@shapio/cms 0.4.0 → 0.4.1

package/dist/{worker-i1rY2TIZ.js → worker-BDYDbaea.js}

@@ -1084,13 +1084,15 @@ const MYSQL_TABLES = {
 			"change_seq",
 			"created_at",
 			"updated_at",
-			"site_id"
+			"site_id",
+			"entry_created_at"
 		],
-		nullable: ["autosaved_at"],
+		nullable: ["autosaved_at", "entry_created_at"],
 		timestamps: [
 			"autosaved_at",
 			"created_at",
-			"updated_at"
+			"updated_at",
+			"entry_created_at"
 		],
 		uniqueKeys: [{
 			name: "entry_heads_pkey",
@@ -4590,6 +4592,8 @@ const countLiveByModel = (siteId, modelIds, executor = db) => modelIds.length ==
 * Pass the outer query's executor; the subquery is compiled into the outer statement.
 */
 const entrySiteOf = (executor, entryId) => executor.selectFrom("entries").select("entries.site_id").where("entries.id", "=", entryId);
+/** The entry's creation time, copied onto each head (`entry_heads.entry_created_at`, the default list order). */
+const entryCreatedAtOf = (executor, entryId) => executor.selectFrom("entries").select("entries.created_at").where("entries.id", "=", entryId);
 /**
 * Live entries of a model on sites other than `siteId`, per site (a definition can only move to one site
 * while no other site holds entries of it: plan site-schema, rule 2). Deleted ones do not count: once the
@@ -4704,6 +4708,7 @@ const findForEntry = (entryId, executor = db) => executor.selectFrom("entry_head
 const insert$28 = (head, trx = db) => trx.insertInto("entry_heads").values({
 	entry_id: head.entryId,
 	site_id: entrySiteOf(trx, head.entryId),
+	entry_created_at: entryCreatedAtOf(trx, head.entryId),
 	model_id: head.modelId,
 	locale: head.locale,
 	state: head.state,
@@ -6345,6 +6350,11 @@ const effectiveTitleField = (definition) => {
 };
 /** Title types that the document edits inline as its H1; any other title type stays a property. */
 const INLINE_TITLE_TYPES = /* @__PURE__ */ new Set(["string", "text"]);
+/**
+* The automatic rule: the fields written in the document while `display.canvasFieldIds` is unset (rich
+* text, dynamic zones, repeatable components, media with several files). Also what a canvas field can take
+* between blocks: only these hold blocks.
+*/
 const isCanvasEligible = (field) => {
 	switch (field.type) {
 		case "richtext":
@@ -6354,6 +6364,12 @@ const isCanvasEligible = (field) => {
 		default: return false;
 	}
 };
+/**
+* Whether `display.canvasFieldIds` may list the field: any field but the entry's title (`effectiveTitleField`),
+* which the document shows as its heading. A configured cover is refused by the validator; an automatically
+* chosen one placed in the document simply stops being the cover.
+*/
+const isDocumentPlaceable = (field, title) => field.id !== title?.id;
 /** A single `media` field that may hold an image. */
 const isCoverEligible = (field) => field.type === "media" && !field.settings.multiple && (field.settings.allowedKinds === void 0 || field.settings.allowedKinds.includes("image"));
 const byIds = (live, ids) => (ids ?? []).map((id) => live.find((field) => field.id === id)).filter((field) => field !== void 0);
@@ -6378,16 +6394,16 @@ const coverOf = (model, live, canvas) => {
 	return live.find((field) => isCoverEligible(field) && !canvas.has(field.id));
 };
 /**
-* The entry document's layout: title, cover, canvas blocks and properties. Configured `display` ids win
-* when they point at live, eligible fields; anything else falls back to the defaults (canvas: every
-* eligible field in field order; cover: the first single image field). Deprecated and ineligible ids are
-* skipped, so a stale definition never breaks the editor. Pure: no values, no I/O.
+* The entry document's layout: title, cover, document fields and properties. Configured `display` ids win
+* when they point at live, eligible fields; anything else falls back to the defaults (canvas: every block
+* field in field order; cover: the first single image field not in the canvas). Deprecated, unknown ids and
+* the title are skipped, so a stale definition never breaks the editor. Pure: no values, no I/O.
 */
 const effectiveLayout = (model) => {
 	const live = model.fields.filter((field) => !field.deprecated);
 	const title = effectiveTitleField(model);
 	const titleInline = title !== void 0 && INLINE_TITLE_TYPES.has(title.type);
-	const configuredCanvas = unique$1(byIds(live, model.display.canvasFieldIds).filter(isCanvasEligible));
+	const configuredCanvas = unique$1(byIds(live, model.display.canvasFieldIds).filter((field) => isDocumentPlaceable(field, title)));
 	const canvasCandidates = model.display.canvasFieldIds === void 0 ? live.filter(isCanvasEligible) : configuredCanvas;
 	const cover = coverOf(model, live, new Set(configuredCanvas.map((field) => field.id)));
 	const canvas = canvasCandidates.filter((field) => field.id !== cover?.id);
@@ -6974,17 +6990,18 @@ const checkFieldList = (ids, check) => {
 	});
 };
 /**
-* The entry document's layout (`effectiveLayout`): canvas blocks, cover and strip. Title, cover and canvas
-* are disjoint (title types are never canvas or cover types, so eligibility covers the title); strip
-* entries are properties, so never the cover or a canvas block.
+* The entry document's layout (`effectiveLayout`): document fields, cover and strip. Title, cover and
+* canvas are disjoint: any field but the title (configured or automatic) may be in the canvas, the
+* configured cover may not; strip entries are properties, so never the cover or a document field.
 */
 const checkDocumentLayout = (model, fields) => {
 	const { canvasFieldIds, coverFieldId, stripFieldIds } = model.display;
 	const canvas = new Set(canvasFieldIds ?? []);
+	const title = effectiveTitleField(model);
 	const issues = checkFieldList(canvasFieldIds, {
 		path: "/display/canvasFieldIds",
 		fields,
-		reject: (field) => isCanvasEligible(field) ? void 0 : canvasRejection(field)
+		reject: (field) => isDocumentPlaceable(field, title) ? void 0 : "the title is the heading of the document, not a field in it"
 	});
 	if (coverFieldId !== void 0) issues.push(...checkFieldList([coverFieldId], {
 		path: "/display/coverFieldId",
@@ -7001,11 +7018,6 @@ const checkDocumentLayout = (model, fields) => {
 	}));
 	return issues;
 };
-const canvasRejection = (field) => {
-	if (field.type === "component") return "only a repeatable component can be in the canvas";
-	if (field.type === "media") return "only a media field with several files can be in the canvas";
-	return `a ${field.type} field cannot be in the canvas`;
-};
 const checkDisplay = (definition) => {
 	const fields = new Map(definition.fields.map((field) => [field.id, field]));
 	const fieldIds = new Set(fields.keys());
@@ -12561,9 +12573,11 @@ const mysqlContentDialect = {
 	},
 	snapshotCte: ({ name, siteId, modelId, seq }) => sql`with ${sql.id(name)} as (
     select pl.entry_id, pl.site_id, pl.model_id, pl.locale, 'published' as state, r.data, 0 as version,
-      r.id as revision_id, pl.published_at as updated_at, null as autosaved_at
+      r.id as revision_id, pl.published_at as updated_at, null as autosaved_at,
+      en.created_at as entry_created_at
     from publication_log pl
     join content_revisions r on r.id = pl.revision_id
+    join entries en on en.id = pl.entry_id
     where pl.site_id = ${siteId} and pl.model_id = ${modelId}
       and pl.from_seq <= ${seq}
       and (pl.to_seq is null or pl.to_seq > ${seq})
@@ -12586,8 +12600,9 @@ const mysqlContentDialect = {
 //#region src/content/compiler/dialect/postgres.ts
 /**
 * PostgreSQL content SQL (ADR 0001): JSONB with a GIN `jsonb_path_ops` index serving containment, so
-* scalar equality is emitted as `data @> {...}`; ranges and sorts use per-field B-tree expression indexes
-* built `CONCURRENTLY` with a matching `CREATE STATISTICS` object.
+* equality on a field without an index is emitted as `data @> {...}`; ranges, sorts and equality on indexed
+* fields (filterable or sortable) use per-field B-tree expression indexes built `CONCURRENTLY` with a
+* matching `CREATE STATISTICS` object.
 */
 const DATA$1 = sql.ref(CONTENT_HEADS_COLUMNS.data);
 const ARRAY_TYPES = {
@@ -12639,6 +12654,10 @@ const postgresContentDialect = {
 	castParameter: castParameter$2,
 	fieldEquals: (target, value) => {
 		if (target.numericString && target.cast) return sql`(${fieldValue$2(target.fieldId, target.cast)} = ${castParameter$2(value, target.cast)})`;
+		if (target.indexed && target.cast) {
+			const expression = fieldValue$2(target.fieldId, target.cast);
+			return sql`(${expression} = ${castParameter$2(value, target.cast)} and ${expression} is not null)`;
+		}
 		return containment({ [target.fieldId]: target.list ? [value] : value });
 	},
 	fieldMissing: (fieldId) => {
@@ -12651,9 +12670,11 @@ const postgresContentDialect = {
 	sortDirection: (direction) => direction === "desc" ? sql`desc` : sql`asc`,
 	snapshotCte: ({ name, siteId, modelId, seq }) => sql`with ${sql.id(name)} as (
     select pl.entry_id, pl.site_id, pl.model_id, pl.locale, 'published'::text as state, r.data, 0 as version,
-      r.id as revision_id, pl.published_at as updated_at, null::timestamptz as autosaved_at
+      r.id as revision_id, pl.published_at as updated_at, null::timestamptz as autosaved_at,
+      en.created_at as entry_created_at
     from publication_log pl
     join content_revisions r on r.id = pl.revision_id
+    join entries en on en.id = pl.entry_id
     where pl.site_id = ${siteId}::uuid and pl.model_id = ${modelId}
       and pl.from_seq <= ${seq}::bigint
       and (pl.to_seq is null or pl.to_seq > ${seq}::bigint)
@@ -12742,9 +12763,11 @@ const DIALECTS = {
 		},
 		snapshotCte: ({ name, siteId, modelId, seq }) => sql`with ${sql.id(name)} as (
     select pl.entry_id, pl.site_id, pl.model_id, pl.locale, 'published' as state, r.data, 0 as version,
-      r.id as revision_id, pl.published_at as updated_at, null as autosaved_at
+      r.id as revision_id, pl.published_at as updated_at, null as autosaved_at,
+      en.created_at as entry_created_at
     from publication_log pl
     join content_revisions r on r.id = pl.revision_id
+    join entries en on en.id = pl.entry_id
     where pl.site_id = ${siteId} and pl.model_id = ${modelId}
       and pl.from_seq <= ${seq}
       and (pl.to_seq is null or pl.to_seq > ${seq})
@@ -13385,6 +13408,12 @@ const NUMERIC_TYPES = /* @__PURE__ */ new Set([
 ]);
 /** Numbers stored as JSON strings (exact decimals, big integers). */
 const NUMERIC_STRING_TYPES$1 = /* @__PURE__ */ new Set(["decimal", "biginteger"]);
+/**
+* Whether a field has a B-tree expression index: filterable or sortable, and not deprecated. The schema
+* planner builds an index for exactly these fields (`indexStepsOf`), and PostgreSQL equality compares on
+* the index expression for them (`EqualityTarget.indexed`).
+*/
+const hasFieldIndex = (field) => (field.filterable || field.sortable) && !field.deprecated;
 const valueCastFor = (type) => {
 	if (NUMERIC_TYPES.has(type)) return "numeric";
 	return type === "boolean" ? "boolean" : "text";
@@ -13408,8 +13437,9 @@ const fieldValueExpression = (fieldId, type, dialect = contentDialect()) => {
 	return dialect.fieldValue(fieldId, valueCastFor(type), NUMERIC_STRING_TYPES$1.has(type));
 };
 /**
-* Equality on a top-level field (lists: "contains"). PostgreSQL emits containment, which its GIN index
-* serves; SQLite compares the field's index expression.
+* Equality on a top-level field (lists: "contains"). PostgreSQL compares the field's index expression when
+* the field has one (`EqualityTarget.indexed`) and emits containment, which its GIN index serves, otherwise;
+* SQLite and MySQL compare the field's index expression.
 */
 const fieldEqualsExpression = (target, value, dialect = contentDialect()) => {
 	assertStableId(target.fieldId, "a field ID");
@@ -13750,17 +13780,32 @@ const RANGE_SQL = {
 	$ne: sql`<>`
 };
 const anyOf = (parts) => parts.length === 0 ? sql`false` : sql`(${sql.join(parts, sql` or `)})`;
-const equalityTarget = ({ field }) => ({
-	fieldId: field.id,
-	cast: SCALAR_DATA_TYPES.has(field.type) ? valueCastFor(field.type) : null,
-	list: isListValued(field),
-	numericString: NUMERIC_STRING_TYPES.has(field.type)
-});
+const equalityTarget = ({ field }) => {
+	const cast = SCALAR_DATA_TYPES.has(field.type) ? valueCastFor(field.type) : null;
+	const list = isListValued(field);
+	return {
+		fieldId: field.id,
+		cast,
+		list,
+		numericString: NUMERIC_STRING_TYPES.has(field.type),
+		indexed: cast !== null && !list && hasFieldIndex(field)
+	};
+};
+/** System filter columns. `createdAt` is the entry's, copied on every head (`h.entry_created_at`). */
 const SYSTEM_COLUMNS = {
 	id: "h.entry_id",
-	createdAt: "e.created_at",
+	createdAt: "h.entry_created_at",
 	updatedAt: "h.updated_at"
 };
+/** Whether a filter names a column of `entries` (the head query's `e`), so its COUNT must join entries. */
+const filterReadsEntries = (node) => {
+	switch (node.kind) {
+		case "and":
+		case "or": return node.nodes.some(filterReadsEntries);
+		case "not": return filterReadsEntries(node.node);
+		case "condition": return node.target.kind === "system" && SYSTEM_COLUMNS[node.target.name].startsWith("e.");
+	}
+};
 const systemCondition = (name, operator, value, dialect) => {
 	const column = sql.ref(SYSTEM_COLUMNS[name]);
 	const element = name === "id" ? "uuid" : "timestamp";
@@ -13862,20 +13907,13 @@ const whereOf = (plan, table, dialect) => {
 	return sql.join(conditions, sql` and `);
 };
 /**
-* The joined entry's site and model, which always equal the head's. Written out on the row query of a plain
-* list in `entries` order (the default newest-first sort) so the planner can walk `entries_model_idx` in that
-* order and stop at the page limit instead of sorting every head of the model. Not added when there are
-* conditions or the sort is on the head: SQLite then prefers the entries index over a field index that
-* serves the filter or the sort. Left off the COUNT, which reads every match either way.
-*/
-const entryScope = (plan, dialect) => plan.orderedByEntry === true && plan.conditions.length === 0 ? sql` and e.site_id = ${dialect.uuid(plan.siteId)} and e.model_id = ${modelIdLiteral(plan.modelId)}` : sql``;
-/**
 * The COUNT's FROM. Live heads exist only for live entries (deleting an entry removes its heads in the same
-* transaction; entries soft-deleted for having no head have none), so a count of heads with no condition
-* (conditions may name `e` columns) needs no join: it is read from `entry_heads_model_locale_state_idx`
-* alone. A snapshot keeps the join: the publication log still lists entries deleted since.
+* transaction; entries soft-deleted for having no head have none; `headLiveEntry.int.test.ts` pins it), so a
+* count of heads whose conditions name no `e` column needs no join: it is read from the heads' indexes alone
+* (the model index, or a field index for an indexed filter). A snapshot keeps the join: the publication log
+* still lists entries deleted since.
 */
-const countFrom = (plan, table, where, joined) => plan.source.kind === "heads" && plan.conditions.length === 0 ? sql`from ${table} h where ${where}` : joined;
+const countFrom = (plan, table, where, joined) => plan.source.kind === "heads" && !(plan.conditionsReadEntries ?? plan.conditions.length > 0) ? sql`from ${table} h where ${where}` : joined;
 const HEAD_COLUMNS$1 = sql`h.entry_id, h.locale, h.data, h.version, h.revision_id, h.updated_at,
       h.autosaved_at, e.created_at, e.updated_at as entry_updated_at, e.created_by_admin_id, e.owner_app_user_id`;
 /** The parts every statement over a plan's heads shares. */
@@ -13888,7 +13926,7 @@ const headQueryParts = (plan, dialect) => {
 	const offset = plan.offset ? sql` offset ${plan.offset}` : sql``;
 	return {
 		prefix: cte ?? sql``,
-		rows: sql`${from}${entryScope(plan, dialect)}${orderBy}${limit}${offset}`,
+		rows: sql`${from}${orderBy}${limit}${offset}`,
 		countFrom: countFrom(plan, table, where, from)
 	};
 };
@@ -14219,13 +14257,15 @@ const parseContentQuery = (tree, context) => {
 /**
 * ORDER BY for a content query. Field sorts use the same expression as the field's index (so the index can
 * serve them); the entry ID is always the final tie-breaker so pages are stable. Without an explicit sort
-* the model's default sort applies when the caller may read that field, else newest first. The tie-breaker is
-* spelled `e.id` (equal to `h.entry_id` by the join) so that, on an unfiltered list in `created_at` order,
-* every ORDER BY term is on `entries` and MySQL sorts only the model's entries before joining their heads.
+* the model's default sort applies when the caller may read that field, else newest first. `createdAt` is the
+* entry's creation time copied on the head (`h.entry_created_at`), so the default order and its tie-breaker
+* are both head columns, which `entry_heads_entry_order_idx` (site, model, state, `entry_created_at desc`,
+* `entry_id`) serves: a page is read in index order and the scan stops at the limit (ADR 0001, "Delivery perf
+* 2").
 */
 const SYSTEM_SORT_COLUMNS = {
 	id: "h.entry_id",
-	createdAt: "e.created_at",
+	createdAt: "h.entry_created_at",
 	updatedAt: "h.updated_at"
 };
 const termSql = (term, dialect) => {
@@ -14252,9 +14292,7 @@ const defaultSortTerms = (model, isReadable) => {
 		direction: "desc"
 	}];
 };
-/** Whether the first sort term is a column of `entries` (the head query's `e`), not of the head. */
-const leadsWithEntryColumn = (terms) => terms[0]?.target.kind === "system" && SYSTEM_SORT_COLUMNS[terms[0].target.name].startsWith("e.");
-const compileOrderBy = (terms, dialect = contentDialect()) => [...terms.map((term) => termSql(term, dialect)), sql`e.id asc`];
+const compileOrderBy = (terms, dialect = contentDialect()) => [...terms.map((term) => termSql(term, dialect)), sql`h.entry_id asc`];
 //#endregion
 //#region src/content/errors.ts
 /** Errors the content services throw; the central error handler renders them. */
@@ -14524,8 +14562,10 @@ const needsFollowUpReads = (env, model, rows, query, policy) => {
 	if (query.populate.size > 0) return true;
 	const fields = selectFields(model, policy.readMask, query.fields);
 	const documents = rows.map((row) => row.data);
-	return env.audience === "delivery" && targetsByModel(model, documents, fields).size > 0 || env.media !== void 0 && (mediaIdsOf(model, documents, fields).size > 0 || seoImageIdOf(env, fields) !== void 0);
+	return env.audience === "delivery" && targetsByModel(model, documents, fields).size > 0 || needsMediaReads(env, model, rows, fields);
 };
+/** Whether projecting these rows reads asset views (media fields, rich-text images, a default SEO image). */
+const needsMediaReads = (env, model, rows, fields) => env.media !== void 0 && (mediaIdsOf(model, rows.map((row) => row.data), fields).size > 0 || seoImageIdOf(env, fields) !== void 0);
 /** The site's default social image a `?seo=resolved` read needs (when the response carries an SEO field). */
 const seoImageIdOf = (env, fields) => env.seo?.imageId && seoFieldsOf(fields).length > 0 ? env.seo.imageId : void 0;
 /** A default SEO image is shown only while it is a public image (never through a signed URL). */
@@ -14808,6 +14848,8 @@ const getAdminEntry = async (context, modelKey, id, locale) => {
 	return buildAdminEntryView(context, model, policy, entry, locale);
 };
 /** Filters, search and row filter of a parsed query as SQL conditions. */
+/** Whether `queryConditions` names an `entries` column (`HeadQueryPlan.conditionsReadEntries`). */
+const queryReadsEntries = (query, policy) => query.filter !== null && filterReadsEntries(query.filter) || query.author !== void 0 || policy.rowFilter !== null;
 const queryConditions = (context, query, policy) => {
 	const rowFilter = compileRowFilter(policy.rowFilter, context.actor);
 	return [
@@ -14846,8 +14888,8 @@ const listAdminEntries = async (context, modelKey, rawQuery) => {
 		},
 		locales: readScopeFor(context.snapshot, model.definition, query.locale, { fallback: true }),
 		conditions: queryConditions(context, query, policy),
+		conditionsReadEntries: queryReadsEntries(query, policy),
 		orderBy: compileOrderBy(sort),
-		orderedByEntry: leadsWithEntryColumn(sort),
 		limit,
 		offset
 	});
@@ -18693,7 +18735,8 @@ const getDeliverySite$1 = async (context) => {
 * delivery-perf). The heads, the page total and the site's publication sequence come from one statement, so
 * a read that needs nothing else (no relation, populate or asset follow-up) runs without a transaction.
 * Anything that needs a follow-up statement runs in one REPEATABLE READ, read-only transaction, so every
-* statement of the response sees the moment `meta.snapshot` names.
+* statement of the response sees the moment `meta.snapshot` names, except a live published read whose only
+* follow-up is relation visibility: that runs on the pool (`readConsistently` explains why it is safe).
 */
 const deliveryEnvironment = (context, executor, source, locale, richText, seo) => ({
 	executor,
@@ -18715,6 +18758,11 @@ const environmentOf = (read, executor) => deliveryEnvironment(read.context, exec
 */
 const followsUp = (read) => read.query.populate.size > 0 || selectFields(read.model, read.policy.readMask, read.query.fields).some((field) => field.type === "relation" || field.type === "media" || Boolean(read.seo?.imageId) && isSeoField(field));
 /**
+* A live read of published heads (no `?snapshot`, not a preview or draft read, no extra conditions) without
+* populate: its only possible follow-up is relation visibility (asset views are checked on the rows).
+*/
+const isLiveVisibilityRead = (read) => read.source.kind === "heads" && read.source.state === "published" && read.query.populate.size === 0 && (read.conditions?.length ?? 0) === 0;
+/**
 * Loads the site's SEO defaults when the query asks for resolved SEO. Read before the heads, outside their
 * consistent moment: defaults are not part of a snapshot (`?snapshot=N&seo=resolved` uses today's).
 */
@@ -18729,20 +18777,29 @@ const seqOf = (seq) => {
 /**
 * Runs the plan's statement on the pool when the read cannot need a follow-up, and keeps that result when
 * the rows indeed need none; otherwise reads again inside one REPEATABLE READ transaction. `finish` projects
-* the rows (through the same executor), so its own statements see the same moment.
+* the rows (through the same executor), so its own statements see the same moment. A live published read
+* whose only follow-up is relation visibility also stays on the pool (see below).
 */
 const readConsistently = async (read, plan, options, finish) => {
 	const compiled = compileHeadPage(plan, options);
 	const { db } = read.context;
-	if (!followsUp(read)) {
+	const live = isLiveVisibilityRead(read);
+	if (!followsUp(read) || live) {
 		const env = environmentOf(read, db);
 		const { rows, meta } = await runHeadPage(compiled.rows, db);
+		const fields = selectFields(read.model, read.policy.readMask, read.query.fields);
 		if (meta && !needsFollowUpReads(env, read.model, rows, read.query, read.policy)) return finish({
 			env,
 			rows,
 			total: meta.total,
 			seq: seqOf(meta.seq)
 		});
+		if (meta && live && !needsMediaReads(env, read.model, rows, fields)) return finish({
+			env,
+			rows,
+			total: meta.total,
+			seq: seqOf(meta.seq)
+		});
 	}
 	return withConsistentRead(async (trx) => {
 		const env = environmentOf(read, trx);
@@ -18776,8 +18833,8 @@ const readEntryPage = async (unloaded, options = { total: true }) => {
 		source: read.source,
 		locales: localesOf(read),
 		conditions: [...queryConditions(context, query, policy), ...read.conditions ?? []],
+		conditionsReadEntries: queryReadsEntries(query, policy) || (read.conditions?.length ?? 0) > 0,
 		orderBy: compileOrderBy(sort),
-		orderedByEntry: leadsWithEntryColumn(sort),
 		limit,
 		offset
 	};
@@ -24188,13 +24245,15 @@ const summarizePrompt = (input) => ({
 //#region src/services/assist/summarize.ts
 const notSummarizable = (fieldApiKey, reason) => new AppError(400, "ASSIST_FIELD_NOT_SUMMARIZABLE", `"${fieldApiKey}" cannot be summarized into: ${reason}`, { field: fieldApiKey });
 /**
-* The target must be a string or text property (not the title) of a model whose document has a rich-text
-* canvas field: the summary is made from that canvas (plan §I).
+* The target must be a live string or text field (not the title) of a model whose document has a rich-text
+* canvas field, wherever the field is placed (a property or in the document): the summary is made from
+* that canvas (plan §I).
 */
 const summaryTarget = (definition, fieldApiKey) => {
 	const layout = effectiveLayout(definition);
-	const field = layout.properties.find((candidate) => candidate.apiKey === fieldApiKey);
-	if (!field) throw layout.title?.apiKey === fieldApiKey ? notSummarizable(fieldApiKey, "it is the title") : notSummarizable(fieldApiKey, "it is not a property of this model");
+	if (layout.title?.apiKey === fieldApiKey) throw notSummarizable(fieldApiKey, "it is the title");
+	const field = definition.fields.find((candidate) => candidate.apiKey === fieldApiKey && !candidate.deprecated);
+	if (!field) throw notSummarizable(fieldApiKey, "it is not a field of this model");
 	if (field.type !== "string" && field.type !== "text") throw notSummarizable(fieldApiKey, "only string and text fields hold summaries");
 	const canvas = layout.canvas.filter((candidate) => candidate.type === "richtext");
 	if (canvas.length === 0) throw notSummarizable(fieldApiKey, "the model has no rich-text body to summarize");
@@ -25551,11 +25610,11 @@ const scopedDefinitionsOf = (definitions) => definitions.map(({ definition, site
 /** Site IDs to keys, so schema issues found in one site's view can name the site. */
 const loadSiteKeys = async (executor) => new Map((await list$10(executor)).map((site) => [site.id, site.key]));
 /** The most filterable or sortable fields the database can index, or undefined without a limit. */
-const maxFieldIndexes = () => isMysql() ? 56 : void 0;
+const maxFieldIndexes = () => isMysql() ? 55 : void 0;
 //#endregion
 //#region src/schema/planner/plan.ts
 /** The field indexes a definition needs (filterable or sortable, not deprecated), in the current layout. */
-const indexStepsOf = (definition) => definition && definition.kind !== "component" ? definition.fields.filter((field) => (field.filterable || field.sortable) && !field.deprecated).map((field) => {
+const indexStepsOf = (definition) => definition && definition.kind !== "component" ? definition.fields.filter((field) => hasFieldIndex(field)).map((field) => {
 	const spec = {
 		modelId: definition.id,
 		fieldId: field.id,
@@ -33433,6 +33492,19 @@ const executeIdempotentDdl = async (db, statement) => {
 	}
 };
 //#endregion
+//#region src/db/entryOrderIndex.ts
+/**
+* `entry_heads_entry_order_idx` (ADR 0001, "Delivery perf 2"): the default newest-first list order on the
+* heads. The `20261005120000_entry_heads_entry_created_at` migration builds it on an empty table, else the
+* `schema.entryOrderIndex` job builds it here, `CONCURRENTLY` (PostgreSQL only: SQLite and MySQL build it in
+* their migrations).
+*/
+const ENTRY_ORDER_INDEX = "entry_heads_entry_order_idx";
+const createEntryOrderIndexConcurrently = (db) => sql`create index concurrently if not exists ${sql.id(ENTRY_ORDER_INDEX)}
+    on entry_heads (site_id, model_id, state, entry_created_at desc, entry_id)`.execute(db);
+/** Drops an INVALID index left by an interrupted build, so the next build starts over. */
+const dropEntryOrderIndexConcurrently = (db) => sql`drop index concurrently if exists ${sql.id(ENTRY_ORDER_INDEX)}`.execute(db);
+//#endregion
 //#region src/db/indexCatalog.ts
 /** Whether a relation exists in the current schema (e.g. content tables before package E's migration). */
 const tableExists = async (db, table) => {
@@ -33552,6 +33624,30 @@ const dropFieldIndex = (db, indexName) => withIndexBuildLock(db, async () => {
 		await executeIfAny(db, dropStatisticsStatement(indexName));
 	}
 });
+/** The job that builds `entry_heads_entry_order_idx` on an instance upgraded with heads present (PostgreSQL). */
+const ENTRY_ORDER_INDEX_JOB = "schema.entryOrderIndex";
+/**
+* Builds the default list order's index `CONCURRENTLY`, under the same lock as field index builds (two
+* concurrent builds on `entry_heads` deadlock). Idempotent: a valid index is kept, an INVALID one dropped
+* and rebuilt.
+*/
+const buildEntryOrderIndex = (db, log) => withIndexBuildLock(db, async () => {
+	const state = await getIndexState(db, ENTRY_ORDER_INDEX);
+	if (state === "valid") return "exists";
+	if (state === "invalid") {
+		log.warn({ indexName: ENTRY_ORDER_INDEX }, "dropping invalid index left by an earlier build");
+		await dropEntryOrderIndexConcurrently(db);
+	}
+	const startedAt = performance.now();
+	await createEntryOrderIndexConcurrently(db);
+	if (await getIndexState(db, "entry_heads_entry_order_idx") !== "valid") throw new Error(`Index ${ENTRY_ORDER_INDEX} is not valid after building`);
+	await analyzeHeadsStatement().execute(db);
+	log.info({
+		indexName: ENTRY_ORDER_INDEX,
+		durationMs: Math.round(performance.now() - startedAt)
+	}, "entry order index built");
+	return "built";
+});
 //#endregion
 //#region src/schema/planner/indexLayout.ts
 /**
@@ -33735,7 +33831,8 @@ const createFollowUpHandler = (deps) => async (context) => {
 const createSchemaJobHandlers = (deps) => [
 	[SCHEMA_CHANGE_JOB, createSchemaChangeHandler(deps)],
 	[SCHEMA_FOLLOW_UP_JOB, createFollowUpHandler(deps)],
-	[FIELD_INDEX_LAYOUT_JOB, createFieldIndexLayoutHandler(deps.db)]
+	[FIELD_INDEX_LAYOUT_JOB, createFieldIndexLayoutHandler(deps.db)],
+	[ENTRY_ORDER_INDEX_JOB, async (context) => ({ outcome: await buildEntryOrderIndex(deps.db, context.log) })]
 ];
 //#endregion
 //#region src/publishing/failures.ts
@@ -38085,6 +38182,7 @@ const insertRevision = (revision, trx = db) => trx.insertInto("content_revisions
 const insertHead = (head, trx = db) => trx.insertInto("entry_heads").values({
 	entry_id: head.entryId,
 	site_id: entrySiteOf(trx, head.entryId),
+	entry_created_at: entryCreatedAtOf(trx, head.entryId),
 	model_id: head.modelId,
 	locale: head.locale,
 	state: head.state,
@@ -38290,7 +38388,7 @@ const EMPTY_LOCK = {
 	schemaVersion: 0,
 	definitions: {}
 };
-const BATCH = 200;
+const BATCH$2 = 200;
 const pushLimited = (list, item) => {
 	if (list.length < 100) list.push(item);
 };
@@ -38437,9 +38535,9 @@ const scanBundle = async (context, input, acc) => {
 	const modelKey = (id) => definitionKeys.get(id) ?? context.snapshot.byId.get(id)?.definition.apiKey;
 	const knownLocale = (code) => bundleLocales.has(code) || context.snapshot.locales.some((locale) => locale.code === code);
 	const flush = async (force) => {
-		if (users.length >= BATCH || force && users.length > 0) await planUsers(acc, users.splice(0));
-		if (assets.length >= BATCH || force && assets.length > 0) await planAssets(acc, assets.splice(0));
-		if (entries.length >= BATCH / 2 || force && entries.length > 0) await planEntries(acc, entries.splice(0), modelKey, knownLocale);
+		if (users.length >= BATCH$2 || force && users.length > 0) await planUsers(acc, users.splice(0));
+		if (assets.length >= BATCH$2 || force && assets.length > 0) await planAssets(acc, assets.splice(0));
+		if (entries.length >= BATCH$2 / 2 || force && entries.length > 0) await planEntries(acc, entries.splice(0), modelKey, knownLocale);
 	};
 	for await (const { record } of readBundle(input)) {
 		switch (record.type) {
@@ -38901,7 +38999,7 @@ const openStoredBundle = (storage, stored) => storage.get(stored.driver).getStre
 const removeStoredBundle = (storage, stored) => storage.get(stored.driver).delete(stored.key);
 //#endregion
 //#region src/constants/version.ts
-const SHAPIO_VERSION = "0.4.0";
+const SHAPIO_VERSION = "0.4.1";
 //#endregion
 //#region src/repositories/transferExport.ts
 /**
@@ -42195,14 +42293,14 @@ const docsRoutes = async (app) => {
 //#endregion
 //#region src/db/migrations/20261001120000_create_platform_tables.ts
 var _20261001120000_create_platform_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$30,
-	up: () => up$30
+	down: () => down$33,
+	up: () => up$33
 });
 /**
 * Foundation tables shared by every package: durable versions, the job queue, the transactional outbox
 * and the audit log. Statuses are text with CHECK constraints so new states need only a constraint change.
 */
-const up$30 = async (db) => {
+const up$33 = async (db) => {
 	await db.schema.createTable("system_versions").addColumn("id", "boolean", (col) => col.primaryKey().defaultTo(true).check(sql`id`)).addColumn("schema_version", "integer", (col) => col.notNull().defaultTo(0)).addColumn("permissions_version", "integer", (col) => col.notNull().defaultTo(0)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 	await sql`insert into system_versions default values`.execute(db);
 	await db.schema.createTable("jobs").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("type", "text", (col) => col.notNull()).addColumn("payload", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("status", "text", (col) => col.notNull().defaultTo("pending").check(sql`status in ('pending', 'running', 'succeeded', 'dead')`)).addColumn("priority", "integer", (col) => col.notNull().defaultTo(0)).addColumn("run_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("attempts", "integer", (col) => col.notNull().defaultTo(0)).addColumn("max_attempts", "integer", (col) => col.notNull().defaultTo(10).check(sql`max_attempts > 0`)).addColumn("idempotency_key", "text").addColumn("locked_by", "text").addColumn("locked_until", "timestamptz").addColumn("checkpoint", "jsonb").addColumn("result", "jsonb").addColumn("last_error", "text").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("finished_at", "timestamptz").execute();
@@ -42224,7 +42322,7 @@ const up$30 = async (db) => {
 		"occurred_at desc"
 	]).execute();
 };
-const down$30 = async (db) => {
+const down$33 = async (db) => {
 	await db.schema.dropTable("audit_events").execute();
 	await db.schema.dropTable("outbox_events").execute();
 	await db.schema.dropTable("jobs").execute();
@@ -42233,8 +42331,8 @@ const down$30 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001130000_create_admin_identity.ts
 var _20261001130000_create_admin_identity_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$29,
-	up: () => up$29
+	down: () => down$32,
+	up: () => up$32
 });
 /**
 * Admin identity (package B, ADR 0005): admin users, roles and their permission grants, server-side
@@ -42243,7 +42341,7 @@ var _20261001130000_create_admin_identity_exports = /* @__PURE__ */ __exportAll(
 */
 const withTimestamps$3 = (table) => table.addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`));
 const uuidPrimaryKey$3 = (table) => table.addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`));
-const up$29 = async (db) => {
+const up$32 = async (db) => {
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("admin_users")).addColumn("email", "text", (col) => col.notNull().unique()).addColumn("name", "text", (col) => col.notNull().defaultTo("")).addColumn("password_hash", "text", (col) => col.notNull()).addColumn("status", "text", (col) => col.notNull().defaultTo("active").check(sql`status in ('active', 'disabled')`)).addColumn("last_login_at", "timestamptz").addColumn("password_changed_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`))).execute();
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("admin_roles")).addColumn("key", "text", (col) => col.notNull().unique().check(sql`key ~ '^[a-z][a-z0-9-]{0,62}$'`)).addColumn("name", "text", (col) => col.notNull()).addColumn("description", "text", (col) => col.notNull().defaultTo("")).addColumn("kind", "text", (col) => col.notNull().defaultTo("admin").check(sql`kind in ('admin', 'delivery')`)).addColumn("is_system", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("version", "integer", (col) => col.notNull().defaultTo(1))).execute();
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("admin_role_permissions")).addColumn("role_id", "uuid", (col) => col.notNull().references("admin_roles.id").onDelete("cascade")).addColumn("action", "text", (col) => col.notNull()).addColumn("model_id", "text").addColumn("condition", "text", (col) => col.check(sql`condition in ('ownedByPrincipal')`)).addColumn("field_ids", sql`text[]`).addUniqueConstraint("admin_role_permissions_grant_uq", [
@@ -42263,7 +42361,7 @@ const up$29 = async (db) => {
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("api_tokens")).addColumn("name", "text", (col) => col.notNull()).addColumn("token_hash", "text", (col) => col.notNull().unique()).addColumn("token_prefix", "text", (col) => col.notNull()).addColumn("role_id", "uuid", (col) => col.notNull().references("admin_roles.id").onDelete("restrict")).addColumn("created_by", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("expires_at", "timestamptz").addColumn("last_used_at", "timestamptz").addColumn("revoked_at", "timestamptz")).execute();
 	await db.schema.createIndex("api_tokens_role_idx").on("api_tokens").column("role_id").execute();
 };
-const down$29 = async (db) => {
+const down$32 = async (db) => {
 	await db.schema.dropTable("api_tokens").execute();
 	await db.schema.dropTable("setup_tokens").execute();
 	await db.schema.dropTable("password_resets").execute();
@@ -42277,31 +42375,31 @@ const down$29 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001130500_create_system_settings.ts
 var _20261001130500_create_system_settings_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$28,
-	up: () => up$28
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Instance-wide key/value settings that must survive restarts and be shared by every instance, e.g. the
 * generated signing secret. General purpose: later packages add keys, not tables.
 */
-const up$28 = async (db) => {
+const up$31 = async (db) => {
 	await db.schema.createTable("system_settings").addColumn("key", "text", (col) => col.primaryKey()).addColumn("value", "text", (col) => col.notNull()).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 };
-const down$28 = async (db) => {
+const down$31 = async (db) => {
 	await db.schema.dropTable("system_settings").execute();
 };
 //#endregion
 //#region src/db/migrations/20261001140000_create_schema_tables.ts
 var _20261001140000_create_schema_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * Schema registry (package D, ADR 0002): models and components (one table, `kind` discriminator), immutable
 * schema revisions, the per-model active pointer, schema change jobs, locales and schema settings.
 * Model definitions are data: creating or changing a model never runs DDL (CONTRIBUTING.md rule 1).
 */
-const up$27 = async (db) => {
+const up$30 = async (db) => {
 	await db.schema.createTable("models").addColumn("id", "uuid", (col) => col.primaryKey()).addColumn("kind", "text", (col) => col.notNull().check(sql`kind in ('collection', 'singleton', 'component')`)).addColumn("api_key", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("deleted_at", "timestamptz").execute();
 	await sql`create unique index models_api_key_uq on models (lower(api_key)) where deleted_at is null`.execute(db);
 	await db.schema.createTable("schema_revisions").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("model_id", "uuid", (col) => col.notNull().references("models.id").onDelete("restrict")).addColumn("version", "integer", (col) => col.notNull().check(sql`version > 0`)).addColumn("definition", "jsonb", (col) => col.notNull()).addColumn("hash", "text", (col) => col.notNull()).addColumn("parent_revision_id", "uuid", (col) => col.references("schema_revisions.id")).addColumn("created_by_type", "text", (col) => col.notNull()).addColumn("created_by_id", "text").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addUniqueConstraint("schema_revisions_model_version_uq", ["model_id", "version"]).execute();
@@ -42329,7 +42427,7 @@ const up$27 = async (db) => {
 	await db.schema.createTable("schema_settings").addColumn("id", "boolean", (col) => col.primaryKey().defaultTo(true).check(sql`id`)).addColumn("read_only", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("read_only_reason", "text").addColumn("updated_by_type", "text").addColumn("updated_by_id", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 	await sql`insert into schema_settings default values`.execute(db);
 };
-const down$27 = async (db) => {
+const down$30 = async (db) => {
 	await db.schema.dropTable("schema_settings").execute();
 	await db.schema.dropTable("locales").execute();
 	await db.schema.dropTable("schema_change_jobs").execute();
@@ -42341,8 +42439,8 @@ const down$27 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001150000_create_content_tables.ts
 var _20261001150000_create_content_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Content storage (package E, ADR 0001): entries, immutable content revisions, mutable heads (one per
@@ -42350,7 +42448,7 @@ var _20261001150000_create_content_tables_exports = /* @__PURE__ */ __exportAll(
 * and the publication log behind `?snapshot=N`. User content models never get tables of their own
 * (CONTRIBUTING.md rule 1): their values are JSONB keyed by stable field IDs.
 */
-const up$26 = async (db) => {
+const up$29 = async (db) => {
 	await db.schema.createTable("entries").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("model_id", "uuid", (col) => col.notNull().references("models.id").onDelete("restrict")).addColumn("owner_app_user_id", "uuid").addColumn("created_by_admin_id", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("deleted_at", "timestamptz").execute();
 	await sql`create index entries_model_idx on entries (model_id, created_at) where deleted_at is null`.execute(db);
 	await sql`create index entries_owner_idx on entries (owner_app_user_id) where owner_app_user_id is not null`.execute(db);
@@ -42414,7 +42512,7 @@ const up$26 = async (db) => {
 	await sql`create unique index publication_log_open_uq on publication_log (entry_id, locale) where to_seq is null`.execute(db);
 	await db.schema.createIndex("publication_log_model_seq_idx").on("publication_log").columns(["model_id", "from_seq"]).execute();
 };
-const down$26 = async (db) => {
+const down$29 = async (db) => {
 	await db.schema.dropTable("publication_log").execute();
 	await db.schema.dropTable("publication_state").execute();
 	await db.schema.dropTable("unique_values").execute();
@@ -42427,8 +42525,8 @@ const down$26 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001160000_create_media_tables.ts
 var _20261001160000_create_media_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * Media library (package G): folders, assets, image variants, references from content and upload grants.
@@ -42439,7 +42537,7 @@ const withTimestamps$2 = (table) => table.addColumn("created_at", "timestamptz",
 const uuidPrimaryKey$2 = (table) => table.addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`));
 const STORAGE_DRIVER_CHECK = sql`storage_driver in ('local', 's3')`;
 const VISIBILITY_CHECK = sql`visibility in ('public', 'private')`;
-const up$25 = async (db) => {
+const up$28 = async (db) => {
 	await withTimestamps$2(uuidPrimaryKey$2(db.schema.createTable("media_folders")).addColumn("parent_id", "uuid", (col) => col.references("media_folders.id").onDelete("restrict")).addColumn("name", "text", (col) => col.notNull().check(sql`length(name) between 1 and 255`)).addColumn("created_by", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("version", "integer", (col) => col.notNull().defaultTo(1))).execute();
 	await sql`create unique index media_folders_sibling_name_uq on media_folders
     (coalesce(parent_id, '00000000-0000-0000-0000-000000000000'::uuid), lower(name))`.execute(db);
@@ -42468,7 +42566,7 @@ const up$25 = async (db) => {
 	]).execute();
 	await db.schema.createTable("media_upload_grants").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("asset_id", "uuid", (col) => col.notNull()).addColumn("kind", "text", (col) => col.notNull().check(sql`kind in ('create', 'replace')`)).addColumn("storage_driver", "text", (col) => col.notNull().check(STORAGE_DRIVER_CHECK)).addColumn("storage_key", "text", (col) => col.notNull().unique()).addColumn("original_filename", "text", (col) => col.notNull()).addColumn("declared_mime_type", "text", (col) => col.notNull()).addColumn("max_size_bytes", "bigint", (col) => col.notNull()).addColumn("folder_id", "uuid").addColumn("visibility", "text", (col) => col.notNull().check(VISIBILITY_CHECK)).addColumn("created_by", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("created_by_principal", "text", (col) => col.notNull()).addColumn("status", "text", (col) => col.notNull().defaultTo("pending").check(sql`status in ('pending', 'consumed', 'rejected', 'expired')`)).addColumn("expires_at", "timestamptz", (col) => col.notNull()).addColumn("consumed_at", "timestamptz").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 };
-const down$25 = async (db) => {
+const down$28 = async (db) => {
 	await db.schema.dropTable("media_upload_grants").execute();
 	await db.schema.dropTable("media_references").execute();
 	await db.schema.dropTable("media_variants").execute();
@@ -42478,8 +42576,8 @@ const down$25 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001170000_create_publishing_tables.ts
 var _20261001170000_create_publishing_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * Publishing (package H): scheduled publications, releases, webhooks and their delivery log, deployment
@@ -42518,13 +42616,13 @@ const createPreviewTables = async (db) => {
 	await uuidPrimaryKey$1(db.schema.createTable("preview_tokens")).addColumn("token_hash", "text", (col) => col.notNull().unique()).addColumn("token_prefix", "text", (col) => col.notNull()).addColumn("model_id", "uuid", (col) => col.notNull()).addColumn("entry_id", "uuid", (col) => col.references("entries.id").onDelete("cascade")).addColumn("locale", "text").addColumn("connection_id", "uuid", (col) => col.references("deployment_connections.id").onDelete("set null")).addColumn("delivery_role_id", "uuid", (col) => col.references("admin_roles.id").onDelete("set null")).addColumn("created_by", "uuid", (col) => col.notNull().references("admin_users.id").onDelete("cascade")).addColumn("expires_at", "timestamptz", (col) => col.notNull()).addColumn("revoked_at", "timestamptz").addColumn("last_used_at", "timestamptz").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 	await db.schema.createIndex("preview_tokens_entry_idx").on("preview_tokens").columns(["entry_id", "created_at desc"]).execute();
 };
-const up$24 = async (db) => {
+const up$27 = async (db) => {
 	await createSchedulingTables(db);
 	await createWebhookTables(db);
 	await createDeploymentTables(db);
 	await createPreviewTables(db);
 };
-const down$24 = async (db) => {
+const down$27 = async (db) => {
 	await db.schema.dropTable("preview_tokens").execute();
 	await db.schema.dropTable("deployment_runs").execute();
 	await db.schema.dropTable("deployment_connections").execute();
@@ -42537,8 +42635,8 @@ const down$24 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001180000_create_app_users.ts
 var _20261001180000_create_app_users_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * App users (package I, ADR 0005): the end users of sites and apps built on Shapio, with their own roles
@@ -42589,7 +42687,7 @@ const createCredentials = async (db) => {
 	}
 	await db.schema.createTable("app_login_codes").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("app_user_id", "uuid", (col) => col.notNull().references("app_users.id").onDelete("cascade")).addColumn("code_hash", "text", (col) => col.notNull().unique()).addColumn("expires_at", "timestamptz", (col) => col.notNull()).addColumn("used_at", "timestamptz").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 };
-const up$23 = async (db) => {
+const up$26 = async (db) => {
 	await createUsers(db);
 	await createRoles(db);
 	await createCredentials(db);
@@ -42599,7 +42697,7 @@ const up$23 = async (db) => {
       foreign key (owner_app_user_id) references app_users (id) on delete set null
   `.execute(db);
 };
-const down$23 = async (db) => {
+const down$26 = async (db) => {
 	await sql`alter table entries drop constraint if exists entries_owner_app_user_fk`.execute(db);
 	await db.schema.dropTable("app_login_codes").execute();
 	await db.schema.dropTable("app_password_resets").execute();
@@ -42614,8 +42712,8 @@ const down$23 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261002120000_create_extension_hook_runs.ts
 var _20261002120000_create_extension_hook_runs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * Extension points (package K, ADR 0009): the ledger of post-commit lifecycle hooks (`afterCreate`,
@@ -42623,17 +42721,17 @@ var _20261002120000_create_extension_hook_runs_exports = /* @__PURE__ */ __expor
 * as the hook's own database work, so a hook re-run after a worker crash finds its row and is skipped:
 * exactly once for everything the hook does through its transaction.
 */
-const up$22 = async (db) => {
+const up$25 = async (db) => {
 	await db.schema.createTable("extension_hook_runs").addColumn("event_id", "uuid", (col) => col.notNull()).addColumn("hook", "text", (col) => col.notNull()).addColumn("job_id", "uuid").addColumn("completed_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addPrimaryKeyConstraint("extension_hook_runs_pkey", ["event_id", "hook"]).execute();
 };
-const down$22 = async (db) => {
+const down$25 = async (db) => {
 	await db.schema.dropTable("extension_hook_runs").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002130000_app_auth_token_version_and_login_code_pkce.ts
 var _20261002130000_app_auth_token_version_and_login_code_pkce_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * App users (ADR 0005):
@@ -42644,20 +42742,20 @@ var _20261002130000_app_auth_token_version_and_login_code_pkce_exports = /* @__P
 *   sign-in; the one-time login code is only exchanged with the matching verifier. Codes live a minute, so
 *   any pending ones (issued without a challenge) are dropped rather than given a placeholder.
 */
-const up$21 = async (db) => {
+const up$24 = async (db) => {
 	await db.schema.alterTable("app_users").addColumn("token_version", "integer", (col) => col.notNull().defaultTo(0)).execute();
 	await sql`delete from app_login_codes`.execute(db);
 	await db.schema.alterTable("app_login_codes").addColumn("code_challenge", "text", (col) => col.notNull()).execute();
 };
-const down$21 = async (db) => {
+const down$24 = async (db) => {
 	await db.schema.alterTable("app_login_codes").dropColumn("code_challenge").execute();
 	await db.schema.alterTable("app_users").dropColumn("token_version").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002180000_add_publication_log_diff_indexes.ts
 var _20261002180000_add_publication_log_diff_indexes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * The snapshot diff (repositories/snapshotDiff.ts) finds the (entry, locale) pairs whose live period opened
@@ -42666,7 +42764,7 @@ var _20261002180000_add_publication_log_diff_indexes_exports = /* @__PURE__ */ _
 * - `(entry_id, locale, from_seq)`: "the row live at seq N" is the latest row starting at or before N.
 * Periods that opened in the range use the existing `(model_id, from_seq)` index.
 */
-const up$20 = async (db) => {
+const up$23 = async (db) => {
 	await sql`create index publication_log_to_seq_idx on publication_log (to_seq) where to_seq is not null`.execute(db);
 	await db.schema.createIndex("publication_log_entry_locale_from_idx").on("publication_log").columns([
 		"entry_id",
@@ -42674,15 +42772,15 @@ const up$20 = async (db) => {
 		"from_seq"
 	]).execute();
 };
-const down$20 = async (db) => {
+const down$23 = async (db) => {
 	await db.schema.dropIndex("publication_log_entry_locale_from_idx").execute();
 	await db.schema.dropIndex("publication_log_to_seq_idx").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002180100_create_usage_tables.ts
 var _20261002180100_create_usage_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Field usage from delivery traffic (plan developer-face §5): daily counters written by the in-memory
@@ -42690,7 +42788,7 @@ var _20261002180100_create_usage_tables_exports = /* @__PURE__ */ __exportAll({
 * payloads. `principal_key` is `token:<id>`, `app_users` or `anonymous`. Pruned by the retention job
 * after USAGE_RETENTION_DAYS.
 */
-const up$19 = async (db) => {
+const up$22 = async (db) => {
 	await db.schema.createTable("field_reads").addColumn("day", "date", (col) => col.notNull()).addColumn("model_id", "uuid", (col) => col.notNull()).addColumn("field_path", "text", (col) => col.notNull()).addColumn("principal_key", "text", (col) => col.notNull()).addColumn("selection", "text", (col) => col.notNull().check(sql`selection in ('explicit', 'implicit')`)).addColumn("reads", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_read_at", "timestamptz", (col) => col.notNull()).addPrimaryKeyConstraint("field_reads_pkey", [
 		"day",
 		"model_id",
@@ -42701,15 +42799,15 @@ const up$19 = async (db) => {
 	await db.schema.createIndex("field_reads_model_day_idx").on("field_reads").columns(["model_id", "day"]).execute();
 	await db.schema.createTable("token_reads").addColumn("day", "date", (col) => col.notNull()).addColumn("principal_key", "text", (col) => col.notNull()).addColumn("requests", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_snapshot", "bigint").addColumn("last_read_at", "timestamptz", (col) => col.notNull()).addPrimaryKeyConstraint("token_reads_pkey", ["day", "principal_key"]).execute();
 };
-const down$19 = async (db) => {
+const down$22 = async (db) => {
 	await db.schema.dropTable("token_reads").execute();
 	await db.schema.dropTable("field_reads").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002180200_create_change_sets.ts
 var _20261002180200_create_change_sets_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Change sets (developer-face plan §5, ADR 0010): schema drafts and entry publications that ship as ONE
@@ -42888,7 +42986,7 @@ const migrateReleases = async (db) => {
 	await sql`drop table release_items`.execute(db);
 	await sql`drop table releases`.execute(db);
 };
-const up$18 = async (db) => {
+const up$21 = async (db) => {
 	await createTables(db);
 	await linkExecutionRecords(db);
 	await allowConversionRevisions(db);
@@ -42960,7 +43058,7 @@ const restoreReleases = async (db) => {
 	await sql`update webhooks set events = array_remove(array_remove(events, 'change_set.shipping'),
     'change_set.discarded')`.execute(db);
 };
-const down$18 = async (db) => {
+const down$21 = async (db) => {
 	await restoreReleases(db);
 	await sql`alter table content_revisions drop constraint content_revisions_reason_check`.execute(db);
 	await sql`alter table content_revisions add constraint content_revisions_reason_check
@@ -42981,8 +43079,8 @@ const down$18 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261002190000_create_editor_presence_and_content_health.ts
 var _20261002190000_create_editor_presence_and_content_health_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * Editor experience (plan editor-experience §9):
@@ -42993,7 +43091,7 @@ var _20261002190000_create_editor_presence_and_content_health_exports = /* @__PU
 * - `content_health_findings`: open and recently resolved findings of the health rules per entry and
 *   locale (`*` for the entry as a whole). An evaluation upserts what it found and resolves the rest.
 */
-const up$17 = async (db) => {
+const up$20 = async (db) => {
 	await sql`
     create unlogged table editor_presence (
       entry_id uuid not null,
@@ -43030,15 +43128,15 @@ const up$17 = async (db) => {
 	await sql`create index content_health_findings_resolved_idx on content_health_findings (resolved_at)
     where resolved_at is not null`.execute(db);
 };
-const down$17 = async (db) => {
+const down$20 = async (db) => {
 	await sql`drop table content_health_findings`.execute(db);
 	await sql`drop table editor_presence`.execute(db);
 };
 //#endregion
 //#region src/db/migrations/20261003120000_add_changes_ship_permission.ts
 var _20261003120000_add_changes_ship_permission_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * `changes.ship` (agentic plan §I): shipping a change set (and scheduling a ship) becomes its own global
@@ -43046,7 +43144,7 @@ var _20261003120000_add_changes_ship_permission_exports = /* @__PURE__ */ __expo
 * live. Every role that holds `changes.manage` today keeps what it could do: it gets `changes.ship` too.
 * The permissions version moves only when grants changed, so running instances reload exactly then.
 */
-const up$16 = async (db) => {
+const up$19 = async (db) => {
 	await sql`
     with granted as (
       insert into admin_role_permissions (role_id, action, model_id, condition, field_ids)
@@ -43060,7 +43158,7 @@ const up$16 = async (db) => {
     where exists (select 1 from granted)
   `.execute(db);
 };
-const down$16 = async (db) => {
+const down$19 = async (db) => {
 	await sql`
     with revoked as (
       delete from admin_role_permissions where action = 'changes.ship' returning 1
@@ -43072,8 +43170,8 @@ const down$16 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003130000_create_sites.ts
 var _20261003130000_create_sites_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Sites (plan agentic-ecosystem §H, ADR 0011): one instance hosts many sites with one schema and one login.
@@ -43261,7 +43359,7 @@ const siteRoleAssignments = async (db) => {
   `.execute(db);
 	await sql`alter table admin_invitations drop column role_ids`.execute(db);
 };
-const up$15 = async (db) => {
+const up$18 = async (db) => {
 	await createSites(db);
 	await addSiteColumns(db);
 	await tieCopiesToEntries(db);
@@ -43274,7 +43372,7 @@ const assertSingleSite = async (db) => {
 	const { rows } = await sql`select count(*)::text as count from sites`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 1) throw new Error("Cannot roll back sites while more than one site exists: merging them would merge their snapshot ledgers and uniqueness and widen role assignments. Delete the other sites first.");
 };
-const down$15 = async (db) => {
+const down$18 = async (db) => {
 	await assertSingleSite(db);
 	await sql`alter table admin_invitations add column role_ids uuid[] not null default '{}'::uuid[]`.execute(db);
 	await sql`
@@ -43345,8 +43443,8 @@ const down$15 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003140200_enqueue_field_index_layout.ts
 var _20261003140200_enqueue_field_index_layout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Field index layout v2 (sites plan §H): per-field expression indexes on `entry_heads` lead with `site_id`,
@@ -43356,12 +43454,12 @@ var _20261003140200_enqueue_field_index_layout_exports = /* @__PURE__ */ __expor
 * old ones while the instance keeps serving. Nothing to rebuild (no field index yet, e.g. a new install):
 * no job.
 */
-const JOB_TYPE = "schema.fieldIndexLayout";
-const IDEMPOTENCY_KEY = "schema.fieldIndexLayout:v2";
-const up$14 = async (db) => {
+const JOB_TYPE$1 = "schema.fieldIndexLayout";
+const IDEMPOTENCY_KEY$1 = "schema.fieldIndexLayout:v2";
+const up$17 = async (db) => {
 	await sql`
     insert into jobs (type, payload, max_attempts, idempotency_key)
-    select ${JOB_TYPE}, '{}'::jsonb, 5, ${IDEMPOTENCY_KEY}
+    select ${JOB_TYPE$1}, '{}'::jsonb, 5, ${IDEMPOTENCY_KEY$1}
     where exists (
       select 1 from pg_catalog.pg_index i
       join pg_catalog.pg_class c on c.oid = i.indexrelid
@@ -43371,14 +43469,14 @@ const up$14 = async (db) => {
   `.execute(db);
 };
 /** The layout job is idempotent; rolling back only forgets it if it has not run yet. */
-const down$14 = async (db) => {
-	await sql`delete from jobs where idempotency_key = ${IDEMPOTENCY_KEY} and status = 'pending'`.execute(db);
+const down$17 = async (db) => {
+	await sql`delete from jobs where idempotency_key = ${IDEMPOTENCY_KEY$1} and status = 'pending'`.execute(db);
 };
 //#endregion
 //#region src/db/migrations/20261003140500_change_set_items_site_and_preview_entry.ts
 var _20261003140500_change_set_items_site_and_preview_entry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Sites, publishing (plan agentic-ecosystem §H, package G5).
@@ -43389,7 +43487,7 @@ var _20261003140500_change_set_items_site_and_preview_entry_exports = /* @__PURE
 * - `preview_tokens.entry_id` becomes required: a preview token previews one entry of one site. Model-wide
 *   tokens (short-lived by design) are deleted; whoever needs one opens the entry's preview again.
 */
-const up$13 = async (db) => {
+const up$16 = async (db) => {
 	await sql`alter table change_sets add constraint change_sets_id_site_uq unique (id, site_id)`.execute(db);
 	await sql`alter table change_set_items add column site_id uuid`.execute(db);
 	await sql`
@@ -43405,7 +43503,7 @@ const up$13 = async (db) => {
 	await sql`delete from preview_tokens where entry_id is null`.execute(db);
 	await sql`alter table preview_tokens alter column entry_id set not null`.execute(db);
 };
-const down$13 = async (db) => {
+const down$16 = async (db) => {
 	await sql`alter table preview_tokens alter column entry_id drop not null`.execute(db);
 	await sql`alter table change_set_items drop constraint change_set_items_entry_site_fk`.execute(db);
 	await sql`alter table change_set_items drop constraint change_set_items_set_site_fk`.execute(db);
@@ -43415,8 +43513,8 @@ const down$13 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003150000_widen_deployment_providers.ts
 var _20261003150000_widen_deployment_providers_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Deploy adapters (plan agentic-ecosystem §B2): deployment connections may use the Vercel and Netlify
@@ -43431,11 +43529,11 @@ const replaceCheck = async (db, check) => {
     check (${check}) not valid`.execute(db);
 	await sql`alter table deployment_connections validate constraint deployment_connections_provider_check`.execute(db);
 };
-const up$12 = async (db) => {
+const up$15 = async (db) => {
 	await replaceCheck(db, WIDENED);
 };
 /** Refuses while Vercel or Netlify connections exist: a down migration never deletes user data. */
-const down$12 = async (db) => {
+const down$15 = async (db) => {
 	const { rows } = await sql`
     select count(*)::text as count from deployment_connections where provider in ('vercel', 'netlify')
   `.execute(db);
@@ -43446,8 +43544,8 @@ const down$12 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003160000_create_assist_runs.ts
 var _20261003160000_create_assist_runs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Editor assists (plan agentic-ecosystem §A0, §I): one `assist_runs` row per assist request (who, which
@@ -43463,14 +43561,14 @@ const replaceSourceCheck = async (db, check) => {
 	await sql`alter table change_sets add constraint change_sets_source_check check (${check}) not valid`.execute(db);
 	await sql`alter table change_sets validate constraint change_sets_source_check`.execute(db);
 };
-const up$11 = async (db) => {
+const up$14 = async (db) => {
 	await db.schema.createTable("assist_runs").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("site_id", "uuid", (col) => col.notNull().references("sites.id").onDelete("cascade")).addColumn("actor_type", "text", (col) => col.notNull()).addColumn("actor_id", "text", (col) => col.notNull()).addColumn("action", "text", (col) => col.notNull().check(ACTIONS)).addColumn("rule", "text").addColumn("provider", "text", (col) => col.notNull()).addColumn("model", "text", (col) => col.notNull()).addColumn("input_tokens", "integer", (col) => col.notNull().defaultTo(0)).addColumn("output_tokens", "integer", (col) => col.notNull().defaultTo(0)).addColumn("duration_ms", "integer", (col) => col.notNull().defaultTo(0)).addColumn("status", "text", (col) => col.notNull().check(sql`status in ('queued', 'running', 'succeeded', 'failed')`)).addColumn("error_code", "text").addColumn("job_id", "uuid", (col) => col.references("jobs.id").onDelete("set null")).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("finished_at", "timestamptz").execute();
 	await db.schema.createIndex("assist_runs_site_created_idx").on("assist_runs").columns(["site_id", "created_at"]).execute();
 	await db.schema.createIndex("assist_runs_created_idx").on("assist_runs").column("created_at").execute();
 	await replaceSourceCheck(db, SOURCES_WIDENED);
 };
 /** Refuses while change sets opened by assist exist: a down migration never deletes user data. */
-const down$11 = async (db) => {
+const down$14 = async (db) => {
 	const { rows } = await sql`
     select count(*)::text as count from change_sets where source = 'assist'
   `.execute(db);
@@ -43482,8 +43580,8 @@ const down$11 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003170000_audit_events_seq.ts
 var _20261003170000_audit_events_seq_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * `audit_events.seq`: a monotonic tiebreaker after `occurred_at`, so events written in the same instant (one
@@ -43492,17 +43590,17 @@ var _20261003170000_audit_events_seq_exports$2 = /* @__PURE__ */ __exportAll({
 * are numbered in the order the rewrite reads them. No index: the audit queries filter and sort by
 * `occurred_at` first, and `seq` only breaks ties.
 */
-const up$10 = async (db) => {
+const up$13 = async (db) => {
 	await db.schema.alterTable("audit_events").addColumn("seq", "bigint", (col) => col.notNull().generatedAlwaysAsIdentity()).execute();
 };
-const down$10 = async (db) => {
+const down$13 = async (db) => {
 	await db.schema.alterTable("audit_events").dropColumn("seq").execute();
 };
 //#endregion
 //#region src/db/migrations/20261004120000_models_site_scope.ts
 var _20261004120000_models_site_scope_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * Per-site schema (plan site-schema): a definition belongs to one site (`models.site_id`) or is shared by every
@@ -43515,7 +43613,7 @@ var _20261004120000_models_site_scope_exports$2 = /* @__PURE__ */ __exportAll({
 * over `lower(api_key)` cannot hold. Share or delete them first; then `down` is lossless.
 */
 const NIL_UUID$1 = "00000000-0000-0000-0000-000000000000";
-const up$9 = async (db) => {
+const up$12 = async (db) => {
 	await sql`alter table models add column site_id uuid references sites (id)`.execute(db);
 	await sql`create index models_site_idx on models (site_id)`.execute(db);
 	await sql`drop index models_api_key_uq`.execute(db);
@@ -43525,7 +43623,7 @@ const up$9 = async (db) => {
   `.execute(db);
 	await sql`alter table schema_drafts add column shared boolean not null default false`.execute(db);
 };
-const down$9 = async (db) => {
+const down$12 = async (db) => {
 	const { rows } = await sql`select count(*)::text as count from models where site_id is not null`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 0) throw new Error("Cannot roll back per-site schema while definitions belong to a site: two sites may share an API ID. Share or delete the site definitions first.");
 	await sql`alter table schema_drafts drop column shared`.execute(db);
@@ -43537,8 +43635,8 @@ const down$9 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261004130000_site_seo_settings.ts
 var _20261004130000_site_seo_settings_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * SEO defaults per site (plan seo-fields): `sites.seo_defaults` holds the site's default texts per locale, its
@@ -43549,7 +43647,7 @@ var _20261004130000_site_seo_settings_exports$2 = /* @__PURE__ */ __exportAll({
 * about what a site publishes) gets it; the built-in owner and admin roles get it from `ensureSystemRoles`.
 * The permissions version moves only when grants changed, so running instances reload exactly then.
 */
-const up$8 = async (db) => {
+const up$11 = async (db) => {
 	await sql`alter table sites add column seo_defaults jsonb`.execute(db);
 	await sql`
     with granted as (
@@ -43564,7 +43662,7 @@ const up$8 = async (db) => {
     where exists (select 1 from granted)
   `.execute(db);
 };
-const down$8 = async (db) => {
+const down$11 = async (db) => {
 	await sql`
     with revoked as (
       delete from admin_role_permissions where action = 'site.settings' returning 1
@@ -43575,10 +43673,61 @@ const down$8 = async (db) => {
 	await sql`alter table sites drop column seo_defaults`.execute(db);
 };
 //#endregion
+//#region src/db/migrations/20261005120000_entry_heads_entry_created_at.ts
+var _20261005120000_entry_heads_entry_created_at_exports$2 = /* @__PURE__ */ __exportAll({
+	down: () => down$10,
+	up: () => up$10
+});
+/**
+* Delivery perf 2 (ADR 0001 amendment): the entry's `created_at` on each head (`entry_created_at`), so a list
+* in the default newest-first order walks `entry_heads_entry_order_idx` and stops at the page instead of
+* joining every matching head to `entries` and sorting them. `entries.created_at` never changes, and every head
+* insert copies it (repositories `entryHeads.insert`, `transferImport.insertHead`).
+*
+* The column is added nullable (a catalog-only change) and backfilled here in batches. The index is built
+* here on an empty table (a new install). With heads present it is built `CONCURRENTLY`, which cannot run
+* in a migration's transaction, by the `schema.entryOrderIndex` job this migration enqueues
+* (schema/planner/indexes.ts), so writes continue while it builds; queries are correct without it.
+*/
+const INDEX$2 = "entry_heads_entry_order_idx";
+const JOB_TYPE = "schema.entryOrderIndex";
+const IDEMPOTENCY_KEY = "schema.entryOrderIndex:v1";
+const BATCH$1 = 5e3;
+const up$10 = async (db) => {
+	await sql`alter table entry_heads add column entry_created_at timestamptz`.execute(db);
+	for (;;) {
+		const result = await sql`
+      update entry_heads h set entry_created_at = e.created_at
+      from entries e
+      where e.id = h.entry_id and (h.entry_id, h.locale, h.state) in (
+        select entry_id, locale, state from entry_heads where entry_created_at is null limit ${BATCH$1}
+      )
+    `.execute(db);
+		if (Number(result.numAffectedRows ?? 0n) < BATCH$1) break;
+	}
+	const { rows } = await sql`select exists (select 1 from entry_heads) as present`.execute(db);
+	if (rows[0]?.present) {
+		await sql`
+      insert into jobs (type, payload, max_attempts, idempotency_key)
+      values (${JOB_TYPE}, '{}'::jsonb, 5, ${IDEMPOTENCY_KEY})
+      on conflict do nothing
+    `.execute(db);
+		return;
+	}
+	await sql`
+    create index ${sql.id(INDEX$2)} on entry_heads (site_id, model_id, state, entry_created_at desc, entry_id)
+  `.execute(db);
+};
+const down$10 = async (db) => {
+	await sql`delete from jobs where idempotency_key = ${IDEMPOTENCY_KEY} and status = 'pending'`.execute(db);
+	await sql`drop index if exists ${sql.id(INDEX$2)}`.execute(db);
+	await sql`alter table entry_heads drop column entry_created_at`.execute(db);
+};
+//#endregion
 //#region src/db/migrations/mysql/0001_baseline.ts
 var _0001_baseline_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * MySQL baseline: Shapio's whole system schema as of PostgreSQL migration
@@ -44761,13 +44910,13 @@ const withoutForeignKeyChecks = async (db, statements) => db.connection().execut
 		await sql`set foreign_key_checks = 1`.execute(connection);
 	}
 });
-const up$7 = async (db) => withoutForeignKeyChecks(db, STATEMENTS$1);
-const down$7 = async (db) => withoutForeignKeyChecks(db, [...TABLES$1].reverse().map((table) => `drop table if exists \`${table}\``));
+const up$9 = async (db) => withoutForeignKeyChecks(db, STATEMENTS$1);
+const down$9 = async (db) => withoutForeignKeyChecks(db, [...TABLES$1].reverse().map((table) => `drop table if exists \`${table}\``));
 //#endregion
 //#region src/db/migrations/mysql/20261003170000_audit_events_seq.ts
 var _20261003170000_audit_events_seq_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * MySQL twin of `../20261003170000_audit_events_seq.ts`: `seq` is `AUTO_INCREMENT`, which InnoDB only allows
@@ -44775,26 +44924,26 @@ var _20261003170000_audit_events_seq_exports$1 = /* @__PURE__ */ __exportAll({
 * tiebreaker). Existing rows are numbered in primary-key order. `db/mysql/tables.ts` lists `seq` as the
 * table's identity, so an insert's emulated RETURNING finds its row by `LAST_INSERT_ID()`.
 */
-const up$6 = async (db) => {
+const up$8 = async (db) => {
 	await sql`alter table \`audit_events\`
     add column \`seq\` bigint not null auto_increment,
     add unique key \`audit_events_seq_key\` (\`seq\`)`.execute(db);
 };
-const down$6 = async (db) => {
+const down$8 = async (db) => {
 	await sql`alter table \`audit_events\` drop column \`seq\``.execute(db);
 };
 //#endregion
 //#region src/db/migrations/mysql/20261004120000_models_site_scope.ts
 var _20261004120000_models_site_scope_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * MySQL twin of `../20261004120000_models_site_scope.ts`. The per-scope API ID key uses functional key parts,
 * like the baseline: `coalesce(site_id, '')` for the scope (MySQL has no `NULLS NOT DISTINCT`) and the
 * case-folded API ID of live rows only (a deleted row's part is NULL, and NULLs never collide).
 */
-const up$5 = async (db) => {
+const up$7 = async (db) => {
 	await sql`alter table \`models\` add column \`site_id\` char(36) character set ascii collate ascii_general_ci`.execute(db);
 	await sql`create index \`models_site_idx\` on \`models\` (\`site_id\`)`.execute(db);
 	await sql`alter table \`models\` add constraint \`models_site_id_fkey\` foreign key (\`site_id\`) references \`sites\` (\`id\`)`.execute(db);
@@ -44803,7 +44952,7 @@ const up$5 = async (db) => {
     ((coalesce(\`site_id\`, '')), (case when (\`deleted_at\` IS NULL) then lower(\`api_key\`) end))`.execute(db);
 	await sql`alter table \`schema_drafts\` add column \`shared\` tinyint(1) not null default 0`.execute(db);
 };
-const down$5 = async (db) => {
+const down$7 = async (db) => {
 	const { rows } = await sql`select count(*) as count from \`models\` where \`site_id\` is not null`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 0) throw new Error("Cannot roll back per-site schema while definitions belong to a site: two sites may share an API ID. Share or delete the site definitions first.");
 	await sql`alter table \`schema_drafts\` drop column \`shared\``.execute(db);
@@ -44817,8 +44966,8 @@ const down$5 = async (db) => {
 //#endregion
 //#region src/db/migrations/mysql/20261004130000_site_seo_settings.ts
 var _20261004130000_site_seo_settings_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$6,
+	up: () => up$6
 });
 /**
 * MySQL twin of `../20261004130000_site_seo_settings.ts`. `insert ignore` stands in for `on conflict do
@@ -44826,7 +44975,7 @@ var _20261004130000_site_seo_settings_exports$1 = /* @__PURE__ */ __exportAll({
 */
 const bumpPermissionsVersion$1 = (db) => sql`update \`system_versions\` set \`permissions_version\` = \`permissions_version\` + 1,
     \`updated_at\` = current_timestamp(6)`.execute(db);
-const up$4 = async (db) => {
+const up$6 = async (db) => {
 	await sql`alter table \`sites\` add column \`seo_defaults\` json`.execute(db);
 	const granted = await sql`
     insert ignore into \`admin_role_permissions\` (\`id\`, \`role_id\`, \`action\`, \`model_id\`, \`condition\`, \`field_ids\`)
@@ -44836,24 +44985,53 @@ const up$4 = async (db) => {
   `.execute(db);
 	if (Number(granted.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion$1(db);
 };
-const down$4 = async (db) => {
+const down$6 = async (db) => {
 	const revoked = await sql`delete from \`admin_role_permissions\` where \`action\` = 'site.settings'`.execute(db);
 	if (Number(revoked.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion$1(db);
 	await sql`alter table \`sites\` drop column \`seo_defaults\``.execute(db);
 };
 //#endregion
+//#region src/db/migrations/mysql/20261005120000_entry_heads_entry_created_at.ts
+var _20261005120000_entry_heads_entry_created_at_exports$1 = /* @__PURE__ */ __exportAll({
+	down: () => down$5,
+	up: () => up$5
+});
+/**
+* MySQL twin of `../20261005120000_entry_heads_entry_created_at.ts`. The column is added `ALGORITHM=INSTANT`
+* and backfilled in batches; the index is built online (`ALGORITHM=INPLACE, LOCK=NONE`), so writes continue.
+* It is one more index of `entry_heads`, which is why `MYSQL_MAX_FIELD_INDEXES` (db/limits.ts) went down by one.
+*/
+const INDEX$1 = "entry_heads_entry_order_idx";
+const BATCH = 5e3;
+const up$5 = async (db) => {
+	await sql`alter table \`entry_heads\` add column \`entry_created_at\` datetime(6), algorithm=instant`.execute(db);
+	for (;;) {
+		const result = await sql`update \`entry_heads\` set \`entry_created_at\` = (
+      select e.\`created_at\` from \`entries\` e where e.\`id\` = \`entry_heads\`.\`entry_id\`
+    ) where \`entry_created_at\` is null limit ${sql.lit(BATCH)}`.execute(db);
+		if (Number(result.numAffectedRows ?? 0n) < BATCH) break;
+	}
+	await sql`create index ${sql.id(INDEX$1)} on \`entry_heads\`
+    (\`site_id\`, \`model_id\`, \`state\`, \`entry_created_at\` desc, \`entry_id\`) algorithm=inplace lock=none`.execute(db);
+};
+const down$5 = async (db) => {
+	await sql`drop index ${sql.id(INDEX$1)} on \`entry_heads\``.execute(db);
+	await sql`alter table \`entry_heads\` drop column \`entry_created_at\``.execute(db);
+};
+//#endregion
 //#region src/db/migrations/mysql/index.ts
 const MYSQL_MIGRATIONS = {
 	"0001_baseline": _0001_baseline_exports$1,
 	"20261003170000_audit_events_seq": _20261003170000_audit_events_seq_exports$1,
 	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports$1,
-	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports$1
+	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports$1,
+	"20261005120000_entry_heads_entry_created_at": _20261005120000_entry_heads_entry_created_at_exports$1
 };
 //#endregion
 //#region src/db/migrations/sqlite/0001_baseline.ts
 var _0001_baseline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$4,
+	up: () => up$4
 });
 /**
 * SQLite baseline: Shapio's whole system schema as of PostgreSQL migration
@@ -45998,18 +46176,18 @@ const TABLES = [
 	"assist_runs",
 	"sequences"
 ];
-const up$3 = async (db) => {
+const up$4 = async (db) => {
 	for (const statement of STATEMENTS) await sql.raw(statement).execute(db);
 };
-const down$3 = async (db) => {
+const down$4 = async (db) => {
 	await sql`pragma defer_foreign_keys = on`.execute(db);
 	for (const table of [...TABLES].reverse()) await sql.raw(`drop table if exists "${table}"`).execute(db);
 };
 //#endregion
 //#region src/db/migrations/sqlite/20261003170000_audit_events_seq.ts
 var _20261003170000_audit_events_seq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$3,
+	up: () => up$3
 });
 /**
 * SQLite twin of `../20261003170000_audit_events_seq.ts`. SQLite cannot add a column whose default calls a
@@ -46036,7 +46214,7 @@ const INDEXES = [
 	`create index "audit_events_occurred_at_idx" on "audit_events" (occurred_at DESC)`,
 	`create index "audit_events_target_idx" on "audit_events" (target_type, target_id, occurred_at DESC)`
 ];
-const up$2 = async (db) => {
+const up$3 = async (db) => {
 	await sql`insert into "sequences" (name, value) values ('audit_events_seq', 0)`.execute(db);
 	await sql`alter table "audit_events" rename to "audit_events_before_seq"`.execute(db);
 	await sql`create table "audit_events" (
@@ -46064,15 +46242,15 @@ const up$2 = async (db) => {
 	await sql`drop table "audit_events_before_seq"`.execute(db);
 	for (const statement of INDEXES) await sql.raw(statement).execute(db);
 };
-const down$2 = async (db) => {
+const down$3 = async (db) => {
 	await sql`alter table "audit_events" drop column "seq"`.execute(db);
 	await sql`delete from "sequences" where name = 'audit_events_seq'`.execute(db);
 };
 //#endregion
 //#region src/db/migrations/sqlite/20261004120000_models_site_scope.ts
 var _20261004120000_models_site_scope_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$2,
+	up: () => up$2
 });
 /**
 * SQLite twin of `../20261004120000_models_site_scope.ts`. `down` rebuilds `models` without `site_id`
@@ -46082,7 +46260,7 @@ var _20261004120000_models_site_scope_exports = /* @__PURE__ */ __exportAll({
 * deletes nothing they reference.
 */
 const NIL_UUID = "00000000-0000-0000-0000-000000000000";
-const up$1 = async (db) => {
+const up$2 = async (db) => {
 	await sql`alter table "models" add column "site_id" text_uuid references sites (id)`.execute(db);
 	await sql`create index "models_site_idx" on "models" (site_id)`.execute(db);
 	await sql`drop index "models_api_key_uq"`.execute(db);
@@ -46092,7 +46270,7 @@ const up$1 = async (db) => {
   `.execute(db);
 	await sql`alter table "schema_drafts" add column "shared" integer_boolean not null default 0`.execute(db);
 };
-const down$1 = async (db) => {
+const down$2 = async (db) => {
 	const { rows } = await sql`select count(*) as count from "models" where site_id is not null`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 0) throw new Error("Cannot roll back per-site schema while definitions belong to a site: two sites may share an API ID. Share or delete the site definitions first.");
 	await sql`alter table "schema_drafts" drop column "shared"`.execute(db);
@@ -46117,15 +46295,15 @@ const down$1 = async (db) => {
 //#endregion
 //#region src/db/migrations/sqlite/20261004130000_site_seo_settings.ts
 var _20261004130000_site_seo_settings_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$1,
+	up: () => up$1
 });
 /**
 * SQLite twin of `../20261004130000_site_seo_settings.ts`. `insert or ignore` stands in for `on conflict do
 * nothing` (the grant's unique index); the permissions version moves only when a grant was added or removed.
 */
 const bumpPermissionsVersion = (db) => sql`update "system_versions" set permissions_version = permissions_version + 1, updated_at = shapio_now()`.execute(db);
-const up = async (db) => {
+const up$1 = async (db) => {
 	await sql`alter table "sites" add column "seo_defaults" text_jsonb`.execute(db);
 	const granted = await sql`
     insert or ignore into "admin_role_permissions" (role_id, action, model_id, condition, field_ids)
@@ -46135,18 +46313,42 @@ const up = async (db) => {
   `.execute(db);
 	if (Number(granted.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion(db);
 };
-const down = async (db) => {
+const down$1 = async (db) => {
 	const revoked = await sql`delete from "admin_role_permissions" where action = 'site.settings'`.execute(db);
 	if (Number(revoked.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion(db);
 	await sql`alter table "sites" drop column "seo_defaults"`.execute(db);
 };
 //#endregion
+//#region src/db/migrations/sqlite/20261005120000_entry_heads_entry_created_at.ts
+var _20261005120000_entry_heads_entry_created_at_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* SQLite twin of `../20261005120000_entry_heads_entry_created_at.ts`. One process holds the write lock, so
+* the backfill is one statement and the index is built here (a plain `CREATE INDEX`; writers wait for it, the
+* documented single-process limitation of ADR 0001, "D2: as built").
+*/
+const INDEX = "entry_heads_entry_order_idx";
+const up = async (db) => {
+	await sql`alter table "entry_heads" add column "entry_created_at" text_timestamptz`.execute(db);
+	await sql`update "entry_heads" set entry_created_at = (
+    select e.created_at from "entries" e where e.id = "entry_heads".entry_id
+  ) where entry_created_at is null`.execute(db);
+	await sql`create index ${sql.id(INDEX)} on "entry_heads" (site_id, model_id, state, entry_created_at desc, entry_id)`.execute(db);
+};
+const down = async (db) => {
+	await sql`drop index if exists ${sql.id(INDEX)}`.execute(db);
+	await sql`alter table "entry_heads" drop column "entry_created_at"`.execute(db);
+};
+//#endregion
 //#region src/db/migrations/sqlite/index.ts
 const SQLITE_MIGRATIONS = {
 	"0001_baseline": _0001_baseline_exports,
 	"20261003170000_audit_events_seq": _20261003170000_audit_events_seq_exports,
 	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports,
-	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports
+	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports,
+	"20261005120000_entry_heads_entry_created_at": _20261005120000_entry_heads_entry_created_at_exports
 };
 //#endregion
 //#region src/db/migrations/index.ts
@@ -46178,7 +46380,8 @@ const MIGRATIONS = {
 	"20261003160000_create_assist_runs": _20261003160000_create_assist_runs_exports,
 	"20261003170000_audit_events_seq": _20261003170000_audit_events_seq_exports$2,
 	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports$2,
-	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports$2
+	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports$2,
+	"20261005120000_entry_heads_entry_created_at": _20261005120000_entry_heads_entry_created_at_exports$2
 };
 const PROVIDERS = {
 	postgres: { getMigrations: () => Promise.resolve({ ...MIGRATIONS }) },
@@ -49277,4 +49480,4 @@ const startDedicatedWorker = async (config) => {
 //#endregion
 export { toTypeName as $, update$8 as A, checkThemeContrast as B, BEFORE_EVENTS as C, listForAssets as D, buildEditorManifest as E, RESERVED_FIELD_API_KEYS as F, mergePulledLock as G, hashDefinition as H, RESERVED_TYPE_NAMES as I, schemaFilePath as J, parseDefinition as K, SCHEMA_KIND_DIRECTORIES as L, describeError as M, LOCK_FILE_PATH as N, listLiveByDriver as O, RESERVED_DEFINITION_API_KEYS as P, suggestPlural as Q, SITES_DIRECTORY as R, AFTER_EVENTS as S, EXTENSION_ROUTE_ROOT as T, lockCoversSite as U, foldApiKey as V, lockEntriesForSite as W, serializeDefinition as X, scopeDirectory as Y, serializeLockFile as Z, createLogger as _, loadConfig as a, createStableId as at, SITE_KEY_PATTERN as b, getPendingMigrations as c, sqliteDriverOf as ct, createMediaStorage as d, upgradeLockFile as et, createSite$1 as f, generateToken as g, SYSTEM_CLI_ACTOR as h, assertDatabaseReachable as i, SAFE_LINK_PATTERN as it, STORAGE_DRIVERS$1 as j, lockById$5 as k, migrateToLatest as l, createAdminDirect as m, startServer as n, withSiteCovered as nt, loadEnvFileIfPresent as o, validateRichText as ot, listAllSites as p, parseLockFile as q, copyObjectVerified as r, RICHTEXT_FORMAT as rt, buildApp as s, createDb as st, startDedicatedWorker as t, validateSchema as tt, SHAPIO_VERSION as u, createUrlBuilder as v, EXTENSION_JOB_PREFIX as w, loadProjectConfig as x, loopbackUrl as y, THEME_VARIANTS as z };
 
-//# sourceMappingURL=worker-i1rY2TIZ.js.map
+//# sourceMappingURL=worker-BDYDbaea.js.map