@shapio/cms 0.5.9 → 0.5.10

package/dist/{worker-6ru1tYBs.js → worker-DHm2JwMZ.js}

@@ -1,5 +1,5 @@
-import { a as buildAssetKey, c as isValidStorageKey, d as withVisibility, i as ObjectNotFoundError, l as sanitizeFilename, n as contentDisposition, o as buildVariantKey, r as InvalidStorageKeyError, s as encodeKeyPath, u as visibilityOfKey } from "./contentDisposition-DOL2Xt0l.js";
-import { i as isHookError, n as HookError } from "./public-B57h4F7Y.js";
+import { a as buildAssetKey, c as isValidStorageKey, d as withVisibility, i as ObjectNotFoundError, l as sanitizeFilename, n as contentDisposition, o as buildVariantKey, r as InvalidStorageKeyError, s as encodeKeyPath, u as visibilityOfKey } from "./contentDisposition-DzhPhncr.js";
+import { i as isHookError, n as HookError } from "./public-sJCQaNaP.js";
 import { createRequire } from "node:module";
 import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { closeSync, createReadStream, createWriteStream, existsSync, openSync, readFileSync, statSync } from "node:fs";
@@ -2065,7 +2065,7 @@ const REFUSES_UPDATES = /* @__PURE__ */ new Set(["content_revisions", "schema_re
 const targetOf = (conflict) => conflict.columns?.map((column) => column.column.name);
 /**
 * `ON CONFLICT … DO UPDATE` as `ON DUPLICATE KEY UPDATE`, and `ON CONFLICT … DO NOTHING` without RETURNING
-* as `ON DUPLICATE KEY UPDATE <key> = <key>` (a no-op), when MySQL's any-key behaviour equals the target's
+* as `ON DUPLICATE KEY UPDATE <key> = <key>` (a no-op), when MySQL's any-key behavior equals the target's
 * (`duplicateKeyMatchesTarget`). Any other conflict clause (another unique key could fire, a `WHERE` on the
 * update, RETURNING) is left for the compiler's plan: each row inserted under a savepoint, and a duplicate
 * on the target either skipped or turned into an UPDATE of the row it found.
@@ -2277,7 +2277,7 @@ const insertPlan = (node, compile) => {
 /**
 * Subquery shapes MySQL rejects, rewritten (ADR 0001, "MySQL"): `IN (… LIMIT n)` (error 1235) and a subquery
 * reading the table an UPDATE, DELETE or INSERT writes (error 1093) read a derived table instead, which MySQL
-* materialises first; PostgreSQL's `UPDATE … FROM` becomes a multi-table UPDATE.
+* materializes first; PostgreSQL's `UPDATE … FROM` becomes a multi-table UPDATE.
 */
 /** The alias of a derived table wrapped around a subquery. */
 const DERIVED_ALIAS = "shapio_derived";
@@ -2287,7 +2287,7 @@ const tableNameOf$1 = (node) => node && TableNode.is(node) ? node.table.identifi
 * reads `table`, the target of the enclosing UPDATE, DELETE or INSERT (error 1093).
 */
 const needsDerivedTable = (node, table) => node.limit !== void 0 || table !== void 0 && ((node.from?.froms ?? []).some((item) => tableNameOf$1(AliasNode.is(item) ? item.node : item) === table) || (node.joins ?? []).some((join) => tableNameOf$1(AliasNode.is(join.table) ? join.table.node : join.table) === table));
-/** `(select * from (<subquery>) as shapio_derived)`: MySQL materialises it first. */
+/** `(select * from (<subquery>) as shapio_derived)`: MySQL materializes it first. */
 const derived = (node) => Object.freeze({
 	...SelectQueryNode.createFrom([AliasNode.create(node, IdentifierNode.create(DERIVED_ALIAS))]),
 	selections: [SelectionNode.create(SelectAllNode.create())]
@@ -2317,7 +2317,7 @@ var DerivedTableWrapper = class extends OperationNodeTransformer {
 const wrapSubqueries = (where, table) => where ? new DerivedTableWrapper(table).transformNode(where) : where;
 /**
 * An INSERT whose VALUES read the target table in a scalar subquery (`coalesce(max(position) + 1, 0)`):
-* MySQL rejects that (error 1093) unless the subquery reads a derived table, which it materialises first.
+* MySQL rejects that (error 1093) unless the subquery reads a derived table, which it materializes first.
 */
 const withDerivedValueSubqueries = (node) => {
 	const table = node.into?.table.identifier.name;
@@ -2494,7 +2494,7 @@ var ShapioMysqlQueryCompiler = class ShapioMysqlQueryCompiler extends MysqlQuery
 //#endregion
 //#region src/db/notifyHub.ts
 /**
-* In-process notification delivery (ADR 0002 notes notifications are an optimisation; consumers also check
+* In-process notification delivery (ADR 0002 notes notifications are an optimization; consumers also check
 * a durable version): an event bus per database. Every handle on the same database in this process shares
 * one bus, so two app instances in one test process still hear each other.
 * - SQLite: the only delivery (SQLite deployments are single-process).
@@ -2880,7 +2880,7 @@ var MysqlDriver = class {
 		this.#pool = pool;
 	}
 	#pooled() {
-		if (!this.#pool) throw new Error("The MySQL driver is not initialised");
+		if (!this.#pool) throw new Error("The MySQL driver is not initialized");
 		return this.#pool;
 	}
 	/**
@@ -3044,7 +3044,7 @@ const ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}/;
 */
 const timestampText = (value) => typeof value === "string" && ISO_TIMESTAMP.test(value) ? toDatetimeText(value) : value;
 const isTimestampColumn = (table, column) => table !== void 0 && (tableInfo(table)?.timestamps ?? []).includes(column);
-/** A value node (or primitive list) bound to a timestamp column, with ISO text normalised. */
+/** A value node (or primitive list) bound to a timestamp column, with ISO text normalized. */
 const timestampValue = (node) => {
 	if (ValueNode.is(node)) {
 		const value = timestampText(node.value);
@@ -3053,7 +3053,7 @@ const timestampValue = (node) => {
 	if (PrimitiveValueListNode.is(node)) return PrimitiveValueListNode.create(node.values.map(timestampText));
 	return node;
 };
-/** Insert rows with ISO text for timestamp columns normalised. */
+/** Insert rows with ISO text for timestamp columns normalized. */
 const withTimestampValues = (node) => {
 	const table = node.into?.table.identifier.name;
 	const positions = (node.columns?.map((column) => column.column.name) ?? []).flatMap((column, index) => isTimestampColumn(table, column) ? [index] : []);
@@ -3172,7 +3172,7 @@ const decodeRow = (row, markers) => {
 * Adapts Kysely queries written for PostgreSQL to MySQL (dialect boundary, ADR 0001, "MySQL"). Rewrites that
 * stay one statement happen here; statements MySQL cannot run as one (`RETURNING`, most `ON CONFLICT`) are
 * planned by the compiler (`plans.ts`). This plugin:
-* - fills the columns PostgreSQL defaults that MySQL cannot, and normalises ISO text bound to timestamp
+* - fills the columns PostgreSQL defaults that MySQL cannot, and normalizes ISO text bound to timestamp
 *   columns (`insertValues.ts`);
 * - spells casts MySQL's way (`text` → `char`, `bigint`/`integer` → `signed`) and maps row locks MySQL lacks;
 * - keeps PostgreSQL's NULL placement in ORDER BY (`nullOrdering.ts`);
@@ -3393,7 +3393,7 @@ const currentTimestamp = () => {
 };
 /**
 * A bound value read as a timestamp (ISO-8601 text or a Date; null stays null).
-* PostgreSQL: `cast($1 as timestamptz)`. SQLite: the value normalised by `toStoredTimestamp` and bound.
+* PostgreSQL: `cast($1 as timestamptz)`. SQLite: the value normalized by `toStoredTimestamp` and bound.
 * MySQL: `cast($1 as datetime(6))` with UTC `DATETIME` text (ISO text keeps its microseconds).
 * Contract: compares and sorts against timestamp columns as an instant, at the precision the text carries
 * (microseconds from `timestampCursorText` on PostgreSQL, milliseconds on SQLite).
@@ -3918,7 +3918,7 @@ const indexExpressionSql = (index) => index.columns.map((column) => index.nullab
 const nullsNotDistinctIndexFor = (table, columns) => NULLS_NOT_DISTINCT_INDEXES.find((index) => index.table === table && index.columns.length === columns.length && index.columns.every((column) => columns.includes(column)));
 //#endregion
 //#region src/db/sqlite/plugin.ts
-/** Row-lock modifiers PostgreSQL needs and SQLite rejects; its write transactions are already serialised. */
+/** Row-lock modifiers PostgreSQL needs and SQLite rejects; its write transactions are already serialized. */
 const ROW_LOCKS = /* @__PURE__ */ new Set([
 	"ForUpdate",
 	"ForNoKeyUpdate",
@@ -4102,7 +4102,7 @@ const OPTIMIZE = {
 };
 /**
 * A Kysely driver over Node's built-in `node:sqlite` (no native dependency). One writer connection runs
-* every write, serialised by an in-process lock (`writeLock.ts`, `BEGIN IMMEDIATE`); reader connections
+* every write, serialized by an in-process lock (`writeLock.ts`, `BEGIN IMMEDIATE`); reader connections
 * serve read-only transactions and autocommit reads concurrently (WAL). An in-memory database has the
 * writer only, and every statement takes the lock.
 */
@@ -4331,7 +4331,7 @@ var SqliteSession = class {
 //#region src/db/sqlite/index.ts
 /**
 * SQLite runs DDL inside transactions, so each migration commits or rolls back whole. The driver handles
-* concurrency itself (one writer, several readers), so Kysely must not serialise connections on top.
+* concurrency itself (one writer, several readers), so Kysely must not serialize connections on top.
 */
 var ShapioSqliteAdapter = class extends SqliteAdapter {
 	get supportsTransactionalDdl() {
@@ -5260,11 +5260,11 @@ const richTextMediaIds = (document) => {
 	return [...ids];
 };
 //#endregion
-//#region ../../packages/schema/dist/resolve-viddCEYd.js
+//#region ../../packages/schema/dist/resolve-Csjpkpue.js
 /**
 * The built-in SEO component (plan seo-fields). It is ordinary schema data, created through the change planner
 * and always shared with every site; what makes it "the" SEO component is its stable ID, never its API ID, so
-* a renamed or extended copy is still recognised and an unrelated `seo` component (an import) never is.
+* a renamed or extended copy is still recognized and an unrelated `seo` component (an import) never is.
 */
 const SEO_COMPONENT_ID = "f3905a00-d2a3-4c62-899a-c894bfd6cb9b";
 /** Stable field IDs of the built-in's fields. Resolver and admin look fields up by these. */
@@ -6297,7 +6297,7 @@ const entries = [
 		optionsSchema: Type.Object({ collapsed: Type.Optional(Type.Boolean()) }, closed$1$1)
 	}
 ];
-const EDITOR_CATALOGUE = new Map(entries.map((entry) => [entry.id, entry]));
+const EDITOR_CATALOG = new Map(entries.map((entry) => [entry.id, entry]));
 /** The editor a field gets when its definition names none. */
 const DEFAULT_EDITORS = {
 	string: "textInput",
@@ -7167,7 +7167,7 @@ const checkFlags = (field, path, isComponent) => {
 const checkEditor = (field, path) => {
 	const { id, options } = field.editor;
 	if (isCustomEditorId(id)) return [];
-	const entry = EDITOR_CATALOGUE.get(id);
+	const entry = EDITOR_CATALOG.get(id);
 	if (!entry) return [issue$1(`${path}/editor/id`, "UNKNOWN_EDITOR", `"${id}" is not a built-in editor (custom editors use a vendor.name ID)`)];
 	if (!entry.dataTypes.includes(field.type) || !(entry.supports?.(field) ?? true)) return [issue$1(`${path}/editor/id`, "INCOMPATIBLE_EDITOR", `the ${id} editor cannot edit this ${field.type} field`)];
 	return collectSchemaErrors(entry.optionsSchema, options, `${path}/editor/options`).map((error) => issue$1(error.path, "INVALID_EDITOR_OPTIONS", error.message));
@@ -8544,11 +8544,11 @@ const BUILT_IN_THEME_KEYS = [
 	"butter"
 ];
 /**
-* A token value an extension may use: a hex colour or a colour function whose arguments are numbers, units
+* A token value an extension may use: a hex color or a color function whose arguments are numbers, units
 * and separators only (no `;`, quotes, braces or nested functions such as `url()` or `var()`), so a value
 * can never escape its declaration.
 */
-const THEME_COLOUR_PATTERN = /^(?:#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})|(?:rgba?|hsla?|oklch|oklab)\([0-9a-z.,%\s/+-]{1,80}\))$/;
+const THEME_COLOR_PATTERN = /^(?:#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})|(?:rgba?|hsla?|oklch|oklab)\([0-9a-z.,%\s/+-]{1,80}\))$/;
 const SURFACES = [
 	"background",
 	"card",
@@ -8631,7 +8631,7 @@ const luminance = (hex) => {
 	].map((index) => channel(parseInt(hex.slice(index, index + 2), 16)));
 	return .2126 * (r ?? 0) + .7152 * (g ?? 0) + .0722 * (b ?? 0);
 };
-/** The WCAG contrast ratio of two `#rrggbb` colours. */
+/** The WCAG contrast ratio of two `#rrggbb` colors. */
 const contrastRatio = (a, b) => {
 	const [high = 0, low = 0] = [luminance(a), luminance(b)].sort((x, y) => y - x);
 	return (high + .05) / (low + .05);
@@ -8844,7 +8844,7 @@ const purgeDeletedEntriesOfModels = async (modelIds, trx) => {
 /**
 * The publication sequence and log behind `?snapshot=N` (ADR 0001). The sequence is one row incremented
 * inside each publishing transaction: its row lock orders publications by commit, so a reader that sees N
-* also sees every publication before N. Take it as late as possible in the transaction (it serialises every
+* also sees every publication before N. Take it as late as possible in the transaction (it serializes every
 * publication instance-wide until commit), and never ahead of the transaction that uses it.
 *
 * Every number also gets a `publication_snapshots` ledger row (why, who, the schema version live with it),
@@ -9032,7 +9032,7 @@ const purgeDefinitions = async (ids, trx = db) => {
 	await trx.deleteFrom("models").where("id", "in", ids).execute();
 };
 /**
-* Keeps the denormalised kind, API key and scope in step with the active revision; also undeletes. The scope
+* Keeps the denormalized kind, API key and scope in step with the active revision; also undeletes. The scope
 * only differs from the stored one for a scope change (`ActivationItem.moveScope`).
 */
 const markModelActive = (model, trx = db) => trx.updateTable("models").set({
@@ -9305,7 +9305,7 @@ const sleep = (ms, signal) => new Promise((resolve) => {
 //#region src/db/sqlite/keyedMutex.ts
 /**
 * An in-process mutex per key: SQLite's stand-in for PostgreSQL session advisory locks (migrations, index
-* builds). It serialises holders inside one process only; SQLite deployments are single-process.
+* builds). It serializes holders inside one process only; SQLite deployments are single-process.
 */
 const TAILS = /* @__PURE__ */ new Map();
 /** Runs `fn` while holding the lock for `key`; waiters run in arrival order. */
@@ -9417,10 +9417,10 @@ const acquireXactLockShared = async (trx, namespace, key) => {
 //#endregion
 //#region src/schema/planner/locks.ts
 /**
-* Serialises every schema activation (and the start of every planned change) instance-wide. Activations are
+* Serializes every schema activation (and the start of every planned change) instance-wide. Activations are
 * rare, and holding this lock while re-validating the whole schema closes races between changes to
 * *different* definitions (e.g. two renames to colliding GraphQL names). It lives in the model namespace;
-* a collision with a model's hash only costs extra serialisation.
+* a collision with a model's hash only costs extra serialization.
 */
 const SCHEMA_ACTIVATION_LOCK_KEY = lockKeyFromId("shapio:schema-activation");
 /**
@@ -10879,7 +10879,7 @@ const MEDIA_PROCESS_JOB = "media.process";
 const MEDIA_PURGE_JOB = "media.purge";
 const MEDIA_RELOCATE_JOB = "media.relocate";
 const MEDIA_GRANT_EXPIRE_JOB = "media.grant.expire";
-/** Outbox event types (webhook catalogue `media.*`, package H). */
+/** Outbox event types (webhook catalog `media.*`, package H). */
 const MEDIA_EVENTS = {
 	created: "media.created",
 	updated: "media.updated",
@@ -12884,7 +12884,7 @@ const getOwnerRoleId = async (trx) => {
 const isOwnerActor = (actor, ownerRoleId) => actor.kind === "system" || actor.kind === "admin" && actor.networkRoleIds.includes(ownerRoleId);
 /**
 * Inserts an admin user with role assignments (`roleIds`: those roles on every site). Shared by setup,
-* invitations and `shapio admin create`; the caller owns the transaction, validation, authorisation and
+* invitations and `shapio admin create`; the caller owns the transaction, validation, authorization and
 * audit.
 */
 const insertAdminUser = async (input, trx) => {
@@ -12909,7 +12909,7 @@ const getAdminUser = async (id) => {
 	if (!row) throw notFound$7();
 	return toAdminUserView(row);
 };
-/** Fails when no active owner other than `exceptUserId` would remain. Locks owners to serialise checks. */
+/** Fails when no active owner other than `exceptUserId` would remain. Locks owners to serialize checks. */
 const assertAnotherOwnerRemains = async (exceptUserId, trx) => {
 	if (!(await lockActiveHoldersOfRoleKey(SYSTEM_ROLE_KEYS.owner, trx)).some((owner) => owner.id !== exceptUserId)) throw new AppError(409, "LAST_OWNER", "Shapio needs at least one active owner");
 };
@@ -14817,7 +14817,7 @@ const groupByRole = (grants) => {
 * Every role's grants, held in memory and reloaded when `system_versions.permissions_version` moves.
 * The version is checked on every lookup: read here, or read once by the request (`versions`, see
 * `KnownVersions`). That durable check is what makes a permission change visible to every instance from the
-* next request (NOTIFY would only be an optimisation). Lookups on the pool share one reload; a
+* next request (NOTIFY would only be an optimization). Lookups on the pool share one reload; a
 * lookup inside a transaction reads (and, when stale, reloads) through that transaction alone, never
 * through a reload running on another request's transaction.
 */
@@ -15414,7 +15414,7 @@ const findNamingProblems = (config) => {
 	return [...problems, ...findThemeProblems(config.themes)];
 };
 const BUILT_IN_THEMES = new Set(BUILT_IN_THEME_KEYS);
-/** Theme keys (pattern, built-in, unique), at least one variant, and colour values (no CSS injection). */
+/** Theme keys (pattern, built-in, unique), at least one variant, and color values (no CSS injection). */
 const findThemeProblems = (themes) => {
 	const problems = [];
 	const keys = /* @__PURE__ */ new Set();
@@ -15442,9 +15442,9 @@ const findThemeProblems = (themes) => {
 		});
 		for (const variant of THEME_VARIANTS) {
 			const tokens = theme[variant];
-			for (const [token, value] of Object.entries(isRecord$6(tokens) ? tokens : {})) if (typeof value === "string" && !THEME_COLOUR_PATTERN.test(value)) problems.push({
+			for (const [token, value] of Object.entries(isRecord$6(tokens) ? tokens : {})) if (typeof value === "string" && !THEME_COLOR_PATTERN.test(value)) problems.push({
 				path: `${path}/${variant}/${token}`,
-				message: `"${value}" is not a colour: use #rrggbb, rgb(), hsl(), oklch() or oklab()`
+				message: `"${value}" is not a color: use #rrggbb, rgb(), hsl(), oklch() or oklab()`
 			});
 		}
 	});
@@ -17625,7 +17625,7 @@ const themeCss = (theme) => {
 		return block(selector, tokens);
 	}).join("\n");
 };
-const buildThemeCatalogue = (themes) => ({
+const buildThemeCatalog = (themes) => ({
 	items: themes.map((theme) => ({
 		key: theme.key,
 		name: theme.name,
@@ -17835,7 +17835,7 @@ const resolveMediaOrigins = async (storage) => {
 	const base = originOf(storage.publicBaseUrl);
 	if (base) origins.add(base);
 	if (storage.s3) {
-		const { createS3Adapter } = await import("./s3Adapter-U01iEAcK.js");
+		const { createS3Adapter } = await import("./s3Adapter-CZcCl0sy.js");
 		const adapter = createS3Adapter({
 			config: storage.s3,
 			publicBaseUrl: void 0
@@ -17939,7 +17939,7 @@ const LAST_SEEN_WRITE_INTERVAL_MS = 6e4;
 const CSRF_HEADER = "x-csrf-token";
 const INVITATION_TTL_MS = 6048e5;
 const PASSWORD_RESET_TTL_MS = 36e5;
-/** API tokens carry a recognisable prefix (secret scanners, and telling them apart from app-user JWTs). */
+/** API tokens carry a recognizable prefix (secret scanners, and telling them apart from app-user JWTs). */
 const API_TOKEN_PREFIX = "shp_";
 /** Rate limits for unauthenticated credential endpoints. Per IP via @fastify/rate-limit route config. */
 const CREDENTIAL_RATE_LIMIT_PER_IP = {
@@ -18044,7 +18044,7 @@ const isSetupRequired = async (database = db) => await countAll(database) === 0;
 /**
 * At boot, while no admin exists: supersedes any earlier setup token and issues a new one. Returns the
 * token for the caller to show exactly once (it is stored only as a hash), or undefined when setup is done.
-* Serialised with setup itself by the setup advisory lock.
+* Serialized with setup itself by the setup advisory lock.
 */
 const issueSetupToken = async (database) => database.transaction().execute(async (trx) => {
 	await acquireXactLock(trx, LOCK_NAMESPACE.setup, 1);
@@ -18206,7 +18206,7 @@ const findSummaryByIdInSite = (id, siteId, trx = db) => summaries(trx).where("ap
 const findByEmailWithHash = (siteId, email, trx = db) => trx.selectFrom("app_users").selectAll().where("site_id", "=", siteId).where((eb) => eb(eb.fn("lower", ["email"]), "=", email.toLowerCase())).where("deleted_at", "is", null).executeTakeFirst();
 /** Includes the password hash: for credential checks only. Live (not deleted) accounts only. */
 const findByIdWithHash = (id, trx = db) => trx.selectFrom("app_users").selectAll().where("id", "=", id).where("deleted_at", "is", null).executeTakeFirst();
-/** Locks the live account row (status changes, deletion and credential changes serialise on it). */
+/** Locks the live account row (status changes, deletion and credential changes serialize on it). */
 const lockById$2 = (id, trx) => trx.selectFrom("app_users").selectAll().where("id", "=", id).where("deleted_at", "is", null).forUpdate().executeTakeFirst();
 /** Locks the live account row of one site (another site's account reads as not found). */
 const lockByIdInSite = (id, siteId, trx) => trx.selectFrom("app_users").selectAll().where("id", "=", id).where("site_id", "=", siteId).where("deleted_at", "is", null).forUpdate().executeTakeFirst();
@@ -19831,11 +19831,11 @@ const jsonInstruction = (request) => request.json ? `\n\nAnswer with one JSON ob
 * Chat Completions (`POST {AI_BASE_URL}/chat/completions`). `openai` uses `response_format` with the
 * schema; `openai-compatible` (Ollama, LM Studio, vLLM) gets the schema in the prompt.
 */
-const createChatCompletionsProvider = (transport, flavour) => ({
-	id: flavour,
+const createChatCompletionsProvider = (transport, flavor) => ({
+	id: flavor,
 	model: transport.config.model,
 	complete: async (request) => {
-		const native = flavour === "openai";
+		const native = flavor === "openai";
 		const system = native ? request.system : `${request.system}${jsonInstruction(request)}`;
 		const responseFormat = request.json && native ? {
 			type: "json_schema",
@@ -20785,9 +20785,9 @@ const createMysqlNotificationListener = (options) => {
 //#endregion
 //#region src/db/notifications.ts
 /**
-* LISTEN/NOTIFY primitives (ADR 0002). Notifications are an optimisation only: a listener can miss
+* LISTEN/NOTIFY primitives (ADR 0002). Notifications are an optimization only: a listener can miss
 * messages while disconnected, so every consumer must also check a durable version. Callers get an
-* `onConnect` callback after every (re)connect to resynchronise for anything missed in between.
+* `onConnect` callback after every (re)connect to resynchronize for anything missed in between.
 *
 * SQLite: `shapio_notify()` queues on the connection and an in-process bus delivers on commit
 * (`notifyHub.ts`); only listeners in the same process hear it.
@@ -21742,9 +21742,9 @@ const THEMED = [
 ];
 const themed = (theme) => THEMED.map((selector) => `body.graphiql-${theme} ${selector}`).join(",\n");
 /**
-* Page layout, and GraphiQL's palette adjusted to WCAG AA: every text colour (syntax highlighting, links,
+* Page layout, and GraphiQL's palette adjusted to WCAG AA: every text color (syntax highlighting, links,
 * secondary text) reaches 4.5:1 on the backgrounds it is drawn on, in both themes (GraphiQL's own light
-* palette is 2.3–4.3:1 there), and links in the docs are underlined so they don't rely on colour alone.
+* palette is 2.3–4.3:1 there), and links in the docs are underlined so they don't rely on color alone.
 */
 const STYLE$1 = `html, body, #graphiql { height: 100%; margin: 0; }
 ${themed("light")} {
@@ -24681,7 +24681,7 @@ const createMediaStorage = async (config, deps) => {
 		publicBaseUrl: config.publicBaseUrl
 	}));
 	if (config.s3) {
-		const { createS3Adapter } = await import("./s3Adapter-U01iEAcK.js");
+		const { createS3Adapter } = await import("./s3Adapter-CZcCl0sy.js");
 		adapters.set("s3", createS3Adapter({
 			config: config.s3,
 			publicBaseUrl: config.publicBaseUrl
@@ -24858,7 +24858,7 @@ const CORS_METHODS = [
 /**
 * Baseline HTTP hardening: security headers, CORS (off unless origins are configured; the admin and API
 * share one origin, so CORS is only for the user's own sites and apps), a global rate limit keyed by the
-* client IP (which honours TRUST_PROXY), and @fastify/sensible's httpErrors.
+* client IP (which honors TRUST_PROXY), and @fastify/sensible's httpErrors.
 * The rate-limit store is in memory, so with several instances each counts on its own (documented: put a
 * shared limiter in front for strict limits; ADR 0008).
 */
@@ -24925,11 +24925,11 @@ const textInputPlugin = fp(async (app) => {
 	});
 }, { name: "shapio-text-input" });
 //#endregion
-//#region src/plugins/themeCatalogue.ts
-/** The catalogue is built from the project config by the app (extensions/themeStylesheet.ts). */
-const themeCataloguePlugin = fp(async (app, { catalogue }) => {
-	app.decorate("themeCatalogue", catalogue);
-}, { name: "shapio-theme-catalogue" });
+//#region src/plugins/themeCatalog.ts
+/** The catalog is built from the project config by the app (extensions/themeStylesheet.ts). */
+const themeCatalogPlugin = fp(async (app, { catalog }) => {
+	app.decorate("themeCatalog", catalog);
+}, { name: "shapio-theme-catalog" });
 //#endregion
 //#region src/repositories/usage.ts
 const upsertFieldReads = async (rows, trx = db) => {
@@ -25441,7 +25441,7 @@ const PUBLISHING_JOBS = {
 	deploymentTrigger: "deployment.trigger",
 	deploymentPoll: "deployment.poll"
 };
-/** Change set events (also in the webhook catalogue). `shipped` carries the snapshot it went live in. */
+/** Change set events (also in the webhook catalog). `shipped` carries the snapshot it went live in. */
 const CHANGE_SET_EVENTS = {
 	scheduled: "change_set.scheduled",
 	shipping: "change_set.shipping",
@@ -28479,13 +28479,13 @@ const RevisionSummarySchema = Type.Object({
 });
 /** A revision in a definition's history: whether its change went live, and whether it is the active one. */
 const RevisionListItemSchema = Type.Intersect([RevisionSummarySchema, Type.Object({
-	/** The change that wrote it: `failed` and `cancelled` revisions never went live. */
+	/** The change that wrote it: `failed` and `canceled` revisions never went live. */
 	status: Type.Union([
 		Type.Literal("pending"),
 		Type.Literal("running"),
 		Type.Literal("activated"),
 		Type.Literal("failed"),
-		Type.Literal("cancelled")
+		Type.Literal("canceled")
 	]),
 	active: Type.Boolean()
 })]);
@@ -29374,7 +29374,7 @@ const activateDefinitions = async (db, request) => {
 * with the schema version it activated. The ledger row of the change set's own site is `change_set`; other
 * sites' rows are `conversion` and name the change set; without a change set every row is `schema`. Each
 * site's number is taken on first use (a change set's publications, an entry-level conversion) or at the
-* end, under the schema lock, and that site's deferred work then runs with it. Activations are serialised
+* end, under the schema lock, and that site's deferred work then runs with it. Activations are serialized
 * by the schema lock and every other publisher holds one site's sequence row at most, so taking several
 * sites' rows in first-use order cannot deadlock. A metadata-only activation (a label rename) takes no
 * number anywhere: live content and every API response stay exactly as they were (brief §10).
@@ -30668,7 +30668,7 @@ const markFailed$2 = (id, error, now, trx = db) => trx.updateTable("scheduled_pu
 }).where("id", "=", id).where("status", "in", ["scheduled", "failed"]).execute();
 /** Cancels a schedule that has not run yet; returns the row when it changed. */
 const cancel = (id, now, trx = db) => trx.updateTable("scheduled_publications").set({
-	status: "cancelled",
+	status: "canceled",
 	updated_at: now
 }).where("id", "=", id).where("status", "in", ["scheduled", "failed"]).returningAll().executeTakeFirst();
 /** Whether the entry has a publication still scheduled (change kind waits for it). */
@@ -31143,9 +31143,9 @@ const getEditorFile = async (request, reply) => {
 	return reply.type("text/javascript; charset=utf-8").header("cache-control", "private, max-age=31536000, immutable").send(await readFile(entry.path));
 };
 //#endregion
-//#region src/controllers/themeCatalogue.ts
+//#region src/controllers/themeCatalog.ts
 /** The project's extension themes, for the admin's theme menu. */
-const listThemes = async (request) => ({ items: request.server.themeCatalogue.items });
+const listThemes = async (request) => ({ items: request.server.themeCatalog.items });
 let stylesheetEtag;
 const etagOf = (stylesheet) => {
 	if (stylesheetEtag?.stylesheet !== stylesheet) stylesheetEtag = {
@@ -31156,11 +31156,11 @@ const etagOf = (stylesheet) => {
 };
 /**
 * Their CSS, linked render-blocking from the admin's index.html (empty without extension themes). Public:
-* it holds colours only, and the signed-out screens render in the chosen theme too. Revalidated on each
+* it holds colors only, and the signed-out screens render in the chosen theme too. Revalidated on each
 * load (it changes only with a restart), so a changed theme shows without a stale cache.
 */
 const getThemeStylesheet = async (request, reply) => {
-	const { stylesheet } = request.server.themeCatalogue;
+	const { stylesheet } = request.server.themeCatalog;
 	const etag = etagOf(stylesheet);
 	reply.header("etag", etag).header("cache-control", "no-cache").type("text/css; charset=utf-8");
 	if (request.headers["if-none-match"] === etag) return reply.code(304).send();
@@ -31190,7 +31190,7 @@ const listThemesSchema = { response: { 200: Type.Object({ items: Type.Array(Type
 //#endregion
 //#region src/routes/admin/extensions/index.ts
 /**
-* /api/admin/extensions: what the project installed for the admin (custom field editors, ADR 0009; colour
+* /api/admin/extensions: what the project installed for the admin (custom field editors, ADR 0009; color
 * themes, docs/plans/themes.md).
 */
 const adminExtensionsRoutes = async (app) => {
@@ -33925,7 +33925,7 @@ const createReplaceGrant = async (context, assetId, input) => {
 const goneGrant = () => new AppError(404, "UPLOAD_GRANT_INVALID", "This upload grant is unknown, used or expired");
 /**
 * Local driver only: receives the bytes of a grant (the S3 driver's browser uploads go to the bucket).
-* Authorised by the grant's signature, not by a session. `readUpload` parses the request with the grant's
+* Authorized by the grant's signature, not by a session. `readUpload` parses the request with the grant's
 * size limit; the bytes stream to disk and are re-checked on confirm.
 */
 const receiveLocalUpload = async (context, grantId, readUpload) => {
@@ -34445,7 +34445,7 @@ const confirmUploadSchema = {
 };
 //#endregion
 //#region src/routes/admin/media/index.ts
-const NOT_AUDITED = "media library organisation (folders, metadata, moves) is recorded by media.* outbox events, not audited";
+const NOT_AUDITED = "media library organization (folders, metadata, moves) is recorded by media.* outbox events, not audited";
 const GRANT_ONLY = "issues an upload grant only; the change is audited on confirm (media.upload / media.replace)";
 /** /api/admin/media: the media library (folders, assets, uploads, usage). */
 const adminMediaRoutes = async (app) => {
@@ -35557,7 +35557,7 @@ const summarizeItem = (component, item, lookups) => {
 	}
 	return "";
 };
-const labelled = (label, summary) => summary ? `${label} (${summary})` : label;
+const labeled = (label, summary) => summary ? `${label} (${summary})` : label;
 const componentSummary = (field, value, lookups) => {
 	const component = lookups.component(field.settings.component);
 	const items = listOf(value);
@@ -35572,7 +35572,7 @@ const zoneSummary = (value, lookups) => {
 	const blocks = value.map((item) => {
 		const id = item[COMPONENT_KEY];
 		const component = typeof id === "string" ? lookups.component(id) : void 0;
-		return component ? labelled(component.label, summarizeItem(component, item, lookups)) : String(id);
+		return component ? labeled(component.label, summarizeItem(component, item, lookups)) : String(id);
 	});
 	return `${plural(value.length, "block", "blocks")}: ${blocks.join(", ")}`;
 };
@@ -40250,12 +40250,12 @@ const markDeliveryDead = (id, error, now, trx = db) => trx.updateTable("webhook_
 	updated_at: now
 }).where("id", "=", id).where("status", "in", ["pending", "retrying"]).execute();
 //#endregion
-//#region src/webhooks/catalogue.ts
+//#region src/webhooks/catalog.ts
 const group = (name, types) => types.map((type) => ({
 	type,
 	group: name
 }));
-const WEBHOOK_EVENT_CATALOGUE = [
+const WEBHOOK_EVENT_CATALOG = [
 	...group("entry", [
 		"entry.created",
 		"entry.updated",
@@ -40279,8 +40279,8 @@ const WEBHOOK_EVENT_CATALOGUE = [
 ];
 /** Sent by "Send test"; never produced by the outbox. */
 const WEBHOOK_TEST_EVENT = "webhook.test";
-const TYPES = new Set(WEBHOOK_EVENT_CATALOGUE.map((event) => event.type));
-const GROUPS = new Set(WEBHOOK_EVENT_CATALOGUE.map((event) => event.group));
+const TYPES = new Set(WEBHOOK_EVENT_CATALOG.map((event) => event.type));
+const GROUPS = new Set(WEBHOOK_EVENT_CATALOG.map((event) => event.group));
 const isValidEventPattern = (pattern) => TYPES.has(pattern) || pattern.endsWith(".*") && GROUPS.has(pattern.slice(0, -2));
 const matchesEvent = (patterns, type) => patterns.some((pattern) => pattern === type || pattern.endsWith(".*") && type.startsWith(pattern.slice(0, -1)));
 //#endregion
@@ -40356,7 +40356,7 @@ const assertEvents = (events) => {
 	const invalid = events.filter((event) => !isValidEventPattern(event));
 	if (invalid.length > 0) throw new AppError(400, "INVALID_EVENTS", `Unknown events: ${invalid.join(", ")}`, { invalid });
 };
-const listEventTypes$1 = () => WEBHOOK_EVENT_CATALOGUE;
+const listEventTypes$1 = () => WEBHOOK_EVENT_CATALOG;
 const listWebhooks$2 = async (runtime, site) => (await list$1(site.id, runtime.db)).map((row) => toView(runtime, row));
 const getWebhook$1 = async (runtime, site, id) => {
 	const row = await findSummaryVisible(site.id, id, runtime.db);
@@ -41029,7 +41029,7 @@ const cancelSchedule$1 = async (context, id) => {
 	if (!existing) throw scheduleNotFound(id);
 	if (modelKey) await modelWithPolicy(context, modelKey, "publish");
 	await context.db.transaction().execute(async (trx) => {
-		if (!await cancel(id, /* @__PURE__ */ new Date(), trx)) throw new AppError(409, "SCHEDULE_NOT_PENDING", "Only schedules that have not run can be cancelled", {
+		if (!await cancel(id, /* @__PURE__ */ new Date(), trx)) throw new AppError(409, "SCHEDULE_NOT_PENDING", "Only schedules that have not run can be canceled", {
 			id,
 			status: existing.status
 		});
@@ -41090,7 +41090,7 @@ const ScheduleStatusSchema = Type.Enum([
 	"scheduled",
 	"done",
 	"failed",
-	"cancelled"
+	"canceled"
 ]);
 const ScheduleSchema = Type.Object({
 	id: UuidSchema,
@@ -41145,7 +41145,7 @@ const cancelScheduleSchema = {
 //#endregion
 //#region src/routes/admin/publishing/schedules/index.ts
 /**
-* /api/admin/publishing/schedules: publish-at / unpublish-at per entry and locale. Creating and cancelling
+* /api/admin/publishing/schedules: publish-at / unpublish-at per entry and locale. Creating and canceling
 * need publish permission on the model (checked by the service through the evaluator); listing everything
 * needs `publishing.manage`, listing one entry's schedules needs read permission on its model.
 */
@@ -42921,7 +42921,7 @@ const openStoredBundle = (storage, stored) => storage.get(stored.driver).getStre
 const removeStoredBundle = (storage, stored) => storage.get(stored.driver).delete(stored.key);
 //#endregion
 //#region src/constants/version.ts
-const SHAPIO_VERSION = "0.5.9";
+const SHAPIO_VERSION = "0.5.10";
 //#endregion
 //#region src/repositories/transferExport.ts
 /**
@@ -43612,7 +43612,7 @@ const readPayload = (payload) => {
 		pendingChangeIds: value.pendingChangeIds ?? []
 	};
 };
-/** The import acts as Shapio itself: the request that started it was authorised as an instance admin. */
+/** The import acts as Shapio itself: the request that started it was authorized as an instance admin. */
 const SYSTEM_ACTOR = {
 	kind: "system",
 	component: "transfer"
@@ -43653,7 +43653,7 @@ const forEachBatch = async (run, type, handle) => {
 };
 const waitForSchema = async (run) => {
 	const changes = await findSchemaChangeStatuses(run.payload.pendingChangeIds);
-	const failed = changes.find((change) => change.status === "failed" || change.status === "cancelled");
+	const failed = changes.find((change) => change.status === "failed" || change.status === "canceled");
 	if (failed) throw new PermanentJobError(`Schema change ${failed.id} failed: ${JSON.stringify(failed.error)}`);
 	if (changes.some((change) => change.status !== "activated")) throw new Error("Waiting for the imported schema changes to activate");
 };
@@ -44163,7 +44163,7 @@ const putMediaFileSchema = {
 /**
 * /api/admin/transfer: content export and import (`shapio export` / `shapio import`). Bundles and media
 * files travel as raw streams (never buffered whole), so this scope passes those bodies through unparsed.
-* The service authorises every call as an instance administrator.
+* The service authorizes every call as an instance administrator.
 */
 const adminTransferRoutes = async (app) => {
 	declareSiteScope(app, "site");
@@ -46442,14 +46442,14 @@ const docsRoutes = async (app) => {
 //#endregion
 //#region src/db/migrations/20261001120000_create_platform_tables.ts
 var _20261001120000_create_platform_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$34,
-	up: () => up$34
+	down: () => down$37,
+	up: () => up$37
 });
 /**
 * Foundation tables shared by every package: durable versions, the job queue, the transactional outbox
 * and the audit log. Statuses are text with CHECK constraints so new states need only a constraint change.
 */
-const up$34 = async (db) => {
+const up$37 = async (db) => {
 	await db.schema.createTable("system_versions").addColumn("id", "boolean", (col) => col.primaryKey().defaultTo(true).check(sql`id`)).addColumn("schema_version", "integer", (col) => col.notNull().defaultTo(0)).addColumn("permissions_version", "integer", (col) => col.notNull().defaultTo(0)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 	await sql`insert into system_versions default values`.execute(db);
 	await db.schema.createTable("jobs").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("type", "text", (col) => col.notNull()).addColumn("payload", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("status", "text", (col) => col.notNull().defaultTo("pending").check(sql`status in ('pending', 'running', 'succeeded', 'dead')`)).addColumn("priority", "integer", (col) => col.notNull().defaultTo(0)).addColumn("run_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("attempts", "integer", (col) => col.notNull().defaultTo(0)).addColumn("max_attempts", "integer", (col) => col.notNull().defaultTo(10).check(sql`max_attempts > 0`)).addColumn("idempotency_key", "text").addColumn("locked_by", "text").addColumn("locked_until", "timestamptz").addColumn("checkpoint", "jsonb").addColumn("result", "jsonb").addColumn("last_error", "text").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("finished_at", "timestamptz").execute();
@@ -46471,7 +46471,7 @@ const up$34 = async (db) => {
 		"occurred_at desc"
 	]).execute();
 };
-const down$34 = async (db) => {
+const down$37 = async (db) => {
 	await db.schema.dropTable("audit_events").execute();
 	await db.schema.dropTable("outbox_events").execute();
 	await db.schema.dropTable("jobs").execute();
@@ -46480,8 +46480,8 @@ const down$34 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001130000_create_admin_identity.ts
 var _20261001130000_create_admin_identity_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$33,
-	up: () => up$33
+	down: () => down$36,
+	up: () => up$36
 });
 /**
 * Admin identity (package B, ADR 0005): admin users, roles and their permission grants, server-side
@@ -46490,7 +46490,7 @@ var _20261001130000_create_admin_identity_exports = /* @__PURE__ */ __exportAll(
 */
 const withTimestamps$3 = (table) => table.addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`));
 const uuidPrimaryKey$3 = (table) => table.addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`));
-const up$33 = async (db) => {
+const up$36 = async (db) => {
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("admin_users")).addColumn("email", "text", (col) => col.notNull().unique()).addColumn("name", "text", (col) => col.notNull().defaultTo("")).addColumn("password_hash", "text", (col) => col.notNull()).addColumn("status", "text", (col) => col.notNull().defaultTo("active").check(sql`status in ('active', 'disabled')`)).addColumn("last_login_at", "timestamptz").addColumn("password_changed_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`))).execute();
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("admin_roles")).addColumn("key", "text", (col) => col.notNull().unique().check(sql`key ~ '^[a-z][a-z0-9-]{0,62}$'`)).addColumn("name", "text", (col) => col.notNull()).addColumn("description", "text", (col) => col.notNull().defaultTo("")).addColumn("kind", "text", (col) => col.notNull().defaultTo("admin").check(sql`kind in ('admin', 'delivery')`)).addColumn("is_system", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("version", "integer", (col) => col.notNull().defaultTo(1))).execute();
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("admin_role_permissions")).addColumn("role_id", "uuid", (col) => col.notNull().references("admin_roles.id").onDelete("cascade")).addColumn("action", "text", (col) => col.notNull()).addColumn("model_id", "text").addColumn("condition", "text", (col) => col.check(sql`condition in ('ownedByPrincipal')`)).addColumn("field_ids", sql`text[]`).addUniqueConstraint("admin_role_permissions_grant_uq", [
@@ -46510,7 +46510,7 @@ const up$33 = async (db) => {
 	await withTimestamps$3(uuidPrimaryKey$3(db.schema.createTable("api_tokens")).addColumn("name", "text", (col) => col.notNull()).addColumn("token_hash", "text", (col) => col.notNull().unique()).addColumn("token_prefix", "text", (col) => col.notNull()).addColumn("role_id", "uuid", (col) => col.notNull().references("admin_roles.id").onDelete("restrict")).addColumn("created_by", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("expires_at", "timestamptz").addColumn("last_used_at", "timestamptz").addColumn("revoked_at", "timestamptz")).execute();
 	await db.schema.createIndex("api_tokens_role_idx").on("api_tokens").column("role_id").execute();
 };
-const down$33 = async (db) => {
+const down$36 = async (db) => {
 	await db.schema.dropTable("api_tokens").execute();
 	await db.schema.dropTable("setup_tokens").execute();
 	await db.schema.dropTable("password_resets").execute();
@@ -46524,31 +46524,31 @@ const down$33 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001130500_create_system_settings.ts
 var _20261001130500_create_system_settings_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$32,
-	up: () => up$32
+	down: () => down$35,
+	up: () => up$35
 });
 /**
 * Instance-wide key/value settings that must survive restarts and be shared by every instance, e.g. the
 * generated signing secret. General purpose: later packages add keys, not tables.
 */
-const up$32 = async (db) => {
+const up$35 = async (db) => {
 	await db.schema.createTable("system_settings").addColumn("key", "text", (col) => col.primaryKey()).addColumn("value", "text", (col) => col.notNull()).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 };
-const down$32 = async (db) => {
+const down$35 = async (db) => {
 	await db.schema.dropTable("system_settings").execute();
 };
 //#endregion
 //#region src/db/migrations/20261001140000_create_schema_tables.ts
 var _20261001140000_create_schema_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$31,
-	up: () => up$31
+	down: () => down$34,
+	up: () => up$34
 });
 /**
 * Schema registry (package D, ADR 0002): models and components (one table, `kind` discriminator), immutable
 * schema revisions, the per-model active pointer, schema change jobs, locales and schema settings.
 * Model definitions are data: creating or changing a model never runs DDL (CONTRIBUTING.md rule 1).
 */
-const up$31 = async (db) => {
+const up$34 = async (db) => {
 	await db.schema.createTable("models").addColumn("id", "uuid", (col) => col.primaryKey()).addColumn("kind", "text", (col) => col.notNull().check(sql`kind in ('collection', 'singleton', 'component')`)).addColumn("api_key", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("deleted_at", "timestamptz").execute();
 	await sql`create unique index models_api_key_uq on models (lower(api_key)) where deleted_at is null`.execute(db);
 	await db.schema.createTable("schema_revisions").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("model_id", "uuid", (col) => col.notNull().references("models.id").onDelete("restrict")).addColumn("version", "integer", (col) => col.notNull().check(sql`version > 0`)).addColumn("definition", "jsonb", (col) => col.notNull()).addColumn("hash", "text", (col) => col.notNull()).addColumn("parent_revision_id", "uuid", (col) => col.references("schema_revisions.id")).addColumn("created_by_type", "text", (col) => col.notNull()).addColumn("created_by_id", "text").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addUniqueConstraint("schema_revisions_model_version_uq", ["model_id", "version"]).execute();
@@ -46576,7 +46576,7 @@ const up$31 = async (db) => {
 	await db.schema.createTable("schema_settings").addColumn("id", "boolean", (col) => col.primaryKey().defaultTo(true).check(sql`id`)).addColumn("read_only", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("read_only_reason", "text").addColumn("updated_by_type", "text").addColumn("updated_by_id", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 	await sql`insert into schema_settings default values`.execute(db);
 };
-const down$31 = async (db) => {
+const down$34 = async (db) => {
 	await db.schema.dropTable("schema_settings").execute();
 	await db.schema.dropTable("locales").execute();
 	await db.schema.dropTable("schema_change_jobs").execute();
@@ -46588,8 +46588,8 @@ const down$31 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001150000_create_content_tables.ts
 var _20261001150000_create_content_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$30,
-	up: () => up$30
+	down: () => down$33,
+	up: () => up$33
 });
 /**
 * Content storage (package E, ADR 0001): entries, immutable content revisions, mutable heads (one per
@@ -46597,7 +46597,7 @@ var _20261001150000_create_content_tables_exports = /* @__PURE__ */ __exportAll(
 * and the publication log behind `?snapshot=N`. User content models never get tables of their own
 * (CONTRIBUTING.md rule 1): their values are JSONB keyed by stable field IDs.
 */
-const up$30 = async (db) => {
+const up$33 = async (db) => {
 	await db.schema.createTable("entries").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("model_id", "uuid", (col) => col.notNull().references("models.id").onDelete("restrict")).addColumn("owner_app_user_id", "uuid").addColumn("created_by_admin_id", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("deleted_at", "timestamptz").execute();
 	await sql`create index entries_model_idx on entries (model_id, created_at) where deleted_at is null`.execute(db);
 	await sql`create index entries_owner_idx on entries (owner_app_user_id) where owner_app_user_id is not null`.execute(db);
@@ -46661,7 +46661,7 @@ const up$30 = async (db) => {
 	await sql`create unique index publication_log_open_uq on publication_log (entry_id, locale) where to_seq is null`.execute(db);
 	await db.schema.createIndex("publication_log_model_seq_idx").on("publication_log").columns(["model_id", "from_seq"]).execute();
 };
-const down$30 = async (db) => {
+const down$33 = async (db) => {
 	await db.schema.dropTable("publication_log").execute();
 	await db.schema.dropTable("publication_state").execute();
 	await db.schema.dropTable("unique_values").execute();
@@ -46674,8 +46674,8 @@ const down$30 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001160000_create_media_tables.ts
 var _20261001160000_create_media_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$29,
-	up: () => up$29
+	down: () => down$32,
+	up: () => up$32
 });
 /**
 * Media library (package G): folders, assets, image variants, references from content and upload grants.
@@ -46686,7 +46686,7 @@ const withTimestamps$2 = (table) => table.addColumn("created_at", "timestamptz",
 const uuidPrimaryKey$2 = (table) => table.addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`));
 const STORAGE_DRIVER_CHECK = sql`storage_driver in ('local', 's3')`;
 const VISIBILITY_CHECK = sql`visibility in ('public', 'private')`;
-const up$29 = async (db) => {
+const up$32 = async (db) => {
 	await withTimestamps$2(uuidPrimaryKey$2(db.schema.createTable("media_folders")).addColumn("parent_id", "uuid", (col) => col.references("media_folders.id").onDelete("restrict")).addColumn("name", "text", (col) => col.notNull().check(sql`length(name) between 1 and 255`)).addColumn("created_by", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("version", "integer", (col) => col.notNull().defaultTo(1))).execute();
 	await sql`create unique index media_folders_sibling_name_uq on media_folders
     (coalesce(parent_id, '00000000-0000-0000-0000-000000000000'::uuid), lower(name))`.execute(db);
@@ -46715,7 +46715,7 @@ const up$29 = async (db) => {
 	]).execute();
 	await db.schema.createTable("media_upload_grants").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("asset_id", "uuid", (col) => col.notNull()).addColumn("kind", "text", (col) => col.notNull().check(sql`kind in ('create', 'replace')`)).addColumn("storage_driver", "text", (col) => col.notNull().check(STORAGE_DRIVER_CHECK)).addColumn("storage_key", "text", (col) => col.notNull().unique()).addColumn("original_filename", "text", (col) => col.notNull()).addColumn("declared_mime_type", "text", (col) => col.notNull()).addColumn("max_size_bytes", "bigint", (col) => col.notNull()).addColumn("folder_id", "uuid").addColumn("visibility", "text", (col) => col.notNull().check(VISIBILITY_CHECK)).addColumn("created_by", "uuid", (col) => col.references("admin_users.id").onDelete("set null")).addColumn("created_by_principal", "text", (col) => col.notNull()).addColumn("status", "text", (col) => col.notNull().defaultTo("pending").check(sql`status in ('pending', 'consumed', 'rejected', 'expired')`)).addColumn("expires_at", "timestamptz", (col) => col.notNull()).addColumn("consumed_at", "timestamptz").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 };
-const down$29 = async (db) => {
+const down$32 = async (db) => {
 	await db.schema.dropTable("media_upload_grants").execute();
 	await db.schema.dropTable("media_references").execute();
 	await db.schema.dropTable("media_variants").execute();
@@ -46725,8 +46725,8 @@ const down$29 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001170000_create_publishing_tables.ts
 var _20261001170000_create_publishing_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$28,
-	up: () => up$28
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Publishing (package H): scheduled publications, releases, webhooks and their delivery log, deployment
@@ -46765,13 +46765,13 @@ const createPreviewTables = async (db) => {
 	await uuidPrimaryKey$1(db.schema.createTable("preview_tokens")).addColumn("token_hash", "text", (col) => col.notNull().unique()).addColumn("token_prefix", "text", (col) => col.notNull()).addColumn("model_id", "uuid", (col) => col.notNull()).addColumn("entry_id", "uuid", (col) => col.references("entries.id").onDelete("cascade")).addColumn("locale", "text").addColumn("connection_id", "uuid", (col) => col.references("deployment_connections.id").onDelete("set null")).addColumn("delivery_role_id", "uuid", (col) => col.references("admin_roles.id").onDelete("set null")).addColumn("created_by", "uuid", (col) => col.notNull().references("admin_users.id").onDelete("cascade")).addColumn("expires_at", "timestamptz", (col) => col.notNull()).addColumn("revoked_at", "timestamptz").addColumn("last_used_at", "timestamptz").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 	await db.schema.createIndex("preview_tokens_entry_idx").on("preview_tokens").columns(["entry_id", "created_at desc"]).execute();
 };
-const up$28 = async (db) => {
+const up$31 = async (db) => {
 	await createSchedulingTables(db);
 	await createWebhookTables(db);
 	await createDeploymentTables(db);
 	await createPreviewTables(db);
 };
-const down$28 = async (db) => {
+const down$31 = async (db) => {
 	await db.schema.dropTable("preview_tokens").execute();
 	await db.schema.dropTable("deployment_runs").execute();
 	await db.schema.dropTable("deployment_connections").execute();
@@ -46784,8 +46784,8 @@ const down$28 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261001180000_create_app_users.ts
 var _20261001180000_create_app_users_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * App users (package I, ADR 0005): the end users of sites and apps built on Shapio, with their own roles
@@ -46836,7 +46836,7 @@ const createCredentials = async (db) => {
 	}
 	await db.schema.createTable("app_login_codes").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("app_user_id", "uuid", (col) => col.notNull().references("app_users.id").onDelete("cascade")).addColumn("code_hash", "text", (col) => col.notNull().unique()).addColumn("expires_at", "timestamptz", (col) => col.notNull()).addColumn("used_at", "timestamptz").addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).execute();
 };
-const up$27 = async (db) => {
+const up$30 = async (db) => {
 	await createUsers(db);
 	await createRoles(db);
 	await createCredentials(db);
@@ -46846,7 +46846,7 @@ const up$27 = async (db) => {
       foreign key (owner_app_user_id) references app_users (id) on delete set null
   `.execute(db);
 };
-const down$27 = async (db) => {
+const down$30 = async (db) => {
 	await sql`alter table entries drop constraint if exists entries_owner_app_user_fk`.execute(db);
 	await db.schema.dropTable("app_login_codes").execute();
 	await db.schema.dropTable("app_password_resets").execute();
@@ -46861,8 +46861,8 @@ const down$27 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261002120000_create_extension_hook_runs.ts
 var _20261002120000_create_extension_hook_runs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Extension points (package K, ADR 0009): the ledger of post-commit lifecycle hooks (`afterCreate`,
@@ -46870,17 +46870,17 @@ var _20261002120000_create_extension_hook_runs_exports = /* @__PURE__ */ __expor
 * as the hook's own database work, so a hook re-run after a worker crash finds its row and is skipped:
 * exactly once for everything the hook does through its transaction.
 */
-const up$26 = async (db) => {
+const up$29 = async (db) => {
 	await db.schema.createTable("extension_hook_runs").addColumn("event_id", "uuid", (col) => col.notNull()).addColumn("hook", "text", (col) => col.notNull()).addColumn("job_id", "uuid").addColumn("completed_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addPrimaryKeyConstraint("extension_hook_runs_pkey", ["event_id", "hook"]).execute();
 };
-const down$26 = async (db) => {
+const down$29 = async (db) => {
 	await db.schema.dropTable("extension_hook_runs").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002130000_app_auth_token_version_and_login_code_pkce.ts
 var _20261002130000_app_auth_token_version_and_login_code_pkce_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * App users (ADR 0005):
@@ -46891,20 +46891,20 @@ var _20261002130000_app_auth_token_version_and_login_code_pkce_exports = /* @__P
 *   sign-in; the one-time login code is only exchanged with the matching verifier. Codes live a minute, so
 *   any pending ones (issued without a challenge) are dropped rather than given a placeholder.
 */
-const up$25 = async (db) => {
+const up$28 = async (db) => {
 	await db.schema.alterTable("app_users").addColumn("token_version", "integer", (col) => col.notNull().defaultTo(0)).execute();
 	await sql`delete from app_login_codes`.execute(db);
 	await db.schema.alterTable("app_login_codes").addColumn("code_challenge", "text", (col) => col.notNull()).execute();
 };
-const down$25 = async (db) => {
+const down$28 = async (db) => {
 	await db.schema.alterTable("app_login_codes").dropColumn("code_challenge").execute();
 	await db.schema.alterTable("app_users").dropColumn("token_version").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002180000_add_publication_log_diff_indexes.ts
 var _20261002180000_add_publication_log_diff_indexes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * The snapshot diff (repositories/snapshotDiff.ts) finds the (entry, locale) pairs whose live period opened
@@ -46913,7 +46913,7 @@ var _20261002180000_add_publication_log_diff_indexes_exports = /* @__PURE__ */ _
 * - `(entry_id, locale, from_seq)`: "the row live at seq N" is the latest row starting at or before N.
 * Periods that opened in the range use the existing `(model_id, from_seq)` index.
 */
-const up$24 = async (db) => {
+const up$27 = async (db) => {
 	await sql`create index publication_log_to_seq_idx on publication_log (to_seq) where to_seq is not null`.execute(db);
 	await db.schema.createIndex("publication_log_entry_locale_from_idx").on("publication_log").columns([
 		"entry_id",
@@ -46921,15 +46921,15 @@ const up$24 = async (db) => {
 		"from_seq"
 	]).execute();
 };
-const down$24 = async (db) => {
+const down$27 = async (db) => {
 	await db.schema.dropIndex("publication_log_entry_locale_from_idx").execute();
 	await db.schema.dropIndex("publication_log_to_seq_idx").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002180100_create_usage_tables.ts
 var _20261002180100_create_usage_tables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * Field usage from delivery traffic (plan developer-face §5): daily counters written by the in-memory
@@ -46937,7 +46937,7 @@ var _20261002180100_create_usage_tables_exports = /* @__PURE__ */ __exportAll({
 * payloads. `principal_key` is `token:<id>`, `app_users` or `anonymous`. Pruned by the retention job
 * after USAGE_RETENTION_DAYS.
 */
-const up$23 = async (db) => {
+const up$26 = async (db) => {
 	await db.schema.createTable("field_reads").addColumn("day", "date", (col) => col.notNull()).addColumn("model_id", "uuid", (col) => col.notNull()).addColumn("field_path", "text", (col) => col.notNull()).addColumn("principal_key", "text", (col) => col.notNull()).addColumn("selection", "text", (col) => col.notNull().check(sql`selection in ('explicit', 'implicit')`)).addColumn("reads", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_read_at", "timestamptz", (col) => col.notNull()).addPrimaryKeyConstraint("field_reads_pkey", [
 		"day",
 		"model_id",
@@ -46948,15 +46948,15 @@ const up$23 = async (db) => {
 	await db.schema.createIndex("field_reads_model_day_idx").on("field_reads").columns(["model_id", "day"]).execute();
 	await db.schema.createTable("token_reads").addColumn("day", "date", (col) => col.notNull()).addColumn("principal_key", "text", (col) => col.notNull()).addColumn("requests", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_snapshot", "bigint").addColumn("last_read_at", "timestamptz", (col) => col.notNull()).addPrimaryKeyConstraint("token_reads_pkey", ["day", "principal_key"]).execute();
 };
-const down$23 = async (db) => {
+const down$26 = async (db) => {
 	await db.schema.dropTable("token_reads").execute();
 	await db.schema.dropTable("field_reads").execute();
 };
 //#endregion
 //#region src/db/migrations/20261002180200_create_change_sets.ts
 var _20261002180200_create_change_sets_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * Change sets (developer-face plan §5, ADR 0010): schema drafts and entry publications that ship as ONE
@@ -47135,7 +47135,7 @@ const migrateReleases = async (db) => {
 	await sql`drop table release_items`.execute(db);
 	await sql`drop table releases`.execute(db);
 };
-const up$22 = async (db) => {
+const up$25 = async (db) => {
 	await createTables(db);
 	await linkExecutionRecords(db);
 	await allowConversionRevisions(db);
@@ -47207,7 +47207,7 @@ const restoreReleases = async (db) => {
 	await sql`update webhooks set events = array_remove(array_remove(events, 'change_set.shipping'),
     'change_set.discarded')`.execute(db);
 };
-const down$22 = async (db) => {
+const down$25 = async (db) => {
 	await restoreReleases(db);
 	await sql`alter table content_revisions drop constraint content_revisions_reason_check`.execute(db);
 	await sql`alter table content_revisions add constraint content_revisions_reason_check
@@ -47228,8 +47228,8 @@ const down$22 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261002190000_create_editor_presence_and_content_health.ts
 var _20261002190000_create_editor_presence_and_content_health_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * Editor experience (plan editor-experience §9):
@@ -47240,7 +47240,7 @@ var _20261002190000_create_editor_presence_and_content_health_exports = /* @__PU
 * - `content_health_findings`: open and recently resolved findings of the health rules per entry and
 *   locale (`*` for the entry as a whole). An evaluation upserts what it found and resolves the rest.
 */
-const up$21 = async (db) => {
+const up$24 = async (db) => {
 	await sql`
     create unlogged table editor_presence (
       entry_id uuid not null,
@@ -47277,15 +47277,15 @@ const up$21 = async (db) => {
 	await sql`create index content_health_findings_resolved_idx on content_health_findings (resolved_at)
     where resolved_at is not null`.execute(db);
 };
-const down$21 = async (db) => {
+const down$24 = async (db) => {
 	await sql`drop table content_health_findings`.execute(db);
 	await sql`drop table editor_presence`.execute(db);
 };
 //#endregion
 //#region src/db/migrations/20261003120000_add_changes_ship_permission.ts
 var _20261003120000_add_changes_ship_permission_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * `changes.ship` (agentic plan §I): shipping a change set (and scheduling a ship) becomes its own global
@@ -47293,7 +47293,7 @@ var _20261003120000_add_changes_ship_permission_exports = /* @__PURE__ */ __expo
 * live. Every role that holds `changes.manage` today keeps what it could do: it gets `changes.ship` too.
 * The permissions version moves only when grants changed, so running instances reload exactly then.
 */
-const up$20 = async (db) => {
+const up$23 = async (db) => {
 	await sql`
     with granted as (
       insert into admin_role_permissions (role_id, action, model_id, condition, field_ids)
@@ -47307,7 +47307,7 @@ const up$20 = async (db) => {
     where exists (select 1 from granted)
   `.execute(db);
 };
-const down$20 = async (db) => {
+const down$23 = async (db) => {
 	await sql`
     with revoked as (
       delete from admin_role_permissions where action = 'changes.ship' returning 1
@@ -47319,8 +47319,8 @@ const down$20 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003130000_create_sites.ts
 var _20261003130000_create_sites_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Sites (plan agentic-ecosystem §H, ADR 0011): one instance hosts many sites with one schema and one login.
@@ -47508,7 +47508,7 @@ const siteRoleAssignments = async (db) => {
   `.execute(db);
 	await sql`alter table admin_invitations drop column role_ids`.execute(db);
 };
-const up$19 = async (db) => {
+const up$22 = async (db) => {
 	await createSites(db);
 	await addSiteColumns(db);
 	await tieCopiesToEntries(db);
@@ -47521,7 +47521,7 @@ const assertSingleSite = async (db) => {
 	const { rows } = await sql`select count(*)::text as count from sites`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 1) throw new Error("Cannot roll back sites while more than one site exists: merging them would merge their snapshot ledgers and uniqueness and widen role assignments. Delete the other sites first.");
 };
-const down$19 = async (db) => {
+const down$22 = async (db) => {
 	await assertSingleSite(db);
 	await sql`alter table admin_invitations add column role_ids uuid[] not null default '{}'::uuid[]`.execute(db);
 	await sql`
@@ -47592,8 +47592,8 @@ const down$19 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003140200_enqueue_field_index_layout.ts
 var _20261003140200_enqueue_field_index_layout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Field index layout v2 (sites plan §H): per-field expression indexes on `entry_heads` lead with `site_id`,
@@ -47605,7 +47605,7 @@ var _20261003140200_enqueue_field_index_layout_exports = /* @__PURE__ */ __expor
 */
 const JOB_TYPE$1 = "schema.fieldIndexLayout";
 const IDEMPOTENCY_KEY$1 = "schema.fieldIndexLayout:v2";
-const up$18 = async (db) => {
+const up$21 = async (db) => {
 	await sql`
     insert into jobs (type, payload, max_attempts, idempotency_key)
     select ${JOB_TYPE$1}, '{}'::jsonb, 5, ${IDEMPOTENCY_KEY$1}
@@ -47618,14 +47618,14 @@ const up$18 = async (db) => {
   `.execute(db);
 };
 /** The layout job is idempotent; rolling back only forgets it if it has not run yet. */
-const down$18 = async (db) => {
+const down$21 = async (db) => {
 	await sql`delete from jobs where idempotency_key = ${IDEMPOTENCY_KEY$1} and status = 'pending'`.execute(db);
 };
 //#endregion
 //#region src/db/migrations/20261003140500_change_set_items_site_and_preview_entry.ts
 var _20261003140500_change_set_items_site_and_preview_entry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * Sites, publishing (plan agentic-ecosystem §H, package G5).
@@ -47636,7 +47636,7 @@ var _20261003140500_change_set_items_site_and_preview_entry_exports = /* @__PURE
 * - `preview_tokens.entry_id` becomes required: a preview token previews one entry of one site. Model-wide
 *   tokens (short-lived by design) are deleted; whoever needs one opens the entry's preview again.
 */
-const up$17 = async (db) => {
+const up$20 = async (db) => {
 	await sql`alter table change_sets add constraint change_sets_id_site_uq unique (id, site_id)`.execute(db);
 	await sql`alter table change_set_items add column site_id uuid`.execute(db);
 	await sql`
@@ -47652,7 +47652,7 @@ const up$17 = async (db) => {
 	await sql`delete from preview_tokens where entry_id is null`.execute(db);
 	await sql`alter table preview_tokens alter column entry_id set not null`.execute(db);
 };
-const down$17 = async (db) => {
+const down$20 = async (db) => {
 	await sql`alter table preview_tokens alter column entry_id drop not null`.execute(db);
 	await sql`alter table change_set_items drop constraint change_set_items_entry_site_fk`.execute(db);
 	await sql`alter table change_set_items drop constraint change_set_items_set_site_fk`.execute(db);
@@ -47662,8 +47662,8 @@ const down$17 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003150000_widen_deployment_providers.ts
 var _20261003150000_widen_deployment_providers_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Deploy adapters (plan agentic-ecosystem §B2): deployment connections may use the Vercel and Netlify
@@ -47678,11 +47678,11 @@ const replaceCheck = async (db, check) => {
     check (${check}) not valid`.execute(db);
 	await sql`alter table deployment_connections validate constraint deployment_connections_provider_check`.execute(db);
 };
-const up$16 = async (db) => {
+const up$19 = async (db) => {
 	await replaceCheck(db, WIDENED);
 };
 /** Refuses while Vercel or Netlify connections exist: a down migration never deletes user data. */
-const down$16 = async (db) => {
+const down$19 = async (db) => {
 	const { rows } = await sql`
     select count(*)::text as count from deployment_connections where provider in ('vercel', 'netlify')
   `.execute(db);
@@ -47693,8 +47693,8 @@ const down$16 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003160000_create_assist_runs.ts
 var _20261003160000_create_assist_runs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Editor assists (plan agentic-ecosystem §A0, §I): one `assist_runs` row per assist request (who, which
@@ -47710,14 +47710,14 @@ const replaceSourceCheck = async (db, check) => {
 	await sql`alter table change_sets add constraint change_sets_source_check check (${check}) not valid`.execute(db);
 	await sql`alter table change_sets validate constraint change_sets_source_check`.execute(db);
 };
-const up$15 = async (db) => {
+const up$18 = async (db) => {
 	await db.schema.createTable("assist_runs").addColumn("id", "uuid", (col) => col.primaryKey().defaultTo(sql`gen_random_uuid()`)).addColumn("site_id", "uuid", (col) => col.notNull().references("sites.id").onDelete("cascade")).addColumn("actor_type", "text", (col) => col.notNull()).addColumn("actor_id", "text", (col) => col.notNull()).addColumn("action", "text", (col) => col.notNull().check(ACTIONS)).addColumn("rule", "text").addColumn("provider", "text", (col) => col.notNull()).addColumn("model", "text", (col) => col.notNull()).addColumn("input_tokens", "integer", (col) => col.notNull().defaultTo(0)).addColumn("output_tokens", "integer", (col) => col.notNull().defaultTo(0)).addColumn("duration_ms", "integer", (col) => col.notNull().defaultTo(0)).addColumn("status", "text", (col) => col.notNull().check(sql`status in ('queued', 'running', 'succeeded', 'failed')`)).addColumn("error_code", "text").addColumn("job_id", "uuid", (col) => col.references("jobs.id").onDelete("set null")).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`now()`)).addColumn("finished_at", "timestamptz").execute();
 	await db.schema.createIndex("assist_runs_site_created_idx").on("assist_runs").columns(["site_id", "created_at"]).execute();
 	await db.schema.createIndex("assist_runs_created_idx").on("assist_runs").column("created_at").execute();
 	await replaceSourceCheck(db, SOURCES_WIDENED);
 };
 /** Refuses while change sets opened by assist exist: a down migration never deletes user data. */
-const down$15 = async (db) => {
+const down$18 = async (db) => {
 	const { rows } = await sql`
     select count(*)::text as count from change_sets where source = 'assist'
   `.execute(db);
@@ -47729,8 +47729,8 @@ const down$15 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261003170000_audit_events_seq.ts
 var _20261003170000_audit_events_seq_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * `audit_events.seq`: a monotonic tiebreaker after `occurred_at`, so events written in the same instant (one
@@ -47739,17 +47739,17 @@ var _20261003170000_audit_events_seq_exports$2 = /* @__PURE__ */ __exportAll({
 * are numbered in the order the rewrite reads them. No index: the audit queries filter and sort by
 * `occurred_at` first, and `seq` only breaks ties.
 */
-const up$14 = async (db) => {
+const up$17 = async (db) => {
 	await db.schema.alterTable("audit_events").addColumn("seq", "bigint", (col) => col.notNull().generatedAlwaysAsIdentity()).execute();
 };
-const down$14 = async (db) => {
+const down$17 = async (db) => {
 	await db.schema.alterTable("audit_events").dropColumn("seq").execute();
 };
 //#endregion
 //#region src/db/migrations/20261004120000_models_site_scope.ts
 var _20261004120000_models_site_scope_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Per-site schema (plan site-schema): a definition belongs to one site (`models.site_id`) or is shared by every
@@ -47762,7 +47762,7 @@ var _20261004120000_models_site_scope_exports$2 = /* @__PURE__ */ __exportAll({
 * over `lower(api_key)` cannot hold. Share or delete them first; then `down` is lossless.
 */
 const NIL_UUID$1 = "00000000-0000-0000-0000-000000000000";
-const up$13 = async (db) => {
+const up$16 = async (db) => {
 	await sql`alter table models add column site_id uuid references sites (id)`.execute(db);
 	await sql`create index models_site_idx on models (site_id)`.execute(db);
 	await sql`drop index models_api_key_uq`.execute(db);
@@ -47772,7 +47772,7 @@ const up$13 = async (db) => {
   `.execute(db);
 	await sql`alter table schema_drafts add column shared boolean not null default false`.execute(db);
 };
-const down$13 = async (db) => {
+const down$16 = async (db) => {
 	const { rows } = await sql`select count(*)::text as count from models where site_id is not null`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 0) throw new Error("Cannot roll back per-site schema while definitions belong to a site: two sites may share an API ID. Share or delete the site definitions first.");
 	await sql`alter table schema_drafts drop column shared`.execute(db);
@@ -47784,8 +47784,8 @@ const down$13 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261004130000_site_seo_settings.ts
 var _20261004130000_site_seo_settings_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * SEO defaults per site (plan seo-fields): `sites.seo_defaults` holds the site's default texts per locale, its
@@ -47796,7 +47796,7 @@ var _20261004130000_site_seo_settings_exports$2 = /* @__PURE__ */ __exportAll({
 * about what a site publishes) gets it; the built-in owner and admin roles get it from `ensureSystemRoles`.
 * The permissions version moves only when grants changed, so running instances reload exactly then.
 */
-const up$12 = async (db) => {
+const up$15 = async (db) => {
 	await sql`alter table sites add column seo_defaults jsonb`.execute(db);
 	await sql`
     with granted as (
@@ -47811,7 +47811,7 @@ const up$12 = async (db) => {
     where exists (select 1 from granted)
   `.execute(db);
 };
-const down$12 = async (db) => {
+const down$15 = async (db) => {
 	await sql`
     with revoked as (
       delete from admin_role_permissions where action = 'site.settings' returning 1
@@ -47824,8 +47824,8 @@ const down$12 = async (db) => {
 //#endregion
 //#region src/db/migrations/20261005120000_entry_heads_entry_created_at.ts
 var _20261005120000_entry_heads_entry_created_at_exports$2 = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Delivery perf 2 (ADR 0001 amendment): the entry's `created_at` on each head (`entry_created_at`), so a list
@@ -47842,7 +47842,7 @@ const INDEX$2 = "entry_heads_entry_order_idx";
 const JOB_TYPE = "schema.entryOrderIndex";
 const IDEMPOTENCY_KEY = "schema.entryOrderIndex:v1";
 const BATCH$1 = 5e3;
-const up$11 = async (db) => {
+const up$14 = async (db) => {
 	await sql`alter table entry_heads add column entry_created_at timestamptz`.execute(db);
 	for (;;) {
 		const result = await sql`
@@ -47867,7 +47867,7 @@ const up$11 = async (db) => {
     create index ${sql.id(INDEX$2)} on entry_heads (site_id, model_id, state, entry_created_at desc, entry_id)
   `.execute(db);
 };
-const down$11 = async (db) => {
+const down$14 = async (db) => {
 	await sql`delete from jobs where idempotency_key = ${IDEMPOTENCY_KEY} and status = 'pending'`.execute(db);
 	await sql`drop index if exists ${sql.id(INDEX$2)}`.execute(db);
 	await sql`alter table entry_heads drop column entry_created_at`.execute(db);
@@ -47876,20 +47876,58 @@ const down$11 = async (db) => {
 //#region src/db/migrations/20261006120000_system_versions_release.ts
 var _20261006120000_system_versions_release_exports = /* @__PURE__ */ __exportAll({
 	dialectNeutral: () => true,
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$13,
+	up: () => up$13
 });
-const up$10 = async (db) => {
+const up$13 = async (db) => {
 	await db.schema.alterTable("system_versions").addColumn("release", "text").execute();
 };
-const down$10 = async (db) => {
+const down$13 = async (db) => {
 	await db.schema.alterTable("system_versions").dropColumn("release").execute();
 };
 //#endregion
+//#region src/db/migrations/20261014120000_canceled_status.ts
+var _20261014120000_canceled_status_exports$2 = /* @__PURE__ */ __exportAll({
+	down: () => down$12,
+	up: () => up$12
+});
+/**
+* The `cancelled` status of schema change jobs and scheduled publications becomes `canceled`. Rows are
+* rewritten and the check constraints swapped. MySQL has its own twin; SQLite rebuilds the two tables
+* (`./sqlite/20261014120000_canceled_status.ts`).
+*/
+const TABLES$4 = [{
+	table: "schema_change_jobs",
+	values: [
+		"pending",
+		"running",
+		"activated",
+		"failed"
+	]
+}, {
+	table: "scheduled_publications",
+	values: [
+		"scheduled",
+		"done",
+		"failed"
+	]
+}];
+const swap$1 = async (db, from, to) => {
+	for (const { table, values } of TABLES$4) {
+		const constraint = `${table}_status_check`;
+		await sql`alter table ${sql.table(table)} drop constraint ${sql.id(constraint)}`.execute(db);
+		await sql`update ${sql.table(table)} set status = ${to} where status = ${from}`.execute(db);
+		const allowed = sql.join([...values, to].map((value) => sql.lit(value)));
+		await sql`alter table ${sql.table(table)} add constraint ${sql.id(constraint)} check (status in (${allowed}))`.execute(db);
+	}
+};
+const up$12 = (db) => swap$1(db, "cancelled", "canceled");
+const down$12 = (db) => swap$1(db, "canceled", "cancelled");
+//#endregion
 //#region src/db/migrations/mysql/0001_baseline.ts
 var _0001_baseline_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * MySQL baseline: Shapio's whole system schema as of PostgreSQL migration
@@ -48999,7 +49037,7 @@ const STATEMENTS$1 = [
     ('00000000-0000-4000-b000-000000000001', 'public', '00000000-0000-4000-a000-000000000001'),
     ('00000000-0000-4000-b000-000000000001', 'authenticated', '00000000-0000-4000-a000-000000000002')`
 ];
-const TABLES$1 = [
+const TABLES$3 = [
 	"system_versions",
 	"jobs",
 	"outbox_events",
@@ -49072,13 +49110,13 @@ const withoutForeignKeyChecks = async (db, statements) => db.connection().execut
 		await sql`set foreign_key_checks = 1`.execute(connection);
 	}
 });
-const up$9 = async (db) => withoutForeignKeyChecks(db, STATEMENTS$1);
-const down$9 = async (db) => withoutForeignKeyChecks(db, [...TABLES$1].reverse().map((table) => `drop table if exists \`${table}\``));
+const up$11 = async (db) => withoutForeignKeyChecks(db, STATEMENTS$1);
+const down$11 = async (db) => withoutForeignKeyChecks(db, [...TABLES$3].reverse().map((table) => `drop table if exists \`${table}\``));
 //#endregion
 //#region src/db/migrations/mysql/20261003170000_audit_events_seq.ts
 var _20261003170000_audit_events_seq_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * MySQL twin of `../20261003170000_audit_events_seq.ts`: `seq` is `AUTO_INCREMENT`, which InnoDB only allows
@@ -49086,26 +49124,26 @@ var _20261003170000_audit_events_seq_exports$1 = /* @__PURE__ */ __exportAll({
 * tiebreaker). Existing rows are numbered in primary-key order. `db/mysql/tables.ts` lists `seq` as the
 * table's identity, so an insert's emulated RETURNING finds its row by `LAST_INSERT_ID()`.
 */
-const up$8 = async (db) => {
+const up$10 = async (db) => {
 	await sql`alter table \`audit_events\`
     add column \`seq\` bigint not null auto_increment,
     add unique key \`audit_events_seq_key\` (\`seq\`)`.execute(db);
 };
-const down$8 = async (db) => {
+const down$10 = async (db) => {
 	await sql`alter table \`audit_events\` drop column \`seq\``.execute(db);
 };
 //#endregion
 //#region src/db/migrations/mysql/20261004120000_models_site_scope.ts
 var _20261004120000_models_site_scope_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * MySQL twin of `../20261004120000_models_site_scope.ts`. The per-scope API ID key uses functional key parts,
 * like the baseline: `coalesce(site_id, '')` for the scope (MySQL has no `NULLS NOT DISTINCT`) and the
 * case-folded API ID of live rows only (a deleted row's part is NULL, and NULLs never collide).
 */
-const up$7 = async (db) => {
+const up$9 = async (db) => {
 	await sql`alter table \`models\` add column \`site_id\` char(36) character set ascii collate ascii_general_ci`.execute(db);
 	await sql`create index \`models_site_idx\` on \`models\` (\`site_id\`)`.execute(db);
 	await sql`alter table \`models\` add constraint \`models_site_id_fkey\` foreign key (\`site_id\`) references \`sites\` (\`id\`)`.execute(db);
@@ -49114,7 +49152,7 @@ const up$7 = async (db) => {
     ((coalesce(\`site_id\`, '')), (case when (\`deleted_at\` IS NULL) then lower(\`api_key\`) end))`.execute(db);
 	await sql`alter table \`schema_drafts\` add column \`shared\` tinyint(1) not null default 0`.execute(db);
 };
-const down$7 = async (db) => {
+const down$9 = async (db) => {
 	const { rows } = await sql`select count(*) as count from \`models\` where \`site_id\` is not null`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 0) throw new Error("Cannot roll back per-site schema while definitions belong to a site: two sites may share an API ID. Share or delete the site definitions first.");
 	await sql`alter table \`schema_drafts\` drop column \`shared\``.execute(db);
@@ -49128,8 +49166,8 @@ const down$7 = async (db) => {
 //#endregion
 //#region src/db/migrations/mysql/20261004130000_site_seo_settings.ts
 var _20261004130000_site_seo_settings_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * MySQL twin of `../20261004130000_site_seo_settings.ts`. `insert ignore` stands in for `on conflict do
@@ -49137,7 +49175,7 @@ var _20261004130000_site_seo_settings_exports$1 = /* @__PURE__ */ __exportAll({
 */
 const bumpPermissionsVersion$1 = (db) => sql`update \`system_versions\` set \`permissions_version\` = \`permissions_version\` + 1,
     \`updated_at\` = current_timestamp(6)`.execute(db);
-const up$6 = async (db) => {
+const up$8 = async (db) => {
 	await sql`alter table \`sites\` add column \`seo_defaults\` json`.execute(db);
 	const granted = await sql`
     insert ignore into \`admin_role_permissions\` (\`id\`, \`role_id\`, \`action\`, \`model_id\`, \`condition\`, \`field_ids\`)
@@ -49147,7 +49185,7 @@ const up$6 = async (db) => {
   `.execute(db);
 	if (Number(granted.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion$1(db);
 };
-const down$6 = async (db) => {
+const down$8 = async (db) => {
 	const revoked = await sql`delete from \`admin_role_permissions\` where \`action\` = 'site.settings'`.execute(db);
 	if (Number(revoked.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion$1(db);
 	await sql`alter table \`sites\` drop column \`seo_defaults\``.execute(db);
@@ -49155,8 +49193,8 @@ const down$6 = async (db) => {
 //#endregion
 //#region src/db/migrations/mysql/20261005120000_entry_heads_entry_created_at.ts
 var _20261005120000_entry_heads_entry_created_at_exports$1 = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * MySQL twin of `../20261005120000_entry_heads_entry_created_at.ts`. The column is added `ALGORITHM=INSTANT`
@@ -49165,7 +49203,7 @@ var _20261005120000_entry_heads_entry_created_at_exports$1 = /* @__PURE__ */ __e
 */
 const INDEX$1 = "entry_heads_entry_order_idx";
 const BATCH = 5e3;
-const up$5 = async (db) => {
+const up$7 = async (db) => {
 	await sql`alter table \`entry_heads\` add column \`entry_created_at\` datetime(6), algorithm=instant`.execute(db);
 	for (;;) {
 		const result = await sql`update \`entry_heads\` set \`entry_created_at\` = (
@@ -49176,11 +49214,48 @@ const up$5 = async (db) => {
 	await sql`create index ${sql.id(INDEX$1)} on \`entry_heads\`
     (\`site_id\`, \`model_id\`, \`state\`, \`entry_created_at\` desc, \`entry_id\`) algorithm=inplace lock=none`.execute(db);
 };
-const down$5 = async (db) => {
+const down$7 = async (db) => {
 	await sql`drop index ${sql.id(INDEX$1)} on \`entry_heads\``.execute(db);
 	await sql`alter table \`entry_heads\` drop column \`entry_created_at\``.execute(db);
 };
 //#endregion
+//#region src/db/migrations/mysql/20261014120000_canceled_status.ts
+var _20261014120000_canceled_status_exports$1 = /* @__PURE__ */ __exportAll({
+	down: () => down$6,
+	up: () => up$6
+});
+/**
+* MySQL twin of `../20261014120000_canceled_status.ts`: MySQL 8.4 drops a check constraint with
+* `drop check`, not `drop constraint`.
+*/
+const TABLES$2 = [{
+	table: "schema_change_jobs",
+	values: [
+		"pending",
+		"running",
+		"activated",
+		"failed"
+	]
+}, {
+	table: "scheduled_publications",
+	values: [
+		"scheduled",
+		"done",
+		"failed"
+	]
+}];
+const swap = async (db, from, to) => {
+	for (const { table, values } of TABLES$2) {
+		const constraint = `${table}_status_check`;
+		await sql`alter table ${sql.table(table)} drop check ${sql.id(constraint)}`.execute(db);
+		await sql`update ${sql.table(table)} set status = ${to} where status = ${from}`.execute(db);
+		const allowed = sql.join([...values, to].map((value) => sql.lit(value)));
+		await sql`alter table ${sql.table(table)} add constraint ${sql.id(constraint)} check (status in (${allowed}))`.execute(db);
+	}
+};
+const up$6 = (db) => swap(db, "cancelled", "canceled");
+const down$6 = (db) => swap(db, "canceled", "cancelled");
+//#endregion
 //#region src/db/migrations/mysql/index.ts
 const MYSQL_MIGRATIONS = {
 	"0001_baseline": _0001_baseline_exports$1,
@@ -49188,13 +49263,14 @@ const MYSQL_MIGRATIONS = {
 	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports$1,
 	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports$1,
 	"20261005120000_entry_heads_entry_created_at": _20261005120000_entry_heads_entry_created_at_exports$1,
-	"20261006120000_system_versions_release": _20261006120000_system_versions_release_exports
+	"20261006120000_system_versions_release": _20261006120000_system_versions_release_exports,
+	"20261014120000_canceled_status": _20261014120000_canceled_status_exports$1
 };
 //#endregion
 //#region src/db/migrations/sqlite/0001_baseline.ts
 var _0001_baseline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$5,
+	up: () => up$5
 });
 /**
 * SQLite baseline: Shapio's whole system schema as of PostgreSQL migration
@@ -50277,7 +50353,7 @@ const STATEMENTS = [
     ('00000000-0000-4000-b000-000000000001', 'public', '00000000-0000-4000-a000-000000000001'),
     ('00000000-0000-4000-b000-000000000001', 'authenticated', '00000000-0000-4000-a000-000000000002')`
 ];
-const TABLES = [
+const TABLES$1 = [
 	"system_versions",
 	"jobs",
 	"outbox_events",
@@ -50339,18 +50415,18 @@ const TABLES = [
 	"assist_runs",
 	"sequences"
 ];
-const up$4 = async (db) => {
+const up$5 = async (db) => {
 	for (const statement of STATEMENTS) await sql.raw(statement).execute(db);
 };
-const down$4 = async (db) => {
+const down$5 = async (db) => {
 	await sql`pragma defer_foreign_keys = on`.execute(db);
-	for (const table of [...TABLES].reverse()) await sql.raw(`drop table if exists "${table}"`).execute(db);
+	for (const table of [...TABLES$1].reverse()) await sql.raw(`drop table if exists "${table}"`).execute(db);
 };
 //#endregion
 //#region src/db/migrations/sqlite/20261003170000_audit_events_seq.ts
 var _20261003170000_audit_events_seq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$4,
+	up: () => up$4
 });
 /**
 * SQLite twin of `../20261003170000_audit_events_seq.ts`. SQLite cannot add a column whose default calls a
@@ -50377,7 +50453,7 @@ const INDEXES = [
 	`create index "audit_events_occurred_at_idx" on "audit_events" (occurred_at DESC)`,
 	`create index "audit_events_target_idx" on "audit_events" (target_type, target_id, occurred_at DESC)`
 ];
-const up$3 = async (db) => {
+const up$4 = async (db) => {
 	await sql`insert into "sequences" (name, value) values ('audit_events_seq', 0)`.execute(db);
 	await sql`alter table "audit_events" rename to "audit_events_before_seq"`.execute(db);
 	await sql`create table "audit_events" (
@@ -50405,15 +50481,15 @@ const up$3 = async (db) => {
 	await sql`drop table "audit_events_before_seq"`.execute(db);
 	for (const statement of INDEXES) await sql.raw(statement).execute(db);
 };
-const down$3 = async (db) => {
+const down$4 = async (db) => {
 	await sql`alter table "audit_events" drop column "seq"`.execute(db);
 	await sql`delete from "sequences" where name = 'audit_events_seq'`.execute(db);
 };
 //#endregion
 //#region src/db/migrations/sqlite/20261004120000_models_site_scope.ts
 var _20261004120000_models_site_scope_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$3,
+	up: () => up$3
 });
 /**
 * SQLite twin of `../20261004120000_models_site_scope.ts`. `down` rebuilds `models` without `site_id`
@@ -50423,7 +50499,7 @@ var _20261004120000_models_site_scope_exports = /* @__PURE__ */ __exportAll({
 * deletes nothing they reference.
 */
 const NIL_UUID = "00000000-0000-0000-0000-000000000000";
-const up$2 = async (db) => {
+const up$3 = async (db) => {
 	await sql`alter table "models" add column "site_id" text_uuid references sites (id)`.execute(db);
 	await sql`create index "models_site_idx" on "models" (site_id)`.execute(db);
 	await sql`drop index "models_api_key_uq"`.execute(db);
@@ -50433,7 +50509,7 @@ const up$2 = async (db) => {
   `.execute(db);
 	await sql`alter table "schema_drafts" add column "shared" integer_boolean not null default 0`.execute(db);
 };
-const down$2 = async (db) => {
+const down$3 = async (db) => {
 	const { rows } = await sql`select count(*) as count from "models" where site_id is not null`.execute(db);
 	if (Number(rows[0]?.count ?? 0) > 0) throw new Error("Cannot roll back per-site schema while definitions belong to a site: two sites may share an API ID. Share or delete the site definitions first.");
 	await sql`alter table "schema_drafts" drop column "shared"`.execute(db);
@@ -50458,15 +50534,15 @@ const down$2 = async (db) => {
 //#endregion
 //#region src/db/migrations/sqlite/20261004130000_site_seo_settings.ts
 var _20261004130000_site_seo_settings_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$2,
+	up: () => up$2
 });
 /**
 * SQLite twin of `../20261004130000_site_seo_settings.ts`. `insert or ignore` stands in for `on conflict do
 * nothing` (the grant's unique index); the permissions version moves only when a grant was added or removed.
 */
 const bumpPermissionsVersion = (db) => sql`update "system_versions" set permissions_version = permissions_version + 1, updated_at = shapio_now()`.execute(db);
-const up$1 = async (db) => {
+const up$2 = async (db) => {
 	await sql`alter table "sites" add column "seo_defaults" text_jsonb`.execute(db);
 	const granted = await sql`
     insert or ignore into "admin_role_permissions" (role_id, action, model_id, condition, field_ids)
@@ -50476,7 +50552,7 @@ const up$1 = async (db) => {
   `.execute(db);
 	if (Number(granted.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion(db);
 };
-const down$1 = async (db) => {
+const down$2 = async (db) => {
 	const revoked = await sql`delete from "admin_role_permissions" where action = 'site.settings'`.execute(db);
 	if (Number(revoked.numAffectedRows ?? 0) > 0) await bumpPermissionsVersion(db);
 	await sql`alter table "sites" drop column "seo_defaults"`.execute(db);
@@ -50484,8 +50560,8 @@ const down$1 = async (db) => {
 //#endregion
 //#region src/db/migrations/sqlite/20261005120000_entry_heads_entry_created_at.ts
 var _20261005120000_entry_heads_entry_created_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$1,
+	up: () => up$1
 });
 /**
 * SQLite twin of `../20261005120000_entry_heads_entry_created_at.ts`. One process holds the write lock, so
@@ -50493,18 +50569,61 @@ var _20261005120000_entry_heads_entry_created_at_exports = /* @__PURE__ */ __exp
 * documented single-process limitation of ADR 0001, "D2: as built").
 */
 const INDEX = "entry_heads_entry_order_idx";
-const up = async (db) => {
+const up$1 = async (db) => {
 	await sql`alter table "entry_heads" add column "entry_created_at" text_timestamptz`.execute(db);
 	await sql`update "entry_heads" set entry_created_at = (
     select e.created_at from "entries" e where e.id = "entry_heads".entry_id
   ) where entry_created_at is null`.execute(db);
 	await sql`create index ${sql.id(INDEX)} on "entry_heads" (site_id, model_id, state, entry_created_at desc, entry_id)`.execute(db);
 };
-const down = async (db) => {
+const down$1 = async (db) => {
 	await sql`drop index if exists ${sql.id(INDEX)}`.execute(db);
 	await sql`alter table "entry_heads" drop column "entry_created_at"`.execute(db);
 };
 //#endregion
+//#region src/db/migrations/sqlite/20261014120000_canceled_status.ts
+var _20261014120000_canceled_status_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* SQLite twin of `../20261014120000_canceled_status.ts`. SQLite cannot change a check constraint, so each
+* table is rebuilt from its own stored `create table` statement with the one value swapped: renamed aside
+* (with `legacy_alter_table` on, so references to the name keep pointing at it), recreated, refilled with the
+* status rewritten, and its indexes recreated from `sqlite_master`. Nothing references either table.
+*/
+const TABLES = ["schema_change_jobs", "scheduled_publications"];
+const rebuild = async (db, table, from, to) => {
+	const { rows: created } = await sql`
+    select sql from sqlite_master where type = 'table' and name = ${table}
+  `.execute(db);
+	const { rows: indexes } = await sql`
+    select sql from sqlite_master where type = 'index' and tbl_name = ${table} and sql is not null
+  `.execute(db);
+	const definition = created[0]?.sql;
+	if (!definition || !definition.includes(`'${from}'`)) throw new Error(`${table}: expected a status check allowing '${from}'`);
+	const repaired = definition.replace(/references\s+("?)(\w+?)_before_\w+\1/gi, (_, quote, base) => `references ${quote}${base}${quote}`);
+	const aside = `${table}_before_${to}`;
+	await sql`pragma legacy_alter_table = on`.execute(db);
+	await sql`alter table ${sql.table(table)} rename to ${sql.table(aside)}`.execute(db);
+	await sql.raw(repaired.replace(`'${from}'`, `'${to}'`)).execute(db);
+	const { rows: columns } = await sql`
+    select name from pragma_table_info(${aside}) order by cid
+  `.execute(db);
+	const names = columns.map(({ name }) => sql.id(name));
+	const values = columns.map(({ name }) => name === "status" ? sql`case when status = ${from} then ${to} else status end` : sql.id(name));
+	await sql`insert into ${sql.table(table)} (${sql.join(names)}) select ${sql.join(values)} from ${sql.table(aside)}`.execute(db);
+	await sql`drop table ${sql.table(aside)}`.execute(db);
+	await sql`pragma legacy_alter_table = off`.execute(db);
+	for (const { sql: index } of indexes) await sql.raw(index).execute(db);
+};
+const up = async (db) => {
+	for (const table of TABLES) await rebuild(db, table, "cancelled", "canceled");
+};
+const down = async (db) => {
+	for (const table of TABLES) await rebuild(db, table, "canceled", "cancelled");
+};
+//#endregion
 //#region src/db/migrations/sqlite/index.ts
 const SQLITE_MIGRATIONS = {
 	"0001_baseline": _0001_baseline_exports,
@@ -50512,7 +50631,8 @@ const SQLITE_MIGRATIONS = {
 	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports,
 	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports,
 	"20261005120000_entry_heads_entry_created_at": _20261005120000_entry_heads_entry_created_at_exports,
-	"20261006120000_system_versions_release": _20261006120000_system_versions_release_exports
+	"20261006120000_system_versions_release": _20261006120000_system_versions_release_exports,
+	"20261014120000_canceled_status": _20261014120000_canceled_status_exports
 };
 //#endregion
 //#region src/db/migrations/index.ts
@@ -50546,7 +50666,8 @@ const MIGRATIONS = {
 	"20261004120000_models_site_scope": _20261004120000_models_site_scope_exports$2,
 	"20261004130000_site_seo_settings": _20261004130000_site_seo_settings_exports$2,
 	"20261005120000_entry_heads_entry_created_at": _20261005120000_entry_heads_entry_created_at_exports$2,
-	"20261006120000_system_versions_release": _20261006120000_system_versions_release_exports
+	"20261006120000_system_versions_release": _20261006120000_system_versions_release_exports,
+	"20261014120000_canceled_status": _20261014120000_canceled_status_exports$2
 };
 const PROVIDERS = {
 	postgres: { getMigrations: () => Promise.resolve({ ...MIGRATIONS }) },
@@ -51016,7 +51137,7 @@ const mediaFilesRoutes = async (app) => {
 //#region src/services/previewContent.ts
 /**
 * `/api/preview/content/:modelKey[/:id]` (brief §7): DRAFT content for a site's preview, in the delivery
-* shape, authorised by a preview token. Reads are evaluated with the token creator's CURRENT permissions
+* shape, authorized by a preview token. Reads are evaluated with the token creator's CURRENT permissions
 * (so revoking their role ends the preview), limited to read, to the token's model, entry and locale, and to
 * fields a delivery reader would see (`public` fields within the creator's read mask), so a shared preview
 * link never shows more than the published site would.
@@ -51207,7 +51328,7 @@ const getPreview = async (request, reply) => send(reply, await getPreview$1(requ
 //#region src/routes/preview/index.ts
 /**
 * /api/preview/content/:modelKey[/:id]: draft content for site previews, addressed by route key like
-* delivery (plural API ID of a collection), authorised by a preview token in
+* delivery (plural API ID of a collection), authorized by a preview token in
 * `Authorization: Bearer shpv_…` (never a query parameter, so tokens stay out of access logs).
 */
 const previewRoutes = async (app) => {
@@ -51452,7 +51573,7 @@ const buildApp = async (config, deps) => {
 	await app.register(contentHooksPlugin, { hooks: deps.contentHooks ?? extensions.hooks });
 	await app.register(adminContentRoutes, { prefix: urls.withBasePath("/api/admin/content") });
 	await app.register(editorManifestPlugin, { manifest: deps.editorManifest ?? buildEditorManifest(extensions.loaded.projectDir, extensions.loaded.config.editors ?? [], app.log.child({ component: "extensions" })) });
-	await app.register(themeCataloguePlugin, { catalogue: buildThemeCatalogue(extensions.loaded.config.themes ?? []) });
+	await app.register(themeCatalogPlugin, { catalog: buildThemeCatalog(extensions.loaded.config.themes ?? []) });
 	await app.register(adminExtensionsRoutes, { prefix: urls.withBasePath("/api/admin/extensions") });
 	await app.register(deliveryRoutes, { prefix: urls.withBasePath("/api/content") });
 	await app.register(siteRoutes, { prefix: urls.withBasePath("/api/site") });
@@ -52397,7 +52518,7 @@ const EXPIRING_CREDENTIAL_TABLES = [
 	"admin_invitations"
 ];
 /**
-* Credentials that expired before the cutoff: they no longer authorise anything, and the retention period
+* Credentials that expired before the cutoff: they no longer authorize anything, and the retention period
 * keeps recently expired ones for looking into an incident.
 */
 const pruneExpiredCredentials$1 = (table) => async (before, limit, trx = db) => deleted(await trx.deleteFrom(table).where("id", "in", (eb) => eb.selectFrom(table).select("id").where("expires_at", "<", before).limit(limit)).executeTakeFirstOrThrow());
@@ -52884,7 +53005,7 @@ var AssetBusyError = class extends Error {
 /**
 * The `media.relocate` job: after a visibility change, copies the original and its variants under the
 * new visibility prefix (verified by checksum), points the rows at them, and purges the old objects.
-* Shapio's own routes honour the new visibility before this runs; the move matters for a CDN or bucket
+* Shapio's own routes honor the new visibility before this runs; the move matters for a CDN or bucket
 * policy that exposes only `public/`.
 */
 const relocateAsset = async (deps, payload) => {
@@ -53022,7 +53143,7 @@ const summarizeResponse = (response) => {
 * network errors are retried by the queue with exponential backoff up to the webhook's max attempts; then
 * the delivery is dead (dead-lettered). A destination refused by the network policy, or a signing secret that
 * can no longer be decrypted (SESSION_SECRET changed; rotate it to repair), is dead at once.
-* Every attempt is summarised in the delivery log, with the signature redacted and the body truncated.
+* Every attempt is summarized in the delivery log, with the signature redacted and the body truncated.
 */
 const createWebhookDeliveryHandler = (runtime) => async (job) => {
 	const { deliveryId } = job.payload;
@@ -53781,4 +53902,4 @@ const startDedicatedWorker = async (config) => {
 //#endregion
 export { parseLockFile as $, listForAssets as A, SCHEMA_KIND_DIRECTORIES as B, SITE_KEY_PATTERN as C, EXTENSION_JOB_PREFIX as D, BEFORE_EVENTS as E, describeError as F, foldApiKey as G, THEME_VARIANTS as H, LOCK_FILE_PATH as I, isDataType as J, generatedNames as K, RESERVED_DEFINITION_API_KEYS as L, listLiveByDriver as M, lockById$5 as N, EXTENSION_ROUTE_ROOT as O, update$8 as P, parseDefinition as Q, RESERVED_FIELD_API_KEYS as R, loopbackUrl as S, AFTER_EVENTS as T, checkThemeContrast as U, SITES_DIRECTORY as V, createDefinitionIndex as W, lockEntriesForSite as X, lockCoversSite as Y, mergePulledLock as Z, createAdminDirect as _, loadConfig as a, suggestPlural as at, createLogger as b, getPendingMigrations as c, upgradeLockFile as ct, EmailSchema as d, RICHTEXT_FORMAT as dt, routeKeyOf as et, PasswordSchema as f, SAFE_LINK_PATTERN as ft, listAllSites as g, sqliteDriverOf as gt, createSite$1 as h, createDb as ht, assertDatabaseReachable as i, serializeLockFile as it, STORAGE_DRIVERS$1 as j, buildEditorManifest as k, migrateToLatest as l, validateSchema as lt, createMediaStorage as m, validateRichText as mt, startServer as n, scopeDirectory as nt, loadEnvFileIfPresent as o, toTypeName as ot, PersonNameSchema as p, createStableId as pt, hashDefinition as q, copyObjectVerified as r, serializeDefinition as rt, buildApp as s, typeChangeDropsValues as st, startDedicatedWorker as t, schemaFilePath as tt, SHAPIO_VERSION as u, withSiteCovered as ut, SYSTEM_CLI_ACTOR as v, loadProjectConfig as w, createUrlBuilder as x, generateToken as y, RESERVED_TYPE_NAMES as z };
 
-//# sourceMappingURL=worker-6ru1tYBs.js.map
+//# sourceMappingURL=worker-DHm2JwMZ.js.map