized": false } } }, "fediverse": { "type": "component", "repeatable": false, "component": "micelio-site.fediverse", "pluginOptions": { "i18n": { "localized": false } } } };
+const site = {
   kind: kind$1,
   collectionName: collectionName$8,
   info: info$8,
@@ -1126,12 +1187,12 @@ const previewCredential = {
   attributes: attributes$8
 };
 const kind = "collectionType";
-const collectionName$7 = "micelio_sites";
-const info$7 = { "singularName": "site", "pluralName": "sites", "displayName": "Site", "description": "One site the CMS serves: its identity, its host names and the modules the frontend turns on" };
+const collectionName$7 = "tags";
+const info$7 = { "singularName": "tag", "pluralName": "tags", "displayName": "Tag", "description": "Topics an article covers, used to filter the blog" };
 const options$7 = { "draftAndPublish": false };
-const pluginOptions = { "content-manager": { "visible": true }, "content-type-builder": { "visible": false }, "i18n": { "localized": true } };
-const attributes$7 = { "name": { "type": "string", "required": true, "pluginOptions": { "i18n": { "localized": true } } }, "slug": { "type": "string", "regex": "^[a-z0-9]+(?:-[a-z0-9]+)*$", "maxLength": 64, "required": true, "unique": true, "pluginOptions": { "i18n": { "localized": false } } }, "hosts": { "type": "json", "pluginOptions": { "i18n": { "localized": false } } }, "isDefault": { "type": "boolean", "default": false, "required": true, "pluginOptions": { "i18n": { "localized": false } } }, "editorialPolicy": { "type": "json", "pluginOptions": { "i18n": { "localized": false } } }, "description": { "type": "text", "pluginOptions": { "i18n": { "localized": true } } }, "tagline": { "type": "string", "pluginOptions": { "i18n": { "localized": true } } }, "url": { "type": "string", "regex": "^https?://\\S+$", "pluginOptions": { "i18n": { "localized": false } } }, "defaultLocale": { "type": "enumeration", "enum": ["en", "es"], "default": "en", "required": true, "pluginOptions": { "i18n": { "localized": false } } }, "author": { "type": "component", "repeatable": false, "component": "micelio-site.author", "pluginOptions": { "i18n": { "localized": false } } }, "logo": { "type": "media", "multiple": false, "allowedTypes": ["images"], "pluginOptions": { "i18n": { "localized": false } } }, "favicon": { "type": "media", "multiple": false, "allowedTypes": ["images"], "pluginOptions": { "i18n": { "localized": false } } }, "defaultOgImage": { "type": "media", "multiple": false, "allowedTypes": ["images"], "pluginOptions": { "i18n": { "localized": false } } }, "socialLinks": { "type": "component", "repeatable": true, "component": "micelio-site.social-link", "pluginOptions": { "i18n": { "localized": false } } }, "contactEmail": { "type": "email", "pluginOptions": { "i18n": { "localized": false } } }, "privacyContactEmail": { "type": "email", "pluginOptions": { "i18n": { "localized": false } } }, "securityContact": { "type": "string", "maxLength": 512, "pluginOptions": { "i18n": { "localized": false } } }, "privacyJurisdiction": { "type": "enumeration", "enum": ["colombia"], "pluginOptions": { "i18n": { "localized": false } } }, "privacyUpdatedAt": { "type": "datetime", "pluginOptions": { "i18n": { "localized": false } } }, "supportHandle": { "type": "string", "regex": "^[A-Za-z0-9_-]+$", "pluginOptions": { "i18n": { "localized": false } } }, "timezone": { "type": "string", "regex": "^[A-Za-z][A-Za-z0-9]*(?:[/_+-][A-Za-z0-9]+)*$", "pluginOptions": { "i18n": { "localized": false } } }, "addressLocality": { "type": "string", "pluginOptions": { "i18n": { "localized": true } } }, "modules": { "type": "component", "repeatable": false, "component": "micelio-site.modules", "required": true, "pluginOptions": { "i18n": { "localized": false } } }, "theme": { "type": "component", "repeatable": false, "component": "micelio-site.theme", "pluginOptions": { "i18n": { "localized": false } } }, "fediverse": { "type": "component", "repeatable": false, "component": "micelio-site.fediverse", "pluginOptions": { "i18n": { "localized": false } } } };
-const site = {
+const pluginOptions = { "content-manager": { "visible": true }, "i18n": { "localized": true } };
+const attributes$7 = { "name": { "type": "string", "required": true, "pluginOptions": { "i18n": { "localized": true } } }, "slug": { "type": "uid", "regex": "^(?!\\.{1,2}$)[A-Za-z0-9-_.~]*$", "targetField": "name", "required": true, "pluginOptions": { "i18n": { "localized": false } } } };
+const tag = {
   kind,
   collectionName: collectionName$7,
   info: info$7,
@@ -1141,8 +1202,13 @@ const site = {
 };
 const contentTypes = {
   site: { schema: site },
+  category: { schema: withSiteScope(category) },
+  tag: { schema: withSiteScope(tag) },
   "preview-credential": { schema: withSiteScope(previewCredential) }
 };
+const CATEGORY_UID = "plugin::micelio.category";
+const TAG_UID = "plugin::micelio.tag";
+const READ_ACTIONS$1 = [`${CATEGORY_UID}.find`, `${TAG_UID}.find`];
 const blocks = () => ({
   find(ctx) {
     ctx.body = {
@@ -1160,18 +1226,19 @@ const PREVIEW_PATH = "/_preview";
 const PREVIEW_GRANT_HEADER = "x-micelio-preview-grant";
 const PREVIEW_TOKEN_TTL_SECONDS = 60;
 const PREVIEW_GRANT_TTL_SECONDS = 15 * 60;
+const PREVIEW_SYSTEM_GRANT_TTL_SECONDS = 60;
 const PREVIEW_CREDENTIAL_RETENTION_SECONDS = 60 * 60;
 const PREVIEW_RATE_WINDOW_SECONDS = 60;
 const PREVIEW_TOKEN_RATE_LIMIT = 20;
 const PREVIEW_EXCHANGE_RATE_LIMIT = 60;
 async function readableDraft(strapi, userAbility, contentType, documentId, locale) {
   const uid = contentType;
-  if (!strapi.contentType(uid)?.attributes?.[SITE_ATTRIBUTE]) return { status: "not-site-scoped" };
+  if (!strapi.contentType(uid)?.attributes?.[SITE_ATTRIBUTE$1]) return { status: "not-site-scoped" };
   const entry = await strapi.documents(uid).findOne({
     documentId,
     locale: locale ?? void 0,
     status: "draft",
-    populate: { [SITE_ATTRIBUTE]: { fields: ["documentId"] }, createdBy: true }
+    populate: { [SITE_ATTRIBUTE$1]: { fields: ["documentId"] }, createdBy: true }
   });
   if (!entry?.site) return { status: "missing" };
   const checker = strapi.plugin("content-manager").service("permission-checker").create({ userAbility, model: contentType });
@@ -1186,9 +1253,338 @@ async function abilityOf(strapi, adminUser) {
   if (!user || user.isActive === false) return null;
   return strapi.service("admin::permission").engine.generateUserAbility(user);
 }
+const FILE_UID = "plugin::upload.file";
+const QUERY_KEYS = /* @__PURE__ */ new Set(["populate", "site"]);
+const ALWAYS_FIELDS = /* @__PURE__ */ new Set(["id", "documentId", "createdAt", "updatedAt"]);
+const NOT_SCALAR = /* @__PURE__ */ new Set(["relation", "component", "dynamiczone", "media"]);
+const NO_POPULATE = { all: false, children: /* @__PURE__ */ new Map() };
+class QueryProblem extends Error {
+}
+function readDraftQuery(strapi, query, schema) {
+  try {
+    for (const key of Object.keys(query)) {
+      if (!QUERY_KEYS.has(key)) {
+        throw new QueryProblem(
+          `The draft read takes only documentId, locale and populate, not "${key}"`
+        );
+      }
+    }
+    return { populate: parsePopulate(strapi, query.populate, schema, "document", "populate") };
+  } catch (error) {
+    if (error instanceof QueryProblem) return { problem: error.message };
+    throw error;
+  }
+}
+async function readDraft(strapi, options2) {
+  const schema = strapi.contentType(options2.uid);
+  const params = await strapi.contentAPI.sanitize.query(
+    { populate: draftPopulate(strapi, options2.populate, schema) },
+    schema,
+    { auth: options2.auth }
+  );
+  const entry = await strapi.documents(options2.uid).findOne({
+    ...params,
+    documentId: options2.documentId,
+    locale: options2.locale,
+    status: "draft"
+  });
+  if (!entry) return null;
+  await publishedRelations(strapi, entry, schema, options2.populate);
+  await keepToSite(strapi, entry, schema, options2.siteDocumentId);
+  return entry;
+}
+function fail(message) {
+  throw new QueryProblem(message);
+}
+function attributeOf(schema, name2) {
+  return Object.prototype.hasOwnProperty.call(schema.attributes, name2) ? schema.attributes[name2] : void 0;
+}
+function expand(value, path2) {
+  const found = { all: false, pairs: [] };
+  const add2 = (part2) => {
+    if (part2 === void 0 || part2 === null || part2 === false || part2 === "false") return;
+    if (part2 === true || part2 === "true") {
+      found.all = true;
+    } else if (typeof part2 === "string") {
+      for (const name2 of part2.split(",").map((piece) => piece.trim())) {
+        if (name2 === "") continue;
+        if (name2 === "*") found.all = true;
+        else {
+          const [head = "", ...rest] = name2.split(".");
+          found.pairs.push([head, rest.length > 0 ? { populate: rest.join(".") } : true]);
+        }
+      }
+    } else if (Array.isArray(part2)) {
+      for (const item of part2) {
+        if (typeof item !== "string" && (typeof item !== "object" || item === null)) {
+          fail(`${path2} must be a name, a list of names or an object`);
+        }
+        add2(item);
+      }
+    } else if (typeof part2 === "object") {
+      found.pairs.push(...Object.entries(part2));
+    } else {
+      fail(`${path2} must be a name, a list of names or an object`);
+    }
+  };
+  add2(value);
+  return found;
+}
+function parsePopulate(strapi, value, schema, scope, path2) {
+  const { all: all2, pairs } = expand(value, path2);
+  if (all2 && pairs.length > 0) fail(`${path2} cannot mix "*" with names`);
+  if (all2 && scope === "related") fail(`${path2} cannot be "*" under a relation`);
+  const children = /* @__PURE__ */ new Map();
+  for (const [name2, sub] of pairs) {
+    const here = `${path2}[${name2}]`;
+    const attribute = attributeOf(schema, name2);
+    if (!attribute || attribute.private === true) fail(`${here} is not an attribute of the type`);
+    if (scope === "related" && attribute.type !== "media") {
+      fail(`${here}: under a relation only a media attribute may be populated`);
+    }
+    if (children.has(name2)) fail(`${here} is named twice`);
+    const node = parseNode(strapi, sub, attribute, here);
+    if (node) children.set(name2, node);
+  }
+  return { all: all2, children };
+}
+function parseNode(strapi, sub, attribute, path2) {
+  if (sub === false || sub === "false") return void 0;
+  const options2 = sub === true || sub === "true" || sub === "" ? {} : sub;
+  if (typeof options2 !== "object" || options2 === null || Array.isArray(options2)) {
+    fail(`${path2} must be true or an object`);
+  }
+  const given = options2;
+  const only = (...keys) => {
+    for (const key of Object.keys(given)) {
+      if (!keys.includes(key)) fail(`${path2} does not take "${key}"`);
+    }
+  };
+  switch (attribute.type) {
+    case "media":
+      only("fields");
+      return { fields: fieldsOf(given.fields, strapi.contentType(FILE_UID), path2) };
+    case "relation": {
+      only("fields", "populate");
+      const target = relationTarget(strapi, attribute, path2);
+      const schema = strapi.contentType(target);
+      const node = { fields: fieldsOf(given.fields, schema, path2) };
+      if (given.populate !== void 0) {
+        node.populate = parsePopulate(
+          strapi,
+          given.populate,
+          schema,
+          "related",
+          `${path2}[populate]`
+        );
+      }
+      return node;
+    }
+    case "component":
+      only("fields", "populate");
+      return componentNode(strapi, given, attribute.component, path2);
+    case "dynamiczone": {
+      only("on");
+      if (given.on === void 0) return {};
+      if (typeof given.on !== "object" || given.on === null || Array.isArray(given.on)) {
+        fail(`${path2}[on] must be an object`);
+      }
+      const on = /* @__PURE__ */ new Map();
+      for (const [uid, fragment] of Object.entries(given.on)) {
+        if (!attribute.components?.includes(uid))
+          fail(`${path2}[on][${uid}] is not a component of the zone`);
+        const node = parseNode(
+          strapi,
+          fragment,
+          { type: "component", component: uid },
+          `${path2}[on][${uid}]`
+        );
+        if (node) on.set(uid, node);
+      }
+      return { on };
+    }
+    default:
+      return fail(`${path2} is not a relation, a component, a dynamic zone or a media attribute`);
+  }
+}
+function componentNode(strapi, given, uid, path2) {
+  const component2 = strapi.components[uid];
+  const node = { fields: fieldsOf(given.fields, component2, path2) };
+  if (given.populate !== void 0) {
+    node.populate = parsePopulate(
+      strapi,
+      given.populate,
+      component2,
+      "document",
+      `${path2}[populate]`
+    );
+  }
+  return node;
+}
+function relationTarget(strapi, attribute, path2) {
+  const target = attribute.target;
+  if (typeof target !== "string" || target.startsWith("admin::") || !(target in strapi.contentTypes)) {
+    return fail(`${path2} is a relation the draft read does not follow`);
+  }
+  return target;
+}
+function fieldsOf(value, schema, path2) {
+  if (value === void 0) return void 0;
+  const names = (Array.isArray(value) ? value : [value]).flatMap((item) => {
+    if (typeof item !== "string") return fail(`${path2}[fields] must be names of fields`);
+    return item.split(",").map((piece) => piece.trim());
+  });
+  for (const name2 of names) {
+    const attribute = attributeOf(schema, name2);
+    const known = ALWAYS_FIELDS.has(name2) || attribute !== void 0 && attribute.private !== true;
+    if (!known || attribute !== void 0 && NOT_SCALAR.has(attribute.type)) {
+      fail(`${path2}[fields]: "${name2}" is not a field of the type`);
+    }
+  }
+  return names.filter((name2) => name2 !== "");
+}
+function draftPopulate(strapi, spec, schema) {
+  if (spec.all) return "*";
+  const populate = {};
+  for (const [name2, node] of spec.children) {
+    const attribute = attributeOf(schema, name2);
+    if (attribute?.type === "media") {
+      populate[name2] = node.fields ? { fields: node.fields } : true;
+    } else if (attribute?.type === "component") {
+      populate[name2] = componentPopulate(strapi, node, attribute.component);
+    } else if (attribute?.type === "dynamiczone") {
+      populate[name2] = node.on ? {
+        on: Object.fromEntries(
+          [...node.on].map(([uid, fragment]) => [
+            uid,
+            componentPopulate(strapi, fragment, uid)
+          ])
+        )
+      } : true;
+    } else {
+      populate[name2] = true;
+    }
+  }
+  return populate;
+}
+function componentPopulate(strapi, node, uid) {
+  const options2 = {};
+  if (node.fields) options2.fields = node.fields;
+  if (node.populate) options2.populate = draftPopulate(strapi, node.populate, strapi.components[uid]);
+  return Object.keys(options2).length > 0 ? options2 : true;
+}
+async function publishedRelations(strapi, entry, schema, spec) {
+  for (const [name2, attribute] of Object.entries(schema.attributes)) {
+    const value = entry[name2];
+    if (value === void 0 || value === null) continue;
+    const node = spec.children.get(name2) ?? (spec.all ? {} : void 0);
+    if (attribute.type === "relation") {
+      if (typeof attribute.target !== "string") {
+        delete entry[name2];
+        continue;
+      }
+      const target = attribute.target;
+      const published = [];
+      for (const related of Array.isArray(value) ? value : [value]) {
+        const read = await publishedOf(strapi, target, related, node ?? {});
+        if (read) published.push(read);
+      }
+      entry[name2] = Array.isArray(value) ? published : published[0] ?? null;
+    } else if (attribute.type === "component") {
+      const component2 = strapi.components[attribute.component];
+      for (const child of Array.isArray(value) ? value : [value]) {
+        await publishedRelations(strapi, child, component2, node?.populate ?? NO_POPULATE);
+      }
+    } else if (attribute.type === "dynamiczone") {
+      for (const child of value) {
+        const uid = child.__component;
+        if (!(uid in strapi.components)) continue;
+        await publishedRelations(
+          strapi,
+          child,
+          strapi.components[uid],
+          node?.on?.get(uid)?.populate ?? NO_POPULATE
+        );
+      }
+    }
+  }
+}
+async function publishedOf(strapi, target, related, node) {
+  if (typeof related.documentId !== "string") return null;
+  const media2 = {};
+  for (const [name2, child] of node.populate?.children ?? []) {
+    media2[name2] = child.fields ? { fields: child.fields } : true;
+  }
+  return await strapi.documents(target).findOne({
+    documentId: related.documentId,
+    locale: typeof related.locale === "string" ? related.locale : void 0,
+    status: "published",
+    fields: node.fields,
+    populate: Object.keys(media2).length > 0 ? media2 : void 0
+  });
+}
+async function keepToSite(strapi, entry, schema, siteDocumentId) {
+  const found = /* @__PURE__ */ new Map();
+  await walk(strapi, entry, schema, async (target, entries) => {
+    if (!isSiteScoped(strapi.contentType(target))) return entries;
+    const ids = found.get(target) ?? /* @__PURE__ */ new Set();
+    for (const { documentId } of entries) if (typeof documentId === "string") ids.add(documentId);
+    found.set(target, ids);
+    return entries;
+  });
+  if (found.size === 0) return;
+  const owned = /* @__PURE__ */ new Map();
+  for (const [target, ids] of found) {
+    const published = strapi.contentType(target).options?.draftAndPublish === true;
+    const rows = await strapi.db.query(target).findMany({
+      select: ["documentId"],
+      where: {
+        documentId: { $in: [...ids] },
+        [SITE_ATTRIBUTE$1]: { documentId: siteDocumentId },
+        ...published ? { publishedAt: { $notNull: true } } : {}
+      }
+    });
+    owned.set(target, new Set(rows.map((row) => row.documentId)));
+  }
+  await walk(strapi, entry, schema, async (target, entries) => {
+    const ids = owned.get(target);
+    if (!isSiteScoped(strapi.contentType(target))) return entries;
+    return entries.filter(
+      ({ documentId }) => typeof documentId === "string" && ids?.has(documentId) === true
+    );
+  });
+}
+async function walk(strapi, entry, schema, visit) {
+  for (const [name2, attribute] of Object.entries(schema.attributes)) {
+    const value = entry[name2];
+    if (value === void 0 || value === null) continue;
+    if (attribute.type === "relation") {
+      if (!("target" in attribute) || typeof attribute.target !== "string") {
+        delete entry[name2];
+        continue;
+      }
+      const target = attribute.target;
+      const many = Array.isArray(value);
+      const kept = await visit(target, many ? value : [value]);
+      for (const child of kept) await walk(strapi, child, strapi.contentType(target), visit);
+      entry[name2] = many ? kept : kept[0] ?? null;
+    } else if (attribute.type === "component") {
+      const component2 = strapi.components[attribute.component];
+      for (const child of Array.isArray(value) ? value : [value]) {
+        await walk(strapi, child, component2, visit);
+      }
+    } else if (attribute.type === "dynamiczone") {
+      for (const child of value) {
+        const component2 = strapi.components[child.__component];
+        if (component2) await walk(strapi, child, component2, visit);
+      }
+    }
+  }
+}
 const LIFETIME_SECONDS = {
   token: PREVIEW_TOKEN_TTL_SECONDS,
-  grant: PREVIEW_GRANT_TTL_SECONDS
+  grant: PREVIEW_GRANT_TTL_SECONDS,
+  system: PREVIEW_SYSTEM_GRANT_TTL_SECONDS
 };
 function hashCredential(value) {
   return createHash("sha256").update(value).digest("hex");
@@ -1196,6 +1592,9 @@ function hashCredential(value) {
 function issueCredential(kind2, binding, now = /* @__PURE__ */ new Date()) {
   const value = randomBytes(32).toString("base64url");
   const record = {
+    adminUser: null,
+    adminOrigin: null,
+    entryVersion: null,
     ...binding,
     kind: kind2,
     hash: hashCredential(value),
@@ -1224,15 +1623,22 @@ class PreviewUnavailableError extends Error {
 const preview$1 = ({ strapi }) => {
   const store2 = () => strapi.db.query(PREVIEW_CREDENTIAL_UID);
   async function save(record) {
-    const site2 = await strapi.db.query(SITE_UID).findOne({ where: { documentId: record.siteDocumentId }, select: ["id"] });
+    const site2 = await strapi.db.query(SITE_UID$1).findOne({ where: { documentId: record.siteDocumentId }, select: ["id"] });
     await store2().create({ data: { ...record, site: site2?.id } });
   }
-  async function find(kind2, value) {
+  async function find(kinds, value) {
     const row = await store2().findOne({
-      where: { hash: hashCredential(value), kind: kind2 }
+      where: { hash: hashCredential(value), kind: { $in: kinds } }
     });
     return row;
   }
+  async function removeExpired() {
+    await store2().deleteMany({
+      where: {
+        expiresAt: { $lt: new Date(Date.now() - PREVIEW_CREDENTIAL_RETENTION_SECONDS * 1e3) }
+      }
+    });
+  }
   async function revoke(adminUser, entryDocumentId) {
     await store2().updateMany({
       where: {
@@ -1253,43 +1659,56 @@ const preview$1 = ({ strapi }) => {
   }
   return {
     async issueToken(binding) {
-      const site2 = await strapi.db.query(SITE_UID).findOne({ where: { documentId: binding.siteDocumentId }, select: ["url"] });
+      const site2 = await strapi.db.query(SITE_UID$1).findOne({ where: { documentId: binding.siteDocumentId }, select: ["url"] });
       const url = previewUrlOf(site2?.url);
       if (!url) throw new PreviewUnavailableError(binding.siteDocumentId);
-      await store2().deleteMany({
-        where: {
-          expiresAt: { $lt: new Date(Date.now() - PREVIEW_CREDENTIAL_RETENTION_SECONDS * 1e3) }
-        }
-      });
+      await removeExpired();
       const { value, record } = issueCredential("token", binding);
       await save(record);
       url.searchParams.set("token", value);
       return { url: url.toString(), expiresAt: record.expiresAt.toISOString() };
     },
     async exchange(token, siteDocumentId) {
-      const row = await find("token", token);
+      const row = await find(["token"], token);
       if (!row || !mayUseCredential(toRecord(row), "token", { siteDocumentId })) return null;
       const claimed = await store2().updateMany({
         where: { id: row.id, usedAt: null, revokedAt: null },
         data: { usedAt: /* @__PURE__ */ new Date() }
       });
       if (claimed.count !== 1) return null;
-      if (!await stillReadable(row)) return null;
-      const { value, record } = issueCredential("grant", bindingOf(row));
+      const binding = adminBindingOf(row);
+      if (!binding || !await stillReadable(binding)) return null;
+      const { value, record } = issueCredential("grant", binding);
       await save(record);
       return {
         grant: value,
         expiresAt: record.expiresAt.toISOString(),
-        adminOrigin: row.adminOrigin,
+        adminOrigin: binding.adminOrigin,
         contentType: row.contentType,
         documentId: row.entryDocumentId,
         locale: row.entryLocale
       };
     },
+    async issueSystemGrant(binding) {
+      await removeExpired();
+      const { value, record } = issueCredential("system", binding);
+      await save(record);
+      return value;
+    },
     async resolveGrant(grant, expected) {
-      const row = await find("grant", grant);
-      if (!row || !mayUseCredential(toRecord(row), "grant", expected)) return null;
-      return await stillReadable(row) ? bindingOf(row) : null;
+      const row = await find(["grant", "system"], grant);
+      if (!row || !mayUseCredential(toRecord(row), row.kind, expected)) return null;
+      if (row.kind === "system") {
+        const claimed = await store2().updateMany({
+          where: { id: row.id, usedAt: null, revokedAt: null },
+          data: { usedAt: /* @__PURE__ */ new Date() }
+        });
+        if (claimed.count !== 1) return null;
+        return { ...targetOf(row), actor: "system", entryVersion: row.entryVersion };
+      }
+      const binding = adminBindingOf(row);
+      if (!binding || !await stillReadable(binding)) return null;
+      return { ...targetOf(row), actor: "admin", entryVersion: null };
     },
     revoke
   };
@@ -1306,21 +1725,26 @@ function previewUrlOf(url) {
     return void 0;
   }
 }
-function bindingOf(row) {
+function targetOf(row) {
   return {
-    adminUser: row.adminUser,
-    adminOrigin: row.adminOrigin,
     siteDocumentId: row.siteDocumentId,
     contentType: row.contentType,
     entryDocumentId: row.entryDocumentId,
     entryLocale: row.entryLocale
   };
 }
+function adminBindingOf(row) {
+  if (row.adminUser === null || row.adminOrigin === null) return null;
+  return { ...targetOf(row), adminUser: row.adminUser, adminOrigin: row.adminOrigin };
+}
 function toRecord(row) {
   return {
-    ...bindingOf(row),
+    ...targetOf(row),
     kind: row.kind,
     hash: row.hash,
+    adminUser: row.adminUser,
+    adminOrigin: row.adminOrigin,
+    entryVersion: row.entryVersion,
     expiresAt: new Date(row.expiresAt),
     usedAt: row.usedAt ? new Date(row.usedAt) : null,
     revokedAt: row.revokedAt ? new Date(row.revokedAt) : null
@@ -1358,6 +1782,16 @@ const preview = ({ strapi }) => {
   const previews = () => strapi.plugin("micelio").service("preview");
   const tokenLimit = createRateLimiter(PREVIEW_TOKEN_RATE_LIMIT, PREVIEW_RATE_WINDOW_SECONDS);
   const exchangeLimit = createRateLimiter(PREVIEW_EXCHANGE_RATE_LIMIT, PREVIEW_RATE_WINDOW_SECONDS);
+  async function isVersionOf(uid, binding) {
+    const current = await strapi.documents(uid).findOne({
+      documentId: binding.entryDocumentId,
+      locale: binding.entryLocale ?? void 0,
+      status: "draft",
+      fields: ["updatedAt"]
+    });
+    if (!current?.updatedAt || !binding.entryVersion) return false;
+    return new Date(current.updatedAt).getTime() === new Date(binding.entryVersion).getTime();
+  }
   return {
     async token(ctx) {
       const ability = ctx.state.userAbility;
@@ -1461,22 +1895,37 @@ const preview = ({ strapi }) => {
       }
       const uid = binding.contentType;
       const schema = strapi.contentType(uid);
+      const read = readDraftQuery(strapi, query, schema);
+      if ("problem" in read) {
+        refuse(ctx, 400, "previewRequestInvalid", read.problem);
+        return;
+      }
       const auth = ctx.state.auth;
-      const params = await strapi.contentAPI.sanitize.query(query, schema, { auth });
-      const entry = await strapi.documents(uid).findOne({
-        ...params,
-        documentId: binding.entryDocumentId,
-        locale: binding.entryLocale ?? void 0,
-        status: "draft"
-      });
-      if (!entry) {
+      let entry;
+      try {
+        entry = await readDraft(strapi, {
+          uid,
+          documentId: binding.entryDocumentId,
+          locale: binding.entryLocale ?? void 0,
+          populate: read.populate,
+          siteDocumentId: siteOf(ctx),
+          auth
+        });
+      } catch (error) {
+        if (!(error instanceof errors.ValidationError || error instanceof errors.PaginationError)) {
+          throw error;
+        }
+        refuse(ctx, 400, "previewRequestInvalid", error.message);
+        return;
+      }
+      if (!entry || binding.actor === "system" && !await isVersionOf(uid, binding)) {
         refuse(ctx, 404, "previewRefused", REFUSED);
         return;
       }
       ctx.set("Cache-Control", "private, no-store");
       ctx.body = {
         data: await strapi.contentAPI.sanitize.output(entry, schema, { auth }),
-        meta: {}
+        meta: { actor: binding.actor }
       };
     }
   };
@@ -1509,8 +1958,8 @@ function readTokenBody(body) {
   return { uid, documentId, locale };
 }
 const name = "@micelio/strapi-plugin-core";
-const version$1 = "0.1.0";
-const engines = { "node": ">=22.12" };
+const version$1 = "0.2.0";
+const engines = { "node": ">=22.19.0" };
 const micelio = "0.6";
 const packageJson = {
   name,
@@ -1755,7 +2204,7 @@ function runSanitiser(loaded, html) {
   return void 0;
 }
 async function readSiteOrigins(strapi) {
-  const sites = await strapi.db.query(SITE_UID).findMany({ select: ["url"] });
+  const sites = await strapi.db.query(SITE_UID$1).findMany({ select: ["url"] });
   const origins = /* @__PURE__ */ new Set();
   for (const { url } of sites) {
     if (!url) continue;
@@ -1813,7 +2262,7 @@ async function readSitesWithSections(strapi, sections) {
 async function readSiteRows(strapi, populate) {
   const locales = strapi.plugin("i18n").service("locales");
   const defaultLocale = await locales.getDefaultLocale();
-  const rows = await strapi.db.query(SITE_UID).findMany({
+  const rows = await strapi.db.query(SITE_UID$1).findMany({
     select: ["documentId", "locale", "name", "slug", "hosts", "isDefault", "url"],
     populate,
     orderBy: { slug: "asc" }
@@ -1876,7 +2325,7 @@ const extensions$1 = ({ strapi }) => {
     },
     async sites(ctx) {
       const ability = abilityOf2(ctx);
-      if (ability?.can(READ_SITES, SITE_UID) !== true) {
+      if (ability?.can(READ_SITES, SITE_UID$1) !== true) {
         sendProblem(ctx, {
           type: "about:blank",
           title: "Forbidden",
@@ -1975,7 +2424,9 @@ function readBody(body) {
   return { uid, documentId, to, locale, publishAt };
 }
 const controllers = {
-  site: factories.createCoreController(SITE_UID),
+  site: factories.createCoreController(SITE_UID$1),
+  category: factories.createCoreController(CATEGORY_UID),
+  tag: factories.createCoreController(TAG_UID),
   blocks,
   transitions: transitions$1,
   status: status$1,
@@ -2015,7 +2466,7 @@ const siteScope = (_config, { strapi }) => {
   };
 };
 async function loadSites(strapi) {
-  const rows = await strapi.db.query(SITE_UID).findMany({
+  const rows = await strapi.db.query(SITE_UID$1).findMany({
     select: ["documentId", "slug", "hosts", "isDefault"]
   });
   const sites = /* @__PURE__ */ new Map();
@@ -2117,16 +2568,16 @@ const COMPONENTS = {
 function registerComponents(strapi) {
   const components = Object.fromEntries(
     Object.entries(COMPONENTS).flatMap(
-      ([category, schemas]) => Object.entries(schemas).map(([name2, schema]) => {
-        const uid = `${category}.${name2}`;
+      ([category2, schemas]) => Object.entries(schemas).map(([name2, schema]) => {
+        const uid = `${category2}.${name2}`;
         const component2 = {
           ...structuredClone(schema),
           __schema__: structuredClone(schema),
           uid,
-          category,
+          category: category2,
           modelType: "component",
           modelName: name2,
-          globalId: `Component${pascalCase(category)}${pascalCase(name2)}`
+          globalId: `Component${pascalCase(category2)}${pascalCase(name2)}`
         };
         return [uid, component2];
       })
@@ -2174,10 +2625,120 @@ async function storedState(strapi, uid, params) {
   });
   return entry?.editorial?.state ?? "draft";
 }
+const LEGACY_TO_PLUGIN = {
+  "api::category.category": "plugin::micelio.category",
+  "api::tag.tag": "plugin::micelio.tag"
+};
+const CONFIGURATION_KEY_PREFIX = "plugin_content_manager_configuration_content_types::";
+const ACTION_TABLES = [
+  { uid: "plugin::users-permissions.permission", owner: "role" },
+  { uid: "admin::api-token-permission", owner: "token" }
+];
+async function renameLegacyUids(strapi) {
+  const report = { actions: 0, subjects: 0, layouts: 0 };
+  for (const [legacy, current] of Object.entries(LEGACY_TO_PLUGIN)) {
+    if (strapi.contentTypes[legacy]) {
+      strapi.log.info(
+        `micelio: kept the grants and layouts of ${legacy}: the host still registers that type`
+      );
+      continue;
+    }
+    for (const { uid, owner } of ACTION_TABLES) {
+      report.actions += await renameActions(strapi, uid, owner, legacy, current);
+    }
+    report.subjects += await renameSubjects(strapi, legacy, current);
+    report.layouts += await renameLayouts(strapi, legacy, current);
+  }
+  return report;
+}
+async function hasTable(strapi, uid) {
+  if (!strapi.db.metadata.has(uid)) return false;
+  const tableName = strapi.db.metadata.get(uid).tableName;
+  return Boolean(tableName) && await strapi.db.getSchemaConnection().hasTable(tableName);
+}
+async function renameActions(strapi, uid, owner, legacy, current) {
+  if (!await hasTable(strapi, uid)) return 0;
+  const rows = await strapi.db.query(uid).findMany({
+    where: { action: { $startsWith: `${legacy}.` } },
+    populate: { [owner]: { select: ["id"] } }
+  });
+  for (const row of rows) {
+    const action = `${current}${row.action.slice(legacy.length)}`;
+    const ownerRow = row[owner];
+    const twin = ownerRow ? await strapi.db.query(uid).findOne({ where: { action, [owner]: ownerRow.id } }) : null;
+    if (twin) {
+      await strapi.db.query(uid).delete({ where: { id: row.id } });
+    } else {
+      await strapi.db.query(uid).update({ where: { id: row.id }, data: { action } });
+    }
+  }
+  return rows.length;
+}
+async function renameSubjects(strapi, legacy, current) {
+  const uid = "admin::permission";
+  if (!await hasTable(strapi, uid)) return 0;
+  const rows = await strapi.db.query(uid).findMany({
+    where: { subject: legacy },
+    populate: { role: { select: ["id"] } }
+  });
+  for (const row of rows) {
+    const twin = row.role ? await strapi.db.query(uid).findOne({ where: { action: row.action, subject: current, role: row.role.id } }) : null;
+    if (twin) {
+      await strapi.db.query(uid).delete({ where: { id: row.id } });
+    } else {
+      await strapi.db.query(uid).update({ where: { id: row.id }, data: { subject: current } });
+    }
+  }
+  return rows.length;
+}
+function replaceWholeUid(text2, legacy, current) {
+  const escaped = legacy.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return text2.replace(new RegExp(`${escaped}(?![A-Za-z0-9_-])`, "g"), () => current);
+}
+async function renameLayouts(strapi, legacy, current) {
+  const uid = "strapi::core-store";
+  if (!await hasTable(strapi, uid)) return 0;
+  const rows = await strapi.db.query(uid).findMany({
+    where: { key: { $startsWith: CONFIGURATION_KEY_PREFIX } }
+  });
+  let changed = 0;
+  for (const row of rows) {
+    const key = replaceWholeUid(row.key, legacy, current);
+    const value = row.value ? replaceWholeUid(row.value, legacy, current) : row.value;
+    if (key === row.key && value === row.value) continue;
+    changed += 1;
+    if (key !== row.key && await strapi.db.query(uid).findOne({ where: { key } })) {
+      await strapi.db.query(uid).delete({ where: { id: row.id } });
+    } else {
+      await strapi.db.query(uid).update({ where: { id: row.id }, data: { key, value } });
+    }
+  }
+  return changed;
+}
+function previewPageUrl(strapi, uid, { documentId, locale }) {
+  const schema = strapi.contentType(uid);
+  const hasDynamicZone = Object.values(schema?.attributes ?? {}).some(
+    ({ type }) => type === "dynamiczone"
+  );
+  if (!documentId || schema?.kind !== "collectionType") return void 0;
+  if (!isSiteScoped(schema) || !hasDynamicZone) return void 0;
+  const base = strapi.config.get("admin.url", "/admin");
+  const page = `${base.replace(/\/$/, "")}/plugins/micelio/preview/${encodeURIComponent(uid)}/${encodeURIComponent(documentId)}`;
+  return locale ? `${page}?locale=${encodeURIComponent(locale)}` : page;
+}
+function registerPreviewShortcut(strapi) {
+  if (strapi.config.get("admin.preview") !== void 0) return;
+  strapi.config.set("admin.preview", {
+    enabled: true,
+    config: {
+      handler: (uid, params) => previewPageUrl(strapi, uid, params)
+    }
+  });
+}
 function siteCreatedHook(strapi) {
   return async (context, next) => {
     const result = await next();
-    if (context.uid !== SITE_UID || context.action !== "create") return result;
+    if (context.uid !== SITE_UID$1 || context.action !== "create") return result;
     const site2 = result;
     await hooksOf(strapi).runAfter("siteCreated", {
       site: site2.documentId,
@@ -2196,14 +2757,16 @@ function siteScopeDocuments(strapi) {
     const site2 = currentSite(strapi);
     if (context.action === "create") {
       params.data = params.data ?? {};
-      if (isMissing(params.data[SITE_ATTRIBUTE])) {
-        if (!site2) throw new errors.ValidationError(`${SITE_ATTRIBUTE} is required`);
-        params.data[SITE_ATTRIBUTE] = site2.documentId;
+      if (site2) params.data[SITE_ATTRIBUTE$1] = site2.documentId;
+      else if (isMissing(params.data[SITE_ATTRIBUTE$1])) {
+        throw new errors.ValidationError(`${SITE_ATTRIBUTE$1} is required`);
       }
     }
-    if (context.action === "update" && params.data && SITE_ATTRIBUTE in params.data) {
-      if (isMissing(params.data[SITE_ATTRIBUTE])) {
-        throw new errors.ValidationError(`${SITE_ATTRIBUTE} is required`);
+    if (context.action === "update" && params.data && SITE_ATTRIBUTE$1 in params.data) {
+      if (site2) delete params.data[SITE_ATTRIBUTE$1];
+      else if (isUnchanged(params.data[SITE_ATTRIBUTE$1])) delete params.data[SITE_ATTRIBUTE$1];
+      else if (isMissing(params.data[SITE_ATTRIBUTE$1])) {
+        throw new errors.ValidationError(`${SITE_ATTRIBUTE$1} is required`);
       }
     }
     if (site2 && READ_ACTIONS.has(context.action)) {
@@ -2215,21 +2778,119 @@ function siteScopeDocuments(strapi) {
       });
       if (owned === 0) throw new errors.NotFoundError("Not Found");
     }
-    return next();
+    if (context.action === "update" && params.documentId) {
+      await keepSiteOfLocales(strapi, context.uid, params);
+    }
+    const result = await next();
+    if (rebuildsRelations(context.action, params) && params.documentId) {
+      await repairSiteOfLocales(strapi, context.uid, params);
+    }
+    return result;
   };
 }
+async function keepSiteOfLocales(strapi, uid, params) {
+  if (!isLocalized(strapi, uid)) return;
+  const locale = typeof params.locale === "string" ? params.locale : await strapi.plugin("i18n").service("locales").getDefaultLocale();
+  const { documentId } = params;
+  const rows = await strapi.db.query(uid).findMany({
+    where: { documentId },
+    populate: { [SITE_ATTRIBUTE$1]: { select: ["id", "documentId"] } }
+  });
+  if (rows.length === 0) return;
+  const named = params.data?.[SITE_ATTRIBUTE$1];
+  if (rows.some((row) => row.locale === locale)) {
+    if (named !== void 0) await refuseMoveAwayFromOtherLocales(strapi, rows, locale, named);
+    return;
+  }
+  const sites = new Map(
+    rows.flatMap((row) => row.site ? [[row.site.documentId, row.site.id]] : [])
+  );
+  const data = params.data = params.data ?? {};
+  if (named !== void 0) {
+    if (sites.size !== 1) return;
+    const [[shared]] = [...sites];
+    for (const documentIdOfNamed of await namedSites(strapi, named)) {
+      if (documentIdOfNamed !== shared) {
+        throw new errors.ValidationError(`${SITE_ATTRIBUTE$1} must be the site of the other locales`);
+      }
+    }
+  } else if (sites.size !== 1) {
+    throw new errors.ValidationError(`${SITE_ATTRIBUTE$1} is required`);
+  }
+  data[SITE_ATTRIBUTE$1] = { connect: [{ id: [...sites.values()][0] }] };
+}
+async function refuseMoveAwayFromOtherLocales(strapi, rows, locale, named) {
+  const target = new Set(await namedSites(strapi, named));
+  const own = rows.filter((row) => row.locale === locale).flatMap((row) => row.site?.documentId ?? []);
+  if (target.size === 0 || [...target].every((site2) => own.includes(site2))) return;
+  const staysElsewhere = rows.some(
+    (row) => row.locale !== locale && row.site && !target.has(row.site.documentId)
+  );
+  if (staysElsewhere) {
+    throw new errors.ValidationError(
+      `${SITE_ATTRIBUTE$1} cannot change while other locales of the document stay on another site`
+    );
+  }
+}
+async function namedSites(strapi, value) {
+  if (typeof value === "string") return [value];
+  if (typeof value === "number") return [await documentIdOfSite(strapi, value)];
+  if (Array.isArray(value))
+    return (await Promise.all(value.map((v) => namedSites(strapi, v)))).flat();
+  if (typeof value !== "object" || value === null) return [];
+  const { documentId, id: id2, connect, set } = value;
+  if (typeof documentId === "string") return [documentId];
+  if (typeof id2 === "number") return [await documentIdOfSite(strapi, id2)];
+  return [...await namedSites(strapi, connect), ...await namedSites(strapi, set)];
+}
+async function documentIdOfSite(strapi, id2) {
+  const row = await strapi.db.query(SITE_UID$1).findOne({ where: { id: id2 } });
+  return row?.documentId ?? String(id2);
+}
+function isLocalized(strapi, uid) {
+  const model = strapi.contentType(uid);
+  const options2 = model.pluginOptions;
+  return options2?.i18n?.localized === true;
+}
+function rebuildsRelations(action, params) {
+  return action === "publish" || action === "discardDraft" || action === "update" && params.status === "published";
+}
+async function repairSiteOfLocales(strapi, uid, params) {
+  if (!isLocalized(strapi, uid)) return;
+  const query = strapi.db.query(uid);
+  const rows = await query.findMany({
+    where: {
+      documentId: params.documentId,
+      ...typeof params.locale === "string" && params.locale !== "*" ? { locale: params.locale } : {}
+    },
+    populate: { [SITE_ATTRIBUTE$1]: { select: ["id"] } }
+  });
+  for (const row of rows.filter((candidate) => !candidate.site)) {
+    const other = rows.find((candidate) => candidate.locale === row.locale && candidate.site);
+    if (other?.site) {
+      await query.update({ where: { id: row.id }, data: { [SITE_ATTRIBUTE$1]: other.site.id } });
+    }
+  }
+}
 function currentSite(strapi) {
   const state = strapi.requestContext.get()?.state;
   return state?.micelio?.site;
 }
 function siteFilter(site2) {
-  return { [SITE_ATTRIBUTE]: { documentId: { $eq: site2.documentId } } };
+  return { [SITE_ATTRIBUTE$1]: { documentId: { $eq: site2.documentId } } };
+}
+function isUnchanged(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const { connect, disconnect, ...rest } = value;
+  const isEmpty = (list2) => list2 === void 0 || Array.isArray(list2) && list2.length === 0;
+  return Object.keys(rest).length === 0 && isEmpty(connect) && isEmpty(disconnect);
 }
 function isMissing(value) {
   if (value === void 0 || value === null || value === "") return true;
   if (Array.isArray(value)) return value.length === 0;
   if (typeof value === "object") {
-    const { connect, set } = value;
+    const { connect, set, documentId, id: id2 } = value;
+    if (documentId !== void 0 || id2 !== void 0) return !(documentId || id2);
     const list2 = set ?? connect;
     return Array.isArray(list2) ? list2.length === 0 : list2 === void 0;
   }
@@ -2250,7 +2911,7 @@ function normalizeHosts(value) {
   }
   return hosts;
 }
-const SITE = SITE_UID;
+const SITE = SITE_UID$1;
 function siteRules(strapi) {
   return async (context, next) => {
     if (context.uid !== SITE) return next();
@@ -2299,6 +2960,13 @@ async function hostsOfOtherSites(strapi, documentId) {
 }
 const register = ({ strapi }) => {
   registerComponents(strapi);
+  registerPreviewShortcut(strapi);
+  strapi.hook("strapi::content-types.beforeSync").register(async () => {
+    const report = await renameLegacyUids(strapi);
+    if (report.actions + report.subjects + report.layouts > 0) {
+      strapi.log.info(`[micelio] moved legacy category and tag UIDs: ${JSON.stringify(report)}`);
+    }
+  });
   strapi.documents.use(siteCreatedHook(strapi));
   strapi.documents.use(siteRules(strapi));
   strapi.documents.use(siteSectionInstances(strapi));
@@ -2375,14 +3043,32 @@ const contentApiRoutes = () => ({
     }
   ]
 });
-const siteRoutes = factories.createCoreRouter(SITE_UID, {
+const siteRoutes = factories.createCoreRouter(SITE_UID$1, {
   prefix: "/micelio",
   only: ["find", "findOne"]
 });
+const scoped = () => ({ middlewares: [SITE_SCOPE_MIDDLEWARE] });
+const config = () => ({
+  find: scoped(),
+  findOne: scoped(),
+  create: scoped(),
+  update: scoped(),
+  delete: scoped()
+});
+const categoryRoutes = factories.createCoreRouter(CATEGORY_UID, {
+  prefix: "",
+  config: config()
+});
+const tagRoutes = factories.createCoreRouter(TAG_UID, {
+  prefix: "",
+  config: config()
+});
 const routes = {
   "content-api": contentApiRoutes,
   admin: adminRoutes,
-  site: siteRoutes
+  site: siteRoutes,
+  category: categoryRoutes,
+  tag: tagRoutes
 };
 const extensions = ({ strapi }) => createExtensionRegistry(strapi);
 const hooks = ({ strapi }) => createHookRegistry(strapi.log);
@@ -2625,7 +3311,7 @@ function asList(value) {
 function exportedTypes(strapi, personal) {
   const types = [];
   for (const [uid, schema] of Object.entries(strapi.contentTypes)) {
-    if (uid !== SITE_UID && !isSiteScoped(schema)) continue;
+    if (uid !== SITE_UID$1 && !isSiteScoped(schema)) continue;
     if (!isWritten(exportPolicyOf(schema), personal)) continue;
     types.push({
       uid,
@@ -2641,20 +3327,20 @@ async function siteRowsOf(strapi, type, site2, context) {
   const query = strapi.db.query(type.uid);
   const owned = await query.findMany({
     select: ["documentId"],
-    where: { [SITE_ATTRIBUTE]: { documentId: site2.documentId } }
+    where: { [SITE_ATTRIBUTE$1]: { documentId: site2.documentId } }
   });
   const documentIds = [...new Set(owned.map((row) => row.documentId))];
   if (documentIds.length === 0) return [];
   return await query.findMany({
     where: { documentId: { $in: documentIds } },
-    populate: populateOf(type.attributes, context, /* @__PURE__ */ new Set([SITE_ATTRIBUTE]))
+    populate: populateOf(type.attributes, context, /* @__PURE__ */ new Set([SITE_ATTRIBUTE$1]))
   });
 }
 function attributesOf(strapi, uid) {
   return strapi.contentType(uid).attributes;
 }
 function documentsOf(type, rows, context) {
-  const skip = new Set(type.uid === SITE_UID ? [] : [SITE_ATTRIBUTE]);
+  const skip = new Set(type.uid === SITE_UID$1 ? [] : [SITE_ATTRIBUTE$1]);
   const documents = /* @__PURE__ */ new Map();
   for (const row of rows) {
     const version2 = {
@@ -2864,15 +3550,15 @@ async function exportSite(strapi, request, output) {
     },
     personal
   };
-  const siteRows = await strapi.db.query(SITE_UID).findMany({
+  const siteRows = await strapi.db.query(SITE_UID$1).findMany({
     where: { slug: request.site },
-    populate: populateOf(attributesOf(strapi, SITE_UID), context)
+    populate: populateOf(attributesOf(strapi, SITE_UID$1), context)
   });
   const site2 = siteRows[0];
   if (!site2) throw new ExportError("exportSiteNotFound", `There is no site "${request.site}"`);
   const contents = [];
   for (const type of types) {
-    const rows = type.uid === SITE_UID ? siteRows : await siteRowsOf(strapi, type, site2, context);
+    const rows = type.uid === SITE_UID$1 ? siteRows : await siteRowsOf(strapi, type, site2, context);
     contents.push({ type: type.name, documents: documentsOf(type, rows, context) });
   }
   const index2 = await mediaIndex(strapi, media2);
@@ -3408,7 +4094,7 @@ function all(types, strapi) {
 async function targetSite(strapi, staged, request) {
   const archived = staged.contents.get("site").documents[0];
   const data = archived.versions[0].data;
-  const rows = await strapi.db.query(SITE_UID).findMany({
+  const rows = await strapi.db.query(SITE_UID$1).findMany({
     select: ["documentId", "slug", "hosts", "isDefault"]
   });
   const sites = [...new Map(rows.map((row) => [row.documentId, row])).values()];
@@ -3702,7 +4388,7 @@ async function writeContent(strapi, plan2, files, request, report) {
   const context = deserialiseContext(strapi, plan2, files, written);
   const shaOf = new Map([...files.entries()].map(([sha256, id2]) => [id2, sha256]));
   const ordered = [...plan2.types].sort(
-    (a, b) => a.uid === SITE_UID ? -1 : b.uid === SITE_UID ? 1 : compare(a.name, b.name)
+    (a, b) => a.uid === SITE_UID$1 ? -1 : b.uid === SITE_UID$1 ? 1 : compare(a.name, b.name)
   );
   const pending = [];
   for (const type of ordered) {
@@ -3718,7 +4404,7 @@ async function writeContent(strapi, plan2, files, request, report) {
   }
   if (request.mode === "replace") {
     for (const type of ordered) {
-      if (type.uid === SITE_UID) continue;
+      if (type.uid === SITE_UID$1) continue;
       const kept = new Set(plan2.staged.contents.get(type.name).documents.map((d) => d.documentId));
       const rows = await siteRowsOf(strapi, type, plan2.site, serialiseContext(strapi, plan2, shaOf));
       for (const documentId of new Set(rows.map((row) => row.documentId))) {
@@ -3730,9 +4416,9 @@ async function writeContent(strapi, plan2, files, request, report) {
   }
 }
 async function writeDocument(strapi, plan2, type, document, context, shaOf) {
-  const isSite = type.uid === SITE_UID;
+  const isSite = type.uid === SITE_UID$1;
   const documentId = isSite ? plan2.site.documentId : document.documentId;
-  const skip = new Set(isSite ? [] : [SITE_ATTRIBUTE]);
+  const skip = new Set(isSite ? [] : [SITE_ATTRIBUTE$1]);
   const query = strapi.db.query(type.uid);
   const rows = await query.findMany({
     where: { documentId },
@@ -3755,7 +4441,7 @@ async function writeDocument(strapi, plan2, type, document, context, shaOf) {
     pending ||= result.pending > 0;
     const data = { ...result.data };
     if (!exists) {
-      if (!isSite) data[SITE_ATTRIBUTE] = plan2.site.documentId;
+      if (!isSite) data[SITE_ATTRIBUTE$1] = plan2.site.documentId;
       await documents.create({ locale, data: { ...data, documentId } });
       exists = true;
     } else {
@@ -3808,7 +4494,7 @@ async function writeDocument(strapi, plan2, type, document, context, shaOf) {
 }
 function desiredData(type, version2, plan2, rows) {
   const data = knownData(type.attributes, version2.data);
-  if (type.uid === SITE_UID) {
+  if (type.uid === SITE_UID$1) {
     data.isDefault = rows[0]?.isDefault === true;
     if (!plan2.site.isNew) data.slug = plan2.site.slug;
   }
@@ -3817,7 +4503,7 @@ function desiredData(type, version2, plan2, rows) {
 async function checkOwner(strapi, type, documentId, site2) {
   const rows = await strapi.db.query(type.uid).findMany({
     where: { documentId },
-    populate: { [SITE_ATTRIBUTE]: { select: ["documentId"] } }
+    populate: { [SITE_ATTRIBUTE$1]: { select: ["documentId"] } }
   });
   if (rows.some((row) => row.site?.documentId && row.site.documentId !== site2)) {
     throw new ExportError(
@@ -3895,7 +4581,9 @@ const transitions = ({ strapi }) => ({
   }
 });
 const services = {
-  site: factories.createCoreService(SITE_UID),
+  site: factories.createCoreService(SITE_UID$1),
+  category: factories.createCoreService(CATEGORY_UID),
+  tag: factories.createCoreService(TAG_UID),
   transitions,
   hostCheck,
   hooks,
@@ -3908,7 +4596,7 @@ const index = {
   register,
   bootstrap,
   destroy,
-  config,
+  config: config$1,
   controllers,
   routes,
   services,
@@ -3917,10 +4605,13 @@ const index = {
   middlewares
 };
 export {
+  CATEGORY_UID,
   EDITORIAL_STATES,
-  SITE_ATTRIBUTE,
+  READ_ACTIONS$1 as READ_ACTIONS,
+  SITE_ATTRIBUTE$1 as SITE_ATTRIBUTE,
   SITE_SCOPE_MIDDLEWARE,
-  SITE_UID,
+  SITE_UID$1 as SITE_UID,
+  TAG_UID,
   index as default,
   formatHostCheckReport,
   missingLocales,