@phtngyn/cms 0.1.0-beta.4 → 0.2.0-beta.1

package/src/{installation-CNfIriVm.js → installation-DsGst1BH.js}

@@ -1,42 +1,548 @@
 import { a as EditorNodeId, c as RevisionId, d as SourcePath, i as DocumentVersion, r as DocumentId, t as DocumentGeneration } from "./scalars-B2lgGUnj.js";
-import { i as FormResult, n as FORM_SUBMISSION_MAX_BYTES } from "./Forms-CfcI3tPU.js";
-import { a as encodeCmsEditorComponentAttributes, d as createCmsComarkRenderData, i as validateFormValues, t as documentForms } from "./Forms-Dj6NuW66.js";
-import { $ as StudioActor, A as UnpublishDocumentInput, B as SeoMediaUnavailable, D as RemoveDocumentInput, Et as RequestId, H as SeoRevision, J as AccessDenied, K as SeoVersionConflict, O as RestoreDocumentInput, Q as Role, S as PublishDocumentInput, Y as AuthenticationRequired, _t as MediaReference, a as DOCUMENT_REVISION_ACTIONS, at as MediaCleanupReport, b as MarkdownNode, bt as MediaTooLarge, ct as MediaFolder, dt as MediaInvalid, et as StudioEntryDenied, ft as MediaName, ht as MediaPage, it as MediaByteSize, j as UpdateDocumentInput, k as UndeleteDocumentInput, l as DocumentMutationResult, lt as MediaId, m as DocumentSource, mt as MediaObjectKey, n as CmsMarkdownDocument, nt as ImageMimeType, o as DeletedDocument, ot as MediaConflict, p as DocumentRevisionAction, pt as MediaNotFound, rt as MediaAsset, st as MediaCursor, tt as StudioRequestContext, ut as MediaIntegrityReport, vt as MediaReferenced, x as MoveDocumentInput, xt as MediaUpload, y as DuplicateDocumentInput, yt as MediaStatus, z as SeoConfirmationRequired } from "./models-Bah5B3bT.js";
-import { $ as DocumentRevision, A as StudioBadRequest, B as User, C as DocumentStore, D as CurrentStudioRequest, E as defaultAccessControlLayer, F as studioInternalError, G as UserSelfRemovalDenied, H as UserAlreadyExists, I as InitializationAlreadyCompleted, J as CollaborationServerMessage, K as UserSelfRoleChangeDenied, L as InitializationProofInvalid, M as StudioRequestConflict, N as StudioSchemaError, O as StudioApi, P as StudioInternalError, Q as DocumentHistoryInvalidCursor, R as InitializationState, S as DocumentPersistenceError, T as AccessControl, U as UserNotFound, V as UserAdministrationDenied, W as UserPage, X as StateVector, Y as CollaborationTicket, Z as DocumentHistoryComparisonTooLarge, _ as Documents, a as mediaObjectPrefix, at as ActivityEntry, b as cursorCodec, c as Seo, ct as ActivityPage, d as seoDeliveryLayer, dt as DocumentMediaUnavailable, et as ACTIVITY_ACTIONS, f as seoLayer, ft as DocumentNotFound, g as DocumentPreviews, gt as PublishedDocumentNotFound, h as DocumentMaintenance, ht as DocumentVersionConflict, i as MediaObjectStore, it as ActivityCursorInvalid, k as StudioAuthentication, l as SeoDelivery, lt as ActivityTarget, m as SeoStore, mt as DocumentValidationFailed, n as s3MediaObjectStoreLayer, nt as ActivityContext, o as PreviewSeo, ot as ActivityEntryDraft, p as SeoPersistenceError, pt as DocumentPathConflict, q as CollaborationClientMessage, r as MediaPersistenceError, rt as ActivityCursor, s as PublishedSeo, st as ActivityId, tt as ActivityAction, u as makeDefaultSeoOptions, ut as ActivityTargetKind, v as PublishedDocuments, w as renderEditorMarkdown, x as DocumentGenerationConflict, y as documentsLayer, z as CreateUserInput } from "./S3MediaObjects-CpPSzJto.js";
+import { $ as StudioActor, A as UnpublishDocumentInput, B as SeoMediaUnavailable, D as RemoveDocumentInput, Et as RequestId, H as SeoRevision, J as AccessDenied, K as SeoVersionConflict, O as RestoreDocumentInput, Q as Role, S as PublishDocumentInput, Y as AuthenticationRequired, _t as MediaReference, a as DOCUMENT_REVISION_ACTIONS, at as MediaCleanupReport, b as MarkdownNode, bt as MediaTooLarge, ct as MediaFolder, dt as MediaInvalid, et as StudioEntryDenied, ft as MediaName, ht as MediaPage, it as MediaByteSize, j as UpdateDocumentInput, k as UndeleteDocumentInput, l as DocumentMutationResult, lt as MediaId, m as DocumentSource, mt as MediaObjectKey, n as CmsMarkdownDocument, nt as ImageMimeType, o as DeletedDocument, ot as MediaConflict, p as DocumentRevisionAction, pt as MediaNotFound, rt as MediaAsset, st as MediaCursor, tt as StudioRequestContext, ut as MediaIntegrityReport, vt as MediaReferenced, x as MoveDocumentInput, xt as MediaUpload, y as DuplicateDocumentInput, yt as MediaStatus, z as SeoConfirmationRequired } from "./models-DgkGTFus.js";
+import { $ as DocumentRevision, A as StudioBadRequest, B as User, C as DocumentStore, D as CurrentStudioRequest, E as defaultAccessControlLayer, F as studioInternalError, G as UserSelfRemovalDenied, H as UserAlreadyExists, I as InitializationAlreadyCompleted, J as CollaborationServerMessage, K as UserSelfRoleChangeDenied, L as InitializationProofInvalid, M as StudioRequestConflict, N as StudioSchemaError, O as StudioApi, P as StudioInternalError, Q as DocumentHistoryInvalidCursor, R as InitializationState, S as DocumentPersistenceError, T as AccessControl, U as UserNotFound, V as UserAdministrationDenied, W as UserPage, X as StateVector, Y as CollaborationTicket, Z as DocumentHistoryComparisonTooLarge, _ as Documents, a as mediaObjectPrefix, at as ActivityEntry, b as cursorCodec, c as Seo, ct as ActivityPage, d as seoDeliveryLayer, dt as DocumentMediaUnavailable, et as ACTIVITY_ACTIONS, f as seoLayer, ft as DocumentNotFound, g as DocumentPreviews, gt as PublishedDocumentNotFound, h as DocumentMaintenance, ht as DocumentVersionConflict, i as MediaObjectStore, it as ActivityCursorInvalid, k as StudioAuthentication, l as SeoDelivery, lt as ActivityTarget, m as SeoStore, mt as DocumentValidationFailed, n as s3MediaObjectStoreLayer, nt as ActivityContext, o as PreviewSeo, ot as ActivityEntryDraft, p as SeoPersistenceError, pt as DocumentPathConflict, q as CollaborationClientMessage, r as MediaPersistenceError, rt as ActivityCursor, s as PublishedSeo, st as ActivityId, tt as ActivityAction, u as makeDefaultSeoOptions, ut as ActivityTargetKind, v as PublishedDocuments, w as renderEditorMarkdown, x as DocumentGenerationConflict, y as documentsLayer, z as CreateUserInput } from "./S3MediaObjects-DC0c8sYC.js";
+import { o as ContentTransferConflict } from "./ContentTransfer-CTzGGKFV.js";
 import { a as CMS_FORM_SUBMIT_PATH, l as CMS_READINESS_PATH, o as CMS_LIVENESS_PATH, p as STUDIO_COLLABORATION_PATH, t as CMS_AUTHENTICATION_PATH, u as STUDIO_API_PATH } from "./HttpPaths-c9nLZ9H2.js";
+import { i as FormResult, n as FORM_SUBMISSION_MAX_BYTES } from "./Forms-CfcI3tPU.js";
+import { a as encodeCmsEditorComponentAttributes, d as createCmsComarkRenderData, i as validateFormValues, t as documentForms } from "./Forms-02-p8qEw.js";
 import { a as createEditorNodeId, o as editorNodeId, r as identifiedAttributes, t as assertCanonicalEditorContent } from "./metadata-BEZPWh-3.js";
-import { C as finiteNumberAttribute, S as compactJsonAttributes, _ as comarkTagForEditorMark, b as encodeEditorImageAttributes, g as EDITOR_MARK_TYPES, h as comarkToEditor, u as EditorDocumentInvalid, v as isEditorMark, w as nonEmptyStringAttribute, x as normalizeEditorImageLayout, y as EDITOR_IMAGE_LAYOUT_ATTRIBUTE } from "./Configuration-CDMYfTre.js";
-import { o as ContentTransferConflict } from "./ContentTransfer-C3Av9sWz.js";
+import { C as finiteNumberAttribute, S as compactJsonAttributes, _ as comarkTagForEditorMark, b as encodeEditorImageAttributes, g as EDITOR_MARK_TYPES, h as comarkToEditor, u as EditorDocumentInvalid, v as isEditorMark, w as nonEmptyStringAttribute, x as normalizeEditorImageLayout, y as EDITOR_IMAGE_LAYOUT_ATTRIBUTE } from "./Configuration-CjVUBBwa.js";
 import { Cause, Clock, Context, Crypto, Data, DateTime, Deferred, Effect, Encoding, Exit, Fiber, Layer, Option, Predicate, PubSub, Pull, Queue, Redacted, Ref, Result, Schedule, Schema, Scope, Semaphore, Stream, flow } from "effect";
 import { Extension, Node, getSchema, mergeAttributes } from "@tiptap/core";
 import { prosemirrorJSONToYDoc, ySyncPluginKey, yXmlFragmentToProseMirrorRootNode } from "@tiptap/y-tiptap";
 import { FindMyWay, HttpEffect, HttpMiddleware, HttpRouter, HttpServer, HttpServerRequest, HttpServerResponse, Multipart } from "effect/unstable/http";
 import { HttpApiBuilder, HttpApiMiddleware } from "effect/unstable/httpapi";
-import * as NodeCrypto from "@effect/platform-node-shared/NodeCrypto";
-import { createAuthMiddleware, getSessionFromCtx, isAPIError } from "better-auth/api";
+import { Pool } from "pg";
+import { PgClient, PgPool } from "@effect/sql-pg";
+import * as PgDrizzle from "drizzle-orm/effect-postgres";
+import { migrate } from "drizzle-orm/pg-core/effect/session";
+import { and, asc, count, desc, eq, gt, inArray, lt, lte, ne, or, sql } from "drizzle-orm";
+import { alias, bigint, boolean, bytea, check, foreignKey, index, integer, jsonb, pgTable, primaryKey, text, timestamp, unique, uniqueIndex, uuid } from "drizzle-orm/pg-core";
+import * as Client from "effect/unstable/sql/SqlClient";
+import * as Statement from "effect/unstable/sql/Statement";
 import { betterAuth } from "better-auth";
 import { createAccessControl } from "better-auth/plugins/access";
 import { admin } from "better-auth/plugins/admin";
 import { defaultStatements } from "better-auth/plugins/admin/access";
+import * as NodeCrypto from "@effect/platform-node-shared/NodeCrypto";
+import { createAuthMiddleware, getSessionFromCtx, isAPIError } from "better-auth/api";
 import { Hocuspocus, IncomingMessage, MessageType, shouldSkipStoreHooks } from "@hocuspocus/server";
 import StarterKit from "@tiptap/starter-kit";
 import * as Y from "yjs";
 import { Doc, applyUpdate, encodeStateAsUpdate, encodeStateVector } from "yjs";
 import { RateLimiter } from "effect/unstable/persistence";
-import { PgClient } from "@effect/sql-pg";
 import { isDeepStrictEqual } from "node:util";
-import { and, asc, count, desc, eq, gt, inArray, lt, lte, ne, or, sql } from "drizzle-orm";
-import * as PgDrizzle from "drizzle-orm/effect-postgres";
 import { createInsertSchema, createSelectSchema } from "drizzle-orm/effect-schema";
-import { alias, bigint, boolean, bytea, check, foreignKey, index, integer, jsonb, pgTable, primaryKey, text, timestamp, unique, uniqueIndex, uuid } from "drizzle-orm/pg-core";
-import { migrate } from "drizzle-orm/pg-core/effect/session";
 import { EffectDrizzleQueryError } from "drizzle-orm/effect-core";
 import * as Cause$1 from "effect/Cause";
 import * as Option$1 from "effect/Option";
 import * as SqlError from "effect/unstable/sql/SqlError";
 import { Buffer } from "node:buffer";
-import { Pool } from "pg";
 
+//#region ../sql-pg/src/internal/database/embedded-migrations.generated.ts
+const embeddedMigrations = [
+	{
+		sql: [
+			"CREATE TABLE \"activity_entries\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"action\" text NOT NULL,\n	\"actor_id\" text NOT NULL,\n	\"actor_email\" text NOT NULL,\n	\"actor_name\" text NOT NULL,\n	\"actor_roles\" jsonb NOT NULL,\n	\"request_id\" uuid NOT NULL,\n	\"reason\" text,\n	\"target_kind\" text NOT NULL,\n	\"target_id\" text,\n	\"details\" jsonb DEFAULT '{}' NOT NULL,\n	\"occurred_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"activity_entries_action_check\" CHECK (\"action\" in ('document.created', 'document.updated', 'document.moved', 'document.trashed', 'document.revision.restored', 'document.untrashed', 'document.published', 'media.uploaded', 'media.replaced', 'media.removed', 'media.cleaned', 'user.created', 'user.removed', 'user.role.changed', 'user.sessions.revoked', 'authentication.signed-in', 'authentication.signed-out', 'authentication.password.changed', 'authentication.password.reset')),\n	CONSTRAINT \"activity_entries_target_kind_check\" CHECK (\"target_kind\" in ('document', 'media', 'media-library', 'user')),\n	CONSTRAINT \"activity_entries_target_check\" CHECK ((\"target_kind\" = 'media-library' AND \"target_id\" IS NULL)\n        OR (\"target_kind\" <> 'media-library' AND \"target_id\" IS NOT NULL)),\n	CONSTRAINT \"activity_entries_actor_roles_check\" CHECK (jsonb_typeof(\"actor_roles\") = 'array'),\n	CONSTRAINT \"activity_entries_details_check\" CHECK (jsonb_typeof(\"details\") = 'object')\n);\n",
+			"\nCREATE TABLE \"auth_accounts\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"issuer\" text NOT NULL,\n	\"account_id\" text NOT NULL,\n	\"provider_id\" text NOT NULL,\n	\"user_id\" uuid NOT NULL,\n	\"access_token\" text,\n	\"refresh_token\" text,\n	\"id_token\" text,\n	\"access_token_expires_at\" timestamp with time zone,\n	\"refresh_token_expires_at\" timestamp with time zone,\n	\"scope\" text,\n	\"password\" text,\n	\"created_at\" timestamp with time zone DEFAULT now() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT now() NOT NULL\n);\n",
+			"\nCREATE TABLE \"auth_rate_limits\" (\n	\"key\" text PRIMARY KEY,\n	\"count\" bigint NOT NULL,\n	\"last_request\" bigint NOT NULL\n);\n",
+			"\nCREATE TABLE \"auth_sessions\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"expires_at\" timestamp with time zone NOT NULL,\n	\"token\" text NOT NULL UNIQUE,\n	\"created_at\" timestamp with time zone DEFAULT now() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT now() NOT NULL,\n	\"ip_address\" text,\n	\"user_agent\" text,\n	\"user_id\" uuid NOT NULL,\n	\"impersonated_by\" text\n);\n",
+			"\nCREATE TABLE \"auth_users\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"name\" text NOT NULL,\n	\"email\" text NOT NULL UNIQUE,\n	\"email_verified\" boolean DEFAULT false NOT NULL,\n	\"image\" text,\n	\"created_at\" timestamp with time zone DEFAULT now() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT now() NOT NULL,\n	\"role\" text DEFAULT 'editor' NOT NULL,\n	\"banned\" boolean DEFAULT false NOT NULL,\n	\"ban_reason\" text,\n	\"ban_expires\" timestamp with time zone,\n	\"cms_creation_change_id\" uuid UNIQUE,\n	\"cms_sessions_revoked_change_id\" uuid UNIQUE,\n	CONSTRAINT \"auth_users_role_check\" CHECK (\"role\" in ('administrator', 'editor', 'viewer'))\n);\n",
+			"\nCREATE TABLE \"auth_verifications\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"identifier\" text NOT NULL,\n	\"value\" text NOT NULL,\n	\"expires_at\" timestamp with time zone NOT NULL,\n	\"created_at\" timestamp with time zone DEFAULT now() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT now() NOT NULL\n);\n",
+			"\nCREATE TABLE \"change_receipts\" (\n	\"change_id\" uuid PRIMARY KEY,\n	\"fingerprint\" text NOT NULL,\n	\"outcome\" text NOT NULL,\n	\"activity_id\" uuid UNIQUE,\n	\"completed_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"change_receipts_outcome_check\" CHECK ((\"outcome\" = 'applied' AND \"activity_id\" IS NOT NULL)\n      OR (\"outcome\" = 'cancelled' AND \"activity_id\" IS NULL))\n);\n",
+			"\nCREATE TABLE \"cms_state\" (\n	\"singleton\" boolean PRIMARY KEY DEFAULT true,\n	\"generation\" bigint DEFAULT 0 NOT NULL,\n	CONSTRAINT \"cms_state_singleton_check\" CHECK (\"singleton\"),\n	CONSTRAINT \"cms_state_generation_check\" CHECK (\"generation\" >= 0)\n);\n",
+			"\nCREATE TABLE \"document_heads\" (\n	\"document_id\" uuid PRIMARY KEY,\n	\"authored_revision_id\" uuid NOT NULL,\n	\"published_revision_id\" uuid\n);\n",
+			"\nCREATE TABLE \"document_media_references\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"document_id\" uuid NOT NULL,\n	\"object_key\" text NOT NULL,\n	\"path\" text NOT NULL,\n	\"source_path\" text NOT NULL,\n	\"node_path\" integer[] NOT NULL,\n	CONSTRAINT \"document_media_references_identity_unique\" UNIQUE(\"document_id\",\"source_path\",\"node_path\",\"object_key\"),\n	CONSTRAINT \"document_media_references_object_key_check\" CHECK (char_length(\"object_key\") between 1 and 1024\n        AND btrim(\"object_key\") = \"object_key\"\n        AND \"object_key\" !~ '(^/|/$|//|(^|/)\\.{1,2}(/|$)|[[:cntrl:]])'\n        AND position(chr(92) in \"object_key\") = 0),\n	CONSTRAINT \"document_media_references_node_path_check\" CHECK (array_position(\"node_path\", NULL) IS NULL AND 0 <= ALL(\"node_path\"))\n);\n",
+			"\nCREATE TABLE \"document_revisions\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"document_id\" uuid NOT NULL,\n	\"action\" text NOT NULL,\n	\"source_path\" text NOT NULL,\n	\"markdown\" text NOT NULL,\n	\"actor_id\" text NOT NULL,\n	\"actor_email\" text NOT NULL,\n	\"actor_name\" text NOT NULL,\n	\"actor_roles\" jsonb NOT NULL,\n	\"request_id\" uuid NOT NULL,\n	\"reason\" text,\n	\"activity_details\" jsonb DEFAULT '{}' NOT NULL,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"document_revisions_document_id_unique\" UNIQUE(\"document_id\",\"id\"),\n	CONSTRAINT \"document_revisions_action_check\" CHECK (\"action\" in ('document.create', 'document.move', 'document.remove', 'document.restore', 'document.undelete', 'document.update'))\n);\n",
+			"\nCREATE TABLE \"documents\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"source_path\" text NOT NULL,\n	\"deleted_at\" timestamp with time zone,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL\n);\n",
+			"\nCREATE TABLE \"initialization_state\" (\n	\"singleton\" boolean PRIMARY KEY DEFAULT true,\n	\"state\" text DEFAULT 'uninitialized' NOT NULL,\n	\"change_id\" uuid,\n	\"claim\" jsonb,\n	CONSTRAINT \"initialization_state_singleton_check\" CHECK (\"singleton\"),\n	CONSTRAINT \"initialization_state_state_check\" CHECK (\"state\" in ('uninitialized', 'claiming', 'ready')),\n	CONSTRAINT \"initialization_state_claim_check\" CHECK ((\"state\" = 'claiming' AND \"change_id\" IS NOT NULL AND jsonb_typeof(\"claim\") = 'object')\n        OR (\"state\" <> 'claiming' AND \"change_id\" IS NULL AND \"claim\" IS NULL))\n);\n",
+			"\nCREATE TABLE \"media_assets\" (\n	\"id\" uuid PRIMARY KEY,\n	\"object_key\" text NOT NULL UNIQUE,\n	\"name\" text NOT NULL,\n	\"folder\" text DEFAULT '' NOT NULL,\n	\"mime_type\" text NOT NULL,\n	\"byte_size\" bigint NOT NULL,\n	\"status\" text DEFAULT 'uploading' NOT NULL,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"media_assets_byte_size_check\" CHECK (\"byte_size\" > 0 AND \"byte_size\" <= 9007199254740991),\n	CONSTRAINT \"media_assets_mime_type_check\" CHECK (\"mime_type\" in ('image/avif', 'image/gif', 'image/jpeg', 'image/png', 'image/webp')),\n	CONSTRAINT \"media_assets_status_check\" CHECK (\"status\" in ('uploading', 'ready', 'deleting')),\n	CONSTRAINT \"media_assets_name_check\" CHECK (char_length(\"name\") between 1 and 255\n    AND btrim(\"name\") = \"name\"\n    AND \"name\" not in ('.', '..')\n    AND \"name\" !~ '[[:cntrl:]/]'\n    AND position(chr(92) in \"name\") = 0),\n	CONSTRAINT \"media_assets_folder_check\" CHECK (char_length(\"folder\") <= 512\n    AND btrim(\"folder\") = \"folder\"\n    AND \"folder\" !~ '(^/|/$|//|(^|/)\\.{1,2}(/|$)|[[:cntrl:]])'\n    AND position(chr(92) in \"folder\") = 0),\n	CONSTRAINT \"media_assets_object_key_check\" CHECK (\"object_key\" ~ '^media/[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\\.(avif|gif|jpg|png|webp)$')\n);\n",
+			"\nCREATE TABLE \"media_replacements\" (\n	\"media_id\" uuid PRIMARY KEY,\n	\"object_key\" text NOT NULL,\n	\"staging_object_key\" text NOT NULL UNIQUE,\n	\"name\" text NOT NULL,\n	\"folder\" text NOT NULL,\n	\"mime_type\" text NOT NULL,\n	\"byte_size\" bigint NOT NULL,\n	\"staged\" boolean DEFAULT false NOT NULL,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"media_replacements_byte_size_check\" CHECK (\"byte_size\" > 0 AND \"byte_size\" <= 9007199254740991),\n	CONSTRAINT \"media_replacements_mime_type_check\" CHECK (\"mime_type\" in ('image/avif', 'image/gif', 'image/jpeg', 'image/png', 'image/webp')),\n	CONSTRAINT \"media_replacements_name_check\" CHECK (char_length(\"name\") between 1 and 255\n    AND btrim(\"name\") = \"name\"\n    AND \"name\" not in ('.', '..')\n    AND \"name\" !~ '[[:cntrl:]/]'\n    AND position(chr(92) in \"name\") = 0),\n	CONSTRAINT \"media_replacements_folder_check\" CHECK (char_length(\"folder\") <= 512\n    AND btrim(\"folder\") = \"folder\"\n    AND \"folder\" !~ '(^/|/$|//|(^|/)\\.{1,2}(/|$)|[[:cntrl:]])'\n    AND position(chr(92) in \"folder\") = 0),\n	CONSTRAINT \"media_replacements_object_key_check\" CHECK (\"object_key\" ~ '^media/[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\\.(avif|gif|jpg|png|webp)$'),\n	CONSTRAINT \"media_replacements_staging_object_key_check\" CHECK (\"staging_object_key\" ~ '^media/replacements/[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\\.(avif|gif|jpg|png|webp)$'),\n	CONSTRAINT \"media_replacements_distinct_object_keys_check\" CHECK (\"staging_object_key\" <> \"object_key\")\n);\n",
+			"\nCREATE TABLE \"pending_changes\" (\n	\"id\" uuid PRIMARY KEY,\n	\"action\" text NOT NULL,\n	\"subject\" text NOT NULL,\n	\"scope\" text NOT NULL,\n	\"actor_id\" text NOT NULL,\n	\"actor_email\" text NOT NULL,\n	\"actor_name\" text NOT NULL,\n	\"actor_roles\" jsonb NOT NULL,\n	\"request_id\" uuid NOT NULL,\n	\"reason\" text,\n	\"target_kind\" text,\n	\"target_id\" text,\n	\"intent\" jsonb NOT NULL,\n	\"fingerprint\" text NOT NULL,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"pending_changes_action_check\" CHECK (\"action\" in ('document.created', 'document.updated', 'document.moved', 'document.trashed', 'document.revision.restored', 'document.untrashed', 'document.published', 'media.uploaded', 'media.replaced', 'media.removed', 'media.cleaned', 'user.created', 'user.removed', 'user.role.changed', 'user.sessions.revoked', 'authentication.signed-in', 'authentication.signed-out', 'authentication.password.changed', 'authentication.password.reset')),\n	CONSTRAINT \"pending_changes_scope_check\" CHECK (\"scope\" in ('initialization', 'media', 'users')),\n	CONSTRAINT \"pending_changes_subject_check\" CHECK (char_length(\"subject\") between 1 and 1024 AND btrim(\"subject\") = \"subject\"),\n	CONSTRAINT \"pending_changes_actor_roles_check\" CHECK (jsonb_typeof(\"actor_roles\") = 'array'),\n	CONSTRAINT \"pending_changes_intent_check\" CHECK (jsonb_typeof(\"intent\") = 'object'),\n	CONSTRAINT \"pending_changes_target_check\" CHECK ((\"target_kind\" IS NULL AND \"target_id\" IS NULL)\n        OR (\"target_kind\" = 'media-library' AND \"target_id\" IS NULL)\n        OR (\"target_kind\" in ('document', 'media', 'user')\n          AND \"target_id\" IS NOT NULL))\n);\n",
+			"\nCREATE TABLE \"working_document_publish_attempts\" (\n	\"id\" uuid PRIMARY KEY,\n	\"activity\" jsonb NOT NULL,\n	\"document_id\" uuid NOT NULL,\n	\"expected_generation\" uuid NOT NULL,\n	\"expected_version\" uuid NOT NULL,\n	\"high_watermark\" bigint NOT NULL,\n	\"markdown_hash\" text NOT NULL,\n	\"state\" bytea NOT NULL,\n	\"state_vector\" bytea NOT NULL,\n	\"checkpoint_version\" uuid,\n	\"phase\" text DEFAULT 'pending' NOT NULL,\n	\"failure\" text,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"working_document_publish_attempts_phase_check\" CHECK (\"phase\" in ('pending', 'checkpointed', 'published', 'failed')),\n	CONSTRAINT \"working_document_publish_attempts_high_watermark_check\" CHECK (\"high_watermark\" between 0 and 9007199254740991),\n	CONSTRAINT \"working_document_publish_attempts_markdown_hash_check\" CHECK (char_length(\"markdown_hash\") between 1 and 128),\n	CONSTRAINT \"working_document_publish_attempts_state_check\" CHECK (octet_length(\"state\") > 0),\n	CONSTRAINT \"working_document_publish_attempts_state_vector_check\" CHECK (octet_length(\"state_vector\") > 0),\n	CONSTRAINT \"working_document_publish_attempts_payload_check\" CHECK ((\n          \"phase\" = 'pending'\n          AND \"checkpoint_version\" IS NULL\n          AND \"failure\" IS NULL\n        ) OR (\n          \"phase\" in ('checkpointed', 'published')\n          AND \"checkpoint_version\" IS NOT NULL\n          AND \"failure\" IS NULL\n        ) OR (\n          \"phase\" = 'failed'\n          AND \"checkpoint_version\" IS NULL\n          AND char_length(\"failure\") between 1 and 128\n        ))\n);\n",
+			"\nCREATE TABLE \"working_document_updates\" (\n	\"document_id\" uuid,\n	\"generation_id\" uuid NOT NULL,\n	\"sequence\" bigint,\n	\"update\" bytea NOT NULL,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"working_document_updates_pkey\" PRIMARY KEY(\"document_id\",\"sequence\"),\n	CONSTRAINT \"working_document_updates_sequence_check\" CHECK (\"sequence\" between 1 and 9007199254740991),\n	CONSTRAINT \"working_document_updates_update_check\" CHECK (octet_length(\"update\") > 0)\n);\n",
+			"\nCREATE TABLE \"working_documents\" (\n	\"document_id\" uuid PRIMARY KEY,\n	\"format_version\" integer NOT NULL,\n	\"generation_id\" uuid NOT NULL,\n	\"state\" bytea NOT NULL,\n	\"saved_state_vector\" bytea NOT NULL,\n	\"saved_version\" uuid NOT NULL,\n	\"next_update_sequence\" bigint DEFAULT 1 NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"working_documents_generation_unique\" UNIQUE(\"document_id\",\"generation_id\"),\n	CONSTRAINT \"working_documents_format_version_check\" CHECK (\"format_version\" = 1),\n	CONSTRAINT \"working_documents_state_check\" CHECK (octet_length(\"state\") > 0),\n	CONSTRAINT \"working_documents_saved_state_vector_check\" CHECK (octet_length(\"saved_state_vector\") > 0),\n	CONSTRAINT \"working_documents_next_update_sequence_check\" CHECK (\"next_update_sequence\" between 1 and 9007199254740991)\n);\n",
+			"\nCREATE INDEX \"activity_entries_history\" ON \"activity_entries\" (\"occurred_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST);",
+			"\nCREATE INDEX \"activity_entries_actor\" ON \"activity_entries\" (\"actor_id\",\"occurred_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST);",
+			"\nCREATE INDEX \"activity_entries_target\" ON \"activity_entries\" (\"target_kind\",\"target_id\",\"occurred_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST);",
+			"\nCREATE INDEX \"activity_entries_request\" ON \"activity_entries\" (\"request_id\");",
+			"\nCREATE INDEX \"auth_accounts_user_id\" ON \"auth_accounts\" (\"user_id\");",
+			"\nCREATE UNIQUE INDEX \"auth_accounts_identity\" ON \"auth_accounts\" (\"issuer\",\"account_id\");",
+			"\nCREATE INDEX \"auth_sessions_user_id\" ON \"auth_sessions\" (\"user_id\");",
+			"\nCREATE INDEX \"auth_verifications_identifier\" ON \"auth_verifications\" (\"identifier\");",
+			"\nCREATE INDEX \"change_receipts_activity\" ON \"change_receipts\" (\"activity_id\");",
+			"\nCREATE INDEX \"document_media_references_object_key\" ON \"document_media_references\" (\"object_key\");",
+			"\nCREATE INDEX \"document_revisions_history\" ON \"document_revisions\" (\"document_id\",\"created_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST);",
+			"\nCREATE UNIQUE INDEX \"documents_active_path\" ON \"documents\" (\"source_path\") WHERE \"deleted_at\" is null;",
+			"\nCREATE INDEX \"media_assets_catalog\" ON \"media_assets\" (\"created_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST) WHERE \"status\" = 'ready';",
+			"\nCREATE INDEX \"media_assets_folder\" ON \"media_assets\" (\"folder\",\"created_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST) WHERE \"status\" = 'ready';",
+			"\nCREATE INDEX \"media_assets_recovery\" ON \"media_assets\" (\"updated_at\",\"id\") WHERE \"status\" <> 'ready';",
+			"\nCREATE INDEX \"media_replacements_recovery\" ON \"media_replacements\" (\"updated_at\",\"media_id\");",
+			"\nCREATE UNIQUE INDEX \"pending_changes_subject\" ON \"pending_changes\" (\"subject\");",
+			"\nCREATE INDEX \"pending_changes_recovery\" ON \"pending_changes\" (\"scope\",\"updated_at\",\"id\");",
+			"\nCREATE UNIQUE INDEX \"working_document_publish_attempts_active\" ON \"working_document_publish_attempts\" (\"document_id\") WHERE \"phase\" in ('pending', 'checkpointed');",
+			"\nCREATE INDEX \"working_document_publish_attempts_recovery\" ON \"working_document_publish_attempts\" (\"document_id\",\"created_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST);",
+			"\nALTER TABLE \"auth_accounts\" ADD CONSTRAINT \"auth_accounts_user_id_auth_users_id_fkey\" FOREIGN KEY (\"user_id\") REFERENCES \"auth_users\"(\"id\") ON DELETE CASCADE;",
+			"\nALTER TABLE \"auth_sessions\" ADD CONSTRAINT \"auth_sessions_user_id_auth_users_id_fkey\" FOREIGN KEY (\"user_id\") REFERENCES \"auth_users\"(\"id\") ON DELETE CASCADE;",
+			"\nALTER TABLE \"change_receipts\" ADD CONSTRAINT \"change_receipts_activity_id_activity_entries_id_fkey\" FOREIGN KEY (\"activity_id\") REFERENCES \"activity_entries\"(\"id\") ON DELETE RESTRICT;",
+			"\nALTER TABLE \"document_heads\" ADD CONSTRAINT \"document_heads_document_id_documents_id_fkey\" FOREIGN KEY (\"document_id\") REFERENCES \"documents\"(\"id\") ON DELETE RESTRICT;",
+			"\nALTER TABLE \"document_heads\" ADD CONSTRAINT \"document_heads_authored_revision_fkey\" FOREIGN KEY (\"document_id\",\"authored_revision_id\") REFERENCES \"document_revisions\"(\"document_id\",\"id\") ON DELETE RESTRICT;",
+			"\nALTER TABLE \"document_heads\" ADD CONSTRAINT \"document_heads_published_revision_fkey\" FOREIGN KEY (\"document_id\",\"published_revision_id\") REFERENCES \"document_revisions\"(\"document_id\",\"id\") ON DELETE RESTRICT;",
+			"\nALTER TABLE \"document_media_references\" ADD CONSTRAINT \"document_media_references_document_id_documents_id_fkey\" FOREIGN KEY (\"document_id\") REFERENCES \"documents\"(\"id\") ON DELETE CASCADE;",
+			"\nALTER TABLE \"document_revisions\" ADD CONSTRAINT \"document_revisions_document_id_documents_id_fkey\" FOREIGN KEY (\"document_id\") REFERENCES \"documents\"(\"id\") ON DELETE RESTRICT;",
+			"\nALTER TABLE \"media_replacements\" ADD CONSTRAINT \"media_replacements_media_id_media_assets_id_fkey\" FOREIGN KEY (\"media_id\") REFERENCES \"media_assets\"(\"id\") ON DELETE RESTRICT;",
+			"\nALTER TABLE \"working_document_publish_attempts\" ADD CONSTRAINT \"working_document_publish_attempts_document_generation_fkey\" FOREIGN KEY (\"document_id\",\"expected_generation\") REFERENCES \"working_documents\"(\"document_id\",\"generation_id\") ON DELETE CASCADE;",
+			"\nALTER TABLE \"working_document_publish_attempts\" ADD CONSTRAINT \"working_document_publish_attempts_expected_version_fkey\" FOREIGN KEY (\"document_id\",\"expected_version\") REFERENCES \"document_revisions\"(\"document_id\",\"id\") ON DELETE RESTRICT;",
+			"\nALTER TABLE \"working_document_publish_attempts\" ADD CONSTRAINT \"working_document_publish_attempts_checkpoint_version_fkey\" FOREIGN KEY (\"document_id\",\"checkpoint_version\") REFERENCES \"document_revisions\"(\"document_id\",\"id\") ON DELETE RESTRICT;",
+			"\nALTER TABLE \"working_document_updates\" ADD CONSTRAINT \"working_document_updates_document_generation_fkey\" FOREIGN KEY (\"document_id\",\"generation_id\") REFERENCES \"working_documents\"(\"document_id\",\"generation_id\") ON DELETE CASCADE;",
+			"\nALTER TABLE \"working_documents\" ADD CONSTRAINT \"working_documents_document_id_documents_id_fkey\" FOREIGN KEY (\"document_id\") REFERENCES \"documents\"(\"id\") ON DELETE CASCADE;",
+			"\nALTER TABLE \"working_documents\" ADD CONSTRAINT \"working_documents_saved_version_fkey\" FOREIGN KEY (\"document_id\",\"saved_version\") REFERENCES \"document_revisions\"(\"document_id\",\"id\") ON DELETE RESTRICT;"
+		],
+		bps: true,
+		folderMillis: 1788466567e3,
+		hash: "943a4996ef8c4324bd58280a80103e5a1632b088880164904b3857686e26f33e",
+		name: "20260903201607_cms_baseline"
+	},
+	{
+		sql: [
+			"ALTER TABLE \"auth_rate_limits\" ADD COLUMN \"id\" uuid DEFAULT gen_random_uuid();",
+			"\nALTER TABLE \"auth_rate_limits\" DROP CONSTRAINT \"auth_rate_limits_pkey\";",
+			"\nALTER TABLE \"auth_rate_limits\" ADD PRIMARY KEY (\"id\");",
+			"\nALTER TABLE \"auth_rate_limits\" ADD CONSTRAINT \"auth_rate_limits_key_key\" UNIQUE(\"key\");"
+		],
+		bps: true,
+		folderMillis: 1788587191e3,
+		hash: "78b837c6b72a3de22d68e8db90bd211e61a0b97ff29bf8d16a0bba245eefa7ed",
+		name: "20260905054631_burly_northstar"
+	},
+	{
+		sql: ["ALTER TABLE \"auth_accounts\" DROP COLUMN \"issuer\";", "\nCREATE UNIQUE INDEX \"auth_accounts_identity\" ON \"auth_accounts\" (\"provider_id\",\"account_id\");"],
+		bps: true,
+		folderMillis: 178875937e4,
+		hash: "e442485fa6c2d611e3dae508a12d245481bc5ec8f2dd4f5d853910df34484787",
+		name: "20260907053610_fancy_lady_deathstrike"
+	},
+	{
+		sql: ["ALTER TABLE \"activity_entries\" DROP CONSTRAINT \"activity_entries_action_check\", ADD CONSTRAINT \"activity_entries_action_check\" CHECK (\"action\" in ('document.created', 'document.updated', 'document.moved', 'document.trashed', 'document.revision.restored', 'document.untrashed', 'document.published', 'document.unpublished', 'media.uploaded', 'media.replaced', 'media.removed', 'media.cleaned', 'user.created', 'user.removed', 'user.role.changed', 'user.sessions.revoked', 'authentication.signed-in', 'authentication.signed-out', 'authentication.password.changed', 'authentication.password.reset'));", "\nALTER TABLE \"pending_changes\" DROP CONSTRAINT \"pending_changes_action_check\", ADD CONSTRAINT \"pending_changes_action_check\" CHECK (\"action\" in ('document.created', 'document.updated', 'document.moved', 'document.trashed', 'document.revision.restored', 'document.untrashed', 'document.published', 'document.unpublished', 'media.uploaded', 'media.replaced', 'media.removed', 'media.cleaned', 'user.created', 'user.removed', 'user.role.changed', 'user.sessions.revoked', 'authentication.signed-in', 'authentication.signed-out', 'authentication.password.changed', 'authentication.password.reset'));"],
+		bps: true,
+		folderMillis: 1788866265e3,
+		hash: "24c56a37796caf8d76c0a97128a382b31e71808aa5b0ca7e5bac96795f9e16c7",
+		name: "20260908111745_classy_johnny_storm"
+	},
+	{
+		sql: [
+			"CREATE TABLE \"seo_media_references\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"scope\" text NOT NULL,\n	\"media_id\" uuid NOT NULL,\n	CONSTRAINT \"seo_media_references_scope_media_unique\" UNIQUE(\"scope\",\"media_id\"),\n	CONSTRAINT \"seo_media_references_scope_check\" CHECK (\"scope\" in ('working', 'published'))\n);\n",
+			"\nCREATE TABLE \"seo_revisions\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"settings\" jsonb NOT NULL,\n	\"actor_id\" text NOT NULL,\n	\"actor_email\" text NOT NULL,\n	\"actor_name\" text NOT NULL,\n	\"actor_roles\" jsonb NOT NULL,\n	\"request_id\" uuid NOT NULL,\n	\"reason\" text,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"seo_revisions_actor_roles_check\" CHECK (jsonb_typeof(\"actor_roles\") = 'array'),\n	CONSTRAINT \"seo_revisions_settings_check\" CHECK (jsonb_typeof(\"settings\") = 'object')\n);\n",
+			"\nCREATE TABLE \"seo_state\" (\n	\"singleton\" boolean PRIMARY KEY DEFAULT true,\n	\"working_revision_id\" uuid NOT NULL,\n	\"published_revision_id\" uuid NOT NULL,\n	CONSTRAINT \"seo_state_singleton_check\" CHECK (\"singleton\")\n);\n",
+			"\nCREATE INDEX \"seo_media_references_media\" ON \"seo_media_references\" (\"media_id\");",
+			"\nCREATE INDEX \"seo_revisions_history\" ON \"seo_revisions\" (\"created_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST);",
+			"\nALTER TABLE \"seo_media_references\" ADD CONSTRAINT \"seo_media_references_media_id_media_assets_id_fkey\" FOREIGN KEY (\"media_id\") REFERENCES \"media_assets\"(\"id\") ON DELETE RESTRICT;",
+			"\nALTER TABLE \"seo_state\" ADD CONSTRAINT \"seo_state_working_revision_fkey\" FOREIGN KEY (\"working_revision_id\") REFERENCES \"seo_revisions\"(\"id\") ON DELETE RESTRICT;",
+			"\nALTER TABLE \"seo_state\" ADD CONSTRAINT \"seo_state_published_revision_fkey\" FOREIGN KEY (\"published_revision_id\") REFERENCES \"seo_revisions\"(\"id\") ON DELETE RESTRICT;",
+			"\nALTER TABLE \"activity_entries\" DROP CONSTRAINT \"activity_entries_action_check\", ADD CONSTRAINT \"activity_entries_action_check\" CHECK (\"action\" in ('document.created', 'document.updated', 'document.moved', 'document.trashed', 'document.revision.restored', 'document.untrashed', 'document.published', 'document.unpublished', 'media.uploaded', 'media.replaced', 'media.removed', 'media.cleaned', 'seo.saved', 'seo.published', 'user.created', 'user.removed', 'user.role.changed', 'user.sessions.revoked', 'authentication.signed-in', 'authentication.signed-out', 'authentication.password.changed', 'authentication.password.reset'));",
+			"\nALTER TABLE \"activity_entries\" DROP CONSTRAINT \"activity_entries_target_kind_check\", ADD CONSTRAINT \"activity_entries_target_kind_check\" CHECK (\"target_kind\" in ('document', 'media', 'media-library', 'seo', 'user'));",
+			"\nALTER TABLE \"activity_entries\" DROP CONSTRAINT \"activity_entries_target_check\", ADD CONSTRAINT \"activity_entries_target_check\" CHECK ((\"target_kind\" in ('media-library', 'seo') AND \"target_id\" IS NULL)\n        OR (\"target_kind\" not in ('media-library', 'seo') AND \"target_id\" IS NOT NULL));",
+			"\nALTER TABLE \"pending_changes\" DROP CONSTRAINT \"pending_changes_action_check\", ADD CONSTRAINT \"pending_changes_action_check\" CHECK (\"action\" in ('document.created', 'document.updated', 'document.moved', 'document.trashed', 'document.revision.restored', 'document.untrashed', 'document.published', 'document.unpublished', 'media.uploaded', 'media.replaced', 'media.removed', 'media.cleaned', 'seo.saved', 'seo.published', 'user.created', 'user.removed', 'user.role.changed', 'user.sessions.revoked', 'authentication.signed-in', 'authentication.signed-out', 'authentication.password.changed', 'authentication.password.reset'));"
+		],
+		bps: true,
+		folderMillis: 1789233351e3,
+		hash: "8e6a6abf5385ab3ecf8eb083c1923ac9c74d72aa71bd1d444b7402d3e7e77000",
+		name: "20260912171551_charming_valkyrie"
+	}
+];
+
+//#endregion
+//#region ../sql-pg/src/internal/database/table-helpers.ts
+const transactionTimestamp = sql`transaction_timestamp()`;
+function isOneOf(column, values) {
+	return sql`${column} in (${sql.join(values.map((value) => sql`${value}`), sql`, `)})`;
+}
+
+//#endregion
+//#region ../sql-pg/src/internal/documents/tables.ts
+const cmsState = pgTable("cms_state", {
+	singleton: boolean().default(true).primaryKey(),
+	generation: bigint({ mode: "bigint" }).default(sql`0`).notNull()
+}, (table) => [check("cms_state_singleton_check", sql`${table.singleton}`), check("cms_state_generation_check", sql`${table.generation} >= 0`)]);
+const documentsTable = pgTable("documents", {
+	id: uuid().defaultRandom().primaryKey(),
+	sourcePath: text("source_path").notNull(),
+	deletedAt: timestamp("deleted_at", {
+		mode: "string",
+		withTimezone: true
+	}),
+	createdAt: timestamp("created_at", {
+		mode: "string",
+		withTimezone: true
+	}).default(transactionTimestamp).notNull(),
+	updatedAt: timestamp("updated_at", {
+		mode: "string",
+		withTimezone: true
+	}).default(transactionTimestamp).notNull()
+}, (table) => [uniqueIndex("documents_active_path").on(table.sourcePath).where(sql`${table.deletedAt} is null`)]);
+const documentRevisions = pgTable("document_revisions", {
+	id: uuid().defaultRandom().primaryKey(),
+	documentId: uuid("document_id").notNull().references(() => documentsTable.id, { onDelete: "restrict" }),
+	action: text({ enum: DOCUMENT_REVISION_ACTIONS }).notNull(),
+	sourcePath: text("source_path").notNull(),
+	markdown: text().notNull(),
+	actorId: text("actor_id").notNull(),
+	actorEmail: text("actor_email").notNull(),
+	actorName: text("actor_name").notNull(),
+	actorRoles: jsonb("actor_roles").$type().notNull(),
+	requestId: uuid("request_id").notNull(),
+	reason: text(),
+	activityDetails: jsonb("activity_details").$type().default({}).notNull(),
+	createdAt: timestamp("created_at", {
+		mode: "string",
+		withTimezone: true
+	}).default(transactionTimestamp).notNull()
+}, (table) => [
+	check("document_revisions_action_check", isOneOf(table.action, DOCUMENT_REVISION_ACTIONS)),
+	unique("document_revisions_document_id_unique").on(table.documentId, table.id),
+	index("document_revisions_history").on(table.documentId, table.createdAt.desc(), table.id.desc())
+]);
+const documentHeads = pgTable("document_heads", {
+	documentId: uuid("document_id").primaryKey().references(() => documentsTable.id, { onDelete: "restrict" }),
+	authoredRevisionId: uuid("authored_revision_id").notNull(),
+	publishedRevisionId: uuid("published_revision_id")
+}, (table) => [foreignKey({
+	columns: [table.documentId, table.authoredRevisionId],
+	foreignColumns: [documentRevisions.documentId, documentRevisions.id],
+	name: "document_heads_authored_revision_fkey"
+}).onDelete("restrict"), foreignKey({
+	columns: [table.documentId, table.publishedRevisionId],
+	foreignColumns: [documentRevisions.documentId, documentRevisions.id],
+	name: "document_heads_published_revision_fkey"
+}).onDelete("restrict")]);
+const documentMediaReferences = pgTable("document_media_references", {
+	id: uuid().defaultRandom().primaryKey(),
+	documentId: uuid("document_id").notNull().references(() => documentsTable.id, { onDelete: "cascade" }),
+	objectKey: text("object_key").notNull(),
+	path: text().notNull(),
+	sourcePath: text("source_path").notNull(),
+	nodePath: integer("node_path").array().notNull()
+}, (table) => [
+	unique("document_media_references_identity_unique").on(table.documentId, table.sourcePath, table.nodePath, table.objectKey),
+	check("document_media_references_object_key_check", sql`char_length(${table.objectKey}) between 1 and 1024
+        AND btrim(${table.objectKey}) = ${table.objectKey}
+        AND ${table.objectKey} !~ '(^/|/$|//|(^|/)\\.{1,2}(/|$)|[[:cntrl:]])'
+        AND position(chr(92) in ${table.objectKey}) = 0`),
+	check("document_media_references_node_path_check", sql`array_position(${table.nodePath}, NULL) IS NULL AND 0 <= ALL(${table.nodePath})`),
+	index("document_media_references_object_key").on(table.objectKey)
+]);
+
+//#endregion
+//#region ../sql-pg/src/internal/initialization/tables.ts
+const INITIALIZATION_STATES = [
+	"uninitialized",
+	"claiming",
+	"ready"
+];
+const initializationState = pgTable("initialization_state", {
+	singleton: boolean().default(true).primaryKey(),
+	state: text({ enum: INITIALIZATION_STATES }).default("uninitialized").notNull(),
+	changeId: uuid("change_id"),
+	claim: jsonb().$type()
+}, (table) => [
+	check("initialization_state_singleton_check", sql`${table.singleton}`),
+	check("initialization_state_state_check", isOneOf(table.state, INITIALIZATION_STATES)),
+	check("initialization_state_claim_check", sql`(${table.state} = 'claiming' AND ${table.changeId} IS NOT NULL AND jsonb_typeof(${table.claim}) = 'object')
+        OR (${table.state} <> 'claiming' AND ${table.changeId} IS NULL AND ${table.claim} IS NULL)`)
+]);
+
+//#endregion
+//#region ../sql-pg/src/internal/database/migrations.ts
+const MIGRATION_LOCK_KEY = "cms:database-migrations:v1";
+const migrateCmsDatabase = Effect.fn("CmsDatabase.migrate")(function* (schema) {
+	const postgres = yield* PgClient.PgClient;
+	const database = yield* PgDrizzle.makeWithDefaults();
+	yield* postgres.withTransaction(Effect.gen(function* () {
+		yield* postgres.unsafe("select pg_advisory_xact_lock(hashtextextended($1, 0))", [MIGRATION_LOCK_KEY]);
+		yield* migrate(embeddedMigrations, database._.session, {
+			migrationsFolder: "embedded",
+			migrationsSchema: schema,
+			migrationsTable: "__drizzle_migrations"
+		});
+		yield* database.insert(cmsState).values({}).onConflictDoNothing({ target: cmsState.singleton });
+		yield* database.insert(initializationState).values({}).onConflictDoNothing({ target: initializationState.singleton });
+	}));
+});
+function cmsDatabaseMigrationLayer(schema) {
+	return Layer.effectDiscard(migrateCmsDatabase(schema));
+}
+
+//#endregion
+//#region ../sql-pg/src/internal/postgres/scoped-client.ts
+const PgJson = Statement.custom("PgJson");
+/**
+* Builds a PostgreSQL client whose every physical pool connection starts in
+* the configured schema. The upstream driver does not yet expose PostgreSQL
+* startup parameters, so the initialization belongs at our pool seam.
+*/
+const makeSchemaClient = Effect.fn("Postgres.makeSchemaClient")(function* (options, schema) {
+	const pool = yield* PgPool.make(options);
+	const initialized = /* @__PURE__ */ new WeakSet();
+	const searchPath = `set search_path to "${schema}"`;
+	const initialize = (connection) => initialized.has(connection) ? Effect.succeed(connection) : connection.query(searchPath).pipe(Effect.tap(() => Effect.sync(() => initialized.add(connection))), Effect.as(connection));
+	const acquirer = Effect.map(Effect.flatMap(pool.get, initialize), makeConnection);
+	const transactionAcquirer = Effect.map(Effect.flatMap(pool.reserve, initialize), makeConnection);
+	const listenAcquirer = Effect.flatMap(pool.reserve, initialize);
+	const borrower = (use) => pool.use((connection) => Effect.flatMap(initialize(connection), (ready) => use(makeConnection(ready))));
+	const compiler = PgClient.makeCompiler(options.transformQueryNames, options.transformJson);
+	const transformRows = options.transformResultNames ? Statement.defaultTransforms(options.transformResultNames, options.transformJson).array : void 0;
+	const listen = (channel) => Effect.flatMap(listenAcquirer, (connection) => connection.listen(channel));
+	const json = (value) => Statement.fragment([PgJson(value, void 0, void 0)]);
+	return Object.assign(yield* Client.make({
+		acquirer,
+		borrower,
+		compiler,
+		prepareTransactionControls: true,
+		spanAttributes: [
+			...options.spanAttributes ? Object.entries(options.spanAttributes) : [],
+			["db.system.name", "postgresql"],
+			["cms.database.schema", schema]
+		],
+		transactionAcquirer,
+		transformRows
+	}), {
+		[PgClient.TypeId]: PgClient.TypeId,
+		config: options,
+		json,
+		listen,
+		notify: (channel, payload) => Effect.asVoid(Effect.scoped(Effect.flatMap(acquirer, (connection) => connection.executeRaw("select pg_notify($1, $2)", [channel, payload]))))
+	});
+});
+var ConnectionImpl = class {
+	connection;
+	constructor(connection) {
+		this.connection = connection;
+	}
+	run(query, params, prepare = true) {
+		return Effect.map(this.connection.query(query, params, prepare), (result) => result.rows);
+	}
+	execute(sql, params, transformRows) {
+		const operation = this.run(sql, params);
+		return transformRows ? Effect.map(operation, transformRows) : operation;
+	}
+	executeRaw(sql, params) {
+		return this.connection.query(sql, params);
+	}
+	executeWithoutTransform(sql, params) {
+		return this.run(sql, params);
+	}
+	executeValues(sql, params) {
+		return this.connection.queryValues(sql, params);
+	}
+	executeValuesUnprepared(sql, params) {
+		return this.connection.queryValues(sql, params, false);
+	}
+	executeUnprepared(sql, params, transformRows) {
+		const operation = this.run(sql, params, false);
+		return transformRows ? Effect.map(operation, transformRows) : operation;
+	}
+	executeStream(sql, params, transformRows) {
+		const stream = this.connection.stream(sql, params);
+		if (!transformRows) return stream;
+		return Stream.mapArray(stream, (rows) => {
+			const transformed = transformRows(rows);
+			const first = transformed[0];
+			return first === void 0 ? rows : [first, ...transformed.slice(1)];
+		});
+	}
+};
+function makeConnection(connection) {
+	return new ConnectionImpl(connection);
+}
+function schemaClientLayer(options, schema) {
+	return PgClient.layerFrom(makeSchemaClient(options, schema));
+}
+
+//#endregion
+//#region ../auth/src/internal/user.ts
+const cmsUserCreationChangeField = "cmsCreationChangeId";
+const cmsUserSessionsRevokedChangeField = "cmsSessionsRevokedChangeId";
+const BetterAuthUser = Schema.Struct({
+	banned: Schema.optionalKey(Schema.NullOr(Schema.Boolean)),
+	createdAt: Schema.Date,
+	email: Schema.String,
+	emailVerified: Schema.Boolean,
+	id: Schema.String,
+	name: Schema.String,
+	role: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	updatedAt: Schema.Date
+});
+const BetterAuthUserRecoveryEvidence = Schema.Struct({
+	[cmsUserCreationChangeField]: Schema.optionalKey(Schema.UndefinedOr(Schema.NullOr(ActivityId))),
+	[cmsUserSessionsRevokedChangeField]: Schema.optionalKey(Schema.UndefinedOr(Schema.NullOr(ActivityId)))
+});
+function decodeBetterAuthUser(value) {
+	return Schema.decodeEffect(BetterAuthUser)(value).pipe(Effect.flatMap((user) => Schema.decodeUnknownEffect(User)({
+		banned: user.banned === true,
+		createdAt: user.createdAt.toISOString(),
+		email: user.email,
+		emailVerified: user.emailVerified,
+		id: user.id,
+		name: user.name,
+		role: user.role,
+		updatedAt: user.updatedAt.toISOString()
+	})));
+}
+function decodeBetterAuthActor(user) {
+	return Schema.decodeEffect(StudioActor)(betterAuthActorInput(user));
+}
+function decodeBetterAuthActorOption(user) {
+	return Schema.decodeOption(StudioActor)(betterAuthActorInput(user));
+}
+function decodeBetterAuthUserCreationChangeId(user) {
+	return decodeChangeId(user, cmsUserCreationChangeField);
+}
+function decodeBetterAuthUserSessionsRevokedChangeId(user) {
+	return decodeChangeId(user, cmsUserSessionsRevokedChangeField);
+}
+function decodeChangeId(user, field) {
+	return Schema.decodeEffect(BetterAuthUserRecoveryEvidence)(user).pipe(Effect.map((evidence) => evidence[field] ?? null));
+}
+function betterAuthProviderRoles(value) {
+	return value ? [...new Set(value.split(",").map((role) => role.trim()).filter(Boolean))] : [];
+}
+function betterAuthActorInput(user) {
+	return {
+		email: user.email,
+		id: user.id,
+		name: user.name,
+		roles: betterAuthProviderRoles(user.role)
+	};
+}
+
+//#endregion
+//#region ../auth/src/internal/better-auth.ts
+const cmsBetterAuthAccess = createAccessControl(defaultStatements);
+const cmsBetterAuthRoles = {
+	administrator: cmsBetterAuthAccess.newRole({
+		session: ["list", "revoke"],
+		user: [
+			"create",
+			"list",
+			"get",
+			"set-role",
+			"delete",
+			"update"
+		]
+	}),
+	editor: cmsBetterAuthAccess.newRole({
+		session: [],
+		user: []
+	}),
+	viewer: cmsBetterAuthAccess.newRole({
+		session: [],
+		user: []
+	})
+};
+const timestampFields = {
+	createdAt: "created_at",
+	updatedAt: "updated_at"
+};
+function createCmsBetterAuthOptions(options, activity) {
+	return {
+		advanced: { database: {
+			generateId: "uuid",
+			joins: true
+		} },
+		appName: "CMS Studio",
+		basePath: options.basePath ?? "/api/cms/auth",
+		baseURL: options.baseURL,
+		database: options.database,
+		emailAndPassword: {
+			disableSignUp: true,
+			enabled: true,
+			...activity?.emailAndPassword
+		},
+		hooks: activity?.hooks,
+		user: {
+			additionalFields: {
+				[cmsUserCreationChangeField]: hiddenChangeField("cms_creation_change_id"),
+				[cmsUserSessionsRevokedChangeField]: hiddenChangeField("cms_sessions_revoked_change_id")
+			},
+			modelName: "auth_users",
+			fields: {
+				...timestampFields,
+				emailVerified: "email_verified"
+			}
+		},
+		session: {
+			cookieCache: {
+				enabled: false,
+				strategy: "jwt"
+			},
+			modelName: "auth_sessions",
+			fields: {
+				...timestampFields,
+				expiresAt: "expires_at",
+				ipAddress: "ip_address",
+				userAgent: "user_agent",
+				userId: "user_id"
+			}
+		},
+		account: {
+			modelName: "auth_accounts",
+			fields: {
+				accessToken: "access_token",
+				accessTokenExpiresAt: "access_token_expires_at",
+				accountId: "account_id",
+				...timestampFields,
+				idToken: "id_token",
+				providerId: "provider_id",
+				refreshToken: "refresh_token",
+				refreshTokenExpiresAt: "refresh_token_expires_at",
+				userId: "user_id"
+			}
+		},
+		verification: {
+			modelName: "auth_verifications",
+			fields: {
+				...timestampFields,
+				expiresAt: "expires_at"
+			}
+		},
+		rateLimit: {
+			enabled: true,
+			storage: "database",
+			modelName: "auth_rate_limits",
+			fields: { lastRequest: "last_request" }
+		},
+		plugins: [admin({
+			ac: cmsBetterAuthAccess,
+			adminRoles: ["administrator"],
+			defaultRole: "editor",
+			roles: cmsBetterAuthRoles,
+			schema: {
+				session: { fields: { impersonatedBy: "impersonated_by" } },
+				user: { fields: {
+					banExpires: "ban_expires",
+					banReason: "ban_reason",
+					banned: "banned",
+					role: "role"
+				} }
+			}
+		})],
+		secret: options.secret
+	};
+}
+function createCmsBetterAuth(options, activity) {
+	return betterAuth(createCmsBetterAuthOptions(options, activity));
+}
+function hiddenChangeField(fieldName) {
+	return {
+		fieldName,
+		input: false,
+		required: false,
+		returned: false,
+		type: "string"
+	};
+}
+
+//#endregion
 //#region ../server/src/internal/activity/activity-storage.ts
 var ActivityStore = class extends Context.Service()("@internal/server/ActivityStore") {};
 
@@ -683,63 +1189,6 @@ function appliedResolution(change, intent, userId) {
 	};
 }
 
-//#endregion
-//#region ../auth/src/internal/user.ts
-const cmsUserCreationChangeField = "cmsCreationChangeId";
-const cmsUserSessionsRevokedChangeField = "cmsSessionsRevokedChangeId";
-const BetterAuthUser = Schema.Struct({
-	banned: Schema.optionalKey(Schema.NullOr(Schema.Boolean)),
-	createdAt: Schema.Date,
-	email: Schema.String,
-	emailVerified: Schema.Boolean,
-	id: Schema.String,
-	name: Schema.String,
-	role: Schema.optionalKey(Schema.NullOr(Schema.String)),
-	updatedAt: Schema.Date
-});
-const BetterAuthUserRecoveryEvidence = Schema.Struct({
-	[cmsUserCreationChangeField]: Schema.optionalKey(Schema.UndefinedOr(Schema.NullOr(ActivityId))),
-	[cmsUserSessionsRevokedChangeField]: Schema.optionalKey(Schema.UndefinedOr(Schema.NullOr(ActivityId)))
-});
-function decodeBetterAuthUser(value) {
-	return Schema.decodeEffect(BetterAuthUser)(value).pipe(Effect.flatMap((user) => Schema.decodeUnknownEffect(User)({
-		banned: user.banned === true,
-		createdAt: user.createdAt.toISOString(),
-		email: user.email,
-		emailVerified: user.emailVerified,
-		id: user.id,
-		name: user.name,
-		role: user.role,
-		updatedAt: user.updatedAt.toISOString()
-	})));
-}
-function decodeBetterAuthActor(user) {
-	return Schema.decodeEffect(StudioActor)(betterAuthActorInput(user));
-}
-function decodeBetterAuthActorOption(user) {
-	return Schema.decodeOption(StudioActor)(betterAuthActorInput(user));
-}
-function decodeBetterAuthUserCreationChangeId(user) {
-	return decodeChangeId(user, cmsUserCreationChangeField);
-}
-function decodeBetterAuthUserSessionsRevokedChangeId(user) {
-	return decodeChangeId(user, cmsUserSessionsRevokedChangeField);
-}
-function decodeChangeId(user, field) {
-	return Schema.decodeEffect(BetterAuthUserRecoveryEvidence)(user).pipe(Effect.map((evidence) => evidence[field] ?? null));
-}
-function betterAuthProviderRoles(value) {
-	return value ? [...new Set(value.split(",").map((role) => role.trim()).filter(Boolean))] : [];
-}
-function betterAuthActorInput(user) {
-	return {
-		email: user.email,
-		id: user.id,
-		name: user.name,
-		roles: betterAuthProviderRoles(user.role)
-	};
-}
-
 //#endregion
 //#region ../auth/src/internal/activity-hooks.ts
 function betterAuthActivityWriter(storage, crypto) {
@@ -776,156 +1225,29 @@ function betterAuthActivityOptions(writeActivity, crypto, runPromise) {
 				if (context.path === "/sign-out") return write("authentication.signed-out", actor);
 				if (context.path === "/change-password") return write("authentication.password.changed", actor);
 				return Promise.resolve();
-			}),
-			before
-		}
-	};
-}
-function activityDraft(action, actor, requestId) {
-	return ActivityEntryDraft.make({
-		action,
-		context: {
-			actor,
-			requestId: RequestId.make(requestId)
-		},
-		details: {},
-		target: {
-			kind: "user",
-			userId: actor.id
-		}
-	});
-}
-function decodeActor(user) {
-	const option = decodeBetterAuthActorOption(user);
-	return Option.getOrUndefined(option);
-}
-
-//#endregion
-//#region ../auth/src/internal/better-auth.ts
-const cmsBetterAuthAccess = createAccessControl(defaultStatements);
-const cmsBetterAuthRoles = {
-	administrator: cmsBetterAuthAccess.newRole({
-		session: ["list", "revoke"],
-		user: [
-			"create",
-			"list",
-			"get",
-			"set-role",
-			"delete",
-			"update"
-		]
-	}),
-	editor: cmsBetterAuthAccess.newRole({
-		session: [],
-		user: []
-	}),
-	viewer: cmsBetterAuthAccess.newRole({
-		session: [],
-		user: []
-	})
-};
-const timestampFields = {
-	createdAt: "created_at",
-	updatedAt: "updated_at"
-};
-function createCmsBetterAuthOptions(options, activity) {
-	return {
-		advanced: { database: {
-			generateId: "uuid",
-			joins: true
-		} },
-		appName: "CMS Studio",
-		basePath: options.basePath ?? "/api/cms/auth",
-		baseURL: options.baseURL,
-		database: options.database,
-		emailAndPassword: {
-			disableSignUp: true,
-			enabled: true,
-			...activity?.emailAndPassword
-		},
-		hooks: activity?.hooks,
-		user: {
-			additionalFields: {
-				[cmsUserCreationChangeField]: hiddenChangeField("cms_creation_change_id"),
-				[cmsUserSessionsRevokedChangeField]: hiddenChangeField("cms_sessions_revoked_change_id")
-			},
-			modelName: "auth_users",
-			fields: {
-				...timestampFields,
-				emailVerified: "email_verified"
-			}
-		},
-		session: {
-			cookieCache: {
-				enabled: false,
-				strategy: "jwt"
-			},
-			modelName: "auth_sessions",
-			fields: {
-				...timestampFields,
-				expiresAt: "expires_at",
-				ipAddress: "ip_address",
-				userAgent: "user_agent",
-				userId: "user_id"
-			}
-		},
-		account: {
-			modelName: "auth_accounts",
-			fields: {
-				accessToken: "access_token",
-				accessTokenExpiresAt: "access_token_expires_at",
-				accountId: "account_id",
-				...timestampFields,
-				idToken: "id_token",
-				providerId: "provider_id",
-				refreshToken: "refresh_token",
-				refreshTokenExpiresAt: "refresh_token_expires_at",
-				userId: "user_id"
-			}
-		},
-		verification: {
-			modelName: "auth_verifications",
-			fields: {
-				...timestampFields,
-				expiresAt: "expires_at"
-			}
-		},
-		rateLimit: {
-			enabled: true,
-			storage: "database",
-			modelName: "auth_rate_limits",
-			fields: { lastRequest: "last_request" }
-		},
-		plugins: [admin({
-			ac: cmsBetterAuthAccess,
-			adminRoles: ["administrator"],
-			defaultRole: "editor",
-			roles: cmsBetterAuthRoles,
-			schema: {
-				session: { fields: { impersonatedBy: "impersonated_by" } },
-				user: { fields: {
-					banExpires: "ban_expires",
-					banReason: "ban_reason",
-					banned: "banned",
-					role: "role"
-				} }
-			}
-		})],
-		secret: options.secret
-	};
-}
-function createCmsBetterAuth(options, activity) {
-	return betterAuth(createCmsBetterAuthOptions(options, activity));
-}
-function hiddenChangeField(fieldName) {
-	return {
-		fieldName,
-		input: false,
-		required: false,
-		returned: false,
-		type: "string"
+			}),
+			before
+		}
 	};
 }
+function activityDraft(action, actor, requestId) {
+	return ActivityEntryDraft.make({
+		action,
+		context: {
+			actor,
+			requestId: RequestId.make(requestId)
+		},
+		details: {},
+		target: {
+			kind: "user",
+			userId: actor.id
+		}
+	});
+}
+function decodeActor(user) {
+	const option = decodeBetterAuthActorOption(user);
+	return Option.getOrUndefined(option);
+}
 
 //#endregion
 //#region ../auth/src/internal/handler.ts
@@ -5398,13 +5720,6 @@ function createCmsInstallationLayer(options) {
 	});
 }
 
-//#endregion
-//#region ../sql-pg/src/internal/database/table-helpers.ts
-const transactionTimestamp = sql`transaction_timestamp()`;
-function isOneOf(column, values) {
-	return sql`${column} in (${sql.join(values.map((value) => sql`${value}`), sql`, `)})`;
-}
-
 //#endregion
 //#region ../sql-pg/src/internal/activity/tables.ts
 const ACTIVITY_TARGET_KINDS = [
@@ -5896,227 +6211,6 @@ function changeJournalUnavailable(operation, cause) {
 	});
 }
 
-//#endregion
-//#region ../sql-pg/src/internal/database/embedded-migrations.generated.ts
-const embeddedMigrations = [
-	{
-		sql: [
-			"CREATE TABLE \"activity_entries\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"action\" text NOT NULL,\n	\"actor_id\" text NOT NULL,\n	\"actor_email\" text NOT NULL,\n	\"actor_name\" text NOT NULL,\n	\"actor_roles\" jsonb NOT NULL,\n	\"request_id\" uuid NOT NULL,\n	\"reason\" text,\n	\"target_kind\" text NOT NULL,\n	\"target_id\" text,\n	\"details\" jsonb DEFAULT '{}' NOT NULL,\n	\"occurred_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"activity_entries_action_check\" CHECK (\"action\" in ('document.created', 'document.updated', 'document.moved', 'document.trashed', 'document.revision.restored', 'document.untrashed', 'document.published', 'media.uploaded', 'media.replaced', 'media.removed', 'media.cleaned', 'user.created', 'user.removed', 'user.role.changed', 'user.sessions.revoked', 'authentication.signed-in', 'authentication.signed-out', 'authentication.password.changed', 'authentication.password.reset')),\n	CONSTRAINT \"activity_entries_target_kind_check\" CHECK (\"target_kind\" in ('document', 'media', 'media-library', 'user')),\n	CONSTRAINT \"activity_entries_target_check\" CHECK ((\"target_kind\" = 'media-library' AND \"target_id\" IS NULL)\n        OR (\"target_kind\" <> 'media-library' AND \"target_id\" IS NOT NULL)),\n	CONSTRAINT \"activity_entries_actor_roles_check\" CHECK (jsonb_typeof(\"actor_roles\") = 'array'),\n	CONSTRAINT \"activity_entries_details_check\" CHECK (jsonb_typeof(\"details\") = 'object')\n);\n",
-			"\nCREATE TABLE \"auth_accounts\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"issuer\" text NOT NULL,\n	\"account_id\" text NOT NULL,\n	\"provider_id\" text NOT NULL,\n	\"user_id\" uuid NOT NULL,\n	\"access_token\" text,\n	\"refresh_token\" text,\n	\"id_token\" text,\n	\"access_token_expires_at\" timestamp with time zone,\n	\"refresh_token_expires_at\" timestamp with time zone,\n	\"scope\" text,\n	\"password\" text,\n	\"created_at\" timestamp with time zone DEFAULT now() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT now() NOT NULL\n);\n",
-			"\nCREATE TABLE \"auth_rate_limits\" (\n	\"key\" text PRIMARY KEY,\n	\"count\" bigint NOT NULL,\n	\"last_request\" bigint NOT NULL\n);\n",
-			"\nCREATE TABLE \"auth_sessions\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"expires_at\" timestamp with time zone NOT NULL,\n	\"token\" text NOT NULL UNIQUE,\n	\"created_at\" timestamp with time zone DEFAULT now() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT now() NOT NULL,\n	\"ip_address\" text,\n	\"user_agent\" text,\n	\"user_id\" uuid NOT NULL,\n	\"impersonated_by\" text\n);\n",
-			"\nCREATE TABLE \"auth_users\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"name\" text NOT NULL,\n	\"email\" text NOT NULL UNIQUE,\n	\"email_verified\" boolean DEFAULT false NOT NULL,\n	\"image\" text,\n	\"created_at\" timestamp with time zone DEFAULT now() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT now() NOT NULL,\n	\"role\" text DEFAULT 'editor' NOT NULL,\n	\"banned\" boolean DEFAULT false NOT NULL,\n	\"ban_reason\" text,\n	\"ban_expires\" timestamp with time zone,\n	\"cms_creation_change_id\" uuid UNIQUE,\n	\"cms_sessions_revoked_change_id\" uuid UNIQUE,\n	CONSTRAINT \"auth_users_role_check\" CHECK (\"role\" in ('administrator', 'editor', 'viewer'))\n);\n",
-			"\nCREATE TABLE \"auth_verifications\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"identifier\" text NOT NULL,\n	\"value\" text NOT NULL,\n	\"expires_at\" timestamp with time zone NOT NULL,\n	\"created_at\" timestamp with time zone DEFAULT now() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT now() NOT NULL\n);\n",
-			"\nCREATE TABLE \"change_receipts\" (\n	\"change_id\" uuid PRIMARY KEY,\n	\"fingerprint\" text NOT NULL,\n	\"outcome\" text NOT NULL,\n	\"activity_id\" uuid UNIQUE,\n	\"completed_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"change_receipts_outcome_check\" CHECK ((\"outcome\" = 'applied' AND \"activity_id\" IS NOT NULL)\n      OR (\"outcome\" = 'cancelled' AND \"activity_id\" IS NULL))\n);\n",
-			"\nCREATE TABLE \"cms_state\" (\n	\"singleton\" boolean PRIMARY KEY DEFAULT true,\n	\"generation\" bigint DEFAULT 0 NOT NULL,\n	CONSTRAINT \"cms_state_singleton_check\" CHECK (\"singleton\"),\n	CONSTRAINT \"cms_state_generation_check\" CHECK (\"generation\" >= 0)\n);\n",
-			"\nCREATE TABLE \"document_heads\" (\n	\"document_id\" uuid PRIMARY KEY,\n	\"authored_revision_id\" uuid NOT NULL,\n	\"published_revision_id\" uuid\n);\n",
-			"\nCREATE TABLE \"document_media_references\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"document_id\" uuid NOT NULL,\n	\"object_key\" text NOT NULL,\n	\"path\" text NOT NULL,\n	\"source_path\" text NOT NULL,\n	\"node_path\" integer[] NOT NULL,\n	CONSTRAINT \"document_media_references_identity_unique\" UNIQUE(\"document_id\",\"source_path\",\"node_path\",\"object_key\"),\n	CONSTRAINT \"document_media_references_object_key_check\" CHECK (char_length(\"object_key\") between 1 and 1024\n        AND btrim(\"object_key\") = \"object_key\"\n        AND \"object_key\" !~ '(^/|/$|//|(^|/)\\.{1,2}(/|$)|[[:cntrl:]])'\n        AND position(chr(92) in \"object_key\") = 0),\n	CONSTRAINT \"document_media_references_node_path_check\" CHECK (array_position(\"node_path\", NULL) IS NULL AND 0 <= ALL(\"node_path\"))\n);\n",
-			"\nCREATE TABLE \"document_revisions\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"document_id\" uuid NOT NULL,\n	\"action\" text NOT NULL,\n	\"source_path\" text NOT NULL,\n	\"markdown\" text NOT NULL,\n	\"actor_id\" text NOT NULL,\n	\"actor_email\" text NOT NULL,\n	\"actor_name\" text NOT NULL,\n	\"actor_roles\" jsonb NOT NULL,\n	\"request_id\" uuid NOT NULL,\n	\"reason\" text,\n	\"activity_details\" jsonb DEFAULT '{}' NOT NULL,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"document_revisions_document_id_unique\" UNIQUE(\"document_id\",\"id\"),\n	CONSTRAINT \"document_revisions_action_check\" CHECK (\"action\" in ('document.create', 'document.move', 'document.remove', 'document.restore', 'document.undelete', 'document.update'))\n);\n",
-			"\nCREATE TABLE \"documents\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"source_path\" text NOT NULL,\n	\"deleted_at\" timestamp with time zone,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL\n);\n",
-			"\nCREATE TABLE \"initialization_state\" (\n	\"singleton\" boolean PRIMARY KEY DEFAULT true,\n	\"state\" text DEFAULT 'uninitialized' NOT NULL,\n	\"change_id\" uuid,\n	\"claim\" jsonb,\n	CONSTRAINT \"initialization_state_singleton_check\" CHECK (\"singleton\"),\n	CONSTRAINT \"initialization_state_state_check\" CHECK (\"state\" in ('uninitialized', 'claiming', 'ready')),\n	CONSTRAINT \"initialization_state_claim_check\" CHECK ((\"state\" = 'claiming' AND \"change_id\" IS NOT NULL AND jsonb_typeof(\"claim\") = 'object')\n        OR (\"state\" <> 'claiming' AND \"change_id\" IS NULL AND \"claim\" IS NULL))\n);\n",
-			"\nCREATE TABLE \"media_assets\" (\n	\"id\" uuid PRIMARY KEY,\n	\"object_key\" text NOT NULL UNIQUE,\n	\"name\" text NOT NULL,\n	\"folder\" text DEFAULT '' NOT NULL,\n	\"mime_type\" text NOT NULL,\n	\"byte_size\" bigint NOT NULL,\n	\"status\" text DEFAULT 'uploading' NOT NULL,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"media_assets_byte_size_check\" CHECK (\"byte_size\" > 0 AND \"byte_size\" <= 9007199254740991),\n	CONSTRAINT \"media_assets_mime_type_check\" CHECK (\"mime_type\" in ('image/avif', 'image/gif', 'image/jpeg', 'image/png', 'image/webp')),\n	CONSTRAINT \"media_assets_status_check\" CHECK (\"status\" in ('uploading', 'ready', 'deleting')),\n	CONSTRAINT \"media_assets_name_check\" CHECK (char_length(\"name\") between 1 and 255\n    AND btrim(\"name\") = \"name\"\n    AND \"name\" not in ('.', '..')\n    AND \"name\" !~ '[[:cntrl:]/]'\n    AND position(chr(92) in \"name\") = 0),\n	CONSTRAINT \"media_assets_folder_check\" CHECK (char_length(\"folder\") <= 512\n    AND btrim(\"folder\") = \"folder\"\n    AND \"folder\" !~ '(^/|/$|//|(^|/)\\.{1,2}(/|$)|[[:cntrl:]])'\n    AND position(chr(92) in \"folder\") = 0),\n	CONSTRAINT \"media_assets_object_key_check\" CHECK (\"object_key\" ~ '^media/[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\\.(avif|gif|jpg|png|webp)$')\n);\n",
-			"\nCREATE TABLE \"media_replacements\" (\n	\"media_id\" uuid PRIMARY KEY,\n	\"object_key\" text NOT NULL,\n	\"staging_object_key\" text NOT NULL UNIQUE,\n	\"name\" text NOT NULL,\n	\"folder\" text NOT NULL,\n	\"mime_type\" text NOT NULL,\n	\"byte_size\" bigint NOT NULL,\n	\"staged\" boolean DEFAULT false NOT NULL,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"media_replacements_byte_size_check\" CHECK (\"byte_size\" > 0 AND \"byte_size\" <= 9007199254740991),\n	CONSTRAINT \"media_replacements_mime_type_check\" CHECK (\"mime_type\" in ('image/avif', 'image/gif', 'image/jpeg', 'image/png', 'image/webp')),\n	CONSTRAINT \"media_replacements_name_check\" CHECK (char_length(\"name\") between 1 and 255\n    AND btrim(\"name\") = \"name\"\n    AND \"name\" not in ('.', '..')\n    AND \"name\" !~ '[[:cntrl:]/]'\n    AND position(chr(92) in \"name\") = 0),\n	CONSTRAINT \"media_replacements_folder_check\" CHECK (char_length(\"folder\") <= 512\n    AND btrim(\"folder\") = \"folder\"\n    AND \"folder\" !~ '(^/|/$|//|(^|/)\\.{1,2}(/|$)|[[:cntrl:]])'\n    AND position(chr(92) in \"folder\") = 0),\n	CONSTRAINT \"media_replacements_object_key_check\" CHECK (\"object_key\" ~ '^media/[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\\.(avif|gif|jpg|png|webp)$'),\n	CONSTRAINT \"media_replacements_staging_object_key_check\" CHECK (\"staging_object_key\" ~ '^media/replacements/[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\\.(avif|gif|jpg|png|webp)$'),\n	CONSTRAINT \"media_replacements_distinct_object_keys_check\" CHECK (\"staging_object_key\" <> \"object_key\")\n);\n",
-			"\nCREATE TABLE \"pending_changes\" (\n	\"id\" uuid PRIMARY KEY,\n	\"action\" text NOT NULL,\n	\"subject\" text NOT NULL,\n	\"scope\" text NOT NULL,\n	\"actor_id\" text NOT NULL,\n	\"actor_email\" text NOT NULL,\n	\"actor_name\" text NOT NULL,\n	\"actor_roles\" jsonb NOT NULL,\n	\"request_id\" uuid NOT NULL,\n	\"reason\" text,\n	\"target_kind\" text,\n	\"target_id\" text,\n	\"intent\" jsonb NOT NULL,\n	\"fingerprint\" text NOT NULL,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"pending_changes_action_check\" CHECK (\"action\" in ('document.created', 'document.updated', 'document.moved', 'document.trashed', 'document.revision.restored', 'document.untrashed', 'document.published', 'media.uploaded', 'media.replaced', 'media.removed', 'media.cleaned', 'user.created', 'user.removed', 'user.role.changed', 'user.sessions.revoked', 'authentication.signed-in', 'authentication.signed-out', 'authentication.password.changed', 'authentication.password.reset')),\n	CONSTRAINT \"pending_changes_scope_check\" CHECK (\"scope\" in ('initialization', 'media', 'users')),\n	CONSTRAINT \"pending_changes_subject_check\" CHECK (char_length(\"subject\") between 1 and 1024 AND btrim(\"subject\") = \"subject\"),\n	CONSTRAINT \"pending_changes_actor_roles_check\" CHECK (jsonb_typeof(\"actor_roles\") = 'array'),\n	CONSTRAINT \"pending_changes_intent_check\" CHECK (jsonb_typeof(\"intent\") = 'object'),\n	CONSTRAINT \"pending_changes_target_check\" CHECK ((\"target_kind\" IS NULL AND \"target_id\" IS NULL)\n        OR (\"target_kind\" = 'media-library' AND \"target_id\" IS NULL)\n        OR (\"target_kind\" in ('document', 'media', 'user')\n          AND \"target_id\" IS NOT NULL))\n);\n",
-			"\nCREATE TABLE \"working_document_publish_attempts\" (\n	\"id\" uuid PRIMARY KEY,\n	\"activity\" jsonb NOT NULL,\n	\"document_id\" uuid NOT NULL,\n	\"expected_generation\" uuid NOT NULL,\n	\"expected_version\" uuid NOT NULL,\n	\"high_watermark\" bigint NOT NULL,\n	\"markdown_hash\" text NOT NULL,\n	\"state\" bytea NOT NULL,\n	\"state_vector\" bytea NOT NULL,\n	\"checkpoint_version\" uuid,\n	\"phase\" text DEFAULT 'pending' NOT NULL,\n	\"failure\" text,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"working_document_publish_attempts_phase_check\" CHECK (\"phase\" in ('pending', 'checkpointed', 'published', 'failed')),\n	CONSTRAINT \"working_document_publish_attempts_high_watermark_check\" CHECK (\"high_watermark\" between 0 and 9007199254740991),\n	CONSTRAINT \"working_document_publish_attempts_markdown_hash_check\" CHECK (char_length(\"markdown_hash\") between 1 and 128),\n	CONSTRAINT \"working_document_publish_attempts_state_check\" CHECK (octet_length(\"state\") > 0),\n	CONSTRAINT \"working_document_publish_attempts_state_vector_check\" CHECK (octet_length(\"state_vector\") > 0),\n	CONSTRAINT \"working_document_publish_attempts_payload_check\" CHECK ((\n          \"phase\" = 'pending'\n          AND \"checkpoint_version\" IS NULL\n          AND \"failure\" IS NULL\n        ) OR (\n          \"phase\" in ('checkpointed', 'published')\n          AND \"checkpoint_version\" IS NOT NULL\n          AND \"failure\" IS NULL\n        ) OR (\n          \"phase\" = 'failed'\n          AND \"checkpoint_version\" IS NULL\n          AND char_length(\"failure\") between 1 and 128\n        ))\n);\n",
-			"\nCREATE TABLE \"working_document_updates\" (\n	\"document_id\" uuid,\n	\"generation_id\" uuid NOT NULL,\n	\"sequence\" bigint,\n	\"update\" bytea NOT NULL,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"working_document_updates_pkey\" PRIMARY KEY(\"document_id\",\"sequence\"),\n	CONSTRAINT \"working_document_updates_sequence_check\" CHECK (\"sequence\" between 1 and 9007199254740991),\n	CONSTRAINT \"working_document_updates_update_check\" CHECK (octet_length(\"update\") > 0)\n);\n",
-			"\nCREATE TABLE \"working_documents\" (\n	\"document_id\" uuid PRIMARY KEY,\n	\"format_version\" integer NOT NULL,\n	\"generation_id\" uuid NOT NULL,\n	\"state\" bytea NOT NULL,\n	\"saved_state_vector\" bytea NOT NULL,\n	\"saved_version\" uuid NOT NULL,\n	\"next_update_sequence\" bigint DEFAULT 1 NOT NULL,\n	\"updated_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"working_documents_generation_unique\" UNIQUE(\"document_id\",\"generation_id\"),\n	CONSTRAINT \"working_documents_format_version_check\" CHECK (\"format_version\" = 1),\n	CONSTRAINT \"working_documents_state_check\" CHECK (octet_length(\"state\") > 0),\n	CONSTRAINT \"working_documents_saved_state_vector_check\" CHECK (octet_length(\"saved_state_vector\") > 0),\n	CONSTRAINT \"working_documents_next_update_sequence_check\" CHECK (\"next_update_sequence\" between 1 and 9007199254740991)\n);\n",
-			"\nCREATE INDEX \"activity_entries_history\" ON \"activity_entries\" (\"occurred_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST);",
-			"\nCREATE INDEX \"activity_entries_actor\" ON \"activity_entries\" (\"actor_id\",\"occurred_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST);",
-			"\nCREATE INDEX \"activity_entries_target\" ON \"activity_entries\" (\"target_kind\",\"target_id\",\"occurred_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST);",
-			"\nCREATE INDEX \"activity_entries_request\" ON \"activity_entries\" (\"request_id\");",
-			"\nCREATE INDEX \"auth_accounts_user_id\" ON \"auth_accounts\" (\"user_id\");",
-			"\nCREATE UNIQUE INDEX \"auth_accounts_identity\" ON \"auth_accounts\" (\"issuer\",\"account_id\");",
-			"\nCREATE INDEX \"auth_sessions_user_id\" ON \"auth_sessions\" (\"user_id\");",
-			"\nCREATE INDEX \"auth_verifications_identifier\" ON \"auth_verifications\" (\"identifier\");",
-			"\nCREATE INDEX \"change_receipts_activity\" ON \"change_receipts\" (\"activity_id\");",
-			"\nCREATE INDEX \"document_media_references_object_key\" ON \"document_media_references\" (\"object_key\");",
-			"\nCREATE INDEX \"document_revisions_history\" ON \"document_revisions\" (\"document_id\",\"created_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST);",
-			"\nCREATE UNIQUE INDEX \"documents_active_path\" ON \"documents\" (\"source_path\") WHERE \"deleted_at\" is null;",
-			"\nCREATE INDEX \"media_assets_catalog\" ON \"media_assets\" (\"created_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST) WHERE \"status\" = 'ready';",
-			"\nCREATE INDEX \"media_assets_folder\" ON \"media_assets\" (\"folder\",\"created_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST) WHERE \"status\" = 'ready';",
-			"\nCREATE INDEX \"media_assets_recovery\" ON \"media_assets\" (\"updated_at\",\"id\") WHERE \"status\" <> 'ready';",
-			"\nCREATE INDEX \"media_replacements_recovery\" ON \"media_replacements\" (\"updated_at\",\"media_id\");",
-			"\nCREATE UNIQUE INDEX \"pending_changes_subject\" ON \"pending_changes\" (\"subject\");",
-			"\nCREATE INDEX \"pending_changes_recovery\" ON \"pending_changes\" (\"scope\",\"updated_at\",\"id\");",
-			"\nCREATE UNIQUE INDEX \"working_document_publish_attempts_active\" ON \"working_document_publish_attempts\" (\"document_id\") WHERE \"phase\" in ('pending', 'checkpointed');",
-			"\nCREATE INDEX \"working_document_publish_attempts_recovery\" ON \"working_document_publish_attempts\" (\"document_id\",\"created_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST);",
-			"\nALTER TABLE \"auth_accounts\" ADD CONSTRAINT \"auth_accounts_user_id_auth_users_id_fkey\" FOREIGN KEY (\"user_id\") REFERENCES \"auth_users\"(\"id\") ON DELETE CASCADE;",
-			"\nALTER TABLE \"auth_sessions\" ADD CONSTRAINT \"auth_sessions_user_id_auth_users_id_fkey\" FOREIGN KEY (\"user_id\") REFERENCES \"auth_users\"(\"id\") ON DELETE CASCADE;",
-			"\nALTER TABLE \"change_receipts\" ADD CONSTRAINT \"change_receipts_activity_id_activity_entries_id_fkey\" FOREIGN KEY (\"activity_id\") REFERENCES \"activity_entries\"(\"id\") ON DELETE RESTRICT;",
-			"\nALTER TABLE \"document_heads\" ADD CONSTRAINT \"document_heads_document_id_documents_id_fkey\" FOREIGN KEY (\"document_id\") REFERENCES \"documents\"(\"id\") ON DELETE RESTRICT;",
-			"\nALTER TABLE \"document_heads\" ADD CONSTRAINT \"document_heads_authored_revision_fkey\" FOREIGN KEY (\"document_id\",\"authored_revision_id\") REFERENCES \"document_revisions\"(\"document_id\",\"id\") ON DELETE RESTRICT;",
-			"\nALTER TABLE \"document_heads\" ADD CONSTRAINT \"document_heads_published_revision_fkey\" FOREIGN KEY (\"document_id\",\"published_revision_id\") REFERENCES \"document_revisions\"(\"document_id\",\"id\") ON DELETE RESTRICT;",
-			"\nALTER TABLE \"document_media_references\" ADD CONSTRAINT \"document_media_references_document_id_documents_id_fkey\" FOREIGN KEY (\"document_id\") REFERENCES \"documents\"(\"id\") ON DELETE CASCADE;",
-			"\nALTER TABLE \"document_revisions\" ADD CONSTRAINT \"document_revisions_document_id_documents_id_fkey\" FOREIGN KEY (\"document_id\") REFERENCES \"documents\"(\"id\") ON DELETE RESTRICT;",
-			"\nALTER TABLE \"media_replacements\" ADD CONSTRAINT \"media_replacements_media_id_media_assets_id_fkey\" FOREIGN KEY (\"media_id\") REFERENCES \"media_assets\"(\"id\") ON DELETE RESTRICT;",
-			"\nALTER TABLE \"working_document_publish_attempts\" ADD CONSTRAINT \"working_document_publish_attempts_document_generation_fkey\" FOREIGN KEY (\"document_id\",\"expected_generation\") REFERENCES \"working_documents\"(\"document_id\",\"generation_id\") ON DELETE CASCADE;",
-			"\nALTER TABLE \"working_document_publish_attempts\" ADD CONSTRAINT \"working_document_publish_attempts_expected_version_fkey\" FOREIGN KEY (\"document_id\",\"expected_version\") REFERENCES \"document_revisions\"(\"document_id\",\"id\") ON DELETE RESTRICT;",
-			"\nALTER TABLE \"working_document_publish_attempts\" ADD CONSTRAINT \"working_document_publish_attempts_checkpoint_version_fkey\" FOREIGN KEY (\"document_id\",\"checkpoint_version\") REFERENCES \"document_revisions\"(\"document_id\",\"id\") ON DELETE RESTRICT;",
-			"\nALTER TABLE \"working_document_updates\" ADD CONSTRAINT \"working_document_updates_document_generation_fkey\" FOREIGN KEY (\"document_id\",\"generation_id\") REFERENCES \"working_documents\"(\"document_id\",\"generation_id\") ON DELETE CASCADE;",
-			"\nALTER TABLE \"working_documents\" ADD CONSTRAINT \"working_documents_document_id_documents_id_fkey\" FOREIGN KEY (\"document_id\") REFERENCES \"documents\"(\"id\") ON DELETE CASCADE;",
-			"\nALTER TABLE \"working_documents\" ADD CONSTRAINT \"working_documents_saved_version_fkey\" FOREIGN KEY (\"document_id\",\"saved_version\") REFERENCES \"document_revisions\"(\"document_id\",\"id\") ON DELETE RESTRICT;"
-		],
-		bps: true,
-		folderMillis: 1788466567e3,
-		hash: "943a4996ef8c4324bd58280a80103e5a1632b088880164904b3857686e26f33e",
-		name: "20260903201607_cms_baseline"
-	},
-	{
-		sql: [
-			"ALTER TABLE \"auth_rate_limits\" ADD COLUMN \"id\" uuid DEFAULT gen_random_uuid();",
-			"\nALTER TABLE \"auth_rate_limits\" DROP CONSTRAINT \"auth_rate_limits_pkey\";",
-			"\nALTER TABLE \"auth_rate_limits\" ADD PRIMARY KEY (\"id\");",
-			"\nALTER TABLE \"auth_rate_limits\" ADD CONSTRAINT \"auth_rate_limits_key_key\" UNIQUE(\"key\");"
-		],
-		bps: true,
-		folderMillis: 1788587191e3,
-		hash: "78b837c6b72a3de22d68e8db90bd211e61a0b97ff29bf8d16a0bba245eefa7ed",
-		name: "20260905054631_burly_northstar"
-	},
-	{
-		sql: ["ALTER TABLE \"auth_accounts\" DROP COLUMN \"issuer\";", "\nCREATE UNIQUE INDEX \"auth_accounts_identity\" ON \"auth_accounts\" (\"provider_id\",\"account_id\");"],
-		bps: true,
-		folderMillis: 178875937e4,
-		hash: "e442485fa6c2d611e3dae508a12d245481bc5ec8f2dd4f5d853910df34484787",
-		name: "20260907053610_fancy_lady_deathstrike"
-	},
-	{
-		sql: ["ALTER TABLE \"activity_entries\" DROP CONSTRAINT \"activity_entries_action_check\", ADD CONSTRAINT \"activity_entries_action_check\" CHECK (\"action\" in ('document.created', 'document.updated', 'document.moved', 'document.trashed', 'document.revision.restored', 'document.untrashed', 'document.published', 'document.unpublished', 'media.uploaded', 'media.replaced', 'media.removed', 'media.cleaned', 'user.created', 'user.removed', 'user.role.changed', 'user.sessions.revoked', 'authentication.signed-in', 'authentication.signed-out', 'authentication.password.changed', 'authentication.password.reset'));", "\nALTER TABLE \"pending_changes\" DROP CONSTRAINT \"pending_changes_action_check\", ADD CONSTRAINT \"pending_changes_action_check\" CHECK (\"action\" in ('document.created', 'document.updated', 'document.moved', 'document.trashed', 'document.revision.restored', 'document.untrashed', 'document.published', 'document.unpublished', 'media.uploaded', 'media.replaced', 'media.removed', 'media.cleaned', 'user.created', 'user.removed', 'user.role.changed', 'user.sessions.revoked', 'authentication.signed-in', 'authentication.signed-out', 'authentication.password.changed', 'authentication.password.reset'));"],
-		bps: true,
-		folderMillis: 1788866265e3,
-		hash: "24c56a37796caf8d76c0a97128a382b31e71808aa5b0ca7e5bac96795f9e16c7",
-		name: "20260908111745_classy_johnny_storm"
-	},
-	{
-		sql: [
-			"CREATE TABLE \"seo_media_references\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"scope\" text NOT NULL,\n	\"media_id\" uuid NOT NULL,\n	CONSTRAINT \"seo_media_references_scope_media_unique\" UNIQUE(\"scope\",\"media_id\"),\n	CONSTRAINT \"seo_media_references_scope_check\" CHECK (\"scope\" in ('working', 'published'))\n);\n",
-			"\nCREATE TABLE \"seo_revisions\" (\n	\"id\" uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n	\"settings\" jsonb NOT NULL,\n	\"actor_id\" text NOT NULL,\n	\"actor_email\" text NOT NULL,\n	\"actor_name\" text NOT NULL,\n	\"actor_roles\" jsonb NOT NULL,\n	\"request_id\" uuid NOT NULL,\n	\"reason\" text,\n	\"created_at\" timestamp with time zone DEFAULT transaction_timestamp() NOT NULL,\n	CONSTRAINT \"seo_revisions_actor_roles_check\" CHECK (jsonb_typeof(\"actor_roles\") = 'array'),\n	CONSTRAINT \"seo_revisions_settings_check\" CHECK (jsonb_typeof(\"settings\") = 'object')\n);\n",
-			"\nCREATE TABLE \"seo_state\" (\n	\"singleton\" boolean PRIMARY KEY DEFAULT true,\n	\"working_revision_id\" uuid NOT NULL,\n	\"published_revision_id\" uuid NOT NULL,\n	CONSTRAINT \"seo_state_singleton_check\" CHECK (\"singleton\")\n);\n",
-			"\nCREATE INDEX \"seo_media_references_media\" ON \"seo_media_references\" (\"media_id\");",
-			"\nCREATE INDEX \"seo_revisions_history\" ON \"seo_revisions\" (\"created_at\" DESC NULLS LAST,\"id\" DESC NULLS LAST);",
-			"\nALTER TABLE \"seo_media_references\" ADD CONSTRAINT \"seo_media_references_media_id_media_assets_id_fkey\" FOREIGN KEY (\"media_id\") REFERENCES \"media_assets\"(\"id\") ON DELETE RESTRICT;",
-			"\nALTER TABLE \"seo_state\" ADD CONSTRAINT \"seo_state_working_revision_fkey\" FOREIGN KEY (\"working_revision_id\") REFERENCES \"seo_revisions\"(\"id\") ON DELETE RESTRICT;",
-			"\nALTER TABLE \"seo_state\" ADD CONSTRAINT \"seo_state_published_revision_fkey\" FOREIGN KEY (\"published_revision_id\") REFERENCES \"seo_revisions\"(\"id\") ON DELETE RESTRICT;",
-			"\nALTER TABLE \"activity_entries\" DROP CONSTRAINT \"activity_entries_action_check\", ADD CONSTRAINT \"activity_entries_action_check\" CHECK (\"action\" in ('document.created', 'document.updated', 'document.moved', 'document.trashed', 'document.revision.restored', 'document.untrashed', 'document.published', 'document.unpublished', 'media.uploaded', 'media.replaced', 'media.removed', 'media.cleaned', 'seo.saved', 'seo.published', 'user.created', 'user.removed', 'user.role.changed', 'user.sessions.revoked', 'authentication.signed-in', 'authentication.signed-out', 'authentication.password.changed', 'authentication.password.reset'));",
-			"\nALTER TABLE \"activity_entries\" DROP CONSTRAINT \"activity_entries_target_kind_check\", ADD CONSTRAINT \"activity_entries_target_kind_check\" CHECK (\"target_kind\" in ('document', 'media', 'media-library', 'seo', 'user'));",
-			"\nALTER TABLE \"activity_entries\" DROP CONSTRAINT \"activity_entries_target_check\", ADD CONSTRAINT \"activity_entries_target_check\" CHECK ((\"target_kind\" in ('media-library', 'seo') AND \"target_id\" IS NULL)\n        OR (\"target_kind\" not in ('media-library', 'seo') AND \"target_id\" IS NOT NULL));",
-			"\nALTER TABLE \"pending_changes\" DROP CONSTRAINT \"pending_changes_action_check\", ADD CONSTRAINT \"pending_changes_action_check\" CHECK (\"action\" in ('document.created', 'document.updated', 'document.moved', 'document.trashed', 'document.revision.restored', 'document.untrashed', 'document.published', 'document.unpublished', 'media.uploaded', 'media.replaced', 'media.removed', 'media.cleaned', 'seo.saved', 'seo.published', 'user.created', 'user.removed', 'user.role.changed', 'user.sessions.revoked', 'authentication.signed-in', 'authentication.signed-out', 'authentication.password.changed', 'authentication.password.reset'));"
-		],
-		bps: true,
-		folderMillis: 1789233351e3,
-		hash: "8e6a6abf5385ab3ecf8eb083c1923ac9c74d72aa71bd1d444b7402d3e7e77000",
-		name: "20260912171551_charming_valkyrie"
-	}
-];
-
-//#endregion
-//#region ../sql-pg/src/internal/documents/tables.ts
-const cmsState = pgTable("cms_state", {
-	singleton: boolean().default(true).primaryKey(),
-	generation: bigint({ mode: "bigint" }).default(sql`0`).notNull()
-}, (table) => [check("cms_state_singleton_check", sql`${table.singleton}`), check("cms_state_generation_check", sql`${table.generation} >= 0`)]);
-const documentsTable = pgTable("documents", {
-	id: uuid().defaultRandom().primaryKey(),
-	sourcePath: text("source_path").notNull(),
-	deletedAt: timestamp("deleted_at", {
-		mode: "string",
-		withTimezone: true
-	}),
-	createdAt: timestamp("created_at", {
-		mode: "string",
-		withTimezone: true
-	}).default(transactionTimestamp).notNull(),
-	updatedAt: timestamp("updated_at", {
-		mode: "string",
-		withTimezone: true
-	}).default(transactionTimestamp).notNull()
-}, (table) => [uniqueIndex("documents_active_path").on(table.sourcePath).where(sql`${table.deletedAt} is null`)]);
-const documentRevisions = pgTable("document_revisions", {
-	id: uuid().defaultRandom().primaryKey(),
-	documentId: uuid("document_id").notNull().references(() => documentsTable.id, { onDelete: "restrict" }),
-	action: text({ enum: DOCUMENT_REVISION_ACTIONS }).notNull(),
-	sourcePath: text("source_path").notNull(),
-	markdown: text().notNull(),
-	actorId: text("actor_id").notNull(),
-	actorEmail: text("actor_email").notNull(),
-	actorName: text("actor_name").notNull(),
-	actorRoles: jsonb("actor_roles").$type().notNull(),
-	requestId: uuid("request_id").notNull(),
-	reason: text(),
-	activityDetails: jsonb("activity_details").$type().default({}).notNull(),
-	createdAt: timestamp("created_at", {
-		mode: "string",
-		withTimezone: true
-	}).default(transactionTimestamp).notNull()
-}, (table) => [
-	check("document_revisions_action_check", isOneOf(table.action, DOCUMENT_REVISION_ACTIONS)),
-	unique("document_revisions_document_id_unique").on(table.documentId, table.id),
-	index("document_revisions_history").on(table.documentId, table.createdAt.desc(), table.id.desc())
-]);
-const documentHeads = pgTable("document_heads", {
-	documentId: uuid("document_id").primaryKey().references(() => documentsTable.id, { onDelete: "restrict" }),
-	authoredRevisionId: uuid("authored_revision_id").notNull(),
-	publishedRevisionId: uuid("published_revision_id")
-}, (table) => [foreignKey({
-	columns: [table.documentId, table.authoredRevisionId],
-	foreignColumns: [documentRevisions.documentId, documentRevisions.id],
-	name: "document_heads_authored_revision_fkey"
-}).onDelete("restrict"), foreignKey({
-	columns: [table.documentId, table.publishedRevisionId],
-	foreignColumns: [documentRevisions.documentId, documentRevisions.id],
-	name: "document_heads_published_revision_fkey"
-}).onDelete("restrict")]);
-const documentMediaReferences = pgTable("document_media_references", {
-	id: uuid().defaultRandom().primaryKey(),
-	documentId: uuid("document_id").notNull().references(() => documentsTable.id, { onDelete: "cascade" }),
-	objectKey: text("object_key").notNull(),
-	path: text().notNull(),
-	sourcePath: text("source_path").notNull(),
-	nodePath: integer("node_path").array().notNull()
-}, (table) => [
-	unique("document_media_references_identity_unique").on(table.documentId, table.sourcePath, table.nodePath, table.objectKey),
-	check("document_media_references_object_key_check", sql`char_length(${table.objectKey}) between 1 and 1024
-        AND btrim(${table.objectKey}) = ${table.objectKey}
-        AND ${table.objectKey} !~ '(^/|/$|//|(^|/)\\.{1,2}(/|$)|[[:cntrl:]])'
-        AND position(chr(92) in ${table.objectKey}) = 0`),
-	check("document_media_references_node_path_check", sql`array_position(${table.nodePath}, NULL) IS NULL AND 0 <= ALL(${table.nodePath})`),
-	index("document_media_references_object_key").on(table.objectKey)
-]);
-
-//#endregion
-//#region ../sql-pg/src/internal/initialization/tables.ts
-const INITIALIZATION_STATES = [
-	"uninitialized",
-	"claiming",
-	"ready"
-];
-const initializationState = pgTable("initialization_state", {
-	singleton: boolean().default(true).primaryKey(),
-	state: text({ enum: INITIALIZATION_STATES }).default("uninitialized").notNull(),
-	changeId: uuid("change_id"),
-	claim: jsonb().$type()
-}, (table) => [
-	check("initialization_state_singleton_check", sql`${table.singleton}`),
-	check("initialization_state_state_check", isOneOf(table.state, INITIALIZATION_STATES)),
-	check("initialization_state_claim_check", sql`(${table.state} = 'claiming' AND ${table.changeId} IS NOT NULL AND jsonb_typeof(${table.claim}) = 'object')
-        OR (${table.state} <> 'claiming' AND ${table.changeId} IS NULL AND ${table.claim} IS NULL)`)
-]);
-
-//#endregion
-//#region ../sql-pg/src/internal/database/migrations.ts
-const MIGRATION_LOCK_KEY = "cms:database-migrations:v1";
-const migrateCmsDatabase = Effect.fn("CmsDatabase.migrate")(function* () {
-	const postgres = yield* PgClient.PgClient;
-	const database = yield* PgDrizzle.makeWithDefaults();
-	yield* postgres.withTransaction(Effect.gen(function* () {
-		yield* postgres.unsafe("select pg_advisory_xact_lock(hashtextextended($1, 0))", [MIGRATION_LOCK_KEY]);
-		yield* migrate(embeddedMigrations, database._.session, "__drizzle_migrations");
-		yield* database.insert(cmsState).values({}).onConflictDoNothing({ target: cmsState.singleton });
-		yield* database.insert(initializationState).values({}).onConflictDoNothing({ target: initializationState.singleton });
-	}));
-});
-const cmsDatabaseMigrationLayer = Layer.effectDiscard(migrateCmsDatabase());
-
 //#endregion
 //#region ../sql-pg/src/internal/documents/commands.ts
 const isEffectDrizzleQueryError = Schema.is(EffectDrizzleQueryError);
@@ -8078,21 +8172,32 @@ function notifyWorkingDocumentChange(database, kind, documentId, generationId) {
 * Mutations that span seams remain transactions inside this adapter.
 */
 function postgresLayer(options) {
-	const database = PgClient.layer({
-		...options,
+	const { schema, ...poolOptions } = options;
+	const clientOptions = {
+		...poolOptions,
 		applicationName: options.applicationName ?? "@internal/sql-pg"
-	});
-	const migrations = cmsDatabaseMigrationLayer.pipe(Layer.provide(database));
-	const locks = postgresAdvisoryLockLayer(options);
-	return Layer.mergeAll(postgresActivityStoreLayer, changeJournalLayer, documentStoreLayer, mediaStoreLayer, seoStoreLayer, initializationStoreLayer.pipe(Layer.provide(locks)), postgresUserCommandFenceLayer.pipe(Layer.provide(locks)), postgresWorkingDocumentChangesLayer(options), workingDocumentStoreLayer).pipe(Layer.provide(migrations), Layer.provide(database));
+	};
+	const database = schemaClientLayer(clientOptions, schema);
+	const migrations = cmsDatabaseMigrationLayer(schema).pipe(Layer.provide(database));
+	const locks = postgresAdvisoryLockLayer(poolOptions);
+	return Layer.mergeAll(postgresActivityStoreLayer, changeJournalLayer, documentStoreLayer, mediaStoreLayer, seoStoreLayer, initializationStoreLayer.pipe(Layer.provide(locks)), postgresUserCommandFenceLayer.pipe(Layer.provide(locks)), postgresWorkingDocumentChangesLayer(poolOptions), workingDocumentStoreLayer).pipe(Layer.provide(migrations), Layer.provide(database));
 }
 
 //#endregion
 //#region src/runtime/installation.ts
+var DatabaseSchemaProvisionFailed = class extends Schema.TaggedError()("NuxtCmsInstallation.DatabaseSchemaProvisionFailed", {
+	cause: Schema.Defect(),
+	schema: Schema.String
+}) {};
 const installCms = Effect.fn("NuxtCmsInstallation.install")(function* (options) {
+	yield* provisionDatabaseSchema(options.database);
 	const crypto = NodeCrypto.layer;
-	const postgres = postgresLayer({ url: Redacted.make(options.databaseUrl) });
-	const identity = Layer.unwrap(Effect.acquireRelease(Effect.sync(() => new Pool({ connectionString: options.databaseUrl })), (pool) => Effect.promise(() => pool.end()).pipe(Effect.asVoid)).pipe(Effect.map((pool) => betterAuthLayer({
+	const databaseUrl = scopedDatabaseUrl(options.database);
+	const postgres = postgresLayer({
+		schema: options.database.schema,
+		url: Redacted.make(options.database.url)
+	});
+	const identity = Layer.unwrap(Effect.acquireRelease(Effect.sync(() => new Pool({ connectionString: databaseUrl })), (pool) => Effect.promise(() => pool.end()).pipe(Effect.asVoid)).pipe(Effect.map((pool) => betterAuthLayer({
 		baseURL: options.baseUrl,
 		database: pool,
 		secret: `cms-authentication:${options.secret}`
@@ -8119,6 +8224,16 @@ const installCms = Effect.fn("NuxtCmsInstallation.install")(function* (options)
 		studioSecret: Redacted.make(`cms-collaboration:${options.secret}`)
 	});
 });
+const provisionDatabaseSchema = Effect.fn("NuxtCmsInstallation.provisionDatabaseSchema")(function* (database) {
+	const pool = new Pool({ connectionString: database.url });
+	yield* Effect.tryPromise({
+		try: () => pool.query(`create schema if not exists "${database.schema}"`),
+		catch: (cause) => new DatabaseSchemaProvisionFailed({
+			cause,
+			schema: database.schema
+		})
+	}).pipe(Effect.ensuring(Effect.promise(() => pool.end())));
+});
 function toS3MediaObjectStoreOptions(options) {
 	const { credentials: authoredCredentials, publicBaseUrl: _publicBaseUrl, ...storeOptions } = options;
 	if (!authoredCredentials) return storeOptions;
@@ -8135,7 +8250,13 @@ function toS3MediaObjectStoreOptions(options) {
 		credentials
 	};
 }
+function scopedDatabaseUrl(database) {
+	if (!/^[a-z_][a-z0-9_]{0,62}$/u.test(database.schema)) throw new Error("Invalid CMS PostgreSQL schema.");
+	const url = new URL(database.url);
+	url.searchParams.set("options", `-csearch_path=${database.schema}`);
+	return url.href;
+}
 
 //#endregion
-export { toS3MediaObjectStoreOptions as n, installCms as t };
-//# sourceMappingURL=installation-CNfIriVm.js.map
+export { embeddedMigrations as a, createCmsBetterAuth as i, scopedDatabaseUrl as n, toS3MediaObjectStoreOptions as r, installCms as t };
+//# sourceMappingURL=installation-DsGst1BH.js.map