@shapio/cms 0.4.0 → 0.5.0

package/dist/{worker-i1rY2TIZ.js → worker-jz_0yAmS.js}

@@ -7,7 +7,6 @@ import Fastify, { LogController } from "fastify";
 import { AliasNode, AndNode, BinaryOperationNode, ColumnNode, ColumnUpdateNode, IdentifierNode, InsertQueryNode, Kysely, ListNode, MysqlAdapter, MysqlIntrospector, MysqlQueryCompiler, OnDuplicateKeyNode, OperationNodeTransformer, OperatorNode, OrNode, OrderByItemNode, ParensNode, PostgresDialect, PrimitiveValueListNode, RawNode, ReferenceNode, SelectAllNode, SelectModifierNode, SelectQueryNode, SelectionNode, SqliteAdapter, SqliteIntrospector, SqliteQueryCompiler, TableNode, UpdateQueryNode, ValueListNode, ValueNode, ValuesNode, WhereNode, sql } from "kysely";
 import pg from "pg";
 import { AsyncLocalStorage } from "node:async_hooks";
-import mysql from "mysql2";
 import { EventEmitter } from "node:events";
 import { DatabaseSync } from "node:sqlite";
 import { Type } from "typebox";
@@ -15,9 +14,6 @@ import { Value } from "typebox/value";
 import { isDeepStrictEqual } from "node:util";
 import { createJiti } from "jiti";
 import { pino } from "pino";
-import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
-import { createPresignedPost } from "@aws-sdk/s3-presigned-post";
-import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 import fp from "fastify-plugin";
 import { hash, verify } from "@node-rs/argon2";
 import cookie from "@fastify/cookie";
@@ -177,6 +173,20 @@ const sqliteLocationOfUrl = (url) => {
 		path
 	};
 };
+/** `host:port/database` (PostgreSQL, MySQL) or the file path (SQLite) from DATABASE_URL, never the credentials. */
+const describeDatabaseTarget = (connectionString) => {
+	if (dialectOfUrl(connectionString) === "sqlite") {
+		const location = sqliteLocationOfUrl(connectionString);
+		return location.kind === "memory" ? "an in-memory database" : location.path;
+	}
+	try {
+		const url = new URL(connectionString);
+		const defaultPort = dialectOfUrl(connectionString) === "mysql" ? "3306" : "5432";
+		return `${url.hostname}:${url.port || defaultPort}${url.pathname}`;
+	} catch {
+		return "the configured database";
+	}
+};
 let current;
 /** The dialect queries are built for. PostgreSQL until a database handle says otherwise. */
 const currentDialect = () => current ?? "postgres";
@@ -1084,13 +1094,15 @@ const MYSQL_TABLES = {
 			"change_seq",
 			"created_at",
 			"updated_at",
-			"site_id"
+			"site_id",
+			"entry_created_at"
 		],
-		nullable: ["autosaved_at"],
+		nullable: ["autosaved_at", "entry_created_at"],
 		timestamps: [
 			"autosaved_at",
 			"created_at",
-			"updated_at"
+			"updated_at",
+			"entry_created_at"
 		],
 		uniqueKeys: [{
 			name: "entry_heads_pkey",
@@ -1897,9 +1909,10 @@ const MYSQL_TABLES = {
 			"id",
 			"schema_version",
 			"permissions_version",
-			"updated_at"
+			"updated_at",
+			"release"
 		],
-		nullable: [],
+		nullable: ["release"],
 		timestamps: ["updated_at"],
 		uniqueKeys: [{
 			name: "system_versions_pkey",
@@ -2682,6 +2695,13 @@ const typeCast = (field, next) => {
 	return next();
 };
 //#endregion
+//#region src/db/mysql/module.ts
+/**
+* mysql2, loaded on first use. A process on PostgreSQL never loads it, and a bundle of the read path (the
+* in-process delivery runtime) can leave it out as an optional dependency.
+*/
+const loadMysql = async () => (await import("mysql2")).default;
+//#endregion
 //#region src/db/mysql/parameters.ts
 /**
 * Parameters the MySQL connection resolves itself just before a statement runs (ADR 0001, "MySQL").
@@ -2883,7 +2903,7 @@ var MysqlDriver = class {
 		this.databaseKey = mysqlDatabaseKey(options.url);
 	}
 	async init() {
-		const pool = mysql.createPool(mysqlPoolOptions(this.#options.url, this.#options.poolMax, this.#options.applicationName));
+		const pool = (await loadMysql()).createPool(mysqlPoolOptions(this.#options.url, this.#options.poolMax, this.#options.applicationName));
 		pool.on("connection", (connection) => {
 			connection.query(SESSION_SETUP, (error) => {
 				if (error) {
@@ -4590,6 +4610,8 @@ const countLiveByModel = (siteId, modelIds, executor = db) => modelIds.length ==
 * Pass the outer query's executor; the subquery is compiled into the outer statement.
 */
 const entrySiteOf = (executor, entryId) => executor.selectFrom("entries").select("entries.site_id").where("entries.id", "=", entryId);
+/** The entry's creation time, copied onto each head (`entry_heads.entry_created_at`, the default list order). */
+const entryCreatedAtOf = (executor, entryId) => executor.selectFrom("entries").select("entries.created_at").where("entries.id", "=", entryId);
 /**
 * Live entries of a model on sites other than `siteId`, per site (a definition can only move to one site
 * while no other site holds entries of it: plan site-schema, rule 2). Deleted ones do not count: once the
@@ -4704,6 +4726,7 @@ const findForEntry = (entryId, executor = db) => executor.selectFrom("entry_head
 const insert$28 = (head, trx = db) => trx.insertInto("entry_heads").values({
 	entry_id: head.entryId,
 	site_id: entrySiteOf(trx, head.entryId),
+	entry_created_at: entryCreatedAtOf(trx, head.entryId),
 	model_id: head.modelId,
 	locale: head.locale,
 	state: head.state,
@@ -6345,6 +6368,11 @@ const effectiveTitleField = (definition) => {
 };
 /** Title types that the document edits inline as its H1; any other title type stays a property. */
 const INLINE_TITLE_TYPES = /* @__PURE__ */ new Set(["string", "text"]);
+/**
+* The automatic rule: the fields written in the document while `display.canvasFieldIds` is unset (rich
+* text, dynamic zones, repeatable components, media with several files). Also what a canvas field can take
+* between blocks: only these hold blocks.
+*/
 const isCanvasEligible = (field) => {
 	switch (field.type) {
 		case "richtext":
@@ -6354,6 +6382,12 @@ const isCanvasEligible = (field) => {
 		default: return false;
 	}
 };
+/**
+* Whether `display.canvasFieldIds` may list the field: any field but the entry's title (`effectiveTitleField`),
+* which the document shows as its heading. A configured cover is refused by the validator; an automatically
+* chosen one placed in the document simply stops being the cover.
+*/
+const isDocumentPlaceable = (field, title) => field.id !== title?.id;
 /** A single `media` field that may hold an image. */
 const isCoverEligible = (field) => field.type === "media" && !field.settings.multiple && (field.settings.allowedKinds === void 0 || field.settings.allowedKinds.includes("image"));
 const byIds = (live, ids) => (ids ?? []).map((id) => live.find((field) => field.id === id)).filter((field) => field !== void 0);
@@ -6378,16 +6412,16 @@ const coverOf = (model, live, canvas) => {
 	return live.find((field) => isCoverEligible(field) && !canvas.has(field.id));
 };
 /**
-* The entry document's layout: title, cover, canvas blocks and properties. Configured `display` ids win
-* when they point at live, eligible fields; anything else falls back to the defaults (canvas: every
-* eligible field in field order; cover: the first single image field). Deprecated and ineligible ids are
-* skipped, so a stale definition never breaks the editor. Pure: no values, no I/O.
+* The entry document's layout: title, cover, document fields and properties. Configured `display` ids win
+* when they point at live, eligible fields; anything else falls back to the defaults (canvas: every block
+* field in field order; cover: the first single image field not in the canvas). Deprecated, unknown ids and
+* the title are skipped, so a stale definition never breaks the editor. Pure: no values, no I/O.
 */
 const effectiveLayout = (model) => {
 	const live = model.fields.filter((field) => !field.deprecated);
 	const title = effectiveTitleField(model);
 	const titleInline = title !== void 0 && INLINE_TITLE_TYPES.has(title.type);
-	const configuredCanvas = unique$1(byIds(live, model.display.canvasFieldIds).filter(isCanvasEligible));
+	const configuredCanvas = unique$1(byIds(live, model.display.canvasFieldIds).filter((field) => isDocumentPlaceable(field, title)));
 	const canvasCandidates = model.display.canvasFieldIds === void 0 ? live.filter(isCanvasEligible) : configuredCanvas;
 	const cover = coverOf(model, live, new Set(configuredCanvas.map((field) => field.id)));
 	const canvas = canvasCandidates.filter((field) => field.id !== cover?.id);
@@ -6974,17 +7008,18 @@ const checkFieldList = (ids, check) => {
 	});
 };
 /**
-* The entry document's layout (`effectiveLayout`): canvas blocks, cover and strip. Title, cover and canvas
-* are disjoint (title types are never canvas or cover types, so eligibility covers the title); strip
-* entries are properties, so never the cover or a canvas block.
+* The entry document's layout (`effectiveLayout`): document fields, cover and strip. Title, cover and
+* canvas are disjoint: any field but the title (configured or automatic) may be in the canvas, the
+* configured cover may not; strip entries are properties, so never the cover or a document field.
 */
 const checkDocumentLayout = (model, fields) => {
 	const { canvasFieldIds, coverFieldId, stripFieldIds } = model.display;
 	const canvas = new Set(canvasFieldIds ?? []);
+	const title = effectiveTitleField(model);
 	const issues = checkFieldList(canvasFieldIds, {
 		path: "/display/canvasFieldIds",
 		fields,
-		reject: (field) => isCanvasEligible(field) ? void 0 : canvasRejection(field)
+		reject: (field) => isDocumentPlaceable(field, title) ? void 0 : "the title is the heading of the document, not a field in it"
 	});
 	if (coverFieldId !== void 0) issues.push(...checkFieldList([coverFieldId], {
 		path: "/display/coverFieldId",
@@ -7001,11 +7036,6 @@ const checkDocumentLayout = (model, fields) => {
 	}));
 	return issues;
 };
-const canvasRejection = (field) => {
-	if (field.type === "component") return "only a repeatable component can be in the canvas";
-	if (field.type === "media") return "only a media field with several files can be in the canvas";
-	return `a ${field.type} field cannot be in the canvas`;
-};
 const checkDisplay = (definition) => {
 	const fields = new Map(definition.fields.map((field) => [field.id, field]));
 	const fieldIds = new Set(fields.keys());
@@ -9423,6 +9453,10 @@ const bumpSchemaVersion = async (trx, now) => {
 		updated_at: now
 	})).returning("schema_version").executeTakeFirstOrThrow()).schema_version;
 };
+/** Records the Shapio release this database is served by (in-process readers compare their own with it). */
+const setRelease = async (release, executor = db) => {
+	await executor.updateTable("system_versions").set({ release }).execute();
+};
 //#endregion
 //#region src/schema/snapshot.ts
 /**
@@ -12120,13 +12154,20 @@ const groupBindings = (rows) => {
 	return bindings;
 };
 const KNOWN_ACTIONS = /* @__PURE__ */ new Set([...CONTENT_ACTIONS, ...GLOBAL_ACTIONS]);
+const KNOWN_CONDITIONS = /* @__PURE__ */ new Set(["ownedByPrincipal"]);
+/**
+* A stored grant as this build understands it. Rows written by a newer Shapio may name an action or a row
+* condition this build does not know; they grant nothing here (fail closed). An unknown condition must never
+* read as "no condition", which would widen the grant to every row.
+*/
 const toGrant$1 = (row) => {
 	if (!KNOWN_ACTIONS.has(row.action)) return;
+	if (row.condition !== null && !KNOWN_CONDITIONS.has(row.condition)) return;
 	return {
 		roleId: row.role_id,
 		action: row.action,
 		modelId: row.model_id,
-		condition: row.condition === "ownedByPrincipal" ? "ownedByPrincipal" : null,
+		condition: row.condition,
 		fieldIds: row.field_ids
 	};
 };
@@ -12561,9 +12602,11 @@ const mysqlContentDialect = {
 	},
 	snapshotCte: ({ name, siteId, modelId, seq }) => sql`with ${sql.id(name)} as (
     select pl.entry_id, pl.site_id, pl.model_id, pl.locale, 'published' as state, r.data, 0 as version,
-      r.id as revision_id, pl.published_at as updated_at, null as autosaved_at
+      r.id as revision_id, pl.published_at as updated_at, null as autosaved_at,
+      en.created_at as entry_created_at
     from publication_log pl
     join content_revisions r on r.id = pl.revision_id
+    join entries en on en.id = pl.entry_id
     where pl.site_id = ${siteId} and pl.model_id = ${modelId}
       and pl.from_seq <= ${seq}
       and (pl.to_seq is null or pl.to_seq > ${seq})
@@ -12586,8 +12629,9 @@ const mysqlContentDialect = {
 //#region src/content/compiler/dialect/postgres.ts
 /**
 * PostgreSQL content SQL (ADR 0001): JSONB with a GIN `jsonb_path_ops` index serving containment, so
-* scalar equality is emitted as `data @> {...}`; ranges and sorts use per-field B-tree expression indexes
-* built `CONCURRENTLY` with a matching `CREATE STATISTICS` object.
+* equality on a field without an index is emitted as `data @> {...}`; ranges, sorts and equality on indexed
+* fields (filterable or sortable) use per-field B-tree expression indexes built `CONCURRENTLY` with a
+* matching `CREATE STATISTICS` object.
 */
 const DATA$1 = sql.ref(CONTENT_HEADS_COLUMNS.data);
 const ARRAY_TYPES = {
@@ -12639,6 +12683,10 @@ const postgresContentDialect = {
 	castParameter: castParameter$2,
 	fieldEquals: (target, value) => {
 		if (target.numericString && target.cast) return sql`(${fieldValue$2(target.fieldId, target.cast)} = ${castParameter$2(value, target.cast)})`;
+		if (target.indexed && target.cast) {
+			const expression = fieldValue$2(target.fieldId, target.cast);
+			return sql`(${expression} = ${castParameter$2(value, target.cast)} and ${expression} is not null)`;
+		}
 		return containment({ [target.fieldId]: target.list ? [value] : value });
 	},
 	fieldMissing: (fieldId) => {
@@ -12651,9 +12699,11 @@ const postgresContentDialect = {
 	sortDirection: (direction) => direction === "desc" ? sql`desc` : sql`asc`,
 	snapshotCte: ({ name, siteId, modelId, seq }) => sql`with ${sql.id(name)} as (
     select pl.entry_id, pl.site_id, pl.model_id, pl.locale, 'published'::text as state, r.data, 0 as version,
-      r.id as revision_id, pl.published_at as updated_at, null::timestamptz as autosaved_at
+      r.id as revision_id, pl.published_at as updated_at, null::timestamptz as autosaved_at,
+      en.created_at as entry_created_at
     from publication_log pl
     join content_revisions r on r.id = pl.revision_id
+    join entries en on en.id = pl.entry_id
     where pl.site_id = ${siteId}::uuid and pl.model_id = ${modelId}
       and pl.from_seq <= ${seq}::bigint
       and (pl.to_seq is null or pl.to_seq > ${seq}::bigint)
@@ -12742,9 +12792,11 @@ const DIALECTS = {
 		},
 		snapshotCte: ({ name, siteId, modelId, seq }) => sql`with ${sql.id(name)} as (
     select pl.entry_id, pl.site_id, pl.model_id, pl.locale, 'published' as state, r.data, 0 as version,
-      r.id as revision_id, pl.published_at as updated_at, null as autosaved_at
+      r.id as revision_id, pl.published_at as updated_at, null as autosaved_at,
+      en.created_at as entry_created_at
     from publication_log pl
     join content_revisions r on r.id = pl.revision_id
+    join entries en on en.id = pl.entry_id
     where pl.site_id = ${siteId} and pl.model_id = ${modelId}
       and pl.from_seq <= ${seq}
       and (pl.to_seq is null or pl.to_seq > ${seq})
@@ -13377,6 +13429,20 @@ const SITE_QUERY_PARAMETER = "site";
 * and the header that selects the site. CDNs that key on the URL only need `?site=` instead of the header.
 */
 const DELIVERY_VARY = "Authorization, Cookie, Shapio-Site";
+//#endregion
+//#region src/services/contentContext.ts
+/**
+* The content service context for one call, the same however the call arrived: the site's view of the pinned
+* schema (plan site-schema: shared definitions and the site's own), scoped to the site.
+*/
+const buildContentContext = ({ network, hooks, media, requestId, ip, ...rest }) => ({
+	...rest,
+	snapshot: network.forSite(rest.site.id),
+	hooks: hooks ?? createContentHooks(),
+	...media ? { media } : {},
+	...requestId !== void 0 ? { requestId } : {},
+	...ip !== void 0 ? { ip } : {}
+});
 const NUMERIC_TYPES = /* @__PURE__ */ new Set([
 	"number",
 	"integer",
@@ -13385,6 +13451,12 @@ const NUMERIC_TYPES = /* @__PURE__ */ new Set([
 ]);
 /** Numbers stored as JSON strings (exact decimals, big integers). */
 const NUMERIC_STRING_TYPES$1 = /* @__PURE__ */ new Set(["decimal", "biginteger"]);
+/**
+* Whether a field has a B-tree expression index: filterable or sortable, and not deprecated. The schema
+* planner builds an index for exactly these fields (`indexStepsOf`), and PostgreSQL equality compares on
+* the index expression for them (`EqualityTarget.indexed`).
+*/
+const hasFieldIndex = (field) => (field.filterable || field.sortable) && !field.deprecated;
 const valueCastFor = (type) => {
 	if (NUMERIC_TYPES.has(type)) return "numeric";
 	return type === "boolean" ? "boolean" : "text";
@@ -13408,8 +13480,9 @@ const fieldValueExpression = (fieldId, type, dialect = contentDialect()) => {
 	return dialect.fieldValue(fieldId, valueCastFor(type), NUMERIC_STRING_TYPES$1.has(type));
 };
 /**
-* Equality on a top-level field (lists: "contains"). PostgreSQL emits containment, which its GIN index
-* serves; SQLite compares the field's index expression.
+* Equality on a top-level field (lists: "contains"). PostgreSQL compares the field's index expression when
+* the field has one (`EqualityTarget.indexed`) and emits containment, which its GIN index serves, otherwise;
+* SQLite and MySQL compare the field's index expression.
 */
 const fieldEqualsExpression = (target, value, dialect = contentDialect()) => {
 	assertStableId(target.fieldId, "a field ID");
@@ -13750,17 +13823,32 @@ const RANGE_SQL = {
 	$ne: sql`<>`
 };
 const anyOf = (parts) => parts.length === 0 ? sql`false` : sql`(${sql.join(parts, sql` or `)})`;
-const equalityTarget = ({ field }) => ({
-	fieldId: field.id,
-	cast: SCALAR_DATA_TYPES.has(field.type) ? valueCastFor(field.type) : null,
-	list: isListValued(field),
-	numericString: NUMERIC_STRING_TYPES.has(field.type)
-});
+const equalityTarget = ({ field }) => {
+	const cast = SCALAR_DATA_TYPES.has(field.type) ? valueCastFor(field.type) : null;
+	const list = isListValued(field);
+	return {
+		fieldId: field.id,
+		cast,
+		list,
+		numericString: NUMERIC_STRING_TYPES.has(field.type),
+		indexed: cast !== null && !list && hasFieldIndex(field)
+	};
+};
+/** System filter columns. `createdAt` is the entry's, copied on every head (`h.entry_created_at`). */
 const SYSTEM_COLUMNS = {
 	id: "h.entry_id",
-	createdAt: "e.created_at",
+	createdAt: "h.entry_created_at",
 	updatedAt: "h.updated_at"
 };
+/** Whether a filter names a column of `entries` (the head query's `e`), so its COUNT must join entries. */
+const filterReadsEntries = (node) => {
+	switch (node.kind) {
+		case "and":
+		case "or": return node.nodes.some(filterReadsEntries);
+		case "not": return filterReadsEntries(node.node);
+		case "condition": return node.target.kind === "system" && SYSTEM_COLUMNS[node.target.name].startsWith("e.");
+	}
+};
 const systemCondition = (name, operator, value, dialect) => {
 	const column = sql.ref(SYSTEM_COLUMNS[name]);
 	const element = name === "id" ? "uuid" : "timestamp";
@@ -13862,20 +13950,13 @@ const whereOf = (plan, table, dialect) => {
 	return sql.join(conditions, sql` and `);
 };
 /**
-* The joined entry's site and model, which always equal the head's. Written out on the row query of a plain
-* list in `entries` order (the default newest-first sort) so the planner can walk `entries_model_idx` in that
-* order and stop at the page limit instead of sorting every head of the model. Not added when there are
-* conditions or the sort is on the head: SQLite then prefers the entries index over a field index that
-* serves the filter or the sort. Left off the COUNT, which reads every match either way.
-*/
-const entryScope = (plan, dialect) => plan.orderedByEntry === true && plan.conditions.length === 0 ? sql` and e.site_id = ${dialect.uuid(plan.siteId)} and e.model_id = ${modelIdLiteral(plan.modelId)}` : sql``;
-/**
 * The COUNT's FROM. Live heads exist only for live entries (deleting an entry removes its heads in the same
-* transaction; entries soft-deleted for having no head have none), so a count of heads with no condition
-* (conditions may name `e` columns) needs no join: it is read from `entry_heads_model_locale_state_idx`
-* alone. A snapshot keeps the join: the publication log still lists entries deleted since.
+* transaction; entries soft-deleted for having no head have none; `headLiveEntry.int.test.ts` pins it), so a
+* count of heads whose conditions name no `e` column needs no join: it is read from the heads' indexes alone
+* (the model index, or a field index for an indexed filter). A snapshot keeps the join: the publication log
+* still lists entries deleted since.
 */
-const countFrom = (plan, table, where, joined) => plan.source.kind === "heads" && plan.conditions.length === 0 ? sql`from ${table} h where ${where}` : joined;
+const countFrom = (plan, table, where, joined) => plan.source.kind === "heads" && !(plan.conditionsReadEntries ?? plan.conditions.length > 0) ? sql`from ${table} h where ${where}` : joined;
 const HEAD_COLUMNS$1 = sql`h.entry_id, h.locale, h.data, h.version, h.revision_id, h.updated_at,
       h.autosaved_at, e.created_at, e.updated_at as entry_updated_at, e.created_by_admin_id, e.owner_app_user_id`;
 /** The parts every statement over a plan's heads shares. */
@@ -13888,7 +13969,7 @@ const headQueryParts = (plan, dialect) => {
 	const offset = plan.offset ? sql` offset ${plan.offset}` : sql``;
 	return {
 		prefix: cte ?? sql``,
-		rows: sql`${from}${entryScope(plan, dialect)}${orderBy}${limit}${offset}`,
+		rows: sql`${from}${orderBy}${limit}${offset}`,
 		countFrom: countFrom(plan, table, where, from)
 	};
 };
@@ -14219,13 +14300,15 @@ const parseContentQuery = (tree, context) => {
 /**
 * ORDER BY for a content query. Field sorts use the same expression as the field's index (so the index can
 * serve them); the entry ID is always the final tie-breaker so pages are stable. Without an explicit sort
-* the model's default sort applies when the caller may read that field, else newest first. The tie-breaker is
-* spelled `e.id` (equal to `h.entry_id` by the join) so that, on an unfiltered list in `created_at` order,
-* every ORDER BY term is on `entries` and MySQL sorts only the model's entries before joining their heads.
+* the model's default sort applies when the caller may read that field, else newest first. `createdAt` is the
+* entry's creation time copied on the head (`h.entry_created_at`), so the default order and its tie-breaker
+* are both head columns, which `entry_heads_entry_order_idx` (site, model, state, `entry_created_at desc`,
+* `entry_id`) serves: a page is read in index order and the scan stops at the limit (ADR 0001, "Delivery perf
+* 2").
 */
 const SYSTEM_SORT_COLUMNS = {
 	id: "h.entry_id",
-	createdAt: "e.created_at",
+	createdAt: "h.entry_created_at",
 	updatedAt: "h.updated_at"
 };
 const termSql = (term, dialect) => {
@@ -14252,9 +14335,7 @@ const defaultSortTerms = (model, isReadable) => {
 		direction: "desc"
 	}];
 };
-/** Whether the first sort term is a column of `entries` (the head query's `e`), not of the head. */
-const leadsWithEntryColumn = (terms) => terms[0]?.target.kind === "system" && SYSTEM_SORT_COLUMNS[terms[0].target.name].startsWith("e.");
-const compileOrderBy = (terms, dialect = contentDialect()) => [...terms.map((term) => termSql(term, dialect)), sql`e.id asc`];
+const compileOrderBy = (terms, dialect = contentDialect()) => [...terms.map((term) => termSql(term, dialect)), sql`h.entry_id asc`];
 //#endregion
 //#region src/content/errors.ts
 /** Errors the content services throw; the central error handler renders them. */
@@ -14524,8 +14605,10 @@ const needsFollowUpReads = (env, model, rows, query, policy) => {
 	if (query.populate.size > 0) return true;
 	const fields = selectFields(model, policy.readMask, query.fields);
 	const documents = rows.map((row) => row.data);
-	return env.audience === "delivery" && targetsByModel(model, documents, fields).size > 0 || env.media !== void 0 && (mediaIdsOf(model, documents, fields).size > 0 || seoImageIdOf(env, fields) !== void 0);
+	return env.audience === "delivery" && targetsByModel(model, documents, fields).size > 0 || needsMediaReads(env, model, rows, fields);
 };
+/** Whether projecting these rows reads asset views (media fields, rich-text images, a default SEO image). */
+const needsMediaReads = (env, model, rows, fields) => env.media !== void 0 && (mediaIdsOf(model, rows.map((row) => row.data), fields).size > 0 || seoImageIdOf(env, fields) !== void 0);
 /** The site's default social image a `?seo=resolved` read needs (when the response carries an SEO field). */
 const seoImageIdOf = (env, fields) => env.seo?.imageId && seoFieldsOf(fields).length > 0 ? env.seo.imageId : void 0;
 /** A default SEO image is shown only while it is a public image (never through a signed URL). */
@@ -14808,6 +14891,8 @@ const getAdminEntry = async (context, modelKey, id, locale) => {
 	return buildAdminEntryView(context, model, policy, entry, locale);
 };
 /** Filters, search and row filter of a parsed query as SQL conditions. */
+/** Whether `queryConditions` names an `entries` column (`HeadQueryPlan.conditionsReadEntries`). */
+const queryReadsEntries = (query, policy) => query.filter !== null && filterReadsEntries(query.filter) || query.author !== void 0 || policy.rowFilter !== null;
 const queryConditions = (context, query, policy) => {
 	const rowFilter = compileRowFilter(policy.rowFilter, context.actor);
 	return [
@@ -14846,8 +14931,8 @@ const listAdminEntries = async (context, modelKey, rawQuery) => {
 		},
 		locales: readScopeFor(context.snapshot, model.definition, query.locale, { fallback: true }),
 		conditions: queryConditions(context, query, policy),
+		conditionsReadEntries: queryReadsEntries(query, policy),
 		orderBy: compileOrderBy(sort),
-		orderedByEntry: leadsWithEntryColumn(sort),
 		limit,
 		offset
 	});
@@ -14925,13 +15010,12 @@ const SYSTEM_PRINCIPAL = {
 	kind: "system",
 	component: EXTENSION_SYSTEM_COMPONENT
 };
-const contentContext = async (environment, site, principal) => ({
+const contentContext = async (environment, site, principal) => buildContentContext({
 	db: environment.db,
-	snapshot: (await environment.registry.getSnapshot()).forSite(site.id),
+	network: await environment.registry.getSnapshot(),
 	permissions: environment.permissions,
 	actor: principal ?? SYSTEM_PRINCIPAL,
-	site,
-	hooks: createContentHooks()
+	site
 });
 const toReadEntry = (view) => ({
 	id: view.id,
@@ -15216,157 +15300,6 @@ const createLoggerOptions = (config) => ({
 });
 const createLogger = (config) => pino(createLoggerOptions(config));
 //#endregion
-//#region src/media/contentDisposition.ts
-/**
-* A Content-Disposition value that names the file safely: an ASCII fallback plus the RFC 5987 UTF-8 form,
-* so quotes, semicolons or line breaks in a filename can never inject header parameters.
-*/
-const contentDisposition = (filename, type = "inline") => {
-	return `${type}; filename="${filename.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_")}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
-};
-/** Types a browser only ever displays passively: opening one directly cannot run script. */
-const PASSIVE_INLINE_TYPE = /^(image\/(png|jpeg|gif|webp|avif|bmp|tiff|x-icon|vnd\.microsoft\.icon)|video\/.+|audio\/.+)$/;
-/**
-* Content-Disposition to store on an object in a bucket. Public objects can be served straight from the
-* bucket or a CDN, where Shapio's sandboxing headers are absent; anything that could run as a page there
-* (SVG, HTML, XML, PDF...) is stored as an attachment, so opening it downloads it. `<img>` tags still show
-* an SVG, since embedding ignores Content-Disposition.
-*/
-const bucketContentDisposition = (contentType) => PASSIVE_INLINE_TYPE.test(contentType.toLowerCase()) ? void 0 : "attachment";
-//#endregion
-//#region src/media/errors.ts
-/** Thrown by adapters when a key has no object, so callers can tell "missing" from "storage is down". */
-var ObjectNotFoundError = class extends Error {
-	constructor(key, options) {
-		super(`No stored object at ${key}`, options);
-		this.name = "ObjectNotFoundError";
-	}
-};
-var InvalidStorageKeyError = class extends Error {
-	constructor(key) {
-		super(`Not a valid media storage key: ${JSON.stringify(key)}`);
-		this.name = "InvalidStorageKeyError";
-	}
-};
-//#endregion
-//#region src/media/s3Adapter.ts
-/** R2 accepts any region name ("auto" by convention); AWS needs the bucket's real region. */
-const DEFAULT_REGION = "us-east-1";
-const isNotFound$2 = (error) => error instanceof S3ServiceException && (error.$metadata.httpStatusCode === 404 || error.name === "NotFound" || error.name === "NoSuchKey");
-const createS3Client = (config) => new S3Client({
-	region: config.region ?? DEFAULT_REGION,
-	...config.endpoint ? { endpoint: config.endpoint } : {},
-	forcePathStyle: config.forcePathStyle,
-	...config.accessKeyId && config.secretAccessKey ? { credentials: {
-		accessKeyId: config.accessKeyId,
-		secretAccessKey: config.secretAccessKey
-	} } : {},
-	requestChecksumCalculation: "WHEN_REQUIRED",
-	responseChecksumValidation: "WHEN_REQUIRED"
-});
-/**
-* Any S3-compatible service (AWS S3, Cloudflare R2, B2, Spaces, Wasabi, versitygw). Private objects are read
-* through presigned GET URLs; browsers upload straight to the bucket with a presigned POST whose policy
-* limits size and content type, so Shapio never streams upload bytes.
-*/
-const createS3Adapter = ({ config, publicBaseUrl, client }) => {
-	const s3 = client ?? createS3Client(config);
-	const Bucket = config.bucket;
-	const checkKey = (key) => {
-		if (!isValidStorageKey(key)) throw new InvalidStorageKeyError(key);
-		return key;
-	};
-	const head = async (key) => {
-		try {
-			const result = await s3.send(new HeadObjectCommand({
-				Bucket,
-				Key: checkKey(key)
-			}));
-			return {
-				size: result.ContentLength ?? 0,
-				contentType: result.ContentType
-			};
-		} catch (error) {
-			if (isNotFound$2(error)) return;
-			throw error;
-		}
-	};
-	return {
-		driver: "s3",
-		put: async (key, body, { contentType, contentLength }) => {
-			await s3.send(new PutObjectCommand({
-				Bucket,
-				Key: checkKey(key),
-				Body: body,
-				ContentType: contentType,
-				ContentLength: Buffer.isBuffer(body) ? body.length : contentLength,
-				ContentDisposition: bucketContentDisposition(contentType)
-			}));
-		},
-		getStream: async (key, range) => {
-			try {
-				const result = await s3.send(new GetObjectCommand({
-					Bucket,
-					Key: checkKey(key),
-					...range ? { Range: `bytes=${range.start}-${range.end}` } : {}
-				}));
-				if (!result.Body) throw new ObjectNotFoundError(key);
-				return result.Body;
-			} catch (error) {
-				throw isNotFound$2(error) ? new ObjectNotFoundError(key, { cause: error }) : error;
-			}
-		},
-		head,
-		exists: async (key) => await head(key) !== void 0,
-		delete: async (key) => {
-			await s3.send(new DeleteObjectCommand({
-				Bucket,
-				Key: checkKey(key)
-			}));
-		},
-		signedGetUrl: async (key, { expiresInSeconds, filename, contentType }) => getSignedUrl(s3, new GetObjectCommand({
-			Bucket,
-			Key: checkKey(key),
-			ResponseContentType: contentType,
-			ResponseContentDisposition: contentDisposition(filename)
-		}), { expiresIn: expiresInSeconds }),
-		publicUrl: (key) => publicBaseUrl ? `${publicBaseUrl}/${encodeKeyPath(checkKey(key))}` : void 0,
-		presignedUpload: async ({ key, contentType, maxSizeBytes, expiresInSeconds }) => {
-			const disposition = bucketContentDisposition(contentType);
-			const { url, fields } = await createPresignedPost(s3, {
-				Bucket,
-				Key: checkKey(key),
-				Conditions: [
-					[
-						"content-length-range",
-						1,
-						maxSizeBytes
-					],
-					[
-						"eq",
-						"$Content-Type",
-						contentType
-					],
-					...disposition ? [[
-						"eq",
-						"$Content-Disposition",
-						disposition
-					]] : []
-				],
-				Fields: {
-					"Content-Type": contentType,
-					...disposition ? { "Content-Disposition": disposition } : {}
-				},
-				Expires: expiresInSeconds
-			});
-			return {
-				url,
-				fields
-			};
-		}
-	};
-};
-//#endregion
 //#region src/media/origins.ts
 const SAMPLE_KEY = "public/00000000-0000-0000-0000-000000000000/sample/origin-probe";
 const originOf = (url) => {
@@ -15387,6 +15320,7 @@ const resolveMediaOrigins = async (storage) => {
 	const base = originOf(storage.publicBaseUrl);
 	if (base) origins.add(base);
 	if (storage.s3) {
+		const { createS3Adapter } = await import("./s3Adapter-C8AgFVYw.js");
 		const adapter = createS3Adapter({
 			config: storage.s3,
 			publicBaseUrl: void 0
@@ -16044,7 +15978,42 @@ const memoizePermissions = (base, principal) => {
 	};
 };
 //#endregion
+//#region src/permissions/scoped.ts
+const isLazy = (versions) => "read" in versions;
+/**
+* The evaluator at the scope's versions. Inside a transaction before a lazy scope read its versions, the
+* unbound evaluator checks the versions itself through the transaction, so no pooled connection is asked
+* for while the transaction holds one.
+*/
+const boundEvaluator = async (base, versions, executor) => {
+	if (!isLazy(versions)) return base.atVersions?.(versions) ?? base;
+	if (executor && !versions.isRead()) return base;
+	return base.atVersions?.(await versions.read()) ?? base;
+};
+/**
+* One scope's evaluator (an HTTP request, an in-process delivery call): checked against the scope's durable
+* versions (ADR 0005: a revoke applies from the next scope, not mid-scope) and memoized per (principal, action,
+* model) for the scope (`memo.ts`).
+*/
+const scopePermissions = (base, principal, versions) => memoizePermissions({
+	evaluate: async (caller, policyRequest, executor) => (await boundEvaluator(base, versions, executor)).evaluate(caller, policyRequest, executor),
+	canPerform: async (caller, action, executor) => (await boundEvaluator(base, versions, executor)).canPerform(caller, action, executor),
+	canPerformOnSite: async (caller, action, siteId, executor) => (await boundEvaluator(base, versions, executor)).canPerformOnSite(caller, action, siteId, executor)
+}, principal);
+//#endregion
+//#region src/constants/delivery.ts
+/** `system_settings` key of the delivery descriptor the server writes at start (services/deliveryDescriptor.ts). */
+const DELIVERY_DESCRIPTOR_SETTING = "delivery_descriptor";
+//#endregion
 //#region src/repositories/requestState.ts
+/** The site a lookup names, joined to the one `system_versions` row (at most one row matches). */
+const siteJoin = (join, lookup) => {
+	switch (lookup.by) {
+		case "id": return join.on("sites.id", "=", lookup.id);
+		case "key": return join.on("sites.key", "=", lookup.key);
+		case "primary": return join.on("sites.is_primary", "=", true);
+	}
+};
 /**
 * Everything a request checks before its work, in one statement: the durable schema and permissions versions
 * (`system_versions`, one row) and, when asked, the request's site. Read once per request on the pool, before
@@ -16059,13 +16028,7 @@ const read = async (lookup, trx = db) => {
 			site: void 0
 		};
 	}
-	const row = await trx.selectFrom("system_versions").leftJoin("sites", (join) => {
-		switch (lookup.by) {
-			case "id": return join.on("sites.id", "=", lookup.id);
-			case "key": return join.on("sites.key", "=", lookup.key);
-			case "primary": return join.on("sites.is_primary", "=", true);
-		}
-	}).select([
+	const row = await trx.selectFrom("system_versions").leftJoin("sites", (join) => siteJoin(join, lookup)).select([
 		"system_versions.schema_version",
 		"system_versions.permissions_version",
 		"sites.id as site_id",
@@ -16108,27 +16071,15 @@ const getRequestState = (request, lookup) => {
 /** Reads the request's site with its state, or on its own when the state was already read without it. */
 const readRequestSite = async (request, lookup) => request.requestState ? findSite(lookup) : (await getRequestState(request, lookup)).site;
 /**
-* The server's evaluator at the request's versions. Inside a transaction before the state was read (no route
-* does that today), the unbound evaluator checks the versions itself through the transaction, so no pooled
-* connection is asked for while the transaction holds one.
-*/
-const boundPermissions = async (request, executor) => {
-	const base = request.server.permissions;
-	if (executor && !request.requestState) return base;
-	const { versions } = await getRequestState(request);
-	return base.atVersions?.(versions) ?? base;
-};
-/**
 * The request's evaluator: checked against the request's versions, and memoized per (principal, action,
 * model) for the request (`permissions/memo.ts`), for REST as for GraphQL. Create it after site resolution,
 * which settles the principal.
 */
 const getRequestPermissions = (request) => {
-	request.requestPermissions ??= memoizePermissions({
-		evaluate: async (principal, policyRequest, executor) => (await boundPermissions(request, executor)).evaluate(principal, policyRequest, executor),
-		canPerform: async (principal, action, executor) => (await boundPermissions(request, executor)).canPerform(principal, action, executor),
-		canPerformOnSite: async (principal, action, siteId, executor) => (await boundPermissions(request, executor)).canPerformOnSite(principal, action, siteId, executor)
-	}, request.principal);
+	request.requestPermissions ??= scopePermissions(request.server.permissions, request.principal, {
+		read: async () => (await getRequestState(request)).versions,
+		isRead: () => request.requestState !== null
+	});
 	return request.requestPermissions;
 };
 //#endregion
@@ -16371,12 +16322,14 @@ const revokeApiToken = async (context, permissions, id) => {
 		});
 	});
 };
+/** Whether a token with this expiry has expired at `now`. */
+const isTokenExpired = (expiresAt, now) => expiresAt !== null && expiresAt.getTime() <= now.getTime();
 /** The principal for a bearer API token, or undefined when unknown, revoked or expired. */
-const resolveApiToken = async (value, now = /* @__PURE__ */ new Date()) => {
-	const row = await findLiveByHash$1(hashToken(value));
-	if (!row || row.expires_at !== null && row.expires_at.getTime() <= now.getTime()) return;
+const resolveApiToken = async (value, now = /* @__PURE__ */ new Date(), { recordUse = true, executor = db } = {}) => {
+	const row = await findLiveByHash$1(hashToken(value), executor);
+	if (!row || isTokenExpired(row.expires_at, now)) return;
 	const staleBefore = /* @__PURE__ */ new Date(now.getTime() - LAST_SEEN_WRITE_INTERVAL_MS);
-	if (row.last_used_at === null || row.last_used_at.getTime() < staleBefore.getTime()) await touchLastUsed$1(row.id, now, staleBefore);
+	if (recordUse && (row.last_used_at === null || row.last_used_at.getTime() < staleBefore.getTime())) await touchLastUsed$1(row.id, now, staleBefore, executor);
 	return {
 		kind: "token",
 		tokenId: row.id,
@@ -17548,7 +17501,7 @@ const editorManifestPlugin = fp(async (app, { manifest }) => {
 	app.decorate("editorManifest", manifest);
 }, { name: "shapio-editor-manifest" });
 //#endregion
-//#region src/plugins/errorHandler.ts
+//#region src/helpers/errorResponse.ts
 const STATUS_CODES = {
 	400: "BAD_REQUEST",
 	401: "UNAUTHORIZED",
@@ -17565,6 +17518,10 @@ const STATUS_CODES = {
 };
 /** Errors raised by @fastify/csrf-protection (plugins/csrf.ts). */
 const CSRF_ERROR_CODES$1 = /* @__PURE__ */ new Set(["FST_CSRF_INVALID_TOKEN", "FST_CSRF_MISSING_SECRET"]);
+/**
+* The one error shape every endpoint returns, `{ error: { code, message, details? } }`, and its status.
+* Server errors (5xx) never carry their internal text; the caller logs the original error.
+*/
 const toErrorResponse = (error) => {
 	if (error instanceof AppError) {
 		const body = { error: {
@@ -17577,7 +17534,7 @@ const toErrorResponse = (error) => {
 			body
 		};
 	}
-	if (CSRF_ERROR_CODES$1.has(error.code)) return {
+	if (error.code !== void 0 && CSRF_ERROR_CODES$1.has(error.code)) return {
 		statusCode: 403,
 		body: { error: {
 			code: "CSRF_INVALID",
@@ -17612,6 +17569,8 @@ const toErrorResponse = (error) => {
 		} }
 	};
 };
+//#endregion
+//#region src/plugins/errorHandler.ts
 /** The single error handler: consistent `{ error: { code, message, details? } }` bodies and logging. */
 const errorHandlerPlugin = fp(async (app) => {
 	app.decorateRequest("errorCode", void 0);
@@ -18181,6 +18140,14 @@ const createMysqlNotificationListener = (options) => {
 		});
 	};
 	const connect = async () => {
+		if (closed) return;
+		let mysql;
+		try {
+			mysql = await loadMysql();
+		} catch (error) {
+			log.error({ err: error }, "mysql2 could not be loaded; notifications are off");
+			return;
+		}
 		if (closed) return;
 		const current = mysql.createConnection(mysqlPoolOptions(connectionString, 1, options.applicationName ?? "shapio-listen"));
 		connection = current;
@@ -18693,7 +18660,8 @@ const getDeliverySite$1 = async (context) => {
 * delivery-perf). The heads, the page total and the site's publication sequence come from one statement, so
 * a read that needs nothing else (no relation, populate or asset follow-up) runs without a transaction.
 * Anything that needs a follow-up statement runs in one REPEATABLE READ, read-only transaction, so every
-* statement of the response sees the moment `meta.snapshot` names.
+* statement of the response sees the moment `meta.snapshot` names, except a live published read whose only
+* follow-up is relation visibility: that runs on the pool (`readConsistently` explains why it is safe).
 */
 const deliveryEnvironment = (context, executor, source, locale, richText, seo) => ({
 	executor,
@@ -18715,6 +18683,11 @@ const environmentOf = (read, executor) => deliveryEnvironment(read.context, exec
 */
 const followsUp = (read) => read.query.populate.size > 0 || selectFields(read.model, read.policy.readMask, read.query.fields).some((field) => field.type === "relation" || field.type === "media" || Boolean(read.seo?.imageId) && isSeoField(field));
 /**
+* A live read of published heads (no `?snapshot`, not a preview or draft read, no extra conditions) without
+* populate: its only possible follow-up is relation visibility (asset views are checked on the rows).
+*/
+const isLiveVisibilityRead = (read) => read.source.kind === "heads" && read.source.state === "published" && read.query.populate.size === 0 && (read.conditions?.length ?? 0) === 0;
+/**
 * Loads the site's SEO defaults when the query asks for resolved SEO. Read before the heads, outside their
 * consistent moment: defaults are not part of a snapshot (`?snapshot=N&seo=resolved` uses today's).
 */
@@ -18729,20 +18702,29 @@ const seqOf = (seq) => {
 /**
 * Runs the plan's statement on the pool when the read cannot need a follow-up, and keeps that result when
 * the rows indeed need none; otherwise reads again inside one REPEATABLE READ transaction. `finish` projects
-* the rows (through the same executor), so its own statements see the same moment.
+* the rows (through the same executor), so its own statements see the same moment. A live published read
+* whose only follow-up is relation visibility also stays on the pool (see below).
 */
 const readConsistently = async (read, plan, options, finish) => {
 	const compiled = compileHeadPage(plan, options);
 	const { db } = read.context;
-	if (!followsUp(read)) {
+	const live = isLiveVisibilityRead(read);
+	if (!followsUp(read) || live) {
 		const env = environmentOf(read, db);
 		const { rows, meta } = await runHeadPage(compiled.rows, db);
+		const fields = selectFields(read.model, read.policy.readMask, read.query.fields);
 		if (meta && !needsFollowUpReads(env, read.model, rows, read.query, read.policy)) return finish({
 			env,
 			rows,
 			total: meta.total,
 			seq: seqOf(meta.seq)
 		});
+		if (meta && live && !needsMediaReads(env, read.model, rows, fields)) return finish({
+			env,
+			rows,
+			total: meta.total,
+			seq: seqOf(meta.seq)
+		});
 	}
 	return withConsistentRead(async (trx) => {
 		const env = environmentOf(read, trx);
@@ -18776,8 +18758,8 @@ const readEntryPage = async (unloaded, options = { total: true }) => {
 		source: read.source,
 		locales: localesOf(read),
 		conditions: [...queryConditions(context, query, policy), ...read.conditions ?? []],
+		conditionsReadEntries: queryReadsEntries(query, policy) || (read.conditions?.length ?? 0) > 0,
 		orderBy: compileOrderBy(sort),
-		orderedByEntry: leadsWithEntryColumn(sort),
 		limit,
 		offset
 	};
@@ -18923,6 +18905,45 @@ const createLoaders = (siteId, content) => {
 	};
 };
 //#endregion
+//#region src/schema/codegen/graphql/requestContext.ts
+/**
+* The context every resolver of one operation receives, with its own DataLoaders. Carries no HTTP objects, so
+* an operation can run outside a request.
+*/
+const createGraphqlContext = ({ site, permissions, isAdmin, content }) => {
+	let base;
+	const contentAt = async (snapshot) => {
+		base ??= content(snapshot);
+		return {
+			...await base,
+			snapshot,
+			permissions
+		};
+	};
+	return {
+		permissions,
+		isAdmin,
+		site,
+		loaders: createLoaders(() => site.id, contentAt),
+		content: contentAt
+	};
+};
+//#endregion
+//#region src/helpers/siteQuery.ts
+const isSiteSegment = (segment) => {
+	const key = segment.split("=", 1)[0] ?? "";
+	try {
+		return decodeURIComponent(key.replace(/\+/g, " ")) === SITE_QUERY_PARAMETER;
+	} catch {
+		return false;
+	}
+};
+/**
+* A raw querystring (without `?`) without its `site` parameter: site resolution consumes it, and the content
+* compiler refuses unknown keys. The rest is left exactly as sent (bracket syntax is the compiler's to parse).
+*/
+const withoutSiteParameter = (rawQuery) => rawQuery.split("&").filter((segment) => !isSiteSegment(segment)).join("&");
+//#endregion
 //#region src/controllers/contentContext.ts
 /**
 * The service context for a content request: the pinned snapshot, the principal and dependencies.
@@ -18930,9 +18951,9 @@ const createLoaders = (siteId, content) => {
 * memoized per (principal, action, model), so the read, relation visibility, populate and usage recording
 * evaluate each model's policy once.
 */
-const contentContextFor = async (request) => ({
+const contentContextFor = async (request) => buildContentContext({
 	db: request.server.db,
-	snapshot: await getRequestSchema(request),
+	network: await getRequestNetworkSchema(request),
 	permissions: getRequestPermissions(request),
 	actor: request.principal,
 	site: getRequestSite(request),
@@ -18944,14 +18965,6 @@ const contentContextFor = async (request) => ({
 	requestId: request.id,
 	ip: request.ip
 });
-const isSiteSegment = (segment) => {
-	const key = segment.split("=", 1)[0] ?? "";
-	try {
-		return decodeURIComponent(key.replace(/\+/g, " ")) === SITE_QUERY_PARAMETER;
-	} catch {
-		return false;
-	}
-};
 /**
 * The raw querystring (bracket syntax is parsed by the content compiler, not Fastify's flat parser), without
 * `?site=`: site resolution (plugins/siteResolution.ts) consumed it, and the compiler refuses unknown keys.
@@ -18959,34 +18972,19 @@ const isSiteSegment = (segment) => {
 const rawQueryOf = (request) => {
 	const index = request.url.indexOf("?");
 	if (index === -1) return "";
-	return request.url.slice(index + 1).split("&").filter((segment) => !isSiteSegment(segment)).join("&");
+	return withoutSiteParameter(request.url.slice(index + 1));
 };
 //#endregion
 //#region src/controllers/graphqlContext.ts
 /** Admin users and admin-scope API tokens: may read drafts. */
 const isAdminPrincipal = (principal) => principal.kind === "admin" || principal.kind === "token" && principal.scope === "admin";
 /** The context every resolver of one `/api/graphql` request receives (built after site resolution). */
-const createGraphqlRequestContext = (request) => {
-	const site = getRequestSite(request);
-	const permissions = getRequestPermissions(request);
-	let base;
-	const content = async (snapshot) => {
-		base ??= contentContextFor(request);
-		return {
-			...await base,
-			snapshot,
-			permissions
-		};
-	};
-	return {
-		request,
-		permissions,
-		isAdmin: isAdminPrincipal(request.principal),
-		site,
-		loaders: createLoaders(() => site.id, content),
-		content
-	};
-};
+const createGraphqlRequestContext = (request) => createGraphqlContext({
+	site: getRequestSite(request),
+	permissions: getRequestPermissions(request),
+	isAdmin: isAdminPrincipal(request.principal),
+	content: () => contentContextFor(request)
+});
 //#endregion
 //#region src/controllers/graphql.ts
 const introspectionDisabled = () => new AppError(403, "INTROSPECTION_DISABLED", "Schema introspection needs an admin session or an API token (or GRAPHQL_PUBLIC_INTROSPECTION=true)");
@@ -21491,6 +21489,21 @@ const graphqlPlugin = fp(async (app, { config, urls }) => {
 	]
 });
 //#endregion
+//#region src/media/errors.ts
+/** Thrown by adapters when a key has no object, so callers can tell "missing" from "storage is down". */
+var ObjectNotFoundError = class extends Error {
+	constructor(key, options) {
+		super(`No stored object at ${key}`, options);
+		this.name = "ObjectNotFoundError";
+	}
+};
+var InvalidStorageKeyError = class extends Error {
+	constructor(key) {
+		super(`Not a valid media storage key: ${JSON.stringify(key)}`);
+		this.name = "InvalidStorageKeyError";
+	}
+};
+//#endregion
 //#region src/media/signing.ts
 const sign = (secret, purpose, subject, expiresAt) => createHmac("sha256", secret).update(`${purpose}\n${subject}\n${expiresAt}`).digest("base64url");
 const safeEqual = (a, b) => {
@@ -21608,9 +21621,10 @@ var StorageNotConfiguredError = class extends Error {
 };
 /**
 * Every adapter this instance can reach. Local disk is always available; S3 whenever its bucket is set,
-* whatever STORAGE_DRIVER says, so assets keep being served while `shapio media migrate` moves them.
+* whatever STORAGE_DRIVER says, so assets keep being served while `shapio media migrate` moves them. The S3
+* adapter (and the AWS SDK) is loaded only then.
 */
-const createMediaStorage = (config, deps) => {
+const createMediaStorage = async (config, deps) => {
 	const adapters = /* @__PURE__ */ new Map();
 	adapters.set("local", createLocalAdapter({
 		root: config.mediaPath,
@@ -21618,10 +21632,13 @@ const createMediaStorage = (config, deps) => {
 		signingSecret: deps.signingSecret,
 		publicBaseUrl: config.publicBaseUrl
 	}));
-	if (config.s3) adapters.set("s3", createS3Adapter({
-		config: config.s3,
-		publicBaseUrl: config.publicBaseUrl
-	}));
+	if (config.s3) {
+		const { createS3Adapter } = await import("./s3Adapter-C8AgFVYw.js");
+		adapters.set("s3", createS3Adapter({
+			config: config.s3,
+			publicBaseUrl: config.publicBaseUrl
+		}));
+	}
 	const get = (driver) => {
 		const adapter = adapters.get(driver);
 		if (!adapter) throw new StorageNotConfiguredError(driver);
@@ -21637,7 +21654,7 @@ const createMediaStorage = (config, deps) => {
 //#region src/plugins/mediaStorage.ts
 /** Exposes the media storage adapters to routes. Registered after the signing secret is resolved. */
 const mediaStoragePlugin = fp(async (app, { storage, urls, signingSecret }) => {
-	app.decorate("mediaStorage", createMediaStorage(storage, {
+	app.decorate("mediaStorage", await createMediaStorage(storage, {
 		urls,
 		signingSecret
 	}));
@@ -24188,13 +24205,15 @@ const summarizePrompt = (input) => ({
 //#region src/services/assist/summarize.ts
 const notSummarizable = (fieldApiKey, reason) => new AppError(400, "ASSIST_FIELD_NOT_SUMMARIZABLE", `"${fieldApiKey}" cannot be summarized into: ${reason}`, { field: fieldApiKey });
 /**
-* The target must be a string or text property (not the title) of a model whose document has a rich-text
-* canvas field: the summary is made from that canvas (plan §I).
+* The target must be a live string or text field (not the title) of a model whose document has a rich-text
+* canvas field, wherever the field is placed (a property or in the document): the summary is made from
+* that canvas (plan §I).
 */
 const summaryTarget = (definition, fieldApiKey) => {
 	const layout = effectiveLayout(definition);
-	const field = layout.properties.find((candidate) => candidate.apiKey === fieldApiKey);
-	if (!field) throw layout.title?.apiKey === fieldApiKey ? notSummarizable(fieldApiKey, "it is the title") : notSummarizable(fieldApiKey, "it is not a property of this model");
+	if (layout.title?.apiKey === fieldApiKey) throw notSummarizable(fieldApiKey, "it is the title");
+	const field = definition.fields.find((candidate) => candidate.apiKey === fieldApiKey && !candidate.deprecated);
+	if (!field) throw notSummarizable(fieldApiKey, "it is not a field of this model");
 	if (field.type !== "string" && field.type !== "text") throw notSummarizable(fieldApiKey, "only string and text fields hold summaries");
 	const canvas = layout.canvas.filter((candidate) => candidate.type === "richtext");
 	if (canvas.length === 0) throw notSummarizable(fieldApiKey, "the model has no rich-text body to summarize");
@@ -25551,11 +25570,11 @@ const scopedDefinitionsOf = (definitions) => definitions.map(({ definition, site
 /** Site IDs to keys, so schema issues found in one site's view can name the site. */
 const loadSiteKeys = async (executor) => new Map((await list$10(executor)).map((site) => [site.id, site.key]));
 /** The most filterable or sortable fields the database can index, or undefined without a limit. */
-const maxFieldIndexes = () => isMysql() ? 56 : void 0;
+const maxFieldIndexes = () => isMysql() ? 55 : void 0;
 //#endregion
 //#region src/schema/planner/plan.ts
 /** The field indexes a definition needs (filterable or sortable, not deprecated), in the current layout. */
-const indexStepsOf = (definition) => definition && definition.kind !== "component" ? definition.fields.filter((field) => (field.filterable || field.sortable) && !field.deprecated).map((field) => {
+const indexStepsOf = (definition) => definition && definition.kind !== "component" ? definition.fields.filter((field) => hasFieldIndex(field)).map((field) => {
 	const spec = {
 		modelId: definition.id,
 		fieldId: field.id,
@@ -33433,6 +33452,19 @@ const executeIdempotentDdl = async (db, statement) => {
 	}
 };
 //#endregion
+//#region src/db/entryOrderIndex.ts
+/**
+* `entry_heads_entry_order_idx` (ADR 0001, "Delivery perf 2"): the default newest-first list order on the
+* heads. The `20261005120000_entry_heads_entry_created_at` migration builds it on an empty table, else the
+* `schema.entryOrderIndex` job builds it here, `CONCURRENTLY` (PostgreSQL only: SQLite and MySQL build it in
+* their migrations).
+*/
+const ENTRY_ORDER_INDEX = "entry_heads_entry_order_idx";
+const createEntryOrderIndexConcurrently = (db) => sql`create index concurrently if not exists ${sql.id(ENTRY_ORDER_INDEX)}
+    on entry_heads (site_id, model_id, state, entry_created_at desc, entry_id)`.execute(db);
+/** Drops an INVALID index left by an interrupted build, so the next build starts over. */
+const dropEntryOrderIndexConcurrently = (db) => sql`drop index concurrently if exists ${sql.id(ENTRY_ORDER_INDEX)}`.execute(db);
+//#endregion
 //#region src/db/indexCatalog.ts
 /** Whether a relation exists in the current schema (e.g. content tables before package E's migration). */
 const tableExists = async (db, table) => {
@@ -33552,6 +33584,30 @@ const dropFieldIndex = (db, indexName) => withIndexBuildLock(db, async () => {
 		await executeIfAny(db, dropStatisticsStatement(indexName));
 	}
 });
+/** The job that builds `entry_heads_entry_order_idx` on an instance upgraded with heads present (PostgreSQL). */
+const ENTRY_ORDER_INDEX_JOB = "schema.entryOrderIndex";
+/**
+* Builds the default list order's index `CONCURRENTLY`, under the same lock as field index builds (two
+* concurrent builds on `entry_heads` deadlock). Idempotent: a valid index is kept, an INVALID one dropped
+* and rebuilt.
+*/
+const buildEntryOrderIndex = (db, log) => withIndexBuildLock(db, async () => {
+	const state = await getIndexState(db, ENTRY_ORDER_INDEX);
+	if (state === "valid") return "exists";
+	if (state === "invalid") {
+		log.warn({ indexName: ENTRY_ORDER_INDEX }, "dropping invalid index left by an earlier build");
+		await dropEntryOrderIndexConcurrently(db);
+	}
+	const startedAt = performance.now();
+	await createEntryOrderIndexConcurrently(db);
+	if (await getIndexState(db, "entry_heads_entry_order_idx") !== "valid") throw new Error(`Index ${ENTRY_ORDER_INDEX} is not valid after building`);
+	await analyzeHeadsStatement().execute(db);
+	log.info({
+		indexName: ENTRY_ORDER_INDEX,
+		durationMs: Math.round(performance.now() - startedAt)
+	}, "entry order index built");
+	return "built";
+});
 //#endregion
 //#region src/schema/planner/indexLayout.ts
 /**
@@ -33735,7 +33791,8 @@ const createFollowUpHandler = (deps) => async (context) => {
 const createSchemaJobHandlers = (deps) => [
 	[SCHEMA_CHANGE_JOB, createSchemaChangeHandler(deps)],
 	[SCHEMA_FOLLOW_UP_JOB, createFollowUpHandler(deps)],
-	[FIELD_INDEX_LAYOUT_JOB, createFieldIndexLayoutHandler(deps.db)]
+	[FIELD_INDEX_LAYOUT_JOB, createFieldIndexLayoutHandler(deps.db)],
+	[ENTRY_ORDER_INDEX_JOB, async (context) => ({ outcome: await buildEntryOrderIndex(deps.db, context.log) })]
 ];
 //#endregion
 //#region src/publishing/failures.ts
@@ -38085,6 +38142,7 @@ const insertRevision = (revision, trx = db) => trx.insertInto("content_revisions
 const insertHead = (head, trx = db) => trx.insertInto("entry_heads").values({
 	entry_id: head.entryId,
 	site_id: entrySiteOf(trx, head.entryId),
+	entry_created_at: entryCreatedAtOf(trx, head.entryId),
 	model_id: head.modelId,
 	locale: head.locale,
 	state: head.state,
@@ -38290,7 +38348,7 @@ const EMPTY_LOCK = {
 	schemaVersion: 0,
 	definitions: {}
 };
-const BATCH = 200;
+const BATCH$2 = 200;
 const pushLimited = (list, item) => {
 	if (list.length < 100) list.push(item);
 };
@@ -38437,9 +38495,9 @@ const scanBundle = async (context, input, acc) => {
 	const modelKey = (id) => definitionKeys.get(id) ?? context.snapshot.byId.get(id)?.definition.apiKey;
 	const knownLocale = (code) => bundleLocales.has(code) || context.snapshot.locales.some((locale) => locale.code === code);
 	const flush = async (force) => {
-		if (users.length >= BATCH || force && users.length > 0) await planUsers(acc, users.splice(0));
-		if (assets.length >= BATCH || force && assets.length > 0) await planAssets(acc, assets.splice(0));
-		if (entries.length >= BATCH / 2 || force && entries.length > 0) await planEntries(acc, entries.splice(0), modelKey, knownLocale);
+		if (users.length >= BATCH$2 || force && users.length > 0) await planUsers(acc, users.splice(0));
+		if (assets.length >= BATCH$2 || force && assets.length > 0) await planAssets(acc, assets.splice(0));
+		if (entries.length >= BATCH$2 / 2 || force && entries.length > 0) await planEntries(acc, entries.splice(0), modelKey, knownLocale);
 	};
 	for await (const { record } of readBundle(input)) {
 		switch (record.type) {
@@ -38901,7 +38959,7 @@ const openStoredBundle = (storage, stored) => storage.get(stored.driver).getStre
 const removeStoredBundle = (storage, stored) => storage.get(stored.driver).delete(stored.key);
 //#endregion
 //#region src/constants/version.ts
-const SHAPIO_VERSION = "0.4.0";
+const SHAPIO_VERSION = "0.5.0";
 //#endregion
 //#region src/repositories/transferExport.ts
 /**
@@ -39693,21 +39751,21 @@ const importContent = async (run, initial) => {
 	});
 };
 /** Deletes live target entries of the bundle's models that the bundle does not have. */
-const prune = async (run, snapshot) => {
+const prune = async (run, network) => {
 	const keep = /* @__PURE__ */ new Set();
 	const models = /* @__PURE__ */ new Set();
 	for await (const { record } of readBundle(await open$1(run))) if (record.type === "entry") {
 		keep.add(record.id);
 		models.add(record.modelId);
 	}
-	const context = {
+	const context = buildContentContext({
 		db: run.deps.db,
-		snapshot,
+		network,
 		permissions: SYSTEM_PERMISSIONS,
 		actor: SYSTEM_ACTOR,
-		site: await getSiteRef(run.payload.siteId, run.deps.db),
-		hooks: createContentHooks()
-	};
+		site: await getSiteRef(run.payload.siteId, run.deps.db)
+	});
+	const { snapshot } = context;
 	let failed = [];
 	for (let round = 0; round < PRUNE_ROUNDS; round += 1) {
 		failed = [];
@@ -39743,7 +39801,7 @@ const runPhase = async (run, phase) => {
 		case "media": return importMedia(run);
 		case "entries": return importEntryRows(run, await loadSiteSnapshot(run));
 		case "content": return importContent(run, await loadSiteSnapshot(run));
-		case "prune": return run.payload.prune ? prune(run, await loadSiteSnapshot(run)) : void 0;
+		case "prune": return run.payload.prune ? prune(run, await loadSnapshot(run.deps.db)) : void 0;
 		case "cleanup": return removeStoredBundle(run.deps.storage, run.payload.bundle).catch((error) => run.job.log.warn({
 			err: describeError(error),
 			key: run.payload.bundle.key
@@ -42195,14 +42253,14 @@ const docsRoutes = async (app) => {
 //#endregion
 //#region src/db/migrations/20261001120000_create_platform_tables.ts
 var _20261001120000_create_platform_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$30,
-	up: () => up$30
+	down: () => down$34,
+	up: () => up$34
 });
 /**
 * Foundation tables shared by every package: durable versions, the job queue, the transactional outbox
 * and the audit log. Statuses are text with CHECK constraints so new states need only a constraint change.
 */
-const up$30 = async (db) => {
+const up$34 = async (db) => {
 	await db.schema.createTable("system_versions").addColumn("id", "boolean", (col) => col.primaryKey().defaultTo(true).check(sql`id`)).addColumn("schema_version", "integer", (col) => col.notNull().defaultTo(0)).addColumn("permissions_version", "integer", (col) => col.notNull().defaultTo(0)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 	await sql`insert into system_versions default values`.execute(db);
 	await db.schema.createTable("jobs").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("type", "text", (col) => col.notNull()).addColumn("payload", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("status", "text", (col) => col.notNull().defaultTo("pending").check(sql`status in ('pending', 'running', 'succeeded', 'dead')`)).addColumn("priority", "integer", (col) => col.notNull().defaultTo(0)).addColumn("run_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("attempts", "integer", (col) => col.notNull().defaultTo(0)).addColumn("max_attempts", "integer", (col) => col.notNull().defaultTo(10).check(sql`max_attempts > 0`)).addColumn("idempotency_key", "text").addColumn("locked_by", "text").addColumn("locked_until", "timestamptz").addColumn("checkpoint", "jsonb").addColumn("result", "jsonb").addColumn("last_error", "text").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("finished_at", "timestamptz").execute();
@@ -42224,7 +42282,7 @@ const up$30 = async (db) => {
 		"occurred_at desc"
 	]).execute();
 };
-const down$30 = async (db) => {
+const down$34 = async (db) => {
 	await db.schema.dropTable("audit_events").execute();
 	await db.schema.dropTable("outbox_events").execute();
 	await db.schema.dropTable("jobs").execute();
@@ -42233,8 +42291,8 @@ const down$30 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001130000_create_admin_identity.ts
 var _20261001130000_create_admin_identity_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$29,
-	up: () => up$29
+	down: () => down$33,
+	up: () => up$33
 });
 /**
 * Admin identity (package B, ADR 0005): admin users, roles and their permission grants, server-side
@@ -42243,7 +42301,7 @@ var _20261001130000_create_admin_identity_exports = /* @__PURE__ */ __exportAll(
 */
 const withTimestamps$3 = (table) => table.addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`));
 const uuidPrimaryKey$3 = (table) => table.addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`));
-const up$29 = async (db) => {
+const up$33 = async (db) => {
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("admin_users")).addColumn("email", "text", (col) => col.notNull().unique()).addColumn("name", "text", (col) => col.notNull().defaultTo("")).addColumn("password_hash", "text", (col) => col.notNull()).addColumn("status", "text", (col) => col.notNull().defaultTo("active").check(sql`status in ('active', 'disabled')`)).addColumn("last_login_at", "timestamptz").addColumn("password_changed_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`))).execute();
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("admin_roles")).addColumn("key", "text", (col) => col.notNull().unique().check(sql`key ~ '^[a-z][a-z0-9-]{0,62}$'`)).addColumn("name", "text", (col) => col.notNull()).addColumn("description", "text", (col) => col.notNull().defaultTo("")).addColumn("kind", "text", (col) => col.notNull().defaultTo("admin").check(sql`kind in ('admin', 'delivery')`)).addColumn("is_system", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("version", "integer", (col) => col.notNull().defaultTo(1))).execute();
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("admin_role_permissions")).addColumn("role_id", "uuid", (col) => col.notNull().references("admin_roles.id").onDelete("cascade")).addColumn("action", "text", (col) => col.notNull()).addColumn("model_id", "text").addColumn("condition", "text", (col) => col.check(sql`condition in ('ownedByPrincipal')`)).addColumn("field_ids", sql`text[]`).addUniqueConstraint("admin_role_permissions_grant_uq", [
@@ -42263,7 +42321,7 @@ const up$29 = async (db) => {
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("api_tokens")).addColumn("name", "text", (col) => col.notNull()).addColumn("token_hash", "text", (col) => col.notNull().unique()).addColumn("token_prefix", "text", (col) => col.notNull()).addColumn("role_id", "uuid", (col) => col.notNull().references("admin_roles.id").onDelete("restrict")).addColumn("created_by", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("expires_at", "timestamptz").addColumn("last_used_at", "timestamptz").addColumn("revoked_at", "timestamptz")).execute();
 	await db.schema.createIndex("api_tokens_role_idx").on("api_tokens").column("role_id").execute();
 };
-const down$29 = async (db) => {
+const down$33 = async (db) => {
 	await db.schema.dropTable("api_tokens").execute();
 	await db.schema.dropTable("setup_tokens").execute();
 	await db.schema.dropTable("password_resets").execute();
@@ -42277,31 +42335,31 @@ const down$29 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001130500_create_system_settings.ts
 var _20261001130500_create_system_settings_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$28,
-	up: () => up$28
+	down: () => down$32,
+	up: () => up$32
 });
 /**
 * Instance-wide key/value settings that must survive restarts and be shared by every instance, e.g. the
 * generated signing secret. General purpose: later packages add keys, not tables.
 */
-const up$28 = async (db) => {
+const up$32 = async (db) => {
 	await db.schema.createTable("system_settings").addColumn("key", "text", (col) => col.primaryKey()).addColumn("value", "text", (col) => col.notNull()).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 };
-const down$28 = async (db) => {
+const down$32 = async (db) => {
 	await db.schema.dropTable("system_settings").execute();
 };
 //#endregion
 //#region src/db/migrations/20261001140000_create_schema_tables.ts
 var _20261001140000_create_schema_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Schema registry (package D, ADR 0002): models and components (one table, `kind` discriminator), immutable
 * schema revisions, the per-model active pointer, schema change jobs, locales and schema settings.
 * Model definitions are data: creating or changing a model never runs DDL (CONTRIBUTING.md rule 1).
 */
-const up$27 = async (db) => {
+const up$31 = async (db) => {
 	await db.schema.createTable("models").addColumn("id", "uuid", (col) => col.primaryKey()).addColumn("kind", "text", (col) => col.notNull().check(sql`kind in ('collection', 'singleton', 'component')`)).addColumn("api_key", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("deleted_at", "timestamptz").execute();
 	await sql`create unique index models_api_key_uq on models (lower(api_key)) where deleted_at is null`.execute(db);
 	await db.schema.createTable("schema_revisions").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("model_id", "uuid", (col) => col.notNull().references("models.id").onDelete("restrict")).addColumn("version", "integer", (col) => col.notNull().check(sql`version > 0`)).addColumn("definition", "jsonb", (col) => col.notNull()).addColumn("hash", "text", (col) => col.notNull()).addColumn("parent_revision_id", "uuid", (col) => col.references("schema_revisions.id")).addColumn("created_by_type", "text", (col) => col.notNull()).addColumn("created_by_id", "text").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addUniqueConstraint("schema_revisions_model_version_uq", ["model_id", "version"]).execute();
@@ -42329,7 +42387,7 @@ const up$27 = async (db) => {
 	await db.schema.createTable("schema_settings").addColumn("id", "boolean", (col) => col.primaryKey().defaultTo(true).check(sql`id`)).addColumn("read_only", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("read_only_reason", "text").addColumn("updated_by_type", "text").addColumn("updated_by_id", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 	await sql`insert into schema_settings default values`.execute(db);
 };
-const down$27 = async (db) => {
+const down$31 = async (db) => {
 	await db.schema.dropTable("schema_settings").execute();
 	await db.schema.dropTable("locales").execute();
 	await db.schema.dropTable("schema_change_jobs").execute();
@@ -42341,8 +42399,8 @@ const down$27 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001150000_create_content_tables.ts
 var _20261001150000_create_content_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * Content storage (package E, ADR 0001): entries, immutable content revisions, mutable heads (one per
@@ -42350,7 +42408,7 @@ var _20261001150000_create_content_tables_exports = /* @__PURE__ */ __exportAll(
 * and the publication log behind `?snapshot=N`. User content models never get tables of their own
 * (CONTRIBUTING.md rule 1): their values are JSONB keyed by stable field IDs.
 */
-const up$26 = async (db) => {
+const up$30 = async (db) => {
 	await db.schema.createTable("entries").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("model_id", "uuid", (col) => col.notNull().references("models.id").onDelete("restrict")).addColumn("owner_app_user_id", "uuid").addColumn("created_by_admin_id", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("deleted_at", "timestamptz").execute();
 	await sql`create index entries_model_idx on entries (model_id, created_at) where deleted_at is null`.execute(db);
 	await sql`create index entries_owner_idx on entries (owner_app_user_id) where owner_app_user_id is not null`.execute(db);
@@ -42414,7 +42472,7 @@ const up$26 = async (db) => {
 	await sql`create unique index publication_log_open_uq on publication_log (entry_id, locale) where to_seq is null`.execute(db);
 	await db.schema.createIndex("publication_log_model_seq_idx").on("publication_log").columns(["model_id", "from_seq"]).execute();
 };
-const down$26 = async (db) => {
+const down$30 = async (db) => {
 	await db.schema.dropTable("publication_log").execute();
 	await db.schema.dropTable("publication_state").execute();
 	await db.schema.dropTable("unique_values").execute();
@@ -42427,8 +42485,8 @@ const down$26 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001160000_create_media_tables.ts
 var _20261001160000_create_media_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Media library (package G): folders, assets, image variants, references from content and upload grants.
@@ -42439,7 +42497,7 @@ const withTimestamps$2 = (table) => table.addColumn("created_at", "timestamptz",
 const uuidPrimaryKey$2 = (table) => table.addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`));
 const STORAGE_DRIVER_CHECK = sql`storage_driver in ('local', 's3')`;
 const VISIBILITY_CHECK = sql`visibility in ('public', 'private')`;
-const up$25 = async (db) => {
+const up$29 = async (db) => {
 	await withTimestamps$2(uuidPrimaryKey$2(db.schema.createTable("media_folders")).addColumn("parent_id", "uuid", (col) => col.references("media_folders.id").onDelete("restrict")).addColumn("name", "text", (col) => col.notNull().check(sql`length(name) between 1 and 255`)).addColumn("created_by", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("version", "integer", (col) => col.notNull().defaultTo(1))).execute();
 	await sql`create unique index media_folders_sibling_name_uq on media_folders
     (coalesce(parent_id, '00000000-0000-0000-0000-000000000000'::uuid), lower(name))`.execute(db);
@@ -42468,7 +42526,7 @@ const up$25 = async (db) => {
 	]).execute();
 	await db.schema.createTable("media_upload_grants").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("asset_id", "uuid", (col) => col.notNull()).addColumn("kind", "text", (col) => col.notNull().check(sql`kind in ('create', 'replace')`)).addColumn("storage_driver", "text", (col) => col.notNull().check(STORAGE_DRIVER_CHECK)).addColumn("storage_key", "text", (col) => col.notNull().unique()).addColumn("original_filename", "text", (col) => col.notNull()).addColumn("declared_mime_type", "text", (col) => col.notNull()).addColumn("max_size_bytes", "bigint", (col) => col.notNull()).addColumn("folder_id", "uuid").addColumn("visibility", "text", (col) => col.notNull().check(VISIBILITY_CHECK)).addColumn("created_by", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("created_by_principal", "text", (col) => col.notNull()).addColumn("status", "text", (col) => col.notNull().defaultTo("pending").check(sql`status in ('pending', 'consumed', 'rejected', 'expired')`)).addColumn("expires_at", "timestamptz", (col) => col.notNull()).addColumn("consumed_at", "timestamptz").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 };
-const down$25 = async (db) => {
+const down$29 = async (db) => {
 	await db.schema.dropTable("media_upload_grants").execute();
 	await db.schema.dropTable("media_references").execute();
 	await db.schema.dropTable("media_variants").execute();
@@ -42478,8 +42536,8 @@ const down$25 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001170000_create_publishing_tables.ts
 var _20261001170000_create_publishing_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * Publishing (package H): scheduled publications, releases, webhooks and their delivery log, deployment
@@ -42518,13 +42576,13 @@ const createPreviewTables = async (db) => {
 	await uuidPrimaryKey$1(db.schema.createTable("preview_tokens")).addColumn("token_hash", "text", (col) => col.notNull().unique()).addColumn("token_prefix", "text", (col) => col.notNull()).addColumn("model_id", "uuid", (col) => col.notNull()).addColumn("entry_id", "uuid", (col) => col.references("entries.id").onDelete("cascade")).addColumn("locale", "text").addColumn("connection_id", "uuid", (col) => col.references("deployment_connections.id").onDelete("set null")).addColumn("delivery_role_id", "uuid", (col) => col.references("admin_roles.id").onDelete("set null")).addColumn("created_by", "uuid", (col) => col.notNull().references("admin_users.id").onDelete("cascade")).addColumn("expires_at", "timestamptz", (col) => col.notNull()).addColumn("revoked_at", "timestamptz").addColumn("last_used_at", "timestamptz").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 	await db.schema.createIndex("preview_tokens_entry_idx").on("preview_tokens").columns(["entry_id", "created_at desc"]).execute();
 };
-const up$24 = async (db) => {
+const up$28 = async (db) => {
 	await createSchedulingTables(db);
 	await createWebhookTables(db);
 	await createDeploymentTables(db);
 	await createPreviewTables(db);
 };
-const down$24 = async (db) => {
+const down$28 = async (db) => {
 	await db.schema.dropTable("preview_tokens").execute();
 	await db.schema.dropTable("deployment_runs").execute();
 	await db.schema.dropTable("deployment_connections").execute();
@@ -42537,8 +42595,8 @@ const down$24 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001180000_create_app_users.ts
 var _20261001180000_create_app_users_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * App users (package I, ADR 0005): the end users of sites and apps built on Shapio, with their own roles
@@ -42589,7 +42647,7 @@ const createCredentials = async (db) => {
 	}
 	await db.schema.createTable("app_login_codes").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("app_user_id", "uuid", (col) => col.notNull().references("app_users.id").onDelete("cascade")).addColumn("code_hash", "text", (col) => col.notNull().unique()).addColumn("expires_at", "timestamptz", (col) => col.notNull()).addColumn("used_at", "timestamptz").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 };
-const up$23 = async (db) => {
+const up$27 = async (db) => {
 	await createUsers(db);
 	await createRoles(db);
 	await createCredentials(db);
@@ -42599,7 +42657,7 @@ const up$23 = async (db) => {
       foreign key (owner_app_user_id) references app_users (id) on delete set null
   `.execute(db);
 };
-const down$23 = async (db) => {
+const down$27 = async (db) => {
 	await sql`alter table entries drop constraint if exists entries_owner_app_user_fk`.execute(db);
 	await db.schema.dropTable("app_login_codes").execute();
 	await db.schema.dropTable("app_password_resets").execute();
@@ -42614,8 +42672,8 @@ const down$23 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261002120000_create_extension_hook_runs.ts
 var _20261002120000_create_extension_hook_runs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * Extension points (package K, ADR 0009): the ledger of post-commit lifecycle hooks (`afterCreate`,
@@ -42623,17 +42681,17 @@ var _20261002120000_create_extension_hook_runs_exports = /* @__PURE__ */ __expor
 * as the hook's own database work, so a hook re-run after a worker crash finds its row and is skipped:
 * exactly once for everything the hook does through its transaction.
 */
-const up$22 = async (db) => {
+const up$26 = async (db) => {
 	await db.schema.createTable("extension_hook_runs").addColumn("event_id", "uuid", (col) => col.notNull()).addColumn("hook", "text", (col) => col.notNull()).addColumn("job_id", "uuid").addColumn("completed_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addPrimaryKeyConstraint("extension_hook_runs_pkey", ["event_id", "hook"]).execute();
 };
-const down$22 = async (db) => {
+const down$26 = async (db) => {
 	await db.schema.dropTable("extension_hook_runs").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002130000_app_auth_token_version_and_login_code_pkce.ts
 var _20261002130000_app_auth_token_version_and_login_code_pkce_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * App users (ADR 0005):
@@ -42644,20 +42702,20 @@ var _20261002130000_app_auth_token_version_and_login_code_pkce_exports = /* @__P
 *   sign-in; the one-time login code is only exchanged with the matching verifier. Codes live a minute, so
 *   any pending ones (issued without a challenge) are dropped rather than given a placeholder.
 */
-const up$21 = async (db) => {
+const up$25 = async (db) => {
 	await db.schema.alterTable("app_users").addColumn("token_version", "integer", (col) => col.notNull().defaultTo(0)).execute();
 	await sql`delete from app_login_codes`.execute(db);
 	await db.schema.alterTable("app_login_codes").addColumn("code_challenge", "text", (col) => col.notNull()).execute();
 };
-const down$21 = async (db) => {
+const down$25 = async (db) => {
 	await db.schema.alterTable("app_login_codes").dropColumn("code_challenge").execute();
 	await db.schema.alterTable("app_users").dropColumn("token_version").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002180000_add_publication_log_diff_indexes.ts
 var _20261002180000_add_publication_log_diff_indexes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * The snapshot diff (repositories/snapshotDiff.ts) finds the (entry, locale) pairs whose live period opened
@@ -42666,7 +42724,7 @@ var _20261002180000_add_publication_log_diff_indexes_exports = /* @__PURE__ */ _
 * - `(entry_id, locale, from_seq)`: "the row live at seq N" is the latest row starting at or before N.
 * Periods that opened in the range use the existing `(model_id, from_seq)` index.
 */
-const up$20 = async (db) => {
+const up$24 = async (db) => {
 	await sql`create index publication_log_to_seq_idx on publication_log (to_seq) where to_seq is not null`.execute(db);
 	await db.schema.createIndex("publication_log_entry_locale_from_idx").on("publication_log").columns([
 		"entry_id",
@@ -42674,15 +42732,15 @@ const up$20 = async (db) => {
 		"from_seq"
 	]).execute();
 };
-const down$20 = async (db) => {
+const down$24 = async (db) => {
 	await db.schema.dropIndex("publication_log_entry_locale_from_idx").execute();
 	await db.schema.dropIndex("publication_log_to_seq_idx").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002180100_create_usage_tables.ts
 var _20261002180100_create_usage_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * Field usage from delivery traffic (plan developer-face §5): daily counters written by the in-memory
@@ -42690,7 +42748,7 @@ var _20261002180100_create_usage_tables_exports = /* @__PURE__ */ __exportAll({
 * payloads. `principal_key` is `token:<id>`, `app_users` or `anonymous`. Pruned by the retention job
 * after USAGE_RETENTION_DAYS.
 */
-const up$19 = async (db) => {
+const up$23 = async (db) => {
 	await db.schema.createTable("field_reads").addColumn("day", "date", (col) => col.notNull()).addColumn("model_id", "uuid", (col) => col.notNull()).addColumn("field_path", "text", (col) => col.notNull()).addColumn("principal_key", "text", (col) => col.notNull()).addColumn("selection", "text", (col) => col.notNull().check(sql`selection in ('explicit', 'implicit')`)).addColumn("reads", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_read_at", "timestamptz", (col) => col.notNull()).addPrimaryKeyConstraint("field_reads_pkey", [
 		"day",
 		"model_id",
@@ -42701,15 +42759,15 @@ const up$19 = async (db) => {
 	await db.schema.createIndex("field_reads_model_day_idx").on("field_reads").columns(["model_id", "day"]).execute();
 	await db.schema.createTable("token_reads").addColumn("day", "date", (col) => col.notNull()).addColumn("principal_key", "text", (col) => col.notNull()).addColumn("requests", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_snapshot", "bigint").addColumn("last_read_at", "timestamptz", (col) => col.notNull()).addPrimaryKeyConstraint("token_reads_pkey", ["day", "principal_key"]).execute();
 };
-const down$19 = async (db) => {
+const down$23 = async (db) => {
 	await db.schema.dropTable("token_reads").execute();
 	await db.schema.dropTable("field_reads").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002180200_create_change_sets.ts
 var _20261002180200_create_change_sets_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Change sets (developer-face plan §5, ADR 0010): schema drafts and entry publications that ship as ONE
@@ -42888,7 +42946,7 @@ const migrateReleases = async (db) => {
 	await sql`drop table release_items`.execute(db);
 	await sql`drop table releases`.execute(db);
 };
-const up$18 = async (db) => {
+const up$22 = async (db) => {
 	await createTables(db);
 	await linkExecutionRecords(db);
 	await allowConversionRevisions(db);
@@ -42960,7 +43018,7 @@ const restoreReleases = async (db) => {
 	await sql`update webhooks set events = array_remove(array_remove(events, 'change_set.shipping'),
     'change_set.discarded')`.execute(db);
 };
-const down$18 = async (db) => {
+const down$22 = async (db) => {
 	await restoreReleases(db);
 	await sql`alter table content_revisions drop constraint content_revisions_reason_check`.execute(db);
 	await sql`alter table content_revisions add constraint content_revisions_reason_check
@@ -42981,8 +43039,8 @@ const down$18 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261002190000_create_editor_presence_and_content_health.ts
 var _20261002190000_create_editor_presence_and_content_health_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Editor experience (plan editor-experience §9):
@@ -42993,7 +43051,7 @@ var _20261002190000_create_editor_presence_and_content_health_exports = /* @__PU
 * - `content_health_findings`: open and recently resolved findings of the health rules per entry and
 *   locale (`*` for the entry as a whole). An evaluation upserts what it found and resolves the rest.
 */
-const up$17 = async (db) => {
+const up$21 = async (db) => {
 	await sql`
     create unlogged table editor_presence (
       entry_id uuid not null,
@@ -43030,15 +43088,15 @@ const up$17 = async (db) => {
 	await sql`create index content_health_findings_resolved_idx on content_health_findings (resolved_at)
     where resolved_at is not null`.execute(db);
 };
-const down$17 = async (db) => {
+const down$21 = async (db) => {
 	await sql`drop table content_health_findings`.execute(db);
 	await sql`drop table editor_presence`.execute(db);
 };
 //#endregion
 //#region src/db/migrations/20261003120000_add_changes_ship_permission.ts
 var _20261003120000_add_changes_ship_permission_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * `changes.ship` (agentic plan §I): shipping a change set (and scheduling a ship) becomes its own global
@@ -43046,7 +43104,7 @@ var _20261003120000_add_changes_ship_permission_exports = /* @__PURE__ */ __expo
 * live. Every role that holds `changes.manage` today keeps what it could do: it gets `changes.ship` too.
 * The permissions version moves only when grants changed, so running instances reload exactly then.
 */
-const up$16 = async (db) => {
+const up$20 = async (db) => {
 	await sql`
     with granted as (
       insert into admin_role_permissions (role_id, action, model_id, condition, field_ids)
@@ -43060,7 +43118,7 @@ const up$16 = async (db) => {
     where exists (select 1 from granted)
   `.execute(db);
 };
-const down$16 = async (db) => {
+const down$20 = async (db) => {
 	await sql`
     with revoked as (
       delete from admin_role_permissions where action = 'changes.ship' returning 1
@@ -43072,8 +43130,8 @@ const down$16 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003130000_create_sites.ts
 var _20261003130000_create_sites_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Sites (plan agentic-ecosystem §H, ADR 0011): one instance hosts many sites with one schema and one login.
@@ -43261,7 +43319,7 @@ const siteRoleAssignments = async (db) => {
   `.execute(db);
 	await sql`alter table admin_invitations drop column role_ids`.execute(db);
 };
-const up$15 = async (db) => {
+const up$19 = async (db) => {
 	await createSites(db);
 	await addSiteColumns(db);
 	await tieCopiesToEntries(db);
@@ -43274,7 +43332,7 @@ const assertSingleSite = async (db) => {
 	const { rows } = await sql`select count(*)::text as count from sites`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 1) throw new Error("Cannot roll back sites while more than one site exists: merging them would merge their snapshot ledgers and uniqueness and widen role assignments. Delete the other sites first.");
 };
-const down$15 = async (db) => {
+const down$19 = async (db) => {
 	await assertSingleSite(db);
 	await sql`alter table admin_invitations add column role_ids uuid[] not null default '{}'::uuid[]`.execute(db);
 	await sql`
@@ -43345,8 +43403,8 @@ const down$15 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003140200_enqueue_field_index_layout.ts
 var _20261003140200_enqueue_field_index_layout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Field index layout v2 (sites plan §H): per-field expression indexes on `entry_heads` lead with `site_id`,
@@ -43356,12 +43414,12 @@ var _20261003140200_enqueue_field_index_layout_exports = /* @__PURE__ */ __expor
 * old ones while the instance keeps serving. Nothing to rebuild (no field index yet, e.g. a new install):
 * no job.
 */
-const JOB_TYPE = "schema.fieldIndexLayout";
-const IDEMPOTENCY_KEY = "schema.fieldIndexLayout:v2";
-const up$14 = async (db) => {
+const JOB_TYPE$1 = "schema.fieldIndexLayout";
+const IDEMPOTENCY_KEY$1 = "schema.fieldIndexLayout:v2";
+const up$18 = async (db) => {
 	await sql`
     insert into jobs (type, payload, max_attempts, idempotency_key)
-    select ${JOB_TYPE}, '{}'::jsonb, 5, ${IDEMPOTENCY_KEY}
+    select ${JOB_TYPE$1}, '{}'::jsonb, 5, ${IDEMPOTENCY_KEY$1}
     where exists (
       select 1 from pg_catalog.pg_index i
       join pg_catalog.pg_class c on c.oid = i.indexrelid
@@ -43371,14 +43429,14 @@ const up$14 = async (db) => {
   `.execute(db);
 };
 /** The layout job is idempotent; rolling back only forgets it if it has not run yet. */
-const down$14 = async (db) => {
-	await sql`delete from jobs where idempotency_key = ${IDEMPOTENCY_KEY} and status = 'pending'`.execute(db);
+const down$18 = async (db) => {
+	await sql`delete from jobs where idempotency_key = ${IDEMPOTENCY_KEY$1} and status = 'pending'`.execute(db);
 };
 //#endregion
 //#region src/db/migrations/20261003140500_change_set_items_site_and_preview_entry.ts
 var _20261003140500_change_set_items_site_and_preview_entry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Sites, publishing (plan agentic-ecosystem §H, package G5).
@@ -43389,7 +43447,7 @@ var _20261003140500_change_set_items_site_and_preview_entry_exports = /* @__PURE
 * - `preview_tokens.entry_id` becomes required: a preview token previews one entry of one site. Model-wide
 *   tokens (short-lived by design) are deleted; whoever needs one opens the entry's preview again.
 */
-const up$13 = async (db) => {
+const up$17 = async (db) => {
 	await sql`alter table change_sets add constraint change_sets_id_site_uq unique (id, site_id)`.execute(db);
 	await sql`alter table change_set_items add column site_id uuid`.execute(db);
 	await sql`
@@ -43405,7 +43463,7 @@ const up$13 = async (db) => {
 	await sql`delete from preview_tokens where entry_id is null`.execute(db);
 	await sql`alter table preview_tokens alter column entry_id set not null`.execute(db);
 };
-const down$13 = async (db) => {
+const down$17 = async (db) => {
 	await sql`alter table preview_tokens alter column entry_id drop not null`.execute(db);
 	await sql`alter table change_set_items drop constraint change_set_items_entry_site_fk`.execute(db);
 	await sql`alter table change_set_items drop constraint change_set_items_set_site_fk`.execute(db);
@@ -43415,8 +43473,8 @@ const down$13 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003150000_widen_deployment_providers.ts
 var _20261003150000_widen_deployment_providers_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Deploy adapters (plan agentic-ecosystem §B2): deployment connections may use the Vercel and Netlify
@@ -43431,11 +43489,11 @@ const replaceCheck = async (db, check) => {
     check (${check}) not valid`.execute(db);
 	await sql`alter table deployment_connections validate constraint deployment_connections_provider_check`.execute(db);
 };
-const up$12 = async (db) => {
+const up$16 = async (db) => {
 	await replaceCheck(db, WIDENED);
 };
 /** Refuses while Vercel or Netlify connections exist: a down migration never deletes user data. */
-const down$12 = async (db) => {
+const down$16 = async (db) => {
 	const { rows } = await sql`
     select count(*)::text as count from deployment_connections where provider in ('vercel', 'netlify')
   `.execute(db);
@@ -43446,8 +43504,8 @@ const down$12 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003160000_create_assist_runs.ts
 var _20261003160000_create_assist_runs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Editor assists (plan agentic-ecosystem §A0, §I): one `assist_runs` row per assist request (who, which
@@ -43463,14 +43521,14 @@ const replaceSourceCheck = async (db, check) => {
 	await sql`alter table change_sets add constraint change_sets_source_check check (${check}) not valid`.execute(db);
 	await sql`alter table change_sets validate constraint change_sets_source_check`.execute(db);
 };
-const up$11 = async (db) => {
+const up$15 = async (db) => {
 	await db.schema.createTable("assist_runs").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("site_id", "uuid", (col) => col.notNull().references("sites.id").onDelete("cascade")).addColumn("actor_type", "text", (col) => col.notNull()).addColumn("actor_id", "text", (col) => col.notNull()).addColumn("action", "text", (col) => col.notNull().check(ACTIONS)).addColumn("rule", "text").addColumn("provider", "text", (col) => col.notNull()).addColumn("model", "text", (col) => col.notNull()).addColumn("input_tokens", "integer", (col) => col.notNull().defaultTo(0)).addColumn("output_tokens", "integer", (col) => col.notNull().defaultTo(0)).addColumn("duration_ms", "integer", (col) => col.notNull().defaultTo(0)).addColumn("status", "text", (col) => col.notNull().check(sql`status in ('queued', 'running', 'succeeded', 'failed')`)).addColumn("error_code", "text").addColumn("job_id", "uuid", (col) => col.references("jobs.id").onDelete("set null")).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("finished_at", "timestamptz").execute();
 	await db.schema.createIndex("assist_runs_site_created_idx").on("assist_runs").columns(["site_id", "created_at"]).execute();
 	await db.schema.createIndex("assist_runs_created_idx").on("assist_runs").column("created_at").execute();
 	await replaceSourceCheck(db, SOURCES_WIDENED);
 };
 /** Refuses while change sets opened by assist exist: a down migration never deletes user data. */
-const down$11 = async (db) => {
+const down$15 = async (db) => {
 	const { rows } = await sql`
     select count(*)::text as count from change_sets where source = 'assist'
   `.execute(db);
@@ -43482,8 +43540,8 @@ const down$11 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003170000_audit_events_seq.ts
 var _20261003170000_audit_events_seq_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * `audit_events.seq`: a monotonic tiebreaker after `occurred_at`, so events written in the same instant (one
@@ -43492,17 +43550,17 @@ var _20261003170000_audit_events_seq_exports$2 = /* @__PURE__ */ __exportAll({
 * are numbered in the order the rewrite reads them. No index: the audit queries filter and sort by
 * `occurred_at` first, and `seq` only breaks ties.
 */
-const up$10 = async (db) => {
+const up$14 = async (db) => {
 	await db.schema.alterTable("audit_events").addColumn("seq", "bigint", (col) => col.notNull().generatedAlwaysAsIdentity()).execute();
 };
-const down$10 = async (db) => {
+const down$14 = async (db) => {
 	await db.schema.alterTable("audit_events").dropColumn("seq").execute();
 };
 //#endregion
 //#region src/db/migrations/20261004120000_models_site_scope.ts
 var _20261004120000_models_site_scope_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * Per-site schema (plan site-schema): a definition belongs to one site (`models.site_id`) or is shared by every
@@ -43515,7 +43573,7 @@ var _20261004120000_models_site_scope_exports$2 = /* @__PURE__ */ __exportAll({
 * over `lower(api_key)` cannot hold. Share or delete them first; then `down` is lossless.
 */
 const NIL_UUID$1 = "00000000-0000-0000-0000-000000000000";
-const up$9 = async (db) => {
+const up$13 = async (db) => {
 	await sql`alter table models add column site_id uuid references sites (id)`.execute(db);
 	await sql`create index models_site_idx on models (site_id)`.execute(db);
 	await sql`drop index models_api_key_uq`.execute(db);
@@ -43525,7 +43583,7 @@ const up$9 = async (db) => {
   `.execute(db);
 	await sql`alter table schema_drafts add column shared boolean not null default false`.execute(db);
 };
-const down$9 = async (db) => {
+const down$13 = async (db) => {
 	const { rows } = await sql`select count(*)::text as count from models where site_id is not null`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 0) throw new Error("Cannot roll back per-site schema while definitions belong to a site: two sites may share an API ID. Share or delete the site definitions first.");
 	await sql`alter table schema_drafts drop column shared`.execute(db);
@@ -43537,8 +43595,8 @@ const down$9 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261004130000_site_seo_settings.ts
 var _20261004130000_site_seo_settings_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * SEO defaults per site (plan seo-fields): `sites.seo_defaults` holds the site's default texts per locale, its
@@ -43549,7 +43607,7 @@ var _20261004130000_site_seo_settings_exports$2 = /* @__PURE__ */ __exportAll({
 * about what a site publishes) gets it; the built-in owner and admin roles get it from `ensureSystemRoles`.
 * The permissions version moves only when grants changed, so running instances reload exactly then.
 */
-const up$8 = async (db) => {
+const up$12 = async (db) => {
 	await sql`alter table sites add column seo_defaults jsonb`.execute(db);
 	await sql`
     with granted as (
@@ -43564,7 +43622,7 @@ const up$8 = async (db) => {
     where exists (select 1 from granted)
   `.execute(db);
 };
-const down$8 = async (db) => {
+const down$12 = async (db) => {
 	await sql`
     with revoked as (
       delete from admin_role_permissions where action = 'site.settings' returning 1
@@ -43575,10 +43633,74 @@ const down$8 = async (db) => {
 	await sql`alter table sites drop column seo_defaults`.execute(db);
 };
 //#endregion
+//#region src/db/migrations/20261005120000_entry_heads_entry_created_at.ts
+var _20261005120000_entry_heads_entry_created_at_exports$2 = /* @__PURE__ */ __exportAll({
+	down: () => down$11,
+	up: () => up$11
+});
+/**
+* Delivery perf 2 (ADR 0001 amendment): the entry's `created_at` on each head (`entry_created_at`), so a list
+* in the default newest-first order walks `entry_heads_entry_order_idx` and stops at the page instead of
+* joining every matching head to `entries` and sorting them. `entries.created_at` never changes, and every head
+* insert copies it (repositories `entryHeads.insert`, `transferImport.insertHead`).
+*
+* The column is added nullable (a catalog-only change) and backfilled here in batches. The index is built
+* here on an empty table (a new install). With heads present it is built `CONCURRENTLY`, which cannot run
+* in a migration's transaction, by the `schema.entryOrderIndex` job this migration enqueues
+* (schema/planner/indexes.ts), so writes continue while it builds; queries are correct without it.
+*/
+const INDEX$2 = "entry_heads_entry_order_idx";
+const JOB_TYPE = "schema.entryOrderIndex";
+const IDEMPOTENCY_KEY = "schema.entryOrderIndex:v1";
+const BATCH$1 = 5e3;
+const up$11 = async (db) => {
+	await sql`alter table entry_heads add column entry_created_at timestamptz`.execute(db);
+	for (;;) {
+		const result = await sql`
+      update entry_heads h set entry_created_at = e.created_at
+      from entries e
+      where e.id = h.entry_id and (h.entry_id, h.locale, h.state) in (
+        select entry_id, locale, state from entry_heads where entry_created_at is null limit ${BATCH$1}
+      )
+    `.execute(db);
+		if (Number(result.numAffectedRows ?? 0n) < BATCH$1) break;
+	}
+	const { rows } = await sql`select exists (select 1 from entry_heads) as present`.execute(db);
+	if (rows[0]?.present) {
+		await sql`
+      insert into jobs (type, payload, max_attempts, idempotency_key)
+      values (${JOB_TYPE}, '{}'::jsonb, 5, ${IDEMPOTENCY_KEY})
+      on conflict do nothing
+    `.execute(db);
+		return;
+	}
+	await sql`
+    create index ${sql.id(INDEX$2)} on entry_heads (site_id, model_id, state, entry_created_at desc, entry_id)
+  `.execute(db);
+};
+const down$11 = async (db) => {
+	await sql`delete from jobs where idempotency_key = ${IDEMPOTENCY_KEY} and status = 'pending'`.execute(db);
+	await sql`drop index if exists ${sql.id(INDEX$2)}`.execute(db);
+	await sql`alter table entry_heads drop column entry_created_at`.execute(db);
+};
+//#endregion
+//#region src/db/migrations/20261006120000_system_versions_release.ts
+var _20261006120000_system_versions_release_exports = /* @__PURE__ */ __exportAll({
+	dialectNeutral: () => true,
+	down: () => down$10,
+	up: () => up$10
+});
+const up$10 = async (db) => {
+	await db.schema.alterTable("system_versions").addColumn("release", "text").execute();
+};
+const down$10 = async (db) => {
+	await db.schema.alterTable("system_versions").dropColumn("release").execute();
+};
+//#endregion
 //#region src/db/migrations/mysql/0001_baseline.ts
 var _0001_baseline_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * MySQL baseline: Shapio's whole system schema as of PostgreSQL migration
@@ -44761,13 +44883,13 @@ const withoutForeignKeyChecks = async (db, statements) => db.connection().execut
 		await sql`set foreign_key_checks = 1`.execute(connection);
 	}
 });
-const up$7 = async (db) => withoutForeignKeyChecks(db, STATEMENTS$1);
-const down$7 = async (db) => withoutForeignKeyChecks(db, [...TABLES$1].reverse().map((table) => `drop table if exists \`${table}\``));
+const up$9 = async (db) => withoutForeignKeyChecks(db, STATEMENTS$1);
+const down$9 = async (db) => withoutForeignKeyChecks(db, [...TABLES$1].reverse().map((table) => `drop table if exists \`${table}\``));
 //#endregion
 //#region src/db/migrations/mysql/20261003170000_audit_events_seq.ts
 var _20261003170000_audit_events_seq_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * MySQL twin of `../20261003170000_audit_events_seq.ts`: `seq` is `AUTO_INCREMENT`, which InnoDB only allows
@@ -44775,26 +44897,26 @@ var _20261003170000_audit_events_seq_exports$1 = /* @__PURE__ */ __exportAll({
 * tiebreaker). Existing rows are numbered in primary-key order. `db/mysql/tables.ts` lists `seq` as the
 * table's identity, so an insert's emulated RETURNING finds its row by `LAST_INSERT_ID()`.
 */
-const up$6 = async (db) => {
+const up$8 = async (db) => {
 	await sql`alter table \`audit_events\`
     add column \`seq\` bigint not null auto_increment,
     add unique key \`audit_events_seq_key\` (\`seq\`)`.execute(db);
 };
-const down$6 = async (db) => {
+const down$8 = async (db) => {
 	await sql`alter table \`audit_events\` drop column \`seq\``.execute(db);
 };
 //#endregion
 //#region src/db/migrations/mysql/20261004120000_models_site_scope.ts
 var _20261004120000_models_site_scope_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * MySQL twin of `../20261004120000_models_site_scope.ts`. The per-scope API ID key uses functional key parts,
 * like the baseline: `coalesce(site_id, '')` for the scope (MySQL has no `NULLS NOT DISTINCT`) and the
 * case-folded API ID of live rows only (a deleted row's part is NULL, and NULLs never collide).
 */
-const up$5 = async (db) => {
+const up$7 = async (db) => {
 	await sql`alter table \`models\` add column \`site_id\` char(36) character set ascii collate ascii_general_ci`.execute(db);
 	await sql`create index \`models_site_idx\` on \`models\` (\`site_id\`)`.execute(db);
 	await sql`alter table \`models\` add constraint \`models_site_id_fkey\` foreign key (\`site_id\`) references \`sites\` (\`id\`)`.execute(db);
@@ -44803,7 +44925,7 @@ const up$5 = async (db) => {
     ((coalesce(\`site_id\`, '')), (case when (\`deleted_at\` IS NULL) then lower(\`api_key\`) end))`.execute(db);
 	await sql`alter table \`schema_drafts\` add column \`shared\` tinyint(1) not null default 0`.execute(db);
 };
-const down$5 = async (db) => {
+const down$7 = async (db) => {
 	const { rows } = await sql`select count(*) as count from \`models\` where \`site_id\` is not null`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 0) throw new Error("Cannot roll back per-site schema while definitions belong to a site: two sites may share an API ID. Share or delete the site definitions first.");
 	await sql`alter table \`schema_drafts\` drop column \`shared\``.execute(db);
@@ -44817,8 +44939,8 @@ const down$5 = async (db) => {
 //#endregion
 //#region src/db/migrations/mysql/20261004130000_site_seo_settings.ts
 var _20261004130000_site_seo_settings_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$6,
+	up: () => up$6
 });
 /**
 * MySQL twin of `../20261004130000_site_seo_settings.ts`. `insert ignore` stands in for `on conflict do
@@ -44826,7 +44948,7 @@ var _20261004130000_site_seo_settings_exports$1 = /* @__PURE__ */ __exportAll({
 */
 const bumpPermissionsVersion$1 = (db) => sql`update \`system_versions\` set \`permissions_version\` = \`permissions_version\` + 1,
     \`updated_at\` = current_timestamp(6)`.execute(db);
-const up$4 = async (db) => {
+const up$6 = async (db) => {
 	await sql`alter table \`sites\` add column \`seo_defaults\` json`.execute(db);
 	const granted = await sql`
     insert ignore into \`admin_role_permissions\` (\`id\`, \`role_id\`, \`action\`, \`model_id\`, \`condition\`, \`field_ids\`)
@@ -44836,24 +44958,54 @@ const up$4 = async (db) => {
   `.execute(db);
 	if (Number(granted.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion$1(db);
 };
-const down$4 = async (db) => {
+const down$6 = async (db) => {
 	const revoked = await sql`delete from \`admin_role_permissions\` where \`action\` = 'site.settings'`.execute(db);
 	if (Number(revoked.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion$1(db);
 	await sql`alter table \`sites\` drop column \`seo_defaults\``.execute(db);
 };
 //#endregion
+//#region src/db/migrations/mysql/20261005120000_entry_heads_entry_created_at.ts
+var _20261005120000_entry_heads_entry_created_at_exports$1 = /* @__PURE__ */ __exportAll({
+	down: () => down$5,
+	up: () => up$5
+});
+/**
+* MySQL twin of `../20261005120000_entry_heads_entry_created_at.ts`. The column is added `ALGORITHM=INSTANT`
+* and backfilled in batches; the index is built online (`ALGORITHM=INPLACE, LOCK=NONE`), so writes continue.
+* It is one more index of `entry_heads`, which is why `MYSQL_MAX_FIELD_INDEXES` (db/limits.ts) went down by one.
+*/
+const INDEX$1 = "entry_heads_entry_order_idx";
+const BATCH = 5e3;
+const up$5 = async (db) => {
+	await sql`alter table \`entry_heads\` add column \`entry_created_at\` datetime(6), algorithm=instant`.execute(db);
+	for (;;) {
+		const result = await sql`update \`entry_heads\` set \`entry_created_at\` = (
+      select e.\`created_at\` from \`entries\` e where e.\`id\` = \`entry_heads\`.\`entry_id\`
+    ) where \`entry_created_at\` is null limit ${sql.lit(BATCH)}`.execute(db);
+		if (Number(result.numAffectedRows ?? 0n) < BATCH) break;
+	}
+	await sql`create index ${sql.id(INDEX$1)} on \`entry_heads\`
+    (\`site_id\`, \`model_id\`, \`state\`, \`entry_created_at\` desc, \`entry_id\`) algorithm=inplace lock=none`.execute(db);
+};
+const down$5 = async (db) => {
+	await sql`drop index ${sql.id(INDEX$1)} on \`entry_heads\``.execute(db);
+	await sql`alter table \`entry_heads\` drop column \`entry_created_at\``.execute(db);
+};
+//#endregion
 //#region src/db/migrations/mysql/index.ts
 const MYSQL_MIGRATIONS = {
 	"0001_baseline": _0001_baseline_exports$1,
 	"20261003170000_audit_events_seq": _20261003170000_audit_events_seq_exports$1,
 	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports$1,
-	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports$1
+	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports$1,
+	"20261005120000_entry_heads_entry_created_at": _20261005120000_entry_heads_entry_created_at_exports$1,
+	"20261006120000_system_versions_release": _20261006120000_system_versions_release_exports
 };
 //#endregion
 //#region src/db/migrations/sqlite/0001_baseline.ts
 var _0001_baseline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$4,
+	up: () => up$4
 });
 /**
 * SQLite baseline: Shapio's whole system schema as of PostgreSQL migration
@@ -45998,18 +46150,18 @@ const TABLES = [
 	"assist_runs",
 	"sequences"
 ];
-const up$3 = async (db) => {
+const up$4 = async (db) => {
 	for (const statement of STATEMENTS) await sql.raw(statement).execute(db);
 };
-const down$3 = async (db) => {
+const down$4 = async (db) => {
 	await sql`pragma defer_foreign_keys = on`.execute(db);
 	for (const table of [...TABLES].reverse()) await sql.raw(`drop table if exists "${table}"`).execute(db);
 };
 //#endregion
 //#region src/db/migrations/sqlite/20261003170000_audit_events_seq.ts
 var _20261003170000_audit_events_seq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$3,
+	up: () => up$3
 });
 /**
 * SQLite twin of `../20261003170000_audit_events_seq.ts`. SQLite cannot add a column whose default calls a
@@ -46036,7 +46188,7 @@ const INDEXES = [
 	`create index "audit_events_occurred_at_idx" on "audit_events" (occurred_at DESC)`,
 	`create index "audit_events_target_idx" on "audit_events" (target_type, target_id, occurred_at DESC)`
 ];
-const up$2 = async (db) => {
+const up$3 = async (db) => {
 	await sql`insert into "sequences" (name, value) values ('audit_events_seq', 0)`.execute(db);
 	await sql`alter table "audit_events" rename to "audit_events_before_seq"`.execute(db);
 	await sql`create table "audit_events" (
@@ -46064,15 +46216,15 @@ const up$2 = async (db) => {
 	await sql`drop table "audit_events_before_seq"`.execute(db);
 	for (const statement of INDEXES) await sql.raw(statement).execute(db);
 };
-const down$2 = async (db) => {
+const down$3 = async (db) => {
 	await sql`alter table "audit_events" drop column "seq"`.execute(db);
 	await sql`delete from "sequences" where name = 'audit_events_seq'`.execute(db);
 };
 //#endregion
 //#region src/db/migrations/sqlite/20261004120000_models_site_scope.ts
 var _20261004120000_models_site_scope_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$2,
+	up: () => up$2
 });
 /**
 * SQLite twin of `../20261004120000_models_site_scope.ts`. `down` rebuilds `models` without `site_id`
@@ -46082,7 +46234,7 @@ var _20261004120000_models_site_scope_exports = /* @__PURE__ */ __exportAll({
 * deletes nothing they reference.
 */
 const NIL_UUID = "00000000-0000-0000-0000-000000000000";
-const up$1 = async (db) => {
+const up$2 = async (db) => {
 	await sql`alter table "models" add column "site_id" text_uuid references sites (id)`.execute(db);
 	await sql`create index "models_site_idx" on "models" (site_id)`.execute(db);
 	await sql`drop index "models_api_key_uq"`.execute(db);
@@ -46092,7 +46244,7 @@ const up$1 = async (db) => {
   `.execute(db);
 	await sql`alter table "schema_drafts" add column "shared" integer_boolean not null default 0`.execute(db);
 };
-const down$1 = async (db) => {
+const down$2 = async (db) => {
 	const { rows } = await sql`select count(*) as count from "models" where site_id is not null`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 0) throw new Error("Cannot roll back per-site schema while definitions belong to a site: two sites may share an API ID. Share or delete the site definitions first.");
 	await sql`alter table "schema_drafts" drop column "shared"`.execute(db);
@@ -46117,15 +46269,15 @@ const down$1 = async (db) => {
 //#endregion
 //#region src/db/migrations/sqlite/20261004130000_site_seo_settings.ts
 var _20261004130000_site_seo_settings_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$1,
+	up: () => up$1
 });
 /**
 * SQLite twin of `../20261004130000_site_seo_settings.ts`. `insert or ignore` stands in for `on conflict do
 * nothing` (the grant's unique index); the permissions version moves only when a grant was added or removed.
 */
 const bumpPermissionsVersion = (db) => sql`update "system_versions" set permissions_version = permissions_version + 1, updated_at = shapio_now()`.execute(db);
-const up = async (db) => {
+const up$1 = async (db) => {
 	await sql`alter table "sites" add column "seo_defaults" text_jsonb`.execute(db);
 	const granted = await sql`
     insert or ignore into "admin_role_permissions" (role_id, action, model_id, condition, field_ids)
@@ -46135,18 +46287,43 @@ const up = async (db) => {
   `.execute(db);
 	if (Number(granted.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion(db);
 };
-const down = async (db) => {
+const down$1 = async (db) => {
 	const revoked = await sql`delete from "admin_role_permissions" where action = 'site.settings'`.execute(db);
 	if (Number(revoked.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion(db);
 	await sql`alter table "sites" drop column "seo_defaults"`.execute(db);
 };
 //#endregion
+//#region src/db/migrations/sqlite/20261005120000_entry_heads_entry_created_at.ts
+var _20261005120000_entry_heads_entry_created_at_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* SQLite twin of `../20261005120000_entry_heads_entry_created_at.ts`. One process holds the write lock, so
+* the backfill is one statement and the index is built here (a plain `CREATE INDEX`; writers wait for it, the
+* documented single-process limitation of ADR 0001, "D2: as built").
+*/
+const INDEX = "entry_heads_entry_order_idx";
+const up = async (db) => {
+	await sql`alter table "entry_heads" add column "entry_created_at" text_timestamptz`.execute(db);
+	await sql`update "entry_heads" set entry_created_at = (
+    select e.created_at from "entries" e where e.id = "entry_heads".entry_id
+  ) where entry_created_at is null`.execute(db);
+	await sql`create index ${sql.id(INDEX)} on "entry_heads" (site_id, model_id, state, entry_created_at desc, entry_id)`.execute(db);
+};
+const down = async (db) => {
+	await sql`drop index if exists ${sql.id(INDEX)}`.execute(db);
+	await sql`alter table "entry_heads" drop column "entry_created_at"`.execute(db);
+};
+//#endregion
 //#region src/db/migrations/sqlite/index.ts
 const SQLITE_MIGRATIONS = {
 	"0001_baseline": _0001_baseline_exports,
 	"20261003170000_audit_events_seq": _20261003170000_audit_events_seq_exports,
 	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports,
-	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports
+	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports,
+	"20261005120000_entry_heads_entry_created_at": _20261005120000_entry_heads_entry_created_at_exports,
+	"20261006120000_system_versions_release": _20261006120000_system_versions_release_exports
 };
 //#endregion
 //#region src/db/migrations/index.ts
@@ -46178,7 +46355,9 @@ const MIGRATIONS = {
 	"20261003160000_create_assist_runs": _20261003160000_create_assist_runs_exports,
 	"20261003170000_audit_events_seq": _20261003170000_audit_events_seq_exports$2,
 	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports$2,
-	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports$2
+	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports$2,
+	"20261005120000_entry_heads_entry_created_at": _20261005120000_entry_heads_entry_created_at_exports$2,
+	"20261006120000_system_versions_release": _20261006120000_system_versions_release_exports
 };
 const PROVIDERS = {
 	postgres: { getMigrations: () => Promise.resolve({ ...MIGRATIONS }) },
@@ -46481,6 +46660,24 @@ const parseByteRange = (header, size) => {
 	};
 };
 //#endregion
+//#region src/media/contentDisposition.ts
+/**
+* A Content-Disposition value that names the file safely: an ASCII fallback plus the RFC 5987 UTF-8 form,
+* so quotes, semicolons or line breaks in a filename can never inject header parameters.
+*/
+const contentDisposition = (filename, type = "inline") => {
+	return `${type}; filename="${filename.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_")}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
+};
+/** Types a browser only ever displays passively: opening one directly cannot run script. */
+const PASSIVE_INLINE_TYPE = /^(image\/(png|jpeg|gif|webp|avif|bmp|tiff|x-icon|vnd\.microsoft\.icon)|video\/.+|audio\/.+)$/;
+/**
+* Content-Disposition to store on an object in a bucket. Public objects can be served straight from the
+* bucket or a CDN, where Shapio's sandboxing headers are absent; anything that could run as a page there
+* (SVG, HTML, XML, PDF...) is stored as an attachment, so opening it downloads it. `<img>` tags still show
+* an SVG, since embedding ignores Content-Disposition.
+*/
+const bucketContentDisposition = (contentType) => PASSIVE_INLINE_TYPE.test(contentType.toLowerCase()) ? void 0 : "attachment";
+//#endregion
 //#region src/services/mediaFiles.ts
 const notFound = () => new AppError(404, "NOT_FOUND", "Media file not found");
 const findFile = async (key) => {
@@ -46908,6 +47105,16 @@ const insertIfAbsent = async (key, value, trx = db) => {
 		value
 	}).onConflict((oc) => oc.column("key").doNothing()).returning("key").executeTakeFirst() !== void 0;
 };
+/** Creates or replaces a setting. */
+const upsertValue = async (key, value, trx = db) => {
+	await trx.insertInto("system_settings").values({
+		key,
+		value
+	}).onConflict((oc) => oc.column("key").doUpdateSet({
+		value,
+		updated_at: /* @__PURE__ */ new Date()
+	})).execute();
+};
 //#endregion
 //#region src/services/signingSecret.ts
 const SIGNING_SECRET_SETTING = "signing_secret";
@@ -47413,20 +47620,6 @@ var StartupCheckError = class extends Error {
 		this.name = "StartupCheckError";
 	}
 };
-/** `host:port/database` (PostgreSQL, MySQL) or the file path (SQLite) from DATABASE_URL, never the credentials. */
-const describeDatabaseTarget = (connectionString) => {
-	if (dialectOfUrl(connectionString) === "sqlite") {
-		const location = sqliteLocationOfUrl(connectionString);
-		return location.kind === "memory" ? "an in-memory database" : location.path;
-	}
-	try {
-		const url = new URL(connectionString);
-		const defaultPort = dialectOfUrl(connectionString) === "mysql" ? "3306" : "5432";
-		return `${url.hostname}:${url.port || defaultPort}${url.pathname}`;
-	} catch {
-		return "the configured database";
-	}
-};
 const NETWORK_REASONS = {
 	ECONNREFUSED: "connection refused",
 	ENOTFOUND: "host not found",
@@ -48924,6 +49117,45 @@ const createPublishingJobHandlers = (environment) => [
 ];
 /** Outbox subscribers: webhook deliveries and deployment triggers follow domain events (ADR 0007). */
 const PUBLISHING_OUTBOX_SUBSCRIBERS = [webhookOutboxSubscriber, deploymentOutboxSubscriber];
+Type.Object({
+	format: Type.Literal(1),
+	publicUrl: Type.String(),
+	basePath: Type.String(),
+	media: Type.Object({
+		publicBaseUrl: Type.Union([Type.String(), Type.Null()]),
+		s3: Type.Union([Type.Object({
+			bucket: Type.String(),
+			region: Type.Union([Type.String(), Type.Null()]),
+			endpoint: Type.Union([Type.String(), Type.Null()]),
+			forcePathStyle: Type.Boolean()
+		}), Type.Null()])
+	})
+});
+const toDeliveryDescriptor = ({ server, storage }) => ({
+	format: 1,
+	publicUrl: server.publicUrl,
+	basePath: server.basePath,
+	media: {
+		publicBaseUrl: storage.publicBaseUrl ?? null,
+		s3: storage.s3 ? {
+			bucket: storage.s3.bucket,
+			region: storage.s3.region ?? null,
+			endpoint: storage.s3.endpoint ?? null,
+			forcePathStyle: storage.s3.forcePathStyle
+		} : null
+	}
+});
+/**
+* Called by the server at every start, after migrating: records its release and its delivery descriptor
+* (rewritten only when it changed), in one transaction.
+*/
+const publishServerRelease = async (database, release, source) => {
+	const descriptor = JSON.stringify(toDeliveryDescriptor(source));
+	await database.transaction().execute(async (trx) => {
+		await setRelease(release, trx);
+		if (await findValue("delivery_descriptor", trx) !== descriptor) await upsertValue(DELIVERY_DESCRIPTOR_SETTING, descriptor, trx);
+	});
+};
 //#endregion
 //#region src/tls/certificates.ts
 /**
@@ -49084,7 +49316,7 @@ const logStartupSummary = (config, logger) => {
 	};
 	logger.info(summary, `Shapio ${summary.version} running at ${summary.url} (mode ${summary.mode}, storage ${summary.storage}, worker ${summary.worker}, tls ${summary.tls})`);
 };
-const createConfiguredWorker = (config, db, logger, signingSecret, extensions) => {
+const createConfiguredWorker = async (config, db, logger, signingSecret, extensions) => {
 	const publishing = createPublishingJobEnvironment(createPublishingRuntime({
 		db,
 		signingSecret,
@@ -49097,7 +49329,7 @@ const createConfiguredWorker = (config, db, logger, signingSecret, extensions) =
 		urls: createUrlBuilder(config.server),
 		transport: createEmailTransport(config.email, logger.child({ component: "email" }))
 	};
-	const storage = createMediaStorage(config.storage, { urls: createUrlBuilder(config.server) });
+	const storage = await createMediaStorage(config.storage, { urls: createUrlBuilder(config.server) });
 	return createWorker({
 		db,
 		handlers: createJobHandlers([
@@ -49178,6 +49410,7 @@ const startServer = async (config) => {
 			log: logger
 		});
 		const signingSecret = await resolveSigningSecret(db, config.sessionSecret, logger);
+		await publishServerRelease(db, SHAPIO_VERSION, config);
 		extensions = await startExtensions(config, db, logger, project);
 		const app = await buildApp(config, {
 			db,
@@ -49187,7 +49420,7 @@ const startServer = async (config) => {
 			schemaListen: config.schema.listen,
 			...tls.initial ? { tls: tls.initial } : {}
 		});
-		const worker = config.worker.mode === "inline" ? createConfiguredWorker(config, db, logger, signingSecret, extensions) : void 0;
+		const worker = config.worker.mode === "inline" ? await createConfiguredWorker(config, db, logger, signingSecret, extensions) : void 0;
 		const tlsRuntime = tls;
 		const extensionRuntime = extensions;
 		let closing;
@@ -49261,7 +49494,7 @@ const startDedicatedWorker = async (config) => {
 	}
 	const signingSecret = await resolveSigningSecret(db, config.sessionSecret, logger);
 	const extensions = await startExtensions(config, db, logger, project);
-	const worker = createConfiguredWorker(config, db, logger, signingSecret, extensions);
+	const worker = await createConfiguredWorker(config, db, logger, signingSecret, extensions);
 	await ensureRetentionScheduled(db);
 	await ensureHealthSweepScheduled(db);
 	worker.start();
@@ -49275,6 +49508,6 @@ const startDedicatedWorker = async (config) => {
 	return worker;
 };
 //#endregion
-export { toTypeName as $, update$8 as A, checkThemeContrast as B, BEFORE_EVENTS as C, listForAssets as D, buildEditorManifest as E, RESERVED_FIELD_API_KEYS as F, mergePulledLock as G, hashDefinition as H, RESERVED_TYPE_NAMES as I, schemaFilePath as J, parseDefinition as K, SCHEMA_KIND_DIRECTORIES as L, describeError as M, LOCK_FILE_PATH as N, listLiveByDriver as O, RESERVED_DEFINITION_API_KEYS as P, suggestPlural as Q, SITES_DIRECTORY as R, AFTER_EVENTS as S, EXTENSION_ROUTE_ROOT as T, lockCoversSite as U, foldApiKey as V, lockEntriesForSite as W, serializeDefinition as X, scopeDirectory as Y, serializeLockFile as Z, createLogger as _, loadConfig as a, createStableId as at, SITE_KEY_PATTERN as b, getPendingMigrations as c, sqliteDriverOf as ct, createMediaStorage as d, upgradeLockFile as et, createSite$1 as f, generateToken as g, SYSTEM_CLI_ACTOR as h, assertDatabaseReachable as i, SAFE_LINK_PATTERN as it, STORAGE_DRIVERS$1 as j, lockById$5 as k, migrateToLatest as l, createAdminDirect as m, startServer as n, withSiteCovered as nt, loadEnvFileIfPresent as o, validateRichText as ot, listAllSites as p, parseLockFile as q, copyObjectVerified as r, RICHTEXT_FORMAT as rt, buildApp as s, createDb as st, startDedicatedWorker as t, validateSchema as tt, SHAPIO_VERSION as u, createUrlBuilder as v, EXTENSION_JOB_PREFIX as w, loadProjectConfig as x, loopbackUrl as y, THEME_VARIANTS as z };
+export { parseLockFile as $, buildEditorManifest as A, RESERVED_DEFINITION_API_KEYS as B, loopbackUrl as C, BEFORE_EVENTS as D, AFTER_EVENTS as E, lockById$5 as F, THEME_VARIANTS as G, RESERVED_TYPE_NAMES as H, update$8 as I, hashDefinition as J, checkThemeContrast as K, STORAGE_DRIVERS$1 as L, isValidStorageKey as M, listForAssets as N, EXTENSION_JOB_PREFIX as O, listLiveByDriver as P, parseDefinition as Q, describeError as R, createUrlBuilder as S, loadProjectConfig as T, SCHEMA_KIND_DIRECTORIES as U, RESERVED_FIELD_API_KEYS as V, SITES_DIRECTORY as W, lockEntriesForSite as X, lockCoversSite as Y, mergePulledLock as Z, listAllSites as _, loadConfig as a, toTypeName as at, generateToken as b, bucketContentDisposition as c, withSiteCovered as ct, migrateToLatest as d, createStableId as dt, schemaFilePath as et, SHAPIO_VERSION as f, validateRichText as ft, createSite$1 as g, ObjectNotFoundError as h, assertDatabaseReachable as i, suggestPlural as it, encodeKeyPath as j, EXTENSION_ROUTE_ROOT as k, contentDisposition as l, RICHTEXT_FORMAT as lt, InvalidStorageKeyError as m, sqliteDriverOf as mt, startServer as n, serializeDefinition as nt, loadEnvFileIfPresent as o, upgradeLockFile as ot, createMediaStorage as p, createDb as pt, foldApiKey as q, copyObjectVerified as r, serializeLockFile as rt, buildApp as s, validateSchema as st, startDedicatedWorker as t, scopeDirectory as tt, getPendingMigrations as u, SAFE_LINK_PATTERN as ut, createAdminDirect as v, SITE_KEY_PATTERN as w, createLogger as x, SYSTEM_CLI_ACTOR as y, LOCK_FILE_PATH as z };
 
-//# sourceMappingURL=worker-i1rY2TIZ.js.map
+//# sourceMappingURL=worker-jz_0yAmS.js.map