@shapio/cms 0.3.1 → 0.4.0

package/dist/{worker-BAmQPoTJ.js → worker-i1rY2TIZ.js}

@@ -3,7 +3,7 @@ import { createRequire } from "node:module";
 import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { createReadStream, createWriteStream, existsSync, readFileSync, statSync } from "node:fs";
 import { dirname, join, relative, resolve, sep } from "node:path";
-import Fastify from "fastify";
+import Fastify, { LogController } from "fastify";
 import { AliasNode, AndNode, BinaryOperationNode, ColumnNode, ColumnUpdateNode, IdentifierNode, InsertQueryNode, Kysely, ListNode, MysqlAdapter, MysqlIntrospector, MysqlQueryCompiler, OnDuplicateKeyNode, OperationNodeTransformer, OperatorNode, OrNode, OrderByItemNode, ParensNode, PostgresDialect, PrimitiveValueListNode, RawNode, ReferenceNode, SelectAllNode, SelectModifierNode, SelectQueryNode, SelectionNode, SqliteAdapter, SqliteIntrospector, SqliteQueryCompiler, TableNode, UpdateQueryNode, ValueListNode, ValueNode, ValuesNode, WhereNode, sql } from "kysely";
 import pg from "pg";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -1857,9 +1857,10 @@ const MYSQL_TABLES = {
 			"is_primary",
 			"version",
 			"created_at",
-			"updated_at"
+			"updated_at",
+			"seo_defaults"
 		],
-		nullable: [],
+		nullable: ["seo_defaults"],
 		timestamps: ["created_at", "updated_at"],
 		uniqueKeys: [
 			{
@@ -2401,7 +2402,7 @@ const lockingKeySelect = (table, key, node, extra) => {
 		limit: node.limit
 	}));
 };
-const keysOf$1 = (rows, key, bySubquery) => rows.map((row) => bySubquery ? [Object.values(row)[0]] : key.map((_, index) => row[`__shapio_key_${index}`]));
+const keysOf$2 = (rows, key, bySubquery) => rows.map((row) => bySubquery ? [Object.values(row)[0]] : key.map((_, index) => row[`__shapio_key_${index}`]));
 const updatePlan = (node, compile) => {
 	const table = tableOf(node.table, "UPDATE");
 	if (node.from || node.joins?.length) throw new Error(`MySQL: UPDATE … FROM/JOIN on ${table} cannot use RETURNING`);
@@ -2409,7 +2410,7 @@ const updatePlan = (node, compile) => {
 	const bySubquery = keySubquery(node.where, key) !== void 0;
 	const lock = compile(lockingKeySelect(table, key, node, []));
 	return (context) => context.atomically(async () => {
-		const keys = keysOf$1((await context.run(lock)).rows, key, bySubquery);
+		const keys = keysOf$2((await context.run(lock)).rows, key, bySubquery);
 		if (keys.length === 0) return resultOf$2([], 0);
 		await context.run(compile(Object.freeze({
 			...node,
@@ -2429,7 +2430,7 @@ const deletePlan = (node, compile) => {
 	const lock = compile(lockingKeySelect(table, key, node, node.returning.selections));
 	return (context) => context.atomically(async () => {
 		const locked = (await context.run(lock)).rows;
-		const keys = keysOf$1(locked, key, false);
+		const keys = keysOf$2(locked, key, false);
 		if (keys.length === 0) return resultOf$2([], 0);
 		await context.run(compile(Object.freeze({
 			...node,
@@ -5150,7 +5151,7 @@ const NODE_KEYS = /* @__PURE__ */ new Set([
 	"marks"
 ]);
 const MAX_PROBLEMS = 20;
-const isRecord$13 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isRecord$14 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const fail = (walk, path, message) => {
 	if (walk.problems.length < MAX_PROBLEMS) walk.problems.push({
 		path,
@@ -5158,7 +5159,7 @@ const fail = (walk, path, message) => {
 	});
 };
 const checkAttrs = (walk, path, rules, raw) => {
-	if (raw !== void 0 && !isRecord$13(raw)) return fail(walk, `${path}/attrs`, "must be an object");
+	if (raw !== void 0 && !isRecord$14(raw)) return fail(walk, `${path}/attrs`, "must be an object");
 	const given = raw ?? {};
 	const attrs = {};
 	for (const key of Object.keys(given)) if (!rules || !Object.hasOwn(rules, key)) fail(walk, `${path}/attrs/${key}`, "is not an allowed attribute");
@@ -5180,7 +5181,7 @@ const checkMarks = (walk, path, raw, allowed) => {
 	const marks = [];
 	raw.forEach((mark, index) => {
 		const at = `${path}/marks/${index}`;
-		if (!isRecord$13(mark) || typeof mark.type !== "string" || !Object.hasOwn(MARK_RULES, mark.type)) {
+		if (!isRecord$14(mark) || typeof mark.type !== "string" || !Object.hasOwn(MARK_RULES, mark.type)) {
 			fail(walk, at, "is not an allowed mark");
 			return;
 		}
@@ -5201,7 +5202,7 @@ const matchesAllow = (allow, type) => {
 };
 const checkNode = (walk, raw, path, depth, context) => {
 	if (depth > 40) return fail(walk, path, "is nested too deeply");
-	if (!isRecord$13(raw) || typeof raw.type !== "string") return fail(walk, path, "must be a node with a type");
+	if (!isRecord$14(raw) || typeof raw.type !== "string") return fail(walk, path, "must be a node with a type");
 	const { type } = raw;
 	const rule = Object.hasOwn(NODE_RULES, type) ? NODE_RULES[type] : void 0;
 	if (!rule) return fail(walk, path, `"${type}" is not an allowed node`);
@@ -5254,7 +5255,7 @@ const validateRichText = (value) => {
 		problems: [],
 		textLength: 0
 	};
-	if (!isRecord$13(value)) return {
+	if (!isRecord$14(value)) return {
 		ok: false,
 		problems: [{
 			path: "",
@@ -5305,6 +5306,83 @@ const richTextMediaIds = (document) => {
 	return [...ids];
 };
 //#endregion
+//#region ../../packages/schema/dist/resolve-viddCEYd.js
+/**
+* The built-in SEO component (plan seo-fields). It is ordinary schema data, created through the change planner
+* and always shared with every site; what makes it "the" SEO component is its stable ID, never its API ID, so
+* a renamed or extended copy is still recognised and an unrelated `seo` component (an import) never is.
+*/
+const SEO_COMPONENT_ID = "f3905a00-d2a3-4c62-899a-c894bfd6cb9b";
+/** Stable field IDs of the built-in's fields. Resolver and admin look fields up by these. */
+const SEO_FIELD_IDS = {
+	title: "3fe294a9-6af9-4019-8b32-43010822e45a",
+	description: "6d1917f3-94a2-4391-ba1f-a98d14577b93",
+	image: "d27c9354-4afc-4583-93b4-367214a7714a",
+	canonical: "17b374b6-cd85-444e-8403-20c7458ed29e",
+	noindex: "e8346f99-dc3c-4b5c-906f-4854e03c9a57"
+};
+/** The built-in editor for a field holding the SEO component (preview and counters in the admin). */
+const SEO_EDITOR_ID = "seoEditor";
+/** A title template holds the placeholder exactly once, e.g. `%s · Acme`. */
+const SEO_TITLE_TEMPLATE_PATTERN = /^(?:(?!%s)[\s\S])*%s(?:(?!%s)[\s\S])*$/;
+/** A Twitter/X handle with its `@`. */
+const SEO_TWITTER_HANDLE_PATTERN = /^@[A-Za-z0-9_]{1,15}$/;
+/** No defaults saved yet. */
+const EMPTY_SEO_DEFAULTS = {
+	locales: {},
+	imageId: null,
+	twitterHandle: null
+};
+const isValidTitleTemplate = (template) => SEO_TITLE_TEMPLATE_PATTERN.test(template);
+/**
+* One locale's effective default texts: each key from the first locale of the chain that sets it (the
+* requested locale, then its fallbacks, then the default locale).
+*/
+const seoDefaultsForLocale = (defaults, localeChain) => {
+	const pick = (key) => localeChain.map((code) => defaults.locales[code]?.[key]).find((value) => value !== void 0);
+	const siteName = pick("siteName");
+	const titleTemplate = pick("titleTemplate");
+	const description = pick("description");
+	return {
+		...siteName !== void 0 ? { siteName } : {},
+		...titleTemplate !== void 0 ? { titleTemplate } : {},
+		...description !== void 0 ? { description } : {}
+	};
+};
+/** Applies a title template (`%s` replaced once); an invalid template leaves the title as is. */
+const applyTitleTemplate = (title, template) => template !== void 0 && isValidTitleTemplate(template) ? template.replace("%s", () => title) : title;
+/** The API IDs the built-in component is created with. */
+const DEFAULT_SEO_KEYS = {
+	title: "title",
+	description: "description",
+	image: "image",
+	canonical: "canonical",
+	noindex: "noindex"
+};
+const isRecord$13 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const text = (value) => typeof value === "string" && value.trim() !== "" ? value : null;
+/**
+* The effective SEO values of one delivered entry, in the same shape as the raw value (plan seo-fields): the
+* title is the entry's SEO title, else its own title, through the site's template (the bare site name when
+* neither exists, never templated); description and image fall back to the site's defaults; canonical stays
+* the entry's value or null; noindex is a boolean. Other keys (fields a user added) pass through. Pure.
+*/
+const resolveSeo = (raw, context) => {
+	const keys = context.keys ?? DEFAULT_SEO_KEYS;
+	const output = isRecord$13(raw) ? { ...raw } : {};
+	const value = (key) => keys[key] === void 0 ? void 0 : output[keys[key]];
+	const set = (key, next) => {
+		if (keys[key] !== void 0) output[keys[key]] = next;
+	};
+	const base = text(value("title")) ?? text(context.fallbackTitle);
+	set("title", base !== null ? applyTitleTemplate(base, context.defaults.titleTemplate) : context.defaults.siteName ?? null);
+	set("description", text(value("description")) ?? context.defaults.description ?? null);
+	set("image", value("image") ?? context.image ?? null);
+	set("canonical", text(value("canonical")));
+	set("noindex", value("noindex") === true);
+	return output;
+};
+//#endregion
 //#region ../../packages/schema/dist/index.js
 var import_pluralize = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function(root, pluralize) {
@@ -5811,7 +5889,7 @@ const STORAGE_FAMILY = {
 * defaulted properties may be omitted. `normalizeDefinition` turns input into the normalized types below,
 * which are what Shapio stores, hashes and diffs.
 */
-const closed$2$1 = { additionalProperties: false };
+const closed$3$1 = { additionalProperties: false };
 const MODEL_KINDS = ["collection", "singleton"];
 const DEFINITION_KINDS = [...MODEL_KINDS, "component"];
 const SORT_DIRECTIONS = ["asc", "desc"];
@@ -5827,7 +5905,7 @@ const EditorChoiceInputSchema = Type.Object({
 		maxLength: 128
 	}),
 	options: Type.Optional(Type.Record(Type.String(), Type.Unknown()))
-}, closed$2$1);
+}, closed$3$1);
 const FieldInputSchema = Type.Object({
 	id: Type.Optional(Type.String()),
 	apiKey: Type.String(),
@@ -5850,7 +5928,7 @@ const FieldInputSchema = Type.Object({
 	/** Type-specific settings, validated against SETTINGS_SCHEMAS[type]. */
 	settings: Type.Optional(Type.Record(Type.String(), Type.Unknown())),
 	editor: Type.Optional(EditorChoiceInputSchema)
-}, closed$2$1);
+}, closed$3$1);
 const FieldGroupSchema = Type.Object({
 	id: Type.String({
 		minLength: 1,
@@ -5858,7 +5936,7 @@ const FieldGroupSchema = Type.Object({
 	}),
 	label: Label,
 	fieldIds: Type.Array(Type.String())
-}, closed$2$1);
+}, closed$3$1);
 const ModelDisplayInputSchema = Type.Object({
 	/** Field whose value labels an entry in lists, pickers and relation summaries. */
 	titleFieldId: Type.Optional(Type.String()),
@@ -5867,7 +5945,7 @@ const ModelDisplayInputSchema = Type.Object({
 	defaultSort: Type.Optional(Type.Object({
 		fieldId: Type.String(),
 		direction: Type.Enum(SORT_DIRECTIONS)
-	}, closed$2$1)),
+	}, closed$3$1)),
 	/** Editor layout: named sections of the entry form. */
 	groups: Type.Optional(Type.Array(FieldGroupSchema)),
 	/** Fields rendered as blocks in the entry document's canvas, in order. Default: see `effectiveLayout`. */
@@ -5876,11 +5954,11 @@ const ModelDisplayInputSchema = Type.Object({
 	coverFieldId: Type.Optional(Type.String()),
 	/** Properties shown as chips in the document's strip. Default: the first non-empty ones. */
 	stripFieldIds: Type.Optional(Type.Array(Type.String()))
-}, closed$2$1);
+}, closed$3$1);
 const ComponentDisplayInputSchema = Type.Object({
 	titleFieldId: Type.Optional(Type.String()),
 	groups: Type.Optional(Type.Array(FieldGroupSchema))
-}, closed$2$1);
+}, closed$3$1);
 const definitionBase = {
 	id: Type.Optional(Type.String()),
 	apiKey: Type.String(),
@@ -5900,7 +5978,7 @@ const ModelDefinitionInputSchema = Type.Object({
 	/** Entries have separate draft and published states. Default true. */
 	draftAndPublish: Type.Optional(Type.Boolean()),
 	display: Type.Optional(ModelDisplayInputSchema)
-}, closed$2$1);
+}, closed$3$1);
 const ComponentDefinitionInputSchema = Type.Object({
 	...definitionBase,
 	kind: Type.Literal("component"),
@@ -5913,7 +5991,7 @@ const ComponentDefinitionInputSchema = Type.Object({
 		maxLength: 64
 	})),
 	display: Type.Optional(ComponentDisplayInputSchema)
-}, closed$2$1);
+}, closed$3$1);
 const DefinitionInputSchema = Type.Union([ModelDefinitionInputSchema, ComponentDefinitionInputSchema]);
 const isComponentDefinition = (definition) => definition.kind === "component";
 const isModelDefinition = (definition) => definition.kind !== "component";
@@ -5936,7 +6014,7 @@ const LocaleInputSchema = Type.Object({
 * enum values...). Each schema is closed (`additionalProperties: false`) so a typo in a hand-edited schema
 * file is reported instead of ignored. Defaults are applied by `normalizeDefinition`.
 */
-const closed$1$1 = { additionalProperties: false };
+const closed$2$1 = { additionalProperties: false };
 const NonNegativeInt = Type.Integer({ minimum: 0 });
 const pattern = (regex) => Type.String({ pattern: regex.source });
 const lengthRules = {
@@ -5964,7 +6042,7 @@ const EnumValueSchema = Type.Object({
 		minLength: 1,
 		maxLength: 200
 	})
-}, closed$1$1);
+}, closed$2$1);
 const SETTINGS_SCHEMAS = {
 	string: Type.Object({
 		...lengthRules,
@@ -5972,20 +6050,20 @@ const SETTINGS_SCHEMAS = {
 			minLength: 1,
 			maxLength: 500
 		}))
-	}, closed$1$1),
-	text: Type.Object(lengthRules, closed$1$1),
+	}, closed$2$1),
+	text: Type.Object(lengthRules, closed$2$1),
 	richtext: Type.Object({
 		formatVersion: Type.Optional(Type.Integer({ minimum: 1 })),
 		maxLength: Type.Optional(Type.Integer({ minimum: 1 }))
-	}, closed$1$1),
+	}, closed$2$1),
 	number: Type.Object({
 		min: Type.Optional(Type.Number()),
 		max: Type.Optional(Type.Number())
-	}, closed$1$1),
+	}, closed$2$1),
 	integer: Type.Object({
 		min: Type.Optional(Type.Integer()),
 		max: Type.Optional(Type.Integer())
-	}, closed$1$1),
+	}, closed$2$1),
 	decimal: Type.Object({
 		precision: Type.Optional(Type.Integer({
 			minimum: 1,
@@ -5997,68 +6075,70 @@ const SETTINGS_SCHEMAS = {
 		})),
 		min: Type.Optional(pattern(DECIMAL_PATTERN)),
 		max: Type.Optional(pattern(DECIMAL_PATTERN))
-	}, closed$1$1),
+	}, closed$2$1),
 	biginteger: Type.Object({
 		min: Type.Optional(pattern(BIGINTEGER_PATTERN)),
 		max: Type.Optional(pattern(BIGINTEGER_PATTERN))
-	}, closed$1$1),
-	boolean: Type.Object({}, closed$1$1),
+	}, closed$2$1),
+	boolean: Type.Object({}, closed$2$1),
 	date: Type.Object({
 		min: Type.Optional(pattern(DATE_PATTERN)),
 		max: Type.Optional(pattern(DATE_PATTERN))
-	}, closed$1$1),
+	}, closed$2$1),
 	datetime: Type.Object({
 		min: Type.Optional(pattern(DATETIME_PATTERN)),
 		max: Type.Optional(pattern(DATETIME_PATTERN))
-	}, closed$1$1),
+	}, closed$2$1),
 	time: Type.Object({
 		min: Type.Optional(pattern(TIME_PATTERN)),
 		max: Type.Optional(pattern(TIME_PATTERN))
-	}, closed$1$1),
+	}, closed$2$1),
 	enum: Type.Object({
 		values: Type.Array(EnumValueSchema, {
 			minItems: 1,
 			maxItems: 500
 		}),
 		multiple: Type.Optional(Type.Boolean())
-	}, closed$1$1),
-	json: Type.Object({}, closed$1$1),
+	}, closed$2$1),
+	json: Type.Object({}, closed$2$1),
 	slug: Type.Object({
 		...lengthRules,
 		sourceFieldId: Type.Optional(Type.String())
-	}, closed$1$1),
-	email: Type.Object({}, closed$1$1),
+	}, closed$2$1),
+	email: Type.Object({}, closed$2$1),
 	url: Type.Object({ protocols: Type.Optional(Type.Array(Type.Enum([
 		"http",
 		"https",
 		"mailto",
 		"tel"
-	]), { minItems: 1 })) }, closed$1$1),
-	uid: Type.Object(lengthRules, closed$1$1),
+	]), { minItems: 1 })) }, closed$2$1),
+	uid: Type.Object(lengthRules, closed$2$1),
 	media: Type.Object({
 		multiple: Type.Optional(Type.Boolean()),
 		allowedKinds: Type.Optional(Type.Array(Type.Enum(MEDIA_KINDS), { minItems: 1 })),
 		...countRules
-	}, closed$1$1),
+	}, closed$2$1),
 	relation: Type.Object({
 		target: Type.String(),
 		cardinality: Type.Enum(RELATION_CARDINALITIES),
 		...countRules
-	}, closed$1$1),
+	}, closed$2$1),
 	component: Type.Object({
 		component: Type.String(),
 		repeatable: Type.Optional(Type.Boolean()),
 		...countRules
-	}, closed$1$1),
+	}, closed$2$1),
 	dynamiczone: Type.Object({
 		components: Type.Array(Type.String(), {
 			minItems: 1,
 			maxItems: 100
 		}),
 		...countRules
-	}, closed$1$1)
+	}, closed$2$1)
 };
-const closed$12 = { additionalProperties: false };
+/** Whether a field holds the built-in SEO component (by stable ID, whatever its API ID or editor). */
+const isSeoField = (field) => field.type === "component" && field.settings.component === "f3905a00-d2a3-4c62-899a-c894bfd6cb9b" && !field.settings.repeatable;
+const closed$1$1 = { additionalProperties: false };
 const Placeholder = Type.Optional(Type.String({ maxLength: 200 }));
 const isMultipleEnum = (field) => field.type === "enum" && field.settings.multiple;
 const entries = [
@@ -6070,7 +6150,7 @@ const entries = [
 			"url",
 			"uid"
 		],
-		optionsSchema: Type.Object({ placeholder: Placeholder }, closed$12)
+		optionsSchema: Type.Object({ placeholder: Placeholder }, closed$1$1)
 	},
 	{
 		id: "textarea",
@@ -6081,7 +6161,7 @@ const entries = [
 				minimum: 2,
 				maximum: 40
 			}))
-		}, closed$12)
+		}, closed$1$1)
 	},
 	{
 		id: "color",
@@ -6089,12 +6169,12 @@ const entries = [
 		optionsSchema: Type.Object({
 			format: Type.Optional(Type.Enum(["hex", "rgb"])),
 			presets: Type.Optional(Type.Array(Type.String({ maxLength: 32 }), { maxItems: 50 }))
-		}, closed$12)
+		}, closed$1$1)
 	},
 	{
 		id: "richText",
 		dataTypes: ["richtext"],
-		optionsSchema: Type.Object({ toolbar: Type.Optional(Type.Enum(["full", "minimal"])) }, closed$12)
+		optionsSchema: Type.Object({ toolbar: Type.Optional(Type.Enum(["full", "minimal"])) }, closed$1$1)
 	},
 	{
 		id: "numberInput",
@@ -6107,17 +6187,17 @@ const entries = [
 		optionsSchema: Type.Object({
 			placeholder: Placeholder,
 			step: Type.Optional(Type.Number({ exclusiveMinimum: 0 }))
-		}, closed$12)
+		}, closed$1$1)
 	},
 	{
 		id: "toggle",
 		dataTypes: ["boolean"],
-		optionsSchema: Type.Object({}, closed$12)
+		optionsSchema: Type.Object({}, closed$1$1)
 	},
 	{
 		id: "checkbox",
 		dataTypes: ["boolean"],
-		optionsSchema: Type.Object({}, closed$12)
+		optionsSchema: Type.Object({}, closed$1$1)
 	},
 	{
 		id: "segmented",
@@ -6125,35 +6205,35 @@ const entries = [
 		optionsSchema: Type.Object({
 			trueLabel: Type.Optional(Type.String({ maxLength: 50 })),
 			falseLabel: Type.Optional(Type.String({ maxLength: 50 }))
-		}, closed$12),
+		}, closed$1$1),
 		supports: (field) => !isMultipleEnum(field)
 	},
 	{
 		id: "select",
 		dataTypes: ["enum"],
-		optionsSchema: Type.Object({ placeholder: Placeholder }, closed$12)
+		optionsSchema: Type.Object({ placeholder: Placeholder }, closed$1$1)
 	},
 	{
 		id: "radio",
 		dataTypes: ["enum"],
-		optionsSchema: Type.Object({ layout: Type.Optional(Type.Enum(["vertical", "horizontal"])) }, closed$12),
+		optionsSchema: Type.Object({ layout: Type.Optional(Type.Enum(["vertical", "horizontal"])) }, closed$1$1),
 		supports: (field) => !isMultipleEnum(field)
 	},
 	{
 		id: "checkboxGroup",
 		dataTypes: ["enum"],
-		optionsSchema: Type.Object({ layout: Type.Optional(Type.Enum(["vertical", "horizontal"])) }, closed$12),
+		optionsSchema: Type.Object({ layout: Type.Optional(Type.Enum(["vertical", "horizontal"])) }, closed$1$1),
 		supports: isMultipleEnum
 	},
 	{
 		id: "datePicker",
 		dataTypes: ["date"],
-		optionsSchema: Type.Object({}, closed$12)
+		optionsSchema: Type.Object({}, closed$1$1)
 	},
 	{
 		id: "dateTimePicker",
 		dataTypes: ["datetime"],
-		optionsSchema: Type.Object({ display: Type.Optional(Type.Enum(["local", "utc"])) }, closed$12)
+		optionsSchema: Type.Object({ display: Type.Optional(Type.Enum(["local", "utc"])) }, closed$1$1)
 	},
 	{
 		id: "timePicker",
@@ -6161,12 +6241,12 @@ const entries = [
 		optionsSchema: Type.Object({ stepMinutes: Type.Optional(Type.Integer({
 			minimum: 1,
 			maximum: 60
-		})) }, closed$12)
+		})) }, closed$1$1)
 	},
 	{
 		id: "slugInput",
 		dataTypes: ["slug"],
-		optionsSchema: Type.Object({ placeholder: Placeholder }, closed$12)
+		optionsSchema: Type.Object({ placeholder: Placeholder }, closed$1$1)
 	},
 	{
 		id: "jsonEditor",
@@ -6174,27 +6254,33 @@ const entries = [
 		optionsSchema: Type.Object({ rows: Type.Optional(Type.Integer({
 			minimum: 3,
 			maximum: 80
-		})) }, closed$12)
+		})) }, closed$1$1)
 	},
 	{
 		id: "mediaPicker",
 		dataTypes: ["media"],
-		optionsSchema: Type.Object({}, closed$12)
+		optionsSchema: Type.Object({}, closed$1$1)
 	},
 	{
 		id: "relationPicker",
 		dataTypes: ["relation"],
-		optionsSchema: Type.Object({ allowInlineCreate: Type.Optional(Type.Boolean()) }, closed$12)
+		optionsSchema: Type.Object({ allowInlineCreate: Type.Optional(Type.Boolean()) }, closed$1$1)
 	},
 	{
 		id: "componentEditor",
 		dataTypes: ["component"],
-		optionsSchema: Type.Object({ collapsed: Type.Optional(Type.Boolean()) }, closed$12)
+		optionsSchema: Type.Object({ collapsed: Type.Optional(Type.Boolean()) }, closed$1$1)
+	},
+	{
+		id: SEO_EDITOR_ID,
+		dataTypes: ["component"],
+		optionsSchema: Type.Object({}, closed$1$1),
+		supports: isSeoField
 	},
 	{
 		id: "dynamicZoneEditor",
 		dataTypes: ["dynamiczone"],
-		optionsSchema: Type.Object({ collapsed: Type.Optional(Type.Boolean()) }, closed$12)
+		optionsSchema: Type.Object({ collapsed: Type.Optional(Type.Boolean()) }, closed$1$1)
 	}
 ];
 const EDITOR_CATALOGUE = new Map(entries.map((entry) => [entry.id, entry]));
@@ -6595,7 +6681,10 @@ const RESERVED_TYPE_NAMES = [
 	"SnapshotChangeKind",
 	"SnapshotChangeLocale",
 	"SnapshotChangePage",
-	"SnapshotInfo"
+	"SnapshotInfo",
+	"SiteInfo",
+	"SiteSeoDefaults",
+	"SiteSeoLocale"
 ];
 /**
 * Model and component API keys the admin uses as static URL segments (`/content/new`,
@@ -6629,7 +6718,8 @@ const RESERVED_FIELD_API_KEYS = [
 const RESERVED_QUERY_NAMES = [
 	"_schemaVersion",
 	"_changes",
-	"_snapshot"
+	"_snapshot",
+	"_site"
 ];
 /** Every name a definition contributes to the GraphQL schema. */
 const generatedNames = (definition) => {
@@ -8007,7 +8097,9 @@ const BUILT_IN_THEME_KEYS = [
 	"shapio",
 	"classic",
 	"murdered-out",
-	"snowed"
+	"forest",
+	"snowed",
+	"butter"
 ];
 /**
 * A token value an extension may use: a hex colour or a colour function whose arguments are numbers, units
@@ -8117,6 +8209,85 @@ const checkThemeContrast = (tokens, variant) => {
 	};
 	return [...THEME_TEXT_PAIRS.map((pair) => measure(pair, 4.5)), ...uiPairs.map((pair) => measure(pair, 3))];
 };
+/**
+* The built-in SEO component as first created. All fields are public and none has a length limit: the 70 and
+* 160 character marks are admin-only counters (`SEO_TITLE_SOFT_MAX`), never validation.
+*/
+const seoComponentDefinition = () => normalizeDefinition({
+	id: SEO_COMPONENT_ID,
+	kind: "component",
+	apiKey: "seo",
+	label: "SEO",
+	description: "Search and social metadata: title, description, image, canonical URL and indexing.",
+	category: "Built-in",
+	icon: "search",
+	fields: [
+		{
+			id: SEO_FIELD_IDS.title,
+			apiKey: "title",
+			label: "Title",
+			type: "string"
+		},
+		{
+			id: SEO_FIELD_IDS.description,
+			apiKey: "description",
+			label: "Description",
+			type: "text"
+		},
+		{
+			id: SEO_FIELD_IDS.image,
+			apiKey: "image",
+			label: "Social image",
+			type: "media",
+			settings: {
+				multiple: false,
+				allowedKinds: ["image"]
+			}
+		},
+		{
+			id: SEO_FIELD_IDS.canonical,
+			apiKey: "canonical",
+			label: "Canonical URL",
+			type: "url",
+			settings: { protocols: ["https", "http"] }
+		},
+		{
+			id: SEO_FIELD_IDS.noindex,
+			apiKey: "noindex",
+			label: "Hide from search engines",
+			type: "boolean"
+		}
+	],
+	display: { titleFieldId: SEO_FIELD_IDS.title }
+});
+const closed$12 = { additionalProperties: false };
+/** Media asset IDs are UUIDs. */
+const ASSET_ID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+/** One locale's default texts. Every key is optional: a missing one falls back along the locale chain. */
+const SeoLocaleDefaultsSchema = Type.Object({
+	siteName: Type.Optional(Type.String({
+		minLength: 1,
+		maxLength: 200
+	})),
+	titleTemplate: Type.Optional(Type.String({
+		minLength: 2,
+		maxLength: 200,
+		pattern: SEO_TITLE_TEMPLATE_PATTERN.source
+	})),
+	description: Type.Optional(Type.String({
+		minLength: 1,
+		maxLength: 1e3
+	}))
+}, closed$12);
+/**
+* A site's SEO defaults (`sites.seo_defaults`): texts per locale code, the default social image (a public
+* image asset of the same site) and the Twitter handle for the whole site.
+*/
+const SeoDefaultsSchema = Type.Object({
+	locales: Type.Record(Type.String({ pattern: LOCALE_CODE_PATTERN.source }), SeoLocaleDefaultsSchema, { additionalProperties: false }),
+	imageId: Type.Union([Type.String({ pattern: ASSET_ID_PATTERN.source }), Type.Null()]),
+	twitterHandle: Type.Union([Type.String({ pattern: SEO_TWITTER_HANDLE_PATTERN.source }), Type.Null()])
+}, closed$12);
 //#endregion
 //#region src/content/model.ts
 const modelNotFound = (key) => new AppError(404, "MODEL_NOT_FOUND", `No content model "${key}"`, { modelKey: key });
@@ -10214,7 +10385,7 @@ const getPermissionsVersion = async (trx = db) => {
 	return (await trx.selectFrom("system_versions").select("permissions_version").executeTakeFirstOrThrow()).permissions_version;
 };
 /** Call in the same transaction as every permission change, so caches reload exactly when it commits. */
-const bumpPermissionsVersion = (trx = db) => trx.updateTable("system_versions").set((eb) => ({
+const bumpPermissionsVersion$2 = (trx = db) => trx.updateTable("system_versions").set((eb) => ({
 	permissions_version: eb("permissions_version", "+", eb.lit(1)),
 	updated_at: currentTimestamp()
 })).execute();
@@ -10264,7 +10435,8 @@ const SITE_ACTIONS = [
 	"deployments.manage",
 	"deployments.trigger",
 	"changes.manage",
-	"changes.ship"
+	"changes.ship",
+	"site.settings"
 ];
 const GLOBAL_ACTIONS = [...NETWORK_ACTIONS, ...SITE_ACTIONS];
 const EMPTY_MASK$1 = {
@@ -10360,7 +10532,7 @@ const ensureSystemRoles = async (database) => {
 			})), trx);
 			changed ||= added.length > 0;
 		}
-		if (changed) await bumpPermissionsVersion(trx);
+		if (changed) await bumpPermissionsVersion$2(trx);
 	});
 };
 //#endregion
@@ -10642,6 +10814,26 @@ const countContents = async (siteId, trx = db) => {
 	};
 };
 const deleteById$3 = (id, trx = db) => trx.deleteFrom("sites").where("id", "=", id).executeTakeFirst();
+/** A site's SEO defaults (null until first saved) and the version an update must name. */
+const findSeoDefaults = (id, trx = db) => trx.selectFrom("sites").select([
+	"id",
+	"key",
+	"name",
+	"version",
+	"seo_defaults"
+]).where("id", "=", id).executeTakeFirst();
+/** Optimistic update of the SEO defaults: applies only at `expectedVersion`; bumps the version. */
+const updateSeoDefaultsIfVersion = (id, expectedVersion, seoDefaults, trx = db) => trx.updateTable("sites").set((eb) => ({
+	seo_defaults: JSON.stringify(seoDefaults),
+	version: eb("version", "+", 1),
+	updated_at: /* @__PURE__ */ new Date()
+})).where("id", "=", id).where("version", "=", expectedVersion).returning([
+	"id",
+	"key",
+	"name",
+	"version",
+	"seo_defaults"
+]).executeTakeFirst();
 //#endregion
 //#region src/services/roleAssignments.ts
 const assignmentKey = (assignment) => `${assignment.roleId}:${assignment.siteId ?? "*"}`;
@@ -11949,8 +12141,9 @@ const groupByRole = (grants) => {
 };
 /**
 * Every role's grants, held in memory and reloaded when `system_versions.permissions_version` moves.
-* The version is read on every lookup: that durable check is what makes a permission change visible to
-* every instance at once (NOTIFY would only be an optimisation). Lookups on the pool share one reload; a
+* The version is checked on every lookup: read here, or read once by the request (`versions`, see
+* `KnownVersions`). That durable check is what makes a permission change visible to every instance from the
+* next request (NOTIFY would only be an optimisation). Lookups on the pool share one reload; a
 * lookup inside a transaction reads (and, when stale, reloads) through that transaction alone, never
 * through a reload running on another request's transaction.
 */
@@ -11969,21 +12162,21 @@ const createPermissionCache = (database) => {
 	const sharedReload = (version) => reloading ??= reload(version, database).finally(() => {
 		reloading = void 0;
 	});
-	const current = async (executor) => {
-		const version = await getPermissionsVersion(executor ?? database);
+	const current = async (executor, versions) => {
+		const version = versions?.permissionsVersion ?? await getPermissionsVersion(executor ?? database);
 		if (snapshot && snapshot.version === version) return snapshot;
 		const loaded = await (executor ? reload(version, executor) : sharedReload(version));
 		if (!snapshot || loaded.version >= snapshot.version) snapshot = loaded;
 		return loaded;
 	};
 	return {
-		getGrants: async (roleIds, executor) => {
+		getGrants: async (roleIds, executor, versions) => {
 			if (roleIds.length === 0) return [];
-			const { byRole } = await current(executor);
+			const { byRole } = await current(executor, versions);
 			return roleIds.flatMap((roleId) => byRole.get(roleId) ?? []);
 		},
-		getSiteAppRoleIds: async (siteId, audience, executor) => {
-			const { bindings } = await current(executor);
+		getSiteAppRoleIds: async (siteId, audience, executor, versions) => {
+			const { bindings } = await current(executor, versions);
 			return bindings.get(bindingKey(siteId, audience)) ?? [];
 		}
 	};
@@ -12074,7 +12267,7 @@ const APP_ACTIONS = new Set(APP_CONTENT_ACTIONS);
 * outside a site holds no role). Both are delivery audiences: they see `public: false` fields only where a
 * grant names them.
 */
-const rolesOf = async (principal, grants, executor) => {
+const rolesOf = async (principal, grants, executor, versions) => {
 	switch (principal.kind) {
 		case "system": return "all";
 		case "admin": return {
@@ -12095,13 +12288,13 @@ const rolesOf = async (principal, grants, executor) => {
 			actions: READ_ONLY$1
 		};
 		case "appUser": return {
-			roleIds: [...await grants.getSiteAppRoleIds(principal.siteId, "authenticated", executor), ...principal.roleIds],
+			roleIds: [...await grants.getSiteAppRoleIds(principal.siteId, "authenticated", executor, versions), ...principal.roleIds],
 			networkRoleIds: [],
 			audience: "delivery",
 			actions: APP_ACTIONS
 		};
 		case "anonymous": return {
-			roleIds: principal.siteId === null ? [] : await grants.getSiteAppRoleIds(principal.siteId, "public", executor),
+			roleIds: principal.siteId === null ? [] : await grants.getSiteAppRoleIds(principal.siteId, "public", executor, versions),
 			networkRoleIds: [],
 			audience: "delivery",
 			actions: APP_ACTIONS
@@ -12121,58 +12314,64 @@ const actsOnSite = (principal, siteId) => {
 };
 /**
 * The one permission evaluator (ADR 0005): principal → roles → grants → Policy, for REST and GraphQL.
-* Deny by default at every step.
-*/
-const createPermissionEvaluator = ({ grants, fields }) => ({
-	evaluate: async (principal, request, executor) => {
-		const roles = await rolesOf(principal, grants, executor);
-		if (roles === "all") return ALLOW_ALL_POLICY;
-		if (roles.actions !== "all" && !roles.actions.has(request.action)) return DENIED_POLICY;
-		let roleIds = roles.roleIds;
-		if (NETWORK_CONTENT_ACTIONS.has(request.action)) {
-			const modelSite = await fields.getModelSite(request.modelId, executor);
-			roleIds = modelSite !== null && actsOnSite(principal, modelSite) ? roles.roleIds : roles.networkRoleIds;
-		}
-		const held = await grants.getGrants(roleIds, executor);
-		if (held.length === 0) return DENIED_POLICY;
-		const modelFields = roles.audience === "delivery" ? await fields.getModelFields(request.modelId, executor) : void 0;
-		return buildPolicy(held, request, roles.audience, modelFields);
-	},
-	canPerform: async (principal, action, executor) => {
-		const roles = await rolesOf(principal, grants, executor);
-		if (roles === "all") return true;
-		if (roles.audience === "delivery") return false;
-		const roleIds = NETWORK_ACTION_SET.has(action) ? roles.networkRoleIds : roles.roleIds;
-		return allowsGlobalAction(await grants.getGrants(roleIds, executor), action);
-	},
-	canPerformOnSite: async (principal, action, siteId, executor) => {
-		const roles = await rolesOf(principal, grants, executor);
-		if (roles === "all") return true;
-		if (roles.audience === "delivery") return false;
-		const counted = !NETWORK_ACTION_SET.has(action) || SITE_GRANTABLE_ACTIONS.has(action) && actsOnSite(principal, siteId) ? roles.roleIds : roles.networkRoleIds;
-		return allowsGlobalAction(await grants.getGrants(counted, executor), action);
-	}
-});
+* Deny by default at every step. `atVersions` gives the same evaluator for one request, whose caches are
+* checked against the versions the request read once instead of read again on every call.
+*/
+const createPermissionEvaluator = ({ grants, fields }) => {
+	const at = (versions) => ({
+		evaluate: async (principal, request, executor) => {
+			const roles = await rolesOf(principal, grants, executor, versions);
+			if (roles === "all") return ALLOW_ALL_POLICY;
+			if (roles.actions !== "all" && !roles.actions.has(request.action)) return DENIED_POLICY;
+			let roleIds = roles.roleIds;
+			if (NETWORK_CONTENT_ACTIONS.has(request.action)) {
+				const modelSite = await fields.getModelSite(request.modelId, executor, versions);
+				roleIds = modelSite !== null && actsOnSite(principal, modelSite) ? roles.roleIds : roles.networkRoleIds;
+			}
+			const held = await grants.getGrants(roleIds, executor, versions);
+			if (held.length === 0) return DENIED_POLICY;
+			const modelFields = roles.audience === "delivery" ? await fields.getModelFields(request.modelId, executor, versions) : void 0;
+			return buildPolicy(held, request, roles.audience, modelFields);
+		},
+		canPerform: async (principal, action, executor) => {
+			const roles = await rolesOf(principal, grants, executor, versions);
+			if (roles === "all") return true;
+			if (roles.audience === "delivery") return false;
+			const roleIds = NETWORK_ACTION_SET.has(action) ? roles.networkRoleIds : roles.roleIds;
+			return allowsGlobalAction(await grants.getGrants(roleIds, executor, versions), action);
+		},
+		canPerformOnSite: async (principal, action, siteId, executor) => {
+			const roles = await rolesOf(principal, grants, executor, versions);
+			if (roles === "all") return true;
+			if (roles.audience === "delivery") return false;
+			const counted = !NETWORK_ACTION_SET.has(action) || SITE_GRANTABLE_ACTIONS.has(action) && actsOnSite(principal, siteId) ? roles.roleIds : roles.networkRoleIds;
+			return allowsGlobalAction(await grants.getGrants(counted, executor, versions), action);
+		},
+		atVersions: at
+	});
+	return at(void 0);
+};
 //#endregion
 //#region src/schema/fieldVisibility.ts
 /**
 * The permission evaluator's view of field visibility (`public` flags), served from the active schema.
-* Uses the durable version check on every call, so a field made non-public is hidden on every instance at
-* once, whether or not it got the notification. Deprecated fields are reported as non-public: they are
-* hidden from the API unless a role names them explicitly. Components are not delivery models.
+* Uses the durable version check on every call (or the version the request read once, `versions`), so a
+* field made non-public is hidden on every instance from the next request, whether or not it got the
+* notification. Deprecated fields are reported as non-public: they are hidden from the API unless a role
+* names them explicitly. Components are not delivery models.
 */
 const createSchemaFieldVisibility = (registry) => {
-	const activeModel = async (modelId, executor) => {
-		const active = (await registry.getSnapshot(executor)).byId.get(modelId);
+	const activeModel = async (modelId, executor, versions) => {
+		const active = (await registry.getSnapshot(executor, versions)).byId.get(modelId);
 		return active && active.definition.kind !== "component" ? active.definition : void 0;
 	};
 	return {
-		getModelFields: async (modelId, executor) => (await activeModel(modelId, executor))?.fields.map((field) => ({
+		getModelFields: async (modelId, executor, versions) => (await activeModel(modelId, executor, versions))?.fields.map((field) => ({
 			id: field.id,
 			public: field.public && !field.deprecated
 		})),
-		hasModel: async (modelId, executor) => await activeModel(modelId, executor) !== void 0,
-		getModelSite: async (modelId, executor) => (await registry.getSnapshot(executor)).scopeOf(modelId) ?? null
+		hasModel: async (modelId, executor, versions) => await activeModel(modelId, executor, versions) !== void 0,
+		getModelSite: async (modelId, executor, versions) => (await registry.getSnapshot(executor, versions)).scopeOf(modelId) ?? null
 	};
 };
 //#endregion
@@ -12214,8 +12413,8 @@ const createSchemaRegistry = ({ db, log }) => {
 		}
 	};
 	return {
-		getSnapshot: async (executor) => {
-			const version = await getSchemaVersion(executor ?? db);
+		getSnapshot: async (executor, versions) => {
+			const version = versions?.schemaVersion ?? await getSchemaVersion(executor ?? db);
 			if (cached && cached.version >= version) return cached;
 			return executor ? readSnapshot(executor) : loadAtLeast(version);
 		},
@@ -12645,6 +12844,25 @@ const selectFields = (model, mask, selected) => {
 	const allowed = model.definition.fields.filter((field) => maskAllows(mask, field));
 	return selected ? allowed.filter((field) => selected.some((choice) => choice.id === field.id)) : allowed;
 };
+/**
+* Renders a delivered rich-text value's HTML on demand (GraphQL's `RichText.html` resolver). A symbol key, so
+* `JSON.stringify` never writes it: REST responses carry `html` only when the request asked for it.
+*/
+const RICH_TEXT_HTML = Symbol("shapio.richTextHtml");
+const projectRichText = (document, mode, options) => {
+	const render = () => renderRichTextHtml(document, (id) => options.mediaAssets?.get(id)?.url);
+	const { doc, ...envelope } = document;
+	const shaped = mode === "json" ? { ...document } : mode === "html" ? {
+		...envelope,
+		html: render()
+	} : {
+		...envelope,
+		doc,
+		html: render()
+	};
+	shaped[RICH_TEXT_HTML] = render;
+	return shaped;
+};
 const isRecord$8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const isListField = (field) => field.type === "relation" && field.settings.cardinality === "many" || field.type === "media" && field.settings.multiple || field.type === "component" && field.settings.repeatable || field.type === "dynamiczone";
 const projectRelation = (field, value, options, topLevel) => {
@@ -12694,10 +12912,7 @@ const projectValue = (field, value, options, topLevel) => {
 				...projected
 			}] : [];
 		});
-		case "richtext": return options.richTextHtml ? {
-			...value,
-			html: renderRichTextHtml(value, (id) => options.mediaAssets?.get(id)?.url)
-		} : value;
+		case "richtext": return options.richText ? projectRichText(value, options.richText, options) : value;
 		case "media": {
 			if (!options.mediaAssets) return value;
 			const assets = (Array.isArray(value) ? value : [value]).flatMap((id) => {
@@ -12774,7 +12989,6 @@ const toEntryData = (model, data) => data === void 0 ? void 0 : projectData(data
 	fields: model.definition.fields.filter((field) => !field.deprecated),
 	visibleTargets: null,
 	populated: /* @__PURE__ */ new Map(),
-	richTextHtml: false,
 	mediaAssets: null
 });
 const reject = (message, details) => {
@@ -12973,11 +13187,11 @@ const unknownKeyMessage = (path) => {
 	if (segments[0] === "themes" && segments.length === 4) return `unknown theme token "${key}"; the tokens are listed in documentation/extensions.md`;
 	return `unknown key "${key}"`;
 };
-const keysOf = (value) => isRecord$6(value) ? Object.keys(value) : [];
+const keysOf$1 = (value) => isRecord$6(value) ? Object.keys(value) : [];
 /** Rules TypeBox cannot express (key patterns, uniqueness, reserved names); tolerant of a malformed config. */
 const findNamingProblems = (config) => {
 	const problems = [];
-	for (const key of keysOf(config.hooks)) if (!HOOK_MODEL_KEY_PATTERN.test(key)) problems.push({
+	for (const key of keysOf$1(config.hooks)) if (!HOOK_MODEL_KEY_PATTERN.test(key)) problems.push({
 		path: `/hooks/${key}`,
 		message: "must be a model API ID, a model UUID or \"*\""
 	});
@@ -12994,7 +13208,7 @@ const findNamingProblems = (config) => {
 		});
 		prefixes.add(route.prefix);
 	});
-	for (const name of keysOf(config.services)) if (!SERVICE_NAME_PATTERN.test(name)) problems.push({
+	for (const name of keysOf$1(config.services)) if (!SERVICE_NAME_PATTERN.test(name)) problems.push({
 		path: `/services/${name}`,
 		message: "must be a JavaScript identifier"
 	});
@@ -13002,7 +13216,7 @@ const findNamingProblems = (config) => {
 		path: `/services/${name}`,
 		message: `"${name}" is one of Shapio's own services`
 	});
-	for (const name of keysOf(config.jobs)) if (!JOB_NAME_PATTERN.test(name)) problems.push({
+	for (const name of keysOf$1(config.jobs)) if (!JOB_NAME_PATTERN.test(name)) problems.push({
 		path: `/jobs/${name}`,
 		message: "must start with a letter and use letters, digits, \".\", \"_\" or \"-\""
 	});
@@ -13323,6 +13537,20 @@ const SYSTEM_ATTRIBUTES = [
 	"createdAt",
 	"updatedAt"
 ];
+/**
+* Delivery shapes of a rich-text value (ADR 0003): `json` the stored document `{ format, version, doc }`,
+* `html` `{ format, version, html }` (sanitized HTML rendered from the document), `both` the document plus
+* `html`.
+*/
+const RICH_TEXT_MODES = [
+	"json",
+	"html",
+	"both"
+];
+/** What a delivery read returns for rich text when the request does not say (`?richText=`). */
+const DEFAULT_RICH_TEXT_MODE = "json";
+/** `?seo=`: SEO fields as stored, or merged with the site's SEO defaults (plan seo-fields). */
+const SEO_MODES = ["raw", "resolved"];
 const ENTRY_LIST_STATUSES = [
 	"draft",
 	"published",
@@ -13599,7 +13827,7 @@ const compileAuthorCondition = (adminUserId, dialect = contentDialect()) => sql`
 const compileSearch = (fieldId, text, dialect = contentDialect()) => containsInsensitiveExpression(fieldId, text, dialect);
 const SNAPSHOT_CTE = "content_snapshot";
 /** The FROM item for a source, aliased `alias`, and the CTE it needs (snapshots only). */
-const sourceOf$1 = (source, modelId, siteId, dialect) => {
+const sourceOf$2 = (source, modelId, siteId, dialect) => {
 	if (source.kind === "heads") return {
 		cte: null,
 		table: sql.table("entry_heads")
@@ -13648,20 +13876,46 @@ const entryScope = (plan, dialect) => plan.orderedByEntry === true && plan.condi
 * alone. A snapshot keeps the join: the publication log still lists entries deleted since.
 */
 const countFrom = (plan, table, where, joined) => plan.source.kind === "heads" && plan.conditions.length === 0 ? sql`from ${table} h where ${where}` : joined;
-/** The SELECT for a plan: rows, plus the matching COUNT for pagination. */
-const compileHeadQuery = (plan, dialect = contentDialect()) => {
-	const { cte, table } = sourceOf$1(plan.source, plan.modelId, plan.siteId, dialect);
+const HEAD_COLUMNS$1 = sql`h.entry_id, h.locale, h.data, h.version, h.revision_id, h.updated_at,
+      h.autosaved_at, e.created_at, e.updated_at as entry_updated_at, e.created_by_admin_id, e.owner_app_user_id`;
+/** The parts every statement over a plan's heads shares. */
+const headQueryParts = (plan, dialect) => {
+	const { cte, table } = sourceOf$2(plan.source, plan.modelId, plan.siteId, dialect);
 	const where = whereOf(plan, table, dialect);
 	const from = sql`from ${table} h join entries e on e.id = h.entry_id and e.deleted_at is null where ${where}`;
-	const prefix = cte ?? sql``;
 	const orderBy = plan.orderBy.length > 0 ? sql` order by ${sql.join([...plan.orderBy])}` : sql``;
 	const limit = plan.limit !== void 0 ? sql` limit ${plan.limit}` : sql``;
 	const offset = plan.offset ? sql` offset ${plan.offset}` : sql``;
 	return {
-		rows: sql`${prefix}select h.entry_id, h.locale, h.data, h.version, h.revision_id, h.updated_at,
-      h.autosaved_at, e.created_at, e.updated_at as entry_updated_at, e.created_by_admin_id, e.owner_app_user_id
-      ${from}${entryScope(plan, dialect)}${orderBy}${limit}${offset}`,
-		count: sql`${prefix}select count(*) as total ${countFrom(plan, table, where, from)}`
+		prefix: cte ?? sql``,
+		rows: sql`${from}${entryScope(plan, dialect)}${orderBy}${limit}${offset}`,
+		countFrom: countFrom(plan, table, where, from)
+	};
+};
+/** The SELECT for a plan: rows, plus the matching COUNT for pagination. */
+const compileHeadQuery = (plan, dialect = contentDialect()) => {
+	const { prefix, rows, countFrom: counted } = headQueryParts(plan, dialect);
+	return {
+		rows: sql`${prefix}select ${HEAD_COLUMNS$1}
+      ${rows}`,
+		count: sql`${prefix}select count(*) as total ${counted}`
+	};
+};
+/**
+* One delivery read as a single statement (plan delivery-perf): the page's heads with, on every row, the
+* matching total and the site's current publication sequence (`publication_state.last_seq`), so all three
+* come from one snapshot of the database on every dialect without a transaction. The uncorrelated
+* subqueries run once per statement. An empty page carries no row, so `meta` reads the total and the
+* sequence alone, for callers that read it in the same transaction as `rows`.
+*/
+const compileHeadPage = (plan, options, dialect = contentDialect()) => {
+	const { prefix, rows, countFrom: counted } = headQueryParts(plan, dialect);
+	const total = options.total ? sql`(select count(*) ${counted})` : sql`null`;
+	const seq = sql`(select ps.last_seq from publication_state ps where ps.site_id = ${dialect.uuid(plan.siteId)})`;
+	return {
+		rows: sql`${prefix}select ${HEAD_COLUMNS$1}, ${total} as page_total, ${seq} as page_seq
+      ${rows}`,
+		meta: sql`${prefix}select ${total} as page_total, ${seq} as page_seq`
 	};
 };
 //#endregion
@@ -13753,6 +14007,8 @@ const TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
 	"populate",
 	"locale",
 	"snapshot",
+	"richText",
+	"seo",
 	"q",
 	"status",
 	"author"
@@ -13911,6 +14167,27 @@ const parseAdminFilters = (tree, context) => {
 		...author !== void 0 ? { author } : {}
 	};
 };
+const RICH_TEXT_MODE_SET = new Set(RICH_TEXT_MODES);
+/** `?richText=json|html|both` on delivery and preview reads; the default there, nothing on admin reads. */
+const parseRichText = (tree, context) => {
+	const value = single(tree.richText, "richText");
+	if (!context.allowRichText) {
+		if (value !== void 0) throw queryInvalid("richText is only available on the delivery and preview APIs");
+		return {};
+	}
+	if (value !== void 0 && !RICH_TEXT_MODE_SET.has(value)) throw queryInvalid(`"richText" must be one of ${RICH_TEXT_MODES.join(", ")}`);
+	return { richText: value ?? "json" };
+};
+const SEO_MODE_SET = new Set(SEO_MODES);
+/** `?seo=raw|resolved` on delivery and preview reads; `resolved` needs a readable SEO field on the model. */
+const parseSeo = (tree, context) => {
+	const value = single(tree.seo, "seo");
+	if (value === void 0) return {};
+	if (!context.allowSeo) throw queryInvalid("seo is only available on the delivery and preview APIs");
+	if (!SEO_MODE_SET.has(value)) throw queryInvalid(`"seo" must be one of ${SEO_MODES.join(", ")}`);
+	if (value === "resolved" && !context.model.fields.some((field) => !field.deprecated && isSeoField(field) && context.isReadable(field))) throw queryInvalid(`"${context.model.apiKey}" has no SEO field to resolve`);
+	return { seo: value };
+};
 const parseContentQuery = (tree, context) => {
 	for (const key of Object.keys(tree)) if (!TOP_LEVEL_KEYS.has(key)) throw queryInvalid(`Unknown query parameter "${key}"`);
 	const filters = tree.filters;
@@ -13932,6 +14209,8 @@ const parseContentQuery = (tree, context) => {
 		populate: parsePopulate(context, tree.populate),
 		locale,
 		snapshot,
+		...parseRichText(tree, context),
+		...parseSeo(tree, context),
 		...parseAdminFilters(tree, context)
 	};
 };
@@ -14060,6 +14339,29 @@ const outdatedSharedLocales = (model, heads) => model.localized ? heads.filter((
 */
 const runHeadQuery = async (query, executor = db) => (await query.execute(executor)).rows;
 const runCountQuery = async (query, executor = db) => Number((await query.execute(executor)).rows[0]?.total ?? 0);
+const toPageMeta = (row) => ({
+	total: row.page_total === null ? null : Number(row.page_total),
+	seq: row.page_seq === null ? null : Number(row.page_seq)
+});
+/**
+* Runs a head page compiled by `compileHeadPage`: the rows, and the total and sequence carried on them (null
+* when the page is empty; then `runHeadPageMeta` in the same transaction reads them).
+*/
+const runHeadPage = async (query, executor = db) => {
+	const result = (await query.execute(executor)).rows;
+	const [first] = result;
+	return {
+		rows: result.map(({ page_total: _total, page_seq: _seq, ...row }) => row),
+		meta: first ? toPageMeta(first) : null
+	};
+};
+const runHeadPageMeta = async (query, executor = db) => {
+	const [row] = (await query.execute(executor)).rows;
+	return row ? toPageMeta(row) : {
+		total: null,
+		seq: null
+	};
+};
 /** Runs `fn` in one REPEATABLE READ, read-only transaction: a response reads one consistent moment. */
 const withConsistentRead = (fn, database = db) => database.transaction().setIsolationLevel("repeatable read").setAccessMode("read only").execute(fn);
 //#endregion
@@ -14105,6 +14407,51 @@ const populateRelations = async (env, rows, fields, tree) => {
 	return populated;
 };
 //#endregion
+//#region src/content/seo.ts
+const EXPECTED_TYPES = {
+	title: /* @__PURE__ */ new Set(["string", "text"]),
+	description: /* @__PURE__ */ new Set(["text", "string"]),
+	image: /* @__PURE__ */ new Set(["media"]),
+	canonical: /* @__PURE__ */ new Set(["url", "string"]),
+	noindex: /* @__PURE__ */ new Set(["boolean"])
+};
+const keysOf = (model) => {
+	const component = model.components.get(SEO_COMPONENT_ID)?.definition;
+	const keys = {};
+	for (const [key, id] of Object.entries(SEO_FIELD_IDS)) {
+		const field = component?.fields.find((candidate) => candidate.id === id && !candidate.deprecated);
+		const single = field?.type !== "media" || !field.settings.multiple;
+		if (field && single && EXPECTED_TYPES[key].has(field.type)) keys[key] = field.apiKey;
+	}
+	return keys;
+};
+/** The entry's own title, only when the caller may read the title field (never a hidden value). */
+const fallbackTitleOf = (model, policy, row) => {
+	const field = effectiveTitleField(model.definition);
+	if (!field || !maskAllows(policy.readMask, field)) return null;
+	const value = row.data[field.id];
+	return typeof value === "string" ? value : null;
+};
+/** The locale whose defaults apply: the head's for localized models, the requested one otherwise. */
+const defaultsLocaleOf = (env, model, row) => model.definition.localized ? row.locale : env.locale ?? env.snapshot.defaultLocale;
+/** Whether the selected fields include an SEO field (only those are resolved). */
+const seoFieldsOf = (fields) => fields.filter(isSeoField);
+/** Replaces each SEO field's projected value with its resolved value. */
+const resolveSeoFields = (env, options, model, policy, fields, row, data) => {
+	const seoFields = seoFieldsOf(fields);
+	if (seoFields.length === 0) return data;
+	const keys = keysOf(model);
+	const context = {
+		defaults: seoDefaultsForLocale(options.defaults, fallbackChain(env.snapshot, defaultsLocaleOf(env, model, row))),
+		image: options.image,
+		fallbackTitle: fallbackTitleOf(model, policy, row),
+		keys
+	};
+	const output = { ...data };
+	for (const field of seoFields) output[field.apiKey] = resolveSeo(data[field.apiKey], context);
+	return output;
+};
+//#endregion
 //#region src/content/read.ts
 /** Evaluated through the read's executor: a read inside a transaction never asks the pool for a second connection. */
 const readPolicy = (env, modelId) => env.permissions.evaluate(env.actor, {
@@ -14131,33 +14478,85 @@ const fetchHeadsByIds = async (env, model, policy, ids, locales) => {
 /**
 * Relation targets the caller may see in these rows: for delivery, only targets that are published (at the
 * same snapshot) and readable under their model's policy, so a published entry never leaks the ID of a
-* draft (brief §10). Admin reads see every ID (null).
+* draft (brief §10). Admin reads see every ID (null). The heads read are returned for populate.
 */
-const visibleRelationTargets = async (env, model, rows, fields) => {
-	if (env.audience === "admin") return null;
+const relationTargets = async (env, model, rows, fields) => {
+	const fetched = /* @__PURE__ */ new Map();
+	if (env.audience === "admin") return {
+		visible: null,
+		fetched
+	};
 	const visible = /* @__PURE__ */ new Set();
 	const targets = targetsByModel(model, rows.map((row) => row.data), fields);
 	for (const [targetModelId, ids] of targets) {
 		const target = resolveModelById(env.snapshot, targetModelId);
 		if (!target) continue;
 		const policy = await readPolicy(env, targetModelId);
-		(await fetchHeadsByIds(env, target, policy, [...ids])).forEach((row) => visible.add(row.entry_id));
+		const found = await fetchHeadsByIds(env, target, policy, [...ids]);
+		found.forEach((row) => visible.add(row.entry_id));
+		fetched.set(targetModelId, {
+			ids,
+			rows: found
+		});
 	}
-	return visible;
+	return {
+		visible,
+		fetched
+	};
+};
+/**
+* `fetchHeadsByIds` for populate, answered from the heads relation visibility already read when it asked for
+* every one of these IDs under the same policy and locale scope (populate's default), else from the database.
+*/
+const fetchReusing = (fetched) => async (env, model, policy, ids) => {
+	const known = fetched.get(model.definition.id);
+	if (known && ids.every((id) => known.ids.has(id))) {
+		const wanted = new Set(ids);
+		return known.rows.filter((row) => wanted.has(row.entry_id));
+	}
+	return fetchHeadsByIds(env, model, policy, ids);
+};
+/**
+* Whether projecting these rows reads anything more (relation targets, populated entries, asset views). When
+* not, a delivery read is complete in the one statement that fetched the rows (plan delivery-perf).
+*/
+const needsFollowUpReads = (env, model, rows, query, policy) => {
+	if (query.populate.size > 0) return true;
+	const fields = selectFields(model, policy.readMask, query.fields);
+	const documents = rows.map((row) => row.data);
+	return env.audience === "delivery" && targetsByModel(model, documents, fields).size > 0 || env.media !== void 0 && (mediaIdsOf(model, documents, fields).size > 0 || seoImageIdOf(env, fields) !== void 0);
 };
+/** The site's default social image a `?seo=resolved` read needs (when the response carries an SEO field). */
+const seoImageIdOf = (env, fields) => env.seo?.imageId && seoFieldsOf(fields).length > 0 ? env.seo.imageId : void 0;
+/** A default SEO image is shown only while it is a public image (never through a signed URL). */
+const isPublicImage = (view) => view.visibility === "public" && view.mimeType.startsWith("image/");
 /**
 * Asset views for the media a response shows (media fields and rich-text images). Private assets get signed,
 * expiring URLs (package G); the read mask already decided whether the caller may see the field at all.
 * Delivery views carry only what a site needs, never storage keys or internal attribution.
 */
 const loadMediaViews = async (env, model, rows, fields) => {
-	if (!env.media) return null;
+	if (!env.media) return {
+		byId: null,
+		seoImage: null
+	};
 	const ids = mediaIdsOf(model, rows.map((row) => row.data), fields);
-	if (ids.size === 0) return /* @__PURE__ */ new Map();
+	const seoImageId = seoImageIdOf(env, fields);
+	if (seoImageId !== void 0) ids.add(seoImageId);
+	if (ids.size === 0) return {
+		byId: /* @__PURE__ */ new Map(),
+		seoImage: null
+	};
 	const assets = await findLiveManyOnSite(env.siteId, [...ids], env.executor);
 	const views = await toAssetViews(env.media, assets, env.executor);
-	return new Map(views.map((view) => [view.id, env.audience === "delivery" ? toDeliveryAsset(view) : view]));
+	const shaped = (view) => env.audience === "delivery" ? toDeliveryAsset(view) : view;
+	const seoImage = views.find((view) => view.id === seoImageId && isPublicImage(view));
+	return {
+		byId: new Map(views.map((view) => [view.id, shaped(view)])),
+		seoImage: seoImage ? shaped(seoImage) : null
+	};
 };
+/** An asset as delivery shows it: what a site needs, never storage keys or internal attribution. */
 const toDeliveryAsset = (view) => ({
 	id: view.id,
 	filename: view.filename,
@@ -14189,27 +14588,33 @@ const systemAttributes = (env, row) => ({
 });
 const projectRows = async (env, model, policy, rows, query) => {
 	const fields = selectFields(model, policy.readMask, query.fields);
-	const visibleTargets = await visibleRelationTargets(env, model, rows, fields);
+	const { visible: visibleTargets, fetched } = await relationTargets(env, model, rows, fields);
 	const populateEnv = {
 		...env,
 		project: projectRows,
-		fetch: fetchHeadsByIds,
+		fetch: fetchReusing(fetched),
 		policyFor: readPolicy,
 		system: systemAttributes
 	};
 	const populated = await populateRelations(populateEnv, rows, fields, query.populate);
-	const mediaAssets = await loadMediaViews(env, model, rows, fields);
-	return rows.map((row) => ({
-		row,
-		data: projectData(row.data, {
+	const media = await loadMediaViews(env, model, rows, fields);
+	return rows.map((row) => {
+		const data = projectData(row.data, {
 			model,
 			fields,
 			visibleTargets,
 			populated,
-			richTextHtml: env.audience === "delivery",
-			mediaAssets
-		})
-	}));
+			...env.audience === "delivery" ? { richText: env.richText ?? "json" } : {},
+			mediaAssets: media.byId
+		});
+		return {
+			row,
+			data: env.seo ? resolveSeoFields(env, {
+				defaults: env.seo,
+				image: media.seoImage
+			}, model, policy, fields, row, data) : data
+		};
+	});
 };
 //#endregion
 //#region src/services/contentAccess.ts
@@ -14419,6 +14824,8 @@ const parseQueryFor = (context, model, policy, rawQuery, options) => parseConten
 	isReadable: (field) => maskAllows(policy.readMask, field),
 	allowSnapshot: options.allowSnapshot,
 	allowAdminFilters: options.allowAdminFilters ?? false,
+	allowRichText: options.allowRichText ?? false,
+	allowSeo: options.allowSeo ?? false,
 	resolveModel: (modelId) => resolveModelById(context.snapshot, modelId)?.definition
 });
 /** The admin content list: drafts, filtered/sorted/paginated by the same compiler as delivery. */
@@ -15439,19 +15846,19 @@ const toSiteRef = (row) => ({
 	id: row.id,
 	key: row.key
 });
-const siteNotFound = () => new AppError(404, "SITE_NOT_FOUND", "Site not found");
+const siteNotFound$1 = () => new AppError(404, "SITE_NOT_FOUND", "Site not found");
 /** A site's summary by ID (`me` for a site the admin holds no role on: they see its name, nothing else). */
 /** How many sites the instance has, whatever roles the caller holds (one: per-site schema UI is moot). */
 const countSites = () => count();
 const getSiteSummary = async (siteId) => {
 	const site = await findById$12(siteId);
-	if (!site) throw siteNotFound();
+	if (!site) throw siteNotFound$1();
 	return toSiteSummary(site);
 };
 /** The reference of a site by ID (jobs and deferred work carry the ID of the site they belong to). */
 const getSiteRef = async (siteId, executor = db) => {
 	const site = await findById$12(siteId, executor);
-	if (!site) throw siteNotFound();
+	if (!site) throw siteNotFound$1();
 	return toSiteRef(site);
 };
 /**
@@ -15465,7 +15872,7 @@ const listAccessibleSites = async (principal) => {
 const listSites$1 = async (principal) => (await listAccessibleSites(principal)).map(toSiteView);
 const getSite$1 = async (principal, id) => {
 	const site = (await listAccessibleSites(principal)).find((row) => row.id === id);
-	if (!site) throw siteNotFound();
+	if (!site) throw siteNotFound$1();
 	return toSiteView(site);
 };
 /** Every site, primary first (`shapio sites list`, which runs on the server host without a principal). */
@@ -15501,7 +15908,7 @@ const createSite$1 = async (context, input, database = db) => {
 /** Optimistic: fails with VERSION_CONFLICT when the site changed since `expectedVersion` was read. */
 const renameSite = async (context, id, input) => db.transaction().execute(async (trx) => {
 	const current = await findById$12(id, trx);
-	if (!current) throw siteNotFound();
+	if (!current) throw siteNotFound$1();
 	const updated = await renameIfVersion(id, input.expectedVersion, input.name.trim(), trx);
 	if (!updated) throw new AppError(409, "VERSION_CONFLICT", "The site changed since you loaded it", {
 		expectedVersion: input.expectedVersion,
@@ -15529,7 +15936,7 @@ const renameSite = async (context, id, input) => db.transaction().execute(async
 const deleteSite$1 = async (context, id) => {
 	await db.transaction().execute(async (trx) => {
 		const site = await lockById$4(id, trx);
-		if (!site) throw siteNotFound();
+		if (!site) throw siteNotFound$1();
 		if (site.is_primary) throw new AppError(409, "SITE_IS_PRIMARY", "The primary site cannot be deleted");
 		await lockSchema(trx);
 		const contents = {
@@ -15558,24 +15965,171 @@ const deleteSite$1 = async (context, id) => {
 		});
 	});
 };
+/** The site a lookup names, read on its own (a request whose state was read without its site). */
+const findSite = async (lookup) => {
+	switch (lookup.by) {
+		case "id": return findById$12(lookup.id).then((row) => row && toSiteRef(row));
+		case "key": return findByKey(lookup.key).then((row) => row && toSiteRef(row));
+		case "primary": return toSiteRef(await findPrimary());
+	}
+};
 /**
 * Which site a request is about (sites plan §H): the credential's site, else the site the request names,
 * else the primary site. A request that names a different site than its credential is refused
 * (403 `SITE_MISMATCH`), never redirected; an unknown key is 404 `SITE_NOT_FOUND`.
+* `read`: where the site is read; a request passes its once-per-request state read
+* (`repositories/requestState.ts`), which reads the site with the versions in one statement.
 */
-const resolveSite = async ({ credentialSiteId, requestedKey }) => {
+const resolveSite = async ({ credentialSiteId, requestedKey }, read = findSite) => {
 	if (credentialSiteId !== void 0) {
-		const site = await findById$12(credentialSiteId);
-		if (!site) throw siteNotFound();
+		const site = await read({
+			by: "id",
+			id: credentialSiteId
+		});
+		if (!site) throw siteNotFound$1();
 		if (requestedKey !== void 0 && requestedKey !== site.key) throw new AppError(403, "SITE_MISMATCH", `This credential belongs to site "${site.key}", not "${requestedKey}"`);
-		return toSiteRef(site);
+		return site;
 	}
 	if (requestedKey !== void 0) {
-		const site = await findByKey(requestedKey);
+		const site = await read({
+			by: "key",
+			key: requestedKey
+		});
 		if (!site) throw new AppError(404, "SITE_NOT_FOUND", `No site has the key "${requestedKey}"`);
-		return toSiteRef(site);
+		return site;
 	}
-	return toSiteRef(await findPrimary());
+	const primary = await read({ by: "primary" });
+	if (!primary) throw new Error("No primary site");
+	return primary;
+};
+//#endregion
+//#region src/permissions/memo.ts
+/**
+* One request's evaluator, memoized per (principal, action, model): a request touches the same models many
+* times (REST: the read, relation visibility, populate, usage; GraphQL: lists, relation batches,
+* localizations), and evaluates each policy once (ADR 0005). Calls for another principal bypass the memo.
+* A policy still being evaluated is shared only on the executor that evaluates it: one evaluated inside a
+* read transaction is never awaited from another transaction. Once settled, every executor reuses it.
+*/
+const memoizePermissions = (base, principal) => {
+	const settled = /* @__PURE__ */ new Map();
+	const pooled = /* @__PURE__ */ new Map();
+	const byTransaction = /* @__PURE__ */ new WeakMap();
+	const pendingFor = (executor) => {
+		if (!executor) return pooled;
+		let pending = byTransaction.get(executor);
+		if (!pending) {
+			pending = /* @__PURE__ */ new Map();
+			byTransaction.set(executor, pending);
+		}
+		return pending;
+	};
+	return {
+		evaluate: (caller, request, executor) => {
+			if (caller !== principal) return base.evaluate(caller, request, executor);
+			const key = `${request.action}:${request.modelId}`;
+			const done = settled.get(key);
+			if (done) return Promise.resolve(done);
+			const pending = pendingFor(executor);
+			let policy = pending.get(key);
+			if (!policy) {
+				policy = base.evaluate(caller, request, executor);
+				pending.set(key, policy);
+				policy.then((value) => settled.set(key, value), () => void 0);
+			}
+			return policy;
+		},
+		canPerform: (caller, action, executor) => base.canPerform(caller, action, executor),
+		canPerformOnSite: (caller, action, siteId, executor) => base.canPerformOnSite(caller, action, siteId, executor)
+	};
+};
+//#endregion
+//#region src/repositories/requestState.ts
+/**
+* Everything a request checks before its work, in one statement: the durable schema and permissions versions
+* (`system_versions`, one row) and, when asked, the request's site. Read once per request on the pool, before
+* any transaction; caches compare against these versions for the rest of the request.
+*/
+const read = async (lookup, trx = db) => {
+	if (!lookup) {
+		const row = await trx.selectFrom("system_versions").select(["schema_version", "permissions_version"]).executeTakeFirstOrThrow();
+		return {
+			schemaVersion: row.schema_version,
+			permissionsVersion: row.permissions_version,
+			site: void 0
+		};
+	}
+	const row = await trx.selectFrom("system_versions").leftJoin("sites", (join) => {
+		switch (lookup.by) {
+			case "id": return join.on("sites.id", "=", lookup.id);
+			case "key": return join.on("sites.key", "=", lookup.key);
+			case "primary": return join.on("sites.is_primary", "=", true);
+		}
+	}).select([
+		"system_versions.schema_version",
+		"system_versions.permissions_version",
+		"sites.id as site_id",
+		"sites.key as site_key"
+	]).executeTakeFirstOrThrow();
+	return {
+		schemaVersion: row.schema_version,
+		permissionsVersion: row.permissions_version,
+		site: row.site_id !== null && row.site_key !== null ? {
+			id: row.site_id,
+			key: row.site_key
+		} : void 0
+	};
+};
+//#endregion
+//#region src/services/requestState.ts
+/** One statement on the pool: the schema and permissions versions, and the request's site when asked. */
+const readRequestState = async (lookup) => {
+	const row = await read(lookup);
+	return {
+		versions: {
+			schemaVersion: row.schemaVersion,
+			permissionsVersion: row.permissionsVersion
+		},
+		site: row.site
+	};
+};
+//#endregion
+//#region src/plugins/requestState.ts
+/**
+* The durable schema and permissions versions this request checks its caches against, read once on the pool
+* before any transaction (ADR 0002, ADR 0005): a change committed after the read applies from the next
+* request. The first caller reads; site resolution (an `onRequest` hook, before any other caller on a site
+* route) passes its site lookup so the site is read in the same statement.
+*/
+const getRequestState = (request, lookup) => {
+	request.requestState ??= readRequestState(lookup);
+	return request.requestState;
+};
+/** Reads the request's site with its state, or on its own when the state was already read without it. */
+const readRequestSite = async (request, lookup) => request.requestState ? findSite(lookup) : (await getRequestState(request, lookup)).site;
+/**
+* The server's evaluator at the request's versions. Inside a transaction before the state was read (no route
+* does that today), the unbound evaluator checks the versions itself through the transaction, so no pooled
+* connection is asked for while the transaction holds one.
+*/
+const boundPermissions = async (request, executor) => {
+	const base = request.server.permissions;
+	if (executor && !request.requestState) return base;
+	const { versions } = await getRequestState(request);
+	return base.atVersions?.(versions) ?? base;
+};
+/**
+* The request's evaluator: checked against the request's versions, and memoized per (principal, action,
+* model) for the request (`permissions/memo.ts`), for REST as for GraphQL. Create it after site resolution,
+* which settles the principal.
+*/
+const getRequestPermissions = (request) => {
+	request.requestPermissions ??= memoizePermissions({
+		evaluate: async (principal, policyRequest, executor) => (await boundPermissions(request, executor)).evaluate(principal, policyRequest, executor),
+		canPerform: async (principal, action, executor) => (await boundPermissions(request, executor)).canPerform(principal, action, executor),
+		canPerformOnSite: async (principal, action, siteId, executor) => (await boundPermissions(request, executor)).canPerformOnSite(principal, action, siteId, executor)
+	}, request.principal);
+	return request.requestPermissions;
 };
 //#endregion
 //#region src/plugins/siteResolution.ts
@@ -15654,7 +16208,7 @@ const siteResolutionPlugin = fp(async (app, { apiPrefix }) => {
 		const site = await resolveSite({
 			credentialSiteId: await credentialSiteOf(request),
 			requestedKey
-		});
+		}, (lookup) => readRequestSite(request, lookup));
 		request.site = site;
 		request.principal = principalForSite(request.principal, site.id);
 		if (request.principal.kind === "admin" && request.principal.roleIds.length === 0 && request.routeOptions.config?.siteAccess !== "unassigned") throw new AppError(403, "SITE_FORBIDDEN", "You have no role on this site");
@@ -15821,7 +16375,8 @@ const revokeApiToken = async (context, permissions, id) => {
 const resolveApiToken = async (value, now = /* @__PURE__ */ new Date()) => {
 	const row = await findLiveByHash$1(hashToken(value));
 	if (!row || row.expires_at !== null && row.expires_at.getTime() <= now.getTime()) return;
-	await touchLastUsed$1(row.id, now, /* @__PURE__ */ new Date(now.getTime() - LAST_SEEN_WRITE_INTERVAL_MS));
+	const staleBefore = /* @__PURE__ */ new Date(now.getTime() - LAST_SEEN_WRITE_INTERVAL_MS);
+	if (row.last_used_at === null || row.last_used_at.getTime() < staleBefore.getTime()) await touchLastUsed$1(row.id, now, staleBefore);
 	return {
 		kind: "token",
 		tokenId: row.id,
@@ -15906,7 +16461,7 @@ const adminSessionPlugin = fp(async (app, { urls, secureCookies }) => {
 	app.decorate("requireGlobalPermission", (action) => {
 		return async function requireGlobalPermission(request, reply) {
 			await requireAdmin.call(this, request, reply);
-			if (!await app.permissions.canPerform(request.principal, action)) throw new AppError(403, "FORBIDDEN", `Your role does not allow ${action}`);
+			if (!await getRequestPermissions(request).canPerform(request.principal, action)) throw new AppError(403, "FORBIDDEN", `Your role does not allow ${action}`);
 		};
 	});
 }, {
@@ -17059,10 +17614,12 @@ const toErrorResponse = (error) => {
 };
 /** The single error handler: consistent `{ error: { code, message, details? } }` bodies and logging. */
 const errorHandlerPlugin = fp(async (app) => {
+	app.decorateRequest("errorCode", void 0);
 	app.setErrorHandler((error, request, reply) => {
 		const { statusCode, body } = toErrorResponse(error);
+		request.errorCode = body.error.code;
 		if (statusCode >= 500) request.log.error({ err: error }, "request failed");
-		else request.log.info({
+		else request.log.debug({
 			statusCode,
 			code: body.error.code
 		}, "request rejected");
@@ -17073,6 +17630,7 @@ const errorHandlerPlugin = fp(async (app) => {
 			code: "NOT_FOUND",
 			message: `Route ${request.method} ${request.url} not found`
 		} };
+		request.errorCode = body.error.code;
 		return reply.code(404).send(body);
 	});
 }, { name: "shapio-error-handler" });
@@ -17157,6 +17715,14 @@ const gracefulClosePlugin = fp(async (app) => {
 	});
 });
 //#endregion
+//#region src/constants/graphql.ts
+/** A site's GraphQL schema is dropped from memory when no request has used it for this long. */
+const GRAPHQL_SITE_SCHEMA_IDLE_MS = 6e5;
+/** `/api/graphql/playground?query=`: the longest operation the page opens with (it travels in the URL). */
+const PLAYGROUND_QUERY_MAX_LENGTH = 8192;
+/** `/api/graphql/playground?theme=`: GraphiQL's two themes. */
+const PLAYGROUND_THEMES = ["light", "dark"];
+//#endregion
 //#region src/helpers/vary.ts
 /**
 * Adds header names to the reply's `Vary` without dropping the ones already there (`Origin`, set by
@@ -17803,12 +18369,15 @@ const startSchemaChangeListener = ({ connectionString, registry, log }) => creat
 //#region src/plugins/schemaSnapshot.ts
 /**
 * The schema registry and per-request snapshot pinning (ADR 0002). The pin is lazy: requests that never
-* touch the schema (health, static admin) pay nothing; the first call in a request does the version check.
+* touch the schema (health, static admin) pay nothing; the first call in a request checks the cache against
+* the request's schema version (`getRequestState`, read once per request).
 */
 const schemaSnapshotPlugin = fp(async (app, { registry, listen, contentPorts }) => {
 	app.decorate("schemaRegistry", registry);
 	app.decorate("schemaContent", contentPorts);
 	app.decorateRequest("schemaSnapshotPin", null);
+	app.decorateRequest("requestState", null);
+	app.decorateRequest("requestPermissions", null);
 	let listener;
 	if (listen) app.addHook("onReady", async () => {
 		listener = startSchemaChangeListener({
@@ -17827,7 +18396,7 @@ const schemaSnapshotPlugin = fp(async (app, { registry, listen, contentPorts })
 });
 /** The full schema (every site's definitions and the shared ones) this request is pinned to. */
 const getRequestNetworkSchema = (request) => {
-	request.schemaSnapshotPin ??= request.server.schemaRegistry.getSnapshot();
+	request.schemaSnapshotPin ??= getRequestState(request).then(({ versions }) => request.server.schemaRegistry.getSnapshot(void 0, versions));
 	return request.schemaSnapshotPin;
 };
 /**
@@ -17996,42 +18565,137 @@ const executeOperation = async (schema, prepared, input, context) => execute({
 	contextValue: context
 });
 //#endregion
-//#region src/usage/restFieldReads.ts
-const restFieldReads = async ({ snapshot, model, policy, query, policyFor }) => {
-	const fields = selectFields(model, policy.readMask, query.fields);
-	const selection = query.fields === null ? "implicit" : "explicit";
-	const reads = fields.map((field) => ({
-		path: field.id,
-		selection
-	}));
-	for (const field of fields) {
-		if (field.type !== "relation" || !query.populate.has(field.id)) continue;
-		const target = resolveModelById(snapshot, field.settings.target);
-		if (!target) continue;
-		const targetPolicy = await policyFor(target.definition.id);
-		if (!targetPolicy.allowed) continue;
-		for (const targetField of selectFields(target, targetPolicy.readMask, null)) reads.push({
-			path: relationFieldPath(field.id, targetField.id),
-			selection: "implicit"
-		});
+//#region src/services/siteSeo.ts
+/**
+* A site's SEO defaults (plan seo-fields): default texts per locale, a default social image and the Twitter
+* handle, stored on `sites.seo_defaults`. Edited by `site.settings`; delivered on `GET /api/site` and merged
+* into SEO fields by `?seo=resolved` reads.
+*/
+const SITE_UPDATED_EVENT = "site.updated";
+const siteNotFound = () => new AppError(404, "SITE_NOT_FOUND", "Site not found");
+/** Stored defaults, or the empty ones when none were saved (or the stored value no longer fits the schema). */
+const readDefaults = (stored) => stored !== null && Value.Check(SeoDefaultsSchema, stored) ? stored : EMPTY_SEO_DEFAULTS;
+/** The defaults a resolved delivery read merges in. */
+const loadSeoDefaults = async (siteId, executor) => readDefaults((await findSeoDefaults(siteId, executor))?.seo_defaults ?? null);
+/** The caller reads something on this site (the same rule as its content: deny by default). */
+const assertReadsSite = async (context) => {
+	for (const { definition } of context.snapshot.definitions) {
+		if (!isModelDefinition(definition)) continue;
+		if ((await context.permissions.evaluate(context.actor, {
+			action: "read",
+			modelId: definition.id
+		})).allowed) return;
 	}
-	return reads;
+	throw context.actor.kind === "anonymous" ? new AppError(401, "UNAUTHENTICATED", "This site needs a delivery token") : new AppError(403, "FORBIDDEN", "You may not read content on this site");
 };
-//#endregion
-//#region src/services/contentDelivery.ts
-const readableModel = async (context, modelKey) => {
-	const model = resolveModel(context.snapshot, modelKey);
-	const policy = await context.permissions.evaluate(context.actor, {
-		action: "read",
-		modelId: model.definition.id
+/**
+* Reading the defaults needs read access to some content of the site (editors see the template in the entry's
+* search-result preview); changing them needs `site.settings` (the route checks it).
+*/
+const getSiteSeo$1 = async (context) => {
+	await assertReadsSite(context);
+	const row = await findSeoDefaults(context.site.id, context.db);
+	if (!row) throw siteNotFound();
+	return {
+		version: row.version,
+		seo: readDefaults(row.seo_defaults)
+	};
+};
+const invalid$1 = (code, message, details) => new AppError(400, code, message, details);
+const assertKnownLocales = (snapshot, seo) => {
+	const known = new Set(snapshot.locales.map((locale) => locale.code));
+	const unknown = Object.keys(seo.locales).filter((code) => !known.has(code));
+	if (unknown.length > 0) throw invalid$1("UNKNOWN_LOCALE", `Unknown locale "${unknown[0]}"`, { locales: unknown });
+};
+/** The default image must be a live, public image of this site: delivery shows it to anyone. */
+const assertUsableImage = async (context, imageId) => {
+	if (imageId === null) return;
+	const [asset] = await findLiveManyOnSite(context.site.id, [imageId], context.db);
+	if (!asset) throw invalid$1("SEO_IMAGE_INVALID", "The default image is not an asset of this site", { imageId });
+	if (!isPublicImage({
+		visibility: asset.visibility,
+		mimeType: asset.mime_type
+	})) throw invalid$1("SEO_IMAGE_INVALID", "The default image must be a public image", { imageId });
+};
+/** Without empty locale entries, so a cleared locale leaves nothing behind. */
+const compact = (seo) => ({
+	...seo,
+	locales: Object.fromEntries(Object.entries(seo.locales).filter(([, texts]) => Object.keys(texts).length > 0))
+});
+/** Optimistic: fails with VERSION_CONFLICT when the site changed since `expectedVersion` was read. */
+const updateSiteSeo$1 = async (context, input) => {
+	const seo = compact(input.seo);
+	assertKnownLocales(context.snapshot, seo);
+	await assertUsableImage(context, seo.imageId);
+	return context.db.transaction().execute(async (trx) => {
+		const current = await findSeoDefaults(context.site.id, trx);
+		if (!current) throw siteNotFound();
+		const updated = await updateSeoDefaultsIfVersion(context.site.id, input.expectedVersion, seo, trx);
+		if (!updated) throw new AppError(409, "VERSION_CONFLICT", "The site changed since you loaded it", {
+			expectedVersion: input.expectedVersion,
+			actualVersion: current.version
+		});
+		const metadata = {
+			locales: Object.keys(seo.locales),
+			imageId: seo.imageId,
+			twitterHandle: seo.twitterHandle
+		};
+		await recordAudit(trx, {
+			...context,
+			action: "site.seo_update",
+			target: {
+				type: "site",
+				id: context.site.id
+			},
+			metadata
+		});
+		await writeOutboxEvent(trx, {
+			type: SITE_UPDATED_EVENT,
+			aggregateType: "site",
+			aggregateId: context.site.id,
+			payload: {
+				siteKey: context.site.key,
+				changed: ["seo"]
+			},
+			siteId: context.site.id
+		});
+		return {
+			version: updated.version,
+			seo: readDefaults(updated.seo_defaults)
+		};
 	});
-	if (!policy.allowed) throw context.actor.kind === "anonymous" ? new AppError(401, "UNAUTHENTICATED", "This content needs a delivery token") : new AppError(403, "FORBIDDEN", `Your token may not read "${modelKey}"`);
+};
+const deliveryImage = async (context, imageId) => {
+	if (imageId === null || !context.media) return null;
+	const assets = await findLiveManyOnSite(context.site.id, [imageId], context.db);
+	const [view] = await toAssetViews(context.media, assets, context.db);
+	return view && isPublicImage(view) ? toDeliveryAsset(view) : null;
+};
+/** `GET /api/site`: the site's key, name and SEO defaults, its default image as a delivered asset. */
+const getDeliverySite$1 = async (context) => {
+	await assertReadsSite(context);
+	const row = await findSeoDefaults(context.site.id, context.db);
+	if (!row) throw siteNotFound();
+	const { imageId, ...seo } = readDefaults(row.seo_defaults);
 	return {
-		model,
-		policy
+		key: row.key,
+		name: row.name,
+		seo: {
+			...seo,
+			image: await deliveryImage(context, imageId)
+		}
 	};
 };
-const deliveryEnvironment = (context, executor, source, locale) => ({
+//#endregion
+//#region src/services/contentDeliveryReads.ts
+/**
+* Delivery-shaped reads (delivery, preview, GraphQL root fields) at one consistent moment (plan
+* delivery-perf). The heads, the page total and the site's publication sequence come from one statement, so
+* a read that needs nothing else (no relation, populate or asset follow-up) runs without a transaction.
+* Anything that needs a follow-up statement runs in one REPEATABLE READ, read-only transaction, so every
+* statement of the response sees the moment `meta.snapshot` names.
+*/
+const deliveryEnvironment = (context, executor, source, locale, richText, seo) => ({
 	executor,
 	snapshot: context.snapshot,
 	permissions: context.permissions,
@@ -18040,91 +18704,101 @@ const deliveryEnvironment = (context, executor, source, locale) => ({
 	audience: "delivery",
 	source,
 	locale,
-	...context.media ? { media: context.media } : {}
+	...context.media ? { media: context.media } : {},
+	...richText ? { richText } : {},
+	...seo ? { seo } : {}
 });
-/** Runs a delivery read in one consistent transaction at the requested (or current) publication sequence. */
-const atSnapshot = async (context, query, options, read) => withConsistentRead(async (trx) => {
-	const current = await currentSeq(context.site.id, trx);
-	if (query.snapshot !== void 0 && options.drafts) throw queryInvalid("snapshot reads published content; it cannot be combined with drafts");
-	if (query.snapshot !== void 0 && query.snapshot > current) throw snapshotInvalid(query.snapshot, current);
-	const source = options.drafts ? {
-		kind: "heads",
-		state: "draft"
-	} : query.snapshot !== void 0 ? {
-		kind: "snapshot",
-		seq: query.snapshot
-	} : {
-		kind: "heads",
-		state: "published"
-	};
-	return read(deliveryEnvironment(context, trx, source, query.locale), query.snapshot ?? current);
-}, context.db);
+const environmentOf = (read, executor) => deliveryEnvironment(read.context, executor, read.source, read.query.locale, read.query.richText, read.seo);
 /**
-* Counts a successful REST read for field usage (plan developer-face §5): once per request, after the
-* projection, by principal. Admin users and draft reads are never counted.
+* Selected top-level relation or media fields, populate, or a default SEO image to show: the read will need a
+* follow-up statement.
 */
-const recordUsage = async (context, options, model, policy, query) => {
-	const principalKey = usagePrincipalKey(context.actor);
-	if (!options.usage || options.drafts || principalKey === null) return;
-	const reads = await restFieldReads({
-		snapshot: context.snapshot,
-		model,
-		policy,
-		query,
-		policyFor: (modelId) => context.permissions.evaluate(context.actor, {
-			action: "read",
-			modelId
-		})
-	});
-	options.usage.recordRequest(context.site.id, principalKey, query.snapshot ?? null);
-	options.usage.recordFieldReads(context.site.id, principalKey, model.definition.id, reads);
+const followsUp = (read) => read.query.populate.size > 0 || selectFields(read.model, read.policy.readMask, read.query.fields).some((field) => field.type === "relation" || field.type === "media" || Boolean(read.seo?.imageId) && isSeoField(field));
+/**
+* Loads the site's SEO defaults when the query asks for resolved SEO. Read before the heads, outside their
+* consistent moment: defaults are not part of a snapshot (`?snapshot=N&seo=resolved` uses today's).
+*/
+const withSeoDefaults = async (read) => read.query.seo === "resolved" ? {
+	...read,
+	seo: await loadSeoDefaults(read.context.site.id, read.context.db)
+} : read;
+const seqOf = (seq) => {
+	if (seq === null) throw new Error("The site has no publication state");
+	return seq;
+};
+/**
+* Runs the plan's statement on the pool when the read cannot need a follow-up, and keeps that result when
+* the rows indeed need none; otherwise reads again inside one REPEATABLE READ transaction. `finish` projects
+* the rows (through the same executor), so its own statements see the same moment.
+*/
+const readConsistently = async (read, plan, options, finish) => {
+	const compiled = compileHeadPage(plan, options);
+	const { db } = read.context;
+	if (!followsUp(read)) {
+		const env = environmentOf(read, db);
+		const { rows, meta } = await runHeadPage(compiled.rows, db);
+		if (meta && !needsFollowUpReads(env, read.model, rows, read.query, read.policy)) return finish({
+			env,
+			rows,
+			total: meta.total,
+			seq: seqOf(meta.seq)
+		});
+	}
+	return withConsistentRead(async (trx) => {
+		const env = environmentOf(read, trx);
+		const page = await runHeadPage(compiled.rows, trx);
+		const meta = page.meta ?? await runHeadPageMeta(compiled.meta, trx);
+		return finish({
+			env,
+			rows: page.rows,
+			total: meta.total,
+			seq: seqOf(meta.seq)
+		});
+	}, db);
 };
-const toEntries = (env, projected) => projected.map(({ row, data }) => ({
+const localesOf = (read) => readScopeFor(read.context.snapshot, read.model.definition, read.query.locale, { fallback: read.fallback });
+const toEntries = async (read, env, rows) => (await projectRows(env, read.model, read.policy, rows, read.query)).map(({ row, data }) => ({
 	...systemAttributes(env, row),
 	...data
 }));
-const ITEM_PARAMETERS$1 = /* @__PURE__ */ new Set([
-	"fields",
-	"populate",
-	"locale",
-	"snapshot"
-]);
-/** Reading one entry takes only these query parameters; anything else is refused, not ignored. */
-const assertItemParameters = (rawQuery, allowed) => {
-	const unsupported = [...new URLSearchParams(rawQuery).keys()].find((key) => !allowed.has(key.split("[")[0] ?? key));
-	if (unsupported !== void 0) throw queryInvalid(`"${unsupported}" is not supported when reading one entry`);
-};
-const localesOf = (read) => readScopeFor(read.context.snapshot, read.model.definition, read.query.locale, { fallback: read.fallback });
-/** One page of entries in the delivery shape, with the total and the page size used. */
-const readEntryPage = async (read) => {
-	const { context, env, model, policy, query } = read;
+/**
+* One page of entries in the delivery shape, with the total (`total: false` skips counting: a singleton) and
+* the publication sequence it was read at. `check` runs on the sequence before anything is projected.
+*/
+const readEntryPage = async (unloaded, options = { total: true }) => {
+	const read = await withSeoDefaults(unloaded);
+	const { context, model, policy, query } = read;
 	const { limit, offset } = toLimitOffset(query.page, query.pageSize);
 	const sort = query.sort.length > 0 ? query.sort : defaultSortTerms(model.definition, (field) => maskAllows(policy.readMask, field));
-	const compiled = compileHeadQuery({
+	const plan = {
 		siteId: context.site.id,
 		modelId: model.definition.id,
-		source: env.source,
+		source: read.source,
 		locales: localesOf(read),
 		conditions: [...queryConditions(context, query, policy), ...read.conditions ?? []],
 		orderBy: compileOrderBy(sort),
 		orderedByEntry: leadsWithEntryColumn(sort),
 		limit,
 		offset
-	});
-	const rows = await runHeadQuery(compiled.rows, env.executor);
-	return {
-		entries: toEntries(env, await projectRows(env, model, policy, rows, query)),
-		limit,
-		count: () => runCountQuery(compiled.count, env.executor)
 	};
+	return readConsistently(read, plan, { total: options.total }, async ({ env, rows, total, seq }) => {
+		options.check?.(seq);
+		return {
+			entries: await toEntries(read, env, rows),
+			limit,
+			total: total ?? 0,
+			seq
+		};
+	});
 };
-/** One entry by ID in the delivery shape, or undefined when it is not there for this read. */
-const readOneEntry = async (read, id) => {
-	const { context, env, model, policy, query } = read;
-	const byId = compileHeadQuery({
+/** One entry by ID in the delivery shape (undefined when it is not there for this read), and the sequence. */
+const readOneEntry = async (unloaded, id, options = {}) => {
+	const read = await withSeoDefaults(unloaded);
+	const { context, model, policy, query } = read;
+	const plan = {
 		siteId: context.site.id,
 		modelId: model.definition.id,
-		source: env.source,
+		source: read.source,
 		locales: localesOf(read),
 		conditions: [
 			...queryConditions(context, {
@@ -18137,77 +18811,19 @@ const readOneEntry = async (read, id) => {
 		],
 		orderBy: [],
 		limit: 1
-	});
-	const rows = await runHeadQuery(byId.rows, env.executor);
-	const [entry] = toEntries(env, await projectRows(env, model, policy, rows, query));
-	return entry;
-};
-/** `GET /api/content/:modelKey`: a page of a collection, or a singleton's one entry. */
-const listDelivery$1 = async (context, modelKey, rawQuery, options = {}) => {
-	const { model, policy } = await readableModel(context, modelKey);
-	const query = parseQueryFor(context, model, policy, rawQuery, { allowSnapshot: true });
-	const locale = query.locale ?? context.snapshot.defaultLocale;
-	const result = await atSnapshot(context, query, options, async (env, seq) => {
-		const { entries, limit, count } = await readEntryPage({
-			context,
-			env,
-			model,
-			policy,
-			query,
-			fallback: options.fallback ?? true
-		});
-		if (model.definition.kind === "singleton") {
-			const [entry] = entries;
-			if (!entry) throw entryNotFound(modelKey);
-			return {
-				data: entry,
-				meta: {
-					locale,
-					snapshot: seq
-				}
-			};
-		}
-		return {
-			data: entries,
-			meta: {
-				locale,
-				snapshot: seq,
-				pagination: paginationMeta(query.page, limit, await count())
-			}
-		};
-	});
-	await recordUsage(context, options, model, policy, query);
-	return result;
-};
-/** `GET /api/content/:modelKey/:id`: one published entry (404 for drafts, unknown or unreadable entries). */
-const getDelivery$1 = async (context, modelKey, id, rawQuery, options = {}) => {
-	assertItemParameters(rawQuery, ITEM_PARAMETERS$1);
-	const { model, policy } = await readableModel(context, modelKey);
-	const query = parseQueryFor(context, model, policy, rawQuery, { allowSnapshot: true });
-	const result = await atSnapshot(context, query, options, async (env, seq) => {
-		const entry = await readOneEntry({
-			context,
-			env,
-			model,
-			policy,
-			query,
-			fallback: options.fallback ?? true
-		}, id);
-		if (!entry) throw entryNotFound(id);
+	};
+	return readConsistently(read, plan, { total: false }, async ({ env, rows, seq }) => {
+		options.check?.(seq);
+		const [entry] = await toEntries(read, env, rows);
 		return {
-			data: entry,
-			meta: {
-				locale: query.locale ?? context.snapshot.defaultLocale,
-				snapshot: seq
-			}
+			entry,
+			seq
 		};
 	});
-	await recordUsage(context, options, model, policy, query);
-	return result;
 };
 //#endregion
 //#region src/services/contentBatchReads.ts
-const sourceOf = (options) => {
+const sourceOf$1 = (options) => {
 	if (options.drafts) return {
 		kind: "heads",
 		state: "draft"
@@ -18225,7 +18841,7 @@ const loadDeliveryEntries = async (context, modelId, ids, options) => {
 	const found = /* @__PURE__ */ new Map();
 	const model = resolveModelById(context.snapshot, modelId);
 	if (!model || ids.length === 0) return found;
-	const env = deliveryEnvironment(context, context.db, sourceOf(options), options.locale);
+	const env = deliveryEnvironment(context, context.db, sourceOf$1(options), options.locale);
 	const policy = await readPolicy(env, modelId);
 	const scope = readScopeFor(context.snapshot, model.definition, options.locale, { fallback: options.fallback });
 	const rows = await fetchHeadsByIds(env, model, policy, ids, scope);
@@ -18247,7 +18863,7 @@ const loadDeliveryLocalizations = async (context, modelId, entryIds, options) =>
 	const found = new Map(entryIds.map((id) => [id, []]));
 	const model = resolveModelById(context.snapshot, modelId);
 	if (!model || !model.definition.localized || entryIds.length === 0) return found;
-	const source = sourceOf({
+	const source = sourceOf$1({
 		...options,
 		locale: void 0,
 		fallback: false
@@ -18307,48 +18923,17 @@ const createLoaders = (siteId, content) => {
 	};
 };
 //#endregion
-//#region src/schema/codegen/graphql/permissions.ts
+//#region src/controllers/contentContext.ts
 /**
-* The request's evaluator, memoized per (model, action): a GraphQL request touches the same models many
-* times (lists, relation batches, localizations), and evaluates each policy once (ADR 0005). Calls for
-* another principal (never made by content services today) bypass the memo. The memo is kept per executor:
-* a policy evaluated inside one root field's read transaction is never awaited from another's.
+* The service context for a content request: the pinned snapshot, the principal and dependencies.
+* `permissions` is the request's evaluator: checked against the versions the request read once, and
+* memoized per (principal, action, model), so the read, relation visibility, populate and usage recording
+* evaluate each model's policy once.
 */
-const memoizePermissions = (base, principal) => {
-	const pooled = /* @__PURE__ */ new Map();
-	const byTransaction = /* @__PURE__ */ new WeakMap();
-	const memoFor = (executor) => {
-		if (!executor) return pooled;
-		let memo = byTransaction.get(executor);
-		if (!memo) {
-			memo = /* @__PURE__ */ new Map();
-			byTransaction.set(executor, memo);
-		}
-		return memo;
-	};
-	return {
-		evaluate: (caller, request, executor) => {
-			if (caller !== principal) return base.evaluate(caller, request, executor);
-			const memo = memoFor(executor);
-			const key = `${request.action}:${request.modelId}`;
-			let policy = memo.get(key);
-			if (!policy) {
-				policy = base.evaluate(caller, request, executor);
-				memo.set(key, policy);
-			}
-			return policy;
-		},
-		canPerform: (caller, action, executor) => base.canPerform(caller, action, executor),
-		canPerformOnSite: (caller, action, siteId, executor) => base.canPerformOnSite(caller, action, siteId, executor)
-	};
-};
-//#endregion
-//#region src/controllers/contentContext.ts
-/** The service context for a content request: the pinned snapshot, the principal and dependencies. */
 const contentContextFor = async (request) => ({
 	db: request.server.db,
 	snapshot: await getRequestSchema(request),
-	permissions: request.server.permissions,
+	permissions: getRequestPermissions(request),
 	actor: request.principal,
 	site: getRequestSite(request),
 	hooks: request.server.contentHooks,
@@ -18383,7 +18968,7 @@ const isAdminPrincipal = (principal) => principal.kind === "admin" || principal.
 /** The context every resolver of one `/api/graphql` request receives (built after site resolution). */
 const createGraphqlRequestContext = (request) => {
 	const site = getRequestSite(request);
-	const permissions = memoizePermissions(request.server.permissions, request.principal);
+	const permissions = getRequestPermissions(request);
 	let base;
 	const content = async (snapshot) => {
 		base ??= contentContextFor(request);
@@ -18469,9 +19054,16 @@ const BOOTSTRAP = `(() => {
   const root = document.getElementById('graphiql');
   const endpoint = root.dataset.endpoint;
   const csrfUrl = root.dataset.csrf;
+  const props = { shouldPersistHeaders: false };
+  if (root.dataset.query) {
+    props.query = root.dataset.query;
+  }
+  if (root.dataset.theme) {
+    props.forcedTheme = root.dataset.theme;
+  }
   const start = (csrfToken) => {
     const fetcher = GraphiQL.createFetcher({ url: endpoint, headers: { 'x-csrf-token': csrfToken } });
-    ReactDOM.createRoot(root).render(React.createElement(GraphiQL, { fetcher, shouldPersistHeaders: false }));
+    ReactDOM.createRoot(root).render(React.createElement(GraphiQL, { ...props, fetcher }));
   };
   fetch(csrfUrl, { credentials: 'same-origin' })
     .then((response) => {
@@ -18504,9 +19096,11 @@ const loadPlaygroundAssets = () => {
 	});
 	return assets;
 };
+const dataAttribute = (name, value) => value === void 0 || value === "" ? "" : ` data-${name}="${escapeHtml$1(value)}"`;
 /** The playground page; `assetsPath` and the URLs are absolute paths (BASE_PATH included). */
-const renderPlaygroundPage = (urls) => {
+const renderPlaygroundPage = (urls, options = {}) => {
 	const asset = (file) => escapeHtml$1(`${urls.assets}/${file}`);
+	const extra = dataAttribute("query", options.query) + dataAttribute("theme", options.theme);
 	return `<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Shapio GraphQL</title>
@@ -18514,7 +19108,7 @@ const renderPlaygroundPage = (urls) => {
 <link rel="stylesheet" href="${asset("playground.css")}">
 </head>
 <body>
-<div id="graphiql" data-endpoint="${escapeHtml$1(urls.endpoint)}" data-csrf="${escapeHtml$1(urls.csrf)}">Loading…</div>
+<div id="graphiql" data-endpoint="${escapeHtml$1(urls.endpoint)}" data-csrf="${escapeHtml$1(urls.csrf)}"${extra}>Loading…</div>
 <script src="${asset("react.production.min.js")}"><\/script>
 <script src="${asset("react-dom.production.min.js")}"><\/script>
 <script src="${asset("graphiql.min.js")}"><\/script>
@@ -18524,15 +19118,21 @@ const renderPlaygroundPage = (urls) => {
 //#endregion
 //#region src/controllers/graphqlPlayground.ts
 let assets;
-/** The page is a network route; `?site=` only chooses the site its GraphQL requests name (`?site=` on the endpoint). */
+/**
+* The page is a network route; `?site=` only chooses the site its GraphQL requests name (`?site=` on the
+* endpoint). `?query=` opens the editor on that operation, `?theme=light|dark` fixes GraphiQL's theme.
+*/
 const getPlaygroundPage = async (request, reply) => {
 	const { urls } = request.server;
 	const endpoint = urls.withBasePath("/api/graphql");
-	const { site } = request.query;
+	const { site, query, theme } = request.query;
 	return reply.type("text/html; charset=utf-8").send(renderPlaygroundPage({
 		assets: urls.withBasePath("/api/graphql/playground"),
 		endpoint: site === void 0 ? endpoint : `${endpoint}?${SITE_QUERY_PARAMETER}=${encodeURIComponent(site)}`,
 		csrf: urls.withBasePath("/api/admin/auth/csrf")
+	}, {
+		query,
+		theme
 	}));
 };
 const getPlaygroundAsset = async (request, reply) => {
@@ -18590,7 +19190,11 @@ const graphqlPlaygroundRoutes = async (app) => {
 	app.get("/playground", {
 		...admin,
 		schema: {
-			querystring: Type.Object({ [SITE_QUERY_PARAMETER]: Type.Optional(Type.String({ pattern: SITE_KEY_PATTERN })) }),
+			querystring: Type.Object({
+				[SITE_QUERY_PARAMETER]: Type.Optional(Type.String({ pattern: SITE_KEY_PATTERN })),
+				query: Type.Optional(Type.String({ maxLength: PLAYGROUND_QUERY_MAX_LENGTH })),
+				theme: Type.Optional(Type.Enum(PLAYGROUND_THEMES))
+			}),
 			response: { 200: Type.String() }
 		}
 	}, getPlaygroundPage);
@@ -18606,10 +19210,6 @@ const graphqlPlaygroundRoutes = async (app) => {
 	}, getPlaygroundAsset);
 };
 //#endregion
-//#region src/constants/graphql.ts
-/** A site's GraphQL schema is dropped from memory when no request has used it for this long. */
-const GRAPHQL_SITE_SCHEMA_IDLE_MS = 6e5;
-//#endregion
 //#region src/schema/codegen/graphql/documentCache.ts
 const createDocumentCache = (maxEntries = 500) => {
 	const bySchema = /* @__PURE__ */ new WeakMap();
@@ -18661,7 +19261,7 @@ const memoType = (cache, key, create) => {
 * The types every Shapio GraphQL schema has. All of their names are in `RESERVED_TYPE_NAMES`
 * (`@shapio/schema` naming.ts), so no model can collide with them.
 */
-const nonNull$1 = (type) => new GraphQLNonNull(type);
+const nonNull$2 = (type) => new GraphQLNonNull(type);
 const createJsonScalar = () => new GraphQLScalarType({
 	name: "JSON",
 	description: "Any JSON value (JSON fields and rich-text documents).",
@@ -18716,7 +19316,7 @@ const filterType = (name, value, operators) => new GraphQLInputObjectType({
 	fields: () => {
 		const fields = {};
 		for (const operator of operators) {
-			const type = operator === "$null" || operator === "$notNull" ? GraphQLBoolean : operator === "$in" || operator === "$nin" ? new GraphQLList(nonNull$1(value)) : value;
+			const type = operator === "$null" || operator === "$notNull" ? GraphQLBoolean : operator === "$in" || operator === "$nin" ? new GraphQLList(nonNull$2(value)) : value;
 			fields[operatorFieldName(operator)] = {
 				type,
 				description: OPERATOR_DESCRIPTIONS[operator]
@@ -18740,15 +19340,15 @@ const createFilterTypes = (int53) => ({
 const createPageInfo = () => new GraphQLObjectType({
 	name: "PageInfo",
 	fields: {
-		page: { type: nonNull$1(GraphQLInt) },
-		pageSize: { type: nonNull$1(GraphQLInt) },
-		pageCount: { type: nonNull$1(GraphQLInt) },
+		page: { type: nonNull$2(GraphQLInt) },
+		pageSize: { type: nonNull$2(GraphQLInt) },
+		pageCount: { type: nonNull$2(GraphQLInt) },
 		hasNextPage: {
-			type: nonNull$1(GraphQLBoolean),
+			type: nonNull$2(GraphQLBoolean),
 			resolve: (info) => info.page < info.pageCount
 		},
 		hasPreviousPage: {
-			type: nonNull$1(GraphQLBoolean),
+			type: nonNull$2(GraphQLBoolean),
 			resolve: (info) => info.page > 1
 		}
 	}
@@ -18758,13 +19358,13 @@ const createRichText = (json) => new GraphQLObjectType({
 	description: "A rich-text document: the versioned JSON document and its sanitized HTML rendering.",
 	fields: {
 		json: {
-			type: nonNull$1(json),
+			type: nonNull$2(json),
 			description: "`{ format, version, doc }` (ProseMirror JSON)",
-			resolve: ({ html: _html, ...document }) => document
+			resolve: ({ html: _html, [RICH_TEXT_HTML]: _render, ...document }) => document
 		},
 		html: {
-			type: nonNull$1(GraphQLString),
-			resolve: (value) => value.html ?? ""
+			type: nonNull$2(GraphQLString),
+			resolve: (value) => value[RICH_TEXT_HTML]?.() ?? (typeof value.html === "string" ? value.html : "")
 		}
 	}
 });
@@ -18772,36 +19372,36 @@ const createFocalPoint = () => new GraphQLObjectType({
 	name: "FocalPoint",
 	description: "Where the subject of an image is, as fractions of its width and height (0 to 1).",
 	fields: {
-		x: { type: nonNull$1(GraphQLFloat) },
-		y: { type: nonNull$1(GraphQLFloat) }
+		x: { type: nonNull$2(GraphQLFloat) },
+		y: { type: nonNull$2(GraphQLFloat) }
 	}
 });
 const createMediaVariant = () => new GraphQLObjectType({
 	name: "MediaVariant",
 	description: "A ready image variant (thumbnail, responsive width, converted format).",
 	fields: {
-		name: { type: nonNull$1(GraphQLString) },
+		name: { type: nonNull$2(GraphQLString) },
 		width: { type: GraphQLInt },
 		height: { type: GraphQLInt },
 		format: { type: GraphQLString },
-		mimeType: { type: nonNull$1(GraphQLString) },
-		url: { type: nonNull$1(GraphQLString) }
+		mimeType: { type: nonNull$2(GraphQLString) },
+		url: { type: nonNull$2(GraphQLString) }
 	}
 });
 const createMedia = (focalPoint, variant) => new GraphQLObjectType({
 	name: "Media",
 	description: "A media asset. Private assets carry signed URLs that expire at `urlExpiresAt`.",
 	fields: {
-		id: { type: nonNull$1(GraphQLID) },
-		filename: { type: nonNull$1(GraphQLString) },
-		mimeType: { type: nonNull$1(GraphQLString) },
-		sizeBytes: { type: nonNull$1(GraphQLFloat) },
+		id: { type: nonNull$2(GraphQLID) },
+		filename: { type: nonNull$2(GraphQLString) },
+		mimeType: { type: nonNull$2(GraphQLString) },
+		sizeBytes: { type: nonNull$2(GraphQLFloat) },
 		width: { type: GraphQLInt },
 		height: { type: GraphQLInt },
-		alt: { type: nonNull$1(GraphQLString) },
-		caption: { type: nonNull$1(GraphQLString) },
+		alt: { type: nonNull$2(GraphQLString) },
+		caption: { type: nonNull$2(GraphQLString) },
 		focalPoint: { type: focalPoint },
-		url: { type: nonNull$1(GraphQLString) },
+		url: { type: nonNull$2(GraphQLString) },
 		urlExpiresAt: { type: GraphQLString },
 		variants: { type: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(variant))) }
 	}
@@ -18810,15 +19410,15 @@ const createMedia = (focalPoint, variant) => new GraphQLObjectType({
 const createEntry$2 = () => new GraphQLObjectType({
 	name: "Entry",
 	fields: {
-		id: { type: nonNull$1(GraphQLID) },
-		locale: { type: nonNull$1(GraphQLString) },
-		version: { type: nonNull$1(GraphQLInt) },
+		id: { type: nonNull$2(GraphQLID) },
+		locale: { type: nonNull$2(GraphQLString) },
+		version: { type: nonNull$2(GraphQLInt) },
 		status: {
-			type: nonNull$1(GraphQLString),
+			type: nonNull$2(GraphQLString),
 			description: "draft, published or modified"
 		},
-		createdAt: { type: nonNull$1(GraphQLString) },
-		updatedAt: { type: nonNull$1(GraphQLString) },
+		createdAt: { type: nonNull$2(GraphQLString) },
+		updatedAt: { type: nonNull$2(GraphQLString) },
 		publishedAt: { type: GraphQLString }
 	}
 });
@@ -19488,6 +20088,12 @@ const updateDeliveryEntry$1 = async (context, modelKey, id, input) => toResult(a
 }));
 const deleteDeliveryEntry$1 = (context, modelKey, id) => deleteEntry$1(context, modelKey, id);
 //#endregion
+//#region src/schema/codegen/graphql/descriptions.ts
+const describeDefinition = ({ label, description }) => {
+	const help = description?.trim();
+	return help ? `${label}\n\n${help}` : label;
+};
+//#endregion
 //#region src/schema/codegen/graphql/context.ts
 /** An entry as a GraphQL source object. Drafts carry no publication time. */
 const entryNode = (entry, scope) => ({
@@ -19627,7 +20233,7 @@ const definitionFields = (build, owner, masked) => {
 		const resolve = config.resolve;
 		fields[field.apiKey] = {
 			...config,
-			...field.description ? { description: field.description } : {},
+			description: describeDefinition(field),
 			resolve: (node, args, context, info) => {
 				if (masked && !Object.hasOwn(node.data, field.apiKey)) {
 					if (field.required) throw maskedFieldError(field);
@@ -19641,7 +20247,7 @@ const definitionFields = (build, owner, masked) => {
 };
 const componentType = (build, component) => memoType(build.objects, component.id, () => new GraphQLObjectType({
 	name: componentTypeName(component),
-	description: component.description ?? component.label,
+	description: describeDefinition(component),
 	fields: () => definitionFields(build, component, false)
 }));
 const SYSTEM_STRING = (name) => ({
@@ -19651,7 +20257,7 @@ const SYSTEM_STRING = (name) => ({
 const entryType = (build, model) => memoType(build.objects, model.id, () => {
 	const type = new GraphQLObjectType({
 		name: modelTypeName(model),
-		description: model.description ?? model.label,
+		description: describeDefinition(model),
 		fields: () => ({
 			id: {
 				type: new GraphQLNonNull(GraphQLID),
@@ -19728,7 +20334,7 @@ const inputFields = (build, owner) => {
 		const type = fieldInputType(build, owner, field);
 		if (type) fields[field.apiKey] = {
 			type,
-			...field.description ? { description: field.description } : {}
+			description: describeDefinition(field)
 		};
 	}
 	return fields;
@@ -19788,6 +20394,172 @@ const toWriteData = (build, owner, input) => {
 	return output;
 };
 //#endregion
+//#region src/usage/restFieldReads.ts
+const restFieldReads = async ({ snapshot, model, policy, query, policyFor }) => {
+	const fields = selectFields(model, policy.readMask, query.fields);
+	const selection = query.fields === null ? "implicit" : "explicit";
+	const reads = fields.map((field) => ({
+		path: field.id,
+		selection
+	}));
+	for (const field of fields) {
+		if (field.type !== "relation" || !query.populate.has(field.id)) continue;
+		const target = resolveModelById(snapshot, field.settings.target);
+		if (!target) continue;
+		const targetPolicy = await policyFor(target.definition.id);
+		if (!targetPolicy.allowed) continue;
+		for (const targetField of selectFields(target, targetPolicy.readMask, null)) reads.push({
+			path: relationFieldPath(field.id, targetField.id),
+			selection: "implicit"
+		});
+	}
+	return reads;
+};
+//#endregion
+//#region src/services/contentDelivery.ts
+const readableModel = async (context, modelKey) => {
+	const model = resolveModel(context.snapshot, modelKey);
+	const policy = await context.permissions.evaluate(context.actor, {
+		action: "read",
+		modelId: model.definition.id
+	});
+	if (!policy.allowed) throw context.actor.kind === "anonymous" ? new AppError(401, "UNAUTHENTICATED", "This content needs a delivery token") : new AppError(403, "FORBIDDEN", `Your token may not read "${modelKey}"`);
+	return {
+		model,
+		policy
+	};
+};
+/** The heads a read serves: drafts (GraphQL previews), a pinned snapshot, or the published heads. */
+const sourceOf = (query, options) => {
+	if (query.snapshot !== void 0 && options.drafts) throw queryInvalid("snapshot reads published content; it cannot be combined with drafts");
+	return options.drafts ? {
+		kind: "heads",
+		state: "draft"
+	} : query.snapshot !== void 0 ? {
+		kind: "snapshot",
+		seq: query.snapshot
+	} : {
+		kind: "heads",
+		state: "published"
+	};
+};
+/** A pinned snapshot must already exist: checked against the sequence the read itself saw. */
+const snapshotCheck = (query) => (current) => {
+	if (query.snapshot !== void 0 && query.snapshot > current) throw snapshotInvalid(query.snapshot, current);
+};
+/**
+* Counts a successful REST read for field usage (plan developer-face §5): once per request, after the
+* projection, by principal. Admin users and draft reads are never counted.
+*/
+const recordUsage = async (context, options, model, policy, query) => {
+	const principalKey = usagePrincipalKey(context.actor);
+	if (!options.usage || options.drafts || principalKey === null) return;
+	const reads = await restFieldReads({
+		snapshot: context.snapshot,
+		model,
+		policy,
+		query,
+		policyFor: (modelId) => context.permissions.evaluate(context.actor, {
+			action: "read",
+			modelId
+		})
+	});
+	options.usage.recordRequest(context.site.id, principalKey, query.snapshot ?? null);
+	options.usage.recordFieldReads(context.site.id, principalKey, model.definition.id, reads);
+};
+/** Records usage after the response when the caller can defer it (REST), else before returning. */
+const afterRead = async (options, task) => {
+	if (options.defer) {
+		options.defer(task);
+		return;
+	}
+	await task();
+};
+const ITEM_PARAMETERS$1 = /* @__PURE__ */ new Set([
+	"fields",
+	"populate",
+	"locale",
+	"snapshot",
+	"richText",
+	"seo"
+]);
+/** Reading one entry takes only these query parameters; anything else is refused, not ignored. */
+const assertItemParameters = (rawQuery, allowed) => {
+	const unsupported = [...new URLSearchParams(rawQuery).keys()].find((key) => !allowed.has(key.split("[")[0] ?? key));
+	if (unsupported !== void 0) throw queryInvalid(`"${unsupported}" is not supported when reading one entry`);
+};
+/** `GET /api/content/:modelKey`: a page of a collection, or a singleton's one entry. */
+const listDelivery$1 = async (context, modelKey, rawQuery, options = {}) => {
+	const { model, policy } = await readableModel(context, modelKey);
+	const query = parseQueryFor(context, model, policy, rawQuery, {
+		allowSnapshot: true,
+		allowRichText: true,
+		allowSeo: true
+	});
+	const locale = query.locale ?? context.snapshot.defaultLocale;
+	const singleton = model.definition.kind === "singleton";
+	const { entries, limit, total, seq } = await readEntryPage({
+		context,
+		source: sourceOf(query, options),
+		model,
+		policy,
+		query,
+		fallback: options.fallback ?? true
+	}, {
+		total: !singleton,
+		check: snapshotCheck(query)
+	});
+	const snapshot = query.snapshot ?? seq;
+	let result;
+	if (singleton) {
+		const [entry] = entries;
+		if (!entry) throw entryNotFound(modelKey);
+		result = {
+			data: entry,
+			meta: {
+				locale,
+				snapshot
+			}
+		};
+	} else result = {
+		data: entries,
+		meta: {
+			locale,
+			snapshot,
+			pagination: paginationMeta(query.page, limit, total)
+		}
+	};
+	await afterRead(options, () => recordUsage(context, options, model, policy, query));
+	return result;
+};
+/** `GET /api/content/:modelKey/:id`: one published entry (404 for drafts, unknown or unreadable entries). */
+const getDelivery$1 = async (context, modelKey, id, rawQuery, options = {}) => {
+	assertItemParameters(rawQuery, ITEM_PARAMETERS$1);
+	const { model, policy } = await readableModel(context, modelKey);
+	const query = parseQueryFor(context, model, policy, rawQuery, {
+		allowSnapshot: true,
+		allowRichText: true,
+		allowSeo: true
+	});
+	const { entry, seq } = await readOneEntry({
+		context,
+		source: sourceOf(query, options),
+		model,
+		policy,
+		query,
+		fallback: options.fallback ?? true
+	}, id, { check: snapshotCheck(query) });
+	if (!entry) throw entryNotFound(id);
+	await afterRead(options, () => recordUsage(context, options, model, policy, query));
+	return {
+		data: entry,
+		meta: {
+			locale: query.locale ?? context.snapshot.defaultLocale,
+			snapshot: query.snapshot ?? seq
+		}
+	};
+};
+//#endregion
 //#region src/schema/codegen/graphql/queryArgs.ts
 /**
 * `XFilter` and `XSort` inputs, and their translation to the REST querystring the content compiler parses
@@ -19834,7 +20606,7 @@ const createFilterInput = (model, fixed) => {
 			for (const [name, filter] of SYSTEM_FILTERS) fields[name] = { type: fixed.filters[filter] };
 			for (const field of filterableFields(model)) fields[field.apiKey] = {
 				type: fixed.filters[FILTER_TYPE_BY_DATA_TYPE[field.type]],
-				...field.description ? { description: field.description } : {}
+				description: describeDefinition(field)
 			};
 			fields.and = {
 				type: new GraphQLList(new GraphQLNonNull(type)),
@@ -20133,6 +20905,65 @@ const mutationFields = (build, model) => {
 	return fields;
 };
 //#endregion
+//#region src/schema/codegen/graphql/siteFields.ts
+/**
+* `_site` (plan seo-fields): the request's site and its SEO defaults, through the same service as REST
+* `GET /api/site`. Underscored like `_snapshot`, so a model called `site` keeps its own root fields; the name
+* and the `SiteInfo`/`SiteSeo*` types are reserved in `@shapio/schema` naming.ts. SEO fields on entries stay
+* raw in GraphQL: merge them with `resolveSeo()` from `@shapio/client`.
+*/
+const SITE_QUERY = "_site";
+const nonNull$1 = (type) => new GraphQLNonNull(type);
+const createTypes$1 = (media) => {
+	const locale = new GraphQLObjectType({
+		name: "SiteSeoLocale",
+		description: "One locale's default SEO texts; a missing one falls back along the locale chain",
+		fields: {
+			locale: { type: nonNull$1(GraphQLString) },
+			siteName: { type: GraphQLString },
+			titleTemplate: {
+				type: GraphQLString,
+				description: "Page titles go through it: `%s` is replaced by the title, e.g. `%s · Acme`"
+			},
+			description: {
+				type: GraphQLString,
+				description: "Used where an entry has no SEO description"
+			}
+		}
+	});
+	const seo = new GraphQLObjectType({
+		name: "SiteSeoDefaults",
+		fields: {
+			locales: {
+				type: nonNull$1(new GraphQLList(nonNull$1(locale))),
+				resolve: (source) => Object.entries(source.locales).map(([code, texts]) => ({
+					locale: code,
+					...texts
+				}))
+			},
+			twitterHandle: { type: GraphQLString },
+			image: {
+				type: media,
+				description: "The default social image (a public image), or null"
+			}
+		}
+	});
+	return new GraphQLObjectType({
+		name: "SiteInfo",
+		description: "The site this request reads, and its SEO defaults",
+		fields: {
+			key: { type: nonNull$1(GraphQLString) },
+			name: { type: nonNull$1(GraphQLString) },
+			seo: { type: nonNull$1(seo) }
+		}
+	});
+};
+const siteQueryFields = (snapshot, fixed) => ({ [SITE_QUERY]: {
+	type: nonNull$1(createTypes$1(fixed.media)),
+	description: "The request's site: its key, name and SEO defaults",
+	resolve: async (_root, _args, context) => getDeliverySite$1(await context.content(snapshot))
+} });
+//#endregion
 //#region src/db/snapshotDiffQuery.ts
 const POSTGRES = {
 	uuid: (value) => sql`${value}::uuid`,
@@ -20533,7 +21364,7 @@ const buildGraphqlSchema = (snapshot) => {
 		description: "The schema version this API reflects; it changes whenever a model changes",
 		resolve: () => snapshot.version
 	};
-	Object.assign(query, snapshotQueryFields(snapshot));
+	Object.assign(query, snapshotQueryFields(snapshot), siteQueryFields(snapshot, build.fixed));
 	const schema = new GraphQLSchema({
 		query: new GraphQLObjectType({
 			name: "Query",
@@ -20817,6 +21648,56 @@ const publishingPlugin = fp(async (app, { runtime }) => {
 	app.decorate("publishing", runtime);
 }, { name: "shapio-publishing" });
 //#endregion
+//#region src/plugins/requestLog.ts
+/** How the caller authenticated, as logged: the principal's kind, never its ids. */
+const PRINCIPAL_LABELS = {
+	anonymous: "anonymous",
+	admin: "admin",
+	token: "token",
+	appUser: "app",
+	system: "system"
+};
+/** The concrete path without its query string, which may carry credentials (signed media URLs, OAuth). */
+const pathOf = (url) => {
+	const queryStart = url.indexOf("?");
+	return queryStart === -1 ? url : url.slice(0, queryStart);
+};
+/** Milliseconds with one decimal. */
+const roundMs = (ms) => Math.round(ms * 10) / 10;
+/**
+* The request's one response line. `request.principal` is undefined when the request failed before
+* authentication ran; `request.site` only on site routes; `request.errorCode` only when the central error
+* handler (plugins/errorHandler.ts) answered.
+*/
+const responseLineOf = (request, reply) => {
+	const principal = request.principal;
+	return {
+		method: request.method,
+		...request.routeOptions.url ? { route: request.routeOptions.url } : {},
+		path: pathOf(request.url),
+		status: reply.statusCode,
+		ms: roundMs(reply.elapsedTime),
+		...request.site ? { site: request.site.key } : {},
+		...principal ? { principal: PRINCIPAL_LABELS[principal.kind] } : {},
+		...request.errorCode ? { code: request.errorCode } : {}
+	};
+};
+/**
+* Replaces Fastify's request logging (`disableRequestLogging`): one info line per response with the fields
+* that matter, and the request-start line (full redacted URL, host, remote address) at debug. The logger's
+* `reqId` binding is `request.id`, the id audit entries and extension contexts carry.
+*/
+const requestLogPlugin = fp(async (app) => {
+	app.addHook("onRequest", async (request) => {
+		request.log.debug({ req: request }, "incoming request");
+	});
+	app.addHook("onResponse", async (request, reply) => {
+		const line = responseLineOf(request, reply);
+		if (request.routeOptions.config?.requestLog === "debug") request.log.debug(line, "request");
+		else request.log.info(line, "request");
+	});
+}, { name: "shapio-request-log" });
+//#endregion
 //#region src/plugins/security.ts
 const CORS_METHODS = [
 	"GET",
@@ -21362,11 +22243,30 @@ const NOOP_USAGE_TRACKER = {
 };
 //#endregion
 //#region src/plugins/usage.ts
+/** Starts queued recordings after the response and lets `flush` and shutdown wait for them. */
+const createAfterResponseQueue = () => {
+	const pending = /* @__PURE__ */ new Set();
+	const run = (log, task) => {
+		const started = new Promise((resolve) => setImmediate(resolve)).then(task).catch((error) => {
+			log.error({ err: error }, "recording field usage failed");
+		}).finally(() => pending.delete(started));
+		pending.add(started);
+	};
+	const settled = async () => {
+		await Promise.all([...pending]);
+	};
+	return {
+		run,
+		settled
+	};
+};
 /**
 * Field usage from delivery traffic (plan developer-face §5): one in-memory aggregator per instance,
 * flushed on a timer, when it fills up, and when the app closes (so a clean shutdown loses nothing).
 */
 const usagePlugin = fp(async (app, { config, db }) => {
+	const queue = createAfterResponseQueue();
+	app.decorate("recordUsageAfterResponse", queue.run);
 	if (!config.enabled) {
 		app.decorate("usage", NOOP_USAGE_TRACKER);
 		return;
@@ -21377,8 +22277,15 @@ const usagePlugin = fp(async (app, { config, db }) => {
 		flushIntervalMs: config.flushIntervalMs,
 		log
 	});
-	app.decorate("usage", aggregator);
+	app.decorate("usage", {
+		...aggregator,
+		flush: async () => {
+			await queue.settled();
+			await aggregator.flush();
+		}
+	});
 	app.addHook("onClose", async () => {
+		await queue.settled();
 		await aggregator.close();
 	});
 }, { name: "shapio-usage" });
@@ -21616,7 +22523,7 @@ const createRole$1 = async (context, input, schema) => {
 				kind: input.kind
 			}, trx);
 			await insertPermissions$1(toRows$1(role.id, input.permissions), trx);
-			await bumpPermissionsVersion(trx);
+			await bumpPermissionsVersion$2(trx);
 			await recordAudit(trx, {
 				...context,
 				action: "role.create",
@@ -21661,7 +22568,7 @@ const updateRole$1 = async (context, id, input, schema) => db.transaction().exec
 	if (input.permissions) {
 		await deletePermissionsForRole$1(id, trx);
 		await insertPermissions$1(toRows$1(id, input.permissions), trx);
-		await bumpPermissionsVersion(trx);
+		await bumpPermissionsVersion$2(trx);
 	}
 	await recordAudit(trx, {
 		...context,
@@ -21684,7 +22591,7 @@ const deleteRole$1 = async (context, id) => {
 		if (holders.users > 0 || holders.tokens > 0) throw new AppError(409, "ROLE_IN_USE", "Remove this role from every admin and API token first", holders);
 		await deleteRevokedForRole(id, trx);
 		await deleteById$5(id, trx);
-		await bumpPermissionsVersion(trx);
+		await bumpPermissionsVersion$2(trx);
 		await recordAudit(trx, {
 			...context,
 			action: "role.delete",
@@ -21758,7 +22665,7 @@ const createAppRole$1 = async (context, input, schema) => {
 				description: input.description.trim()
 			}, trx);
 			await insertPermissions(toRows(role.id, input.permissions), trx);
-			await bumpPermissionsVersion(trx);
+			await bumpPermissionsVersion$2(trx);
 			await recordAudit(trx, {
 				...context,
 				action: "app_role.create",
@@ -21800,7 +22707,7 @@ const updateAppRole$1 = async (context, id, input, schema) => db.transaction().e
 	if (input.permissions) {
 		await deletePermissionsForRole(id, trx);
 		await insertPermissions(toRows(id, input.permissions), trx);
-		await bumpPermissionsVersion(trx);
+		await bumpPermissionsVersion$2(trx);
 	}
 	await recordAudit(trx, {
 		...context,
@@ -21825,7 +22732,7 @@ const deleteAppRole$1 = async (context, id) => {
 		const holders = await countHolders(id, trx);
 		if (holders > 0) throw new AppError(409, "ROLE_IN_USE", "Remove this role from every app user first", { users: holders });
 		await deleteById$2(id, trx);
-		await bumpPermissionsVersion(trx);
+		await bumpPermissionsVersion$2(trx);
 		await recordAudit(trx, {
 			...context,
 			action: "app_role.delete",
@@ -22317,7 +23224,7 @@ const updateAppUser$1 = async (context, id, input) => db.transaction().execute(a
 			}
 		});
 	}
-	await bumpPermissionsVersion(trx);
+	await bumpPermissionsVersion$2(trx);
 	const view = await findSummaryById(id, trx);
 	if (!view) throw notFound$4();
 	return toAdminView(view);
@@ -22339,7 +23246,7 @@ const deleteAppUserInTransaction = async (context, user, trx) => {
 	await endAllSignIns(user.id, now, "deleted", trx);
 	await consumeAllForUser$1("email_confirmations", user.id, now, trx);
 	await consumeAllForUser$1("app_password_resets", user.id, now, trx);
-	await bumpPermissionsVersion(trx);
+	await bumpPermissionsVersion$2(trx);
 	await recordAudit(trx, {
 		...context,
 		action: "app_user.delete",
@@ -23647,7 +24554,6 @@ const toInputFormat = (model, fields, data) => {
 		fields: present,
 		visibleTargets: null,
 		populated: /* @__PURE__ */ new Map(),
-		richTextHtml: false,
 		mediaAssets: null
 	});
 };
@@ -25926,9 +26832,99 @@ const createDefinitionRoutes = (category) => async (app) => {
 	}, handlers.listChanges);
 };
 //#endregion
+//#region src/services/builtinComponents.ts
+const existing = (context, active) => ({
+	status: "existing",
+	definitionId: active.definition.id,
+	version: active.version,
+	schemaVersion: context.snapshot.version
+});
+/** Another definition already holds the API ID in some view the shared component would join. */
+const conflictOf = async (context) => {
+	const taken = context.snapshot.network.definitions.find((entry) => entry.definition.id !== "f3905a00-d2a3-4c62-899a-c894bfd6cb9b" && entry.definition.apiKey.toLowerCase() === "seo".toLowerCase());
+	if (!taken) return;
+	const siteKey = taken.siteId === null ? null : (await loadSiteKeys(context.db)).get(taken.siteId) ?? null;
+	const where = siteKey === null ? "shared with all sites" : `on site "${siteKey}"`;
+	return new AppError(409, "SEO_COMPONENT_CONFLICT", `The API ID "${taken.definition.apiKey}" is already used by the ${taken.definition.kind} "${taken.definition.label}" (${where}). Rename or delete it, then add SEO fields again.`, {
+		definitionId: taken.definition.id,
+		apiKey: taken.definition.apiKey,
+		kind: taken.definition.kind,
+		label: taken.definition.label,
+		scope: taken.siteId === null ? "network" : "site",
+		siteKey
+	});
+};
+/** The SEO component belongs to another site only: it cannot be shared from here. */
+const elsewhere = () => new AppError(409, "SEO_COMPONENT_CONFLICT", "The SEO component is kept on another site. A network admin can share it with all sites.", {
+	definitionId: SEO_COMPONENT_ID,
+	scope: "site"
+});
+/**
+* Makes sure the built-in SEO component is in the request's view: returns it when it is (shared, or, for an
+* instance seeded before it was shared, the site's own), else creates it shared (needs `schema.create` on
+* every site). Idempotent: a concurrent create that won is returned as existing on the next call.
+*/
+const ensureSeoComponent$1 = async (context) => {
+	const inView = context.snapshot.byId.get(SEO_COMPONENT_ID);
+	if (inView) return existing(context, inView);
+	await assertCanCreate(context, null);
+	if (context.snapshot.network.byId.has("f3905a00-d2a3-4c62-899a-c894bfd6cb9b")) throw elsewhere();
+	const conflict = await conflictOf(context);
+	if (conflict) throw conflict;
+	const outcome = await applyChange(context, {
+		category: "component",
+		definition: seoComponentDefinition(),
+		expectedVersion: null,
+		scope: "network"
+	});
+	if (outcome.status !== "activated") throw new Error(`Creating the SEO component ended ${outcome.status}`);
+	return {
+		status: "created",
+		definitionId: outcome.definitionId,
+		version: outcome.version ?? 1,
+		schemaVersion: outcome.schemaVersion
+	};
+};
+//#endregion
+//#region src/controllers/builtinComponents.ts
+const ensureSeoComponent = async (request, reply) => {
+	const outcome = await ensureSeoComponent$1(await schemaContextFor(request));
+	return reply.code(outcome.status === "created" ? 201 : 200).send(outcome);
+};
+//#endregion
+//#region src/routes/admin/components/builtinSchemas.ts
+const EnsureOutcomeSchema = Type.Object({
+	/** `created` when this call created it (a new schema version), `existing` when it was already there. */
+	status: Type.Enum(["existing", "created"]),
+	definitionId: Type.String(),
+	version: Type.Integer(),
+	schemaVersion: Type.Integer()
+});
+const ensureSeoComponentSchema = { response: {
+	200: EnsureOutcomeSchema,
+	201: EnsureOutcomeSchema,
+	403: ErrorResponseSchema,
+	409: ErrorResponseSchema,
+	422: ErrorResponseSchema
+} };
+//#endregion
+//#region src/routes/admin/components/builtin.ts
+/** /api/admin/components/builtin: Shapio's built-in components, created on first use (plan seo-fields). */
+const builtinComponentsRoutes = async (app) => {
+	declareSiteScope(app, "site");
+	app.post("/seo/ensure", {
+		schema: ensureSeoComponentSchema,
+		preHandler: app.requireAdmin,
+		config: { audit: { action: "schema.activate" } }
+	}, ensureSeoComponent);
+};
+//#endregion
 //#region src/routes/admin/components/index.ts
-/** /api/admin/components: reusable components (no entries of their own). */
-const componentsRoutes = createDefinitionRoutes("component");
+/** /api/admin/components: reusable components (no entries of their own), and the built-in ones. */
+const componentsRoutes = async (app) => {
+	await app.register(createDefinitionRoutes("component"));
+	await app.register(builtinComponentsRoutes, { prefix: "/builtin" });
+};
 //#endregion
 //#region src/controllers/adminContent.ts
 const revisionSummary = (row) => ({
@@ -27947,6 +28943,60 @@ const adminSetupRoutes = async (app) => {
 	}, completeSetup);
 };
 //#endregion
+//#region src/controllers/siteSeo.ts
+const contextFor$2 = async (request) => ({
+	...toSiteActorContext(request),
+	db: request.server.db,
+	snapshot: await getRequestSchema(request),
+	permissions: getRequestPermissions(request)
+});
+const getSiteSeo = async (request) => getSiteSeo$1(await contextFor$2(request));
+const updateSiteSeo = async (request) => updateSiteSeo$1(await contextFor$2(request), request.body);
+//#endregion
+//#region src/routes/admin/site/schemas.ts
+/** The request's site's SEO defaults and the site version an update must name. */
+const SiteSeoSchema = Type.Object({
+	version: Type.Integer(),
+	seo: SeoDefaultsSchema
+});
+const getSiteSeoSchema = { response: {
+	200: SiteSeoSchema,
+	403: ErrorResponseSchema,
+	404: ErrorResponseSchema
+} };
+const updateSiteSeoSchema = {
+	body: Type.Object({
+		expectedVersion: Type.Integer({ minimum: 1 }),
+		seo: SeoDefaultsSchema
+	}, { additionalProperties: false }),
+	response: {
+		200: SiteSeoSchema,
+		400: ErrorResponseSchema,
+		404: ErrorResponseSchema,
+		409: ErrorResponseSchema
+	}
+};
+//#endregion
+//#region src/routes/admin/site/index.ts
+/**
+* /api/admin/site: the request's site's own settings (plan seo-fields), named by the `Shapio-Site` header.
+* Reading them needs read access to some content of the site (checked by the service); changing them needs
+* `site.settings` on that site (a site admin needs no network role).
+*/
+const adminSiteRoutes = async (app) => {
+	declareSiteScope(app, "site");
+	const settings = { preHandler: app.requireGlobalPermission("site.settings") };
+	app.get("/seo", {
+		schema: getSiteSeoSchema,
+		preHandler: app.requireAdmin
+	}, getSiteSeo);
+	app.put("/seo", {
+		schema: updateSiteSeoSchema,
+		config: { audit: { action: "site.seo_update" } },
+		...settings
+	}, updateSiteSeo);
+};
+//#endregion
 //#region src/services/siteAppRoles.ts
 const toView$3 = (siteId, rows) => {
 	const of = (audience) => rows.filter((row) => row.audience === audience).map((row) => row.role_id);
@@ -27976,7 +29026,7 @@ const setSiteAppRoles$1 = async (context, siteId, input) => db.transaction().exe
 	const before = toView$3(siteId, await listForSite$1(siteId, trx));
 	await replaceForAudience(siteId, "public", next.public, trx);
 	await replaceForAudience(siteId, "authenticated", next.authenticated, trx);
-	await bumpPermissionsVersion(trx);
+	await bumpPermissionsVersion$2(trx);
 	await recordAudit(trx, {
 		...context,
 		action: "site.app_roles_update",
@@ -28090,10 +29140,10 @@ const adminSitesRoutes = async (app) => {
 };
 //#endregion
 //#region src/controllers/apiTokens.ts
-const listTokens = async (request) => listApiTokens(toSiteActorContext(request), request.server.permissions);
+const listTokens = async (request) => listApiTokens(toSiteActorContext(request), getRequestPermissions(request));
 const createToken = async (request, reply) => {
 	const { name, roleId, expiresAt, network } = request.body;
-	const created = await createApiToken(toSiteActorContext(request), request.server.permissions, {
+	const created = await createApiToken(toSiteActorContext(request), getRequestPermissions(request), {
 		name,
 		roleId,
 		expiresAt: expiresAt ? new Date(expiresAt) : null,
@@ -28102,7 +29152,7 @@ const createToken = async (request, reply) => {
 	return reply.code(201).send(created);
 };
 const revokeToken = async (request, reply) => {
-	await revokeApiToken(toSiteActorContext(request), request.server.permissions, request.params.id);
+	await revokeApiToken(toSiteActorContext(request), getRequestPermissions(request), request.params.id);
 	return reply.code(204).send();
 };
 //#endregion
@@ -28682,6 +29732,7 @@ const adminIdentityRoutes = async (app) => {
 	await app.register(adminEditingRoutes);
 	await app.register(adminUsageRoutes, { prefix: "/usage" });
 	await app.register(adminSitesRoutes, { prefix: "/sites" });
+	await app.register(adminSiteRoutes, { prefix: "/site" });
 };
 //#endregion
 //#region src/services/locales.ts
@@ -29362,7 +30413,7 @@ const mediaContextFor = (request) => {
 		storage: server.mediaStorage,
 		urls: server.urls,
 		signingSecret: server.signingSecret,
-		permissions: server.permissions,
+		permissions: getRequestPermissions(request),
 		limits: {
 			maxUploadBytes: server.config.storage.maxUploadBytes,
 			allowedTypes: server.config.storage.allowedTypes
@@ -31317,7 +32368,8 @@ const requestJson = async (runtime, input) => {
 		status: response.status,
 		ok: isSuccessStatus(response.status),
 		json,
-		text: response.body
+		text: response.body,
+		location: response.headers.location
 	};
 };
 /** A short, safe description of a failed provider response (status plus the provider's own message). */
@@ -31398,6 +32450,28 @@ const findDeploymentSince$1 = async (context, since) => {
 		return (deployment.deployment_trigger?.type === void 0 || deployment.deployment_trigger.type === "deploy_hook") && createdSince(toEpochMs(deployment.created_on), since);
 	});
 };
+const isFinished = (deployment) => {
+	const { name, status } = deployment.latest_stage ?? {};
+	return status === "failure" || status === "canceled" || status === "skipped" || name === "deploy" && status === "success";
+};
+/** The newest unfinished deployment, whatever started it (the build a 304 from the deploy hook refers to). */
+const findPendingDeployment = async (context) => {
+	return (await apiRequest$2(context, `${projectPath(context)}/deployments`)).find((deployment) => !isFinished(deployment));
+};
+/** A 304 without Location: Cloudflare already has a deployment queued for the hook's branch. */
+const isAlreadyQueued = (response) => response.status === 304 && !response.location;
+const ALREADY_QUEUED_MESSAGE = "Cloudflare: a deployment was already queued for this branch (deploy hook HTTP 304), so no new one was started";
+const followQueuedDeployment = async (context) => {
+	const pending = await findPendingDeployment(context);
+	if (!pending) return {
+		status: "triggered",
+		message: ALREADY_QUEUED_MESSAGE
+	};
+	return {
+		...reportOf(context, pending),
+		message: `${ALREADY_QUEUED_MESSAGE}; following it`
+	};
+};
 const deploymentOf$1 = (context) => {
 	const id = context.run.provider_ref;
 	return id ? apiRequest$2(context, `${projectPath(context)}/deployments/${encodeURIComponent(id)}`) : findDeploymentSince$1(context, context.run.triggered_at ?? context.run.created_at);
@@ -31436,6 +32510,7 @@ const cloudflarePagesProvider = {
 			policy: context.policy,
 			signal: context.signal
 		});
+		if (isAlreadyQueued(response)) return followQueuedDeployment(context);
 		const envelope = envelopeOf(response);
 		if (!response.ok || envelope.success === false) throw new Error(`Cloudflare deploy hook ${describeFailure(response, errorMessageOf$2(response))}`);
 		const id = envelope.result?.id;
@@ -35255,7 +36330,8 @@ const WEBHOOK_EVENT_CATALOGUE = [
 		"locale.removed"
 	]),
 	...group("change_set", Object.values(CHANGE_SET_EVENTS)),
-	...group("deployment", Object.values(DEPLOYMENT_EVENTS))
+	...group("deployment", Object.values(DEPLOYMENT_EVENTS)),
+	...group("site", ["site.updated"])
 ];
 /** Sent by "Send test"; never produced by the outbox. */
 const WEBHOOK_TEST_EVENT = "webhook.test";
@@ -35523,7 +36599,7 @@ const redeliver$1 = async (runtime, context, webhookId, deliveryId) => {
 //#region src/controllers/webhooks.ts
 const contextFor = (request) => ({
 	...toSiteActorContext(request),
-	permissions: request.server.permissions
+	permissions: getRequestPermissions(request)
 });
 const listWebhooks$1 = async (request) => listWebhooks$2(request.server.publishing, getRequestSite(request));
 const listEventTypes = async () => ({ items: [...listEventTypes$1()] });
@@ -37825,7 +38901,7 @@ const openStoredBundle = (storage, stored) => storage.get(stored.driver).getStre
 const removeStoredBundle = (storage, stored) => storage.get(stored.driver).delete(stored.key);
 //#endregion
 //#region src/constants/version.ts
-const SHAPIO_VERSION = "0.3.1";
+const SHAPIO_VERSION = "0.4.0";
 //#endregion
 //#region src/repositories/transferExport.ts
 /**
@@ -38448,7 +39524,7 @@ const importUserBatch = async (db, siteId, users) => {
 				...account
 			}, trx);
 		}
-		await bumpPermissionsVersion(trx);
+		await bumpPermissionsVersion$2(trx);
 	});
 	result.added = added.length;
 	return result;
@@ -38885,7 +39961,7 @@ const writeMediaFile = async (context, assetId, input, upload) => {
 const transferContextFor = (request) => ({
 	...toSiteActorContext(request),
 	db: request.server.db,
-	permissions: request.server.permissions,
+	permissions: getRequestPermissions(request),
 	storage: request.server.mediaStorage,
 	schemaContext: async () => ({
 		db: request.server.db,
@@ -39991,15 +41067,20 @@ const sendCacheable = (request, reply, payload) => {
 	if (typeof match === "string" && match.split(",").some((candidate) => candidate.trim() === etag)) return reply.code(304).send();
 	return reply.type("application/json; charset=utf-8").send(body);
 };
+/** Field usage is counted after the response is sent, off its path (plan delivery-perf). */
+const usageOptions = (request) => ({
+	usage: request.server.usage,
+	defer: (task) => request.server.recordUsageAfterResponse(request.log, task)
+});
 const listDelivery = async (request, reply) => {
 	const context = await contentContextFor(request);
 	const apiKey = apiKeyOfRoute(context.snapshot, request.params.modelKey);
-	return sendCacheable(request, reply, await listDelivery$1(context, apiKey, rawQueryOf(request), { usage: request.server.usage }));
+	return sendCacheable(request, reply, await listDelivery$1(context, apiKey, rawQueryOf(request), usageOptions(request)));
 };
 const getDelivery = async (request, reply) => {
 	const context = await contentContextFor(request);
 	const apiKey = apiKeyOfRoute(context.snapshot, request.params.modelKey);
-	return sendCacheable(request, reply, await getDelivery$1(context, apiKey, request.params.id, rawQueryOf(request), { usage: request.server.usage }));
+	return sendCacheable(request, reply, await getDelivery$1(context, apiKey, request.params.id, rawQueryOf(request), usageOptions(request)));
 };
 //#endregion
 //#region src/controllers/deliveryWrites.ts
@@ -40180,6 +41261,50 @@ ${graphql ? renderGraphqlSection(graphql) : ""}
 </main></body></html>`;
 };
 //#endregion
+//#region src/routes/site/schemas.ts
+/** The default social image as delivery shows any asset (the media field shape). */
+const DeliveredImageSchema = Type.Record(Type.String(), Type.Unknown());
+const getDeliverySiteSchema = { response: {
+	200: Type.Object({
+		key: Type.String(),
+		name: Type.String(),
+		seo: Type.Object({
+			locales: Type.Record(Type.String(), SeoLocaleDefaultsSchema),
+			twitterHandle: Type.Union([Type.String({ pattern: SEO_TWITTER_HANDLE_PATTERN.source }), Type.Null()]),
+			image: Type.Union([DeliveredImageSchema, Type.Null()])
+		})
+	}),
+	304: { type: "null" },
+	401: ErrorResponseSchema,
+	403: ErrorResponseSchema
+} };
+//#endregion
+//#region src/schema/codegen/openapiSite.ts
+/**
+* `GET /api/site` in the OpenAPI document (plan seo-fields): the site's key, name and SEO defaults. Its schema
+* is the route's own TypeBox schema, never a second copy.
+*/
+const SITE_TAG = {
+	name: "Site",
+	description: "The request's site and its SEO defaults"
+};
+const errorRef$1 = { $ref: "#/components/schemas/Error" };
+const sitePaths = () => ({ "/api/site": { get: {
+	tags: [SITE_TAG.name],
+	summary: "The site's key, name and SEO defaults (texts per locale, default image, Twitter handle)",
+	operationId: "getSite",
+	responses: {
+		"200": {
+			description: "OK",
+			content: { "application/json": { schema: getDeliverySiteSchema.response[200] } }
+		},
+		"401": {
+			description: "Anonymous, and the public role may read nothing on this site",
+			content: { "application/json": { schema: errorRef$1 } }
+		}
+	}
+} } });
+//#endregion
 //#region src/routes/snapshots/schemas.ts
 const SeqSchema = Type.Integer({ minimum: 0 });
 const NullableInteger = Type.Union([Type.Integer(), Type.Null()]);
@@ -40448,13 +41573,20 @@ const COMMON_SCHEMAS = {
 			"doc"
 		]
 	},
-	RichTextOutput: { allOf: [ref("RichText"), {
+	RichTextOutput: {
 		type: "object",
-		properties: { html: {
-			type: "string",
-			description: "Sanitized HTML rendered from the JSON"
-		} }
-	}] },
+		description: "Rich text as delivered, per the `richText` query parameter: `doc` with `json` (the default), `html` with `html`, both with `both`.",
+		properties: {
+			format: { const: "shapio-richtext" },
+			version: { const: 1 },
+			doc: { type: "object" },
+			html: {
+				type: "string",
+				description: "Sanitized HTML rendered from the JSON"
+			}
+		},
+		required: ["format", "version"]
+	},
 	MediaAsset: {
 		type: "object",
 		properties: {
@@ -40564,9 +41696,20 @@ const listParameters = (model, delivery) => [
 		schema: { type: "string" },
 		description: "Search the title field"
 	},
-	...itemParameters(delivery)
+	...itemParameters(model, delivery)
 ];
-const itemParameters = (delivery) => [
+/** `?seo=` is offered where it works: delivery reads of a model with an SEO field. */
+const seoParameters = (model) => model.fields.some((field) => !field.deprecated && isSeoField(field)) ? [{
+	name: "seo",
+	in: "query",
+	schema: {
+		type: "string",
+		enum: [...SEO_MODES],
+		default: "raw"
+	},
+	description: "SEO fields as stored (`raw`) or merged with the site's SEO defaults (`resolved`): the title through the site's title template (the entry's own title when empty), description and image from the defaults, `noindex` a boolean. A pinned `snapshot` uses today's defaults."
+}] : [];
+const itemParameters = (model, delivery) => [
 	{
 		name: "fields",
 		in: "query",
@@ -40585,15 +41728,28 @@ const itemParameters = (delivery) => [
 		schema: { type: "string" },
 		description: "Locale to serve; falls back along the locale chain"
 	},
-	...delivery ? [{
-		name: "snapshot",
-		in: "query",
-		schema: {
-			type: "integer",
-			minimum: 1
+	...delivery ? [
+		{
+			name: "snapshot",
+			in: "query",
+			schema: {
+				type: "integer",
+				minimum: 1
+			},
+			description: "Read content as of this publication sequence number (`meta.snapshot`)"
+		},
+		{
+			name: "richText",
+			in: "query",
+			schema: {
+				type: "string",
+				enum: [...RICH_TEXT_MODES],
+				default: DEFAULT_RICH_TEXT_MODE
+			},
+			description: "Rich-text shape: the JSON document, sanitized HTML rendered from it, or both"
 		},
-		description: "Read content as of this publication sequence number (`meta.snapshot`)"
-	}] : []
+		...seoParameters(model)
+	] : []
 ];
 const idParameter = {
 	name: "id",
@@ -40647,7 +41803,7 @@ const modelPaths = (model) => {
 			tags: [tag],
 			summary: single ? `Read the published ${model.label}` : `List published ${model.label} entries`,
 			operationId: `list${name}`,
-			parameters: single ? itemParameters(true) : listParameters(model, true),
+			parameters: single ? itemParameters(model, true) : listParameters(model, true),
 			responses: {
 				"200": json({
 					type: "object",
@@ -40670,7 +41826,7 @@ const modelPaths = (model) => {
 			tags: [tag],
 			summary: `Read one published ${model.label} entry`,
 			operationId: `get${name}`,
-			parameters: [idParameter, ...itemParameters(true)],
+			parameters: [idParameter, ...itemParameters(model, true)],
 			responses: {
 				"200": json({
 					type: "object",
@@ -40834,11 +41990,15 @@ const generateOpenApi = (snapshot, options) => {
 		},
 		servers: [{ url: options.serverUrl }],
 		security: [{ bearerAuth: [] }, { cookieAuth: [] }],
-		tags: [...models.map((model) => ({
-			name: model.label,
-			description: model.description ?? `${model.kind} \`${model.apiKey}\``
-		})), SNAPSHOTS_TAG],
-		paths: Object.assign({}, ...models.map(modelPaths), snapshotPaths()),
+		tags: [
+			...models.map((model) => ({
+				name: model.label,
+				description: model.description ?? `${model.kind} \`${model.apiKey}\``
+			})),
+			SNAPSHOTS_TAG,
+			SITE_TAG
+		],
+		paths: Object.assign({}, ...models.map(modelPaths), snapshotPaths(), sitePaths()),
 		components: {
 			schemas,
 			securitySchemes: {
@@ -40872,8 +42032,11 @@ export type RichTextNode = {
 
 export type RichText = { format: 'shapio-richtext'; version: 1; doc: RichTextNode };
 
-/** Delivery adds sanitized HTML rendered from the JSON. */
-export type RichTextOutput = RichText & { html: string };
+/**
+ * Rich text as delivery returns it, per the request's \`richText\`: \`doc\` with \`json\` (the default), sanitized
+ * \`html\` rendered from the document with \`html\`, both with \`both\`.
+ */
+export type RichTextOutput = { format: 'shapio-richtext'; version: 1; doc?: RichTextNode; html?: string };
 
 export type MediaAsset = {
   id: string;
@@ -41032,14 +42195,14 @@ const docsRoutes = async (app) => {
 //#endregion
 //#region src/db/migrations/20261001120000_create_platform_tables.ts
 var _20261001120000_create_platform_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * Foundation tables shared by every package: durable versions, the job queue, the transactional outbox
 * and the audit log. Statuses are text with CHECK constraints so new states need only a constraint change.
 */
-const up$27 = async (db) => {
+const up$30 = async (db) => {
 	await db.schema.createTable("system_versions").addColumn("id", "boolean", (col) => col.primaryKey().defaultTo(true).check(sql`id`)).addColumn("schema_version", "integer", (col) => col.notNull().defaultTo(0)).addColumn("permissions_version", "integer", (col) => col.notNull().defaultTo(0)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 	await sql`insert into system_versions default values`.execute(db);
 	await db.schema.createTable("jobs").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("type", "text", (col) => col.notNull()).addColumn("payload", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("status", "text", (col) => col.notNull().defaultTo("pending").check(sql`status in ('pending', 'running', 'succeeded', 'dead')`)).addColumn("priority", "integer", (col) => col.notNull().defaultTo(0)).addColumn("run_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("attempts", "integer", (col) => col.notNull().defaultTo(0)).addColumn("max_attempts", "integer", (col) => col.notNull().defaultTo(10).check(sql`max_attempts > 0`)).addColumn("idempotency_key", "text").addColumn("locked_by", "text").addColumn("locked_until", "timestamptz").addColumn("checkpoint", "jsonb").addColumn("result", "jsonb").addColumn("last_error", "text").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("finished_at", "timestamptz").execute();
@@ -41061,7 +42224,7 @@ const up$27 = async (db) => {
 		"occurred_at desc"
 	]).execute();
 };
-const down$27 = async (db) => {
+const down$30 = async (db) => {
 	await db.schema.dropTable("audit_events").execute();
 	await db.schema.dropTable("outbox_events").execute();
 	await db.schema.dropTable("jobs").execute();
@@ -41070,8 +42233,8 @@ const down$27 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001130000_create_admin_identity.ts
 var _20261001130000_create_admin_identity_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Admin identity (package B, ADR 0005): admin users, roles and their permission grants, server-side
@@ -41080,7 +42243,7 @@ var _20261001130000_create_admin_identity_exports = /* @__PURE__ */ __exportAll(
 */
 const withTimestamps$3 = (table) => table.addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`));
 const uuidPrimaryKey$3 = (table) => table.addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`));
-const up$26 = async (db) => {
+const up$29 = async (db) => {
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("admin_users")).addColumn("email", "text", (col) => col.notNull().unique()).addColumn("name", "text", (col) => col.notNull().defaultTo("")).addColumn("password_hash", "text", (col) => col.notNull()).addColumn("status", "text", (col) => col.notNull().defaultTo("active").check(sql`status in ('active', 'disabled')`)).addColumn("last_login_at", "timestamptz").addColumn("password_changed_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`))).execute();
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("admin_roles")).addColumn("key", "text", (col) => col.notNull().unique().check(sql`key ~ '^[a-z][a-z0-9-]{0,62}$'`)).addColumn("name", "text", (col) => col.notNull()).addColumn("description", "text", (col) => col.notNull().defaultTo("")).addColumn("kind", "text", (col) => col.notNull().defaultTo("admin").check(sql`kind in ('admin', 'delivery')`)).addColumn("is_system", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("version", "integer", (col) => col.notNull().defaultTo(1))).execute();
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("admin_role_permissions")).addColumn("role_id", "uuid", (col) => col.notNull().references("admin_roles.id").onDelete("cascade")).addColumn("action", "text", (col) => col.notNull()).addColumn("model_id", "text").addColumn("condition", "text", (col) => col.check(sql`condition in ('ownedByPrincipal')`)).addColumn("field_ids", sql`text[]`).addUniqueConstraint("admin_role_permissions_grant_uq", [
@@ -41100,7 +42263,7 @@ const up$26 = async (db) => {
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("api_tokens")).addColumn("name", "text", (col) => col.notNull()).addColumn("token_hash", "text", (col) => col.notNull().unique()).addColumn("token_prefix", "text", (col) => col.notNull()).addColumn("role_id", "uuid", (col) => col.notNull().references("admin_roles.id").onDelete("restrict")).addColumn("created_by", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("expires_at", "timestamptz").addColumn("last_used_at", "timestamptz").addColumn("revoked_at", "timestamptz")).execute();
 	await db.schema.createIndex("api_tokens_role_idx").on("api_tokens").column("role_id").execute();
 };
-const down$26 = async (db) => {
+const down$29 = async (db) => {
 	await db.schema.dropTable("api_tokens").execute();
 	await db.schema.dropTable("setup_tokens").execute();
 	await db.schema.dropTable("password_resets").execute();
@@ -41114,31 +42277,31 @@ const down$26 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001130500_create_system_settings.ts
 var _20261001130500_create_system_settings_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * Instance-wide key/value settings that must survive restarts and be shared by every instance, e.g. the
 * generated signing secret. General purpose: later packages add keys, not tables.
 */
-const up$25 = async (db) => {
+const up$28 = async (db) => {
 	await db.schema.createTable("system_settings").addColumn("key", "text", (col) => col.primaryKey()).addColumn("value", "text", (col) => col.notNull()).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 };
-const down$25 = async (db) => {
+const down$28 = async (db) => {
 	await db.schema.dropTable("system_settings").execute();
 };
 //#endregion
 //#region src/db/migrations/20261001140000_create_schema_tables.ts
 var _20261001140000_create_schema_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * Schema registry (package D, ADR 0002): models and components (one table, `kind` discriminator), immutable
 * schema revisions, the per-model active pointer, schema change jobs, locales and schema settings.
 * Model definitions are data: creating or changing a model never runs DDL (CONTRIBUTING.md rule 1).
 */
-const up$24 = async (db) => {
+const up$27 = async (db) => {
 	await db.schema.createTable("models").addColumn("id", "uuid", (col) => col.primaryKey()).addColumn("kind", "text", (col) => col.notNull().check(sql`kind in ('collection', 'singleton', 'component')`)).addColumn("api_key", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("deleted_at", "timestamptz").execute();
 	await sql`create unique index models_api_key_uq on models (lower(api_key)) where deleted_at is null`.execute(db);
 	await db.schema.createTable("schema_revisions").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("model_id", "uuid", (col) => col.notNull().references("models.id").onDelete("restrict")).addColumn("version", "integer", (col) => col.notNull().check(sql`version > 0`)).addColumn("definition", "jsonb", (col) => col.notNull()).addColumn("hash", "text", (col) => col.notNull()).addColumn("parent_revision_id", "uuid", (col) => col.references("schema_revisions.id")).addColumn("created_by_type", "text", (col) => col.notNull()).addColumn("created_by_id", "text").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addUniqueConstraint("schema_revisions_model_version_uq", ["model_id", "version"]).execute();
@@ -41166,7 +42329,7 @@ const up$24 = async (db) => {
 	await db.schema.createTable("schema_settings").addColumn("id", "boolean", (col) => col.primaryKey().defaultTo(true).check(sql`id`)).addColumn("read_only", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("read_only_reason", "text").addColumn("updated_by_type", "text").addColumn("updated_by_id", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 	await sql`insert into schema_settings default values`.execute(db);
 };
-const down$24 = async (db) => {
+const down$27 = async (db) => {
 	await db.schema.dropTable("schema_settings").execute();
 	await db.schema.dropTable("locales").execute();
 	await db.schema.dropTable("schema_change_jobs").execute();
@@ -41178,8 +42341,8 @@ const down$24 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001150000_create_content_tables.ts
 var _20261001150000_create_content_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * Content storage (package E, ADR 0001): entries, immutable content revisions, mutable heads (one per
@@ -41187,7 +42350,7 @@ var _20261001150000_create_content_tables_exports = /* @__PURE__ */ __exportAll(
 * and the publication log behind `?snapshot=N`. User content models never get tables of their own
 * (CONTRIBUTING.md rule 1): their values are JSONB keyed by stable field IDs.
 */
-const up$23 = async (db) => {
+const up$26 = async (db) => {
 	await db.schema.createTable("entries").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("model_id", "uuid", (col) => col.notNull().references("models.id").onDelete("restrict")).addColumn("owner_app_user_id", "uuid").addColumn("created_by_admin_id", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("deleted_at", "timestamptz").execute();
 	await sql`create index entries_model_idx on entries (model_id, created_at) where deleted_at is null`.execute(db);
 	await sql`create index entries_owner_idx on entries (owner_app_user_id) where owner_app_user_id is not null`.execute(db);
@@ -41251,7 +42414,7 @@ const up$23 = async (db) => {
 	await sql`create unique index publication_log_open_uq on publication_log (entry_id, locale) where to_seq is null`.execute(db);
 	await db.schema.createIndex("publication_log_model_seq_idx").on("publication_log").columns(["model_id", "from_seq"]).execute();
 };
-const down$23 = async (db) => {
+const down$26 = async (db) => {
 	await db.schema.dropTable("publication_log").execute();
 	await db.schema.dropTable("publication_state").execute();
 	await db.schema.dropTable("unique_values").execute();
@@ -41264,8 +42427,8 @@ const down$23 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001160000_create_media_tables.ts
 var _20261001160000_create_media_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * Media library (package G): folders, assets, image variants, references from content and upload grants.
@@ -41276,7 +42439,7 @@ const withTimestamps$2 = (table) => table.addColumn("created_at", "timestamptz",
 const uuidPrimaryKey$2 = (table) => table.addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`));
 const STORAGE_DRIVER_CHECK = sql`storage_driver in ('local', 's3')`;
 const VISIBILITY_CHECK = sql`visibility in ('public', 'private')`;
-const up$22 = async (db) => {
+const up$25 = async (db) => {
 	await withTimestamps$2(uuidPrimaryKey$2(db.schema.createTable("media_folders")).addColumn("parent_id", "uuid", (col) => col.references("media_folders.id").onDelete("restrict")).addColumn("name", "text", (col) => col.notNull().check(sql`length(name) between 1 and 255`)).addColumn("created_by", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("version", "integer", (col) => col.notNull().defaultTo(1))).execute();
 	await sql`create unique index media_folders_sibling_name_uq on media_folders
     (coalesce(parent_id, '00000000-0000-0000-0000-000000000000'::uuid), lower(name))`.execute(db);
@@ -41305,7 +42468,7 @@ const up$22 = async (db) => {
 	]).execute();
 	await db.schema.createTable("media_upload_grants").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("asset_id", "uuid", (col) => col.notNull()).addColumn("kind", "text", (col) => col.notNull().check(sql`kind in ('create', 'replace')`)).addColumn("storage_driver", "text", (col) => col.notNull().check(STORAGE_DRIVER_CHECK)).addColumn("storage_key", "text", (col) => col.notNull().unique()).addColumn("original_filename", "text", (col) => col.notNull()).addColumn("declared_mime_type", "text", (col) => col.notNull()).addColumn("max_size_bytes", "bigint", (col) => col.notNull()).addColumn("folder_id", "uuid").addColumn("visibility", "text", (col) => col.notNull().check(VISIBILITY_CHECK)).addColumn("created_by", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("created_by_principal", "text", (col) => col.notNull()).addColumn("status", "text", (col) => col.notNull().defaultTo("pending").check(sql`status in ('pending', 'consumed', 'rejected', 'expired')`)).addColumn("expires_at", "timestamptz", (col) => col.notNull()).addColumn("consumed_at", "timestamptz").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 };
-const down$22 = async (db) => {
+const down$25 = async (db) => {
 	await db.schema.dropTable("media_upload_grants").execute();
 	await db.schema.dropTable("media_references").execute();
 	await db.schema.dropTable("media_variants").execute();
@@ -41315,8 +42478,8 @@ const down$22 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001170000_create_publishing_tables.ts
 var _20261001170000_create_publishing_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * Publishing (package H): scheduled publications, releases, webhooks and their delivery log, deployment
@@ -41355,13 +42518,13 @@ const createPreviewTables = async (db) => {
 	await uuidPrimaryKey$1(db.schema.createTable("preview_tokens")).addColumn("token_hash", "text", (col) => col.notNull().unique()).addColumn("token_prefix", "text", (col) => col.notNull()).addColumn("model_id", "uuid", (col) => col.notNull()).addColumn("entry_id", "uuid", (col) => col.references("entries.id").onDelete("cascade")).addColumn("locale", "text").addColumn("connection_id", "uuid", (col) => col.references("deployment_connections.id").onDelete("set null")).addColumn("delivery_role_id", "uuid", (col) => col.references("admin_roles.id").onDelete("set null")).addColumn("created_by", "uuid", (col) => col.notNull().references("admin_users.id").onDelete("cascade")).addColumn("expires_at", "timestamptz", (col) => col.notNull()).addColumn("revoked_at", "timestamptz").addColumn("last_used_at", "timestamptz").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 	await db.schema.createIndex("preview_tokens_entry_idx").on("preview_tokens").columns(["entry_id", "created_at desc"]).execute();
 };
-const up$21 = async (db) => {
+const up$24 = async (db) => {
 	await createSchedulingTables(db);
 	await createWebhookTables(db);
 	await createDeploymentTables(db);
 	await createPreviewTables(db);
 };
-const down$21 = async (db) => {
+const down$24 = async (db) => {
 	await db.schema.dropTable("preview_tokens").execute();
 	await db.schema.dropTable("deployment_runs").execute();
 	await db.schema.dropTable("deployment_connections").execute();
@@ -41374,8 +42537,8 @@ const down$21 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001180000_create_app_users.ts
 var _20261001180000_create_app_users_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * App users (package I, ADR 0005): the end users of sites and apps built on Shapio, with their own roles
@@ -41426,7 +42589,7 @@ const createCredentials = async (db) => {
 	}
 	await db.schema.createTable("app_login_codes").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("app_user_id", "uuid", (col) => col.notNull().references("app_users.id").onDelete("cascade")).addColumn("code_hash", "text", (col) => col.notNull().unique()).addColumn("expires_at", "timestamptz", (col) => col.notNull()).addColumn("used_at", "timestamptz").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 };
-const up$20 = async (db) => {
+const up$23 = async (db) => {
 	await createUsers(db);
 	await createRoles(db);
 	await createCredentials(db);
@@ -41436,7 +42599,7 @@ const up$20 = async (db) => {
       foreign key (owner_app_user_id) references app_users (id) on delete set null
   `.execute(db);
 };
-const down$20 = async (db) => {
+const down$23 = async (db) => {
 	await sql`alter table entries drop constraint if exists entries_owner_app_user_fk`.execute(db);
 	await db.schema.dropTable("app_login_codes").execute();
 	await db.schema.dropTable("app_password_resets").execute();
@@ -41451,8 +42614,8 @@ const down$20 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261002120000_create_extension_hook_runs.ts
 var _20261002120000_create_extension_hook_runs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Extension points (package K, ADR 0009): the ledger of post-commit lifecycle hooks (`afterCreate`,
@@ -41460,17 +42623,17 @@ var _20261002120000_create_extension_hook_runs_exports = /* @__PURE__ */ __expor
 * as the hook's own database work, so a hook re-run after a worker crash finds its row and is skipped:
 * exactly once for everything the hook does through its transaction.
 */
-const up$19 = async (db) => {
+const up$22 = async (db) => {
 	await db.schema.createTable("extension_hook_runs").addColumn("event_id", "uuid", (col) => col.notNull()).addColumn("hook", "text", (col) => col.notNull()).addColumn("job_id", "uuid").addColumn("completed_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addPrimaryKeyConstraint("extension_hook_runs_pkey", ["event_id", "hook"]).execute();
 };
-const down$19 = async (db) => {
+const down$22 = async (db) => {
 	await db.schema.dropTable("extension_hook_runs").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002130000_app_auth_token_version_and_login_code_pkce.ts
 var _20261002130000_app_auth_token_version_and_login_code_pkce_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * App users (ADR 0005):
@@ -41481,20 +42644,20 @@ var _20261002130000_app_auth_token_version_and_login_code_pkce_exports = /* @__P
 *   sign-in; the one-time login code is only exchanged with the matching verifier. Codes live a minute, so
 *   any pending ones (issued without a challenge) are dropped rather than given a placeholder.
 */
-const up$18 = async (db) => {
+const up$21 = async (db) => {
 	await db.schema.alterTable("app_users").addColumn("token_version", "integer", (col) => col.notNull().defaultTo(0)).execute();
 	await sql`delete from app_login_codes`.execute(db);
 	await db.schema.alterTable("app_login_codes").addColumn("code_challenge", "text", (col) => col.notNull()).execute();
 };
-const down$18 = async (db) => {
+const down$21 = async (db) => {
 	await db.schema.alterTable("app_login_codes").dropColumn("code_challenge").execute();
 	await db.schema.alterTable("app_users").dropColumn("token_version").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002180000_add_publication_log_diff_indexes.ts
 var _20261002180000_add_publication_log_diff_indexes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * The snapshot diff (repositories/snapshotDiff.ts) finds the (entry, locale) pairs whose live period opened
@@ -41503,7 +42666,7 @@ var _20261002180000_add_publication_log_diff_indexes_exports = /* @__PURE__ */ _
 * - `(entry_id, locale, from_seq)`: "the row live at seq N" is the latest row starting at or before N.
 * Periods that opened in the range use the existing `(model_id, from_seq)` index.
 */
-const up$17 = async (db) => {
+const up$20 = async (db) => {
 	await sql`create index publication_log_to_seq_idx on publication_log (to_seq) where to_seq is not null`.execute(db);
 	await db.schema.createIndex("publication_log_entry_locale_from_idx").on("publication_log").columns([
 		"entry_id",
@@ -41511,15 +42674,15 @@ const up$17 = async (db) => {
 		"from_seq"
 	]).execute();
 };
-const down$17 = async (db) => {
+const down$20 = async (db) => {
 	await db.schema.dropIndex("publication_log_entry_locale_from_idx").execute();
 	await db.schema.dropIndex("publication_log_to_seq_idx").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002180100_create_usage_tables.ts
 var _20261002180100_create_usage_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Field usage from delivery traffic (plan developer-face §5): daily counters written by the in-memory
@@ -41527,7 +42690,7 @@ var _20261002180100_create_usage_tables_exports = /* @__PURE__ */ __exportAll({
 * payloads. `principal_key` is `token:<id>`, `app_users` or `anonymous`. Pruned by the retention job
 * after USAGE_RETENTION_DAYS.
 */
-const up$16 = async (db) => {
+const up$19 = async (db) => {
 	await db.schema.createTable("field_reads").addColumn("day", "date", (col) => col.notNull()).addColumn("model_id", "uuid", (col) => col.notNull()).addColumn("field_path", "text", (col) => col.notNull()).addColumn("principal_key", "text", (col) => col.notNull()).addColumn("selection", "text", (col) => col.notNull().check(sql`selection in ('explicit', 'implicit')`)).addColumn("reads", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_read_at", "timestamptz", (col) => col.notNull()).addPrimaryKeyConstraint("field_reads_pkey", [
 		"day",
 		"model_id",
@@ -41538,15 +42701,15 @@ const up$16 = async (db) => {
 	await db.schema.createIndex("field_reads_model_day_idx").on("field_reads").columns(["model_id", "day"]).execute();
 	await db.schema.createTable("token_reads").addColumn("day", "date", (col) => col.notNull()).addColumn("principal_key", "text", (col) => col.notNull()).addColumn("requests", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_snapshot", "bigint").addColumn("last_read_at", "timestamptz", (col) => col.notNull()).addPrimaryKeyConstraint("token_reads_pkey", ["day", "principal_key"]).execute();
 };
-const down$16 = async (db) => {
+const down$19 = async (db) => {
 	await db.schema.dropTable("token_reads").execute();
 	await db.schema.dropTable("field_reads").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002180200_create_change_sets.ts
 var _20261002180200_create_change_sets_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Change sets (developer-face plan §5, ADR 0010): schema drafts and entry publications that ship as ONE
@@ -41725,7 +42888,7 @@ const migrateReleases = async (db) => {
 	await sql`drop table release_items`.execute(db);
 	await sql`drop table releases`.execute(db);
 };
-const up$15 = async (db) => {
+const up$18 = async (db) => {
 	await createTables(db);
 	await linkExecutionRecords(db);
 	await allowConversionRevisions(db);
@@ -41797,7 +42960,7 @@ const restoreReleases = async (db) => {
 	await sql`update webhooks set events = array_remove(array_remove(events, 'change_set.shipping'),
     'change_set.discarded')`.execute(db);
 };
-const down$15 = async (db) => {
+const down$18 = async (db) => {
 	await restoreReleases(db);
 	await sql`alter table content_revisions drop constraint content_revisions_reason_check`.execute(db);
 	await sql`alter table content_revisions add constraint content_revisions_reason_check
@@ -41818,8 +42981,8 @@ const down$15 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261002190000_create_editor_presence_and_content_health.ts
 var _20261002190000_create_editor_presence_and_content_health_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Editor experience (plan editor-experience §9):
@@ -41830,7 +42993,7 @@ var _20261002190000_create_editor_presence_and_content_health_exports = /* @__PU
 * - `content_health_findings`: open and recently resolved findings of the health rules per entry and
 *   locale (`*` for the entry as a whole). An evaluation upserts what it found and resolves the rest.
 */
-const up$14 = async (db) => {
+const up$17 = async (db) => {
 	await sql`
     create unlogged table editor_presence (
       entry_id uuid not null,
@@ -41867,15 +43030,15 @@ const up$14 = async (db) => {
 	await sql`create index content_health_findings_resolved_idx on content_health_findings (resolved_at)
     where resolved_at is not null`.execute(db);
 };
-const down$14 = async (db) => {
+const down$17 = async (db) => {
 	await sql`drop table content_health_findings`.execute(db);
 	await sql`drop table editor_presence`.execute(db);
 };
 //#endregion
 //#region src/db/migrations/20261003120000_add_changes_ship_permission.ts
 var _20261003120000_add_changes_ship_permission_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * `changes.ship` (agentic plan §I): shipping a change set (and scheduling a ship) becomes its own global
@@ -41883,7 +43046,7 @@ var _20261003120000_add_changes_ship_permission_exports = /* @__PURE__ */ __expo
 * live. Every role that holds `changes.manage` today keeps what it could do: it gets `changes.ship` too.
 * The permissions version moves only when grants changed, so running instances reload exactly then.
 */
-const up$13 = async (db) => {
+const up$16 = async (db) => {
 	await sql`
     with granted as (
       insert into admin_role_permissions (role_id, action, model_id, condition, field_ids)
@@ -41897,7 +43060,7 @@ const up$13 = async (db) => {
     where exists (select 1 from granted)
   `.execute(db);
 };
-const down$13 = async (db) => {
+const down$16 = async (db) => {
 	await sql`
     with revoked as (
       delete from admin_role_permissions where action = 'changes.ship' returning 1
@@ -41909,8 +43072,8 @@ const down$13 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003130000_create_sites.ts
 var _20261003130000_create_sites_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Sites (plan agentic-ecosystem §H, ADR 0011): one instance hosts many sites with one schema and one login.
@@ -42098,7 +43261,7 @@ const siteRoleAssignments = async (db) => {
   `.execute(db);
 	await sql`alter table admin_invitations drop column role_ids`.execute(db);
 };
-const up$12 = async (db) => {
+const up$15 = async (db) => {
 	await createSites(db);
 	await addSiteColumns(db);
 	await tieCopiesToEntries(db);
@@ -42111,7 +43274,7 @@ const assertSingleSite = async (db) => {
 	const { rows } = await sql`select count(*)::text as count from sites`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 1) throw new Error("Cannot roll back sites while more than one site exists: merging them would merge their snapshot ledgers and uniqueness and widen role assignments. Delete the other sites first.");
 };
-const down$12 = async (db) => {
+const down$15 = async (db) => {
 	await assertSingleSite(db);
 	await sql`alter table admin_invitations add column role_ids uuid[] not null default '{}'::uuid[]`.execute(db);
 	await sql`
@@ -42182,8 +43345,8 @@ const down$12 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003140200_enqueue_field_index_layout.ts
 var _20261003140200_enqueue_field_index_layout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Field index layout v2 (sites plan §H): per-field expression indexes on `entry_heads` lead with `site_id`,
@@ -42195,7 +43358,7 @@ var _20261003140200_enqueue_field_index_layout_exports = /* @__PURE__ */ __expor
 */
 const JOB_TYPE = "schema.fieldIndexLayout";
 const IDEMPOTENCY_KEY = "schema.fieldIndexLayout:v2";
-const up$11 = async (db) => {
+const up$14 = async (db) => {
 	await sql`
     insert into jobs (type, payload, max_attempts, idempotency_key)
     select ${JOB_TYPE}, '{}'::jsonb, 5, ${IDEMPOTENCY_KEY}
@@ -42208,14 +43371,14 @@ const up$11 = async (db) => {
   `.execute(db);
 };
 /** The layout job is idempotent; rolling back only forgets it if it has not run yet. */
-const down$11 = async (db) => {
+const down$14 = async (db) => {
 	await sql`delete from jobs where idempotency_key = ${IDEMPOTENCY_KEY} and status = 'pending'`.execute(db);
 };
 //#endregion
 //#region src/db/migrations/20261003140500_change_set_items_site_and_preview_entry.ts
 var _20261003140500_change_set_items_site_and_preview_entry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * Sites, publishing (plan agentic-ecosystem §H, package G5).
@@ -42226,7 +43389,7 @@ var _20261003140500_change_set_items_site_and_preview_entry_exports = /* @__PURE
 * - `preview_tokens.entry_id` becomes required: a preview token previews one entry of one site. Model-wide
 *   tokens (short-lived by design) are deleted; whoever needs one opens the entry's preview again.
 */
-const up$10 = async (db) => {
+const up$13 = async (db) => {
 	await sql`alter table change_sets add constraint change_sets_id_site_uq unique (id, site_id)`.execute(db);
 	await sql`alter table change_set_items add column site_id uuid`.execute(db);
 	await sql`
@@ -42242,7 +43405,7 @@ const up$10 = async (db) => {
 	await sql`delete from preview_tokens where entry_id is null`.execute(db);
 	await sql`alter table preview_tokens alter column entry_id set not null`.execute(db);
 };
-const down$10 = async (db) => {
+const down$13 = async (db) => {
 	await sql`alter table preview_tokens alter column entry_id drop not null`.execute(db);
 	await sql`alter table change_set_items drop constraint change_set_items_entry_site_fk`.execute(db);
 	await sql`alter table change_set_items drop constraint change_set_items_set_site_fk`.execute(db);
@@ -42252,8 +43415,8 @@ const down$10 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003150000_widen_deployment_providers.ts
 var _20261003150000_widen_deployment_providers_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * Deploy adapters (plan agentic-ecosystem §B2): deployment connections may use the Vercel and Netlify
@@ -42268,11 +43431,11 @@ const replaceCheck = async (db, check) => {
     check (${check}) not valid`.execute(db);
 	await sql`alter table deployment_connections validate constraint deployment_connections_provider_check`.execute(db);
 };
-const up$9 = async (db) => {
+const up$12 = async (db) => {
 	await replaceCheck(db, WIDENED);
 };
 /** Refuses while Vercel or Netlify connections exist: a down migration never deletes user data. */
-const down$9 = async (db) => {
+const down$12 = async (db) => {
 	const { rows } = await sql`
     select count(*)::text as count from deployment_connections where provider in ('vercel', 'netlify')
   `.execute(db);
@@ -42283,8 +43446,8 @@ const down$9 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003160000_create_assist_runs.ts
 var _20261003160000_create_assist_runs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * Editor assists (plan agentic-ecosystem §A0, §I): one `assist_runs` row per assist request (who, which
@@ -42300,14 +43463,14 @@ const replaceSourceCheck = async (db, check) => {
 	await sql`alter table change_sets add constraint change_sets_source_check check (${check}) not valid`.execute(db);
 	await sql`alter table change_sets validate constraint change_sets_source_check`.execute(db);
 };
-const up$8 = async (db) => {
+const up$11 = async (db) => {
 	await db.schema.createTable("assist_runs").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("site_id", "uuid", (col) => col.notNull().references("sites.id").onDelete("cascade")).addColumn("actor_type", "text", (col) => col.notNull()).addColumn("actor_id", "text", (col) => col.notNull()).addColumn("action", "text", (col) => col.notNull().check(ACTIONS)).addColumn("rule", "text").addColumn("provider", "text", (col) => col.notNull()).addColumn("model", "text", (col) => col.notNull()).addColumn("input_tokens", "integer", (col) => col.notNull().defaultTo(0)).addColumn("output_tokens", "integer", (col) => col.notNull().defaultTo(0)).addColumn("duration_ms", "integer", (col) => col.notNull().defaultTo(0)).addColumn("status", "text", (col) => col.notNull().check(sql`status in ('queued', 'running', 'succeeded', 'failed')`)).addColumn("error_code", "text").addColumn("job_id", "uuid", (col) => col.references("jobs.id").onDelete("set null")).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("finished_at", "timestamptz").execute();
 	await db.schema.createIndex("assist_runs_site_created_idx").on("assist_runs").columns(["site_id", "created_at"]).execute();
 	await db.schema.createIndex("assist_runs_created_idx").on("assist_runs").column("created_at").execute();
 	await replaceSourceCheck(db, SOURCES_WIDENED);
 };
 /** Refuses while change sets opened by assist exist: a down migration never deletes user data. */
-const down$8 = async (db) => {
+const down$11 = async (db) => {
 	const { rows } = await sql`
     select count(*)::text as count from change_sets where source = 'assist'
   `.execute(db);
@@ -42319,8 +43482,8 @@ const down$8 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003170000_audit_events_seq.ts
 var _20261003170000_audit_events_seq_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * `audit_events.seq`: a monotonic tiebreaker after `occurred_at`, so events written in the same instant (one
@@ -42329,17 +43492,17 @@ var _20261003170000_audit_events_seq_exports$2 = /* @__PURE__ */ __exportAll({
 * are numbered in the order the rewrite reads them. No index: the audit queries filter and sort by
 * `occurred_at` first, and `seq` only breaks ties.
 */
-const up$7 = async (db) => {
+const up$10 = async (db) => {
 	await db.schema.alterTable("audit_events").addColumn("seq", "bigint", (col) => col.notNull().generatedAlwaysAsIdentity()).execute();
 };
-const down$7 = async (db) => {
+const down$10 = async (db) => {
 	await db.schema.alterTable("audit_events").dropColumn("seq").execute();
 };
 //#endregion
 //#region src/db/migrations/20261004120000_models_site_scope.ts
 var _20261004120000_models_site_scope_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * Per-site schema (plan site-schema): a definition belongs to one site (`models.site_id`) or is shared by every
@@ -42352,7 +43515,7 @@ var _20261004120000_models_site_scope_exports$2 = /* @__PURE__ */ __exportAll({
 * over `lower(api_key)` cannot hold. Share or delete them first; then `down` is lossless.
 */
 const NIL_UUID$1 = "00000000-0000-0000-0000-000000000000";
-const up$6 = async (db) => {
+const up$9 = async (db) => {
 	await sql`alter table models add column site_id uuid references sites (id)`.execute(db);
 	await sql`create index models_site_idx on models (site_id)`.execute(db);
 	await sql`drop index models_api_key_uq`.execute(db);
@@ -42362,7 +43525,7 @@ const up$6 = async (db) => {
   `.execute(db);
 	await sql`alter table schema_drafts add column shared boolean not null default false`.execute(db);
 };
-const down$6 = async (db) => {
+const down$9 = async (db) => {
 	const { rows } = await sql`select count(*)::text as count from models where site_id is not null`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 0) throw new Error("Cannot roll back per-site schema while definitions belong to a site: two sites may share an API ID. Share or delete the site definitions first.");
 	await sql`alter table schema_drafts drop column shared`.execute(db);
@@ -42372,10 +43535,50 @@ const down$6 = async (db) => {
 	await sql`alter table models drop column site_id`.execute(db);
 };
 //#endregion
+//#region src/db/migrations/20261004130000_site_seo_settings.ts
+var _20261004130000_site_seo_settings_exports$2 = /* @__PURE__ */ __exportAll({
+	down: () => down$8,
+	up: () => up$8
+});
+/**
+* SEO defaults per site (plan seo-fields): `sites.seo_defaults` holds the site's default texts per locale, its
+* default social image and Twitter handle (`SeoDefaults` in @shapio/schema). Nullable, no default: a
+* catalog-only change, no table rewrite.
+*
+* `site.settings` is the site action that edits them. Every role that holds `publishing.manage` (everything
+* about what a site publishes) gets it; the built-in owner and admin roles get it from `ensureSystemRoles`.
+* The permissions version moves only when grants changed, so running instances reload exactly then.
+*/
+const up$8 = async (db) => {
+	await sql`alter table sites add column seo_defaults jsonb`.execute(db);
+	await sql`
+    with granted as (
+      insert into admin_role_permissions (role_id, action, model_id, condition, field_ids)
+      select role_id, 'site.settings', null, null, null
+      from admin_role_permissions
+      where action = 'publishing.manage' and model_id is null
+      on conflict on constraint admin_role_permissions_grant_uq do nothing
+      returning 1
+    )
+    update system_versions set permissions_version = permissions_version + 1, updated_at = now()
+    where exists (select 1 from granted)
+  `.execute(db);
+};
+const down$8 = async (db) => {
+	await sql`
+    with revoked as (
+      delete from admin_role_permissions where action = 'site.settings' returning 1
+    )
+    update system_versions set permissions_version = permissions_version + 1, updated_at = now()
+    where exists (select 1 from revoked)
+  `.execute(db);
+	await sql`alter table sites drop column seo_defaults`.execute(db);
+};
+//#endregion
 //#region src/db/migrations/mysql/0001_baseline.ts
 var _0001_baseline_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * MySQL baseline: Shapio's whole system schema as of PostgreSQL migration
@@ -43558,13 +44761,13 @@ const withoutForeignKeyChecks = async (db, statements) => db.connection().execut
 		await sql`set foreign_key_checks = 1`.execute(connection);
 	}
 });
-const up$5 = async (db) => withoutForeignKeyChecks(db, STATEMENTS$1);
-const down$5 = async (db) => withoutForeignKeyChecks(db, [...TABLES$1].reverse().map((table) => `drop table if exists \`${table}\``));
+const up$7 = async (db) => withoutForeignKeyChecks(db, STATEMENTS$1);
+const down$7 = async (db) => withoutForeignKeyChecks(db, [...TABLES$1].reverse().map((table) => `drop table if exists \`${table}\``));
 //#endregion
 //#region src/db/migrations/mysql/20261003170000_audit_events_seq.ts
 var _20261003170000_audit_events_seq_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$6,
+	up: () => up$6
 });
 /**
 * MySQL twin of `../20261003170000_audit_events_seq.ts`: `seq` is `AUTO_INCREMENT`, which InnoDB only allows
@@ -43572,26 +44775,26 @@ var _20261003170000_audit_events_seq_exports$1 = /* @__PURE__ */ __exportAll({
 * tiebreaker). Existing rows are numbered in primary-key order. `db/mysql/tables.ts` lists `seq` as the
 * table's identity, so an insert's emulated RETURNING finds its row by `LAST_INSERT_ID()`.
 */
-const up$4 = async (db) => {
+const up$6 = async (db) => {
 	await sql`alter table \`audit_events\`
     add column \`seq\` bigint not null auto_increment,
     add unique key \`audit_events_seq_key\` (\`seq\`)`.execute(db);
 };
-const down$4 = async (db) => {
+const down$6 = async (db) => {
 	await sql`alter table \`audit_events\` drop column \`seq\``.execute(db);
 };
 //#endregion
 //#region src/db/migrations/mysql/20261004120000_models_site_scope.ts
 var _20261004120000_models_site_scope_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$5,
+	up: () => up$5
 });
 /**
 * MySQL twin of `../20261004120000_models_site_scope.ts`. The per-scope API ID key uses functional key parts,
 * like the baseline: `coalesce(site_id, '')` for the scope (MySQL has no `NULLS NOT DISTINCT`) and the
 * case-folded API ID of live rows only (a deleted row's part is NULL, and NULLs never collide).
 */
-const up$3 = async (db) => {
+const up$5 = async (db) => {
 	await sql`alter table \`models\` add column \`site_id\` char(36) character set ascii collate ascii_general_ci`.execute(db);
 	await sql`create index \`models_site_idx\` on \`models\` (\`site_id\`)`.execute(db);
 	await sql`alter table \`models\` add constraint \`models_site_id_fkey\` foreign key (\`site_id\`) references \`sites\` (\`id\`)`.execute(db);
@@ -43600,7 +44803,7 @@ const up$3 = async (db) => {
     ((coalesce(\`site_id\`, '')), (case when (\`deleted_at\` IS NULL) then lower(\`api_key\`) end))`.execute(db);
 	await sql`alter table \`schema_drafts\` add column \`shared\` tinyint(1) not null default 0`.execute(db);
 };
-const down$3 = async (db) => {
+const down$5 = async (db) => {
 	const { rows } = await sql`select count(*) as count from \`models\` where \`site_id\` is not null`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 0) throw new Error("Cannot roll back per-site schema while definitions belong to a site: two sites may share an API ID. Share or delete the site definitions first.");
 	await sql`alter table \`schema_drafts\` drop column \`shared\``.execute(db);
@@ -43612,17 +44815,45 @@ const down$3 = async (db) => {
 	await sql`alter table \`models\` drop column \`site_id\``.execute(db);
 };
 //#endregion
+//#region src/db/migrations/mysql/20261004130000_site_seo_settings.ts
+var _20261004130000_site_seo_settings_exports$1 = /* @__PURE__ */ __exportAll({
+	down: () => down$4,
+	up: () => up$4
+});
+/**
+* MySQL twin of `../20261004130000_site_seo_settings.ts`. `insert ignore` stands in for `on conflict do
+* nothing` (the grant's unique key); the permissions version moves only when a grant was added or removed.
+*/
+const bumpPermissionsVersion$1 = (db) => sql`update \`system_versions\` set \`permissions_version\` = \`permissions_version\` + 1,
+    \`updated_at\` = current_timestamp(6)`.execute(db);
+const up$4 = async (db) => {
+	await sql`alter table \`sites\` add column \`seo_defaults\` json`.execute(db);
+	const granted = await sql`
+    insert ignore into \`admin_role_permissions\` (\`id\`, \`role_id\`, \`action\`, \`model_id\`, \`condition\`, \`field_ids\`)
+    select uuid(), \`role_id\`, 'site.settings', null, null, null
+    from \`admin_role_permissions\`
+    where \`action\` = 'publishing.manage' and \`model_id\` is null
+  `.execute(db);
+	if (Number(granted.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion$1(db);
+};
+const down$4 = async (db) => {
+	const revoked = await sql`delete from \`admin_role_permissions\` where \`action\` = 'site.settings'`.execute(db);
+	if (Number(revoked.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion$1(db);
+	await sql`alter table \`sites\` drop column \`seo_defaults\``.execute(db);
+};
+//#endregion
 //#region src/db/migrations/mysql/index.ts
 const MYSQL_MIGRATIONS = {
 	"0001_baseline": _0001_baseline_exports$1,
 	"20261003170000_audit_events_seq": _20261003170000_audit_events_seq_exports$1,
-	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports$1
+	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports$1,
+	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports$1
 };
 //#endregion
 //#region src/db/migrations/sqlite/0001_baseline.ts
 var _0001_baseline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$3,
+	up: () => up$3
 });
 /**
 * SQLite baseline: Shapio's whole system schema as of PostgreSQL migration
@@ -44767,18 +45998,18 @@ const TABLES = [
 	"assist_runs",
 	"sequences"
 ];
-const up$2 = async (db) => {
+const up$3 = async (db) => {
 	for (const statement of STATEMENTS) await sql.raw(statement).execute(db);
 };
-const down$2 = async (db) => {
+const down$3 = async (db) => {
 	await sql`pragma defer_foreign_keys = on`.execute(db);
 	for (const table of [...TABLES].reverse()) await sql.raw(`drop table if exists "${table}"`).execute(db);
 };
 //#endregion
 //#region src/db/migrations/sqlite/20261003170000_audit_events_seq.ts
 var _20261003170000_audit_events_seq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$2,
+	up: () => up$2
 });
 /**
 * SQLite twin of `../20261003170000_audit_events_seq.ts`. SQLite cannot add a column whose default calls a
@@ -44805,7 +46036,7 @@ const INDEXES = [
 	`create index "audit_events_occurred_at_idx" on "audit_events" (occurred_at DESC)`,
 	`create index "audit_events_target_idx" on "audit_events" (target_type, target_id, occurred_at DESC)`
 ];
-const up$1 = async (db) => {
+const up$2 = async (db) => {
 	await sql`insert into "sequences" (name, value) values ('audit_events_seq', 0)`.execute(db);
 	await sql`alter table "audit_events" rename to "audit_events_before_seq"`.execute(db);
 	await sql`create table "audit_events" (
@@ -44833,15 +46064,15 @@ const up$1 = async (db) => {
 	await sql`drop table "audit_events_before_seq"`.execute(db);
 	for (const statement of INDEXES) await sql.raw(statement).execute(db);
 };
-const down$1 = async (db) => {
+const down$2 = async (db) => {
 	await sql`alter table "audit_events" drop column "seq"`.execute(db);
 	await sql`delete from "sequences" where name = 'audit_events_seq'`.execute(db);
 };
 //#endregion
 //#region src/db/migrations/sqlite/20261004120000_models_site_scope.ts
 var _20261004120000_models_site_scope_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$1,
+	up: () => up$1
 });
 /**
 * SQLite twin of `../20261004120000_models_site_scope.ts`. `down` rebuilds `models` without `site_id`
@@ -44851,7 +46082,7 @@ var _20261004120000_models_site_scope_exports = /* @__PURE__ */ __exportAll({
 * deletes nothing they reference.
 */
 const NIL_UUID = "00000000-0000-0000-0000-000000000000";
-const up = async (db) => {
+const up$1 = async (db) => {
 	await sql`alter table "models" add column "site_id" text_uuid references sites (id)`.execute(db);
 	await sql`create index "models_site_idx" on "models" (site_id)`.execute(db);
 	await sql`drop index "models_api_key_uq"`.execute(db);
@@ -44861,7 +46092,7 @@ const up = async (db) => {
   `.execute(db);
 	await sql`alter table "schema_drafts" add column "shared" integer_boolean not null default 0`.execute(db);
 };
-const down = async (db) => {
+const down$1 = async (db) => {
 	const { rows } = await sql`select count(*) as count from "models" where site_id is not null`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 0) throw new Error("Cannot roll back per-site schema while definitions belong to a site: two sites may share an API ID. Share or delete the site definitions first.");
 	await sql`alter table "schema_drafts" drop column "shared"`.execute(db);
@@ -44884,11 +46115,38 @@ const down = async (db) => {
 	await sql`create unique index "models_api_key_uq" on "models" (lower(api_key)) where (deleted_at IS NULL)`.execute(db);
 };
 //#endregion
+//#region src/db/migrations/sqlite/20261004130000_site_seo_settings.ts
+var _20261004130000_site_seo_settings_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* SQLite twin of `../20261004130000_site_seo_settings.ts`. `insert or ignore` stands in for `on conflict do
+* nothing` (the grant's unique index); the permissions version moves only when a grant was added or removed.
+*/
+const bumpPermissionsVersion = (db) => sql`update "system_versions" set permissions_version = permissions_version + 1, updated_at = shapio_now()`.execute(db);
+const up = async (db) => {
+	await sql`alter table "sites" add column "seo_defaults" text_jsonb`.execute(db);
+	const granted = await sql`
+    insert or ignore into "admin_role_permissions" (role_id, action, model_id, condition, field_ids)
+    select role_id, 'site.settings', null, null, null
+    from "admin_role_permissions"
+    where action = 'publishing.manage' and model_id is null
+  `.execute(db);
+	if (Number(granted.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion(db);
+};
+const down = async (db) => {
+	const revoked = await sql`delete from "admin_role_permissions" where action = 'site.settings'`.execute(db);
+	if (Number(revoked.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion(db);
+	await sql`alter table "sites" drop column "seo_defaults"`.execute(db);
+};
+//#endregion
 //#region src/db/migrations/sqlite/index.ts
 const SQLITE_MIGRATIONS = {
 	"0001_baseline": _0001_baseline_exports,
 	"20261003170000_audit_events_seq": _20261003170000_audit_events_seq_exports,
-	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports
+	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports,
+	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports
 };
 //#endregion
 //#region src/db/migrations/index.ts
@@ -44919,7 +46177,8 @@ const MIGRATIONS = {
 	"20261003150000_widen_deployment_providers": _20261003150000_widen_deployment_providers_exports,
 	"20261003160000_create_assist_runs": _20261003160000_create_assist_runs_exports,
 	"20261003170000_audit_events_seq": _20261003170000_audit_events_seq_exports$2,
-	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports$2
+	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports$2,
+	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports$2
 };
 const PROVIDERS = {
 	postgres: { getMigrations: () => Promise.resolve({ ...MIGRATIONS }) },
@@ -45067,13 +46326,17 @@ const getVersionSchema = { response: { 200: Type.Object({
 const healthRoutes = async (app) => {
 	declareSiteScope(app, "network");
 	const config = { rateLimit: false };
+	const probeConfig = {
+		...config,
+		requestLog: "debug"
+	};
 	app.get("/health", {
 		schema: getHealthSchema,
-		config
+		config: probeConfig
 	}, getHealth);
 	app.get("/ready", {
 		schema: getReadySchema,
-		config
+		config: probeConfig
 	}, getReady);
 	app.get("/version", {
 		schema: getVersionSchema,
@@ -45388,7 +46651,9 @@ const DRAFT = {
 const ITEM_PARAMETERS = /* @__PURE__ */ new Set([
 	"fields",
 	"populate",
-	"locale"
+	"locale",
+	"richText",
+	"seo"
 ]);
 const unauthenticated = () => new AppError(401, "INVALID_PREVIEW_TOKEN", "The preview token is invalid, expired or revoked");
 const allows = (mask, fieldId) => mask.mode === "all" || mask.fieldIds.includes(fieldId);
@@ -45461,7 +46726,11 @@ const authorize = async (runtime, base, fields, request) => {
 };
 /** The token's locale wins; a different `locale` in the query is refused rather than silently ignored. */
 const scopedQuery = (scope, rawQuery) => {
-	const query = parseQueryFor(scope.context, scope.model, scope.policy, rawQuery, { allowSnapshot: false });
+	const query = parseQueryFor(scope.context, scope.model, scope.policy, rawQuery, {
+		allowSnapshot: false,
+		allowRichText: true,
+		allowSeo: true
+	});
 	if (scope.token.locale && query.locale && query.locale !== scope.token.locale) throw new AppError(403, "PREVIEW_SCOPE", `This preview token is for locale "${scope.token.locale}"`);
 	return scope.token.locale ? {
 		...query,
@@ -45470,9 +46739,9 @@ const scopedQuery = (scope, rawQuery) => {
 };
 /** A preview token reads its one entry only. */
 const entryCondition = (token) => [entryIdIs(token.entry_id)];
-const readOf = (scope, executor, query) => ({
+const readOf = (scope, query) => ({
 	context: scope.context,
-	env: deliveryEnvironment(scope.context, executor, DRAFT, query.locale),
+	source: DRAFT,
 	model: scope.model,
 	policy: scope.policy,
 	query,
@@ -45487,30 +46756,26 @@ const metaOf = (scope, query) => ({
 const listPreview$1 = async (runtime, base, fields, request) => {
 	const scope = await authorize(runtime, base, fields, request);
 	const query = scopedQuery(scope, request.rawQuery);
-	return withConsistentRead(async (trx) => {
-		const { entries, limit, count } = await readEntryPage(readOf(scope, trx, query));
-		return {
-			data: entries,
-			meta: {
-				...metaOf(scope, query),
-				pagination: paginationMeta(query.page, limit, await count())
-			}
-		};
-	}, scope.context.db);
+	const { entries, limit, total } = await readEntryPage(readOf(scope, query));
+	return {
+		data: entries,
+		meta: {
+			...metaOf(scope, query),
+			pagination: paginationMeta(query.page, limit, total)
+		}
+	};
 };
 const getPreview$1 = async (runtime, base, fields, request) => {
 	assertItemParameters(request.rawQuery, ITEM_PARAMETERS);
 	const scope = await authorize(runtime, base, fields, request);
 	if (scope.token.entry_id !== request.id) throw new AppError(403, "PREVIEW_SCOPE", "This preview token is for another entry");
 	const query = scopedQuery(scope, request.rawQuery);
-	return withConsistentRead(async (trx) => {
-		const entry = await readOneEntry(readOf(scope, trx, query), request.id);
-		if (!entry) throw entryNotFound(request.id);
-		return {
-			data: entry,
-			meta: metaOf(scope, query)
-		};
-	}, scope.context.db);
+	const { entry } = await readOneEntry(readOf(scope, query), request.id);
+	if (!entry) throw entryNotFound(request.id);
+	return {
+		data: entry,
+		meta: metaOf(scope, query)
+	};
 };
 //#endregion
 //#region src/controllers/previewContent.ts
@@ -45571,6 +46836,20 @@ const previewRoutes = async (app) => {
 	}, getPreview);
 };
 //#endregion
+//#region src/controllers/site.ts
+const getDeliverySite = async (request, reply) => sendCacheable(request, reply, await getDeliverySite$1(await contentContextFor(request)));
+//#endregion
+//#region src/routes/site/index.ts
+/**
+* /api/site (plan seo-fields): the delivery view of the request's site (token, `Shapio-Site` or `?site=`):
+* its key, name and SEO defaults, for pages without an entry and for GraphQL users merging SEO themselves.
+* Readable by any caller that reads content on the site; cacheable like delivery reads.
+*/
+const siteRoutes = async (app) => {
+	declareSiteScope(app, "site");
+	app.get("/", { schema: getDeliverySiteSchema }, getDeliverySite);
+};
+//#endregion
 //#region src/controllers/snapshots.ts
 const listSnapshotChanges = async (request) => listSnapshotChanges$1(await contentContextFor(request), request.query);
 const getCurrentSnapshot = async (request) => currentSnapshot(await contentContextFor(request));
@@ -45672,6 +46951,7 @@ const buildApp = async (config, deps) => {
 		} } : {},
 		trustProxy: toFastifyTrustProxy(config.server.trustProxy),
 		genReqId: () => randomUUID(),
+		logController: new LogController({ disableRequestLogging: true }),
 		ajv: { customOptions: { removeAdditional: false } }
 	};
 	const app = Fastify(options).withTypeProvider();
@@ -45681,6 +46961,7 @@ const buildApp = async (config, deps) => {
 	});
 	const schemaLookup = deps.fieldVisibility ?? createSchemaFieldVisibility(schemaRegistry);
 	await app.register(auditDeclarationPlugin);
+	await app.register(requestLogPlugin);
 	await app.register(gracefulClosePlugin);
 	await app.register(errorHandlerPlugin);
 	await app.register(servicesPlugin, {
@@ -45756,6 +47037,7 @@ const buildApp = async (config, deps) => {
 	await app.register(themeCataloguePlugin, { catalogue: buildThemeCatalogue(extensions.loaded.config.themes ?? []) });
 	await app.register(adminExtensionsRoutes, { prefix: urls.withBasePath("/api/admin/extensions") });
 	await app.register(deliveryRoutes, { prefix: urls.withBasePath("/api/content") });
+	await app.register(siteRoutes, { prefix: urls.withBasePath("/api/site") });
 	await app.register(snapshotsRoutes, { prefix: urls.withBasePath("/api/snapshots") });
 	await app.register(docsRoutes, { prefix: urls.withBasePath("/api/docs") });
 	if (config.graphql.enabled) {
@@ -47995,4 +49277,4 @@ const startDedicatedWorker = async (config) => {
 //#endregion
 export { toTypeName as $, update$8 as A, checkThemeContrast as B, BEFORE_EVENTS as C, listForAssets as D, buildEditorManifest as E, RESERVED_FIELD_API_KEYS as F, mergePulledLock as G, hashDefinition as H, RESERVED_TYPE_NAMES as I, schemaFilePath as J, parseDefinition as K, SCHEMA_KIND_DIRECTORIES as L, describeError as M, LOCK_FILE_PATH as N, listLiveByDriver as O, RESERVED_DEFINITION_API_KEYS as P, suggestPlural as Q, SITES_DIRECTORY as R, AFTER_EVENTS as S, EXTENSION_ROUTE_ROOT as T, lockCoversSite as U, foldApiKey as V, lockEntriesForSite as W, serializeDefinition as X, scopeDirectory as Y, serializeLockFile as Z, createLogger as _, loadConfig as a, createStableId as at, SITE_KEY_PATTERN as b, getPendingMigrations as c, sqliteDriverOf as ct, createMediaStorage as d, upgradeLockFile as et, createSite$1 as f, generateToken as g, SYSTEM_CLI_ACTOR as h, assertDatabaseReachable as i, SAFE_LINK_PATTERN as it, STORAGE_DRIVERS$1 as j, lockById$5 as k, migrateToLatest as l, createAdminDirect as m, startServer as n, withSiteCovered as nt, loadEnvFileIfPresent as o, validateRichText as ot, listAllSites as p, parseLockFile as q, copyObjectVerified as r, RICHTEXT_FORMAT as rt, buildApp as s, createDb as st, startDedicatedWorker as t, validateSchema as tt, SHAPIO_VERSION as u, createUrlBuilder as v, EXTENSION_JOB_PREFIX as w, loadProjectConfig as x, loopbackUrl as y, THEME_VARIANTS as z };
 
-//# sourceMappingURL=worker-BAmQPoTJ.js.map
+//# sourceMappingURL=worker-i1rY2TIZ.js.map