@shapio/cms 0.4.1 → 0.5.1

package/dist/{worker-BDYDbaea.js → worker-BU-V4qbH.js}

@@ -7,7 +7,6 @@ import Fastify, { LogController } from "fastify";
 import { AliasNode, AndNode, BinaryOperationNode, ColumnNode, ColumnUpdateNode, IdentifierNode, InsertQueryNode, Kysely, ListNode, MysqlAdapter, MysqlIntrospector, MysqlQueryCompiler, OnDuplicateKeyNode, OperationNodeTransformer, OperatorNode, OrNode, OrderByItemNode, ParensNode, PostgresDialect, PrimitiveValueListNode, RawNode, ReferenceNode, SelectAllNode, SelectModifierNode, SelectQueryNode, SelectionNode, SqliteAdapter, SqliteIntrospector, SqliteQueryCompiler, TableNode, UpdateQueryNode, ValueListNode, ValueNode, ValuesNode, WhereNode, sql } from "kysely";
 import pg from "pg";
 import { AsyncLocalStorage } from "node:async_hooks";
-import mysql from "mysql2";
 import { EventEmitter } from "node:events";
 import { DatabaseSync } from "node:sqlite";
 import { Type } from "typebox";
@@ -15,9 +14,6 @@ import { Value } from "typebox/value";
 import { isDeepStrictEqual } from "node:util";
 import { createJiti } from "jiti";
 import { pino } from "pino";
-import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
-import { createPresignedPost } from "@aws-sdk/s3-presigned-post";
-import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 import fp from "fastify-plugin";
 import { hash, verify } from "@node-rs/argon2";
 import cookie from "@fastify/cookie";
@@ -177,6 +173,20 @@ const sqliteLocationOfUrl = (url) => {
 		path
 	};
 };
+/** `host:port/database` (PostgreSQL, MySQL) or the file path (SQLite) from DATABASE_URL, never the credentials. */
+const describeDatabaseTarget = (connectionString) => {
+	if (dialectOfUrl(connectionString) === "sqlite") {
+		const location = sqliteLocationOfUrl(connectionString);
+		return location.kind === "memory" ? "an in-memory database" : location.path;
+	}
+	try {
+		const url = new URL(connectionString);
+		const defaultPort = dialectOfUrl(connectionString) === "mysql" ? "3306" : "5432";
+		return `${url.hostname}:${url.port || defaultPort}${url.pathname}`;
+	} catch {
+		return "the configured database";
+	}
+};
 let current;
 /** The dialect queries are built for. PostgreSQL until a database handle says otherwise. */
 const currentDialect = () => current ?? "postgres";
@@ -1899,9 +1909,10 @@ const MYSQL_TABLES = {
 			"id",
 			"schema_version",
 			"permissions_version",
-			"updated_at"
+			"updated_at",
+			"release"
 		],
-		nullable: [],
+		nullable: ["release"],
 		timestamps: ["updated_at"],
 		uniqueKeys: [{
 			name: "system_versions_pkey",
@@ -2684,6 +2695,13 @@ const typeCast = (field, next) => {
 	return next();
 };
 //#endregion
+//#region src/db/mysql/module.ts
+/**
+* mysql2, loaded on first use. A process on PostgreSQL never loads it, and a bundle of the read path (the
+* in-process delivery runtime) can leave it out as an optional dependency.
+*/
+const loadMysql = async () => (await import("mysql2")).default;
+//#endregion
 //#region src/db/mysql/parameters.ts
 /**
 * Parameters the MySQL connection resolves itself just before a statement runs (ADR 0001, "MySQL").
@@ -2885,7 +2903,7 @@ var MysqlDriver = class {
 		this.databaseKey = mysqlDatabaseKey(options.url);
 	}
 	async init() {
-		const pool = mysql.createPool(mysqlPoolOptions(this.#options.url, this.#options.poolMax, this.#options.applicationName));
+		const pool = (await loadMysql()).createPool(mysqlPoolOptions(this.#options.url, this.#options.poolMax, this.#options.applicationName));
 		pool.on("connection", (connection) => {
 			connection.query(SESSION_SETUP, (error) => {
 				if (error) {
@@ -9435,6 +9453,10 @@ const bumpSchemaVersion = async (trx, now) => {
 		updated_at: now
 	})).returning("schema_version").executeTakeFirstOrThrow()).schema_version;
 };
+/** Records the Shapio release this database is served by (in-process readers compare their own with it). */
+const setRelease = async (release, executor = db) => {
+	await executor.updateTable("system_versions").set({ release }).execute();
+};
 //#endregion
 //#region src/schema/snapshot.ts
 /**
@@ -10412,6 +10434,14 @@ const CONTENT_ACTIONS = [
 	"schemaManage"
 ];
 /**
+* What a delivery role may grant (plan drafts-mode §1): `read`, and `readDrafts`, which lets a delivery token
+* read draft heads (`?publicationState=draft`, GraphQL `publicationState: DRAFT`) on top of `read`. A
+* `readDrafts` grant always covers every model (no model, condition or field list), so one check per request
+* covers relation targets too. Admin and app roles never hold it; admin principals read drafts without it.
+*/
+const DELIVERY_ACTIONS = ["read", "readDrafts"];
+const READ_DRAFTS_ACTION = "readDrafts";
+/**
 * Content actions about the schema rather than one site's entries: network roles only for a shared
 * definition; for a site's own definition, the roles that apply on that site (when the principal acts there).
 */
@@ -12131,14 +12161,25 @@ const groupBindings = (rows) => {
 	}
 	return bindings;
 };
-const KNOWN_ACTIONS = /* @__PURE__ */ new Set([...CONTENT_ACTIONS, ...GLOBAL_ACTIONS]);
+const KNOWN_ACTIONS = /* @__PURE__ */ new Set([
+	...CONTENT_ACTIONS,
+	...DELIVERY_ACTIONS,
+	...GLOBAL_ACTIONS
+]);
+const KNOWN_CONDITIONS = /* @__PURE__ */ new Set(["ownedByPrincipal"]);
+/**
+* A stored grant as this build understands it. Rows written by a newer Shapio may name an action or a row
+* condition this build does not know; they grant nothing here (fail closed). An unknown condition must never
+* read as "no condition", which would widen the grant to every row.
+*/
 const toGrant$1 = (row) => {
 	if (!KNOWN_ACTIONS.has(row.action)) return;
+	if (row.condition !== null && !KNOWN_CONDITIONS.has(row.condition)) return;
 	return {
 		roleId: row.role_id,
 		action: row.action,
 		modelId: row.model_id,
-		condition: row.condition === "ownedByPrincipal" ? "ownedByPrincipal" : null,
+		condition: row.condition,
 		fieldIds: row.field_ids
 	};
 };
@@ -12270,7 +12311,9 @@ const allowsGlobalAction = (grants, action) => grants.some((grant) => grant.acti
 //#endregion
 //#region src/permissions/evaluator.ts
 const NETWORK_ACTION_SET = new Set(NETWORK_ACTIONS);
-const READ_ONLY$1 = /* @__PURE__ */ new Set(["read"]);
+/** Delivery tokens read, and read drafts where their role grants `readDrafts`. */
+const DELIVERY_TOKEN_ACTIONS = new Set(DELIVERY_ACTIONS);
+/** App users and anonymous callers: never `readDrafts`, whatever a role says. */
 const APP_ACTIONS = new Set(APP_CONTENT_ACTIONS);
 /**
 * Which roles a principal holds and how its masks are computed. App users hold the custom app roles assigned
@@ -12297,7 +12340,7 @@ const rolesOf = async (principal, grants, executor, versions) => {
 			roleIds: [principal.roleId],
 			networkRoleIds: [],
 			audience: "delivery",
-			actions: READ_ONLY$1
+			actions: DELIVERY_TOKEN_ACTIONS
 		};
 		case "appUser": return {
 			roleIds: [...await grants.getSiteAppRoleIds(principal.siteId, "authenticated", executor, versions), ...principal.roleIds],
@@ -13400,6 +13443,22 @@ const SITE_QUERY_PARAMETER = "site";
 * and the header that selects the site. CDNs that key on the URL only need `?site=` instead of the header.
 */
 const DELIVERY_VARY = "Authorization, Cookie, Shapio-Site";
+/** `Cache-Control` of delivery responses carrying drafts (REST and GraphQL; plan drafts-mode): never stored. */
+const DRAFTS_CACHE_CONTROL = "private, no-store";
+//#endregion
+//#region src/services/contentContext.ts
+/**
+* The content service context for one call, the same however the call arrived: the site's view of the pinned
+* schema (plan site-schema: shared definitions and the site's own), scoped to the site.
+*/
+const buildContentContext = ({ network, hooks, media, requestId, ip, ...rest }) => ({
+	...rest,
+	snapshot: network.forSite(rest.site.id),
+	hooks: hooks ?? createContentHooks(),
+	...media ? { media } : {},
+	...requestId !== void 0 ? { requestId } : {},
+	...ip !== void 0 ? { ip } : {}
+});
 const NUMERIC_TYPES = /* @__PURE__ */ new Set([
 	"number",
 	"integer",
@@ -13580,6 +13639,8 @@ const RICH_TEXT_MODES = [
 /** What a delivery read returns for rich text when the request does not say (`?richText=`). */
 const DEFAULT_RICH_TEXT_MODE = "json";
 /** `?seo=`: SEO fields as stored, or merged with the site's SEO defaults (plan seo-fields). */
+/** Which heads a delivery read serves (`?publicationState=`, GraphQL's `publicationState`). */
+const PUBLICATION_STATES = ["published", "draft"];
 const SEO_MODES = ["raw", "resolved"];
 const ENTRY_LIST_STATUSES = [
 	"draft",
@@ -14047,6 +14108,7 @@ const TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
 	"snapshot",
 	"richText",
 	"seo",
+	"publicationState",
 	"q",
 	"status",
 	"author"
@@ -14226,6 +14288,18 @@ const parseSeo = (tree, context) => {
 	if (value === "resolved" && !context.model.fields.some((field) => !field.deprecated && isSeoField(field) && context.isReadable(field))) throw queryInvalid(`"${context.model.apiKey}" has no SEO field to resolve`);
 	return { seo: value };
 };
+const PUBLICATION_STATE_SET = new Set(PUBLICATION_STATES);
+/**
+* `?publicationState=published|draft` on delivery reads; whether the caller may read drafts is the service's
+* check.
+*/
+const parsePublicationState = (tree, context) => {
+	const value = single(tree.publicationState, "publicationState");
+	if (value === void 0) return {};
+	if (!context.allowPublicationState) throw queryInvalid("publicationState is only available on the delivery API");
+	if (!PUBLICATION_STATE_SET.has(value)) throw queryInvalid(`"publicationState" must be one of ${PUBLICATION_STATES.join(", ")}`);
+	return { publicationState: value };
+};
 const parseContentQuery = (tree, context) => {
 	for (const key of Object.keys(tree)) if (!TOP_LEVEL_KEYS.has(key)) throw queryInvalid(`Unknown query parameter "${key}"`);
 	const filters = tree.filters;
@@ -14249,6 +14323,7 @@ const parseContentQuery = (tree, context) => {
 		snapshot,
 		...parseRichText(tree, context),
 		...parseSeo(tree, context),
+		...parsePublicationState(tree, context),
 		...parseAdminFilters(tree, context)
 	};
 };
@@ -14868,6 +14943,7 @@ const parseQueryFor = (context, model, policy, rawQuery, options) => parseConten
 	allowAdminFilters: options.allowAdminFilters ?? false,
 	allowRichText: options.allowRichText ?? false,
 	allowSeo: options.allowSeo ?? false,
+	allowPublicationState: options.allowPublicationState ?? false,
 	resolveModel: (modelId) => resolveModelById(context.snapshot, modelId)?.definition
 });
 /** The admin content list: drafts, filtered/sorted/paginated by the same compiler as delivery. */
@@ -14967,13 +15043,12 @@ const SYSTEM_PRINCIPAL = {
 	kind: "system",
 	component: EXTENSION_SYSTEM_COMPONENT
 };
-const contentContext = async (environment, site, principal) => ({
+const contentContext = async (environment, site, principal) => buildContentContext({
 	db: environment.db,
-	snapshot: (await environment.registry.getSnapshot()).forSite(site.id),
+	network: await environment.registry.getSnapshot(),
 	permissions: environment.permissions,
 	actor: principal ?? SYSTEM_PRINCIPAL,
-	site,
-	hooks: createContentHooks()
+	site
 });
 const toReadEntry = (view) => ({
 	id: view.id,
@@ -15258,157 +15333,6 @@ const createLoggerOptions = (config) => ({
 });
 const createLogger = (config) => pino(createLoggerOptions(config));
 //#endregion
-//#region src/media/contentDisposition.ts
-/**
-* A Content-Disposition value that names the file safely: an ASCII fallback plus the RFC 5987 UTF-8 form,
-* so quotes, semicolons or line breaks in a filename can never inject header parameters.
-*/
-const contentDisposition = (filename, type = "inline") => {
-	return `${type}; filename="${filename.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_")}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
-};
-/** Types a browser only ever displays passively: opening one directly cannot run script. */
-const PASSIVE_INLINE_TYPE = /^(image\/(png|jpeg|gif|webp|avif|bmp|tiff|x-icon|vnd\.microsoft\.icon)|video\/.+|audio\/.+)$/;
-/**
-* Content-Disposition to store on an object in a bucket. Public objects can be served straight from the
-* bucket or a CDN, where Shapio's sandboxing headers are absent; anything that could run as a page there
-* (SVG, HTML, XML, PDF...) is stored as an attachment, so opening it downloads it. `<img>` tags still show
-* an SVG, since embedding ignores Content-Disposition.
-*/
-const bucketContentDisposition = (contentType) => PASSIVE_INLINE_TYPE.test(contentType.toLowerCase()) ? void 0 : "attachment";
-//#endregion
-//#region src/media/errors.ts
-/** Thrown by adapters when a key has no object, so callers can tell "missing" from "storage is down". */
-var ObjectNotFoundError = class extends Error {
-	constructor(key, options) {
-		super(`No stored object at ${key}`, options);
-		this.name = "ObjectNotFoundError";
-	}
-};
-var InvalidStorageKeyError = class extends Error {
-	constructor(key) {
-		super(`Not a valid media storage key: ${JSON.stringify(key)}`);
-		this.name = "InvalidStorageKeyError";
-	}
-};
-//#endregion
-//#region src/media/s3Adapter.ts
-/** R2 accepts any region name ("auto" by convention); AWS needs the bucket's real region. */
-const DEFAULT_REGION = "us-east-1";
-const isNotFound$2 = (error) => error instanceof S3ServiceException && (error.$metadata.httpStatusCode === 404 || error.name === "NotFound" || error.name === "NoSuchKey");
-const createS3Client = (config) => new S3Client({
-	region: config.region ?? DEFAULT_REGION,
-	...config.endpoint ? { endpoint: config.endpoint } : {},
-	forcePathStyle: config.forcePathStyle,
-	...config.accessKeyId && config.secretAccessKey ? { credentials: {
-		accessKeyId: config.accessKeyId,
-		secretAccessKey: config.secretAccessKey
-	} } : {},
-	requestChecksumCalculation: "WHEN_REQUIRED",
-	responseChecksumValidation: "WHEN_REQUIRED"
-});
-/**
-* Any S3-compatible service (AWS S3, Cloudflare R2, B2, Spaces, Wasabi, versitygw). Private objects are read
-* through presigned GET URLs; browsers upload straight to the bucket with a presigned POST whose policy
-* limits size and content type, so Shapio never streams upload bytes.
-*/
-const createS3Adapter = ({ config, publicBaseUrl, client }) => {
-	const s3 = client ?? createS3Client(config);
-	const Bucket = config.bucket;
-	const checkKey = (key) => {
-		if (!isValidStorageKey(key)) throw new InvalidStorageKeyError(key);
-		return key;
-	};
-	const head = async (key) => {
-		try {
-			const result = await s3.send(new HeadObjectCommand({
-				Bucket,
-				Key: checkKey(key)
-			}));
-			return {
-				size: result.ContentLength ?? 0,
-				contentType: result.ContentType
-			};
-		} catch (error) {
-			if (isNotFound$2(error)) return;
-			throw error;
-		}
-	};
-	return {
-		driver: "s3",
-		put: async (key, body, { contentType, contentLength }) => {
-			await s3.send(new PutObjectCommand({
-				Bucket,
-				Key: checkKey(key),
-				Body: body,
-				ContentType: contentType,
-				ContentLength: Buffer.isBuffer(body) ? body.length : contentLength,
-				ContentDisposition: bucketContentDisposition(contentType)
-			}));
-		},
-		getStream: async (key, range) => {
-			try {
-				const result = await s3.send(new GetObjectCommand({
-					Bucket,
-					Key: checkKey(key),
-					...range ? { Range: `bytes=${range.start}-${range.end}` } : {}
-				}));
-				if (!result.Body) throw new ObjectNotFoundError(key);
-				return result.Body;
-			} catch (error) {
-				throw isNotFound$2(error) ? new ObjectNotFoundError(key, { cause: error }) : error;
-			}
-		},
-		head,
-		exists: async (key) => await head(key) !== void 0,
-		delete: async (key) => {
-			await s3.send(new DeleteObjectCommand({
-				Bucket,
-				Key: checkKey(key)
-			}));
-		},
-		signedGetUrl: async (key, { expiresInSeconds, filename, contentType }) => getSignedUrl(s3, new GetObjectCommand({
-			Bucket,
-			Key: checkKey(key),
-			ResponseContentType: contentType,
-			ResponseContentDisposition: contentDisposition(filename)
-		}), { expiresIn: expiresInSeconds }),
-		publicUrl: (key) => publicBaseUrl ? `${publicBaseUrl}/${encodeKeyPath(checkKey(key))}` : void 0,
-		presignedUpload: async ({ key, contentType, maxSizeBytes, expiresInSeconds }) => {
-			const disposition = bucketContentDisposition(contentType);
-			const { url, fields } = await createPresignedPost(s3, {
-				Bucket,
-				Key: checkKey(key),
-				Conditions: [
-					[
-						"content-length-range",
-						1,
-						maxSizeBytes
-					],
-					[
-						"eq",
-						"$Content-Type",
-						contentType
-					],
-					...disposition ? [[
-						"eq",
-						"$Content-Disposition",
-						disposition
-					]] : []
-				],
-				Fields: {
-					"Content-Type": contentType,
-					...disposition ? { "Content-Disposition": disposition } : {}
-				},
-				Expires: expiresInSeconds
-			});
-			return {
-				url,
-				fields
-			};
-		}
-	};
-};
-//#endregion
 //#region src/media/origins.ts
 const SAMPLE_KEY = "public/00000000-0000-0000-0000-000000000000/sample/origin-probe";
 const originOf = (url) => {
@@ -15429,6 +15353,7 @@ const resolveMediaOrigins = async (storage) => {
 	const base = originOf(storage.publicBaseUrl);
 	if (base) origins.add(base);
 	if (storage.s3) {
+		const { createS3Adapter } = await import("./s3Adapter-BipoQiwQ.js");
 		const adapter = createS3Adapter({
 			config: storage.s3,
 			publicBaseUrl: void 0
@@ -16086,7 +16011,42 @@ const memoizePermissions = (base, principal) => {
 	};
 };
 //#endregion
+//#region src/permissions/scoped.ts
+const isLazy = (versions) => "read" in versions;
+/**
+* The evaluator at the scope's versions. Inside a transaction before a lazy scope read its versions, the
+* unbound evaluator checks the versions itself through the transaction, so no pooled connection is asked
+* for while the transaction holds one.
+*/
+const boundEvaluator = async (base, versions, executor) => {
+	if (!isLazy(versions)) return base.atVersions?.(versions) ?? base;
+	if (executor && !versions.isRead()) return base;
+	return base.atVersions?.(await versions.read()) ?? base;
+};
+/**
+* One scope's evaluator (an HTTP request, an in-process delivery call): checked against the scope's durable
+* versions (ADR 0005: a revoke applies from the next scope, not mid-scope) and memoized per (principal, action,
+* model) for the scope (`memo.ts`).
+*/
+const scopePermissions = (base, principal, versions) => memoizePermissions({
+	evaluate: async (caller, policyRequest, executor) => (await boundEvaluator(base, versions, executor)).evaluate(caller, policyRequest, executor),
+	canPerform: async (caller, action, executor) => (await boundEvaluator(base, versions, executor)).canPerform(caller, action, executor),
+	canPerformOnSite: async (caller, action, siteId, executor) => (await boundEvaluator(base, versions, executor)).canPerformOnSite(caller, action, siteId, executor)
+}, principal);
+//#endregion
+//#region src/constants/delivery.ts
+/** `system_settings` key of the delivery descriptor the server writes at start (services/deliveryDescriptor.ts). */
+const DELIVERY_DESCRIPTOR_SETTING = "delivery_descriptor";
+//#endregion
 //#region src/repositories/requestState.ts
+/** The site a lookup names, joined to the one `system_versions` row (at most one row matches). */
+const siteJoin = (join, lookup) => {
+	switch (lookup.by) {
+		case "id": return join.on("sites.id", "=", lookup.id);
+		case "key": return join.on("sites.key", "=", lookup.key);
+		case "primary": return join.on("sites.is_primary", "=", true);
+	}
+};
 /**
 * Everything a request checks before its work, in one statement: the durable schema and permissions versions
 * (`system_versions`, one row) and, when asked, the request's site. Read once per request on the pool, before
@@ -16101,13 +16061,7 @@ const read = async (lookup, trx = db) => {
 			site: void 0
 		};
 	}
-	const row = await trx.selectFrom("system_versions").leftJoin("sites", (join) => {
-		switch (lookup.by) {
-			case "id": return join.on("sites.id", "=", lookup.id);
-			case "key": return join.on("sites.key", "=", lookup.key);
-			case "primary": return join.on("sites.is_primary", "=", true);
-		}
-	}).select([
+	const row = await trx.selectFrom("system_versions").leftJoin("sites", (join) => siteJoin(join, lookup)).select([
 		"system_versions.schema_version",
 		"system_versions.permissions_version",
 		"sites.id as site_id",
@@ -16150,27 +16104,15 @@ const getRequestState = (request, lookup) => {
 /** Reads the request's site with its state, or on its own when the state was already read without it. */
 const readRequestSite = async (request, lookup) => request.requestState ? findSite(lookup) : (await getRequestState(request, lookup)).site;
 /**
-* The server's evaluator at the request's versions. Inside a transaction before the state was read (no route
-* does that today), the unbound evaluator checks the versions itself through the transaction, so no pooled
-* connection is asked for while the transaction holds one.
-*/
-const boundPermissions = async (request, executor) => {
-	const base = request.server.permissions;
-	if (executor && !request.requestState) return base;
-	const { versions } = await getRequestState(request);
-	return base.atVersions?.(versions) ?? base;
-};
-/**
 * The request's evaluator: checked against the request's versions, and memoized per (principal, action,
 * model) for the request (`permissions/memo.ts`), for REST as for GraphQL. Create it after site resolution,
 * which settles the principal.
 */
 const getRequestPermissions = (request) => {
-	request.requestPermissions ??= memoizePermissions({
-		evaluate: async (principal, policyRequest, executor) => (await boundPermissions(request, executor)).evaluate(principal, policyRequest, executor),
-		canPerform: async (principal, action, executor) => (await boundPermissions(request, executor)).canPerform(principal, action, executor),
-		canPerformOnSite: async (principal, action, siteId, executor) => (await boundPermissions(request, executor)).canPerformOnSite(principal, action, siteId, executor)
-	}, request.principal);
+	request.requestPermissions ??= scopePermissions(request.server.permissions, request.principal, {
+		read: async () => (await getRequestState(request)).versions,
+		isRead: () => request.requestState !== null
+	});
 	return request.requestPermissions;
 };
 //#endregion
@@ -16413,12 +16355,14 @@ const revokeApiToken = async (context, permissions, id) => {
 		});
 	});
 };
+/** Whether a token with this expiry has expired at `now`. */
+const isTokenExpired = (expiresAt, now) => expiresAt !== null && expiresAt.getTime() <= now.getTime();
 /** The principal for a bearer API token, or undefined when unknown, revoked or expired. */
-const resolveApiToken = async (value, now = /* @__PURE__ */ new Date()) => {
-	const row = await findLiveByHash$1(hashToken(value));
-	if (!row || row.expires_at !== null && row.expires_at.getTime() <= now.getTime()) return;
+const resolveApiToken = async (value, now = /* @__PURE__ */ new Date(), { recordUse = true, executor = db } = {}) => {
+	const row = await findLiveByHash$1(hashToken(value), executor);
+	if (!row || isTokenExpired(row.expires_at, now)) return;
 	const staleBefore = /* @__PURE__ */ new Date(now.getTime() - LAST_SEEN_WRITE_INTERVAL_MS);
-	if (row.last_used_at === null || row.last_used_at.getTime() < staleBefore.getTime()) await touchLastUsed$1(row.id, now, staleBefore);
+	if (recordUse && (row.last_used_at === null || row.last_used_at.getTime() < staleBefore.getTime())) await touchLastUsed$1(row.id, now, staleBefore, executor);
 	return {
 		kind: "token",
 		tokenId: row.id,
@@ -17590,7 +17534,7 @@ const editorManifestPlugin = fp(async (app, { manifest }) => {
 	app.decorate("editorManifest", manifest);
 }, { name: "shapio-editor-manifest" });
 //#endregion
-//#region src/plugins/errorHandler.ts
+//#region src/helpers/errorResponse.ts
 const STATUS_CODES = {
 	400: "BAD_REQUEST",
 	401: "UNAUTHORIZED",
@@ -17607,6 +17551,10 @@ const STATUS_CODES = {
 };
 /** Errors raised by @fastify/csrf-protection (plugins/csrf.ts). */
 const CSRF_ERROR_CODES$1 = /* @__PURE__ */ new Set(["FST_CSRF_INVALID_TOKEN", "FST_CSRF_MISSING_SECRET"]);
+/**
+* The one error shape every endpoint returns, `{ error: { code, message, details? } }`, and its status.
+* Server errors (5xx) never carry their internal text; the caller logs the original error.
+*/
 const toErrorResponse = (error) => {
 	if (error instanceof AppError) {
 		const body = { error: {
@@ -17619,7 +17567,7 @@ const toErrorResponse = (error) => {
 			body
 		};
 	}
-	if (CSRF_ERROR_CODES$1.has(error.code)) return {
+	if (error.code !== void 0 && CSRF_ERROR_CODES$1.has(error.code)) return {
 		statusCode: 403,
 		body: { error: {
 			code: "CSRF_INVALID",
@@ -17654,6 +17602,8 @@ const toErrorResponse = (error) => {
 		} }
 	};
 };
+//#endregion
+//#region src/plugins/errorHandler.ts
 /** The single error handler: consistent `{ error: { code, message, details? } }` bodies and logging. */
 const errorHandlerPlugin = fp(async (app) => {
 	app.decorateRequest("errorCode", void 0);
@@ -18097,10 +18047,11 @@ const csrfForGet = (app) => (request, reply, done) => {
 /**
 * Responses vary by credentials. GET queries get REST's validators (a strong ETag over the body, 304 on a
 * match) and its caching policy (public for anonymous callers, private otherwise); everything else is
-* never stored.
+* never stored. An operation that read drafts (the controller set `DRAFTS_CACHE_CONTROL`) keeps it.
 */
 const cacheHeaders = async (request, reply, payload) => {
 	appendVary(reply, DELIVERY_VARY);
+	if (reply.getHeader("cache-control") === "private, no-store") return payload;
 	if (request.method !== "GET" || reply.statusCode !== 200 || typeof payload !== "string") {
 		reply.header("cache-control", "no-store");
 		return payload;
@@ -18223,6 +18174,14 @@ const createMysqlNotificationListener = (options) => {
 		});
 	};
 	const connect = async () => {
+		if (closed) return;
+		let mysql;
+		try {
+			mysql = await loadMysql();
+		} catch (error) {
+			log.error({ err: error }, "mysql2 could not be loaded; notifications are off");
+			return;
+		}
 		if (closed) return;
 		const current = mysql.createConnection(mysqlPoolOptions(connectionString, 1, options.applicationName ?? "shapio-listen"));
 		connection = current;
@@ -18980,6 +18939,49 @@ const createLoaders = (siteId, content) => {
 	};
 };
 //#endregion
+//#region src/schema/codegen/graphql/requestContext.ts
+/**
+* The context every resolver of one operation receives, with its own DataLoaders. Carries no HTTP objects, so
+* an operation can run outside a request.
+*/
+const createGraphqlContext = ({ site, permissions, content }) => {
+	let base;
+	let drafts = false;
+	const contentAt = async (snapshot) => {
+		base ??= content(snapshot);
+		return {
+			...await base,
+			snapshot,
+			permissions
+		};
+	};
+	return {
+		permissions,
+		markDrafts: () => {
+			drafts = true;
+		},
+		readDrafts: () => drafts,
+		site,
+		loaders: createLoaders(() => site.id, contentAt),
+		content: contentAt
+	};
+};
+//#endregion
+//#region src/helpers/siteQuery.ts
+const isSiteSegment = (segment) => {
+	const key = segment.split("=", 1)[0] ?? "";
+	try {
+		return decodeURIComponent(key.replace(/\+/g, " ")) === SITE_QUERY_PARAMETER;
+	} catch {
+		return false;
+	}
+};
+/**
+* A raw querystring (without `?`) without its `site` parameter: site resolution consumes it, and the content
+* compiler refuses unknown keys. The rest is left exactly as sent (bracket syntax is the compiler's to parse).
+*/
+const withoutSiteParameter = (rawQuery) => rawQuery.split("&").filter((segment) => !isSiteSegment(segment)).join("&");
+//#endregion
 //#region src/controllers/contentContext.ts
 /**
 * The service context for a content request: the pinned snapshot, the principal and dependencies.
@@ -18987,9 +18989,9 @@ const createLoaders = (siteId, content) => {
 * memoized per (principal, action, model), so the read, relation visibility, populate and usage recording
 * evaluate each model's policy once.
 */
-const contentContextFor = async (request) => ({
+const contentContextFor = async (request) => buildContentContext({
 	db: request.server.db,
-	snapshot: await getRequestSchema(request),
+	network: await getRequestNetworkSchema(request),
 	permissions: getRequestPermissions(request),
 	actor: request.principal,
 	site: getRequestSite(request),
@@ -19001,14 +19003,6 @@ const contentContextFor = async (request) => ({
 	requestId: request.id,
 	ip: request.ip
 });
-const isSiteSegment = (segment) => {
-	const key = segment.split("=", 1)[0] ?? "";
-	try {
-		return decodeURIComponent(key.replace(/\+/g, " ")) === SITE_QUERY_PARAMETER;
-	} catch {
-		return false;
-	}
-};
 /**
 * The raw querystring (bracket syntax is parsed by the content compiler, not Fastify's flat parser), without
 * `?site=`: site resolution (plugins/siteResolution.ts) consumed it, and the compiler refuses unknown keys.
@@ -19016,34 +19010,16 @@ const isSiteSegment = (segment) => {
 const rawQueryOf = (request) => {
 	const index = request.url.indexOf("?");
 	if (index === -1) return "";
-	return request.url.slice(index + 1).split("&").filter((segment) => !isSiteSegment(segment)).join("&");
+	return withoutSiteParameter(request.url.slice(index + 1));
 };
 //#endregion
 //#region src/controllers/graphqlContext.ts
-/** Admin users and admin-scope API tokens: may read drafts. */
-const isAdminPrincipal = (principal) => principal.kind === "admin" || principal.kind === "token" && principal.scope === "admin";
 /** The context every resolver of one `/api/graphql` request receives (built after site resolution). */
-const createGraphqlRequestContext = (request) => {
-	const site = getRequestSite(request);
-	const permissions = getRequestPermissions(request);
-	let base;
-	const content = async (snapshot) => {
-		base ??= contentContextFor(request);
-		return {
-			...await base,
-			snapshot,
-			permissions
-		};
-	};
-	return {
-		request,
-		permissions,
-		isAdmin: isAdminPrincipal(request.principal),
-		site,
-		loaders: createLoaders(() => site.id, content),
-		content
-	};
-};
+const createGraphqlRequestContext = (request) => createGraphqlContext({
+	site: getRequestSite(request),
+	permissions: getRequestPermissions(request),
+	content: () => contentContextFor(request)
+});
 //#endregion
 //#region src/controllers/graphql.ts
 const introspectionDisabled = () => new AppError(403, "INTROSPECTION_DISABLED", "Schema introspection needs an admin session or an API token (or GRAPHQL_PUBLIC_INTROSPECTION=true)");
@@ -19077,8 +19053,10 @@ const runGraphql = async (request, reply, input) => {
 	}
 	if (prepared.selectsIntrospection && !mayIntrospect) throw introspectionDisabled();
 	const usage = collectUsage(request, schema, prepared.document, prepared.operation, input.variables ?? void 0);
-	const result = await executeOperation(schema, prepared, input, createGraphqlRequestContext(request));
+	const context = createGraphqlRequestContext(request);
+	const result = await executeOperation(schema, prepared, input, context);
 	recordUsage$1(request, usage, result.data !== null && result.data !== void 0);
+	if (context.readDrafts()) reply.header("cache-control", DRAFTS_CACHE_CONTROL);
 	return send$1(reply, formatGraphqlResult(result, { log: request.log }));
 };
 const postGraphql = async (request, reply) => runGraphql(request, reply, request.body);
@@ -19492,7 +19470,7 @@ const createFixedTypes = () => {
 		entry: createEntry$2(),
 		publicationState: new GraphQLEnumType({
 			name: "PublicationState",
-			description: "DRAFT is for admin principals only (previews).",
+			description: "DRAFT is for admin principals and delivery tokens granted Read drafts (development servers).",
 			values: {
 				PUBLISHED: { value: "published" },
 				DRAFT: { value: "draft" }
@@ -20473,6 +20451,26 @@ const restFieldReads = async ({ snapshot, model, policy, query, policyFor }) =>
 	return reads;
 };
 //#endregion
+//#region src/services/draftAccess.ts
+/**
+* Who may read draft heads through the delivery API (plan drafts-mode §1). Admin users, admin-scope tokens
+* and Shapio itself always could (GraphQL previews). A delivery token may when its role grants `readDrafts`,
+* which always covers every model, so this one check per request also covers relation targets. App users and
+* anonymous callers never may, whatever a role says (the evaluator denies them too). The caller has already
+* checked `read` on the model.
+*/
+const isAdminPrincipal = (principal) => principal.kind === "system" || principal.kind === "admin" || principal.kind === "token" && principal.scope === "admin";
+const draftsForbidden = (message) => new AppError(403, "DRAFTS_FORBIDDEN", message);
+const assertMayReadDrafts = async (context, modelId, modelKey) => {
+	const { actor } = context;
+	if (isAdminPrincipal(actor)) return;
+	if (actor.kind !== "token") throw draftsForbidden("Drafts need an admin user or a delivery token granted Read drafts");
+	if (!(await context.permissions.evaluate(actor, {
+		action: "readDrafts",
+		modelId
+	})).allowed) throw draftsForbidden(`This token may not read drafts of "${modelKey}"; grant Read drafts on its delivery role`);
+};
+//#endregion
 //#region src/services/contentDelivery.ts
 const readableModel = async (context, modelKey) => {
 	const model = resolveModel(context.snapshot, modelKey);
@@ -20486,10 +20484,19 @@ const readableModel = async (context, modelKey) => {
 		policy
 	};
 };
-/** The heads a read serves: drafts (GraphQL previews), a pinned snapshot, or the published heads. */
-const sourceOf = (query, options) => {
-	if (query.snapshot !== void 0 && options.drafts) throw queryInvalid("snapshot reads published content; it cannot be combined with drafts");
-	return options.drafts ? {
+/** Whether a read asks for drafts: GraphQL's option, or `?publicationState=draft`. */
+const readsDrafts = (query, options) => options.drafts === true || query.publicationState === "draft";
+/**
+* A draft read must be allowed: `read` was checked already; `readDrafts` (or an admin principal) is checked
+* here.
+*/
+const authorizeDrafts$1 = async (context, model, modelKey, drafts) => {
+	if (drafts) await assertMayReadDrafts(context, model.definition.id, modelKey);
+};
+/** The heads a read serves: drafts, a pinned snapshot, or the published heads. */
+const sourceOf = (query, drafts) => {
+	if (query.snapshot !== void 0 && drafts) throw queryInvalid("snapshot reads published content; it cannot be combined with drafts");
+	return drafts ? {
 		kind: "heads",
 		state: "draft"
 	} : query.snapshot !== void 0 ? {
@@ -20510,7 +20517,7 @@ const snapshotCheck = (query) => (current) => {
 */
 const recordUsage = async (context, options, model, policy, query) => {
 	const principalKey = usagePrincipalKey(context.actor);
-	if (!options.usage || options.drafts || principalKey === null) return;
+	if (!options.usage || readsDrafts(query, options) || principalKey === null) return;
 	const reads = await restFieldReads({
 		snapshot: context.snapshot,
 		model,
@@ -20538,8 +20545,24 @@ const ITEM_PARAMETERS$1 = /* @__PURE__ */ new Set([
 	"locale",
 	"snapshot",
 	"richText",
-	"seo"
+	"seo",
+	"publicationState"
 ]);
+const DELIVERY_PARSE = {
+	allowSnapshot: true,
+	allowRichText: true,
+	allowSeo: true,
+	allowPublicationState: true
+};
+/** Meta every delivery response carries; draft reads add `publicationState` (published ones are unchanged). */
+const metaOf$1 = (locale, snapshot, drafts) => drafts ? {
+	locale,
+	snapshot,
+	publicationState: "draft"
+} : {
+	locale,
+	snapshot
+};
 /** Reading one entry takes only these query parameters; anything else is refused, not ignored. */
 const assertItemParameters = (rawQuery, allowed) => {
 	const unsupported = [...new URLSearchParams(rawQuery).keys()].find((key) => !allowed.has(key.split("[")[0] ?? key));
@@ -20548,16 +20571,15 @@ const assertItemParameters = (rawQuery, allowed) => {
 /** `GET /api/content/:modelKey`: a page of a collection, or a singleton's one entry. */
 const listDelivery$1 = async (context, modelKey, rawQuery, options = {}) => {
 	const { model, policy } = await readableModel(context, modelKey);
-	const query = parseQueryFor(context, model, policy, rawQuery, {
-		allowSnapshot: true,
-		allowRichText: true,
-		allowSeo: true
-	});
+	const query = parseQueryFor(context, model, policy, rawQuery, DELIVERY_PARSE);
+	const drafts = readsDrafts(query, options);
+	const source = sourceOf(query, drafts);
+	await authorizeDrafts$1(context, model, modelKey, drafts);
 	const locale = query.locale ?? context.snapshot.defaultLocale;
 	const singleton = model.definition.kind === "singleton";
 	const { entries, limit, total, seq } = await readEntryPage({
 		context,
-		source: sourceOf(query, options),
+		source,
 		model,
 		policy,
 		query,
@@ -20573,34 +20595,32 @@ const listDelivery$1 = async (context, modelKey, rawQuery, options = {}) => {
 		if (!entry) throw entryNotFound(modelKey);
 		result = {
 			data: entry,
-			meta: {
-				locale,
-				snapshot
-			}
+			meta: metaOf$1(locale, snapshot, drafts)
 		};
 	} else result = {
 		data: entries,
 		meta: {
-			locale,
-			snapshot,
+			...metaOf$1(locale, snapshot, drafts),
 			pagination: paginationMeta(query.page, limit, total)
 		}
 	};
 	await afterRead(options, () => recordUsage(context, options, model, policy, query));
 	return result;
 };
-/** `GET /api/content/:modelKey/:id`: one published entry (404 for drafts, unknown or unreadable entries). */
+/**
+* `GET /api/content/:modelKey/:id`: one published entry (404 for unpublished, unknown or unreadable entries);
+* with drafts, the entry's draft.
+*/
 const getDelivery$1 = async (context, modelKey, id, rawQuery, options = {}) => {
 	assertItemParameters(rawQuery, ITEM_PARAMETERS$1);
 	const { model, policy } = await readableModel(context, modelKey);
-	const query = parseQueryFor(context, model, policy, rawQuery, {
-		allowSnapshot: true,
-		allowRichText: true,
-		allowSeo: true
-	});
+	const query = parseQueryFor(context, model, policy, rawQuery, DELIVERY_PARSE);
+	const drafts = readsDrafts(query, options);
+	const source = sourceOf(query, drafts);
+	await authorizeDrafts$1(context, model, modelKey, drafts);
 	const { entry, seq } = await readOneEntry({
 		context,
-		source: sourceOf(query, options),
+		source,
 		model,
 		policy,
 		query,
@@ -20610,10 +20630,7 @@ const getDelivery$1 = async (context, modelKey, id, rawQuery, options = {}) => {
 	await afterRead(options, () => recordUsage(context, options, model, policy, query));
 	return {
 		data: entry,
-		meta: {
-			locale: query.locale ?? context.snapshot.defaultLocale,
-			snapshot: query.snapshot ?? seq
-		}
+		meta: metaOf$1(query.locale ?? context.snapshot.defaultLocale, query.snapshot ?? seq, drafts)
 	};
 };
 //#endregion
@@ -20758,18 +20775,21 @@ const readArgs = (build) => ({
 	publicationState: {
 		type: build.fixed.publicationState,
 		defaultValue: "published",
-		description: "DRAFT needs an admin user or an admin API token"
+		description: "DRAFT needs an admin user, an admin API token or a delivery token granted Read drafts"
 	},
 	snapshot: {
 		type: GraphQLInt,
 		description: "Read published content as of this publication sequence"
 	}
 });
-const draftsForbidden = () => new AppError(403, "FORBIDDEN", "publicationState DRAFT needs an admin user or an admin API token");
-/** The read scope of a root read; drafts only for admin principals (never delivery principals). */
+/**
+* The read scope of a root read. Drafts: the delivery service checks the caller may read them (admin
+* principals, delivery tokens granted Read drafts; plan drafts-mode) before reading any head, and the
+* response is marked never to be stored.
+*/
 const scopeOf = (args, context) => {
 	const drafts = args.publicationState === "draft";
-	if (drafts && !context.isAdmin) throw draftsForbidden();
+	if (drafts) context.markDrafts();
 	return {
 		locale: args.locale ?? void 0,
 		fallback: args.fallback ?? true,
@@ -21548,6 +21568,21 @@ const graphqlPlugin = fp(async (app, { config, urls }) => {
 	]
 });
 //#endregion
+//#region src/media/errors.ts
+/** Thrown by adapters when a key has no object, so callers can tell "missing" from "storage is down". */
+var ObjectNotFoundError = class extends Error {
+	constructor(key, options) {
+		super(`No stored object at ${key}`, options);
+		this.name = "ObjectNotFoundError";
+	}
+};
+var InvalidStorageKeyError = class extends Error {
+	constructor(key) {
+		super(`Not a valid media storage key: ${JSON.stringify(key)}`);
+		this.name = "InvalidStorageKeyError";
+	}
+};
+//#endregion
 //#region src/media/signing.ts
 const sign = (secret, purpose, subject, expiresAt) => createHmac("sha256", secret).update(`${purpose}\n${subject}\n${expiresAt}`).digest("base64url");
 const safeEqual = (a, b) => {
@@ -21665,9 +21700,10 @@ var StorageNotConfiguredError = class extends Error {
 };
 /**
 * Every adapter this instance can reach. Local disk is always available; S3 whenever its bucket is set,
-* whatever STORAGE_DRIVER says, so assets keep being served while `shapio media migrate` moves them.
+* whatever STORAGE_DRIVER says, so assets keep being served while `shapio media migrate` moves them. The S3
+* adapter (and the AWS SDK) is loaded only then.
 */
-const createMediaStorage = (config, deps) => {
+const createMediaStorage = async (config, deps) => {
 	const adapters = /* @__PURE__ */ new Map();
 	adapters.set("local", createLocalAdapter({
 		root: config.mediaPath,
@@ -21675,10 +21711,13 @@ const createMediaStorage = (config, deps) => {
 		signingSecret: deps.signingSecret,
 		publicBaseUrl: config.publicBaseUrl
 	}));
-	if (config.s3) adapters.set("s3", createS3Adapter({
-		config: config.s3,
-		publicBaseUrl: config.publicBaseUrl
-	}));
+	if (config.s3) {
+		const { createS3Adapter } = await import("./s3Adapter-BipoQiwQ.js");
+		adapters.set("s3", createS3Adapter({
+			config: config.s3,
+			publicBaseUrl: config.publicBaseUrl
+		}));
+	}
 	const get = (driver) => {
 		const adapter = adapters.get(driver);
 		if (!adapter) throw new StorageNotConfiguredError(driver);
@@ -21694,7 +21733,7 @@ const createMediaStorage = (config, deps) => {
 //#region src/plugins/mediaStorage.ts
 /** Exposes the media storage adapters to routes. Registered after the signing secret is resolved. */
 const mediaStoragePlugin = fp(async (app, { storage, urls, signingSecret }) => {
-	app.decorate("mediaStorage", createMediaStorage(storage, {
+	app.decorate("mediaStorage", await createMediaStorage(storage, {
 		urls,
 		signingSecret
 	}));
@@ -22492,7 +22531,8 @@ const outboundPolicy = (runtime, allowPrivateNetwork) => ({
 });
 //#endregion
 //#region src/services/roles.ts
-const CONTENT_ACTION_SET = new Set(CONTENT_ACTIONS);
+const MODEL_ACTION_SET = /* @__PURE__ */ new Set([...CONTENT_ACTIONS, ...DELIVERY_ACTIONS]);
+const DELIVERY_ACTION_SET = new Set(DELIVERY_ACTIONS);
 const GLOBAL_ACTION_SET = new Set(GLOBAL_ACTIONS);
 const FIELD_SCOPED_ACTIONS = /* @__PURE__ */ new Set([
 	"read",
@@ -22519,9 +22559,17 @@ const toRoleView = (role, grants) => ({
 });
 const invalidPermissions = (message, details) => new AppError(400, "INVALID_PERMISSIONS", message, details);
 /**
+* `readDrafts` (plan drafts-mode §1): delivery roles only, and always on every model with no condition or
+* field list, so one check per request covers every model a draft read reaches (relation targets too).
+*/
+const validateReadDrafts = (kind, permission, at) => {
+	if (kind !== "delivery") throw invalidPermissions("Read drafts is for delivery roles only", at);
+	if (permission.modelId !== null || permission.condition !== null || permission.fieldIds !== null) throw invalidPermissions("Read drafts applies to every model, with no condition or field list", at);
+};
+/**
 * The server-side rules for grants (never only the UI): known actions, global actions only without a
-* model, conditions and field lists only where they mean something, delivery roles read-only, no
-* duplicate (action, model) pairs.
+* model, conditions and field lists only where they mean something, delivery roles read-only (`read`, and
+* `readDrafts` on every model), no duplicate (action, model) pairs.
 */
 const validatePermissions = (kind, permissions) => {
 	const seen = /* @__PURE__ */ new Set();
@@ -22531,9 +22579,10 @@ const validatePermissions = (kind, permissions) => {
 			action: permission.action
 		};
 		const isGlobal = GLOBAL_ACTION_SET.has(permission.action);
-		if (!isGlobal && !CONTENT_ACTION_SET.has(permission.action)) throw invalidPermissions("Unknown action", at);
+		if (!isGlobal && !MODEL_ACTION_SET.has(permission.action)) throw invalidPermissions("Unknown action", at);
 		if (isGlobal && (permission.modelId !== null || permission.condition !== null || permission.fieldIds !== null)) throw invalidPermissions("Global actions take no model, condition or field list", at);
-		if (kind === "delivery" && permission.action !== "read") throw invalidPermissions("Delivery roles can only read", at);
+		if (kind === "delivery" && !DELIVERY_ACTION_SET.has(permission.action)) throw invalidPermissions("Delivery roles can only read", at);
+		if (permission.action === "readDrafts") validateReadDrafts(kind, permission, at);
 		if (permission.fieldIds !== null && !FIELD_SCOPED_ACTIONS.has(permission.action)) throw invalidPermissions("Field lists apply to read, create and update only", at);
 		const key = `${permission.action}\u0000${permission.modelId ?? "*"}`;
 		if (seen.has(key)) throw invalidPermissions("Each action may be granted once per model", at);
@@ -22885,7 +22934,11 @@ Type.Enum(SITE_ACTIONS);
 /** What `me.sitePermissions` lists: site actions, and network actions a role on the site grants there. */
 const SitePermissionSchema = Type.Enum([...SITE_ACTIONS, ...SITE_GRANTABLE_ACTION_LIST]);
 const PermissionSchema$1 = Type.Object({
-	action: Type.Enum([...CONTENT_ACTIONS, ...GLOBAL_ACTIONS]),
+	action: Type.Enum([
+		...CONTENT_ACTIONS,
+		READ_DRAFTS_ACTION,
+		...GLOBAL_ACTIONS
+	]),
 	modelId: Type.Union([Type.String({
 		minLength: 1,
 		maxLength: 100
@@ -38999,7 +39052,7 @@ const openStoredBundle = (storage, stored) => storage.get(stored.driver).getStre
 const removeStoredBundle = (storage, stored) => storage.get(stored.driver).delete(stored.key);
 //#endregion
 //#region src/constants/version.ts
-const SHAPIO_VERSION = "0.4.1";
+const SHAPIO_VERSION = "0.5.1";
 //#endregion
 //#region src/repositories/transferExport.ts
 /**
@@ -39791,21 +39844,21 @@ const importContent = async (run, initial) => {
 	});
 };
 /** Deletes live target entries of the bundle's models that the bundle does not have. */
-const prune = async (run, snapshot) => {
+const prune = async (run, network) => {
 	const keep = /* @__PURE__ */ new Set();
 	const models = /* @__PURE__ */ new Set();
 	for await (const { record } of readBundle(await open$1(run))) if (record.type === "entry") {
 		keep.add(record.id);
 		models.add(record.modelId);
 	}
-	const context = {
+	const context = buildContentContext({
 		db: run.deps.db,
-		snapshot,
+		network,
 		permissions: SYSTEM_PERMISSIONS,
 		actor: SYSTEM_ACTOR,
-		site: await getSiteRef(run.payload.siteId, run.deps.db),
-		hooks: createContentHooks()
-	};
+		site: await getSiteRef(run.payload.siteId, run.deps.db)
+	});
+	const { snapshot } = context;
 	let failed = [];
 	for (let round = 0; round < PRUNE_ROUNDS; round += 1) {
 		failed = [];
@@ -39841,7 +39894,7 @@ const runPhase = async (run, phase) => {
 		case "media": return importMedia(run);
 		case "entries": return importEntryRows(run, await loadSiteSnapshot(run));
 		case "content": return importContent(run, await loadSiteSnapshot(run));
-		case "prune": return run.payload.prune ? prune(run, await loadSiteSnapshot(run)) : void 0;
+		case "prune": return run.payload.prune ? prune(run, await loadSnapshot(run.deps.db)) : void 0;
 		case "cleanup": return removeStoredBundle(run.deps.storage, run.payload.bundle).catch((error) => run.job.log.warn({
 			err: describeError(error),
 			key: run.payload.bundle.key
@@ -41149,18 +41202,22 @@ const appAuthRoutes = async (app) => {
 };
 //#endregion
 //#region src/controllers/delivery.ts
+const cacheControlOf = (request, noStore) => {
+	if (noStore) return DRAFTS_CACHE_CONTROL;
+	return request.principal.kind === "anonymous" ? "public, max-age=0, must-revalidate" : "private, max-age=0, must-revalidate";
+};
 /**
 * Delivery responses are cacheable by validators: a strong ETag over the exact body (so it changes whenever
 * a head version, a populated target or the projection changes), `Vary` on the credentials that select the
 * principal and on the `Shapio-Site` header that selects the site (`?site=` is part of the URL), and `private`
-* caching whenever a principal is authenticated (build plan §4.E6).
+* caching whenever a principal is authenticated (build plan §4.E6). `noStore`: draft reads, never stored.
 */
-const sendCacheable = (request, reply, payload) => {
+const sendCacheable = (request, reply, payload, { noStore = false } = {}) => {
 	const body = JSON.stringify(payload);
 	const etag = `"${createHash("sha256").update(body).digest("base64url").slice(0, 32)}"`;
 	reply.header("etag", etag);
 	appendVary(reply, DELIVERY_VARY);
-	reply.header("cache-control", request.principal.kind === "anonymous" ? "public, max-age=0, must-revalidate" : "private, max-age=0, must-revalidate");
+	reply.header("cache-control", cacheControlOf(request, noStore));
 	const match = request.headers["if-none-match"];
 	if (typeof match === "string" && match.split(",").some((candidate) => candidate.trim() === etag)) return reply.code(304).send();
 	return reply.type("application/json; charset=utf-8").send(body);
@@ -41170,15 +41227,17 @@ const usageOptions = (request) => ({
 	usage: request.server.usage,
 	defer: (task) => request.server.recordUsageAfterResponse(request.log, task)
 });
+/** A delivery response, never stored by a cache when it carries drafts. */
+const sendDelivery = (request, reply, result) => sendCacheable(request, reply, result, { noStore: result.meta.publicationState === "draft" });
 const listDelivery = async (request, reply) => {
 	const context = await contentContextFor(request);
 	const apiKey = apiKeyOfRoute(context.snapshot, request.params.modelKey);
-	return sendCacheable(request, reply, await listDelivery$1(context, apiKey, rawQueryOf(request), usageOptions(request)));
+	return sendDelivery(request, reply, await listDelivery$1(context, apiKey, rawQueryOf(request), usageOptions(request)));
 };
 const getDelivery = async (request, reply) => {
 	const context = await contentContextFor(request);
 	const apiKey = apiKeyOfRoute(context.snapshot, request.params.modelKey);
-	return sendCacheable(request, reply, await getDelivery$1(context, apiKey, request.params.id, rawQueryOf(request), usageOptions(request)));
+	return sendDelivery(request, reply, await getDelivery$1(context, apiKey, request.params.id, rawQueryOf(request), usageOptions(request)));
 };
 //#endregion
 //#region src/controllers/deliveryWrites.ts
@@ -41846,6 +41905,16 @@ const itemParameters = (model, delivery) => [
 			},
 			description: "Rich-text shape: the JSON document, sanitized HTML rendered from it, or both"
 		},
+		{
+			name: "publicationState",
+			in: "query",
+			schema: {
+				type: "string",
+				enum: [...PUBLICATION_STATES],
+				default: "published"
+			},
+			description: "Drafts mode: `draft` reads saved drafts instead of published content. Needs a delivery token whose role grants Read drafts (or an admin user); responses are never cached. Cannot be combined with `snapshot`."
+		},
 		...seoParameters(model)
 	] : []
 ];
@@ -41871,7 +41940,12 @@ const modelPaths = (model) => {
 		type: "object",
 		properties: {
 			locale: { type: "string" },
-			snapshot: { type: "integer" }
+			snapshot: { type: "integer" },
+			publicationState: {
+				type: "string",
+				enum: ["draft"],
+				description: "Present on draft reads only"
+			}
 		}
 	};
 	const listMeta = { allOf: [meta, {
@@ -42293,14 +42367,14 @@ const docsRoutes = async (app) => {
 //#endregion
 //#region src/db/migrations/20261001120000_create_platform_tables.ts
 var _20261001120000_create_platform_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$33,
-	up: () => up$33
+	down: () => down$34,
+	up: () => up$34
 });
 /**
 * Foundation tables shared by every package: durable versions, the job queue, the transactional outbox
 * and the audit log. Statuses are text with CHECK constraints so new states need only a constraint change.
 */
-const up$33 = async (db) => {
+const up$34 = async (db) => {
 	await db.schema.createTable("system_versions").addColumn("id", "boolean", (col) => col.primaryKey().defaultTo(true).check(sql`id`)).addColumn("schema_version", "integer", (col) => col.notNull().defaultTo(0)).addColumn("permissions_version", "integer", (col) => col.notNull().defaultTo(0)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 	await sql`insert into system_versions default values`.execute(db);
 	await db.schema.createTable("jobs").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("type", "text", (col) => col.notNull()).addColumn("payload", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("status", "text", (col) => col.notNull().defaultTo("pending").check(sql`status in ('pending', 'running', 'succeeded', 'dead')`)).addColumn("priority", "integer", (col) => col.notNull().defaultTo(0)).addColumn("run_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("attempts", "integer", (col) => col.notNull().defaultTo(0)).addColumn("max_attempts", "integer", (col) => col.notNull().defaultTo(10).check(sql`max_attempts > 0`)).addColumn("idempotency_key", "text").addColumn("locked_by", "text").addColumn("locked_until", "timestamptz").addColumn("checkpoint", "jsonb").addColumn("result", "jsonb").addColumn("last_error", "text").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("finished_at", "timestamptz").execute();
@@ -42322,7 +42396,7 @@ const up$33 = async (db) => {
 		"occurred_at desc"
 	]).execute();
 };
-const down$33 = async (db) => {
+const down$34 = async (db) => {
 	await db.schema.dropTable("audit_events").execute();
 	await db.schema.dropTable("outbox_events").execute();
 	await db.schema.dropTable("jobs").execute();
@@ -42331,8 +42405,8 @@ const down$33 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001130000_create_admin_identity.ts
 var _20261001130000_create_admin_identity_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$32,
-	up: () => up$32
+	down: () => down$33,
+	up: () => up$33
 });
 /**
 * Admin identity (package B, ADR 0005): admin users, roles and their permission grants, server-side
@@ -42341,7 +42415,7 @@ var _20261001130000_create_admin_identity_exports = /* @__PURE__ */ __exportAll(
 */
 const withTimestamps$3 = (table) => table.addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`));
 const uuidPrimaryKey$3 = (table) => table.addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`));
-const up$32 = async (db) => {
+const up$33 = async (db) => {
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("admin_users")).addColumn("email", "text", (col) => col.notNull().unique()).addColumn("name", "text", (col) => col.notNull().defaultTo("")).addColumn("password_hash", "text", (col) => col.notNull()).addColumn("status", "text", (col) => col.notNull().defaultTo("active").check(sql`status in ('active', 'disabled')`)).addColumn("last_login_at", "timestamptz").addColumn("password_changed_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`))).execute();
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("admin_roles")).addColumn("key", "text", (col) => col.notNull().unique().check(sql`key ~ '^[a-z][a-z0-9-]{0,62}$'`)).addColumn("name", "text", (col) => col.notNull()).addColumn("description", "text", (col) => col.notNull().defaultTo("")).addColumn("kind", "text", (col) => col.notNull().defaultTo("admin").check(sql`kind in ('admin', 'delivery')`)).addColumn("is_system", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("version", "integer", (col) => col.notNull().defaultTo(1))).execute();
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("admin_role_permissions")).addColumn("role_id", "uuid", (col) => col.notNull().references("admin_roles.id").onDelete("cascade")).addColumn("action", "text", (col) => col.notNull()).addColumn("model_id", "text").addColumn("condition", "text", (col) => col.check(sql`condition in ('ownedByPrincipal')`)).addColumn("field_ids", sql`text[]`).addUniqueConstraint("admin_role_permissions_grant_uq", [
@@ -42361,7 +42435,7 @@ const up$32 = async (db) => {
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("api_tokens")).addColumn("name", "text", (col) => col.notNull()).addColumn("token_hash", "text", (col) => col.notNull().unique()).addColumn("token_prefix", "text", (col) => col.notNull()).addColumn("role_id", "uuid", (col) => col.notNull().references("admin_roles.id").onDelete("restrict")).addColumn("created_by", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("expires_at", "timestamptz").addColumn("last_used_at", "timestamptz").addColumn("revoked_at", "timestamptz")).execute();
 	await db.schema.createIndex("api_tokens_role_idx").on("api_tokens").column("role_id").execute();
 };
-const down$32 = async (db) => {
+const down$33 = async (db) => {
 	await db.schema.dropTable("api_tokens").execute();
 	await db.schema.dropTable("setup_tokens").execute();
 	await db.schema.dropTable("password_resets").execute();
@@ -42375,31 +42449,31 @@ const down$32 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001130500_create_system_settings.ts
 var _20261001130500_create_system_settings_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$31,
-	up: () => up$31
+	down: () => down$32,
+	up: () => up$32
 });
 /**
 * Instance-wide key/value settings that must survive restarts and be shared by every instance, e.g. the
 * generated signing secret. General purpose: later packages add keys, not tables.
 */
-const up$31 = async (db) => {
+const up$32 = async (db) => {
 	await db.schema.createTable("system_settings").addColumn("key", "text", (col) => col.primaryKey()).addColumn("value", "text", (col) => col.notNull()).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 };
-const down$31 = async (db) => {
+const down$32 = async (db) => {
 	await db.schema.dropTable("system_settings").execute();
 };
 //#endregion
 //#region src/db/migrations/20261001140000_create_schema_tables.ts
 var _20261001140000_create_schema_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$30,
-	up: () => up$30
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Schema registry (package D, ADR 0002): models and components (one table, `kind` discriminator), immutable
 * schema revisions, the per-model active pointer, schema change jobs, locales and schema settings.
 * Model definitions are data: creating or changing a model never runs DDL (CONTRIBUTING.md rule 1).
 */
-const up$30 = async (db) => {
+const up$31 = async (db) => {
 	await db.schema.createTable("models").addColumn("id", "uuid", (col) => col.primaryKey()).addColumn("kind", "text", (col) => col.notNull().check(sql`kind in ('collection', 'singleton', 'component')`)).addColumn("api_key", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("deleted_at", "timestamptz").execute();
 	await sql`create unique index models_api_key_uq on models (lower(api_key)) where deleted_at is null`.execute(db);
 	await db.schema.createTable("schema_revisions").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("model_id", "uuid", (col) => col.notNull().references("models.id").onDelete("restrict")).addColumn("version", "integer", (col) => col.notNull().check(sql`version > 0`)).addColumn("definition", "jsonb", (col) => col.notNull()).addColumn("hash", "text", (col) => col.notNull()).addColumn("parent_revision_id", "uuid", (col) => col.references("schema_revisions.id")).addColumn("created_by_type", "text", (col) => col.notNull()).addColumn("created_by_id", "text").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addUniqueConstraint("schema_revisions_model_version_uq", ["model_id", "version"]).execute();
@@ -42427,7 +42501,7 @@ const up$30 = async (db) => {
 	await db.schema.createTable("schema_settings").addColumn("id", "boolean", (col) => col.primaryKey().defaultTo(true).check(sql`id`)).addColumn("read_only", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("read_only_reason", "text").addColumn("updated_by_type", "text").addColumn("updated_by_id", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 	await sql`insert into schema_settings default values`.execute(db);
 };
-const down$30 = async (db) => {
+const down$31 = async (db) => {
 	await db.schema.dropTable("schema_settings").execute();
 	await db.schema.dropTable("locales").execute();
 	await db.schema.dropTable("schema_change_jobs").execute();
@@ -42439,8 +42513,8 @@ const down$30 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001150000_create_content_tables.ts
 var _20261001150000_create_content_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$29,
-	up: () => up$29
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * Content storage (package E, ADR 0001): entries, immutable content revisions, mutable heads (one per
@@ -42448,7 +42522,7 @@ var _20261001150000_create_content_tables_exports = /* @__PURE__ */ __exportAll(
 * and the publication log behind `?snapshot=N`. User content models never get tables of their own
 * (CONTRIBUTING.md rule 1): their values are JSONB keyed by stable field IDs.
 */
-const up$29 = async (db) => {
+const up$30 = async (db) => {
 	await db.schema.createTable("entries").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("model_id", "uuid", (col) => col.notNull().references("models.id").onDelete("restrict")).addColumn("owner_app_user_id", "uuid").addColumn("created_by_admin_id", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("deleted_at", "timestamptz").execute();
 	await sql`create index entries_model_idx on entries (model_id, created_at) where deleted_at is null`.execute(db);
 	await sql`create index entries_owner_idx on entries (owner_app_user_id) where owner_app_user_id is not null`.execute(db);
@@ -42512,7 +42586,7 @@ const up$29 = async (db) => {
 	await sql`create unique index publication_log_open_uq on publication_log (entry_id, locale) where to_seq is null`.execute(db);
 	await db.schema.createIndex("publication_log_model_seq_idx").on("publication_log").columns(["model_id", "from_seq"]).execute();
 };
-const down$29 = async (db) => {
+const down$30 = async (db) => {
 	await db.schema.dropTable("publication_log").execute();
 	await db.schema.dropTable("publication_state").execute();
 	await db.schema.dropTable("unique_values").execute();
@@ -42525,8 +42599,8 @@ const down$29 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001160000_create_media_tables.ts
 var _20261001160000_create_media_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$28,
-	up: () => up$28
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Media library (package G): folders, assets, image variants, references from content and upload grants.
@@ -42537,7 +42611,7 @@ const withTimestamps$2 = (table) => table.addColumn("created_at", "timestamptz",
 const uuidPrimaryKey$2 = (table) => table.addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`));
 const STORAGE_DRIVER_CHECK = sql`storage_driver in ('local', 's3')`;
 const VISIBILITY_CHECK = sql`visibility in ('public', 'private')`;
-const up$28 = async (db) => {
+const up$29 = async (db) => {
 	await withTimestamps$2(uuidPrimaryKey$2(db.schema.createTable("media_folders")).addColumn("parent_id", "uuid", (col) => col.references("media_folders.id").onDelete("restrict")).addColumn("name", "text", (col) => col.notNull().check(sql`length(name) between 1 and 255`)).addColumn("created_by", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("version", "integer", (col) => col.notNull().defaultTo(1))).execute();
 	await sql`create unique index media_folders_sibling_name_uq on media_folders
     (coalesce(parent_id, '00000000-0000-0000-0000-000000000000'::uuid), lower(name))`.execute(db);
@@ -42566,7 +42640,7 @@ const up$28 = async (db) => {
 	]).execute();
 	await db.schema.createTable("media_upload_grants").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("asset_id", "uuid", (col) => col.notNull()).addColumn("kind", "text", (col) => col.notNull().check(sql`kind in ('create', 'replace')`)).addColumn("storage_driver", "text", (col) => col.notNull().check(STORAGE_DRIVER_CHECK)).addColumn("storage_key", "text", (col) => col.notNull().unique()).addColumn("original_filename", "text", (col) => col.notNull()).addColumn("declared_mime_type", "text", (col) => col.notNull()).addColumn("max_size_bytes", "bigint", (col) => col.notNull()).addColumn("folder_id", "uuid").addColumn("visibility", "text", (col) => col.notNull().check(VISIBILITY_CHECK)).addColumn("created_by", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("created_by_principal", "text", (col) => col.notNull()).addColumn("status", "text", (col) => col.notNull().defaultTo("pending").check(sql`status in ('pending', 'consumed', 'rejected', 'expired')`)).addColumn("expires_at", "timestamptz", (col) => col.notNull()).addColumn("consumed_at", "timestamptz").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 };
-const down$28 = async (db) => {
+const down$29 = async (db) => {
 	await db.schema.dropTable("media_upload_grants").execute();
 	await db.schema.dropTable("media_references").execute();
 	await db.schema.dropTable("media_variants").execute();
@@ -42576,8 +42650,8 @@ const down$28 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001170000_create_publishing_tables.ts
 var _20261001170000_create_publishing_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * Publishing (package H): scheduled publications, releases, webhooks and their delivery log, deployment
@@ -42616,13 +42690,13 @@ const createPreviewTables = async (db) => {
 	await uuidPrimaryKey$1(db.schema.createTable("preview_tokens")).addColumn("token_hash", "text", (col) => col.notNull().unique()).addColumn("token_prefix", "text", (col) => col.notNull()).addColumn("model_id", "uuid", (col) => col.notNull()).addColumn("entry_id", "uuid", (col) => col.references("entries.id").onDelete("cascade")).addColumn("locale", "text").addColumn("connection_id", "uuid", (col) => col.references("deployment_connections.id").onDelete("set null")).addColumn("delivery_role_id", "uuid", (col) => col.references("admin_roles.id").onDelete("set null")).addColumn("created_by", "uuid", (col) => col.notNull().references("admin_users.id").onDelete("cascade")).addColumn("expires_at", "timestamptz", (col) => col.notNull()).addColumn("revoked_at", "timestamptz").addColumn("last_used_at", "timestamptz").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 	await db.schema.createIndex("preview_tokens_entry_idx").on("preview_tokens").columns(["entry_id", "created_at desc"]).execute();
 };
-const up$27 = async (db) => {
+const up$28 = async (db) => {
 	await createSchedulingTables(db);
 	await createWebhookTables(db);
 	await createDeploymentTables(db);
 	await createPreviewTables(db);
 };
-const down$27 = async (db) => {
+const down$28 = async (db) => {
 	await db.schema.dropTable("preview_tokens").execute();
 	await db.schema.dropTable("deployment_runs").execute();
 	await db.schema.dropTable("deployment_connections").execute();
@@ -42635,8 +42709,8 @@ const down$27 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001180000_create_app_users.ts
 var _20261001180000_create_app_users_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * App users (package I, ADR 0005): the end users of sites and apps built on Shapio, with their own roles
@@ -42687,7 +42761,7 @@ const createCredentials = async (db) => {
 	}
 	await db.schema.createTable("app_login_codes").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("app_user_id", "uuid", (col) => col.notNull().references("app_users.id").onDelete("cascade")).addColumn("code_hash", "text", (col) => col.notNull().unique()).addColumn("expires_at", "timestamptz", (col) => col.notNull()).addColumn("used_at", "timestamptz").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 };
-const up$26 = async (db) => {
+const up$27 = async (db) => {
 	await createUsers(db);
 	await createRoles(db);
 	await createCredentials(db);
@@ -42697,7 +42771,7 @@ const up$26 = async (db) => {
       foreign key (owner_app_user_id) references app_users (id) on delete set null
   `.execute(db);
 };
-const down$26 = async (db) => {
+const down$27 = async (db) => {
 	await sql`alter table entries drop constraint if exists entries_owner_app_user_fk`.execute(db);
 	await db.schema.dropTable("app_login_codes").execute();
 	await db.schema.dropTable("app_password_resets").execute();
@@ -42712,8 +42786,8 @@ const down$26 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261002120000_create_extension_hook_runs.ts
 var _20261002120000_create_extension_hook_runs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * Extension points (package K, ADR 0009): the ledger of post-commit lifecycle hooks (`afterCreate`,
@@ -42721,17 +42795,17 @@ var _20261002120000_create_extension_hook_runs_exports = /* @__PURE__ */ __expor
 * as the hook's own database work, so a hook re-run after a worker crash finds its row and is skipped:
 * exactly once for everything the hook does through its transaction.
 */
-const up$25 = async (db) => {
+const up$26 = async (db) => {
 	await db.schema.createTable("extension_hook_runs").addColumn("event_id", "uuid", (col) => col.notNull()).addColumn("hook", "text", (col) => col.notNull()).addColumn("job_id", "uuid").addColumn("completed_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addPrimaryKeyConstraint("extension_hook_runs_pkey", ["event_id", "hook"]).execute();
 };
-const down$25 = async (db) => {
+const down$26 = async (db) => {
 	await db.schema.dropTable("extension_hook_runs").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002130000_app_auth_token_version_and_login_code_pkce.ts
 var _20261002130000_app_auth_token_version_and_login_code_pkce_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * App users (ADR 0005):
@@ -42742,20 +42816,20 @@ var _20261002130000_app_auth_token_version_and_login_code_pkce_exports = /* @__P
 *   sign-in; the one-time login code is only exchanged with the matching verifier. Codes live a minute, so
 *   any pending ones (issued without a challenge) are dropped rather than given a placeholder.
 */
-const up$24 = async (db) => {
+const up$25 = async (db) => {
 	await db.schema.alterTable("app_users").addColumn("token_version", "integer", (col) => col.notNull().defaultTo(0)).execute();
 	await sql`delete from app_login_codes`.execute(db);
 	await db.schema.alterTable("app_login_codes").addColumn("code_challenge", "text", (col) => col.notNull()).execute();
 };
-const down$24 = async (db) => {
+const down$25 = async (db) => {
 	await db.schema.alterTable("app_login_codes").dropColumn("code_challenge").execute();
 	await db.schema.alterTable("app_users").dropColumn("token_version").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002180000_add_publication_log_diff_indexes.ts
 var _20261002180000_add_publication_log_diff_indexes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * The snapshot diff (repositories/snapshotDiff.ts) finds the (entry, locale) pairs whose live period opened
@@ -42764,7 +42838,7 @@ var _20261002180000_add_publication_log_diff_indexes_exports = /* @__PURE__ */ _
 * - `(entry_id, locale, from_seq)`: "the row live at seq N" is the latest row starting at or before N.
 * Periods that opened in the range use the existing `(model_id, from_seq)` index.
 */
-const up$23 = async (db) => {
+const up$24 = async (db) => {
 	await sql`create index publication_log_to_seq_idx on publication_log (to_seq) where to_seq is not null`.execute(db);
 	await db.schema.createIndex("publication_log_entry_locale_from_idx").on("publication_log").columns([
 		"entry_id",
@@ -42772,15 +42846,15 @@ const up$23 = async (db) => {
 		"from_seq"
 	]).execute();
 };
-const down$23 = async (db) => {
+const down$24 = async (db) => {
 	await db.schema.dropIndex("publication_log_entry_locale_from_idx").execute();
 	await db.schema.dropIndex("publication_log_to_seq_idx").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002180100_create_usage_tables.ts
 var _20261002180100_create_usage_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * Field usage from delivery traffic (plan developer-face §5): daily counters written by the in-memory
@@ -42788,7 +42862,7 @@ var _20261002180100_create_usage_tables_exports = /* @__PURE__ */ __exportAll({
 * payloads. `principal_key` is `token:<id>`, `app_users` or `anonymous`. Pruned by the retention job
 * after USAGE_RETENTION_DAYS.
 */
-const up$22 = async (db) => {
+const up$23 = async (db) => {
 	await db.schema.createTable("field_reads").addColumn("day", "date", (col) => col.notNull()).addColumn("model_id", "uuid", (col) => col.notNull()).addColumn("field_path", "text", (col) => col.notNull()).addColumn("principal_key", "text", (col) => col.notNull()).addColumn("selection", "text", (col) => col.notNull().check(sql`selection in ('explicit', 'implicit')`)).addColumn("reads", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_read_at", "timestamptz", (col) => col.notNull()).addPrimaryKeyConstraint("field_reads_pkey", [
 		"day",
 		"model_id",
@@ -42799,15 +42873,15 @@ const up$22 = async (db) => {
 	await db.schema.createIndex("field_reads_model_day_idx").on("field_reads").columns(["model_id", "day"]).execute();
 	await db.schema.createTable("token_reads").addColumn("day", "date", (col) => col.notNull()).addColumn("principal_key", "text", (col) => col.notNull()).addColumn("requests", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_snapshot", "bigint").addColumn("last_read_at", "timestamptz", (col) => col.notNull()).addPrimaryKeyConstraint("token_reads_pkey", ["day", "principal_key"]).execute();
 };
-const down$22 = async (db) => {
+const down$23 = async (db) => {
 	await db.schema.dropTable("token_reads").execute();
 	await db.schema.dropTable("field_reads").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002180200_create_change_sets.ts
 var _20261002180200_create_change_sets_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Change sets (developer-face plan §5, ADR 0010): schema drafts and entry publications that ship as ONE
@@ -42986,7 +43060,7 @@ const migrateReleases = async (db) => {
 	await sql`drop table release_items`.execute(db);
 	await sql`drop table releases`.execute(db);
 };
-const up$21 = async (db) => {
+const up$22 = async (db) => {
 	await createTables(db);
 	await linkExecutionRecords(db);
 	await allowConversionRevisions(db);
@@ -43058,7 +43132,7 @@ const restoreReleases = async (db) => {
 	await sql`update webhooks set events = array_remove(array_remove(events, 'change_set.shipping'),
     'change_set.discarded')`.execute(db);
 };
-const down$21 = async (db) => {
+const down$22 = async (db) => {
 	await restoreReleases(db);
 	await sql`alter table content_revisions drop constraint content_revisions_reason_check`.execute(db);
 	await sql`alter table content_revisions add constraint content_revisions_reason_check
@@ -43079,8 +43153,8 @@ const down$21 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261002190000_create_editor_presence_and_content_health.ts
 var _20261002190000_create_editor_presence_and_content_health_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Editor experience (plan editor-experience §9):
@@ -43091,7 +43165,7 @@ var _20261002190000_create_editor_presence_and_content_health_exports = /* @__PU
 * - `content_health_findings`: open and recently resolved findings of the health rules per entry and
 *   locale (`*` for the entry as a whole). An evaluation upserts what it found and resolves the rest.
 */
-const up$20 = async (db) => {
+const up$21 = async (db) => {
 	await sql`
     create unlogged table editor_presence (
       entry_id uuid not null,
@@ -43128,15 +43202,15 @@ const up$20 = async (db) => {
 	await sql`create index content_health_findings_resolved_idx on content_health_findings (resolved_at)
     where resolved_at is not null`.execute(db);
 };
-const down$20 = async (db) => {
+const down$21 = async (db) => {
 	await sql`drop table content_health_findings`.execute(db);
 	await sql`drop table editor_presence`.execute(db);
 };
 //#endregion
 //#region src/db/migrations/20261003120000_add_changes_ship_permission.ts
 var _20261003120000_add_changes_ship_permission_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * `changes.ship` (agentic plan §I): shipping a change set (and scheduling a ship) becomes its own global
@@ -43144,7 +43218,7 @@ var _20261003120000_add_changes_ship_permission_exports = /* @__PURE__ */ __expo
 * live. Every role that holds `changes.manage` today keeps what it could do: it gets `changes.ship` too.
 * The permissions version moves only when grants changed, so running instances reload exactly then.
 */
-const up$19 = async (db) => {
+const up$20 = async (db) => {
 	await sql`
     with granted as (
       insert into admin_role_permissions (role_id, action, model_id, condition, field_ids)
@@ -43158,7 +43232,7 @@ const up$19 = async (db) => {
     where exists (select 1 from granted)
   `.execute(db);
 };
-const down$19 = async (db) => {
+const down$20 = async (db) => {
 	await sql`
     with revoked as (
       delete from admin_role_permissions where action = 'changes.ship' returning 1
@@ -43170,8 +43244,8 @@ const down$19 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003130000_create_sites.ts
 var _20261003130000_create_sites_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Sites (plan agentic-ecosystem §H, ADR 0011): one instance hosts many sites with one schema and one login.
@@ -43359,7 +43433,7 @@ const siteRoleAssignments = async (db) => {
   `.execute(db);
 	await sql`alter table admin_invitations drop column role_ids`.execute(db);
 };
-const up$18 = async (db) => {
+const up$19 = async (db) => {
 	await createSites(db);
 	await addSiteColumns(db);
 	await tieCopiesToEntries(db);
@@ -43372,7 +43446,7 @@ const assertSingleSite = async (db) => {
 	const { rows } = await sql`select count(*)::text as count from sites`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 1) throw new Error("Cannot roll back sites while more than one site exists: merging them would merge their snapshot ledgers and uniqueness and widen role assignments. Delete the other sites first.");
 };
-const down$18 = async (db) => {
+const down$19 = async (db) => {
 	await assertSingleSite(db);
 	await sql`alter table admin_invitations add column role_ids uuid[] not null default '{}'::uuid[]`.execute(db);
 	await sql`
@@ -43443,8 +43517,8 @@ const down$18 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003140200_enqueue_field_index_layout.ts
 var _20261003140200_enqueue_field_index_layout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Field index layout v2 (sites plan §H): per-field expression indexes on `entry_heads` lead with `site_id`,
@@ -43456,7 +43530,7 @@ var _20261003140200_enqueue_field_index_layout_exports = /* @__PURE__ */ __expor
 */
 const JOB_TYPE$1 = "schema.fieldIndexLayout";
 const IDEMPOTENCY_KEY$1 = "schema.fieldIndexLayout:v2";
-const up$17 = async (db) => {
+const up$18 = async (db) => {
 	await sql`
     insert into jobs (type, payload, max_attempts, idempotency_key)
     select ${JOB_TYPE$1}, '{}'::jsonb, 5, ${IDEMPOTENCY_KEY$1}
@@ -43469,14 +43543,14 @@ const up$17 = async (db) => {
   `.execute(db);
 };
 /** The layout job is idempotent; rolling back only forgets it if it has not run yet. */
-const down$17 = async (db) => {
+const down$18 = async (db) => {
 	await sql`delete from jobs where idempotency_key = ${IDEMPOTENCY_KEY$1} and status = 'pending'`.execute(db);
 };
 //#endregion
 //#region src/db/migrations/20261003140500_change_set_items_site_and_preview_entry.ts
 var _20261003140500_change_set_items_site_and_preview_entry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Sites, publishing (plan agentic-ecosystem §H, package G5).
@@ -43487,7 +43561,7 @@ var _20261003140500_change_set_items_site_and_preview_entry_exports = /* @__PURE
 * - `preview_tokens.entry_id` becomes required: a preview token previews one entry of one site. Model-wide
 *   tokens (short-lived by design) are deleted; whoever needs one opens the entry's preview again.
 */
-const up$16 = async (db) => {
+const up$17 = async (db) => {
 	await sql`alter table change_sets add constraint change_sets_id_site_uq unique (id, site_id)`.execute(db);
 	await sql`alter table change_set_items add column site_id uuid`.execute(db);
 	await sql`
@@ -43503,7 +43577,7 @@ const up$16 = async (db) => {
 	await sql`delete from preview_tokens where entry_id is null`.execute(db);
 	await sql`alter table preview_tokens alter column entry_id set not null`.execute(db);
 };
-const down$16 = async (db) => {
+const down$17 = async (db) => {
 	await sql`alter table preview_tokens alter column entry_id drop not null`.execute(db);
 	await sql`alter table change_set_items drop constraint change_set_items_entry_site_fk`.execute(db);
 	await sql`alter table change_set_items drop constraint change_set_items_set_site_fk`.execute(db);
@@ -43513,8 +43587,8 @@ const down$16 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003150000_widen_deployment_providers.ts
 var _20261003150000_widen_deployment_providers_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Deploy adapters (plan agentic-ecosystem §B2): deployment connections may use the Vercel and Netlify
@@ -43529,11 +43603,11 @@ const replaceCheck = async (db, check) => {
     check (${check}) not valid`.execute(db);
 	await sql`alter table deployment_connections validate constraint deployment_connections_provider_check`.execute(db);
 };
-const up$15 = async (db) => {
+const up$16 = async (db) => {
 	await replaceCheck(db, WIDENED);
 };
 /** Refuses while Vercel or Netlify connections exist: a down migration never deletes user data. */
-const down$15 = async (db) => {
+const down$16 = async (db) => {
 	const { rows } = await sql`
     select count(*)::text as count from deployment_connections where provider in ('vercel', 'netlify')
   `.execute(db);
@@ -43544,8 +43618,8 @@ const down$15 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003160000_create_assist_runs.ts
 var _20261003160000_create_assist_runs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Editor assists (plan agentic-ecosystem §A0, §I): one `assist_runs` row per assist request (who, which
@@ -43561,14 +43635,14 @@ const replaceSourceCheck = async (db, check) => {
 	await sql`alter table change_sets add constraint change_sets_source_check check (${check}) not valid`.execute(db);
 	await sql`alter table change_sets validate constraint change_sets_source_check`.execute(db);
 };
-const up$14 = async (db) => {
+const up$15 = async (db) => {
 	await db.schema.createTable("assist_runs").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("site_id", "uuid", (col) => col.notNull().references("sites.id").onDelete("cascade")).addColumn("actor_type", "text", (col) => col.notNull()).addColumn("actor_id", "text", (col) => col.notNull()).addColumn("action", "text", (col) => col.notNull().check(ACTIONS)).addColumn("rule", "text").addColumn("provider", "text", (col) => col.notNull()).addColumn("model", "text", (col) => col.notNull()).addColumn("input_tokens", "integer", (col) => col.notNull().defaultTo(0)).addColumn("output_tokens", "integer", (col) => col.notNull().defaultTo(0)).addColumn("duration_ms", "integer", (col) => col.notNull().defaultTo(0)).addColumn("status", "text", (col) => col.notNull().check(sql`status in ('queued', 'running', 'succeeded', 'failed')`)).addColumn("error_code", "text").addColumn("job_id", "uuid", (col) => col.references("jobs.id").onDelete("set null")).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("finished_at", "timestamptz").execute();
 	await db.schema.createIndex("assist_runs_site_created_idx").on("assist_runs").columns(["site_id", "created_at"]).execute();
 	await db.schema.createIndex("assist_runs_created_idx").on("assist_runs").column("created_at").execute();
 	await replaceSourceCheck(db, SOURCES_WIDENED);
 };
 /** Refuses while change sets opened by assist exist: a down migration never deletes user data. */
-const down$14 = async (db) => {
+const down$15 = async (db) => {
 	const { rows } = await sql`
     select count(*)::text as count from change_sets where source = 'assist'
   `.execute(db);
@@ -43580,8 +43654,8 @@ const down$14 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003170000_audit_events_seq.ts
 var _20261003170000_audit_events_seq_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * `audit_events.seq`: a monotonic tiebreaker after `occurred_at`, so events written in the same instant (one
@@ -43590,17 +43664,17 @@ var _20261003170000_audit_events_seq_exports$2 = /* @__PURE__ */ __exportAll({
 * are numbered in the order the rewrite reads them. No index: the audit queries filter and sort by
 * `occurred_at` first, and `seq` only breaks ties.
 */
-const up$13 = async (db) => {
+const up$14 = async (db) => {
 	await db.schema.alterTable("audit_events").addColumn("seq", "bigint", (col) => col.notNull().generatedAlwaysAsIdentity()).execute();
 };
-const down$13 = async (db) => {
+const down$14 = async (db) => {
 	await db.schema.alterTable("audit_events").dropColumn("seq").execute();
 };
 //#endregion
 //#region src/db/migrations/20261004120000_models_site_scope.ts
 var _20261004120000_models_site_scope_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * Per-site schema (plan site-schema): a definition belongs to one site (`models.site_id`) or is shared by every
@@ -43613,7 +43687,7 @@ var _20261004120000_models_site_scope_exports$2 = /* @__PURE__ */ __exportAll({
 * over `lower(api_key)` cannot hold. Share or delete them first; then `down` is lossless.
 */
 const NIL_UUID$1 = "00000000-0000-0000-0000-000000000000";
-const up$12 = async (db) => {
+const up$13 = async (db) => {
 	await sql`alter table models add column site_id uuid references sites (id)`.execute(db);
 	await sql`create index models_site_idx on models (site_id)`.execute(db);
 	await sql`drop index models_api_key_uq`.execute(db);
@@ -43623,7 +43697,7 @@ const up$12 = async (db) => {
   `.execute(db);
 	await sql`alter table schema_drafts add column shared boolean not null default false`.execute(db);
 };
-const down$12 = async (db) => {
+const down$13 = async (db) => {
 	const { rows } = await sql`select count(*)::text as count from models where site_id is not null`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 0) throw new Error("Cannot roll back per-site schema while definitions belong to a site: two sites may share an API ID. Share or delete the site definitions first.");
 	await sql`alter table schema_drafts drop column shared`.execute(db);
@@ -43635,8 +43709,8 @@ const down$12 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261004130000_site_seo_settings.ts
 var _20261004130000_site_seo_settings_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * SEO defaults per site (plan seo-fields): `sites.seo_defaults` holds the site's default texts per locale, its
@@ -43647,7 +43721,7 @@ var _20261004130000_site_seo_settings_exports$2 = /* @__PURE__ */ __exportAll({
 * about what a site publishes) gets it; the built-in owner and admin roles get it from `ensureSystemRoles`.
 * The permissions version moves only when grants changed, so running instances reload exactly then.
 */
-const up$11 = async (db) => {
+const up$12 = async (db) => {
 	await sql`alter table sites add column seo_defaults jsonb`.execute(db);
 	await sql`
     with granted as (
@@ -43662,7 +43736,7 @@ const up$11 = async (db) => {
     where exists (select 1 from granted)
   `.execute(db);
 };
-const down$11 = async (db) => {
+const down$12 = async (db) => {
 	await sql`
     with revoked as (
       delete from admin_role_permissions where action = 'site.settings' returning 1
@@ -43675,8 +43749,8 @@ const down$11 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261005120000_entry_heads_entry_created_at.ts
 var _20261005120000_entry_heads_entry_created_at_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * Delivery perf 2 (ADR 0001 amendment): the entry's `created_at` on each head (`entry_created_at`), so a list
@@ -43693,7 +43767,7 @@ const INDEX$2 = "entry_heads_entry_order_idx";
 const JOB_TYPE = "schema.entryOrderIndex";
 const IDEMPOTENCY_KEY = "schema.entryOrderIndex:v1";
 const BATCH$1 = 5e3;
-const up$10 = async (db) => {
+const up$11 = async (db) => {
 	await sql`alter table entry_heads add column entry_created_at timestamptz`.execute(db);
 	for (;;) {
 		const result = await sql`
@@ -43718,12 +43792,25 @@ const up$10 = async (db) => {
     create index ${sql.id(INDEX$2)} on entry_heads (site_id, model_id, state, entry_created_at desc, entry_id)
   `.execute(db);
 };
-const down$10 = async (db) => {
+const down$11 = async (db) => {
 	await sql`delete from jobs where idempotency_key = ${IDEMPOTENCY_KEY} and status = 'pending'`.execute(db);
 	await sql`drop index if exists ${sql.id(INDEX$2)}`.execute(db);
 	await sql`alter table entry_heads drop column entry_created_at`.execute(db);
 };
 //#endregion
+//#region src/db/migrations/20261006120000_system_versions_release.ts
+var _20261006120000_system_versions_release_exports = /* @__PURE__ */ __exportAll({
+	dialectNeutral: () => true,
+	down: () => down$10,
+	up: () => up$10
+});
+const up$10 = async (db) => {
+	await db.schema.alterTable("system_versions").addColumn("release", "text").execute();
+};
+const down$10 = async (db) => {
+	await db.schema.alterTable("system_versions").dropColumn("release").execute();
+};
+//#endregion
 //#region src/db/migrations/mysql/0001_baseline.ts
 var _0001_baseline_exports$1 = /* @__PURE__ */ __exportAll({
 	down: () => down$9,
@@ -45025,7 +45112,8 @@ const MYSQL_MIGRATIONS = {
 	"20261003170000_audit_events_seq": _20261003170000_audit_events_seq_exports$1,
 	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports$1,
 	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports$1,
-	"20261005120000_entry_heads_entry_created_at": _20261005120000_entry_heads_entry_created_at_exports$1
+	"20261005120000_entry_heads_entry_created_at": _20261005120000_entry_heads_entry_created_at_exports$1,
+	"20261006120000_system_versions_release": _20261006120000_system_versions_release_exports
 };
 //#endregion
 //#region src/db/migrations/sqlite/0001_baseline.ts
@@ -46348,7 +46436,8 @@ const SQLITE_MIGRATIONS = {
 	"20261003170000_audit_events_seq": _20261003170000_audit_events_seq_exports,
 	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports,
 	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports,
-	"20261005120000_entry_heads_entry_created_at": _20261005120000_entry_heads_entry_created_at_exports
+	"20261005120000_entry_heads_entry_created_at": _20261005120000_entry_heads_entry_created_at_exports,
+	"20261006120000_system_versions_release": _20261006120000_system_versions_release_exports
 };
 //#endregion
 //#region src/db/migrations/index.ts
@@ -46381,7 +46470,8 @@ const MIGRATIONS = {
 	"20261003170000_audit_events_seq": _20261003170000_audit_events_seq_exports$2,
 	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports$2,
 	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports$2,
-	"20261005120000_entry_heads_entry_created_at": _20261005120000_entry_heads_entry_created_at_exports$2
+	"20261005120000_entry_heads_entry_created_at": _20261005120000_entry_heads_entry_created_at_exports$2,
+	"20261006120000_system_versions_release": _20261006120000_system_versions_release_exports
 };
 const PROVIDERS = {
 	postgres: { getMigrations: () => Promise.resolve({ ...MIGRATIONS }) },
@@ -46684,6 +46774,24 @@ const parseByteRange = (header, size) => {
 	};
 };
 //#endregion
+//#region src/media/contentDisposition.ts
+/**
+* A Content-Disposition value that names the file safely: an ASCII fallback plus the RFC 5987 UTF-8 form,
+* so quotes, semicolons or line breaks in a filename can never inject header parameters.
+*/
+const contentDisposition = (filename, type = "inline") => {
+	return `${type}; filename="${filename.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_")}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
+};
+/** Types a browser only ever displays passively: opening one directly cannot run script. */
+const PASSIVE_INLINE_TYPE = /^(image\/(png|jpeg|gif|webp|avif|bmp|tiff|x-icon|vnd\.microsoft\.icon)|video\/.+|audio\/.+)$/;
+/**
+* Content-Disposition to store on an object in a bucket. Public objects can be served straight from the
+* bucket or a CDN, where Shapio's sandboxing headers are absent; anything that could run as a page there
+* (SVG, HTML, XML, PDF...) is stored as an attachment, so opening it downloads it. `<img>` tags still show
+* an SVG, since embedding ignores Content-Disposition.
+*/
+const bucketContentDisposition = (contentType) => PASSIVE_INLINE_TYPE.test(contentType.toLowerCase()) ? void 0 : "attachment";
+//#endregion
 //#region src/services/mediaFiles.ts
 const notFound = () => new AppError(404, "NOT_FOUND", "Media file not found");
 const findFile = async (key) => {
@@ -47111,6 +47219,16 @@ const insertIfAbsent = async (key, value, trx = db) => {
 		value
 	}).onConflict((oc) => oc.column("key").doNothing()).returning("key").executeTakeFirst() !== void 0;
 };
+/** Creates or replaces a setting. */
+const upsertValue = async (key, value, trx = db) => {
+	await trx.insertInto("system_settings").values({
+		key,
+		value
+	}).onConflict((oc) => oc.column("key").doUpdateSet({
+		value,
+		updated_at: /* @__PURE__ */ new Date()
+	})).execute();
+};
 //#endregion
 //#region src/services/signingSecret.ts
 const SIGNING_SECRET_SETTING = "signing_secret";
@@ -47616,20 +47734,6 @@ var StartupCheckError = class extends Error {
 		this.name = "StartupCheckError";
 	}
 };
-/** `host:port/database` (PostgreSQL, MySQL) or the file path (SQLite) from DATABASE_URL, never the credentials. */
-const describeDatabaseTarget = (connectionString) => {
-	if (dialectOfUrl(connectionString) === "sqlite") {
-		const location = sqliteLocationOfUrl(connectionString);
-		return location.kind === "memory" ? "an in-memory database" : location.path;
-	}
-	try {
-		const url = new URL(connectionString);
-		const defaultPort = dialectOfUrl(connectionString) === "mysql" ? "3306" : "5432";
-		return `${url.hostname}:${url.port || defaultPort}${url.pathname}`;
-	} catch {
-		return "the configured database";
-	}
-};
 const NETWORK_REASONS = {
 	ECONNREFUSED: "connection refused",
 	ENOTFOUND: "host not found",
@@ -49127,6 +49231,45 @@ const createPublishingJobHandlers = (environment) => [
 ];
 /** Outbox subscribers: webhook deliveries and deployment triggers follow domain events (ADR 0007). */
 const PUBLISHING_OUTBOX_SUBSCRIBERS = [webhookOutboxSubscriber, deploymentOutboxSubscriber];
+Type.Object({
+	format: Type.Literal(1),
+	publicUrl: Type.String(),
+	basePath: Type.String(),
+	media: Type.Object({
+		publicBaseUrl: Type.Union([Type.String(), Type.Null()]),
+		s3: Type.Union([Type.Object({
+			bucket: Type.String(),
+			region: Type.Union([Type.String(), Type.Null()]),
+			endpoint: Type.Union([Type.String(), Type.Null()]),
+			forcePathStyle: Type.Boolean()
+		}), Type.Null()])
+	})
+});
+const toDeliveryDescriptor = ({ server, storage }) => ({
+	format: 1,
+	publicUrl: server.publicUrl,
+	basePath: server.basePath,
+	media: {
+		publicBaseUrl: storage.publicBaseUrl ?? null,
+		s3: storage.s3 ? {
+			bucket: storage.s3.bucket,
+			region: storage.s3.region ?? null,
+			endpoint: storage.s3.endpoint ?? null,
+			forcePathStyle: storage.s3.forcePathStyle
+		} : null
+	}
+});
+/**
+* Called by the server at every start, after migrating: records its release and its delivery descriptor
+* (rewritten only when it changed), in one transaction.
+*/
+const publishServerRelease = async (database, release, source) => {
+	const descriptor = JSON.stringify(toDeliveryDescriptor(source));
+	await database.transaction().execute(async (trx) => {
+		await setRelease(release, trx);
+		if (await findValue("delivery_descriptor", trx) !== descriptor) await upsertValue(DELIVERY_DESCRIPTOR_SETTING, descriptor, trx);
+	});
+};
 //#endregion
 //#region src/tls/certificates.ts
 /**
@@ -49287,7 +49430,7 @@ const logStartupSummary = (config, logger) => {
 	};
 	logger.info(summary, `Shapio ${summary.version} running at ${summary.url} (mode ${summary.mode}, storage ${summary.storage}, worker ${summary.worker}, tls ${summary.tls})`);
 };
-const createConfiguredWorker = (config, db, logger, signingSecret, extensions) => {
+const createConfiguredWorker = async (config, db, logger, signingSecret, extensions) => {
 	const publishing = createPublishingJobEnvironment(createPublishingRuntime({
 		db,
 		signingSecret,
@@ -49300,7 +49443,7 @@ const createConfiguredWorker = (config, db, logger, signingSecret, extensions) =
 		urls: createUrlBuilder(config.server),
 		transport: createEmailTransport(config.email, logger.child({ component: "email" }))
 	};
-	const storage = createMediaStorage(config.storage, { urls: createUrlBuilder(config.server) });
+	const storage = await createMediaStorage(config.storage, { urls: createUrlBuilder(config.server) });
 	return createWorker({
 		db,
 		handlers: createJobHandlers([
@@ -49381,6 +49524,7 @@ const startServer = async (config) => {
 			log: logger
 		});
 		const signingSecret = await resolveSigningSecret(db, config.sessionSecret, logger);
+		await publishServerRelease(db, SHAPIO_VERSION, config);
 		extensions = await startExtensions(config, db, logger, project);
 		const app = await buildApp(config, {
 			db,
@@ -49390,7 +49534,7 @@ const startServer = async (config) => {
 			schemaListen: config.schema.listen,
 			...tls.initial ? { tls: tls.initial } : {}
 		});
-		const worker = config.worker.mode === "inline" ? createConfiguredWorker(config, db, logger, signingSecret, extensions) : void 0;
+		const worker = config.worker.mode === "inline" ? await createConfiguredWorker(config, db, logger, signingSecret, extensions) : void 0;
 		const tlsRuntime = tls;
 		const extensionRuntime = extensions;
 		let closing;
@@ -49464,7 +49608,7 @@ const startDedicatedWorker = async (config) => {
 	}
 	const signingSecret = await resolveSigningSecret(db, config.sessionSecret, logger);
 	const extensions = await startExtensions(config, db, logger, project);
-	const worker = createConfiguredWorker(config, db, logger, signingSecret, extensions);
+	const worker = await createConfiguredWorker(config, db, logger, signingSecret, extensions);
 	await ensureRetentionScheduled(db);
 	await ensureHealthSweepScheduled(db);
 	worker.start();
@@ -49478,6 +49622,6 @@ const startDedicatedWorker = async (config) => {
 	return worker;
 };
 //#endregion
-export { toTypeName as $, update$8 as A, checkThemeContrast as B, BEFORE_EVENTS as C, listForAssets as D, buildEditorManifest as E, RESERVED_FIELD_API_KEYS as F, mergePulledLock as G, hashDefinition as H, RESERVED_TYPE_NAMES as I, schemaFilePath as J, parseDefinition as K, SCHEMA_KIND_DIRECTORIES as L, describeError as M, LOCK_FILE_PATH as N, listLiveByDriver as O, RESERVED_DEFINITION_API_KEYS as P, suggestPlural as Q, SITES_DIRECTORY as R, AFTER_EVENTS as S, EXTENSION_ROUTE_ROOT as T, lockCoversSite as U, foldApiKey as V, lockEntriesForSite as W, serializeDefinition as X, scopeDirectory as Y, serializeLockFile as Z, createLogger as _, loadConfig as a, createStableId as at, SITE_KEY_PATTERN as b, getPendingMigrations as c, sqliteDriverOf as ct, createMediaStorage as d, upgradeLockFile as et, createSite$1 as f, generateToken as g, SYSTEM_CLI_ACTOR as h, assertDatabaseReachable as i, SAFE_LINK_PATTERN as it, STORAGE_DRIVERS$1 as j, lockById$5 as k, migrateToLatest as l, createAdminDirect as m, startServer as n, withSiteCovered as nt, loadEnvFileIfPresent as o, validateRichText as ot, listAllSites as p, parseLockFile as q, copyObjectVerified as r, RICHTEXT_FORMAT as rt, buildApp as s, createDb as st, startDedicatedWorker as t, validateSchema as tt, SHAPIO_VERSION as u, createUrlBuilder as v, EXTENSION_JOB_PREFIX as w, loadProjectConfig as x, loopbackUrl as y, THEME_VARIANTS as z };
+export { parseLockFile as $, buildEditorManifest as A, RESERVED_DEFINITION_API_KEYS as B, loopbackUrl as C, BEFORE_EVENTS as D, AFTER_EVENTS as E, lockById$5 as F, THEME_VARIANTS as G, RESERVED_TYPE_NAMES as H, update$8 as I, hashDefinition as J, checkThemeContrast as K, STORAGE_DRIVERS$1 as L, isValidStorageKey as M, listForAssets as N, EXTENSION_JOB_PREFIX as O, listLiveByDriver as P, parseDefinition as Q, describeError as R, createUrlBuilder as S, loadProjectConfig as T, SCHEMA_KIND_DIRECTORIES as U, RESERVED_FIELD_API_KEYS as V, SITES_DIRECTORY as W, lockEntriesForSite as X, lockCoversSite as Y, mergePulledLock as Z, listAllSites as _, loadConfig as a, toTypeName as at, generateToken as b, bucketContentDisposition as c, withSiteCovered as ct, migrateToLatest as d, createStableId as dt, schemaFilePath as et, SHAPIO_VERSION as f, validateRichText as ft, createSite$1 as g, ObjectNotFoundError as h, assertDatabaseReachable as i, suggestPlural as it, encodeKeyPath as j, EXTENSION_ROUTE_ROOT as k, contentDisposition as l, RICHTEXT_FORMAT as lt, InvalidStorageKeyError as m, sqliteDriverOf as mt, startServer as n, serializeDefinition as nt, loadEnvFileIfPresent as o, upgradeLockFile as ot, createMediaStorage as p, createDb as pt, foldApiKey as q, copyObjectVerified as r, serializeLockFile as rt, buildApp as s, validateSchema as st, startDedicatedWorker as t, scopeDirectory as tt, getPendingMigrations as u, SAFE_LINK_PATTERN as ut, createAdminDirect as v, SITE_KEY_PATTERN as w, createLogger as x, SYSTEM_CLI_ACTOR as y, LOCK_FILE_PATH as z };
 
-//# sourceMappingURL=worker-BDYDbaea.js.map
+//# sourceMappingURL=worker-BU-V4qbH.js.map