@shapio/cms 0.5.0 → 0.5.2

package/dist/config.d.ts

@@ -1,2 +1,2 @@
-import { A as ServiceFactoryContext, C as HookEvent, D as MediaUsage, E as MediaReferenceService, F as defineConfig, I as isHookError, M as ShapioServices, N as ThemeDefinition, O as ModelHooks, P as ThemeTokens, S as HookError, T as JobHandlerContext, _ as ExtensionRoute, a as BeforeHookContext, b as ExtensionSite, c as ContentReadOptions, d as EXTENSION_CONTRACT_VERSION, f as EnqueueOptions, g as ExtensionJobService, h as ExtensionJobHandler, i as BeforeHook, j as ShapioConfig, k as ServiceFactory, l as ContentReadService, m as ExtensionHostConfig, n as AfterHookContext, o as BeforeHookEvent, p as EntryData, r as AfterHookEvent, s as ContentReadEntry, t as AfterHook, u as CustomServices, v as ExtensionRouteOptions, w as HookModel, x as HookEntry, y as ExtensionServices } from "./public-DYR4mtVQ.js";
+import { A as ServiceFactoryContext, C as HookEvent, D as MediaUsage, E as MediaReferenceService, F as defineConfig, I as isHookError, M as ShapioServices, N as ThemeDefinition, O as ModelHooks, P as ThemeTokens, S as HookError, T as JobHandlerContext, _ as ExtensionRoute, a as BeforeHookContext, b as ExtensionSite, c as ContentReadOptions, d as EXTENSION_CONTRACT_VERSION, f as EnqueueOptions, g as ExtensionJobService, h as ExtensionJobHandler, i as BeforeHook, j as ShapioConfig, k as ServiceFactory, l as ContentReadService, m as ExtensionHostConfig, n as AfterHookContext, o as BeforeHookEvent, p as EntryData, r as AfterHookEvent, s as ContentReadEntry, t as AfterHook, u as CustomServices, v as ExtensionRouteOptions, w as HookModel, x as HookEntry, y as ExtensionServices } from "./public-C027OJX6.js";
 export { AfterHook, AfterHookContext, AfterHookEvent, BeforeHook, BeforeHookContext, BeforeHookEvent, ContentReadEntry, ContentReadOptions, ContentReadService, CustomServices, EXTENSION_CONTRACT_VERSION, EnqueueOptions, EntryData, ExtensionHostConfig, ExtensionJobHandler, ExtensionJobService, ExtensionRoute, ExtensionRouteOptions, ExtensionServices, ExtensionSite, HookEntry, HookError, HookEvent, HookModel, JobHandlerContext, MediaReferenceService, MediaUsage, ModelHooks, ServiceFactory, ServiceFactoryContext, ShapioConfig, ShapioServices, ThemeDefinition, ThemeTokens, defineConfig, isHookError };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { A as ServiceFactoryContext, B as Principal, C as HookEvent, D as MediaUsage, E as MediaReferenceService, F as defineConfig, G as ComponentDefinition, H as DB, I as isHookError, J as ModelDefinition, K as DataType, L as KnownVersions, M as ShapioServices, N as ThemeDefinition, O as ModelHooks, P as ThemeTokens, R as PermissionEvaluator, S as HookError, T as JobHandlerContext, U as OutboxEvents, V as Database, W as ContentData, Y as SchemaChange, _ as ExtensionRoute, a as BeforeHookContext, b as ExtensionSite, c as ContentReadOptions, d as EXTENSION_CONTRACT_VERSION, f as EnqueueOptions, g as ExtensionJobService, h as ExtensionJobHandler, i as BeforeHook, j as ShapioConfig, k as ServiceFactory, l as ContentReadService, m as ExtensionHostConfig, n as AfterHookContext, o as BeforeHookEvent, p as EntryData, q as JsonValue, r as AfterHookEvent, s as ContentReadEntry, t as AfterHook, u as CustomServices, v as ExtensionRouteOptions, w as HookModel, x as HookEntry, y as ExtensionServices, z as PermissionExecutor } from "./public-DYR4mtVQ.js";
+import { A as ServiceFactoryContext, B as Principal, C as HookEvent, D as MediaUsage, E as MediaReferenceService, F as defineConfig, G as ComponentDefinition, H as DB, I as isHookError, J as ModelDefinition, K as DataType, L as KnownVersions, M as ShapioServices, N as ThemeDefinition, O as ModelHooks, P as ThemeTokens, R as PermissionEvaluator, S as HookError, T as JobHandlerContext, U as OutboxEvents, V as Database, W as ContentData, Y as SchemaChange, _ as ExtensionRoute, a as BeforeHookContext, b as ExtensionSite, c as ContentReadOptions, d as EXTENSION_CONTRACT_VERSION, f as EnqueueOptions, g as ExtensionJobService, h as ExtensionJobHandler, i as BeforeHook, j as ShapioConfig, k as ServiceFactory, l as ContentReadService, m as ExtensionHostConfig, n as AfterHookContext, o as BeforeHookEvent, p as EntryData, q as JsonValue, r as AfterHookEvent, s as ContentReadEntry, t as AfterHook, u as CustomServices, v as ExtensionRouteOptions, w as HookModel, x as HookEntry, y as ExtensionServices, z as PermissionExecutor } from "./public-C027OJX6.js";
 import { FastifyBaseLogger, FastifyInstance } from "fastify";
 import { Kysely, Selectable, Transaction } from "kysely";
 import { Static, Type } from "typebox";

package/dist/index.js

@@ -1,3 +1,3 @@
-import { a as loadConfig, f as SHAPIO_VERSION, n as startServer, s as buildApp, t as startDedicatedWorker } from "./worker-jz_0yAmS.js";
+import { a as loadConfig, f as SHAPIO_VERSION, n as startServer, s as buildApp, t as startDedicatedWorker } from "./worker-W5eY5lSj.js";
 import { EXTENSION_CONTRACT_VERSION, HookError, defineConfig, isHookError } from "./config.js";
 export { EXTENSION_CONTRACT_VERSION, HookError, SHAPIO_VERSION, buildApp, defineConfig, isHookError, loadConfig, startDedicatedWorker, startServer };

package/dist/{public-DYR4mtVQ.d.ts → public-C027OJX6.d.ts}

@@ -1092,6 +1092,16 @@ type SystemPrincipal = {
 type Principal = AdminPrincipal | AppUserPrincipal | TokenPrincipal | AnonymousPrincipal | SystemPrincipal;
 declare const CONTENT_ACTIONS: readonly ["read", "create", "update", "delete", "publish", "schemaManage"];
 type ContentAction = (typeof CONTENT_ACTIONS)[number];
+/**
+ * What a delivery role may grant (plan drafts-mode §1): `read`, and `readDrafts`, which lets a delivery token
+ * read draft heads (`?publicationState=draft`, GraphQL `publicationState: DRAFT`) on top of `read`. A
+ * `readDrafts` grant always covers every model (no model, condition or field list), so one check per request
+ * covers relation targets too. Admin and app roles never hold it; admin principals read drafts without it.
+ */
+declare const DELIVERY_ACTIONS: readonly ["read", "readDrafts"];
+type DeliveryAction = (typeof DELIVERY_ACTIONS)[number];
+/** Any action evaluated per model: content actions, and `readDrafts`. */
+type ModelAction = ContentAction | DeliveryAction;
 declare const GLOBAL_ACTIONS: readonly ["schema.create", "users.manage", "roles.manage", "audit.read", "sites.manage", "tokens.manage", "media.read", "media.write", "media.manage", "publishing.manage", "webhooks.manage", "deployments.manage", "deployments.trigger", "changes.manage", "changes.ship", "site.settings"];
 type GlobalAction = (typeof GLOBAL_ACTIONS)[number];
 /** Field visibility by stable field ID. `all` means every field the schema exposes to this principal kind. */
@@ -1120,7 +1130,7 @@ type Policy = {
   writeMask: FieldMask;
 };
 type PolicyRequest = {
-  action: ContentAction;
+  action: ModelAction;
   modelId: string;
 };
 /**
@@ -1446,4 +1456,4 @@ declare class HookError extends Error {
 declare const isHookError: (error: unknown) => error is HookError;
 //#endregion
 export { ServiceFactoryContext as A, Principal as B, HookEvent as C, MediaUsage as D, MediaReferenceService as E, defineConfig as F, ComponentDefinition as G, DB as H, isHookError as I, ModelDefinition as J, DataType as K, KnownVersions as L, ShapioServices as M, ThemeDefinition as N, ModelHooks as O, ThemeTokens as P, PermissionEvaluator as R, HookError as S, JobHandlerContext as T, OutboxEvents as U, Database as V, ContentData as W, SchemaChange as Y, ExtensionRoute as _, BeforeHookContext as a, ExtensionSite as b, ContentReadOptions as c, EXTENSION_CONTRACT_VERSION as d, EnqueueOptions as f, ExtensionJobService as g, ExtensionJobHandler as h, BeforeHook as i, ShapioConfig as j, ServiceFactory as k, ContentReadService as l, ExtensionHostConfig as m, AfterHookContext as n, BeforeHookEvent as o, EntryData as p, JsonValue$1 as q, AfterHookEvent as r, ContentReadEntry as s, AfterHook as t, CustomServices as u, ExtensionRouteOptions as v, HookModel as w, HookEntry as x, ExtensionServices as y, PermissionExecutor as z };
-//# sourceMappingURL=public-DYR4mtVQ.d.ts.map
+//# sourceMappingURL=public-C027OJX6.d.ts.map

package/dist/{s3Adapter-C8AgFVYw.js → s3Adapter-CQ4iXRWp.js}

@@ -1,4 +1,4 @@
-import { M as isValidStorageKey, c as bucketContentDisposition, h as ObjectNotFoundError, j as encodeKeyPath, l as contentDisposition, m as InvalidStorageKeyError } from "./worker-jz_0yAmS.js";
+import { M as isValidStorageKey, c as bucketContentDisposition, h as ObjectNotFoundError, j as encodeKeyPath, l as contentDisposition, m as InvalidStorageKeyError } from "./worker-W5eY5lSj.js";
 import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { createPresignedPost } from "@aws-sdk/s3-presigned-post";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
@@ -122,4 +122,4 @@ const createS3Adapter = ({ config, publicBaseUrl, client }) => {
 //#endregion
 export { createS3Adapter };
 
-//# sourceMappingURL=s3Adapter-C8AgFVYw.js.map
+//# sourceMappingURL=s3Adapter-CQ4iXRWp.js.map

package/dist/{s3Adapter-C8AgFVYw.js.map → s3Adapter-CQ4iXRWp.js.map}

@@ -1 +1 @@
-{"version":3,"file":"s3Adapter-C8AgFVYw.js","names":[],"sources":["../src/media/s3Adapter.ts"],"sourcesContent":["import type { Readable } from 'node:stream';\nimport {\n  DeleteObjectCommand,\n  GetObjectCommand,\n  HeadObjectCommand,\n  PutObjectCommand,\n  S3Client,\n  S3ServiceException,\n} from '@aws-sdk/client-s3';\nimport { createPresignedPost } from '@aws-sdk/s3-presigned-post';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\nimport type { S3StorageConfig } from '../config/index.js';\nimport { bucketContentDisposition, contentDisposition } from './contentDisposition.js';\nimport { InvalidStorageKeyError, ObjectNotFoundError } from './errors.js';\nimport { encodeKeyPath, isValidStorageKey } from './keys.js';\nimport type { StorageAdapter } from './types.js';\n\n/** R2 accepts any region name (\"auto\" by convention); AWS needs the bucket's real region. */\nconst DEFAULT_REGION = 'us-east-1';\n\nconst isNotFound = (error: unknown): boolean =>\n  error instanceof S3ServiceException &&\n  (error.$metadata.httpStatusCode === 404 || error.name === 'NotFound' || error.name === 'NoSuchKey');\n\nexport const createS3Client = (config: S3StorageConfig): S3Client =>\n  new S3Client({\n    region: config.region ?? DEFAULT_REGION,\n    ...(config.endpoint ? { endpoint: config.endpoint } : {}),\n    forcePathStyle: config.forcePathStyle,\n    ...(config.accessKeyId && config.secretAccessKey\n      ? { credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey } }\n      : {}),\n    // Only send/validate checksums when an operation requires them: several S3-compatible services\n    // (R2, B2 and other gateways) reject the SDK's default streaming CRC32 trailers.\n    requestChecksumCalculation: 'WHEN_REQUIRED',\n    responseChecksumValidation: 'WHEN_REQUIRED',\n  });\n\nexport type S3AdapterOptions = {\n  config: S3StorageConfig;\n  publicBaseUrl: string | undefined;\n  /** Injected in tests; created from `config` otherwise. */\n  client?: S3Client;\n};\n\n/**\n * Any S3-compatible service (AWS S3, Cloudflare R2, B2, Spaces, Wasabi, versitygw). Private objects are read\n * through presigned GET URLs; browsers upload straight to the bucket with a presigned POST whose policy\n * limits size and content type, so Shapio never streams upload bytes.\n */\nexport const createS3Adapter = ({ config, publicBaseUrl, client }: S3AdapterOptions): StorageAdapter => {\n  const s3 = client ?? createS3Client(config);\n  const Bucket = config.bucket;\n  const checkKey = (key: string) => {\n    if (!isValidStorageKey(key)) {\n      throw new InvalidStorageKeyError(key);\n    }\n    return key;\n  };\n\n  const head = async (key: string) => {\n    try {\n      const result = await s3.send(new HeadObjectCommand({ Bucket, Key: checkKey(key) }));\n      return { size: result.ContentLength ?? 0, contentType: result.ContentType };\n    } catch (error) {\n      if (isNotFound(error)) {\n        return undefined;\n      }\n      throw error;\n    }\n  };\n\n  return {\n    driver: 's3',\n    put: async (key, body, { contentType, contentLength }) => {\n      await s3.send(\n        new PutObjectCommand({\n          Bucket,\n          Key: checkKey(key),\n          Body: body,\n          ContentType: contentType,\n          ContentLength: Buffer.isBuffer(body) ? body.length : contentLength,\n          ContentDisposition: bucketContentDisposition(contentType),\n        }),\n      );\n    },\n    getStream: async (key, range) => {\n      try {\n        const result = await s3.send(\n          new GetObjectCommand({\n            Bucket,\n            Key: checkKey(key),\n            ...(range ? { Range: `bytes=${range.start}-${range.end}` } : {}),\n          }),\n        );\n        if (!result.Body) {\n          throw new ObjectNotFoundError(key);\n        }\n        return result.Body as Readable;\n      } catch (error) {\n        throw isNotFound(error) ? new ObjectNotFoundError(key, { cause: error }) : error;\n      }\n    },\n    head,\n    exists: async (key) => (await head(key)) !== undefined,\n    delete: async (key) => {\n      await s3.send(new DeleteObjectCommand({ Bucket, Key: checkKey(key) }));\n    },\n    signedGetUrl: async (key, { expiresInSeconds, filename, contentType }) =>\n      getSignedUrl(\n        s3,\n        new GetObjectCommand({\n          Bucket,\n          Key: checkKey(key),\n          ResponseContentType: contentType,\n          ResponseContentDisposition: contentDisposition(filename),\n        }),\n        { expiresIn: expiresInSeconds },\n      ),\n    publicUrl: (key) => (publicBaseUrl ? `${publicBaseUrl}/${encodeKeyPath(checkKey(key))}` : undefined),\n    presignedUpload: async ({ key, contentType, maxSizeBytes, expiresInSeconds }) => {\n      const disposition = bucketContentDisposition(contentType);\n      const { url, fields } = await createPresignedPost(s3, {\n        Bucket,\n        Key: checkKey(key),\n        Conditions: [\n          ['content-length-range', 1, maxSizeBytes],\n          ['eq', '$Content-Type', contentType],\n          ...(disposition ? [['eq', '$Content-Disposition', disposition] as ['eq', string, string]] : []),\n        ],\n        Fields: {\n          'Content-Type': contentType,\n          ...(disposition ? { 'Content-Disposition': disposition } : {}),\n        },\n        Expires: expiresInSeconds,\n      });\n      return { url, fields };\n    },\n  };\n};\n"],"mappings":";;;;;;AAkBA,MAAM,iBAAiB;AAEvB,MAAM,cAAc,UAClB,iBAAiB,uBAChB,MAAM,UAAU,mBAAmB,OAAO,MAAM,SAAS,cAAc,MAAM,SAAS;AAEzF,MAAa,kBAAkB,WAC7B,IAAI,SAAS;CACX,QAAQ,OAAO,UAAU;CACzB,GAAI,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;CACvD,gBAAgB,OAAO;CACvB,GAAI,OAAO,eAAe,OAAO,kBAC7B,EAAE,aAAa;EAAE,aAAa,OAAO;EAAa,iBAAiB,OAAO;CAAgB,EAAE,IAC5F,CAAC;CAGL,4BAA4B;CAC5B,4BAA4B;AAC9B,CAAC;;;;;;AAcH,MAAa,mBAAmB,EAAE,QAAQ,eAAe,aAA+C;CACtG,MAAM,KAAK,UAAU,eAAe,MAAM;CAC1C,MAAM,SAAS,OAAO;CACtB,MAAM,YAAY,QAAgB;EAChC,IAAI,CAAC,kBAAkB,GAAG,GACxB,MAAM,IAAI,uBAAuB,GAAG;EAEtC,OAAO;CACT;CAEA,MAAM,OAAO,OAAO,QAAgB;EAClC,IAAI;GACF,MAAM,SAAS,MAAM,GAAG,KAAK,IAAI,kBAAkB;IAAE;IAAQ,KAAK,SAAS,GAAG;GAAE,CAAC,CAAC;GAClF,OAAO;IAAE,MAAM,OAAO,iBAAiB;IAAG,aAAa,OAAO;GAAY;EAC5E,SAAS,OAAO;GACd,IAAI,WAAW,KAAK,GAClB;GAEF,MAAM;EACR;CACF;CAEA,OAAO;EACL,QAAQ;EACR,KAAK,OAAO,KAAK,MAAM,EAAE,aAAa,oBAAoB;GACxD,MAAM,GAAG,KACP,IAAI,iBAAiB;IACnB;IACA,KAAK,SAAS,GAAG;IACjB,MAAM;IACN,aAAa;IACb,eAAe,OAAO,SAAS,IAAI,IAAI,KAAK,SAAS;IACrD,oBAAoB,yBAAyB,WAAW;GAC1D,CAAC,CACH;EACF;EACA,WAAW,OAAO,KAAK,UAAU;GAC/B,IAAI;IACF,MAAM,SAAS,MAAM,GAAG,KACtB,IAAI,iBAAiB;KACnB;KACA,KAAK,SAAS,GAAG;KACjB,GAAI,QAAQ,EAAE,OAAO,SAAS,MAAM,MAAM,GAAG,MAAM,MAAM,IAAI,CAAC;IAChE,CAAC,CACH;IACA,IAAI,CAAC,OAAO,MACV,MAAM,IAAI,oBAAoB,GAAG;IAEnC,OAAO,OAAO;GAChB,SAAS,OAAO;IACd,MAAM,WAAW,KAAK,IAAI,IAAI,oBAAoB,KAAK,EAAE,OAAO,MAAM,CAAC,IAAI;GAC7E;EACF;EACA;EACA,QAAQ,OAAO,QAAS,MAAM,KAAK,GAAG,MAAO,KAAA;EAC7C,QAAQ,OAAO,QAAQ;GACrB,MAAM,GAAG,KAAK,IAAI,oBAAoB;IAAE;IAAQ,KAAK,SAAS,GAAG;GAAE,CAAC,CAAC;EACvE;EACA,cAAc,OAAO,KAAK,EAAE,kBAAkB,UAAU,kBACtD,aACE,IACA,IAAI,iBAAiB;GACnB;GACA,KAAK,SAAS,GAAG;GACjB,qBAAqB;GACrB,4BAA4B,mBAAmB,QAAQ;EACzD,CAAC,GACD,EAAE,WAAW,iBAAiB,CAChC;EACF,YAAY,QAAS,gBAAgB,GAAG,cAAc,GAAG,cAAc,SAAS,GAAG,CAAC,MAAM,KAAA;EAC1F,iBAAiB,OAAO,EAAE,KAAK,aAAa,cAAc,uBAAuB;GAC/E,MAAM,cAAc,yBAAyB,WAAW;GACxD,MAAM,EAAE,KAAK,WAAW,MAAM,oBAAoB,IAAI;IACpD;IACA,KAAK,SAAS,GAAG;IACjB,YAAY;KACV;MAAC;MAAwB;MAAG;KAAY;KACxC;MAAC;MAAM;MAAiB;KAAW;KACnC,GAAI,cAAc,CAAC;MAAC;MAAM;MAAwB;KAAW,CAA2B,IAAI,CAAC;IAC/F;IACA,QAAQ;KACN,gBAAgB;KAChB,GAAI,cAAc,EAAE,uBAAuB,YAAY,IAAI,CAAC;IAC9D;IACA,SAAS;GACX,CAAC;GACD,OAAO;IAAE;IAAK;GAAO;EACvB;CACF;AACF"}
+{"version":3,"file":"s3Adapter-CQ4iXRWp.js","names":[],"sources":["../src/media/s3Adapter.ts"],"sourcesContent":["import type { Readable } from 'node:stream';\nimport {\n  DeleteObjectCommand,\n  GetObjectCommand,\n  HeadObjectCommand,\n  PutObjectCommand,\n  S3Client,\n  S3ServiceException,\n} from '@aws-sdk/client-s3';\nimport { createPresignedPost } from '@aws-sdk/s3-presigned-post';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\nimport type { S3StorageConfig } from '../config/index.js';\nimport { bucketContentDisposition, contentDisposition } from './contentDisposition.js';\nimport { InvalidStorageKeyError, ObjectNotFoundError } from './errors.js';\nimport { encodeKeyPath, isValidStorageKey } from './keys.js';\nimport type { StorageAdapter } from './types.js';\n\n/** R2 accepts any region name (\"auto\" by convention); AWS needs the bucket's real region. */\nconst DEFAULT_REGION = 'us-east-1';\n\nconst isNotFound = (error: unknown): boolean =>\n  error instanceof S3ServiceException &&\n  (error.$metadata.httpStatusCode === 404 || error.name === 'NotFound' || error.name === 'NoSuchKey');\n\nexport const createS3Client = (config: S3StorageConfig): S3Client =>\n  new S3Client({\n    region: config.region ?? DEFAULT_REGION,\n    ...(config.endpoint ? { endpoint: config.endpoint } : {}),\n    forcePathStyle: config.forcePathStyle,\n    ...(config.accessKeyId && config.secretAccessKey\n      ? { credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey } }\n      : {}),\n    // Only send/validate checksums when an operation requires them: several S3-compatible services\n    // (R2, B2 and other gateways) reject the SDK's default streaming CRC32 trailers.\n    requestChecksumCalculation: 'WHEN_REQUIRED',\n    responseChecksumValidation: 'WHEN_REQUIRED',\n  });\n\nexport type S3AdapterOptions = {\n  config: S3StorageConfig;\n  publicBaseUrl: string | undefined;\n  /** Injected in tests; created from `config` otherwise. */\n  client?: S3Client;\n};\n\n/**\n * Any S3-compatible service (AWS S3, Cloudflare R2, B2, Spaces, Wasabi, versitygw). Private objects are read\n * through presigned GET URLs; browsers upload straight to the bucket with a presigned POST whose policy\n * limits size and content type, so Shapio never streams upload bytes.\n */\nexport const createS3Adapter = ({ config, publicBaseUrl, client }: S3AdapterOptions): StorageAdapter => {\n  const s3 = client ?? createS3Client(config);\n  const Bucket = config.bucket;\n  const checkKey = (key: string) => {\n    if (!isValidStorageKey(key)) {\n      throw new InvalidStorageKeyError(key);\n    }\n    return key;\n  };\n\n  const head = async (key: string) => {\n    try {\n      const result = await s3.send(new HeadObjectCommand({ Bucket, Key: checkKey(key) }));\n      return { size: result.ContentLength ?? 0, contentType: result.ContentType };\n    } catch (error) {\n      if (isNotFound(error)) {\n        return undefined;\n      }\n      throw error;\n    }\n  };\n\n  return {\n    driver: 's3',\n    put: async (key, body, { contentType, contentLength }) => {\n      await s3.send(\n        new PutObjectCommand({\n          Bucket,\n          Key: checkKey(key),\n          Body: body,\n          ContentType: contentType,\n          ContentLength: Buffer.isBuffer(body) ? body.length : contentLength,\n          ContentDisposition: bucketContentDisposition(contentType),\n        }),\n      );\n    },\n    getStream: async (key, range) => {\n      try {\n        const result = await s3.send(\n          new GetObjectCommand({\n            Bucket,\n            Key: checkKey(key),\n            ...(range ? { Range: `bytes=${range.start}-${range.end}` } : {}),\n          }),\n        );\n        if (!result.Body) {\n          throw new ObjectNotFoundError(key);\n        }\n        return result.Body as Readable;\n      } catch (error) {\n        throw isNotFound(error) ? new ObjectNotFoundError(key, { cause: error }) : error;\n      }\n    },\n    head,\n    exists: async (key) => (await head(key)) !== undefined,\n    delete: async (key) => {\n      await s3.send(new DeleteObjectCommand({ Bucket, Key: checkKey(key) }));\n    },\n    signedGetUrl: async (key, { expiresInSeconds, filename, contentType }) =>\n      getSignedUrl(\n        s3,\n        new GetObjectCommand({\n          Bucket,\n          Key: checkKey(key),\n          ResponseContentType: contentType,\n          ResponseContentDisposition: contentDisposition(filename),\n        }),\n        { expiresIn: expiresInSeconds },\n      ),\n    publicUrl: (key) => (publicBaseUrl ? `${publicBaseUrl}/${encodeKeyPath(checkKey(key))}` : undefined),\n    presignedUpload: async ({ key, contentType, maxSizeBytes, expiresInSeconds }) => {\n      const disposition = bucketContentDisposition(contentType);\n      const { url, fields } = await createPresignedPost(s3, {\n        Bucket,\n        Key: checkKey(key),\n        Conditions: [\n          ['content-length-range', 1, maxSizeBytes],\n          ['eq', '$Content-Type', contentType],\n          ...(disposition ? [['eq', '$Content-Disposition', disposition] as ['eq', string, string]] : []),\n        ],\n        Fields: {\n          'Content-Type': contentType,\n          ...(disposition ? { 'Content-Disposition': disposition } : {}),\n        },\n        Expires: expiresInSeconds,\n      });\n      return { url, fields };\n    },\n  };\n};\n"],"mappings":";;;;;;AAkBA,MAAM,iBAAiB;AAEvB,MAAM,cAAc,UAClB,iBAAiB,uBAChB,MAAM,UAAU,mBAAmB,OAAO,MAAM,SAAS,cAAc,MAAM,SAAS;AAEzF,MAAa,kBAAkB,WAC7B,IAAI,SAAS;CACX,QAAQ,OAAO,UAAU;CACzB,GAAI,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;CACvD,gBAAgB,OAAO;CACvB,GAAI,OAAO,eAAe,OAAO,kBAC7B,EAAE,aAAa;EAAE,aAAa,OAAO;EAAa,iBAAiB,OAAO;CAAgB,EAAE,IAC5F,CAAC;CAGL,4BAA4B;CAC5B,4BAA4B;AAC9B,CAAC;;;;;;AAcH,MAAa,mBAAmB,EAAE,QAAQ,eAAe,aAA+C;CACtG,MAAM,KAAK,UAAU,eAAe,MAAM;CAC1C,MAAM,SAAS,OAAO;CACtB,MAAM,YAAY,QAAgB;EAChC,IAAI,CAAC,kBAAkB,GAAG,GACxB,MAAM,IAAI,uBAAuB,GAAG;EAEtC,OAAO;CACT;CAEA,MAAM,OAAO,OAAO,QAAgB;EAClC,IAAI;GACF,MAAM,SAAS,MAAM,GAAG,KAAK,IAAI,kBAAkB;IAAE;IAAQ,KAAK,SAAS,GAAG;GAAE,CAAC,CAAC;GAClF,OAAO;IAAE,MAAM,OAAO,iBAAiB;IAAG,aAAa,OAAO;GAAY;EAC5E,SAAS,OAAO;GACd,IAAI,WAAW,KAAK,GAClB;GAEF,MAAM;EACR;CACF;CAEA,OAAO;EACL,QAAQ;EACR,KAAK,OAAO,KAAK,MAAM,EAAE,aAAa,oBAAoB;GACxD,MAAM,GAAG,KACP,IAAI,iBAAiB;IACnB;IACA,KAAK,SAAS,GAAG;IACjB,MAAM;IACN,aAAa;IACb,eAAe,OAAO,SAAS,IAAI,IAAI,KAAK,SAAS;IACrD,oBAAoB,yBAAyB,WAAW;GAC1D,CAAC,CACH;EACF;EACA,WAAW,OAAO,KAAK,UAAU;GAC/B,IAAI;IACF,MAAM,SAAS,MAAM,GAAG,KACtB,IAAI,iBAAiB;KACnB;KACA,KAAK,SAAS,GAAG;KACjB,GAAI,QAAQ,EAAE,OAAO,SAAS,MAAM,MAAM,GAAG,MAAM,MAAM,IAAI,CAAC;IAChE,CAAC,CACH;IACA,IAAI,CAAC,OAAO,MACV,MAAM,IAAI,oBAAoB,GAAG;IAEnC,OAAO,OAAO;GAChB,SAAS,OAAO;IACd,MAAM,WAAW,KAAK,IAAI,IAAI,oBAAoB,KAAK,EAAE,OAAO,MAAM,CAAC,IAAI;GAC7E;EACF;EACA;EACA,QAAQ,OAAO,QAAS,MAAM,KAAK,GAAG,MAAO,KAAA;EAC7C,QAAQ,OAAO,QAAQ;GACrB,MAAM,GAAG,KAAK,IAAI,oBAAoB;IAAE;IAAQ,KAAK,SAAS,GAAG;GAAE,CAAC,CAAC;EACvE;EACA,cAAc,OAAO,KAAK,EAAE,kBAAkB,UAAU,kBACtD,aACE,IACA,IAAI,iBAAiB;GACnB;GACA,KAAK,SAAS,GAAG;GACjB,qBAAqB;GACrB,4BAA4B,mBAAmB,QAAQ;EACzD,CAAC,GACD,EAAE,WAAW,iBAAiB,CAChC;EACF,YAAY,QAAS,gBAAgB,GAAG,cAAc,GAAG,cAAc,SAAS,GAAG,CAAC,MAAM,KAAA;EAC1F,iBAAiB,OAAO,EAAE,KAAK,aAAa,cAAc,uBAAuB;GAC/E,MAAM,cAAc,yBAAyB,WAAW;GACxD,MAAM,EAAE,KAAK,WAAW,MAAM,oBAAoB,IAAI;IACpD;IACA,KAAK,SAAS,GAAG;IACjB,YAAY;KACV;MAAC;MAAwB;MAAG;KAAY;KACxC;MAAC;MAAM;MAAiB;KAAW;KACnC,GAAI,cAAc,CAAC;MAAC;MAAM;MAAwB;KAAW,CAA2B,IAAI,CAAC;IAC/F;IACA,QAAQ;KACN,gBAAgB;KAChB,GAAI,cAAc,EAAE,uBAAuB,YAAY,IAAI,CAAC;IAC9D;IACA,SAAS;GACX,CAAC;GACD,OAAO;IAAE;IAAK;GAAO;EACvB;CACF;AACF"}

package/dist/{worker-jz_0yAmS.js → worker-W5eY5lSj.js}

@@ -10434,6 +10434,14 @@ const CONTENT_ACTIONS = [
 	"schemaManage"
 ];
 /**
+* What a delivery role may grant (plan drafts-mode §1): `read`, and `readDrafts`, which lets a delivery token
+* read draft heads (`?publicationState=draft`, GraphQL `publicationState: DRAFT`) on top of `read`. A
+* `readDrafts` grant always covers every model (no model, condition or field list), so one check per request
+* covers relation targets too. Admin and app roles never hold it; admin principals read drafts without it.
+*/
+const DELIVERY_ACTIONS = ["read", "readDrafts"];
+const READ_DRAFTS_ACTION = "readDrafts";
+/**
 * Content actions about the schema rather than one site's entries: network roles only for a shared
 * definition; for a site's own definition, the roles that apply on that site (when the principal acts there).
 */
@@ -12153,7 +12161,11 @@ const groupBindings = (rows) => {
 	}
 	return bindings;
 };
-const KNOWN_ACTIONS = /* @__PURE__ */ new Set([...CONTENT_ACTIONS, ...GLOBAL_ACTIONS]);
+const KNOWN_ACTIONS = /* @__PURE__ */ new Set([
+	...CONTENT_ACTIONS,
+	...DELIVERY_ACTIONS,
+	...GLOBAL_ACTIONS
+]);
 const KNOWN_CONDITIONS = /* @__PURE__ */ new Set(["ownedByPrincipal"]);
 /**
 * A stored grant as this build understands it. Rows written by a newer Shapio may name an action or a row
@@ -12299,7 +12311,9 @@ const allowsGlobalAction = (grants, action) => grants.some((grant) => grant.acti
 //#endregion
 //#region src/permissions/evaluator.ts
 const NETWORK_ACTION_SET = new Set(NETWORK_ACTIONS);
-const READ_ONLY$1 = /* @__PURE__ */ new Set(["read"]);
+/** Delivery tokens read, and read drafts where their role grants `readDrafts`. */
+const DELIVERY_TOKEN_ACTIONS = new Set(DELIVERY_ACTIONS);
+/** App users and anonymous callers: never `readDrafts`, whatever a role says. */
 const APP_ACTIONS = new Set(APP_CONTENT_ACTIONS);
 /**
 * Which roles a principal holds and how its masks are computed. App users hold the custom app roles assigned
@@ -12326,7 +12340,7 @@ const rolesOf = async (principal, grants, executor, versions) => {
 			roleIds: [principal.roleId],
 			networkRoleIds: [],
 			audience: "delivery",
-			actions: READ_ONLY$1
+			actions: DELIVERY_TOKEN_ACTIONS
 		};
 		case "appUser": return {
 			roleIds: [...await grants.getSiteAppRoleIds(principal.siteId, "authenticated", executor, versions), ...principal.roleIds],
@@ -13429,6 +13443,8 @@ const SITE_QUERY_PARAMETER = "site";
 * and the header that selects the site. CDNs that key on the URL only need `?site=` instead of the header.
 */
 const DELIVERY_VARY = "Authorization, Cookie, Shapio-Site";
+/** `Cache-Control` of delivery responses carrying drafts (REST and GraphQL; plan drafts-mode): never stored. */
+const DRAFTS_CACHE_CONTROL = "private, no-store";
 //#endregion
 //#region src/services/contentContext.ts
 /**
@@ -13623,6 +13639,8 @@ const RICH_TEXT_MODES = [
 /** What a delivery read returns for rich text when the request does not say (`?richText=`). */
 const DEFAULT_RICH_TEXT_MODE = "json";
 /** `?seo=`: SEO fields as stored, or merged with the site's SEO defaults (plan seo-fields). */
+/** Which heads a delivery read serves (`?publicationState=`, GraphQL's `publicationState`). */
+const PUBLICATION_STATES = ["published", "draft"];
 const SEO_MODES = ["raw", "resolved"];
 const ENTRY_LIST_STATUSES = [
 	"draft",
@@ -14090,6 +14108,7 @@ const TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
 	"snapshot",
 	"richText",
 	"seo",
+	"publicationState",
 	"q",
 	"status",
 	"author"
@@ -14269,6 +14288,18 @@ const parseSeo = (tree, context) => {
 	if (value === "resolved" && !context.model.fields.some((field) => !field.deprecated && isSeoField(field) && context.isReadable(field))) throw queryInvalid(`"${context.model.apiKey}" has no SEO field to resolve`);
 	return { seo: value };
 };
+const PUBLICATION_STATE_SET = new Set(PUBLICATION_STATES);
+/**
+* `?publicationState=published|draft` on delivery reads; whether the caller may read drafts is the service's
+* check.
+*/
+const parsePublicationState = (tree, context) => {
+	const value = single(tree.publicationState, "publicationState");
+	if (value === void 0) return {};
+	if (!context.allowPublicationState) throw queryInvalid("publicationState is only available on the delivery API");
+	if (!PUBLICATION_STATE_SET.has(value)) throw queryInvalid(`"publicationState" must be one of ${PUBLICATION_STATES.join(", ")}`);
+	return { publicationState: value };
+};
 const parseContentQuery = (tree, context) => {
 	for (const key of Object.keys(tree)) if (!TOP_LEVEL_KEYS.has(key)) throw queryInvalid(`Unknown query parameter "${key}"`);
 	const filters = tree.filters;
@@ -14292,6 +14323,7 @@ const parseContentQuery = (tree, context) => {
 		snapshot,
 		...parseRichText(tree, context),
 		...parseSeo(tree, context),
+		...parsePublicationState(tree, context),
 		...parseAdminFilters(tree, context)
 	};
 };
@@ -14911,6 +14943,7 @@ const parseQueryFor = (context, model, policy, rawQuery, options) => parseConten
 	allowAdminFilters: options.allowAdminFilters ?? false,
 	allowRichText: options.allowRichText ?? false,
 	allowSeo: options.allowSeo ?? false,
+	allowPublicationState: options.allowPublicationState ?? false,
 	resolveModel: (modelId) => resolveModelById(context.snapshot, modelId)?.definition
 });
 /** The admin content list: drafts, filtered/sorted/paginated by the same compiler as delivery. */
@@ -15320,7 +15353,7 @@ const resolveMediaOrigins = async (storage) => {
 	const base = originOf(storage.publicBaseUrl);
 	if (base) origins.add(base);
 	if (storage.s3) {
-		const { createS3Adapter } = await import("./s3Adapter-C8AgFVYw.js");
+		const { createS3Adapter } = await import("./s3Adapter-CQ4iXRWp.js");
 		const adapter = createS3Adapter({
 			config: storage.s3,
 			publicBaseUrl: void 0
@@ -18014,10 +18047,11 @@ const csrfForGet = (app) => (request, reply, done) => {
 /**
 * Responses vary by credentials. GET queries get REST's validators (a strong ETag over the body, 304 on a
 * match) and its caching policy (public for anonymous callers, private otherwise); everything else is
-* never stored.
+* never stored. An operation that read drafts (the controller set `DRAFTS_CACHE_CONTROL`) keeps it.
 */
 const cacheHeaders = async (request, reply, payload) => {
 	appendVary(reply, DELIVERY_VARY);
+	if (reply.getHeader("cache-control") === "private, no-store") return payload;
 	if (request.method !== "GET" || reply.statusCode !== 200 || typeof payload !== "string") {
 		reply.header("cache-control", "no-store");
 		return payload;
@@ -18910,8 +18944,9 @@ const createLoaders = (siteId, content) => {
 * The context every resolver of one operation receives, with its own DataLoaders. Carries no HTTP objects, so
 * an operation can run outside a request.
 */
-const createGraphqlContext = ({ site, permissions, isAdmin, content }) => {
+const createGraphqlContext = ({ site, permissions, content }) => {
 	let base;
+	let drafts = false;
 	const contentAt = async (snapshot) => {
 		base ??= content(snapshot);
 		return {
@@ -18922,7 +18957,10 @@ const createGraphqlContext = ({ site, permissions, isAdmin, content }) => {
 	};
 	return {
 		permissions,
-		isAdmin,
+		markDrafts: () => {
+			drafts = true;
+		},
+		readDrafts: () => drafts,
 		site,
 		loaders: createLoaders(() => site.id, contentAt),
 		content: contentAt
@@ -18976,13 +19014,10 @@ const rawQueryOf = (request) => {
 };
 //#endregion
 //#region src/controllers/graphqlContext.ts
-/** Admin users and admin-scope API tokens: may read drafts. */
-const isAdminPrincipal = (principal) => principal.kind === "admin" || principal.kind === "token" && principal.scope === "admin";
 /** The context every resolver of one `/api/graphql` request receives (built after site resolution). */
 const createGraphqlRequestContext = (request) => createGraphqlContext({
 	site: getRequestSite(request),
 	permissions: getRequestPermissions(request),
-	isAdmin: isAdminPrincipal(request.principal),
 	content: () => contentContextFor(request)
 });
 //#endregion
@@ -19018,8 +19053,10 @@ const runGraphql = async (request, reply, input) => {
 	}
 	if (prepared.selectsIntrospection && !mayIntrospect) throw introspectionDisabled();
 	const usage = collectUsage(request, schema, prepared.document, prepared.operation, input.variables ?? void 0);
-	const result = await executeOperation(schema, prepared, input, createGraphqlRequestContext(request));
+	const context = createGraphqlRequestContext(request);
+	const result = await executeOperation(schema, prepared, input, context);
 	recordUsage$1(request, usage, result.data !== null && result.data !== void 0);
+	if (context.readDrafts()) reply.header("cache-control", DRAFTS_CACHE_CONTROL);
 	return send$1(reply, formatGraphqlResult(result, { log: request.log }));
 };
 const postGraphql = async (request, reply) => runGraphql(request, reply, request.body);
@@ -19433,7 +19470,7 @@ const createFixedTypes = () => {
 		entry: createEntry$2(),
 		publicationState: new GraphQLEnumType({
 			name: "PublicationState",
-			description: "DRAFT is for admin principals only (previews).",
+			description: "DRAFT is for admin principals and delivery tokens granted Read drafts (development servers).",
 			values: {
 				PUBLISHED: { value: "published" },
 				DRAFT: { value: "draft" }
@@ -20414,6 +20451,26 @@ const restFieldReads = async ({ snapshot, model, policy, query, policyFor }) =>
 	return reads;
 };
 //#endregion
+//#region src/services/draftAccess.ts
+/**
+* Who may read draft heads through the delivery API (plan drafts-mode §1). Admin users, admin-scope tokens
+* and Shapio itself always could (GraphQL previews). A delivery token may when its role grants `readDrafts`,
+* which always covers every model, so this one check per request also covers relation targets. App users and
+* anonymous callers never may, whatever a role says (the evaluator denies them too). The caller has already
+* checked `read` on the model.
+*/
+const isAdminPrincipal = (principal) => principal.kind === "system" || principal.kind === "admin" || principal.kind === "token" && principal.scope === "admin";
+const draftsForbidden = (message) => new AppError(403, "DRAFTS_FORBIDDEN", message);
+const assertMayReadDrafts = async (context, modelId, modelKey) => {
+	const { actor } = context;
+	if (isAdminPrincipal(actor)) return;
+	if (actor.kind !== "token") throw draftsForbidden("Drafts need an admin user or a delivery token granted Read drafts");
+	if (!(await context.permissions.evaluate(actor, {
+		action: "readDrafts",
+		modelId
+	})).allowed) throw draftsForbidden(`This token may not read drafts of "${modelKey}"; grant Read drafts on its delivery role`);
+};
+//#endregion
 //#region src/services/contentDelivery.ts
 const readableModel = async (context, modelKey) => {
 	const model = resolveModel(context.snapshot, modelKey);
@@ -20427,10 +20484,19 @@ const readableModel = async (context, modelKey) => {
 		policy
 	};
 };
-/** The heads a read serves: drafts (GraphQL previews), a pinned snapshot, or the published heads. */
-const sourceOf = (query, options) => {
-	if (query.snapshot !== void 0 && options.drafts) throw queryInvalid("snapshot reads published content; it cannot be combined with drafts");
-	return options.drafts ? {
+/** Whether a read asks for drafts: GraphQL's option, or `?publicationState=draft`. */
+const readsDrafts = (query, options) => options.drafts === true || query.publicationState === "draft";
+/**
+* A draft read must be allowed: `read` was checked already; `readDrafts` (or an admin principal) is checked
+* here.
+*/
+const authorizeDrafts$1 = async (context, model, modelKey, drafts) => {
+	if (drafts) await assertMayReadDrafts(context, model.definition.id, modelKey);
+};
+/** The heads a read serves: drafts, a pinned snapshot, or the published heads. */
+const sourceOf = (query, drafts) => {
+	if (query.snapshot !== void 0 && drafts) throw queryInvalid("snapshot reads published content; it cannot be combined with drafts");
+	return drafts ? {
 		kind: "heads",
 		state: "draft"
 	} : query.snapshot !== void 0 ? {
@@ -20451,7 +20517,7 @@ const snapshotCheck = (query) => (current) => {
 */
 const recordUsage = async (context, options, model, policy, query) => {
 	const principalKey = usagePrincipalKey(context.actor);
-	if (!options.usage || options.drafts || principalKey === null) return;
+	if (!options.usage || readsDrafts(query, options) || principalKey === null) return;
 	const reads = await restFieldReads({
 		snapshot: context.snapshot,
 		model,
@@ -20479,8 +20545,24 @@ const ITEM_PARAMETERS$1 = /* @__PURE__ */ new Set([
 	"locale",
 	"snapshot",
 	"richText",
-	"seo"
+	"seo",
+	"publicationState"
 ]);
+const DELIVERY_PARSE = {
+	allowSnapshot: true,
+	allowRichText: true,
+	allowSeo: true,
+	allowPublicationState: true
+};
+/** Meta every delivery response carries; draft reads add `publicationState` (published ones are unchanged). */
+const metaOf$1 = (locale, snapshot, drafts) => drafts ? {
+	locale,
+	snapshot,
+	publicationState: "draft"
+} : {
+	locale,
+	snapshot
+};
 /** Reading one entry takes only these query parameters; anything else is refused, not ignored. */
 const assertItemParameters = (rawQuery, allowed) => {
 	const unsupported = [...new URLSearchParams(rawQuery).keys()].find((key) => !allowed.has(key.split("[")[0] ?? key));
@@ -20489,16 +20571,15 @@ const assertItemParameters = (rawQuery, allowed) => {
 /** `GET /api/content/:modelKey`: a page of a collection, or a singleton's one entry. */
 const listDelivery$1 = async (context, modelKey, rawQuery, options = {}) => {
 	const { model, policy } = await readableModel(context, modelKey);
-	const query = parseQueryFor(context, model, policy, rawQuery, {
-		allowSnapshot: true,
-		allowRichText: true,
-		allowSeo: true
-	});
+	const query = parseQueryFor(context, model, policy, rawQuery, DELIVERY_PARSE);
+	const drafts = readsDrafts(query, options);
+	const source = sourceOf(query, drafts);
+	await authorizeDrafts$1(context, model, modelKey, drafts);
 	const locale = query.locale ?? context.snapshot.defaultLocale;
 	const singleton = model.definition.kind === "singleton";
 	const { entries, limit, total, seq } = await readEntryPage({
 		context,
-		source: sourceOf(query, options),
+		source,
 		model,
 		policy,
 		query,
@@ -20514,34 +20595,32 @@ const listDelivery$1 = async (context, modelKey, rawQuery, options = {}) => {
 		if (!entry) throw entryNotFound(modelKey);
 		result = {
 			data: entry,
-			meta: {
-				locale,
-				snapshot
-			}
+			meta: metaOf$1(locale, snapshot, drafts)
 		};
 	} else result = {
 		data: entries,
 		meta: {
-			locale,
-			snapshot,
+			...metaOf$1(locale, snapshot, drafts),
 			pagination: paginationMeta(query.page, limit, total)
 		}
 	};
 	await afterRead(options, () => recordUsage(context, options, model, policy, query));
 	return result;
 };
-/** `GET /api/content/:modelKey/:id`: one published entry (404 for drafts, unknown or unreadable entries). */
+/**
+* `GET /api/content/:modelKey/:id`: one published entry (404 for unpublished, unknown or unreadable entries);
+* with drafts, the entry's draft.
+*/
 const getDelivery$1 = async (context, modelKey, id, rawQuery, options = {}) => {
 	assertItemParameters(rawQuery, ITEM_PARAMETERS$1);
 	const { model, policy } = await readableModel(context, modelKey);
-	const query = parseQueryFor(context, model, policy, rawQuery, {
-		allowSnapshot: true,
-		allowRichText: true,
-		allowSeo: true
-	});
+	const query = parseQueryFor(context, model, policy, rawQuery, DELIVERY_PARSE);
+	const drafts = readsDrafts(query, options);
+	const source = sourceOf(query, drafts);
+	await authorizeDrafts$1(context, model, modelKey, drafts);
 	const { entry, seq } = await readOneEntry({
 		context,
-		source: sourceOf(query, options),
+		source,
 		model,
 		policy,
 		query,
@@ -20551,10 +20630,7 @@ const getDelivery$1 = async (context, modelKey, id, rawQuery, options = {}) => {
 	await afterRead(options, () => recordUsage(context, options, model, policy, query));
 	return {
 		data: entry,
-		meta: {
-			locale: query.locale ?? context.snapshot.defaultLocale,
-			snapshot: query.snapshot ?? seq
-		}
+		meta: metaOf$1(query.locale ?? context.snapshot.defaultLocale, query.snapshot ?? seq, drafts)
 	};
 };
 //#endregion
@@ -20699,18 +20775,21 @@ const readArgs = (build) => ({
 	publicationState: {
 		type: build.fixed.publicationState,
 		defaultValue: "published",
-		description: "DRAFT needs an admin user or an admin API token"
+		description: "DRAFT needs an admin user, an admin API token or a delivery token granted Read drafts"
 	},
 	snapshot: {
 		type: GraphQLInt,
 		description: "Read published content as of this publication sequence"
 	}
 });
-const draftsForbidden = () => new AppError(403, "FORBIDDEN", "publicationState DRAFT needs an admin user or an admin API token");
-/** The read scope of a root read; drafts only for admin principals (never delivery principals). */
+/**
+* The read scope of a root read. Drafts: the delivery service checks the caller may read them (admin
+* principals, delivery tokens granted Read drafts; plan drafts-mode) before reading any head, and the
+* response is marked never to be stored.
+*/
 const scopeOf = (args, context) => {
 	const drafts = args.publicationState === "draft";
-	if (drafts && !context.isAdmin) throw draftsForbidden();
+	if (drafts) context.markDrafts();
 	return {
 		locale: args.locale ?? void 0,
 		fallback: args.fallback ?? true,
@@ -21633,7 +21712,7 @@ const createMediaStorage = async (config, deps) => {
 		publicBaseUrl: config.publicBaseUrl
 	}));
 	if (config.s3) {
-		const { createS3Adapter } = await import("./s3Adapter-C8AgFVYw.js");
+		const { createS3Adapter } = await import("./s3Adapter-CQ4iXRWp.js");
 		adapters.set("s3", createS3Adapter({
 			config: config.s3,
 			publicBaseUrl: config.publicBaseUrl
@@ -22452,7 +22531,8 @@ const outboundPolicy = (runtime, allowPrivateNetwork) => ({
 });
 //#endregion
 //#region src/services/roles.ts
-const CONTENT_ACTION_SET = new Set(CONTENT_ACTIONS);
+const MODEL_ACTION_SET = /* @__PURE__ */ new Set([...CONTENT_ACTIONS, ...DELIVERY_ACTIONS]);
+const DELIVERY_ACTION_SET = new Set(DELIVERY_ACTIONS);
 const GLOBAL_ACTION_SET = new Set(GLOBAL_ACTIONS);
 const FIELD_SCOPED_ACTIONS = /* @__PURE__ */ new Set([
 	"read",
@@ -22479,9 +22559,17 @@ const toRoleView = (role, grants) => ({
 });
 const invalidPermissions = (message, details) => new AppError(400, "INVALID_PERMISSIONS", message, details);
 /**
+* `readDrafts` (plan drafts-mode §1): delivery roles only, and always on every model with no condition or
+* field list, so one check per request covers every model a draft read reaches (relation targets too).
+*/
+const validateReadDrafts = (kind, permission, at) => {
+	if (kind !== "delivery") throw invalidPermissions("Read drafts is for delivery roles only", at);
+	if (permission.modelId !== null || permission.condition !== null || permission.fieldIds !== null) throw invalidPermissions("Read drafts applies to every model, with no condition or field list", at);
+};
+/**
 * The server-side rules for grants (never only the UI): known actions, global actions only without a
-* model, conditions and field lists only where they mean something, delivery roles read-only, no
-* duplicate (action, model) pairs.
+* model, conditions and field lists only where they mean something, delivery roles read-only (`read`, and
+* `readDrafts` on every model), no duplicate (action, model) pairs.
 */
 const validatePermissions = (kind, permissions) => {
 	const seen = /* @__PURE__ */ new Set();
@@ -22491,9 +22579,10 @@ const validatePermissions = (kind, permissions) => {
 			action: permission.action
 		};
 		const isGlobal = GLOBAL_ACTION_SET.has(permission.action);
-		if (!isGlobal && !CONTENT_ACTION_SET.has(permission.action)) throw invalidPermissions("Unknown action", at);
+		if (!isGlobal && !MODEL_ACTION_SET.has(permission.action)) throw invalidPermissions("Unknown action", at);
 		if (isGlobal && (permission.modelId !== null || permission.condition !== null || permission.fieldIds !== null)) throw invalidPermissions("Global actions take no model, condition or field list", at);
-		if (kind === "delivery" && permission.action !== "read") throw invalidPermissions("Delivery roles can only read", at);
+		if (kind === "delivery" && !DELIVERY_ACTION_SET.has(permission.action)) throw invalidPermissions("Delivery roles can only read", at);
+		if (permission.action === "readDrafts") validateReadDrafts(kind, permission, at);
 		if (permission.fieldIds !== null && !FIELD_SCOPED_ACTIONS.has(permission.action)) throw invalidPermissions("Field lists apply to read, create and update only", at);
 		const key = `${permission.action}\u0000${permission.modelId ?? "*"}`;
 		if (seen.has(key)) throw invalidPermissions("Each action may be granted once per model", at);
@@ -22845,7 +22934,11 @@ Type.Enum(SITE_ACTIONS);
 /** What `me.sitePermissions` lists: site actions, and network actions a role on the site grants there. */
 const SitePermissionSchema = Type.Enum([...SITE_ACTIONS, ...SITE_GRANTABLE_ACTION_LIST]);
 const PermissionSchema$1 = Type.Object({
-	action: Type.Enum([...CONTENT_ACTIONS, ...GLOBAL_ACTIONS]),
+	action: Type.Enum([
+		...CONTENT_ACTIONS,
+		READ_DRAFTS_ACTION,
+		...GLOBAL_ACTIONS
+	]),
 	modelId: Type.Union([Type.String({
 		minLength: 1,
 		maxLength: 100
@@ -38959,7 +39052,7 @@ const openStoredBundle = (storage, stored) => storage.get(stored.driver).getStre
 const removeStoredBundle = (storage, stored) => storage.get(stored.driver).delete(stored.key);
 //#endregion
 //#region src/constants/version.ts
-const SHAPIO_VERSION = "0.5.0";
+const SHAPIO_VERSION = "0.5.2";
 //#endregion
 //#region src/repositories/transferExport.ts
 /**
@@ -41109,18 +41202,22 @@ const appAuthRoutes = async (app) => {
 };
 //#endregion
 //#region src/controllers/delivery.ts
+const cacheControlOf = (request, noStore) => {
+	if (noStore) return DRAFTS_CACHE_CONTROL;
+	return request.principal.kind === "anonymous" ? "public, max-age=0, must-revalidate" : "private, max-age=0, must-revalidate";
+};
 /**
 * Delivery responses are cacheable by validators: a strong ETag over the exact body (so it changes whenever
 * a head version, a populated target or the projection changes), `Vary` on the credentials that select the
 * principal and on the `Shapio-Site` header that selects the site (`?site=` is part of the URL), and `private`
-* caching whenever a principal is authenticated (build plan §4.E6).
+* caching whenever a principal is authenticated (build plan §4.E6). `noStore`: draft reads, never stored.
 */
-const sendCacheable = (request, reply, payload) => {
+const sendCacheable = (request, reply, payload, { noStore = false } = {}) => {
 	const body = JSON.stringify(payload);
 	const etag = `"${createHash("sha256").update(body).digest("base64url").slice(0, 32)}"`;
 	reply.header("etag", etag);
 	appendVary(reply, DELIVERY_VARY);
-	reply.header("cache-control", request.principal.kind === "anonymous" ? "public, max-age=0, must-revalidate" : "private, max-age=0, must-revalidate");
+	reply.header("cache-control", cacheControlOf(request, noStore));
 	const match = request.headers["if-none-match"];
 	if (typeof match === "string" && match.split(",").some((candidate) => candidate.trim() === etag)) return reply.code(304).send();
 	return reply.type("application/json; charset=utf-8").send(body);
@@ -41130,15 +41227,17 @@ const usageOptions = (request) => ({
 	usage: request.server.usage,
 	defer: (task) => request.server.recordUsageAfterResponse(request.log, task)
 });
+/** A delivery response, never stored by a cache when it carries drafts. */
+const sendDelivery = (request, reply, result) => sendCacheable(request, reply, result, { noStore: result.meta.publicationState === "draft" });
 const listDelivery = async (request, reply) => {
 	const context = await contentContextFor(request);
 	const apiKey = apiKeyOfRoute(context.snapshot, request.params.modelKey);
-	return sendCacheable(request, reply, await listDelivery$1(context, apiKey, rawQueryOf(request), usageOptions(request)));
+	return sendDelivery(request, reply, await listDelivery$1(context, apiKey, rawQueryOf(request), usageOptions(request)));
 };
 const getDelivery = async (request, reply) => {
 	const context = await contentContextFor(request);
 	const apiKey = apiKeyOfRoute(context.snapshot, request.params.modelKey);
-	return sendCacheable(request, reply, await getDelivery$1(context, apiKey, request.params.id, rawQueryOf(request), usageOptions(request)));
+	return sendDelivery(request, reply, await getDelivery$1(context, apiKey, request.params.id, rawQueryOf(request), usageOptions(request)));
 };
 //#endregion
 //#region src/controllers/deliveryWrites.ts
@@ -41806,6 +41905,16 @@ const itemParameters = (model, delivery) => [
 			},
 			description: "Rich-text shape: the JSON document, sanitized HTML rendered from it, or both"
 		},
+		{
+			name: "publicationState",
+			in: "query",
+			schema: {
+				type: "string",
+				enum: [...PUBLICATION_STATES],
+				default: "published"
+			},
+			description: "Drafts mode: `draft` reads saved drafts instead of published content. Needs a delivery token whose role grants Read drafts (or an admin user); responses are never cached. Cannot be combined with `snapshot`."
+		},
 		...seoParameters(model)
 	] : []
 ];
@@ -41831,7 +41940,12 @@ const modelPaths = (model) => {
 		type: "object",
 		properties: {
 			locale: { type: "string" },
-			snapshot: { type: "integer" }
+			snapshot: { type: "integer" },
+			publicationState: {
+				type: "string",
+				enum: ["draft"],
+				description: "Present on draft reads only"
+			}
 		}
 	};
 	const listMeta = { allOf: [meta, {
@@ -49510,4 +49624,4 @@ const startDedicatedWorker = async (config) => {
 //#endregion
 export { parseLockFile as $, buildEditorManifest as A, RESERVED_DEFINITION_API_KEYS as B, loopbackUrl as C, BEFORE_EVENTS as D, AFTER_EVENTS as E, lockById$5 as F, THEME_VARIANTS as G, RESERVED_TYPE_NAMES as H, update$8 as I, hashDefinition as J, checkThemeContrast as K, STORAGE_DRIVERS$1 as L, isValidStorageKey as M, listForAssets as N, EXTENSION_JOB_PREFIX as O, listLiveByDriver as P, parseDefinition as Q, describeError as R, createUrlBuilder as S, loadProjectConfig as T, SCHEMA_KIND_DIRECTORIES as U, RESERVED_FIELD_API_KEYS as V, SITES_DIRECTORY as W, lockEntriesForSite as X, lockCoversSite as Y, mergePulledLock as Z, listAllSites as _, loadConfig as a, toTypeName as at, generateToken as b, bucketContentDisposition as c, withSiteCovered as ct, migrateToLatest as d, createStableId as dt, schemaFilePath as et, SHAPIO_VERSION as f, validateRichText as ft, createSite$1 as g, ObjectNotFoundError as h, assertDatabaseReachable as i, suggestPlural as it, encodeKeyPath as j, EXTENSION_ROUTE_ROOT as k, contentDisposition as l, RICHTEXT_FORMAT as lt, InvalidStorageKeyError as m, sqliteDriverOf as mt, startServer as n, serializeDefinition as nt, loadEnvFileIfPresent as o, upgradeLockFile as ot, createMediaStorage as p, createDb as pt, foldApiKey as q, copyObjectVerified as r, serializeLockFile as rt, buildApp as s, validateSchema as st, startDedicatedWorker as t, scopeDirectory as tt, getPendingMigrations as u, SAFE_LINK_PATTERN as ut, createAdminDirect as v, SITE_KEY_PATTERN as w, createLogger as x, SYSTEM_CLI_ACTOR as y, LOCK_FILE_PATH as z };
 
-//# sourceMappingURL=worker-jz_0yAmS.js.map
+//# sourceMappingURL=worker-W5eY5lSj.js.map