@shapio/local 0.5.0

package/dist/index.js

@@ -0,0 +1,4481 @@
+import { c as assertNotNested, d as toDatetimeText, f as AppError, i as createMysqlDb, l as withConnectionScope, n as createSqliteDb, o as DEFAULT_POOL_ACQUIRE_TIMEOUT_MS, s as pgAcquireError, t as lockKeyFromId, u as toStoredTimestamp } from "./advisoryLocks-COlJQc1r.js";
+import { i as isValidStorageKey, n as ObjectNotFoundError, r as encodeKeyPath, t as InvalidStorageKeyError } from "./errors-SK0PwPKC.js";
+import { t as assertNodeRuntime } from "./nodeRuntime-DzuiHUhY.js";
+import { ShapioApiError, createClient, createDeliveryClient } from "@shapio/client";
+import { Value } from "typebox/value";
+import { BIGINTEGER_PATTERN, DATE_PATTERN, DECIMAL_PATTERN, EMPTY_SEO_DEFAULTS, SCALAR_DATA_TYPES, SEO_COMPONENT_ID, SEO_FIELD_IDS, SeoDefaultsSchema, TEXT_TITLE_FIELD_TYPES, TIME_PATTERN, effectiveLayout, effectiveTitleField, embeddedComponentIds, findDependentModels, hashDefinition, isComponentDefinition, isModelDefinition, isSeoField, isStableId, renderRichTextHtml, resolveSeo, richTextMediaIds, routeKeyOf, seoDefaultsForLocale, withDerivedPlural } from "@shapio/schema";
+import { Type } from "typebox";
+import { Kysely, PostgresDialect, sql } from "kysely";
+import { createHash, createHmac, randomBytes } from "node:crypto";
+import pg from "pg";
+import { dirname, relative, resolve, sep } from "node:path";
+import { pino } from "pino";
+import { createReadStream, createWriteStream } from "node:fs";
+import { mkdir, rename, rm, rmdir, stat, writeFile } from "node:fs/promises";
+import { pipeline } from "node:stream/promises";
+//#endregion
+//#region ../../apps/api/src/constants/version.ts
+const SHAPIO_VERSION$1 = "0.5.0";
+//#endregion
+//#region ../../apps/api/src/helpers/errorResponse.ts
+const STATUS_CODES = {
+	400: "BAD_REQUEST",
+	401: "UNAUTHORIZED",
+	403: "FORBIDDEN",
+	404: "NOT_FOUND",
+	405: "METHOD_NOT_ALLOWED",
+	406: "NOT_ACCEPTABLE",
+	409: "CONFLICT",
+	413: "PAYLOAD_TOO_LARGE",
+	415: "UNSUPPORTED_MEDIA_TYPE",
+	422: "UNPROCESSABLE_ENTITY",
+	429: "RATE_LIMITED",
+	503: "SERVICE_UNAVAILABLE"
+};
+/** Errors raised by @fastify/csrf-protection (plugins/csrf.ts). */
+const CSRF_ERROR_CODES = /* @__PURE__ */ new Set(["FST_CSRF_INVALID_TOKEN", "FST_CSRF_MISSING_SECRET"]);
+/**
+* The one error shape every endpoint returns, `{ error: { code, message, details? } }`, and its status.
+* Server errors (5xx) never carry their internal text; the caller logs the original error.
+*/
+const toErrorResponse = (error) => {
+	if (error instanceof AppError) {
+		const body = { error: {
+			code: error.code,
+			message: error.message
+		} };
+		if (error.details !== void 0) body.error.details = error.details;
+		return {
+			statusCode: error.statusCode,
+			body
+		};
+	}
+	if (error.code !== void 0 && CSRF_ERROR_CODES.has(error.code)) return {
+		statusCode: 403,
+		body: { error: {
+			code: "CSRF_INVALID",
+			message: "Missing or invalid CSRF token"
+		} }
+	};
+	if (error.validation) return {
+		statusCode: 400,
+		body: { error: {
+			code: "VALIDATION_ERROR",
+			message: error.message,
+			details: error.validation.map(({ instancePath, message, params }) => ({
+				instancePath,
+				message,
+				params
+			}))
+		} }
+	};
+	const statusCode = error.statusCode !== void 0 && error.statusCode >= 400 ? error.statusCode : 500;
+	if (statusCode >= 500) return {
+		statusCode,
+		body: { error: {
+			code: "INTERNAL_ERROR",
+			message: "Internal server error"
+		} }
+	};
+	return {
+		statusCode,
+		body: { error: {
+			code: STATUS_CODES[statusCode] ?? "ERROR",
+			message: error.message
+		} }
+	};
+};
+//#endregion
+//#region ../../apps/api/src/delivery/errors.ts
+/**
+* The server's release and this library's differ, or the database predates in-process delivery: reading
+* across versions could run SQL against a schema it was not written for (plan next-in-process §2). Callers
+* that catch `ShapioApiError` see a 503 `VERSION_SKEW`.
+*/
+var ShapioVersionSkewError$1 = class extends ShapioApiError {
+	serverRelease;
+	libraryRelease;
+	constructor(serverRelease, libraryRelease, options) {
+		super(503, { error: {
+			code: "VERSION_SKEW",
+			message: serverRelease === null ? `The Shapio database has not been served by Shapio ${libraryRelease} yet; start the Shapio server of this release (or install the release the server runs) before reading in process` : `The Shapio server runs ${serverRelease} and this in-process reader is ${libraryRelease}; install the same release on both`
+		} });
+		this.name = "ShapioVersionSkewError";
+		if (options?.cause !== void 0) this.cause = options.cause;
+		this.serverRelease = serverRelease;
+		this.libraryRelease = libraryRelease;
+	}
+};
+/** Thrown when the runtime cannot be created for this database (SQLite, an unknown URL, a second database). */
+var DeliveryRuntimeError$1 = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "DeliveryRuntimeError";
+	}
+};
+/** The body and status the HTTP API would have answered, thrown as the client throws it. */
+const toShapioApiError = (error, log) => {
+	if (error instanceof ShapioApiError) return error;
+	const failure = error instanceof Error ? error : new Error(String(error));
+	const { statusCode, body } = toErrorResponse(failure);
+	if (statusCode >= 500) log.error({ err: error }, "in-process delivery read failed");
+	return new ShapioApiError(statusCode, body);
+};
+//#endregion
+//#region ../../apps/api/src/constants/sites.ts
+/** Delivery requests may name their site with this query parameter (it must match a site token's site). */
+const SITE_QUERY_PARAMETER = "site";
+//#endregion
+//#region ../../apps/api/src/content/model.ts
+const modelNotFound = (key) => new AppError(404, "MODEL_NOT_FOUND", `No content model "${key}"`, { modelKey: key });
+const collectComponents = (snapshot, model) => {
+	const found = /* @__PURE__ */ new Map();
+	const queue = embeddedComponentIds(model);
+	while (queue.length > 0) {
+		const id = queue.shift();
+		const active = snapshot.byId.get(id);
+		if (!active || found.has(id) || !isComponentDefinition(active.definition)) continue;
+		found.set(id, {
+			definition: active.definition,
+			version: active.version
+		});
+		queue.push(...embeddedComponentIds(active.definition));
+	}
+	return found;
+};
+const toContentModel = (snapshot, active) => ({
+	definition: active.definition,
+	version: active.version,
+	revisionId: active.revisionId,
+	components: collectComponents(snapshot, active.definition)
+});
+const isModel = (active) => active !== void 0 && !isComponentDefinition(active.definition);
+/**
+* Resolves `/api/…/content/:modelKey` through the registry at request time (CONTRIBUTING.md rule 2). Only a
+* site's view resolves API IDs: another site's model is not in it, so it reads as not found.
+*/
+const resolveModel = (snapshot, modelKey) => {
+	const active = snapshot.modelsByApiKey.get(modelKey);
+	if (!isModel(active)) throw modelNotFound(modelKey);
+	return toContentModel(snapshot, active);
+};
+/**
+* Resolves the delivery and preview routes' `:modelKey`, the route key (`routeKeyOf`): the plural API ID
+* of a collection, the API ID of a singleton. A collection's singular API ID is not a route key (404).
+*/
+const resolveRouteModel = (snapshot, routeKey) => {
+	const active = snapshot.modelsByRouteKey.get(routeKey);
+	if (!active || isComponentDefinition(active.definition)) throw modelNotFound(routeKey);
+	return resolveModel(snapshot, active.definition.apiKey);
+};
+/** The API ID behind a route key: REST entry points translate with it, then call the services. */
+const apiKeyOfRoute = (snapshot, routeKey) => resolveRouteModel(snapshot, routeKey).definition.apiKey;
+/** By stable ID: works on a view and on the full set (jobs and conversions that already know the site). */
+const resolveModelById = (snapshot, modelId) => {
+	const active = snapshot.byId.get(modelId);
+	return isModel(active) ? toContentModel(snapshot, active) : void 0;
+};
+const findFieldByApiKey = (fields, apiKey) => fields.find((field) => field.apiKey === apiKey && !field.deprecated);
+//#endregion
+//#region ../../apps/api/src/helpers/siteQuery.ts
+const isSiteSegment = (segment) => {
+	const key = segment.split("=", 1)[0] ?? "";
+	try {
+		return decodeURIComponent(key.replace(/\+/g, " ")) === SITE_QUERY_PARAMETER;
+	} catch {
+		return false;
+	}
+};
+/**
+* A raw querystring (without `?`) without its `site` parameter: site resolution consumes it, and the content
+* compiler refuses unknown keys. The rest is left exactly as sent (bracket syntax is the compiler's to parse).
+*/
+const withoutSiteParameter = (rawQuery) => rawQuery.split("&").filter((segment) => !isSiteSegment(segment)).join("&");
+//#endregion
+//#region ../../apps/api/src/constants/auth.ts
+/** `last_seen_at` / `last_used_at` are written at most this often, so reads stay reads. */
+const LAST_SEEN_WRITE_INTERVAL_MS = 6e4;
+//#endregion
+//#region ../../apps/api/src/permissions/types.ts
+const CONTENT_ACTIONS = [
+	"read",
+	"create",
+	"update",
+	"delete",
+	"publish",
+	"schemaManage"
+];
+/**
+* Content actions about the schema rather than one site's entries: network roles only for a shared
+* definition; for a site's own definition, the roles that apply on that site (when the principal acts there).
+*/
+const NETWORK_CONTENT_ACTIONS = /* @__PURE__ */ new Set(["schemaManage"]);
+/**
+* Actions that are not scoped to one model, in two kinds (sites plan §H):
+* - Network actions are about the whole instance (creating models, managing admin users, roles and sites,
+*   reading the audit log). Only roles assigned on every site grant them: a role held on one site never does,
+*   so a site admin cannot grant themselves other sites.
+* - Site actions are about one site's library, tokens and publishing; any role held on the site grants them.
+*/
+const NETWORK_ACTIONS = [
+	"schema.create",
+	"users.manage",
+	"roles.manage",
+	"audit.read",
+	"sites.manage"
+];
+/**
+* Network actions a role held on one site also grants for that site alone (plan site-schema, rule 4):
+* `schema.create` creates that site's own definitions. They are checked with `canPerformOnSite` and the
+* request's site; `canPerform` keeps the every-site meaning (shared definitions, locales, the schema lock).
+*/
+const SITE_GRANTABLE_ACTION_LIST = ["schema.create"];
+const SITE_GRANTABLE_ACTIONS = new Set(SITE_GRANTABLE_ACTION_LIST);
+const SITE_ACTIONS = [
+	"tokens.manage",
+	"media.read",
+	"media.write",
+	"media.manage",
+	"publishing.manage",
+	"webhooks.manage",
+	"deployments.manage",
+	"deployments.trigger",
+	"changes.manage",
+	"changes.ship",
+	"site.settings"
+];
+const GLOBAL_ACTIONS = [...NETWORK_ACTIONS, ...SITE_ACTIONS];
+const EMPTY_MASK$1 = {
+	mode: "only",
+	fieldIds: []
+};
+const DENIED_POLICY = Object.freeze({
+	allowed: false,
+	rowFilter: null,
+	readMask: EMPTY_MASK$1,
+	writeMask: EMPTY_MASK$1
+});
+//#endregion
+//#region ../../apps/api/src/routes/schemas/adminIdentity.ts
+/** Schemas shared by the admin identity routes (setup, auth, users, roles, tokens). */
+/** A timestamp in a response: a Date in handlers, ISO-8601 on the wire (fast-json-stringify formats it). */
+const DateTimeSchema = Type.Unsafe({
+	type: "string",
+	format: "date-time"
+});
+const NullableDateTimeSchema = Type.Union([DateTimeSchema, Type.Null()]);
+Type.String({ format: "date-time" });
+const UuidSchema = Type.String({ format: "uuid" });
+Type.Object({ id: UuidSchema });
+Type.String({
+	format: "email",
+	minLength: 3,
+	maxLength: 254
+});
+Type.String({
+	minLength: 12,
+	maxLength: 256
+});
+Type.String({
+	minLength: 1,
+	maxLength: 256
+});
+Type.String({
+	minLength: 1,
+	maxLength: 200
+});
+Type.String({
+	minLength: 16,
+	maxLength: 128,
+	pattern: "^[A-Za-z0-9_-]+$"
+});
+/** A role held on one site, or on every site (`siteId` null). */
+const RoleAssignmentSchema = Type.Object({
+	roleId: UuidSchema,
+	siteId: Type.Union([UuidSchema, Type.Null()])
+}, { additionalProperties: false });
+const AdminUserSchema = Type.Object({
+	id: UuidSchema,
+	email: Type.String(),
+	name: Type.String(),
+	status: Type.Union([Type.Literal("active"), Type.Literal("disabled")]),
+	/** Where each role applies. */
+	assignments: Type.Array(RoleAssignmentSchema),
+	/** Deprecated: the distinct roles of `assignments`, on any site. */
+	roleIds: Type.Array(UuidSchema),
+	lastLoginAt: NullableDateTimeSchema,
+	createdAt: DateTimeSchema,
+	updatedAt: DateTimeSchema
+});
+Type.Object({
+	user: AdminUserSchema,
+	csrfToken: Type.String()
+});
+Type.Enum(CONTENT_ACTIONS);
+Type.Enum(GLOBAL_ACTIONS);
+Type.Enum(NETWORK_ACTIONS);
+Type.Enum(SITE_ACTIONS);
+Type.Enum([...SITE_ACTIONS, ...SITE_GRANTABLE_ACTION_LIST]);
+Type.Object({
+	action: Type.Enum([...CONTENT_ACTIONS, ...GLOBAL_ACTIONS]),
+	modelId: Type.Union([Type.String({
+		minLength: 1,
+		maxLength: 100
+	}), Type.Null()]),
+	condition: Type.Union([Type.Literal("ownedByPrincipal"), Type.Null()]),
+	fieldIds: Type.Union([Type.Array(Type.String({
+		minLength: 1,
+		maxLength: 100
+	}), { maxItems: 500 }), Type.Null()])
+}, { additionalProperties: false });
+//#endregion
+//#region ../../apps/api/src/routes/schemas/error.ts
+/** The one error shape every endpoint returns (central error handler). */
+const ErrorResponseSchema = Type.Object({ error: Type.Object({
+	code: Type.String(),
+	message: Type.String(),
+	details: Type.Optional(Type.Unknown())
+}) });
+//#endregion
+//#region ../../apps/api/src/routes/snapshots/schemas.ts
+const SeqSchema = Type.Integer({ minimum: 0 });
+const NullableInteger = Type.Union([Type.Integer(), Type.Null()]);
+const ERRORS = {
+	400: ErrorResponseSchema,
+	401: ErrorResponseSchema
+};
+const SnapshotChangesQuerySchema = Type.Object({
+	from: SeqSchema,
+	/** Defaults to the current snapshot. */
+	to: Type.Optional(SeqSchema),
+	/** `nextCursor` of the previous page. */
+	after: Type.Optional(UuidSchema),
+	limit: Type.Optional(Type.Integer({
+		minimum: 1,
+		maximum: 500
+	}))
+}, { additionalProperties: false });
+const SnapshotChangeSchema = Type.Object({
+	id: UuidSchema,
+	modelId: UuidSchema,
+	modelKey: Type.String(),
+	routeKey: Type.String(),
+	/** From the revision live at `to` (at `from` when unpublished); null without a readable title. */
+	title: Type.Union([Type.String(), Type.Null()]),
+	/** The cover image's media asset ID, when the model has a readable cover. */
+	coverMediaId: Type.Union([UuidSchema, Type.Null()]),
+	locales: Type.Array(Type.Object({
+		locale: Type.String(),
+		change: Type.Enum([
+			"published",
+			"updated",
+			"unpublished"
+		]),
+		/** The revision live at `to`, or at `from` for `unpublished`. */
+		revisionId: Type.Union([UuidSchema, Type.Null()])
+	}))
+});
+Type.Object({
+	from: Type.Integer(),
+	to: Type.Integer(),
+	schemaVersions: Type.Object({
+		from: NullableInteger,
+		to: NullableInteger
+	}),
+	items: Type.Array(SnapshotChangeSchema),
+	nextCursor: Type.Union([UuidSchema, Type.Null()])
+}), { ...ERRORS };
+Type.Object({
+	snapshot: Type.Integer(),
+	schemaVersion: Type.Integer(),
+	publishedAt: NullableDateTimeSchema
+}), { ...ERRORS };
+//#endregion
+//#region ../../apps/api/src/content/compiler/types.ts
+/** The parsed, allowlisted form of a content query. Nothing in it is raw request text used as SQL. */
+const FILTER_OPERATORS = [
+	"$eq",
+	"$ne",
+	"$in",
+	"$nin",
+	"$lt",
+	"$lte",
+	"$gt",
+	"$gte",
+	"$contains",
+	"$notContains",
+	"$containsi",
+	"$startsWith",
+	"$endsWith",
+	"$null",
+	"$notNull"
+];
+/** System attributes every entry has. They are not stored in `data`. */
+const SYSTEM_ATTRIBUTES = [
+	"id",
+	"createdAt",
+	"updatedAt"
+];
+/**
+* Delivery shapes of a rich-text value (ADR 0003): `json` the stored document `{ format, version, doc }`,
+* `html` `{ format, version, html }` (sanitized HTML rendered from the document), `both` the document plus
+* `html`.
+*/
+const RICH_TEXT_MODES = [
+	"json",
+	"html",
+	"both"
+];
+/** `?seo=`: SEO fields as stored, or merged with the site's SEO defaults (plan seo-fields). */
+const SEO_MODES = ["raw", "resolved"];
+const ENTRY_LIST_STATUSES = [
+	"draft",
+	"published",
+	"modified"
+];
+const QUERY_LIMITS = {
+	maxPageSize: 100,
+	defaultPageSize: 25,
+	maxConditions: 50,
+	maxFilterDepth: 6,
+	maxInValues: 100,
+	maxValueLength: 1e3,
+	maxParameters: 200,
+	maxPopulateDepth: 3,
+	maxSortTerms: 5
+};
+/** A malformed or disallowed query: 400 for unknown/invalid, 403 for fields the caller may not use. */
+const queryInvalid = (message, details) => new AppError(400, "INVALID_QUERY", message, details);
+const queryForbidden = (message, details) => new AppError(403, "FORBIDDEN_FIELD", message, details);
+//#endregion
+//#region ../../apps/api/src/content/compiler/paginate.ts
+const toLimitOffset = (page, pageSize) => {
+	const size = Math.min(Math.max(1, pageSize), QUERY_LIMITS.maxPageSize);
+	return {
+		limit: size,
+		offset: (Math.max(1, page) - 1) * size
+	};
+};
+const paginationMeta = (page, pageSize, total) => ({
+	page,
+	pageSize,
+	total,
+	pageCount: Math.ceil(total / pageSize)
+});
+//#endregion
+//#region ../../apps/api/src/content/errors.ts
+/** Errors the content services throw; the central error handler renders them. */
+const entryNotFound = (id) => new AppError(404, "ENTRY_NOT_FOUND", `No entry ${id}`, { id });
+const snapshotInvalid = (requested, current) => new AppError(400, "SNAPSHOT_INVALID", `Snapshot ${requested} does not exist yet (latest is ${current})`, {
+	requested,
+	current
+});
+//#endregion
+//#region ../../apps/api/src/usage/keys.ts
+/**
+* How delivery reads are attributed (plan developer-face §5). Delivery tokens are consumers, one key per
+* token; app users are counted together, and so are anonymous callers. Admin reads (admin users and
+* admin-scope API tokens), system work and previews are not consumers and are never counted.
+*/
+const APP_USERS_PRINCIPAL_KEY = "app_users";
+const ANONYMOUS_PRINCIPAL_KEY = "anonymous";
+/** `token:<id>`, `app_users`, `anonymous`, or null for principals whose reads are not counted. */
+const usagePrincipalKey = (principal) => {
+	switch (principal.kind) {
+		case "token": return principal.scope === "delivery" ? `token:${principal.tokenId}` : null;
+		case "appUser": return APP_USERS_PRINCIPAL_KEY;
+		case "anonymous": return ANONYMOUS_PRINCIPAL_KEY;
+		default: return null;
+	}
+};
+/** A populated relation's target field: `<relation field ID>.<target field ID>`. */
+const relationFieldPath = (relationFieldId, targetFieldId) => `${relationFieldId}.${targetFieldId}`;
+//#endregion
+//#region ../../apps/api/src/content/validator/scalars.ts
+const INPUT_DATETIME = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(\.\d{1,9})?)?(Z|[+-]\d{2}:\d{2})$/;
+const isRealDate = (text) => {
+	if (!DATE_PATTERN.test(text)) return false;
+	const parsed = /* @__PURE__ */ new Date(`${text}T00:00:00.000Z`);
+	return !Number.isNaN(parsed.getTime()) && parsed.toISOString().startsWith(text);
+};
+const canonicalDate = (value) => typeof value === "string" && isRealDate(value) ? value : void 0;
+const canonicalDatetime = (value) => {
+	if (typeof value !== "string") return;
+	const match = INPUT_DATETIME.exec(value);
+	if (!match || !isRealDate(`${match[1]}-${match[2]}-${match[3]}`)) return;
+	const parsed = new Date(value);
+	return Number.isNaN(parsed.getTime()) ? void 0 : parsed.toISOString();
+};
+const canonicalTime = (value) => {
+	if (typeof value !== "string" || !TIME_PATTERN.test(value)) return;
+	const [hours, minutes, rest = "00"] = value.split(":");
+	const [seconds = "00", millis = "000"] = rest.split(".");
+	return `${hours}:${minutes}:${seconds}.${millis.padEnd(3, "0")}`;
+};
+const canonicalDecimal = (value) => {
+	if (typeof value === "number" && Number.isFinite(value)) {
+		const text = String(value);
+		return DECIMAL_PATTERN.test(text) ? text : void 0;
+	}
+	return typeof value === "string" && DECIMAL_PATTERN.test(value) ? value : void 0;
+};
+const canonicalBigInteger = (value) => {
+	if (typeof value === "number" && Number.isSafeInteger(value)) return String(value);
+	return typeof value === "string" && BIGINTEGER_PATTERN.test(value) ? value : void 0;
+};
+//#endregion
+//#region ../../apps/api/src/content/validator/index.ts
+/**
+* The content validator (build plan §4.E2). Built from the active model and the components it embeds,
+* compiled once per combination of schema revisions and cached. Values arrive keyed by API keys at the
+* boundary (`fromInput`) and are validated in storage form, keyed by stable field IDs (`validate`).
+*
+* Storage format of structured values:
+* - component: an object keyed by the component's field IDs (an array of them when repeatable);
+* - dynamic zone: an array of such objects, each with `__component` holding the component's stable ID
+*   (its API key at the boundary);
+* - relation: the target entry ID (`one`) or an ordered array of IDs (`many`);
+* - media: an asset ID, or an array of them when `multiple`.
+* Missing values (absent, null, empty string, empty list, empty rich text) are not stored.
+* Keys that no field defines (values of removed fields) are preserved untouched (brief §5: field removal
+* keeps values until an explicit cleanup); deprecated fields' values are kept but not validated.
+*/
+const COMPONENT_KEY = "__component";
+//#endregion
+//#region ../../apps/api/src/db/dialect.ts
+const SQLITE_PREFIX = "sqlite:";
+const MEMORY = ":memory:";
+/** The dialect a DATABASE_URL names, or undefined when it names none of them. */
+const dialectOfUrl = (url) => {
+	if (url.startsWith(SQLITE_PREFIX)) return "sqlite";
+	if (url.startsWith("mysql://")) return "mysql";
+	return /^postgres(ql)?:\/\//.test(url) ? "postgres" : void 0;
+};
+/**
+* Where a `sqlite:` URL points: `sqlite::memory:` or `sqlite:<path>` (relative to the working directory or
+* absolute; `sqlite:///abs/path` is accepted too). Throws when the path is empty.
+*/
+const sqliteLocationOfUrl = (url) => {
+	const rest = url.slice(7);
+	if (rest === MEMORY) return { kind: "memory" };
+	const path = rest.startsWith("//") ? rest.slice(2) : rest;
+	if (path === "") throw new Error("A sqlite: DATABASE_URL needs a file path, e.g. sqlite:./shapio.db");
+	return {
+		kind: "file",
+		path
+	};
+};
+/** `host:port/database` (PostgreSQL, MySQL) or the file path (SQLite) from DATABASE_URL, never the credentials. */
+const describeDatabaseTarget = (connectionString) => {
+	if (dialectOfUrl(connectionString) === "sqlite") {
+		const location = sqliteLocationOfUrl(connectionString);
+		return location.kind === "memory" ? "an in-memory database" : location.path;
+	}
+	try {
+		const url = new URL(connectionString);
+		const defaultPort = dialectOfUrl(connectionString) === "mysql" ? "3306" : "5432";
+		return `${url.hostname}:${url.port || defaultPort}${url.pathname}`;
+	} catch {
+		return "the configured database";
+	}
+};
+let current;
+/** The dialect queries are built for. PostgreSQL until a database handle says otherwise. */
+const currentDialect = () => current ?? "postgres";
+/**
+* Sets the process dialect. `createDb` calls it; one process talks to one dialect, so switching after a
+* handle exists is a bug (`force` is for unit tests that compile SQL for both dialects without a database).
+*/
+const setCurrentDialect = (dialect, { force = false } = {}) => {
+	if (!force && current !== void 0 && current !== dialect) throw new Error(`This process already uses ${current}; it cannot also open a ${dialect} database`);
+	current = dialect;
+};
+const isSqlite = () => currentDialect() === "sqlite";
+const isMysql = () => currentDialect() === "mysql";
+//#endregion
+//#region ../../apps/api/src/db/mysql/fieldIndexColumns.ts
+/**
+* On MySQL a field index is built on an invisible virtual column holding the field's value expression
+* (`content/compiler/dialect/mysql.ts`); the column is named after the index: `eh_<hash>` → `ev_<hash>`.
+*/
+const fieldIndexColumnName = (indexName) => indexName.replace(/^eh_/, "ev_");
+//#endregion
+//#region ../../apps/api/src/content/compiler/heads.ts
+/** Content heads (package E). Expression indexes live on this table only. */
+const CONTENT_HEADS_TABLE = "entry_heads";
+/** Columns of `entry_heads` the index layout depends on. Package E must keep these names. */
+const CONTENT_HEADS_COLUMNS = {
+	data: "data",
+	siteId: "site_id",
+	modelId: "model_id",
+	locale: "locale",
+	state: "state"
+};
+//#endregion
+//#region ../../apps/api/src/content/compiler/dialect/mysql.ts
+/**
+* MySQL content SQL (ADR 0001, "MySQL"). `data` is a JSON column; there is no containment index and no
+* partial index, so:
+* - each filterable or sortable field gets an invisible virtual column holding its value expression and one
+*   index `(site_id, model_id[, locale], state, column)`, built online (`ALGORITHM=INPLACE, LOCK=NONE`; a
+*   functional index cannot be). Queries use the expression; MySQL matches it to the column for `=`, ranges
+*   and ORDER BY (it does not for `<=>`, so equality is `expr = ? and expr is not null`: false, never null,
+*   for a missing value, as containment is);
+* - values are read with `json_value`, which gives SQL NULL for JSON null (`->>` gives the text 'null');
+*   text indexes and compares the first 255 characters (an index key is bounded), and equality with a longer
+*   value also compares the whole text; numbers compare as DOUBLE, decimal and biginteger strings as
+*   DECIMAL(65,30) (parameters are cast the same way, or MySQL does not use the column);
+* - text compares in the session's binary `utf8mb4_0900_bin` collation (case-sensitive, code point order),
+*   matched with `locate`, so no LIKE escaping; `$containsi` and search fold both sides with `lower()`;
+* - list membership is `member of` (unindexed); bound lists are `in (?, …)`;
+* - JSON functions return `utf8mb4_bin` text, which MySQL refuses to compare with a literal in the session's
+*   collation, so JSON is compared as JSON (`= cast('null' as json)`) or the literal's collation is named;
+* - NULL placement in sorts is written out: `(expr is null), expr`.
+*/
+const DATA$2 = sql.ref(CONTENT_HEADS_COLUMNS.data);
+/** Longest text `json_value` returns; longer values read as NULL. */
+const TEXT_LIMIT = 1e6;
+/**
+* The JSON path of a field. The `_utf8mb4` introducer gives the literal the character set's own collation
+* whatever the session's: MySQL stores a generated column's expression that way, and only matches a query's
+* expression to the column (to use its index) when every literal in it has the same collation.
+*/
+const path = (fieldId) => sql`_utf8mb4${sql.lit(`$."${fieldId}"`)}`;
+const fieldJson$1 = (fieldId) => sql`json_extract(${DATA$2}, ${path(fieldId)})`;
+const fieldText$2 = (fieldId) => sql`json_value(${DATA$2}, ${path(fieldId)} returning char(${sql.lit(TEXT_LIMIT)}))`;
+/** decimal and biginteger: exact to 35 integer and 30 fractional digits; other numbers are doubles. */
+const DECIMAL = sql`decimal(65,30)`;
+const fieldValue$2 = (fieldId, cast, numericString = false) => {
+	switch (cast) {
+		case "numeric": return numericString ? sql`json_value(${DATA$2}, ${path(fieldId)} returning ${DECIMAL})` : sql`json_value(${DATA$2}, ${path(fieldId)} returning double)`;
+		case "boolean": return sql`json_value(${DATA$2}, ${path(fieldId)} returning char(5))`;
+		default: return sql`left(${fieldText$2(fieldId)}, ${sql.lit(255)})`;
+	}
+};
+const booleanText = (value) => value === true || value === "true" ? "true" : "false";
+const castParameter$3 = (value, cast, numericString = false) => {
+	switch (cast) {
+		case "numeric": return numericString ? sql`cast(${value} as ${DECIMAL})` : sql`cast(${value} as double)`;
+		case "boolean": return sql`${booleanText(value)}`;
+		default: return sql`${value}`;
+	}
+};
+const listValue = (value, element) => element === "timestamp" ? toDatetimeText(value) : value;
+/** `expr = ? and expr is not null`: false (not null) for a missing value, and still index-served. */
+const presentAndEqual = (expression, value) => sql`(${expression} = ${value} and ${expression} is not null)`;
+const textEquals = (fieldId, value) => {
+	const prefix = fieldValue$2(fieldId, "text");
+	if (typeof value === "string" && [...value].length < 255) return presentAndEqual(prefix, sql`${value}`);
+	return sql`(${prefix} = left(${value}, ${sql.lit(255)}) and ${fieldText$2(fieldId)} = ${value})`;
+};
+const COLUMN_TYPES = {
+	text: sql`varchar(${sql.lit(255)}) collate utf8mb4_0900_bin`,
+	numeric: sql`double`,
+	boolean: sql`varchar(5) collate utf8mb4_0900_bin`
+};
+const addIndexColumn = ({ name, table, expression, cast, numericString }) => sql`alter table ${sql.table(table)} add column ${sql.id(fieldIndexColumnName(name))} ${numericString ? DECIMAL : COLUMN_TYPES[cast]}
+    generated always as (${expression}) virtual invisible, algorithm=inplace, lock=none`;
+const mysqlContentDialect = {
+	name: "mysql",
+	uuid: (value) => sql`${value}`,
+	timestamp: (value) => sql`${toDatetimeText(value)}`,
+	bool: (value) => value ? sql`true` : sql`false`,
+	oneOf: (column, values, element) => values.length === 0 ? sql`false` : sql`${column} in (${sql.join(values.map((value) => listValue(value, element)))})`,
+	fieldValue: fieldValue$2,
+	fieldText: fieldText$2,
+	fieldJson: fieldJson$1,
+	castParameter: castParameter$3,
+	fieldEquals: (target, value) => {
+		if (target.list) {
+			const json = fieldJson$1(target.fieldId);
+			return sql`(${json} is not null and json_type(${json}) = 'ARRAY' collate utf8mb4_bin and ${value} member of (${json}))`;
+		}
+		if (target.numericString && target.cast) return sql`(${fieldValue$2(target.fieldId, target.cast, true)} = ${castParameter$3(value, target.cast, true)})`;
+		if (target.cast === null || target.cast === "text") return target.cast === null ? presentAndEqual(fieldText$2(target.fieldId), sql`${value}`) : textEquals(target.fieldId, value);
+		return presentAndEqual(fieldValue$2(target.fieldId, target.cast), castParameter$3(value, target.cast));
+	},
+	fieldMissing: (fieldId) => {
+		const json = fieldJson$1(fieldId);
+		return sql`(${json} is null or ${json} = cast('null' as json) or ${json} = cast('""' as json) or ${json} = json_array())`;
+	},
+	textMatch: (fieldId, operator, text) => {
+		const value = fieldText$2(fieldId);
+		switch (operator) {
+			case "$startsWith": return sql`(locate(${text}, ${value}) = 1)`;
+			case "$endsWith": return sql`(right(${value}, ${sql.lit([...text].length)}) = ${text})`;
+			case "$notContains": return sql`(locate(${text}, coalesce(${value}, '')) = 0)`;
+			default: return sql`(locate(${text}, ${value}) > 0)`;
+		}
+	},
+	containsInsensitive: (fieldId, text) => sql`(locate(lower(${text}), lower(${fieldText$2(fieldId)})) > 0)`,
+	localeRank: (chain, column) => sql`(case ${column} ${sql.join(chain.map((locale, index) => sql`when ${locale} then ${sql.lit(index)}`), sql` `)} end)`,
+	sortDirection: (direction) => direction === "desc" ? sql`desc` : sql`asc`,
+	sortTerm: (expression, direction, nullable) => {
+		const order = direction === "desc" ? sql`desc` : sql`asc`;
+		return nullable ? sql`(${expression} is null) ${order}, ${expression} ${order}` : sql`${expression} ${order}`;
+	},
+	snapshotCte: ({ name, siteId, modelId, seq }) => sql`with ${sql.id(name)} as (
+    select pl.entry_id, pl.site_id, pl.model_id, pl.locale, 'published' as state, r.data, 0 as version,
+      r.id as revision_id, pl.published_at as updated_at, null as autosaved_at,
+      en.created_at as entry_created_at
+    from publication_log pl
+    join content_revisions r on r.id = pl.revision_id
+    join entries en on en.id = pl.entry_id
+    where pl.site_id = ${siteId} and pl.model_id = ${modelId}
+      and pl.from_seq <= ${seq}
+      and (pl.to_seq is null or pl.to_seq > ${seq})
+  ) `,
+	fieldIndexColumn: {
+		add: addIndexColumn,
+		drop: (name) => sql`alter table ${sql.table(CONTENT_HEADS_TABLE)} drop column ${sql.id(fieldIndexColumnName(name))}, algorithm=inplace, lock=none`
+	},
+	createFieldIndex: ({ name, table, localized, modelIdColumn }) => {
+		const { siteId, locale, state } = CONTENT_HEADS_COLUMNS;
+		const leading = localized ? sql`${sql.ref(siteId)}, ${sql.ref(modelIdColumn)}, ${sql.ref(locale)}, ${sql.ref(state)}` : sql`${sql.ref(siteId)}, ${sql.ref(modelIdColumn)}, ${sql.ref(state)}`;
+		return sql`create index ${sql.id(name)} on ${sql.table(table)} (${leading}, ${sql.id(fieldIndexColumnName(name))}) algorithm=inplace lock=none`;
+	},
+	createFieldStatistics: () => null,
+	dropFieldIndex: (name) => sql`drop index ${sql.id(name)} on ${sql.table(CONTENT_HEADS_TABLE)} algorithm=inplace lock=none`,
+	dropFieldStatistics: () => null,
+	analyze: (table) => sql`analyze table ${sql.table(table)}`
+};
+//#endregion
+//#region ../../apps/api/src/content/compiler/dialect/postgres.ts
+/**
+* PostgreSQL content SQL (ADR 0001): JSONB with a GIN `jsonb_path_ops` index serving containment, so
+* equality on a field without an index is emitted as `data @> {...}`; ranges, sorts and equality on indexed
+* fields (filterable or sortable) use per-field B-tree expression indexes built `CONCURRENTLY` with a
+* matching `CREATE STATISTICS` object.
+*/
+const DATA$1 = sql.ref(CONTENT_HEADS_COLUMNS.data);
+const ARRAY_TYPES$1 = {
+	uuid: sql`uuid[]`,
+	text: sql`text[]`,
+	timestamp: sql`timestamptz[]`
+};
+const MISSING_JSON = sql`('null'::jsonb, '""'::jsonb, '[]'::jsonb)`;
+/** LIKE escaping (the default `\` escape character). */
+const escapeLike = (text) => text.replace(/[\\%_]/g, (char) => `\\${char}`);
+const likePattern = (operator, text) => {
+	const escaped = escapeLike(text);
+	switch (operator) {
+		case "$startsWith": return `${escaped}%`;
+		case "$endsWith": return `%${escaped}`;
+		default: return `%${escaped}%`;
+	}
+};
+const fieldText$1 = (fieldId) => sql`(${DATA$1} ->> ${sql.lit(fieldId)})`;
+const fieldValue$1 = (fieldId, cast) => {
+	const text = fieldText$1(fieldId);
+	switch (cast) {
+		case "numeric": return sql`(${text}::numeric)`;
+		case "boolean": return sql`(${text}::boolean)`;
+		default: return text;
+	}
+};
+const castParameter$2 = (value, cast) => {
+	switch (cast) {
+		case "numeric": return sql`${value}::numeric`;
+		case "boolean": return sql`${value}::boolean`;
+		default: return sql`${value}::text`;
+	}
+};
+/**
+* `data @> $1::jsonb`: the only form the GIN index serves. The document is a parameter, field IDs included,
+* so nothing from the request is ever spliced into the SQL text.
+*/
+const containment = (document) => sql`(${DATA$1} @> ${JSON.stringify(document)}::jsonb)`;
+const postgresContentDialect = {
+	name: "postgres",
+	uuid: (value) => sql`${value}::uuid`,
+	timestamp: (value) => sql`${value}::timestamptz`,
+	bool: (value) => sql`${value}::boolean`,
+	oneOf: (column, values, element) => sql`${column} = any(${[...values]}::${ARRAY_TYPES$1[element]})`,
+	fieldValue: fieldValue$1,
+	fieldText: fieldText$1,
+	fieldJson: (fieldId) => sql`(${DATA$1} -> ${sql.lit(fieldId)})`,
+	castParameter: castParameter$2,
+	fieldEquals: (target, value) => {
+		if (target.numericString && target.cast) return sql`(${fieldValue$1(target.fieldId, target.cast)} = ${castParameter$2(value, target.cast)})`;
+		if (target.indexed && target.cast) {
+			const expression = fieldValue$1(target.fieldId, target.cast);
+			return sql`(${expression} = ${castParameter$2(value, target.cast)} and ${expression} is not null)`;
+		}
+		return containment({ [target.fieldId]: target.list ? [value] : value });
+	},
+	fieldMissing: (fieldId) => {
+		const json = postgresContentDialect.fieldJson(fieldId);
+		return sql`(${json} is null or ${json} in ${MISSING_JSON})`;
+	},
+	textMatch: (fieldId, operator, text) => operator === "$notContains" ? sql`(coalesce(${fieldText$1(fieldId)}, '') not like ${likePattern(operator, text)})` : sql`(${fieldText$1(fieldId)} like ${likePattern(operator, text)})`,
+	containsInsensitive: (fieldId, text) => sql`(${fieldText$1(fieldId)} ilike ${likePattern("$containsi", text)})`,
+	localeRank: (chain, column) => sql`array_position(${[...chain]}::text[], ${column})`,
+	sortDirection: (direction) => direction === "desc" ? sql`desc` : sql`asc`,
+	snapshotCte: ({ name, siteId, modelId, seq }) => sql`with ${sql.id(name)} as (
+    select pl.entry_id, pl.site_id, pl.model_id, pl.locale, 'published'::text as state, r.data, 0 as version,
+      r.id as revision_id, pl.published_at as updated_at, null::timestamptz as autosaved_at,
+      en.created_at as entry_created_at
+    from publication_log pl
+    join content_revisions r on r.id = pl.revision_id
+    join entries en on en.id = pl.entry_id
+    where pl.site_id = ${siteId}::uuid and pl.model_id = ${modelId}
+      and pl.from_seq <= ${seq}::bigint
+      and (pl.to_seq is null or pl.to_seq > ${seq}::bigint)
+  ) `,
+	createFieldIndex: ({ name, table, leading, expression, modelIdColumn, modelId }) => sql`create index concurrently if not exists ${sql.id(name)} on ${sql.table(table)} (${leading}, ${expression}) where ${sql.ref(modelIdColumn)} = ${modelId}`,
+	createFieldStatistics: (name, expression, table) => sql`create statistics if not exists ${sql.id(name)} on ${expression} from ${sql.table(table)}`,
+	dropFieldIndex: (name) => sql`drop index concurrently if exists ${sql.id(name)}`,
+	dropFieldStatistics: (name) => sql`drop statistics if exists ${sql.id(name)}`,
+	analyze: (table) => sql`analyze ${sql.table(table)}`
+};
+//#endregion
+//#region ../../apps/api/src/content/compiler/dialect/sqlite.ts
+/**
+* SQLite content SQL (ADR 0001, "D2: as built"). `data` is JSON text read with JSON1's `->`/`->>`; there is
+* no GIN index and no containment, so:
+* - one partial expression index per filterable or sortable field serves equality, ranges and sorts, and
+*   scalar equality is emitted on that same expression (`expr is ?`, which the planner treats like `=` and
+*   which is false, never null, for a missing value, as containment is);
+* - list membership is `json_each` (unindexed; the model's heads are scanned);
+* - LIKE folds ASCII case, so case-sensitive matches use `instr`/`substr`, and case-insensitive ones use
+*   `shapio_fold` (JavaScript `toLowerCase`, a deterministic function registered on every connection by
+*   the database layer) on the column and the same folding of the parameter in JavaScript;
+* - there are no `::` casts and no array parameters: lists are bound as one JSON text parameter, and
+*   timestamps as the stored text (`toStoredTimestamp`), which compares as time;
+* - indexes are built with a plain `CREATE INDEX` (no `CONCURRENTLY`: the build holds the single write lock
+*   until it finishes) and there is no `CREATE STATISTICS`.
+*/
+const DATA = sql.ref(CONTENT_HEADS_COLUMNS.data);
+/** The name of the case-folding SQL function the database layer registers on each SQLite connection. */
+const FOLD_FUNCTION = "shapio_fold";
+/** What `shapio_fold` computes, for the parameter side (and the function's registration). */
+const foldText = (text) => text.toLowerCase();
+const listParameter = (values, element) => JSON.stringify(element === "timestamp" ? values.map((value) => toStoredTimestamp(value)) : [...values]);
+const fieldText = (fieldId) => sql`(${DATA} ->> ${sql.lit(fieldId)})`;
+const fieldJson = (fieldId) => sql`(${DATA} -> ${sql.lit(fieldId)})`;
+/** Booleans extract as 1/0 and numbers as numbers; decimal and biginteger strings need the cast. */
+const fieldValue = (fieldId, cast) => cast === "numeric" ? sql`cast(${fieldText(fieldId)} as numeric)` : fieldText(fieldId);
+const castParameter$1 = (value, cast) => {
+	switch (cast) {
+		case "numeric": return sql`cast(${value} as numeric)`;
+		case "boolean": return sql`${value === true || value === "true" ? 1 : 0}`;
+		default: return sql`${value}`;
+	}
+};
+//#endregion
+//#region ../../apps/api/src/content/compiler/dialect/index.ts
+const DIALECTS = {
+	postgres: postgresContentDialect,
+	sqlite: {
+		name: "sqlite",
+		uuid: (value) => sql`${value}`,
+		timestamp: (value) => sql`${toStoredTimestamp(value)}`,
+		bool: (value) => value ? sql`true` : sql`false`,
+		oneOf: (column, values, element) => sql`${column} in (select value from json_each(${listParameter(values, element)}))`,
+		fieldValue,
+		fieldText,
+		fieldJson,
+		castParameter: castParameter$1,
+		fieldEquals: (target, value) => {
+			if (target.list) {
+				const json = fieldJson(target.fieldId);
+				return sql`(json_type(${json}) = 'array' and exists (select 1 from json_each(${json}) where value = ${value}))`;
+			}
+			if (target.numericString && target.cast) return sql`(${fieldValue(target.fieldId, target.cast)} = ${castParameter$1(value, target.cast)})`;
+			const expression = target.cast ? fieldValue(target.fieldId, target.cast) : fieldText(target.fieldId);
+			return sql`(${expression} is ${castParameter$1(value, target.cast ?? "text")})`;
+		},
+		fieldMissing: (fieldId) => {
+			const json = fieldJson(fieldId);
+			return sql`(${json} is null or ${json} in ('null', '""', '[]'))`;
+		},
+		textMatch: (fieldId, operator, text) => {
+			const value = fieldText(fieldId);
+			switch (operator) {
+				case "$startsWith": return sql`(instr(${value}, ${text}) = 1)`;
+				case "$endsWith": return sql`(substr(${value}, -length(${text})) = ${text})`;
+				case "$notContains": return sql`(instr(coalesce(${value}, ''), ${text}) = 0)`;
+				default: return sql`(instr(${value}, ${text}) > 0)`;
+			}
+		},
+		containsInsensitive: (fieldId, text) => sql`(instr(${sql.raw(FOLD_FUNCTION)}(${fieldText(fieldId)}), ${foldText(text)}) > 0)`,
+		localeRank: (chain, column) => sql`(case ${column} ${sql.join(chain.map((locale, index) => sql`when ${locale} then ${sql.lit(index)}`), sql` `)} end)`,
+		sortDirection: (direction, nullable) => {
+			if (!nullable) return direction === "desc" ? sql`desc` : sql`asc`;
+			return direction === "desc" ? sql`desc nulls first` : sql`asc nulls last`;
+		},
+		snapshotCte: ({ name, siteId, modelId, seq }) => sql`with ${sql.id(name)} as (
+    select pl.entry_id, pl.site_id, pl.model_id, pl.locale, 'published' as state, r.data, 0 as version,
+      r.id as revision_id, pl.published_at as updated_at, null as autosaved_at,
+      en.created_at as entry_created_at
+    from publication_log pl
+    join content_revisions r on r.id = pl.revision_id
+    join entries en on en.id = pl.entry_id
+    where pl.site_id = ${siteId} and pl.model_id = ${modelId}
+      and pl.from_seq <= ${seq}
+      and (pl.to_seq is null or pl.to_seq > ${seq})
+  ) `,
+		createFieldIndex: ({ name, table, leading, expression, modelIdColumn, modelId }) => sql`create index if not exists ${sql.id(name)} on ${sql.table(table)} (${leading}, ${expression}) where ${sql.ref(modelIdColumn)} = ${modelId}`,
+		createFieldStatistics: () => null,
+		dropFieldIndex: (name) => sql`drop index if exists ${sql.id(name)}`,
+		dropFieldStatistics: () => null,
+		analyze: (table) => sql`analyze ${sql.table(table)}`
+	},
+	mysql: mysqlContentDialect
+};
+const contentDialectFor = (name) => DIALECTS[name];
+//#endregion
+//#region ../../apps/api/src/content/compiler/currentDialect.ts
+/**
+* The content dialect of this process's database (`db/dialect.ts`, chosen from `DATABASE_URL`). Every
+* compiler function takes a dialect as an optional last argument that defaults to this one.
+*/
+const contentDialect = () => contentDialectFor(currentDialect());
+//#endregion
+//#region ../../apps/api/src/content/compiler/policy.ts
+/**
+* Policies in content queries (ADR 0005): row filters compile to SQL here (and only here); masks decide
+* which fields a caller sees, may filter on and may write. Row-filter conditions are an enumerated set,
+* never free-form expressions.
+*/
+/** Entry columns row conditions read. `e` is the entries alias of every head query. */
+const OWNER_COLUMNS = {
+	admin: "e.created_by_admin_id",
+	appUser: "e.owner_app_user_id"
+};
+const compileRowFilter = (filter, principal, dialect = contentDialect()) => {
+	if (!filter) return null;
+	switch (filter.kind) {
+		case "ownedByPrincipal":
+			if (principal.kind === "admin") return sql`${sql.ref(OWNER_COLUMNS.admin)} = ${dialect.uuid(principal.adminUserId)}`;
+			if (principal.kind === "appUser") return sql`${sql.ref(OWNER_COLUMNS.appUser)} = ${dialect.uuid(principal.appUserId)}`;
+			return sql`false`;
+		case "and":
+		case "or": {
+			const parts = filter.filters.map((child) => compileRowFilter(child, principal, dialect) ?? sql`true`);
+			if (parts.length === 0) return dialect.bool(filter.kind === "and");
+			return sql`(${sql.join(parts, filter.kind === "and" ? sql` and ` : sql` or `)})`;
+		}
+	}
+};
+/**
+* Whether a mask lets the caller see a field. A wildcard mask covers every live field; deprecated fields
+* stay hidden unless a mask names them explicitly.
+*/
+const maskAllows = (mask, field) => mask.mode === "all" ? !field.deprecated : mask.fieldIds.includes(field.id);
+/**
+* One condition over the entries row `e` for reads spanning several models (the snapshot diff): an entry
+* passes when its model is readable without a row filter, or its model's row filter holds for it.
+*/
+const compileModelRowFilters = (models, principal, dialect = contentDialect()) => {
+	if (models.every((model) => model.rowFilter === null)) return null;
+	const open = models.filter((model) => model.rowFilter === null).map((model) => model.modelId);
+	const parts = [...open.length > 0 ? [dialect.oneOf(sql`e.model_id`, open, "uuid")] : [], ...models.flatMap((model) => model.rowFilter === null ? [] : [sql`(e.model_id = ${dialect.uuid(model.modelId)} and ${compileRowFilter(model.rowFilter, principal, dialect) ?? sql`true`})`])];
+	return sql`(${sql.join(parts, sql` or `)})`;
+};
+//#endregion
+//#region ../../apps/api/src/content/compiler/select.ts
+/**
+* Storage → API projection with explicit masks (build plan §3.10: generic content routes cannot carry
+* fixed response schemas, so this is where leaks are prevented). Only fields the mask allows, and the
+* caller selected, are emitted; field IDs become API keys; relation IDs are limited to targets the caller
+* may see (published, readable) unless they were populated. Absent values are emitted as null (or [] for
+* lists) so every entry of a model has the same shape.
+*/
+/** The top-level fields a response carries: readable, live (unless named by the mask) and selected. */
+const selectFields = (model, mask, selected) => {
+	const allowed = model.definition.fields.filter((field) => maskAllows(mask, field));
+	return selected ? allowed.filter((field) => selected.some((choice) => choice.id === field.id)) : allowed;
+};
+/**
+* Renders a delivered rich-text value's HTML on demand (GraphQL's `RichText.html` resolver). A symbol key, so
+* `JSON.stringify` never writes it: REST responses carry `html` only when the request asked for it.
+*/
+const RICH_TEXT_HTML = Symbol("shapio.richTextHtml");
+const projectRichText = (document, mode, options) => {
+	const render = () => renderRichTextHtml(document, (id) => options.mediaAssets?.get(id)?.url);
+	const { doc, ...envelope } = document;
+	const shaped = mode === "json" ? { ...document } : mode === "html" ? {
+		...envelope,
+		html: render()
+	} : {
+		...envelope,
+		doc,
+		html: render()
+	};
+	shaped[RICH_TEXT_HTML] = render;
+	return shaped;
+};
+const isRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isListField = (field) => field.type === "relation" && field.settings.cardinality === "many" || field.type === "media" && field.settings.multiple || field.type === "component" && field.settings.repeatable || field.type === "dynamiczone";
+const projectRelation = (field, value, options, topLevel) => {
+	const ids = (Array.isArray(value) ? value : [value]).filter((id) => typeof id === "string");
+	const populated = topLevel ? options.populated.get(field.id) : void 0;
+	const shown = ids.flatMap((id) => {
+		if (populated) return populated.has(id) ? [populated.get(id)] : [];
+		return options.visibleTargets === null || options.visibleTargets.has(id) ? [id] : [];
+	});
+	return field.settings.cardinality === "many" ? shown : shown[0] ?? null;
+};
+const projectComponent = (component, value, options) => component && isRecord$2(value) ? projectFields(component.fields.filter((field) => !field.deprecated), value, options, false) : null;
+const isStringOrStrings = (value) => typeof value === "string" || Array.isArray(value) && value.every((item) => typeof item === "string");
+/**
+* Whether a stored value has the shape the field's current type produces. Old snapshots are served through
+* the current schema (plan developer-face §5): a value written before a type change (text → rich text) is
+* not converted at read time, it is emitted as empty instead of being passed off as the new type.
+*/
+const matchesFieldType = (field, value) => {
+	switch (field.type) {
+		case "number":
+		case "integer": return typeof value === "number";
+		case "boolean": return typeof value === "boolean";
+		case "json": return true;
+		case "richtext": return isRecord$2(value) && isRecord$2(value.doc);
+		case "relation":
+		case "media": return isStringOrStrings(value);
+		case "enum": return field.settings.multiple ? Array.isArray(value) && value.every((item) => typeof item === "string") : typeof value === "string";
+		case "component": return field.settings.repeatable ? Array.isArray(value) : isRecord$2(value);
+		case "dynamiczone": return Array.isArray(value);
+		default: return typeof value === "string";
+	}
+};
+const projectValue = (field, value, options, topLevel) => {
+	if (value === void 0 || value === null || !matchesFieldType(field, value)) return isListField(field) ? [] : null;
+	switch (field.type) {
+		case "relation": return projectRelation(field, value, options, topLevel);
+		case "component": {
+			const component = options.model.components.get(field.settings.component)?.definition;
+			return field.settings.repeatable ? (Array.isArray(value) ? value : []).map((item) => projectComponent(component, item, options)) : projectComponent(component, value, options);
+		}
+		case "dynamiczone": return (Array.isArray(value) ? value : []).flatMap((item) => {
+			const component = isRecord$2(item) ? options.model.components.get(String(item[COMPONENT_KEY]))?.definition : void 0;
+			const projected = projectComponent(component, item, options);
+			return component && projected ? [{
+				[COMPONENT_KEY]: component.apiKey,
+				...projected
+			}] : [];
+		});
+		case "richtext": return options.richText ? projectRichText(value, options.richText, options) : value;
+		case "media": {
+			if (!options.mediaAssets) return value;
+			const assets = (Array.isArray(value) ? value : [value]).flatMap((id) => {
+				const asset = typeof id === "string" ? options.mediaAssets?.get(id) : void 0;
+				return asset ? [asset] : [];
+			});
+			return field.settings.multiple ? assets : assets[0] ?? null;
+		}
+		default: return value;
+	}
+};
+function projectFields(fields, data, options, topLevel) {
+	const output = {};
+	for (const field of fields) output[field.apiKey] = projectValue(field, data[field.id], options, topLevel);
+	return output;
+}
+/** A head's data as the API returns it. */
+const projectData = (data, options) => projectFields(options.fields, data, options, true);
+//#endregion
+//#region ../../apps/api/src/usage/restFieldReads.ts
+const restFieldReads = async ({ snapshot, model, policy, query, policyFor }) => {
+	const fields = selectFields(model, policy.readMask, query.fields);
+	const selection = query.fields === null ? "implicit" : "explicit";
+	const reads = fields.map((field) => ({
+		path: field.id,
+		selection
+	}));
+	for (const field of fields) {
+		if (field.type !== "relation" || !query.populate.has(field.id)) continue;
+		const target = resolveModelById(snapshot, field.settings.target);
+		if (!target) continue;
+		const targetPolicy = await policyFor(target.definition.id);
+		if (!targetPolicy.allowed) continue;
+		for (const targetField of selectFields(target, targetPolicy.readMask, null)) reads.push({
+			path: relationFieldPath(field.id, targetField.id),
+			selection: "implicit"
+		});
+	}
+	return reads;
+};
+//#endregion
+//#region ../../apps/api/src/content/compiler/expressions.ts
+const NUMERIC_TYPES = /* @__PURE__ */ new Set([
+	"number",
+	"integer",
+	"decimal",
+	"biginteger"
+]);
+/** Numbers stored as JSON strings (exact decimals, big integers). */
+const NUMERIC_STRING_TYPES$1 = /* @__PURE__ */ new Set(["decimal", "biginteger"]);
+/**
+* Whether a field has a B-tree expression index: filterable or sortable, and not deprecated. The schema
+* planner builds an index for exactly these fields (`indexStepsOf`), and PostgreSQL equality compares on
+* the index expression for them (`EqualityTarget.indexed`).
+*/
+const hasFieldIndex = (field) => (field.filterable || field.sortable) && !field.deprecated;
+const valueCastFor = (type) => {
+	if (NUMERIC_TYPES.has(type)) return "numeric";
+	return type === "boolean" ? "boolean" : "text";
+};
+var UnsafeIdentifierError = class extends Error {
+	constructor(what) {
+		super(`Refusing to build SQL with ${what}: not a stable ID`);
+		this.name = "UnsafeIdentifierError";
+	}
+};
+const assertStableId = (value, what) => {
+	if (!isStableId(value)) throw new UnsafeIdentifierError(what);
+};
+/**
+* The expression for one top-level scalar field of a head's `data`, e.g. `((data ->> '0b1c…')::numeric)`
+* on PostgreSQL. Throws for non-scalar types or a malformed field ID.
+*/
+const fieldValueExpression = (fieldId, type, dialect = contentDialect()) => {
+	assertStableId(fieldId, "a field ID");
+	if (!SCALAR_DATA_TYPES.has(type)) throw new Error(`${type} fields have no scalar expression`);
+	return dialect.fieldValue(fieldId, valueCastFor(type), NUMERIC_STRING_TYPES$1.has(type));
+};
+/**
+* Equality on a top-level field (lists: "contains"). PostgreSQL compares the field's index expression when
+* the field has one (`EqualityTarget.indexed`) and emits containment, which its GIN index serves, otherwise;
+* SQLite and MySQL compare the field's index expression.
+*/
+const fieldEqualsExpression = (target, value, dialect = contentDialect()) => {
+	assertStableId(target.fieldId, "a field ID");
+	return dialect.fieldEquals(target, value);
+};
+/** The field's value is missing: absent, null, "" or []. */
+const fieldMissingExpression = (fieldId, dialect = contentDialect()) => {
+	assertStableId(fieldId, "a field ID");
+	return dialect.fieldMissing(fieldId);
+};
+/** Case-sensitive text match on a top-level field; `text` is a parameter, never SQL. */
+const textMatchExpression = (fieldId, operator, text, dialect = contentDialect()) => {
+	assertStableId(fieldId, "a field ID");
+	return dialect.textMatch(fieldId, operator, text);
+};
+/** Case-insensitive contains on a top-level field (`$containsi`, search). */
+const containsInsensitiveExpression = (fieldId, text, dialect = contentDialect()) => {
+	assertStableId(fieldId, "a field ID");
+	return dialect.containsInsensitive(fieldId, text);
+};
+/**
+* The model ID as a SQL literal for `model_id = '…'`. Expression indexes are partial on the model, and
+* the planner can only prove a partial index's predicate against a literal, never a parameter.
+*/
+const modelIdLiteral = (modelId) => {
+	assertStableId(modelId, "a model ID");
+	return sql.lit(modelId);
+};
+/** A comparison value cast the way `fieldValueExpression` casts the stored value, so indexes match. */
+const castParameter = (value, type, dialect = contentDialect()) => dialect.castParameter(value, valueCastFor(type), NUMERIC_STRING_TYPES$1.has(type));
+//#endregion
+//#region ../../apps/api/src/content/compiler/operators.ts
+const familyOf = (field) => {
+	switch (field.type) {
+		case "string":
+		case "text":
+		case "slug":
+		case "email":
+		case "url":
+		case "uid": return "text";
+		case "enum": return field.settings.multiple ? "list" : "text";
+		case "date":
+		case "datetime":
+		case "time": return "temporal";
+		case "number":
+		case "integer": return "number";
+		case "decimal":
+		case "biginteger": return "numericString";
+		case "boolean": return "boolean";
+		case "relation":
+		case "media": return "reference";
+		default: return "none";
+	}
+};
+const EQUALITY = [
+	"$eq",
+	"$ne",
+	"$in",
+	"$nin",
+	"$null",
+	"$notNull"
+];
+const RANGE = [
+	"$lt",
+	"$lte",
+	"$gt",
+	"$gte"
+];
+const TEXT_MATCH = [
+	"$contains",
+	"$notContains",
+	"$containsi",
+	"$startsWith",
+	"$endsWith"
+];
+const OPERATORS_BY_FAMILY = {
+	text: [
+		...EQUALITY,
+		...RANGE,
+		...TEXT_MATCH
+	],
+	temporal: [...EQUALITY, ...RANGE],
+	number: [...EQUALITY, ...RANGE],
+	numericString: [...EQUALITY, ...RANGE],
+	boolean: [
+		"$eq",
+		"$ne",
+		"$null",
+		"$notNull"
+	],
+	list: EQUALITY,
+	reference: EQUALITY,
+	none: []
+};
+const isRangeOperator = (operator) => RANGE.includes(operator);
+const isTextMatchOperator = (operator) => TEXT_MATCH.includes(operator);
+const isListOperator = (operator) => operator === "$in" || operator === "$nin";
+const isNullOperator = (operator) => operator === "$null" || operator === "$notNull";
+/** Whether the field holds a list (equality means "contains"). */
+const isListValued = (field) => field.type === "enum" && field.settings.multiple || field.type === "relation" && field.settings.cardinality === "many" || field.type === "media" && field.settings.multiple;
+/** Types whose stored JSON string is not unique per value, so equality compares numerically. */
+const NUMERIC_STRING_TYPES = /* @__PURE__ */ new Set(["decimal", "biginteger"]);
+const SYSTEM_OPERATORS = {
+	id: [
+		"$eq",
+		"$ne",
+		"$in",
+		"$nin"
+	],
+	createdAt: [
+		"$eq",
+		"$ne",
+		"$in",
+		"$nin",
+		...RANGE
+	],
+	updatedAt: [
+		"$eq",
+		"$ne",
+		"$in",
+		"$nin",
+		...RANGE
+	]
+};
+/** Throws 400 unless the operator is allowed for the target. */
+const assertOperatorAllowed = (target, operator, label) => {
+	if (target.kind === "system") {
+		if (!(SYSTEM_OPERATORS[target.name] ?? []).includes(operator)) throw queryInvalid(`Operator ${operator} is not supported on "${label}"`);
+		return;
+	}
+	const { field } = target;
+	if (!OPERATORS_BY_FAMILY[familyOf(field)].includes(operator)) throw queryInvalid(`Operator ${operator} is not supported on "${label}" (${field.type})`);
+	if (isRangeOperator(operator) && !field.filterable && !field.sortable) throw queryInvalid(`"${label}" is not filterable: mark it filterable to use ${operator}`);
+	if (isTextMatchOperator(operator) && !field.filterable) throw queryInvalid(`"${label}" is not filterable: mark it filterable to use ${operator}`);
+};
+/** Whether a field can be sorted on: an expression index exists only for sortable/filterable scalars. */
+const isSortable = (field) => field.sortable && familyOf(field) !== "none" && familyOf(field) !== "list" && familyOf(field) !== "reference";
+const coerceBoolean = (raw, label) => {
+	if (raw === true || raw === "true") return true;
+	if (raw === false || raw === "false") return false;
+	throw queryInvalid(`"${label}" needs true or false`);
+};
+const coerceText = (raw, label) => {
+	if (typeof raw !== "string") throw queryInvalid(`"${label}" needs a single text value`);
+	return raw;
+};
+const coerceOrFail = (value, label, expected) => {
+	if (value === void 0) throw queryInvalid(`"${label}" needs ${expected}`);
+	return value;
+};
+/** One comparison value for a field, canonicalized like stored values. */
+const coerceFieldValue = (field, raw, label) => {
+	switch (familyOf(field)) {
+		case "number": {
+			const number = Number(coerceText(raw, label));
+			if (!Number.isFinite(number) || raw.trim() === "") throw queryInvalid(`"${label}" needs a number`);
+			return number;
+		}
+		case "numericString": return coerceOrFail(field.type === "decimal" ? canonicalDecimal(coerceText(raw, label)) : canonicalBigInteger(coerceText(raw, label)), label, "a number");
+		case "temporal": {
+			const text = coerceText(raw, label);
+			const canonical = field.type === "date" ? canonicalDate(text) : field.type === "datetime" ? canonicalDatetime(text) : canonicalTime(text);
+			return coerceOrFail(canonical, label, `a valid ${field.type}`);
+		}
+		case "boolean": return coerceBoolean(raw, label);
+		case "reference": {
+			const id = coerceText(raw, label);
+			if (!isStableId(id)) throw queryInvalid(`"${label}" needs an ID`);
+			return id;
+		}
+		default: return coerceText(raw, label);
+	}
+};
+const coerceSystemValue = (name, raw, label) => {
+	const text = coerceText(raw, label);
+	if (name === "id") {
+		if (!isStableId(text)) throw queryInvalid(`"${label}" needs an entry ID`);
+		return text;
+	}
+	return coerceOrFail(canonicalDatetime(text), label, "an ISO-8601 date-time with a time zone");
+};
+/** Turns the raw operand of `operator` into typed value(s); lists for `$in`/`$nin`, a boolean for `$null`. */
+const coerceOperand = (target, operator, raw, label, maxListLength) => {
+	if (isNullOperator(operator)) return coerceBoolean(raw, label);
+	const coerceOne = (value) => target.kind === "system" ? coerceSystemValue(target.name, value, label) : coerceFieldValue(target.field, value, label);
+	if (isListOperator(operator)) {
+		if (!Array.isArray(raw)) throw queryInvalid(`"${label}" ${operator} needs a list`);
+		if (raw.length > maxListLength) throw queryInvalid(`"${label}" ${operator} accepts at most ${maxListLength} values`);
+		return raw.map(coerceOne);
+	}
+	if (isTextMatchOperator(operator)) {
+		const text = coerceText(raw, label);
+		if (text.length === 0) throw queryInvalid(`"${label}" ${operator} needs a non-empty value`);
+		return text;
+	}
+	return coerceOne(raw);
+};
+//#endregion
+//#region ../../apps/api/src/content/compiler/compile.ts
+const RANGE_SQL = {
+	$lt: sql`<`,
+	$lte: sql`<=`,
+	$gt: sql`>`,
+	$gte: sql`>=`,
+	$eq: sql`=`,
+	$ne: sql`<>`
+};
+const anyOf = (parts) => parts.length === 0 ? sql`false` : sql`(${sql.join(parts, sql` or `)})`;
+const equalityTarget = ({ field }) => {
+	const cast = SCALAR_DATA_TYPES.has(field.type) ? valueCastFor(field.type) : null;
+	const list = isListValued(field);
+	return {
+		fieldId: field.id,
+		cast,
+		list,
+		numericString: NUMERIC_STRING_TYPES.has(field.type),
+		indexed: cast !== null && !list && hasFieldIndex(field)
+	};
+};
+/** System filter columns. `createdAt` is the entry's, copied on every head (`h.entry_created_at`). */
+const SYSTEM_COLUMNS = {
+	id: "h.entry_id",
+	createdAt: "h.entry_created_at",
+	updatedAt: "h.updated_at"
+};
+/** Whether a filter names a column of `entries` (the head query's `e`), so its COUNT must join entries. */
+const filterReadsEntries = (node) => {
+	switch (node.kind) {
+		case "and":
+		case "or": return node.nodes.some(filterReadsEntries);
+		case "not": return filterReadsEntries(node.node);
+		case "condition": return node.target.kind === "system" && SYSTEM_COLUMNS[node.target.name].startsWith("e.");
+	}
+};
+const systemCondition = (name, operator, value, dialect) => {
+	const column = sql.ref(SYSTEM_COLUMNS[name]);
+	const element = name === "id" ? "uuid" : "timestamp";
+	switch (operator) {
+		case "$in": return sql`(${dialect.oneOf(column, value, element)})`;
+		case "$nin": return sql`(not (${dialect.oneOf(column, value, element)}))`;
+		default: {
+			const parameter = name === "id" ? dialect.uuid(value) : dialect.timestamp(value);
+			return sql`(${column} ${RANGE_SQL[operator] ?? sql`=`} ${parameter})`;
+		}
+	}
+};
+const fieldCondition = (target, operator, value, dialect) => {
+	const { field } = target;
+	const equals = (item) => fieldEqualsExpression(equalityTarget(target), item, dialect);
+	switch (operator) {
+		case "$eq": return equals(value);
+		case "$ne": return sql`(not ${equals(value)})`;
+		case "$in": return anyOf(value.map(equals));
+		case "$nin": return sql`(not ${anyOf(value.map(equals))})`;
+		case "$null":
+		case "$notNull": {
+			const missing = fieldMissingExpression(field.id, dialect);
+			return operator === "$null" === value ? missing : sql`(not ${missing})`;
+		}
+		case "$lt":
+		case "$lte":
+		case "$gt":
+		case "$gte": return sql`(${fieldValueExpression(field.id, field.type, dialect)} ${RANGE_SQL[operator]} ${castParameter(value, field.type, dialect)})`;
+		case "$contains":
+		case "$startsWith":
+		case "$endsWith":
+		case "$notContains": return textMatchExpression(field.id, operator, value, dialect);
+		case "$containsi": return containsInsensitiveExpression(field.id, value, dialect);
+	}
+};
+/** A filter AST as one boolean SQL expression. */
+const compileFilter = (node, dialect = contentDialect()) => {
+	const compileChild = (child) => compileFilter(child, dialect);
+	switch (node.kind) {
+		case "and": return sql`(${sql.join(node.nodes.map(compileChild), sql` and `)})`;
+		case "or": return sql`(${sql.join(node.nodes.map(compileChild), sql` or `)})`;
+		case "not": return sql`(not ${compileChild(node.node)})`;
+		case "condition": return node.target.kind === "system" ? systemCondition(node.target.name, node.operator, node.value, dialect) : fieldCondition(node.target, node.operator, node.value, dialect);
+	}
+};
+/**
+* Admin list status of the served draft head `h`, against the published head of its locale (the same rule as
+* `statusOf`): no published head = draft; the same revision and no autosaved work = published; else modified.
+* Served by the entry_heads primary key.
+*/
+const compileStatusCondition = (status) => {
+	const published = sql`select 1 from entry_heads p
+    where p.entry_id = h.entry_id and p.locale = h.locale and p.state = 'published'`;
+	switch (status) {
+		case "draft": return sql`not exists (${published})`;
+		case "published": return sql`(h.autosaved_at is null and exists (${published} and p.revision_id = h.revision_id))`;
+		case "modified": return sql`exists (${published} and (p.revision_id <> h.revision_id or h.autosaved_at is not null))`;
+	}
+};
+/** Entries an admin user created (admin list `?author=`). */
+const compileAuthorCondition = (adminUserId, dialect = contentDialect()) => sql`e.created_by_admin_id = ${dialect.uuid(adminUserId)}`;
+/** Case-insensitive search of one text field. */
+const compileSearch = (fieldId, text, dialect = contentDialect()) => containsInsensitiveExpression(fieldId, text, dialect);
+const SNAPSHOT_CTE = "content_snapshot";
+/** The FROM item for a source, aliased `alias`, and the CTE it needs (snapshots only). */
+const sourceOf$1 = (source, modelId, siteId, dialect) => {
+	if (source.kind === "heads") return {
+		cte: null,
+		table: sql.table("entry_heads")
+	};
+	return {
+		cte: dialect.snapshotCte({
+			name: SNAPSHOT_CTE,
+			siteId,
+			modelId: modelIdLiteral(modelId),
+			seq: source.seq
+		}),
+		table: sql.id(SNAPSHOT_CTE)
+	};
+};
+const localeConditions = (scope, table, source, dialect) => {
+	if (scope.kind === "any") return [];
+	if (scope.chain.length === 1) return [sql`h.locale = ${scope.chain[0]}`];
+	const chain = [...scope.chain];
+	const stateMatch = source.kind === "heads" ? sql` and h2.state = h.state` : sql``;
+	return [dialect.oneOf(sql`h.locale`, chain, "text"), sql`not exists (select 1 from ${table} h2 where h2.entry_id = h.entry_id${stateMatch}
+      and ${dialect.oneOf(sql`h2.locale`, chain, "text")}
+      and ${dialect.localeRank(chain, sql`h2.locale`)} < ${dialect.localeRank(chain, sql`h.locale`)})`];
+};
+const whereOf = (plan, table, dialect) => {
+	const conditions = [
+		sql`h.site_id = ${dialect.uuid(plan.siteId)}`,
+		sql`h.model_id = ${modelIdLiteral(plan.modelId)}`,
+		...plan.source.kind === "heads" ? [sql`h.state = ${plan.source.state}`] : [],
+		...localeConditions(plan.locales, table, plan.source, dialect),
+		...plan.conditions
+	];
+	return sql.join(conditions, sql` and `);
+};
+/**
+* The COUNT's FROM. Live heads exist only for live entries (deleting an entry removes its heads in the same
+* transaction; entries soft-deleted for having no head have none; `headLiveEntry.int.test.ts` pins it), so a
+* count of heads whose conditions name no `e` column needs no join: it is read from the heads' indexes alone
+* (the model index, or a field index for an indexed filter). A snapshot keeps the join: the publication log
+* still lists entries deleted since.
+*/
+const countFrom = (plan, table, where, joined) => plan.source.kind === "heads" && !(plan.conditionsReadEntries ?? plan.conditions.length > 0) ? sql`from ${table} h where ${where}` : joined;
+const HEAD_COLUMNS = sql`h.entry_id, h.locale, h.data, h.version, h.revision_id, h.updated_at,
+      h.autosaved_at, e.created_at, e.updated_at as entry_updated_at, e.created_by_admin_id, e.owner_app_user_id`;
+/** The parts every statement over a plan's heads shares. */
+const headQueryParts = (plan, dialect) => {
+	const { cte, table } = sourceOf$1(plan.source, plan.modelId, plan.siteId, dialect);
+	const where = whereOf(plan, table, dialect);
+	const from = sql`from ${table} h join entries e on e.id = h.entry_id and e.deleted_at is null where ${where}`;
+	const orderBy = plan.orderBy.length > 0 ? sql` order by ${sql.join([...plan.orderBy])}` : sql``;
+	const limit = plan.limit !== void 0 ? sql` limit ${plan.limit}` : sql``;
+	const offset = plan.offset ? sql` offset ${plan.offset}` : sql``;
+	return {
+		prefix: cte ?? sql``,
+		rows: sql`${from}${orderBy}${limit}${offset}`,
+		countFrom: countFrom(plan, table, where, from)
+	};
+};
+/** The SELECT for a plan: rows, plus the matching COUNT for pagination. */
+const compileHeadQuery = (plan, dialect = contentDialect()) => {
+	const { prefix, rows, countFrom: counted } = headQueryParts(plan, dialect);
+	return {
+		rows: sql`${prefix}select ${HEAD_COLUMNS}
+      ${rows}`,
+		count: sql`${prefix}select count(*) as total ${counted}`
+	};
+};
+/**
+* One delivery read as a single statement (plan delivery-perf): the page's heads with, on every row, the
+* matching total and the site's current publication sequence (`publication_state.last_seq`), so all three
+* come from one snapshot of the database on every dialect without a transaction. The uncorrelated
+* subqueries run once per statement. An empty page carries no row, so `meta` reads the total and the
+* sequence alone, for callers that read it in the same transaction as `rows`.
+*/
+const compileHeadPage = (plan, options, dialect = contentDialect()) => {
+	const { prefix, rows, countFrom: counted } = headQueryParts(plan, dialect);
+	const total = options.total ? sql`(select count(*) ${counted})` : sql`null`;
+	const seq = sql`(select ps.last_seq from publication_state ps where ps.site_id = ${dialect.uuid(plan.siteId)})`;
+	return {
+		rows: sql`${prefix}select ${HEAD_COLUMNS}, ${total} as page_total, ${seq} as page_seq
+      ${rows}`,
+		meta: sql`${prefix}select ${total} as page_total, ${seq} as page_seq`
+	};
+};
+//#endregion
+//#region ../../apps/api/src/content/compiler/conditions.ts
+/**
+* Conditions on the head query's entry (alias `h`, compile.ts) for `HeadQueryPlan.conditions`, so callers
+* outside the compiler never write SQL against its aliases.
+*/
+/** The head belongs to entry `id`. */
+const entryIdIs = (id, dialect = contentDialect()) => sql`h.entry_id = ${dialect.uuid(id)}`;
+/** The head belongs to one of `ids` (one bound parameter, whatever its length). */
+const entryIdIn = (ids, dialect = contentDialect()) => dialect.oneOf(sql`h.entry_id`, ids, "uuid");
+//#endregion
+//#region ../../apps/api/src/content/compiler/sort.ts
+/**
+* ORDER BY for a content query. Field sorts use the same expression as the field's index (so the index can
+* serve them); the entry ID is always the final tie-breaker so pages are stable. Without an explicit sort
+* the model's default sort applies when the caller may read that field, else newest first. `createdAt` is the
+* entry's creation time copied on the head (`h.entry_created_at`), so the default order and its tie-breaker
+* are both head columns, which `entry_heads_entry_order_idx` (site, model, state, `entry_created_at desc`,
+* `entry_id`) serves: a page is read in index order and the scan stops at the limit (ADR 0001, "Delivery perf
+* 2").
+*/
+const SYSTEM_SORT_COLUMNS = {
+	id: "h.entry_id",
+	createdAt: "h.entry_created_at",
+	updatedAt: "h.updated_at"
+};
+const termSql = (term, dialect) => {
+	const nullable = term.target.kind === "field";
+	const expression = term.target.kind === "system" ? sql.ref(SYSTEM_SORT_COLUMNS[term.target.name]) : fieldValueExpression(term.target.field.id, term.target.field.type, dialect);
+	if (dialect.sortTerm) return dialect.sortTerm(expression, term.direction, nullable);
+	return sql`${expression} ${dialect.sortDirection(term.direction, nullable)}`;
+};
+const defaultSortTerms = (model, isReadable) => {
+	const preferred = model.display.defaultSort;
+	const field = preferred ? model.fields.find((candidate) => candidate.id === preferred.fieldId) : void 0;
+	if (preferred && field && !field.deprecated && isSortable(field) && isReadable(field)) return [{
+		target: {
+			kind: "field",
+			field
+		},
+		direction: preferred.direction
+	}];
+	return [{
+		target: {
+			kind: "system",
+			name: "createdAt"
+		},
+		direction: "desc"
+	}];
+};
+const compileOrderBy = (terms, dialect = contentDialect()) => [...terms.map((term) => termSql(term, dialect)), sql`h.entry_id asc`];
+//#endregion
+//#region ../../apps/api/src/content/locales.ts
+/**
+* Localization rules (ADR 0004). Every locale's head holds the complete document; shared (non-localized)
+* fields are fanned out to every existing draft of the entry when saved; publishing is strictly per locale.
+*/
+/** The locale itself, then its configured fallbacks, then the default locale (always last). */
+const fallbackChain = (snapshot, locale) => {
+	const chain = [
+		locale,
+		...snapshot.locales.find((candidate) => candidate.code === locale)?.fallbacks ?? [],
+		snapshot.defaultLocale
+	];
+	return chain.filter((code, index) => chain.indexOf(code) === index && snapshot.locales.some((l) => l.code === code));
+};
+/**
+* Which heads serve a read. Non-localized models keep their heads in whichever locale they were created in,
+* so they are read regardless of locale; localized models serve the requested locale or fall back.
+*/
+const readScopeFor = (snapshot, model, requested, { fallback }) => {
+	if (!model.localized) return { kind: "any" };
+	const locale = requested ?? snapshot.defaultLocale;
+	return {
+		kind: "chain",
+		chain: fallback ? fallbackChain(snapshot, locale) : [locale]
+	};
+};
+//#endregion
+//#region ../../apps/api/src/db/index.ts
+const warnIdleConnectionError = (error) => process.emitWarning(`PostgreSQL connection lost while idle: ${error.message}`);
+/**
+* The pg pool as Kysely sees it: an exhausted pool's queue timeout becomes `PoolAcquireTimeoutError`, a
+* connection that cannot be opened in time `DatabaseUnavailableError`, and in strict mode a nested
+* acquisition fails at once.
+*/
+const acquiringPool = (pool, poolMax, acquireTimeoutMs, strict) => ({
+	options: pool.options,
+	connect: async () => {
+		if (strict) assertNotNested();
+		try {
+			return await pool.connect();
+		} catch (error) {
+			throw pgAcquireError(error, poolMax, acquireTimeoutMs);
+		}
+	},
+	end: () => pool.end()
+});
+/** Kysely on PostgreSQL in strict mode: transactions run in a connection scope (`db/connectionScope.ts`). */
+var StrictPostgresKysely = class extends Kysely {
+	transaction() {
+		return withConnectionScope(super.transaction());
+	}
+};
+const warnIdleMysqlConnectionError = (error) => process.emitWarning(`MySQL connection lost while idle: ${error.message}`);
+/**
+* The database handle for DATABASE_URL: PostgreSQL through a `pg` pool, MySQL (`mysql://…`) through a
+* `mysql2` pool, or SQLite (`sqlite:<path>`) through Shapio's `node:sqlite` driver, where `poolMax` is the
+* number of read connections (one connection writes).
+* Sets the process dialect (`db/dialect.ts`) that SQL builders read.
+*/
+const createDb = ({ connectionString, poolMax, acquireTimeoutMs = DEFAULT_POOL_ACQUIRE_TIMEOUT_MS, applicationName = "shapio", onIdleConnectionError, strict = false }) => {
+	if (dialectOfUrl(connectionString) === "sqlite") {
+		setCurrentDialect("sqlite");
+		return createSqliteDb({
+			location: sqliteLocationOfUrl(connectionString),
+			readers: poolMax,
+			strict
+		});
+	}
+	if (dialectOfUrl(connectionString) === "mysql") {
+		setCurrentDialect("mysql");
+		return createMysqlDb({
+			url: connectionString,
+			poolMax,
+			acquireTimeoutMs,
+			applicationName,
+			onIdleConnectionError: onIdleConnectionError ?? warnIdleMysqlConnectionError,
+			strict
+		});
+	}
+	setCurrentDialect("postgres");
+	const pool = new pg.Pool({
+		connectionString,
+		max: poolMax,
+		connectionTimeoutMillis: acquireTimeoutMs,
+		application_name: applicationName
+	});
+	pool.on("error", onIdleConnectionError ?? warnIdleConnectionError);
+	pool.on("connect", (client) => {
+		client.on("error", () => void 0);
+	});
+	const dialect = new PostgresDialect({
+		pool: acquiringPool(pool, poolMax, acquireTimeoutMs, strict),
+		controlClient: pg.Client
+	});
+	return strict ? new StrictPostgresKysely({ dialect }) : new Kysely({ dialect });
+};
+/**
+* The process-wide database handle used as the default executor by repositories.
+* `buildApp` sets it; tests and child processes each run in their own process, so one handle per process holds.
+*/
+let db = void 0;
+const setDb = (instance) => {
+	db = instance;
+};
+/** Whether this process has its database handle yet (a server in the same process set it first). */
+const hasDb = () => db !== void 0;
+/** Unsets the process handle if it is `instance` (its owner is closing it); leaves any other handle alone. */
+const clearDb = (instance) => {
+	if (db === instance) db = void 0;
+};
+//#endregion
+//#region ../../apps/api/src/repositories/contentQueries.ts
+/**
+* Executes head queries compiled by `content/compiler` (the only place content SQL is written). Kept as a
+* repository so services never run SQL themselves.
+*/
+const runHeadQuery = async (query, executor = db) => (await query.execute(executor)).rows;
+const toPageMeta = (row) => ({
+	total: row.page_total === null ? null : Number(row.page_total),
+	seq: row.page_seq === null ? null : Number(row.page_seq)
+});
+/**
+* Runs a head page compiled by `compileHeadPage`: the rows, and the total and sequence carried on them (null
+* when the page is empty; then `runHeadPageMeta` in the same transaction reads them).
+*/
+const runHeadPage = async (query, executor = db) => {
+	const result = (await query.execute(executor)).rows;
+	const [first] = result;
+	return {
+		rows: result.map(({ page_total: _total, page_seq: _seq, ...row }) => row),
+		meta: first ? toPageMeta(first) : null
+	};
+};
+const runHeadPageMeta = async (query, executor = db) => {
+	const [row] = (await query.execute(executor)).rows;
+	return row ? toPageMeta(row) : {
+		total: null,
+		seq: null
+	};
+};
+/** Runs `fn` in one REPEATABLE READ, read-only transaction: a response reads one consistent moment. */
+const withConsistentRead = (fn, database = db) => database.transaction().setIsolationLevel("repeatable read").setAccessMode("read only").execute(fn);
+//#endregion
+//#region ../../apps/api/src/repositories/mediaAssets.ts
+const live = (trx) => trx.selectFrom("media_assets").where("deleted_at", "is", null);
+/** The live assets of one site among `ids`. */
+const findLiveManyOnSite = (siteId, ids, trx = db) => ids.length === 0 ? Promise.resolve([]) : live(trx).selectAll().where("site_id", "=", siteId).where("id", "in", ids).execute();
+//#endregion
+//#region ../../apps/api/src/constants/media.ts
+/** Media library limits and timings (package G). Upload size and allowed types are configuration. */
+/** Shapio's route for stored objects: public ones at a stable URL, private ones with a signature. */
+const MEDIA_FILE_ROUTE_PREFIX = "/api/media/f/";
+/** How long a signed URL for a private asset works. */
+const MEDIA_SIGNED_URL_TTL_SECONDS = 3600;
+//#endregion
+//#region ../../apps/api/src/media/urls.ts
+/**
+* The URL a client should use for a stored object. Public: the CDN/bucket base when configured, otherwise
+* Shapio's stable route. Private: always an expiring signed URL; nothing else reaches private bytes.
+*/
+const resolveObjectUrl = async (storage, urls, object, ttlSeconds = MEDIA_SIGNED_URL_TTL_SECONDS) => {
+	const adapter = storage.get(object.driver);
+	if (object.visibility === "public") return {
+		url: adapter.publicUrl(object.key) ?? urls.absoluteUrl(`/api/media/f/${encodeKeyPath(object.key)}`),
+		expiresAt: null
+	};
+	return {
+		url: await adapter.signedGetUrl(object.key, {
+			expiresInSeconds: ttlSeconds,
+			filename: object.filename,
+			contentType: object.mimeType
+		}),
+		expiresAt: new Date(Date.now() + ttlSeconds * 1e3)
+	};
+};
+//#endregion
+//#region ../../apps/api/src/repositories/mediaVariants.ts
+const listForAssets = (assetIds, trx = db) => assetIds.length === 0 ? Promise.resolve([]) : trx.selectFrom("media_variants").selectAll().where("asset_id", "in", assetIds).orderBy("asset_id").orderBy("width").execute();
+//#endregion
+//#region ../../apps/api/src/services/mediaViews.ts
+const toVariantView = async (deps, asset, variant) => ({
+	name: variant.name,
+	width: variant.width,
+	height: variant.height,
+	format: variant.format,
+	mimeType: variant.mime_type,
+	sizeBytes: variant.size_bytes === null ? null : Number(variant.size_bytes),
+	status: variant.status,
+	url: variant.status === "ready" && variant.storage_key ? (await resolveObjectUrl(deps.storage, deps.urls, {
+		driver: asset.storage_driver,
+		key: variant.storage_key,
+		visibility: asset.visibility,
+		filename: asset.original_filename,
+		mimeType: variant.mime_type
+	})).url : null
+});
+const toAssetView = async (deps, asset, variants) => {
+	const { url, expiresAt } = await resolveObjectUrl(deps.storage, deps.urls, {
+		driver: asset.storage_driver,
+		key: asset.storage_key,
+		visibility: asset.visibility,
+		filename: asset.original_filename,
+		mimeType: asset.mime_type
+	});
+	return {
+		id: asset.id,
+		folderId: asset.folder_id,
+		filename: asset.original_filename,
+		mimeType: asset.mime_type,
+		sizeBytes: Number(asset.size_bytes),
+		width: asset.width,
+		height: asset.height,
+		checksumSha256: asset.checksum_sha256,
+		alt: asset.alt,
+		caption: asset.caption,
+		focalPoint: asset.focal_x !== null && asset.focal_y !== null ? {
+			x: asset.focal_x,
+			y: asset.focal_y
+		} : null,
+		visibility: asset.visibility,
+		status: asset.status,
+		processingError: asset.processing_error,
+		storageDriver: asset.storage_driver,
+		url,
+		urlExpiresAt: expiresAt,
+		variants: await Promise.all(variants.map((variant) => toVariantView(deps, asset, variant))),
+		createdBy: asset.created_by,
+		createdAt: asset.created_at,
+		updatedAt: asset.updated_at,
+		version: asset.version
+	};
+};
+/**
+* API views of assets with their variants (one query for all variants) and URLs: stable for public
+* assets, signed and expiring for private ones. Package E can use this to resolve media fields.
+* `executor`: the caller's open transaction, when there is one.
+*/
+const toAssetViews = async (deps, assets, executor) => {
+	const variants = await listForAssets(assets.map((asset) => asset.id), executor);
+	const byAsset = Map.groupBy(variants, (variant) => variant.asset_id);
+	return Promise.all(assets.map((asset) => toAssetView(deps, asset, byAsset.get(asset.id) ?? [])));
+};
+//#endregion
+//#region ../../apps/api/src/content/compiler/populate.ts
+const idsOf = (rows, fieldId) => {
+	const ids = /* @__PURE__ */ new Set();
+	for (const row of rows) {
+		const value = row.data[fieldId];
+		for (const id of Array.isArray(value) ? value : [value]) if (typeof id === "string") ids.add(id);
+	}
+	return [...ids];
+};
+/** relation field ID → target entry ID → projected target entry. */
+const populateRelations = async (env, rows, fields, tree) => {
+	const populated = /* @__PURE__ */ new Map();
+	for (const [fieldId, subtree] of tree) {
+		const field = fields.find((candidate) => candidate.id === fieldId);
+		if (!field || field.type !== "relation") continue;
+		const byId = /* @__PURE__ */ new Map();
+		populated.set(fieldId, byId);
+		const target = resolveModelById(env.snapshot, field.settings.target);
+		if (!target) continue;
+		const policy = await env.policyFor(env, target.definition.id);
+		const targetRows = await env.fetch(env, target, policy, idsOf(rows, fieldId));
+		for (const { row, data } of await env.project(env, target, policy, targetRows, {
+			fields: null,
+			populate: subtree
+		})) byId.set(row.entry_id, {
+			...env.system(env, row),
+			...data
+		});
+	}
+	return populated;
+};
+//#endregion
+//#region ../../apps/api/src/content/media.ts
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const collect = (model, fields, data, add) => {
+	for (const field of fields) {
+		const value = data[field.id];
+		if (value === void 0 || value === null) continue;
+		switch (field.type) {
+			case "media":
+				(Array.isArray(value) ? value : [value]).forEach((id) => typeof id === "string" && add(id));
+				break;
+			case "richtext":
+				if (isRecord$1(value) && isRecord$1(value.doc)) richTextMediaIds(value).forEach(add);
+				break;
+			case "component": {
+				const component = model.components.get(field.settings.component)?.definition;
+				for (const item of Array.isArray(value) ? value : [value]) if (component && isRecord$1(item)) collect(model, component.fields, item, add);
+				break;
+			}
+			case "dynamiczone": for (const item of Array.isArray(value) ? value : []) {
+				const component = isRecord$1(item) ? model.components.get(String(item[COMPONENT_KEY]))?.definition : void 0;
+				if (component && isRecord$1(item)) collect(model, component.fields, item, add);
+			}
+		}
+	}
+};
+/** Asset IDs used by the given top-level fields of the documents. */
+const mediaIdsOf = (model, documents, fields) => {
+	const ids = /* @__PURE__ */ new Set();
+	for (const data of documents) collect(model, fields, data, (id) => ids.add(id));
+	return ids;
+};
+//#endregion
+//#region ../../apps/api/src/content/relations.ts
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const referenceIds = (value) => (Array.isArray(value) ? value : [value]).filter((item) => typeof item === "string");
+const walkFields = (fields, data, components, visit) => {
+	for (const field of fields) {
+		const value = data[field.id];
+		if (value === void 0 || value === null) continue;
+		if (field.type === "relation") visit({
+			field,
+			entryIds: referenceIds(value)
+		});
+		else if (field.type === "component") {
+			const component = components.get(field.settings.component)?.definition;
+			for (const item of Array.isArray(value) ? value : [value]) if (component && isRecord(item)) walkFields(component.fields, item, components, visit);
+		} else if (field.type === "dynamiczone" && Array.isArray(value)) for (const item of value) {
+			const component = isRecord(item) ? components.get(String(item[COMPONENT_KEY]))?.definition : void 0;
+			if (component && isRecord(item)) walkFields(component.fields, item, components, visit);
+		}
+	}
+};
+/** Calls `visit` for every relation value in a document, in document order. */
+const walkRelations = (model, data, visit, topLevelFields = model.definition.fields) => walkFields(topLevelFields, data, model.components, visit);
+/** Every target a set of documents mentions, grouped by target model. */
+const targetsByModel = (model, documents, topLevelFields) => {
+	const targets = /* @__PURE__ */ new Map();
+	for (const data of documents) walkRelations(model, data, ({ field, entryIds }) => {
+		const set = targets.get(field.settings.target) ?? /* @__PURE__ */ new Set();
+		entryIds.forEach((id) => set.add(id));
+		targets.set(field.settings.target, set);
+	}, topLevelFields);
+	return targets;
+};
+//#endregion
+//#region ../../apps/api/src/content/seo.ts
+const EXPECTED_TYPES = {
+	title: /* @__PURE__ */ new Set(["string", "text"]),
+	description: /* @__PURE__ */ new Set(["text", "string"]),
+	image: /* @__PURE__ */ new Set(["media"]),
+	canonical: /* @__PURE__ */ new Set(["url", "string"]),
+	noindex: /* @__PURE__ */ new Set(["boolean"])
+};
+const keysOf = (model) => {
+	const component = model.components.get(SEO_COMPONENT_ID)?.definition;
+	const keys = {};
+	for (const [key, id] of Object.entries(SEO_FIELD_IDS)) {
+		const field = component?.fields.find((candidate) => candidate.id === id && !candidate.deprecated);
+		const single = field?.type !== "media" || !field.settings.multiple;
+		if (field && single && EXPECTED_TYPES[key].has(field.type)) keys[key] = field.apiKey;
+	}
+	return keys;
+};
+/** The entry's own title, only when the caller may read the title field (never a hidden value). */
+const fallbackTitleOf = (model, policy, row) => {
+	const field = effectiveTitleField(model.definition);
+	if (!field || !maskAllows(policy.readMask, field)) return null;
+	const value = row.data[field.id];
+	return typeof value === "string" ? value : null;
+};
+/** The locale whose defaults apply: the head's for localized models, the requested one otherwise. */
+const defaultsLocaleOf = (env, model, row) => model.definition.localized ? row.locale : env.locale ?? env.snapshot.defaultLocale;
+/** Whether the selected fields include an SEO field (only those are resolved). */
+const seoFieldsOf = (fields) => fields.filter(isSeoField);
+/** Replaces each SEO field's projected value with its resolved value. */
+const resolveSeoFields = (env, options, model, policy, fields, row, data) => {
+	const seoFields = seoFieldsOf(fields);
+	if (seoFields.length === 0) return data;
+	const keys = keysOf(model);
+	const context = {
+		defaults: seoDefaultsForLocale(options.defaults, fallbackChain(env.snapshot, defaultsLocaleOf(env, model, row))),
+		image: options.image,
+		fallbackTitle: fallbackTitleOf(model, policy, row),
+		keys
+	};
+	const output = { ...data };
+	for (const field of seoFields) output[field.apiKey] = resolveSeo(data[field.apiKey], context);
+	return output;
+};
+//#endregion
+//#region ../../apps/api/src/content/read.ts
+/** Evaluated through the read's executor: a read inside a transaction never asks the pool for a second connection. */
+const readPolicy = (env, modelId) => env.permissions.evaluate(env.actor, {
+	action: "read",
+	modelId
+}, env.executor);
+/**
+* Heads of the given entries that the policy lets the caller read, served per the locale chain (or per
+* `locales` when given: GraphQL's `fallback: false` and `localizations`).
+*/
+const fetchHeadsByIds = async (env, model, policy, ids, locales) => {
+	if (ids.length === 0 || !policy.allowed) return [];
+	const rowFilter = compileRowFilter(policy.rowFilter, env.actor);
+	const { rows } = compileHeadQuery({
+		siteId: env.siteId,
+		modelId: model.definition.id,
+		source: env.source,
+		locales: locales ?? readScopeFor(env.snapshot, model.definition, env.locale, { fallback: true }),
+		conditions: [entryIdIn(ids), ...rowFilter ? [rowFilter] : []],
+		orderBy: []
+	});
+	return runHeadQuery(rows, env.executor);
+};
+/**
+* Relation targets the caller may see in these rows: for delivery, only targets that are published (at the
+* same snapshot) and readable under their model's policy, so a published entry never leaks the ID of a
+* draft (brief §10). Admin reads see every ID (null). The heads read are returned for populate.
+*/
+const relationTargets = async (env, model, rows, fields) => {
+	const fetched = /* @__PURE__ */ new Map();
+	if (env.audience === "admin") return {
+		visible: null,
+		fetched
+	};
+	const visible = /* @__PURE__ */ new Set();
+	const targets = targetsByModel(model, rows.map((row) => row.data), fields);
+	for (const [targetModelId, ids] of targets) {
+		const target = resolveModelById(env.snapshot, targetModelId);
+		if (!target) continue;
+		const policy = await readPolicy(env, targetModelId);
+		const found = await fetchHeadsByIds(env, target, policy, [...ids]);
+		found.forEach((row) => visible.add(row.entry_id));
+		fetched.set(targetModelId, {
+			ids,
+			rows: found
+		});
+	}
+	return {
+		visible,
+		fetched
+	};
+};
+/**
+* `fetchHeadsByIds` for populate, answered from the heads relation visibility already read when it asked for
+* every one of these IDs under the same policy and locale scope (populate's default), else from the database.
+*/
+const fetchReusing = (fetched) => async (env, model, policy, ids) => {
+	const known = fetched.get(model.definition.id);
+	if (known && ids.every((id) => known.ids.has(id))) {
+		const wanted = new Set(ids);
+		return known.rows.filter((row) => wanted.has(row.entry_id));
+	}
+	return fetchHeadsByIds(env, model, policy, ids);
+};
+/**
+* Whether projecting these rows reads anything more (relation targets, populated entries, asset views). When
+* not, a delivery read is complete in the one statement that fetched the rows (plan delivery-perf).
+*/
+const needsFollowUpReads = (env, model, rows, query, policy) => {
+	if (query.populate.size > 0) return true;
+	const fields = selectFields(model, policy.readMask, query.fields);
+	const documents = rows.map((row) => row.data);
+	return env.audience === "delivery" && targetsByModel(model, documents, fields).size > 0 || needsMediaReads(env, model, rows, fields);
+};
+/** Whether projecting these rows reads asset views (media fields, rich-text images, a default SEO image). */
+const needsMediaReads = (env, model, rows, fields) => env.media !== void 0 && (mediaIdsOf(model, rows.map((row) => row.data), fields).size > 0 || seoImageIdOf(env, fields) !== void 0);
+/** The site's default social image a `?seo=resolved` read needs (when the response carries an SEO field). */
+const seoImageIdOf = (env, fields) => env.seo?.imageId && seoFieldsOf(fields).length > 0 ? env.seo.imageId : void 0;
+/** A default SEO image is shown only while it is a public image (never through a signed URL). */
+const isPublicImage = (view) => view.visibility === "public" && view.mimeType.startsWith("image/");
+/**
+* Asset views for the media a response shows (media fields and rich-text images). Private assets get signed,
+* expiring URLs (package G); the read mask already decided whether the caller may see the field at all.
+* Delivery views carry only what a site needs, never storage keys or internal attribution.
+*/
+const loadMediaViews = async (env, model, rows, fields) => {
+	if (!env.media) return {
+		byId: null,
+		seoImage: null
+	};
+	const ids = mediaIdsOf(model, rows.map((row) => row.data), fields);
+	const seoImageId = seoImageIdOf(env, fields);
+	if (seoImageId !== void 0) ids.add(seoImageId);
+	if (ids.size === 0) return {
+		byId: /* @__PURE__ */ new Map(),
+		seoImage: null
+	};
+	const assets = await findLiveManyOnSite(env.siteId, [...ids], env.executor);
+	const views = await toAssetViews(env.media, assets, env.executor);
+	const shaped = (view) => env.audience === "delivery" ? toDeliveryAsset(view) : view;
+	const seoImage = views.find((view) => view.id === seoImageId && isPublicImage(view));
+	return {
+		byId: new Map(views.map((view) => [view.id, shaped(view)])),
+		seoImage: seoImage ? shaped(seoImage) : null
+	};
+};
+/** An asset as delivery shows it: what a site needs, never storage keys or internal attribution. */
+const toDeliveryAsset = (view) => ({
+	id: view.id,
+	filename: view.filename,
+	mimeType: view.mimeType,
+	sizeBytes: view.sizeBytes,
+	width: view.width,
+	height: view.height,
+	alt: view.alt,
+	caption: view.caption,
+	focalPoint: view.focalPoint,
+	url: view.url,
+	urlExpiresAt: view.urlExpiresAt?.toISOString() ?? null,
+	variants: view.variants.filter((variant) => variant.url !== null).map(({ name, width, height, format, mimeType, url }) => ({
+		name,
+		width,
+		height,
+		format,
+		mimeType,
+		url
+	}))
+});
+/** System attributes first, then the readable, selected fields by API key. */
+const systemAttributes = (env, row) => ({
+	id: row.entry_id,
+	locale: row.locale,
+	createdAt: row.created_at.toISOString(),
+	updatedAt: row.updated_at.toISOString(),
+	...env.audience === "delivery" ? { publishedAt: row.updated_at.toISOString() } : {}
+});
+const projectRows = async (env, model, policy, rows, query) => {
+	const fields = selectFields(model, policy.readMask, query.fields);
+	const { visible: visibleTargets, fetched } = await relationTargets(env, model, rows, fields);
+	const populateEnv = {
+		...env,
+		project: projectRows,
+		fetch: fetchReusing(fetched),
+		policyFor: readPolicy,
+		system: systemAttributes
+	};
+	const populated = await populateRelations(populateEnv, rows, fields, query.populate);
+	const media = await loadMediaViews(env, model, rows, fields);
+	return rows.map((row) => {
+		const data = projectData(row.data, {
+			model,
+			fields,
+			visibleTargets,
+			populated,
+			...env.audience === "delivery" ? { richText: env.richText ?? "json" } : {},
+			mediaAssets: media.byId
+		});
+		return {
+			row,
+			data: env.seo ? resolveSeoFields(env, {
+				defaults: env.seo,
+				image: media.seoImage
+			}, model, policy, fields, row, data) : data
+		};
+	});
+};
+//#endregion
+//#region ../../apps/api/src/content/compiler/querystring.ts
+const SEGMENT = /^\[([^[\]]*)\]/;
+const MAX_DEPTH = 10;
+const MAX_KEY_LENGTH = 300;
+const splitKey = (key) => {
+	const open = key.indexOf("[");
+	if (open === -1) return [key];
+	const segments = [key.slice(0, open)];
+	let rest = key.slice(open);
+	while (rest.length > 0) {
+		const match = SEGMENT.exec(rest);
+		if (!match) throw queryInvalid(`Malformed query parameter "${key}"`);
+		segments.push(match[1]);
+		rest = rest.slice(match[0].length);
+	}
+	return segments;
+};
+const isTree$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const assign = (tree, segments, value, key) => {
+	let node = tree;
+	segments.forEach((segment, index) => {
+		if (segment === "" || segment === "__proto__" || segment === "constructor" || segment === "prototype") throw queryInvalid(`Malformed query parameter "${key}"`);
+		const last = index === segments.length - 1;
+		const existing = Object.hasOwn(node, segment) ? node[segment] : void 0;
+		if (last) {
+			if (existing === void 0) node[segment] = value;
+			else if (typeof existing === "string") node[segment] = [existing, value];
+			else if (Array.isArray(existing)) existing.push(value);
+			else throw queryInvalid(`Query parameter "${key}" conflicts with another parameter`);
+			return;
+		}
+		if (existing === void 0) {
+			const child = Object.create(null);
+			node[segment] = child;
+			node = child;
+		} else if (isTree$1(existing)) node = existing;
+		else throw queryInvalid(`Query parameter "${key}" conflicts with another parameter`);
+	});
+};
+const parseQueryTree = (search) => {
+	const params = new URLSearchParams(search.startsWith("?") ? search.slice(1) : search);
+	const tree = Object.create(null);
+	let count = 0;
+	for (const [key, value] of params) {
+		count += 1;
+		if (count > QUERY_LIMITS.maxParameters) throw queryInvalid(`At most ${QUERY_LIMITS.maxParameters} query parameters are allowed`);
+		if (key.length > MAX_KEY_LENGTH || value.length > QUERY_LIMITS.maxValueLength) throw queryInvalid("A query parameter is too long");
+		const segments = splitKey(key);
+		if (segments.length > MAX_DEPTH) throw queryInvalid(`Query parameter "${key}" is nested too deeply`);
+		assign(tree, segments, value, key);
+	}
+	return tree;
+};
+/** A list value: repeated parameters, `a,b` comma lists, or `[0]`, `[1]`… keys. */
+const toList = (value, { commas = true } = {}) => {
+	if (value === void 0) return [];
+	if (Array.isArray(value)) return value;
+	if (typeof value === "string") return commas ? value.split(",").filter((item) => item.length > 0) : [value];
+	const keys = Object.keys(value);
+	if (!keys.every((key) => /^\d+$/.test(key))) throw queryInvalid("Expected a list");
+	return keys.sort((a, b) => Number(a) - Number(b)).map((key) => value[key]);
+};
+//#endregion
+//#region ../../apps/api/src/content/compiler/parse.ts
+const TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
+	"filters",
+	"sort",
+	"page",
+	"pageSize",
+	"fields",
+	"populate",
+	"locale",
+	"snapshot",
+	"richText",
+	"seo",
+	"q",
+	"status",
+	"author"
+]);
+const OPERATOR_SET = new Set(FILTER_OPERATORS);
+const isTree = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const single = (value, name) => {
+	if (value === void 0) return;
+	if (typeof value !== "string") throw queryInvalid(`"${name}" must be given once`);
+	return value;
+};
+const positiveInteger = (value, name, max) => {
+	const text = single(value, name);
+	if (text === void 0) return;
+	if (!/^\d{1,15}$/.test(text) || Number(text) < 1 || Number(text) > max) throw queryInvalid(`"${name}" must be an integer between 1 and ${max}`);
+	return Number(text);
+};
+const resolveTarget = (context, key) => {
+	if (SYSTEM_ATTRIBUTES.includes(key)) return {
+		kind: "system",
+		name: key
+	};
+	const field = findFieldByApiKey(context.model.fields, key);
+	if (!field) throw queryInvalid(`Unknown field "${key}"`, { field: key });
+	if (!context.isReadable(field)) throw queryForbidden(`You may not filter, sort or search on "${key}"`, { field: key });
+	return {
+		kind: "field",
+		field
+	};
+};
+const conditionFor = (state, target, operator, raw, label) => {
+	if (!OPERATOR_SET.has(operator)) throw queryInvalid(`Unknown operator "${operator}" on "${label}"`);
+	const op = operator;
+	state.conditions += 1;
+	if (state.conditions > QUERY_LIMITS.maxConditions) throw queryInvalid(`At most ${QUERY_LIMITS.maxConditions} filter conditions are allowed`);
+	assertOperatorAllowed(target, op, label);
+	if (isTree(raw) && !isListOperator(op)) throw queryInvalid(`"${label}" ${op} needs a value`);
+	const operand = isListOperator(op) ? toList(raw) : raw;
+	if (!isListOperator(op) && Array.isArray(operand)) throw queryInvalid(`"${label}" ${op} needs a single value`);
+	return {
+		kind: "condition",
+		target,
+		operator: op,
+		value: coerceOperand(target, op, operand, label, QUERY_LIMITS.maxInValues)
+	};
+};
+const combine = (kind, nodes) => nodes.length === 1 ? nodes[0] : {
+	kind,
+	nodes
+};
+const parseFilterTree = (state, tree, depth) => {
+	if (depth > QUERY_LIMITS.maxFilterDepth) throw queryInvalid("Filters are nested too deeply");
+	const nodes = [];
+	for (const [key, value] of Object.entries(tree)) if (key === "$and" || key === "$or") {
+		const children = toList(value, { commas: false }).map((child) => {
+			if (!isTree(child)) throw queryInvalid(`${key} needs a list of filter objects`);
+			return parseFilterTree(state, child, depth + 1);
+		});
+		if (children.length === 0) throw queryInvalid(`${key} needs at least one filter`);
+		nodes.push(combine(key === "$and" ? "and" : "or", children));
+	} else if (key === "$not") {
+		if (!isTree(value)) throw queryInvalid("$not needs a filter object");
+		nodes.push({
+			kind: "not",
+			node: parseFilterTree(state, value, depth + 1)
+		});
+	} else if (key.startsWith("$")) throw queryInvalid(`Unknown filter keyword "${key}"`);
+	else {
+		const target = resolveTarget(state.context, key);
+		if (!isTree(value)) {
+			nodes.push(conditionFor(state, target, "$eq", value, key));
+			continue;
+		}
+		const operators = Object.entries(value);
+		if (operators.length === 0) throw queryInvalid(`"${key}" needs an operator`);
+		nodes.push(combine("and", operators.map(([operator, operand]) => conditionFor(state, target, operator, operand, key))));
+	}
+	if (nodes.length === 0) throw queryInvalid("Empty filter");
+	return combine("and", nodes);
+};
+const parseSort = (context, value) => {
+	const items = toList(value);
+	if (items.length > QUERY_LIMITS.maxSortTerms) throw queryInvalid(`At most ${QUERY_LIMITS.maxSortTerms} sort terms are allowed`);
+	return items.map((item) => {
+		if (typeof item !== "string") throw queryInvalid("sort needs \"field\" or \"field:asc|desc\" values");
+		const [key = "", direction = "asc", extra] = item.split(":");
+		if (extra !== void 0 || direction !== "asc" && direction !== "desc") throw queryInvalid(`Invalid sort "${item}"`);
+		const target = resolveTarget(context, key);
+		if (target.kind === "field" && !isSortable(target.field)) throw queryInvalid(`"${key}" is not sortable: mark it sortable first`);
+		return {
+			target,
+			direction
+		};
+	});
+};
+const parseFields = (context, value) => {
+	if (value === void 0) return null;
+	return toList(value).map((item) => {
+		if (typeof item !== "string") throw queryInvalid("fields needs a list of field names");
+		const target = resolveTarget(context, item);
+		if (target.kind === "system") throw queryInvalid(`"${item}" is always returned; list only model fields`);
+		return target.field;
+	});
+};
+const relationField = (context, model, key) => {
+	const field = findFieldByApiKey(model.fields, key);
+	if (!field || field.type !== "relation") throw queryInvalid(`"${key}" is not a relation of "${model.apiKey}" and cannot be populated`);
+	if (model.id === context.model.id && !context.isReadable(field)) throw queryForbidden(`You may not populate "${key}"`, { field: key });
+	return field;
+};
+const parsePopulate = (context, value) => {
+	const root = /* @__PURE__ */ new Map();
+	for (const item of toList(value)) {
+		if (typeof item !== "string") throw queryInvalid("populate needs a list of relation paths");
+		if (item === "*") {
+			for (const field of context.model.fields) if (field.type === "relation" && !field.deprecated && context.isReadable(field)) root.set(field.id, root.get(field.id) ?? /* @__PURE__ */ new Map());
+			continue;
+		}
+		const segments = item.split(".");
+		if (segments.length > QUERY_LIMITS.maxPopulateDepth) throw queryInvalid(`populate is limited to ${QUERY_LIMITS.maxPopulateDepth} levels`);
+		let model = context.model;
+		let node = root;
+		for (const segment of segments) {
+			if (!model) throw queryInvalid(`Cannot populate "${item}"`);
+			const field = relationField(context, model, segment);
+			const next = node.get(field.id) ?? /* @__PURE__ */ new Map();
+			node.set(field.id, next);
+			node = next;
+			model = field.type === "relation" ? context.resolveModel(field.settings.target) : void 0;
+		}
+	}
+	return root;
+};
+const parseSearch = (context, value) => {
+	const text = single(value, "q")?.trim();
+	if (!text) return null;
+	const field = effectiveTitleField(context.model);
+	if (!field || !TEXT_TITLE_FIELD_TYPES.has(field.type)) throw queryInvalid(`"${context.model.apiKey}" has no text title field to search`);
+	if (!context.isReadable(field)) throw queryForbidden("You may not search this model", { field: field.apiKey });
+	return {
+		field,
+		text
+	};
+};
+/** Parses a bracket querystring tree into a content query for one model. */
+const STATUS_SET = new Set(ENTRY_LIST_STATUSES);
+/** `status` and `author` (admin lists only). */
+const parseAdminFilters = (tree, context) => {
+	const status = single(tree.status, "status");
+	const author = single(tree.author, "author");
+	if ((status !== void 0 || author !== void 0) && !context.allowAdminFilters) throw queryInvalid("\"status\" and \"author\" are only available on the admin API");
+	if (status !== void 0 && !STATUS_SET.has(status)) throw queryInvalid(`"status" must be one of ${ENTRY_LIST_STATUSES.join(", ")}`);
+	if (author !== void 0 && !isStableId(author)) throw queryInvalid("\"author\" must be an admin user ID");
+	return {
+		...status !== void 0 ? { status } : {},
+		...author !== void 0 ? { author } : {}
+	};
+};
+const RICH_TEXT_MODE_SET = new Set(RICH_TEXT_MODES);
+/** `?richText=json|html|both` on delivery and preview reads; the default there, nothing on admin reads. */
+const parseRichText = (tree, context) => {
+	const value = single(tree.richText, "richText");
+	if (!context.allowRichText) {
+		if (value !== void 0) throw queryInvalid("richText is only available on the delivery and preview APIs");
+		return {};
+	}
+	if (value !== void 0 && !RICH_TEXT_MODE_SET.has(value)) throw queryInvalid(`"richText" must be one of ${RICH_TEXT_MODES.join(", ")}`);
+	return { richText: value ?? "json" };
+};
+const SEO_MODE_SET = new Set(SEO_MODES);
+/** `?seo=raw|resolved` on delivery and preview reads; `resolved` needs a readable SEO field on the model. */
+const parseSeo = (tree, context) => {
+	const value = single(tree.seo, "seo");
+	if (value === void 0) return {};
+	if (!context.allowSeo) throw queryInvalid("seo is only available on the delivery and preview APIs");
+	if (!SEO_MODE_SET.has(value)) throw queryInvalid(`"seo" must be one of ${SEO_MODES.join(", ")}`);
+	if (value === "resolved" && !context.model.fields.some((field) => !field.deprecated && isSeoField(field) && context.isReadable(field))) throw queryInvalid(`"${context.model.apiKey}" has no SEO field to resolve`);
+	return { seo: value };
+};
+const parseContentQuery = (tree, context) => {
+	for (const key of Object.keys(tree)) if (!TOP_LEVEL_KEYS.has(key)) throw queryInvalid(`Unknown query parameter "${key}"`);
+	const filters = tree.filters;
+	if (filters !== void 0 && !isTree(filters)) throw queryInvalid("filters needs field conditions, e.g. filters[title][$eq]=Hello");
+	const locale = single(tree.locale, "locale");
+	if (locale !== void 0 && !context.locales.includes(locale)) throw queryInvalid(`Unknown locale "${locale}"`);
+	const snapshot = positiveInteger(tree.snapshot, "snapshot", Number.MAX_SAFE_INTEGER);
+	if (snapshot !== void 0 && !context.allowSnapshot) throw queryInvalid("snapshot is only available on the delivery API");
+	return {
+		filter: filters ? parseFilterTree({
+			context,
+			conditions: 0
+		}, filters, 1) : null,
+		search: parseSearch(context, tree.q),
+		sort: parseSort(context, tree.sort),
+		page: positiveInteger(tree.page, "page", 1e6) ?? 1,
+		pageSize: positiveInteger(tree.pageSize, "pageSize", QUERY_LIMITS.maxPageSize) ?? QUERY_LIMITS.defaultPageSize,
+		fields: parseFields(context, tree.fields),
+		populate: parsePopulate(context, tree.populate),
+		locale,
+		snapshot,
+		...parseRichText(tree, context),
+		...parseSeo(tree, context),
+		...parseAdminFilters(tree, context)
+	};
+};
+//#endregion
+//#region ../../apps/api/src/repositories/contentRevisions.ts
+/** Stored data of several revisions at once (titles and covers for the snapshot diff). */
+const findDataByIds = (ids, executor = db) => ids.length === 0 ? Promise.resolve([]) : executor.selectFrom("content_revisions").select(["id", "data"]).where("id", "in", [...ids]).execute();
+sql`uuid[]`, sql`text[]`;
+/**
+* MySQL: `cast(concat('[', group_concat(<json texts> separator ','), ']') as json)`, an ordered JSON array
+* aggregate (`JSON_ARRAYAGG` takes no ORDER BY); null for an empty group, like PostgreSQL's aggregates.
+* `items` is the inside of `group_concat`: JSON text per row and its ORDER BY.
+*/
+const mysqlJsonArrayOf = (items) => sql`cast(concat('[', group_concat(${items} separator ','), ']') as json)`;
+sql`jsonb_build_object`, sql`jsonb_agg`, sql`'[]'::jsonb`, sql`json_build_object`, sql`json_agg`, sql`'[]'::json`;
+sql``, sql` desc`;
+sql` nulls first`, sql` nulls last`;
+//#endregion
+//#region ../../apps/api/src/services/contentReads.ts
+/** Filters, search and row filter of a parsed query as SQL conditions. */
+/** Whether `queryConditions` names an `entries` column (`HeadQueryPlan.conditionsReadEntries`). */
+const queryReadsEntries = (query, policy) => query.filter !== null && filterReadsEntries(query.filter) || query.author !== void 0 || policy.rowFilter !== null;
+const queryConditions = (context, query, policy) => {
+	const rowFilter = compileRowFilter(policy.rowFilter, context.actor);
+	return [
+		...query.filter ? [compileFilter(query.filter)] : [],
+		...query.search ? [compileSearch(query.search.field.id, query.search.text)] : [],
+		...query.status ? [compileStatusCondition(query.status)] : [],
+		...query.author ? [compileAuthorCondition(query.author)] : [],
+		...rowFilter ? [rowFilter] : []
+	];
+};
+const parseQueryFor = (context, model, policy, rawQuery, options) => parseContentQuery(parseQueryTree(rawQuery), {
+	model: model.definition,
+	locales: context.snapshot.locales.map((locale) => locale.code),
+	isReadable: (field) => maskAllows(policy.readMask, field),
+	allowSnapshot: options.allowSnapshot,
+	allowAdminFilters: options.allowAdminFilters ?? false,
+	allowRichText: options.allowRichText ?? false,
+	allowSeo: options.allowSeo ?? false,
+	resolveModel: (modelId) => resolveModelById(context.snapshot, modelId)?.definition
+});
+//#endregion
+//#region ../../apps/api/src/repositories/sites.ts
+const findById = (id, trx = db) => trx.selectFrom("sites").selectAll().where("id", "=", id).executeTakeFirst();
+const findByKey = (key, trx = db) => trx.selectFrom("sites").selectAll().where("key", "=", key).executeTakeFirst();
+const findPrimary = (trx = db) => trx.selectFrom("sites").selectAll().where("is_primary", "=", true).executeTakeFirstOrThrow();
+/** A site's SEO defaults (null until first saved) and the version an update must name. */
+const findSeoDefaults = (id, trx = db) => trx.selectFrom("sites").select([
+	"id",
+	"key",
+	"name",
+	"version",
+	"seo_defaults"
+]).where("id", "=", id).executeTakeFirst();
+//#endregion
+//#region ../../apps/api/src/services/siteSeo.ts
+const siteNotFound$1 = () => new AppError(404, "SITE_NOT_FOUND", "Site not found");
+/** Stored defaults, or the empty ones when none were saved (or the stored value no longer fits the schema). */
+const readDefaults = (stored) => stored !== null && Value.Check(SeoDefaultsSchema, stored) ? stored : EMPTY_SEO_DEFAULTS;
+/** The defaults a resolved delivery read merges in. */
+const loadSeoDefaults = async (siteId, executor) => readDefaults((await findSeoDefaults(siteId, executor))?.seo_defaults ?? null);
+/** The caller reads something on this site (the same rule as its content: deny by default). */
+const assertReadsSite = async (context) => {
+	for (const { definition } of context.snapshot.definitions) {
+		if (!isModelDefinition(definition)) continue;
+		if ((await context.permissions.evaluate(context.actor, {
+			action: "read",
+			modelId: definition.id
+		})).allowed) return;
+	}
+	throw context.actor.kind === "anonymous" ? new AppError(401, "UNAUTHENTICATED", "This site needs a delivery token") : new AppError(403, "FORBIDDEN", "You may not read content on this site");
+};
+const deliveryImage = async (context, imageId) => {
+	if (imageId === null || !context.media) return null;
+	const assets = await findLiveManyOnSite(context.site.id, [imageId], context.db);
+	const [view] = await toAssetViews(context.media, assets, context.db);
+	return view && isPublicImage(view) ? toDeliveryAsset(view) : null;
+};
+/** `GET /api/site`: the site's key, name and SEO defaults, its default image as a delivered asset. */
+const getDeliverySite = async (context) => {
+	await assertReadsSite(context);
+	const row = await findSeoDefaults(context.site.id, context.db);
+	if (!row) throw siteNotFound$1();
+	const { imageId, ...seo } = readDefaults(row.seo_defaults);
+	return {
+		key: row.key,
+		name: row.name,
+		seo: {
+			...seo,
+			image: await deliveryImage(context, imageId)
+		}
+	};
+};
+//#endregion
+//#region ../../apps/api/src/services/contentDeliveryReads.ts
+/**
+* Delivery-shaped reads (delivery, preview, GraphQL root fields) at one consistent moment (plan
+* delivery-perf). The heads, the page total and the site's publication sequence come from one statement, so
+* a read that needs nothing else (no relation, populate or asset follow-up) runs without a transaction.
+* Anything that needs a follow-up statement runs in one REPEATABLE READ, read-only transaction, so every
+* statement of the response sees the moment `meta.snapshot` names, except a live published read whose only
+* follow-up is relation visibility: that runs on the pool (`readConsistently` explains why it is safe).
+*/
+const deliveryEnvironment = (context, executor, source, locale, richText, seo) => ({
+	executor,
+	snapshot: context.snapshot,
+	permissions: context.permissions,
+	actor: context.actor,
+	siteId: context.site.id,
+	audience: "delivery",
+	source,
+	locale,
+	...context.media ? { media: context.media } : {},
+	...richText ? { richText } : {},
+	...seo ? { seo } : {}
+});
+const environmentOf = (read, executor) => deliveryEnvironment(read.context, executor, read.source, read.query.locale, read.query.richText, read.seo);
+/**
+* Selected top-level relation or media fields, populate, or a default SEO image to show: the read will need a
+* follow-up statement.
+*/
+const followsUp = (read) => read.query.populate.size > 0 || selectFields(read.model, read.policy.readMask, read.query.fields).some((field) => field.type === "relation" || field.type === "media" || Boolean(read.seo?.imageId) && isSeoField(field));
+/**
+* A live read of published heads (no `?snapshot`, not a preview or draft read, no extra conditions) without
+* populate: its only possible follow-up is relation visibility (asset views are checked on the rows).
+*/
+const isLiveVisibilityRead = (read) => read.source.kind === "heads" && read.source.state === "published" && read.query.populate.size === 0 && (read.conditions?.length ?? 0) === 0;
+/**
+* Loads the site's SEO defaults when the query asks for resolved SEO. Read before the heads, outside their
+* consistent moment: defaults are not part of a snapshot (`?snapshot=N&seo=resolved` uses today's).
+*/
+const withSeoDefaults = async (read) => read.query.seo === "resolved" ? {
+	...read,
+	seo: await loadSeoDefaults(read.context.site.id, read.context.db)
+} : read;
+const seqOf = (seq) => {
+	if (seq === null) throw new Error("The site has no publication state");
+	return seq;
+};
+/**
+* Runs the plan's statement on the pool when the read cannot need a follow-up, and keeps that result when
+* the rows indeed need none; otherwise reads again inside one REPEATABLE READ transaction. `finish` projects
+* the rows (through the same executor), so its own statements see the same moment. A live published read
+* whose only follow-up is relation visibility also stays on the pool (see below).
+*/
+const readConsistently = async (read, plan, options, finish) => {
+	const compiled = compileHeadPage(plan, options);
+	const { db } = read.context;
+	const live = isLiveVisibilityRead(read);
+	if (!followsUp(read) || live) {
+		const env = environmentOf(read, db);
+		const { rows, meta } = await runHeadPage(compiled.rows, db);
+		const fields = selectFields(read.model, read.policy.readMask, read.query.fields);
+		if (meta && !needsFollowUpReads(env, read.model, rows, read.query, read.policy)) return finish({
+			env,
+			rows,
+			total: meta.total,
+			seq: seqOf(meta.seq)
+		});
+		if (meta && live && !needsMediaReads(env, read.model, rows, fields)) return finish({
+			env,
+			rows,
+			total: meta.total,
+			seq: seqOf(meta.seq)
+		});
+	}
+	return withConsistentRead(async (trx) => {
+		const env = environmentOf(read, trx);
+		const page = await runHeadPage(compiled.rows, trx);
+		const meta = page.meta ?? await runHeadPageMeta(compiled.meta, trx);
+		return finish({
+			env,
+			rows: page.rows,
+			total: meta.total,
+			seq: seqOf(meta.seq)
+		});
+	}, db);
+};
+const localesOf = (read) => readScopeFor(read.context.snapshot, read.model.definition, read.query.locale, { fallback: read.fallback });
+const toEntries = async (read, env, rows) => (await projectRows(env, read.model, read.policy, rows, read.query)).map(({ row, data }) => ({
+	...systemAttributes(env, row),
+	...data
+}));
+/**
+* One page of entries in the delivery shape, with the total (`total: false` skips counting: a singleton) and
+* the publication sequence it was read at. `check` runs on the sequence before anything is projected.
+*/
+const readEntryPage = async (unloaded, options = { total: true }) => {
+	const read = await withSeoDefaults(unloaded);
+	const { context, model, policy, query } = read;
+	const { limit, offset } = toLimitOffset(query.page, query.pageSize);
+	const sort = query.sort.length > 0 ? query.sort : defaultSortTerms(model.definition, (field) => maskAllows(policy.readMask, field));
+	const plan = {
+		siteId: context.site.id,
+		modelId: model.definition.id,
+		source: read.source,
+		locales: localesOf(read),
+		conditions: [...queryConditions(context, query, policy), ...read.conditions ?? []],
+		conditionsReadEntries: queryReadsEntries(query, policy) || (read.conditions?.length ?? 0) > 0,
+		orderBy: compileOrderBy(sort),
+		limit,
+		offset
+	};
+	return readConsistently(read, plan, { total: options.total }, async ({ env, rows, total, seq }) => {
+		options.check?.(seq);
+		return {
+			entries: await toEntries(read, env, rows),
+			limit,
+			total: total ?? 0,
+			seq
+		};
+	});
+};
+/** One entry by ID in the delivery shape (undefined when it is not there for this read), and the sequence. */
+const readOneEntry = async (unloaded, id, options = {}) => {
+	const read = await withSeoDefaults(unloaded);
+	const { context, model, policy, query } = read;
+	const plan = {
+		siteId: context.site.id,
+		modelId: model.definition.id,
+		source: read.source,
+		locales: localesOf(read),
+		conditions: [
+			...queryConditions(context, {
+				...query,
+				filter: null,
+				search: null
+			}, policy),
+			...read.conditions ?? [],
+			entryIdIs(id)
+		],
+		orderBy: [],
+		limit: 1
+	};
+	return readConsistently(read, plan, { total: false }, async ({ env, rows, seq }) => {
+		options.check?.(seq);
+		const [entry] = await toEntries(read, env, rows);
+		return {
+			entry,
+			seq
+		};
+	});
+};
+//#endregion
+//#region ../../apps/api/src/services/contentDelivery.ts
+const readableModel = async (context, modelKey) => {
+	const model = resolveModel(context.snapshot, modelKey);
+	const policy = await context.permissions.evaluate(context.actor, {
+		action: "read",
+		modelId: model.definition.id
+	});
+	if (!policy.allowed) throw context.actor.kind === "anonymous" ? new AppError(401, "UNAUTHENTICATED", "This content needs a delivery token") : new AppError(403, "FORBIDDEN", `Your token may not read "${modelKey}"`);
+	return {
+		model,
+		policy
+	};
+};
+/** The heads a read serves: drafts (GraphQL previews), a pinned snapshot, or the published heads. */
+const sourceOf = (query, options) => {
+	if (query.snapshot !== void 0 && options.drafts) throw queryInvalid("snapshot reads published content; it cannot be combined with drafts");
+	return options.drafts ? {
+		kind: "heads",
+		state: "draft"
+	} : query.snapshot !== void 0 ? {
+		kind: "snapshot",
+		seq: query.snapshot
+	} : {
+		kind: "heads",
+		state: "published"
+	};
+};
+/** A pinned snapshot must already exist: checked against the sequence the read itself saw. */
+const snapshotCheck = (query) => (current) => {
+	if (query.snapshot !== void 0 && query.snapshot > current) throw snapshotInvalid(query.snapshot, current);
+};
+/**
+* Counts a successful REST read for field usage (plan developer-face §5): once per request, after the
+* projection, by principal. Admin users and draft reads are never counted.
+*/
+const recordUsage = async (context, options, model, policy, query) => {
+	const principalKey = usagePrincipalKey(context.actor);
+	if (!options.usage || options.drafts || principalKey === null) return;
+	const reads = await restFieldReads({
+		snapshot: context.snapshot,
+		model,
+		policy,
+		query,
+		policyFor: (modelId) => context.permissions.evaluate(context.actor, {
+			action: "read",
+			modelId
+		})
+	});
+	options.usage.recordRequest(context.site.id, principalKey, query.snapshot ?? null);
+	options.usage.recordFieldReads(context.site.id, principalKey, model.definition.id, reads);
+};
+/** Records usage after the response when the caller can defer it (REST), else before returning. */
+const afterRead = async (options, task) => {
+	if (options.defer) {
+		options.defer(task);
+		return;
+	}
+	await task();
+};
+const ITEM_PARAMETERS = /* @__PURE__ */ new Set([
+	"fields",
+	"populate",
+	"locale",
+	"snapshot",
+	"richText",
+	"seo"
+]);
+/** Reading one entry takes only these query parameters; anything else is refused, not ignored. */
+const assertItemParameters = (rawQuery, allowed) => {
+	const unsupported = [...new URLSearchParams(rawQuery).keys()].find((key) => !allowed.has(key.split("[")[0] ?? key));
+	if (unsupported !== void 0) throw queryInvalid(`"${unsupported}" is not supported when reading one entry`);
+};
+/** `GET /api/content/:modelKey`: a page of a collection, or a singleton's one entry. */
+const listDelivery = async (context, modelKey, rawQuery, options = {}) => {
+	const { model, policy } = await readableModel(context, modelKey);
+	const query = parseQueryFor(context, model, policy, rawQuery, {
+		allowSnapshot: true,
+		allowRichText: true,
+		allowSeo: true
+	});
+	const locale = query.locale ?? context.snapshot.defaultLocale;
+	const singleton = model.definition.kind === "singleton";
+	const { entries, limit, total, seq } = await readEntryPage({
+		context,
+		source: sourceOf(query, options),
+		model,
+		policy,
+		query,
+		fallback: options.fallback ?? true
+	}, {
+		total: !singleton,
+		check: snapshotCheck(query)
+	});
+	const snapshot = query.snapshot ?? seq;
+	let result;
+	if (singleton) {
+		const [entry] = entries;
+		if (!entry) throw entryNotFound(modelKey);
+		result = {
+			data: entry,
+			meta: {
+				locale,
+				snapshot
+			}
+		};
+	} else result = {
+		data: entries,
+		meta: {
+			locale,
+			snapshot,
+			pagination: paginationMeta(query.page, limit, total)
+		}
+	};
+	await afterRead(options, () => recordUsage(context, options, model, policy, query));
+	return result;
+};
+/** `GET /api/content/:modelKey/:id`: one published entry (404 for drafts, unknown or unreadable entries). */
+const getDelivery = async (context, modelKey, id, rawQuery, options = {}) => {
+	assertItemParameters(rawQuery, ITEM_PARAMETERS);
+	const { model, policy } = await readableModel(context, modelKey);
+	const query = parseQueryFor(context, model, policy, rawQuery, {
+		allowSnapshot: true,
+		allowRichText: true,
+		allowSeo: true
+	});
+	const { entry, seq } = await readOneEntry({
+		context,
+		source: sourceOf(query, options),
+		model,
+		policy,
+		query,
+		fallback: options.fallback ?? true
+	}, id, { check: snapshotCheck(query) });
+	if (!entry) throw entryNotFound(id);
+	await afterRead(options, () => recordUsage(context, options, model, policy, query));
+	return {
+		data: entry,
+		meta: {
+			locale: query.locale ?? context.snapshot.defaultLocale,
+			snapshot: query.snapshot ?? seq
+		}
+	};
+};
+//#endregion
+//#region ../../apps/api/src/repositories/publications.ts
+const currentSeq = async (siteId, executor = db) => {
+	const row = await executor.selectFrom("publication_state").select("last_seq").where("site_id", "=", siteId).executeTakeFirstOrThrow();
+	return Number(row.last_seq);
+};
+//#endregion
+//#region ../../apps/api/src/repositories/schemaVersions.ts
+/** The global schema version: the durable value every instance compares its cached snapshot against. */
+const getSchemaVersion = async (executor = db) => {
+	return (await executor.selectFrom("system_versions").select("schema_version").executeTakeFirstOrThrow()).schema_version;
+};
+//#endregion
+//#region ../../apps/api/src/db/snapshotDiffQuery.ts
+const POSTGRES = {
+	uuid: (value) => sql`${value}::uuid`,
+	seq: (value) => sql`${value}::bigint`,
+	inModels: (modelIds) => sql`pl.model_id = any(${[...modelIds]}::uuid[])`,
+	distinct: (a, b) => sql`${a} is distinct from ${b}`,
+	aggregate: (object) => sql`jsonb_agg(
+        ${object}
+        order by ch.locale
+      )`,
+	object: sql`jsonb_build_object`,
+	change: sql`change`
+};
+const SQLITE = {
+	uuid: (value) => sql`${value.toLowerCase()}`,
+	seq: (value) => sql`${value}`,
+	inModels: (modelIds) => sql`pl.model_id in (select value from json_each(${JSON.stringify(modelIds)}))`,
+	distinct: (a, b) => sql`${a} is not ${b}`,
+	aggregate: (object) => sql`json_group_array(
+        ${object}
+        order by ch.locale
+      )`,
+	object: sql`json_object`,
+	change: sql`change`
+};
+/** MySQL: `<=>` is null-safe equality; JSON_ARRAYAGG takes no ORDER BY (`mysqlJsonArrayOf`). */
+const MYSQL = {
+	uuid: (value) => sql`${value.toLowerCase()}`,
+	seq: (value) => sql`${value}`,
+	inModels: (modelIds) => modelIds.length === 0 ? sql`false` : sql`pl.model_id in (${sql.join([...modelIds])})`,
+	distinct: (a, b) => sql`not (${a} <=> ${b})`,
+	aggregate: (object) => mysqlJsonArrayOf(sql`${object} order by ch.locale`),
+	object: sql`json_object`,
+	change: sql`\`change\``
+};
+const modelCondition = (dialect, modelIds) => modelIds === null ? sql`true` : dialect.inModels(modelIds);
+const afterCondition = (dialect, after) => after === void 0 ? sql`true` : sql`pl.entry_id > ${dialect.uuid(after)}`;
+/** The revision of (entry, locale) live at `seq`, as a lateral subquery over `c`. */
+const liveAt = (dialect, siteId, seq) => sql`(
+  select p.revision_id from publication_log p
+  where p.site_id = ${dialect.uuid(siteId)} and p.entry_id = c.entry_id and p.locale = c.locale
+    and p.from_seq <= ${dialect.seq(seq)} and (p.to_seq is null or p.to_seq > ${dialect.seq(seq)})
+  order by p.from_seq desc
+  limit 1
+)`;
+const selectSnapshotDiffRows = async (params, executor) => {
+	const dialect = isMysql() ? MYSQL : isSqlite() ? SQLITE : POSTGRES;
+	const { from, to } = params;
+	const scope = sql`pl.site_id = ${dialect.uuid(params.siteId)} and ${modelCondition(dialect, params.modelIds)}
+    and ${afterCondition(dialect, params.after)}`;
+	return (await sql`
+    with candidates as (
+      select pl.entry_id, pl.locale from publication_log pl
+      where pl.from_seq > ${dialect.seq(from)} and pl.from_seq <= ${dialect.seq(to)} and ${scope}
+      union
+      select pl.entry_id, pl.locale from publication_log pl
+      where pl.to_seq > ${dialect.seq(from)} and pl.to_seq <= ${dialect.seq(to)} and ${scope}
+    ),
+    states as (
+      select c.entry_id, c.locale, ${liveAt(dialect, params.siteId, from)} as from_revision_id,
+        ${liveAt(dialect, params.siteId, to)} as to_revision_id
+      from candidates c
+    ),
+    changes as (
+      select s.*,
+        case
+          when s.from_revision_id is null then 'published'
+          when s.to_revision_id is null then 'unpublished'
+          else 'updated'
+        end as ${dialect.change}
+      from states s
+      where ${dialect.distinct(sql`s.from_revision_id`, sql`s.to_revision_id`)}
+    )
+    select ch.entry_id, e.model_id,
+      ${dialect.aggregate(sql`${dialect.object}(
+          'locale', ch.locale,
+          'change', ch.${dialect.change},
+          'fromRevisionId', ch.from_revision_id,
+          'toRevisionId', ch.to_revision_id
+        )`)} as locales
+    from changes ch
+    join entries e on e.id = ch.entry_id
+    where ${params.rowFilter ?? sql`true`}
+    group by ch.entry_id, e.model_id
+    order by ch.entry_id
+    limit ${params.maxRows}
+  `.execute(executor)).rows.map((row) => typeof row.locales === "string" ? {
+		...row,
+		locales: JSON.parse(row.locales)
+	} : row);
+};
+//#endregion
+//#region ../../apps/api/src/repositories/snapshotDiff.ts
+const listChanges = async (query, executor = db) => {
+	if (query.to <= query.from || query.modelIds !== null && query.modelIds.length === 0) return {
+		items: [],
+		nextAfter: null
+	};
+	const rows = await selectSnapshotDiffRows({
+		siteId: query.siteId,
+		from: query.from,
+		to: query.to,
+		after: query.after,
+		modelIds: query.modelIds,
+		rowFilter: query.rowFilter ?? null,
+		maxRows: query.limit + 1
+	}, executor);
+	const page = rows.slice(0, query.limit);
+	return {
+		items: page.map((row) => ({
+			entryId: row.entry_id,
+			modelId: row.model_id,
+			locales: row.locales
+		})),
+		nextAfter: rows.length > query.limit ? page.at(-1)?.entry_id ?? null : null
+	};
+};
+/**
+* The schema version recorded for each publication sequence number in the `publication_snapshots`
+* ledger; numbers without a ledger row (snapshot 0, rows from before the ledger) are absent.
+*/
+const schemaVersionsAt = async (siteId, seqs, executor = db) => {
+	if (seqs.length === 0) return /* @__PURE__ */ new Map();
+	const rows = await executor.selectFrom("publication_snapshots").select(["seq", "schema_version"]).where("site_id", "=", siteId).where("seq", "in", seqs.map((seq) => String(seq))).execute();
+	return new Map(rows.map((row) => [Number(row.seq), row.schema_version]));
+};
+/** When the site's snapshot `seq` was created, from the ledger (undefined without a ledger row). */
+const snapshotCreatedAt = async (siteId, seq, executor = db) => (await executor.selectFrom("publication_snapshots").select("created_at").where("site_id", "=", siteId).where("seq", "=", String(seq)).executeTakeFirst())?.created_at;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+* Models the caller may read. An authenticated caller (session, token, app user) with none (or an instance
+* with no models yet) gets empty results, never an error. Anonymous callers with nothing readable get 401,
+* as the delivery routes answer them when the `public` role grants nothing.
+*/
+const readableModels = async (context) => {
+	const models = context.snapshot.definitions.map((active) => active.definition).filter((definition) => isModelDefinition(definition));
+	const readable = [];
+	for (const definition of models) {
+		const policy = await context.permissions.evaluate(context.actor, {
+			action: "read",
+			modelId: definition.id
+		});
+		if (policy.allowed) readable.push({
+			definition,
+			rowFilter: policy.rowFilter,
+			readMask: policy.readMask
+		});
+	}
+	if (readable.length === 0 && context.actor.kind === "anonymous") throw new AppError(401, "UNAUTHENTICATED", "Snapshots need a delivery token");
+	return readable;
+};
+/** The revision an entry is described from: the default locale's when it changed, else the first. */
+const revisionOf = (item, defaultLocale) => {
+	const locale = item.locales.find((candidate) => candidate.locale === defaultLocale) ?? item.locales[0];
+	return locale ? locale.toRevisionId ?? locale.fromRevisionId : null;
+};
+/**
+* Title and cover per changed entry, read from one revision each (one query for the page). Fields the
+* caller's read mask hides are left out.
+*/
+const describeEntries = async (items, models, defaultLocale, executor) => {
+	const revisionIds = [...new Set(items.flatMap((item) => revisionOf(item, defaultLocale) ?? []))];
+	const rows = await findDataByIds(revisionIds, executor);
+	const dataById = new Map(rows.map((row) => [row.id, row.data]));
+	return (item) => {
+		const model = models.get(item.modelId);
+		const revisionId = revisionOf(item, defaultLocale);
+		const data = revisionId ? dataById.get(revisionId) : void 0;
+		if (!model || !data) return {
+			title: null,
+			coverMediaId: null
+		};
+		const titleField = effectiveTitleField(model.definition);
+		const cover = effectiveLayout(model.definition).cover;
+		const title = titleField && maskAllows(model.readMask, titleField) ? data[titleField.id] : void 0;
+		const coverId = cover && maskAllows(model.readMask, cover) ? data[cover.id] : void 0;
+		return {
+			title: typeof title === "string" && title.trim() !== "" ? title : typeof title === "number" ? String(title) : null,
+			coverMediaId: typeof coverId === "string" ? coverId : null
+		};
+	};
+};
+const boundedLimit = (limit) => Math.min(Math.max(limit ?? 100, 1), 500);
+/** `GET /api/snapshots/changes`, GraphQL `_changes`: one page of entries changed between `from` and `to`. */
+const listSnapshotChanges = async (context, query) => {
+	if (query.after !== void 0 && !UUID.test(query.after)) throw queryInvalid("\"after\" must be a cursor returned by a previous page");
+	const readable = await readableModels(context);
+	const byId = new Map(readable.map((model) => [model.definition.id, model]));
+	return withConsistentRead(async (trx) => {
+		const current = await currentSeq(context.site.id, trx);
+		const to = query.to ?? current;
+		if (to > current) throw snapshotInvalid(to, current);
+		if (query.from < 0 || query.from > to) throw queryInvalid("\"from\" must be between 0 and \"to\"");
+		const page = await listChanges({
+			siteId: context.site.id,
+			from: query.from,
+			to,
+			after: query.after,
+			limit: boundedLimit(query.limit),
+			modelIds: [...byId.keys()],
+			rowFilter: compileModelRowFilters(readable.map((model) => ({
+				modelId: model.definition.id,
+				rowFilter: model.rowFilter
+			})), context.actor)
+		}, trx);
+		const versions = await schemaVersionsAt(context.site.id, [query.from, to], trx);
+		const describe = await describeEntries(page.items, byId, context.snapshot.defaultLocale, trx);
+		return {
+			from: query.from,
+			to,
+			schemaVersions: {
+				from: versions.get(query.from) ?? null,
+				to: versions.get(to) ?? null
+			},
+			items: page.items.flatMap((item) => {
+				const model = byId.get(item.modelId)?.definition;
+				return model ? [{
+					id: item.entryId,
+					modelId: item.modelId,
+					modelKey: model.apiKey,
+					routeKey: routeKeyOf(model),
+					...describe(item),
+					locales: item.locales.map(({ locale, change, fromRevisionId, toRevisionId }) => ({
+						locale,
+						change,
+						revisionId: toRevisionId ?? fromRevisionId
+					}))
+				}] : [];
+			}),
+			nextCursor: page.nextAfter
+		};
+	}, context.db);
+};
+/** `GET /api/snapshots/current`, GraphQL `_snapshot`. */
+const currentSnapshot = async (context) => {
+	await readableModels(context);
+	return withConsistentRead(async (trx) => {
+		const snapshot = await currentSeq(context.site.id, trx);
+		const publishedAt = await snapshotCreatedAt(context.site.id, snapshot, trx);
+		return {
+			snapshot,
+			schemaVersion: await getSchemaVersion(trx),
+			publishedAt: publishedAt ?? null
+		};
+	}, context.db);
+};
+//#endregion
+//#region ../../apps/api/src/helpers/tokens.ts
+/**
+* What we store for a token: its SHA-256, hex. Tokens are high-entropy random values, so a fast hash is
+* enough (no salt or stretching needed); a leaked table does not reveal usable tokens.
+*/
+const hashToken = (token) => createHash("sha256").update(token, "utf8").digest("hex");
+//#endregion
+//#region ../../apps/api/src/permissions/memo.ts
+/**
+* One request's evaluator, memoized per (principal, action, model): a request touches the same models many
+* times (REST: the read, relation visibility, populate, usage; GraphQL: lists, relation batches,
+* localizations), and evaluates each policy once (ADR 0005). Calls for another principal bypass the memo.
+* A policy still being evaluated is shared only on the executor that evaluates it: one evaluated inside a
+* read transaction is never awaited from another transaction. Once settled, every executor reuses it.
+*/
+const memoizePermissions = (base, principal) => {
+	const settled = /* @__PURE__ */ new Map();
+	const pooled = /* @__PURE__ */ new Map();
+	const byTransaction = /* @__PURE__ */ new WeakMap();
+	const pendingFor = (executor) => {
+		if (!executor) return pooled;
+		let pending = byTransaction.get(executor);
+		if (!pending) {
+			pending = /* @__PURE__ */ new Map();
+			byTransaction.set(executor, pending);
+		}
+		return pending;
+	};
+	return {
+		evaluate: (caller, request, executor) => {
+			if (caller !== principal) return base.evaluate(caller, request, executor);
+			const key = `${request.action}:${request.modelId}`;
+			const done = settled.get(key);
+			if (done) return Promise.resolve(done);
+			const pending = pendingFor(executor);
+			let policy = pending.get(key);
+			if (!policy) {
+				policy = base.evaluate(caller, request, executor);
+				pending.set(key, policy);
+				policy.then((value) => settled.set(key, value), () => void 0);
+			}
+			return policy;
+		},
+		canPerform: (caller, action, executor) => base.canPerform(caller, action, executor),
+		canPerformOnSite: (caller, action, siteId, executor) => base.canPerformOnSite(caller, action, siteId, executor)
+	};
+};
+//#endregion
+//#region ../../apps/api/src/permissions/scoped.ts
+const isLazy = (versions) => "read" in versions;
+/**
+* The evaluator at the scope's versions. Inside a transaction before a lazy scope read its versions, the
+* unbound evaluator checks the versions itself through the transaction, so no pooled connection is asked
+* for while the transaction holds one.
+*/
+const boundEvaluator = async (base, versions, executor) => {
+	if (!isLazy(versions)) return base.atVersions?.(versions) ?? base;
+	if (executor && !versions.isRead()) return base;
+	return base.atVersions?.(await versions.read()) ?? base;
+};
+/**
+* One scope's evaluator (an HTTP request, an in-process delivery call): checked against the scope's durable
+* versions (ADR 0005: a revoke applies from the next scope, not mid-scope) and memoized per (principal, action,
+* model) for the scope (`memo.ts`).
+*/
+const scopePermissions = (base, principal, versions) => memoizePermissions({
+	evaluate: async (caller, policyRequest, executor) => (await boundEvaluator(base, versions, executor)).evaluate(caller, policyRequest, executor),
+	canPerform: async (caller, action, executor) => (await boundEvaluator(base, versions, executor)).canPerform(caller, action, executor),
+	canPerformOnSite: async (caller, action, siteId, executor) => (await boundEvaluator(base, versions, executor)).canPerformOnSite(caller, action, siteId, executor)
+}, principal);
+//#endregion
+//#region ../../apps/api/src/permissions/sites.ts
+/**
+* Narrowing principals to one site (sites plan §H). Roles are instance-wide; assignments say where a role
+* applies. On a site, an admin holds the roles assigned on that site plus the roles assigned on every site.
+* Network actions only ever see the roles assigned on every site.
+*/
+const unique = (ids) => [...new Set(ids)].sort();
+/** Roles assigned on every site. */
+const networkRolesOf = (assignments) => unique(assignments.filter((assignment) => assignment.siteId === null).map((assignment) => assignment.roleId));
+/** Roles that apply on `siteId`: those assigned there and those assigned on every site. */
+const siteRolesOf = (assignments, siteId) => unique(assignments.filter((assignment) => assignment.siteId === null || assignment.siteId === siteId).map((assignment) => assignment.roleId));
+/** The admin principal for one site, or for a network route (`siteId` null: network roles only). */
+const narrowToSite = (identity, siteId) => ({
+	kind: "admin",
+	adminUserId: identity.adminUserId,
+	sessionId: identity.sessionId,
+	assignments: identity.assignments,
+	siteId,
+	roleIds: siteId === null ? networkRolesOf(identity.assignments) : siteRolesOf(identity.assignments, siteId),
+	networkRoleIds: networkRolesOf(identity.assignments)
+});
+/** The identity behind an admin principal (to narrow it again to another site). */
+const identityOf = (principal) => ({
+	adminUserId: principal.adminUserId,
+	sessionId: principal.sessionId,
+	assignments: principal.assignments
+});
+/** A credential (token, app-user session, link or code) used on another site than its own. */
+const siteMismatch = () => new AppError(403, "SITE_MISMATCH", "This credential belongs to another site than the one requested");
+/**
+* Re-narrows a principal to the request's site. Admins get that site's roles; anonymous callers get the site
+* (its `public` bindings apply). Site credentials (a site token, an app user) act on their own site only:
+* another site is refused (403 `SITE_MISMATCH`), whatever resolved it. A network token's role applies on
+* every site.
+*/
+const principalForSite = (principal, siteId) => {
+	switch (principal.kind) {
+		case "admin": return narrowToSite(identityOf(principal), siteId);
+		case "anonymous": return {
+			kind: "anonymous",
+			siteId
+		};
+		case "appUser":
+			if (principal.siteId !== siteId) throw siteMismatch();
+			return principal;
+		case "token":
+			if (principal.siteId !== null && principal.siteId !== siteId) throw siteMismatch();
+			return principal;
+		case "system": return principal;
+	}
+};
+/** The roles a token holds for network actions: only a network token's (site tokens never reach the network). */
+const tokenNetworkRoleIds = (token) => token.siteId === null ? [token.roleId] : [];
+//#endregion
+//#region ../../apps/api/src/constants/delivery.ts
+/** `system_settings` key of the delivery descriptor the server writes at start (services/deliveryDescriptor.ts). */
+const DELIVERY_DESCRIPTOR_SETTING = "delivery_descriptor";
+//#endregion
+//#region ../../apps/api/src/repositories/requestState.ts
+/** The site a lookup names, joined to the one `system_versions` row (at most one row matches). */
+const siteJoin = (join, lookup) => {
+	switch (lookup.by) {
+		case "id": return join.on("sites.id", "=", lookup.id);
+		case "key": return join.on("sites.key", "=", lookup.key);
+		case "primary": return join.on("sites.is_primary", "=", true);
+	}
+};
+/**
+* The request state for an in-process delivery call, in the same one statement: the versions and the site,
+* plus the server's release and delivery descriptor, and (for a token already resolved) whether it is still
+* live, so a call is this statement and its read.
+*/
+const readForDelivery = async (input, trx = db) => {
+	const { tokenId } = input;
+	const row = await trx.selectFrom("system_versions").leftJoin("sites", (join) => siteJoin(join, input.site)).leftJoin("system_settings", (join) => join.on("system_settings.key", "=", DELIVERY_DESCRIPTOR_SETTING)).select([
+		"system_versions.schema_version",
+		"system_versions.permissions_version",
+		"system_versions.release",
+		"sites.id as site_id",
+		"sites.key as site_key",
+		"system_settings.value as descriptor"
+	]).$if(tokenId !== void 0, (query) => query.leftJoin("api_tokens", (join) => join.on("api_tokens.id", "=", tokenId ?? "")).select([
+		"api_tokens.id as token_id",
+		"api_tokens.revoked_at as token_revoked_at",
+		"api_tokens.expires_at as token_expires_at"
+	])).executeTakeFirstOrThrow();
+	return {
+		schemaVersion: row.schema_version,
+		permissionsVersion: row.permissions_version,
+		site: row.site_id !== null && row.site_key !== null ? {
+			id: row.site_id,
+			key: row.site_key
+		} : void 0,
+		release: row.release,
+		descriptor: row.descriptor,
+		token: row.token_id === void 0 || row.token_id === null ? null : {
+			revokedAt: row.token_revoked_at ?? null,
+			expiresAt: row.token_expires_at ?? null
+		}
+	};
+};
+//#endregion
+//#region ../../apps/api/src/repositories/adminRoles.ts
+const PERMISSION_COLUMNS$1 = [
+	"role_id",
+	"action",
+	"model_id",
+	"condition",
+	"field_ids"
+];
+/** Every grant of every role; the permission cache loads them all at once (the table is small). */
+const listAllPermissions$1 = (trx = db) => trx.selectFrom("admin_role_permissions").select(PERMISSION_COLUMNS$1).execute();
+//#endregion
+//#region ../../apps/api/src/repositories/permissionsVersion.ts
+/** The durable permissions version; caches compare against it (build plan §3.4). */
+const getPermissionsVersion = async (trx = db) => {
+	return (await trx.selectFrom("system_versions").select("permissions_version").executeTakeFirstOrThrow()).permissions_version;
+};
+//#endregion
+//#region ../../apps/api/src/permissions/seedRoles.ts
+const SYSTEM_ROLE_KEYS = {
+	owner: "owner",
+	admin: "admin",
+	editor: "editor",
+	readOnly: "read-only"
+};
+SYSTEM_ROLE_KEYS.owner, SYSTEM_ROLE_KEYS.admin, SYSTEM_ROLE_KEYS.editor, SYSTEM_ROLE_KEYS.readOnly;
+//#endregion
+//#region ../../apps/api/src/repositories/apiTokens.ts
+const LIST_COLUMNS = [
+	"api_tokens.id",
+	"api_tokens.name",
+	"api_tokens.token_prefix",
+	"api_tokens.role_id",
+	"api_tokens.created_by",
+	"api_tokens.expires_at",
+	"api_tokens.last_used_at",
+	"api_tokens.revoked_at",
+	"api_tokens.created_at",
+	"api_tokens.site_id",
+	"admin_roles.kind as role_kind"
+];
+const withRole = (trx) => trx.selectFrom("api_tokens").innerJoin("admin_roles", "admin_roles.id", "api_tokens.role_id").select(LIST_COLUMNS);
+/** A usable token for this hash: not revoked. Expiry is checked by the caller. */
+const findLiveByHash = (tokenHash, trx = db) => withRole(trx).where("api_tokens.token_hash", "=", tokenHash).where("api_tokens.revoked_at", "is", null).executeTakeFirst();
+const touchLastUsed = (id, now, staleBefore, trx = db) => trx.updateTable("api_tokens").set({ last_used_at: now }).where("id", "=", id).where((eb) => eb.or([eb("last_used_at", "is", null), eb("last_used_at", "<", staleBefore)])).execute();
+//#endregion
+//#region ../../apps/api/src/services/apiTokens.ts
+const scopeOf = (roleKind) => roleKind === "delivery" ? "delivery" : "admin";
+/** Whether a token with this expiry has expired at `now`. */
+const isTokenExpired = (expiresAt, now) => expiresAt !== null && expiresAt.getTime() <= now.getTime();
+/** The principal for a bearer API token, or undefined when unknown, revoked or expired. */
+const resolveApiToken = async (value, now = /* @__PURE__ */ new Date(), { recordUse = true, executor = db } = {}) => {
+	const row = await findLiveByHash(hashToken(value), executor);
+	if (!row || isTokenExpired(row.expires_at, now)) return;
+	const staleBefore = /* @__PURE__ */ new Date(now.getTime() - LAST_SEEN_WRITE_INTERVAL_MS);
+	if (recordUse && (row.last_used_at === null || row.last_used_at.getTime() < staleBefore.getTime())) await touchLastUsed(row.id, now, staleBefore, executor);
+	return {
+		kind: "token",
+		tokenId: row.id,
+		scope: scopeOf(row.role_kind),
+		roleId: row.role_id,
+		siteId: row.site_id
+	};
+};
+//#endregion
+//#region ../../apps/api/src/content/hooks.ts
+/**
+* Lifecycle hook points (ADR 0009). The content services call every hook point inside the owning
+* transaction; a hook that throws aborts the write. This registry is the engine only: the extension
+* runtime (extensions/hooks.ts) registers project hooks on it, running `before*` hooks right here in the
+* transaction and turning `after*` hook points into an outbox event, so project `after*` hooks run after
+* commit as jobs and can never roll the write back.
+*/
+const BEFORE_EVENTS = [
+	"beforeCreate",
+	"beforeUpdate",
+	"beforePublish",
+	"beforeDelete"
+];
+const AFTER_EVENTS = [
+	"afterCreate",
+	"afterUpdate",
+	"afterPublish",
+	"afterDelete"
+];
+[...BEFORE_EVENTS, ...AFTER_EVENTS];
+const createContentHooks = () => {
+	const hooks = /* @__PURE__ */ new Map();
+	return {
+		on: (event, hook) => {
+			hooks.set(event, [...hooks.get(event) ?? [], hook]);
+			return () => hooks.set(event, (hooks.get(event) ?? []).filter((candidate) => candidate !== hook));
+		},
+		run: async (event, context) => {
+			for (const hook of hooks.get(event) ?? []) await hook(context);
+		}
+	};
+};
+//#endregion
+//#region ../../apps/api/src/services/contentContext.ts
+/**
+* The content service context for one call, the same however the call arrived: the site's view of the pinned
+* schema (plan site-schema: shared definitions and the site's own), scoped to the site.
+*/
+const buildContentContext = ({ network, hooks, media, requestId, ip, ...rest }) => ({
+	...rest,
+	snapshot: network.forSite(rest.site.id),
+	hooks: hooks ?? createContentHooks(),
+	...media ? { media } : {},
+	...requestId !== void 0 ? { requestId } : {},
+	...ip !== void 0 ? { ip } : {}
+});
+//#endregion
+//#region ../../apps/api/src/repositories/schemaModels.ts
+/** The active revision of every live (not deleted) model and component. */
+const findActiveDefinitions = (executor = db) => executor.selectFrom("model_active_versions as active").innerJoin("models", "models.id", "active.model_id").innerJoin("schema_revisions as revision", "revision.id", "active.revision_id").where("models.deleted_at", "is", null).select([
+	"models.id as modelId",
+	"models.kind as kind",
+	"models.site_id as siteId",
+	"active.version as version",
+	"active.revision_id as revisionId",
+	"active.activated_at as activatedAt",
+	"revision.hash as hash",
+	"revision.definition as definition"
+]).orderBy("models.created_at").orderBy("models.id").execute();
+lockKeyFromId("shapio:schema-activation");
+//#endregion
+//#region ../../apps/api/src/services/sites.ts
+const toSiteRef = (row) => ({
+	id: row.id,
+	key: row.key
+});
+const siteNotFound = () => new AppError(404, "SITE_NOT_FOUND", "Site not found");
+/** The site a lookup names, read on its own (a request whose state was read without its site). */
+const findSite = async (lookup) => {
+	switch (lookup.by) {
+		case "id": return findById(lookup.id).then((row) => row && toSiteRef(row));
+		case "key": return findByKey(lookup.key).then((row) => row && toSiteRef(row));
+		case "primary": return toSiteRef(await findPrimary());
+	}
+};
+/**
+* Which site a request is about (sites plan §H): the credential's site, else the site the request names,
+* else the primary site. A request that names a different site than its credential is refused
+* (403 `SITE_MISMATCH`), never redirected; an unknown key is 404 `SITE_NOT_FOUND`.
+* `read`: where the site is read; a request passes its once-per-request state read
+* (`repositories/requestState.ts`), which reads the site with the versions in one statement.
+*/
+const resolveSite = async ({ credentialSiteId, requestedKey }, read = findSite) => {
+	if (credentialSiteId !== void 0) {
+		const site = await read({
+			by: "id",
+			id: credentialSiteId
+		});
+		if (!site) throw siteNotFound();
+		if (requestedKey !== void 0 && requestedKey !== site.key) throw new AppError(403, "SITE_MISMATCH", `This credential belongs to site "${site.key}", not "${requestedKey}"`);
+		return site;
+	}
+	if (requestedKey !== void 0) {
+		const site = await read({
+			by: "key",
+			key: requestedKey
+		});
+		if (!site) throw new AppError(404, "SITE_NOT_FOUND", `No site has the key "${requestedKey}"`);
+		return site;
+	}
+	const primary = await read({ by: "primary" });
+	if (!primary) throw new Error("No primary site");
+	return primary;
+};
+//#endregion
+//#region ../../apps/api/src/delivery/scope.ts
+const ANONYMOUS = Object.freeze({
+	kind: "anonymous",
+	siteId: null
+});
+const invalidToken = () => new AppError(401, "INVALID_TOKEN", "The API token is invalid, expired or revoked");
+/**
+* Runs a statement of the call's preamble, mapping a failure on a database that predates this release (a
+* statement names a column or table it lacks) to a version skew rather than an SQL error.
+*/
+const guardingSkew = async (runtime, statement) => {
+	try {
+		return await statement();
+	} catch (error) {
+		if (error instanceof AppError) throw error;
+		const { getPendingMigrations } = await import("./migrator-CIKnDfZy.js");
+		if ((await getPendingMigrations(runtime.db)).length > 0) throw new ShapioVersionSkewError$1(null, SHAPIO_VERSION$1, { cause: error });
+		throw error;
+	}
+};
+/** The one state statement: versions, site, release, descriptor and the token's liveness. */
+const readState = (runtime, site, tokenId) => guardingSkew(runtime, () => readForDelivery({
+	site,
+	...tokenId !== void 0 ? { tokenId } : {}
+}, runtime.db));
+/**
+* The caller: anonymous, or a delivery token resolved once per runtime (read-only: in-process reads never
+* record a token's use) and checked for liveness on every call by the state read. Admin-scope tokens are
+* refused: in-process reads are delivery reads only (rule 7).
+*/
+const callerOf = async (runtime, token) => {
+	if (token === void 0) return { principal: ANONYMOUS };
+	const tokenKey = hashToken(token);
+	let principal = runtime.tokens.get(tokenKey);
+	if (!principal) {
+		const resolved = await guardingSkew(runtime, () => resolveApiToken(token, /* @__PURE__ */ new Date(), {
+			recordUse: false,
+			executor: runtime.db
+		}));
+		if (!resolved) throw invalidToken();
+		if (resolved.scope !== "delivery") throw new AppError(403, "DELIVERY_TOKEN_REQUIRED", "In-process reads take a delivery token (or none); this is an admin API token");
+		runtime.tokens.set(tokenKey, resolved);
+		principal = resolved;
+	}
+	return {
+		principal,
+		tokenKey,
+		tokenId: principal.tokenId
+	};
+};
+/**
+* Opens one in-process call the way the HTTP API opens a request: one statement reads the schema and
+* permissions versions, the site, the server's release and descriptor, and the token's liveness; the call
+* then sees the schema and the permissions at those versions (a change committed later applies from the next
+* call, so a model changed in the admin shows on the next call without a restart: rule 1).
+*/
+const openCallScope = async (runtime, { token, site: requestedKey }) => {
+	const caller = await callerOf(runtime, token);
+	let state;
+	const site = await resolveSite({
+		credentialSiteId: caller.principal.kind === "token" ? caller.principal.siteId ?? void 0 : void 0,
+		requestedKey
+	}, async (lookup) => {
+		state = await readState(runtime, lookup, caller.tokenId);
+		if (state.release !== SHAPIO_VERSION$1) throw new ShapioVersionSkewError$1(state.release, SHAPIO_VERSION$1);
+		return state.site;
+	});
+	if (!state) throw new Error("The site was resolved without reading the request state");
+	if (caller.tokenKey !== void 0) {
+		const live = state.token;
+		if (!live || live.revokedAt !== null || isTokenExpired(live.expiresAt, /* @__PURE__ */ new Date())) {
+			runtime.tokens.delete(caller.tokenKey);
+			throw invalidToken();
+		}
+	}
+	if (state.descriptor === null) throw new AppError(503, "SERVER_NOT_STARTED", "Start the Shapio server of this release once");
+	const versions = {
+		schemaVersion: state.schemaVersion,
+		permissionsVersion: state.permissionsVersion
+	};
+	const principal = principalForSite(caller.principal, site.id);
+	const [network, media] = await Promise.all([runtime.registry.getSnapshot(void 0, versions), runtime.mediaFor(state.descriptor)]);
+	return buildContentContext({
+		db: runtime.db,
+		network,
+		permissions: scopePermissions(runtime.permissions, principal, versions),
+		actor: principal,
+		site,
+		media
+	});
+};
+//#endregion
+//#region ../../apps/api/src/delivery/request.ts
+const decodeSegment = (segment) => {
+	try {
+		return decodeURIComponent(segment);
+	} catch {
+		return;
+	}
+};
+const routeOf = (segments) => {
+	const [api, group, first, second, ...rest] = segments;
+	if (api !== "api" || rest.length > 0) return;
+	if (group === "content" && first) {
+		const routeKey = decodeSegment(first);
+		if (routeKey === void 0) return;
+		if (second === void 0) return {
+			kind: "list",
+			routeKey
+		};
+		const id = decodeSegment(second);
+		return id ? {
+			kind: "item",
+			routeKey,
+			id
+		} : void 0;
+	}
+	if (group === "site" && first === void 0) return { kind: "site" };
+	if (group === "snapshots" && second === void 0) {
+		if (first === "current") return { kind: "snapshotCurrent" };
+		if (first === "changes") return { kind: "snapshotChanges" };
+	}
+};
+/** Matches a delivery read; undefined for any other method or path. */
+const matchDeliveryRequest = (method, path) => {
+	if (method.toUpperCase() !== "GET") return;
+	const index = path.indexOf("?");
+	const pathname = index === -1 ? path : path.slice(0, index);
+	const rawQuery = index === -1 ? "" : path.slice(index + 1);
+	if (!pathname.startsWith("/")) return;
+	const route = routeOf(pathname.slice(1).split("/"));
+	if (!route) return;
+	const site = new URLSearchParams(rawQuery).get("site") || void 0;
+	return {
+		route,
+		query: withoutSiteParameter(rawQuery),
+		site
+	};
+};
+const notAvailable = (method, path) => new ShapioApiError(404, { error: {
+	code: "NOT_AVAILABLE_IN_PROCESS",
+	message: `${method.toUpperCase()} ${path.split("?")[0] ?? path} is not available in process; only delivery reads are`
+} });
+/** The site a call reads: the path's `?site=` or the credentials' site; both must agree. */
+const siteOf = (pathSite, credentialsSite) => {
+	if (pathSite !== void 0 && credentialsSite !== void 0 && pathSite !== credentialsSite) throw new AppError(403, "SITE_MISMATCH", "The site option and ?site= name different sites");
+	return pathSite ?? credentialsSite;
+};
+/** `?from&to&after&limit`, coerced and checked against the HTTP route's own schema. */
+const snapshotChangesQuery = (rawQuery) => {
+	const value = Value.Convert(SnapshotChangesQuerySchema, Object.fromEntries(new URLSearchParams(rawQuery)));
+	if (Value.Check(SnapshotChangesQuerySchema, value)) return value;
+	const validation = Value.Errors(SnapshotChangesQuerySchema, value).map(({ instancePath, message, params }) => ({
+		instancePath,
+		message,
+		params
+	}));
+	const [first] = validation;
+	throw Object.assign(/* @__PURE__ */ new Error(`querystring${first?.instancePath ?? ""} ${first?.message ?? "is invalid"}`), {
+		statusCode: 400,
+		validation
+	});
+};
+/**
+* Values exactly as the HTTP API sends them: a JSON round trip, as the server serializes them. Dates become ISO
+* strings, `undefined` members disappear, and so do symbol-keyed members (a delivered rich-text value carries
+* its HTML renderer for GraphQL behind a symbol), so a caller gets plain data that holds nothing else.
+*/
+const asJson = (value) => JSON.parse(JSON.stringify(value));
+const dispatch = async (context, { route, query }) => {
+	switch (route.kind) {
+		case "list": return listDelivery(context, apiKeyOfRoute(context.snapshot, route.routeKey), query);
+		case "item": return getDelivery(context, apiKeyOfRoute(context.snapshot, route.routeKey), route.id, query);
+		case "site": return getDeliverySite(context);
+		case "snapshotCurrent": return currentSnapshot(context);
+		case "snapshotChanges": return listSnapshotChanges(context, snapshotChangesQuery(query));
+	}
+};
+/**
+* A `RequestFn` that answers delivery reads in this process, as `credentials` (a delivery token or none, and
+* a site). With `onVersionSkew: 'http'`, a call refused for a release mismatch is sent to the server instead.
+*/
+const createInProcessRequest = (runtime, credentials) => {
+	let fallback;
+	let warnedSkew = false;
+	const fallbackRequest = () => {
+		if (runtime.onVersionSkew !== "http" || runtime.fallbackUrl === void 0) return;
+		fallback ??= createClient({
+			baseUrl: runtime.fallbackUrl,
+			...credentials.token !== void 0 ? { token: credentials.token } : {},
+			...credentials.site !== void 0 ? { site: credentials.site } : {}
+		}).request;
+		return fallback;
+	};
+	return async (path, options = {}) => {
+		const method = options.method ?? "GET";
+		const matched = matchDeliveryRequest(method, path);
+		if (!matched) throw notAvailable(method, path);
+		try {
+			const site = siteOf(matched.site, credentials.site);
+			const context = await openCallScope(runtime, {
+				...credentials.token !== void 0 ? { token: credentials.token } : {},
+				...site !== void 0 ? { site } : {}
+			});
+			const result = asJson(await dispatch(context, matched));
+			warnedSkew = false;
+			return result;
+		} catch (error) {
+			const http = error instanceof ShapioVersionSkewError$1 ? fallbackRequest() : void 0;
+			if (http && error instanceof ShapioVersionSkewError$1) {
+				if (!warnedSkew) {
+					warnedSkew = true;
+					runtime.log.warn({
+						serverRelease: error.serverRelease,
+						libraryRelease: error.libraryRelease
+					}, "release mismatch; reading over HTTP until the releases match");
+				}
+				return http(path, options);
+			}
+			throw toShapioApiError(error, runtime.log);
+		}
+	};
+};
+//#endregion
+//#region ../../apps/api/src/helpers/publicUrl.ts
+var InvalidUrlPathError = class extends Error {
+	constructor(path) {
+		super(`Expected an app-relative path starting with a single "/", got ${JSON.stringify(path)}`);
+		this.name = "InvalidUrlPathError";
+	}
+};
+const assertRelativePath = (path) => {
+	if (!path.startsWith("/") || path.startsWith("//")) throw new InvalidUrlPathError(path);
+};
+const createUrlBuilder = ({ publicUrl, basePath }) => {
+	const origin = publicUrl.replace(/\/+$/, "");
+	const withBasePath = (path) => {
+		assertRelativePath(path);
+		return `${basePath}${path}`;
+	};
+	return {
+		publicUrl: origin,
+		basePath,
+		withBasePath,
+		absoluteUrl: (path) => `${origin}${withBasePath(path)}`,
+		originUrl: (rawUrl) => {
+			const safe = rawUrl.startsWith("/") ? rawUrl.replace(/^\/+/, "/") : "/";
+			return `${origin}${safe}`;
+		}
+	};
+};
+//#endregion
+//#region ../../apps/api/src/media/signing.ts
+const sign = (secret, purpose, subject, expiresAt) => createHmac("sha256", secret).update(`${purpose}\n${subject}\n${expiresAt}`).digest("base64url");
+/** `expiresAt` is in Unix seconds. */
+const signMediaGet = (secret, key, expiresAt) => sign(secret, "media-get", key, expiresAt);
+//#endregion
+//#region ../../apps/api/src/media/localAdapter.ts
+const isNotFound = (error) => error instanceof Error && "code" in error && error.code === "ENOENT";
+/**
+* Files under MEDIA_PATH, served by Shapio itself: public objects at a stable URL, private ones only with
+* an HMAC-signed, expiring URL. Writes go to a temporary file and are renamed into place, so a reader never
+* sees half a file.
+*/
+const createLocalAdapter = ({ root, urls, signingSecret, publicBaseUrl }) => {
+	const pathOf = (key) => {
+		const path = resolve(root, key);
+		if (!isValidStorageKey(key) || relative(root, path).startsWith("..") || !path.startsWith(root + sep)) throw new InvalidStorageKeyError(key);
+		return path;
+	};
+	const statOrThrow = async (key) => {
+		try {
+			return await stat(pathOf(key));
+		} catch (error) {
+			throw isNotFound(error) ? new ObjectNotFoundError(key, { cause: error }) : error;
+		}
+	};
+	/** Removes now-empty directories up to the asset folder; a non-empty one stops the walk. */
+	const pruneEmptyParents = async (path) => {
+		let directory = dirname(path);
+		while (directory.startsWith(root + sep) && relative(root, directory).split(sep).length > 1) {
+			try {
+				await rmdir(directory);
+			} catch {
+				return;
+			}
+			directory = dirname(directory);
+		}
+	};
+	return {
+		driver: "local",
+		put: async (key, body) => {
+			const path = pathOf(key);
+			await mkdir(dirname(path), { recursive: true });
+			const temporary = `${path}.${randomBytes(6).toString("hex")}.tmp`;
+			try {
+				if (Buffer.isBuffer(body)) await writeFile(temporary, body);
+				else await pipeline(body, createWriteStream(temporary));
+				await rename(temporary, path);
+			} catch (error) {
+				await rm(temporary, { force: true });
+				throw error;
+			}
+		},
+		getStream: async (key, range) => {
+			await statOrThrow(key);
+			return createReadStream(pathOf(key), range ? {
+				start: range.start,
+				end: range.end
+			} : {});
+		},
+		head: async (key) => {
+			try {
+				return {
+					size: (await statOrThrow(key)).size,
+					contentType: void 0
+				};
+			} catch (error) {
+				if (error instanceof ObjectNotFoundError) return;
+				throw error;
+			}
+		},
+		exists: async (key) => {
+			try {
+				await statOrThrow(key);
+				return true;
+			} catch (error) {
+				if (error instanceof ObjectNotFoundError) return false;
+				throw error;
+			}
+		},
+		delete: async (key) => {
+			const path = pathOf(key);
+			await rm(path, { force: true });
+			await pruneEmptyParents(path);
+		},
+		signedGetUrl: async (key, { expiresInSeconds }) => {
+			if (!signingSecret) throw new Error("The local media adapter was created without a signing secret");
+			pathOf(key);
+			const expiresAt = Math.floor(Date.now() / 1e3) + expiresInSeconds;
+			const signature = signMediaGet(signingSecret, key, expiresAt);
+			return urls.absoluteUrl(`${MEDIA_FILE_ROUTE_PREFIX}${encodeKeyPath(key)}?expires=${expiresAt}&signature=${signature}`);
+		},
+		publicUrl: (key) => publicBaseUrl ? `${publicBaseUrl}/${encodeKeyPath(key)}` : void 0
+	};
+};
+//#endregion
+//#region ../../apps/api/src/media/storage.ts
+var StorageNotConfiguredError = class extends Error {
+	constructor(driver) {
+		super(driver === "s3" ? "Media is stored on S3 but STORAGE_S3_BUCKET is not set" : `Storage driver ${driver} is not configured`);
+		this.name = "StorageNotConfiguredError";
+	}
+};
+/**
+* Every adapter this instance can reach. Local disk is always available; S3 whenever its bucket is set,
+* whatever STORAGE_DRIVER says, so assets keep being served while `shapio media migrate` moves them. The S3
+* adapter (and the AWS SDK) is loaded only then.
+*/
+const createMediaStorage = async (config, deps) => {
+	const adapters = /* @__PURE__ */ new Map();
+	adapters.set("local", createLocalAdapter({
+		root: config.mediaPath,
+		urls: deps.urls,
+		signingSecret: deps.signingSecret,
+		publicBaseUrl: config.publicBaseUrl
+	}));
+	if (config.s3) {
+		const { createS3Adapter } = await import("./s3Adapter-BqCKtI3Y.js");
+		adapters.set("s3", createS3Adapter({
+			config: config.s3,
+			publicBaseUrl: config.publicBaseUrl
+		}));
+	}
+	const get = (driver) => {
+		const adapter = adapters.get(driver);
+		if (!adapter) throw new StorageNotConfiguredError(driver);
+		return adapter;
+	};
+	return {
+		active: get(config.driver),
+		get,
+		has: (driver) => adapters.has(driver)
+	};
+};
+//#endregion
+//#region ../../apps/api/src/repositories/appRoles.ts
+const PERMISSION_COLUMNS = [
+	"role_id",
+	"action",
+	"model_id",
+	"condition",
+	"field_ids"
+];
+/** Every grant of every app role; the permission cache loads them with the admin grants (small table). */
+const listAllPermissions = (trx = db) => trx.selectFrom("app_role_permissions").select(PERMISSION_COLUMNS).execute();
+//#endregion
+//#region ../../apps/api/src/repositories/siteAppRoles.ts
+/** Every binding on every site (the permission cache holds them all, like the grants). */
+const listAll = (trx = db) => trx.selectFrom("site_app_roles").select([
+	"site_id",
+	"audience",
+	"role_id"
+]).execute();
+//#endregion
+//#region ../../apps/api/src/permissions/cache.ts
+const bindingKey = (siteId, audience) => `${siteId}:${audience}`;
+const groupBindings = (rows) => {
+	const bindings = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const key = bindingKey(row.site_id, row.audience);
+		bindings.set(key, [...bindings.get(key) ?? [], row.role_id]);
+	}
+	return bindings;
+};
+const KNOWN_ACTIONS = /* @__PURE__ */ new Set([...CONTENT_ACTIONS, ...GLOBAL_ACTIONS]);
+const KNOWN_CONDITIONS = /* @__PURE__ */ new Set(["ownedByPrincipal"]);
+/**
+* A stored grant as this build understands it. Rows written by a newer Shapio may name an action or a row
+* condition this build does not know; they grant nothing here (fail closed). An unknown condition must never
+* read as "no condition", which would widen the grant to every row.
+*/
+const toGrant = (row) => {
+	if (!KNOWN_ACTIONS.has(row.action)) return;
+	if (row.condition !== null && !KNOWN_CONDITIONS.has(row.condition)) return;
+	return {
+		roleId: row.role_id,
+		action: row.action,
+		modelId: row.model_id,
+		condition: row.condition,
+		fieldIds: row.field_ids
+	};
+};
+const groupByRole = (grants) => {
+	const byRole = /* @__PURE__ */ new Map();
+	for (const grant of grants) {
+		const list = byRole.get(grant.roleId) ?? [];
+		list.push(grant);
+		byRole.set(grant.roleId, list);
+	}
+	return byRole;
+};
+/**
+* Every role's grants, held in memory and reloaded when `system_versions.permissions_version` moves.
+* The version is checked on every lookup: read here, or read once by the request (`versions`, see
+* `KnownVersions`). That durable check is what makes a permission change visible to every instance from the
+* next request (NOTIFY would only be an optimisation). Lookups on the pool share one reload; a
+* lookup inside a transaction reads (and, when stale, reloads) through that transaction alone, never
+* through a reload running on another request's transaction.
+*/
+const createPermissionCache = (database) => {
+	let snapshot;
+	let reloading;
+	const reload = async (version, executor) => {
+		const grants = [...await listAllPermissions$1(executor), ...await listAllPermissions(executor)].map(toGrant).filter((grant) => grant !== void 0);
+		const bindings = groupBindings(await listAll(executor));
+		return {
+			version,
+			byRole: groupByRole(grants),
+			bindings
+		};
+	};
+	const sharedReload = (version) => reloading ??= reload(version, database).finally(() => {
+		reloading = void 0;
+	});
+	const current = async (executor, versions) => {
+		const version = versions?.permissionsVersion ?? await getPermissionsVersion(executor ?? database);
+		if (snapshot && snapshot.version === version) return snapshot;
+		const loaded = await (executor ? reload(version, executor) : sharedReload(version));
+		if (!snapshot || loaded.version >= snapshot.version) snapshot = loaded;
+		return loaded;
+	};
+	return {
+		getGrants: async (roleIds, executor, versions) => {
+			if (roleIds.length === 0) return [];
+			const { byRole } = await current(executor, versions);
+			return roleIds.flatMap((roleId) => byRole.get(roleId) ?? []);
+		},
+		getSiteAppRoleIds: async (siteId, audience, executor, versions) => {
+			const { bindings } = await current(executor, versions);
+			return bindings.get(bindingKey(siteId, audience)) ?? [];
+		}
+	};
+};
+//#endregion
+//#region ../../apps/api/src/permissions/appRoles.ts
+/**
+* What app roles may grant: content actions only. Schema management and every instance-level action stay
+* with admin roles, whatever an app role row says.
+*/
+const APP_CONTENT_ACTIONS = [
+	"read",
+	"create",
+	"update",
+	"delete",
+	"publish"
+];
+//#endregion
+//#region ../../apps/api/src/permissions/policy.ts
+const EMPTY_MASK = {
+	mode: "only",
+	fieldIds: []
+};
+const ALLOW_ALL_POLICY = Object.freeze({
+	allowed: true,
+	rowFilter: null,
+	readMask: { mode: "all" },
+	writeMask: { mode: "all" }
+});
+const WRITE_ACTIONS = /* @__PURE__ */ new Set(["create", "update"]);
+const grantsFor = (grants, action, modelId) => grants.filter((grant) => grant.action === action && (grant.modelId === null || grant.modelId === modelId));
+/** Rows: the union of what each grant allows. Any unconditional grant means no restriction. */
+const combineRowFilters = (grants) => {
+	if (grants.some((grant) => grant.condition === null)) return null;
+	const filters = [...new Set(grants.map((grant) => grant.condition))].filter((kind) => kind !== null).map((kind) => ({ kind }));
+	if (filters.length === 1 && filters[0]) return filters[0];
+	return {
+		kind: "or",
+		filters
+	};
+};
+/**
+* Fields: the union of what each grant allows. For delivery audiences a wildcard grant expands to the
+* model's public fields, so `public: false` fields stay hidden unless a grant names them. Delivery masks
+* are always explicit lists, so a field added after evaluation is never exposed by accident.
+*/
+const combineFieldMasks = (grants, audience, fields) => {
+	if (grants.length === 0) return EMPTY_MASK;
+	const hasWildcard = grants.some((grant) => grant.fieldIds === null);
+	if (audience === "admin" && hasWildcard) return { mode: "all" };
+	const named = new Set(grants.flatMap((grant) => grant.fieldIds ?? []));
+	if (audience === "delivery") return {
+		mode: "only",
+		fieldIds: (fields ?? []).filter((field) => named.has(field.id) || hasWildcard && field.public).map((field) => field.id)
+	};
+	return {
+		mode: "only",
+		fieldIds: [...named].sort()
+	};
+};
+/**
+* The policy for one (action, model) request from a principal's grants. Pure: no I/O, so it is unit- and
+* property-tested directly. Deny by default: no matching grant, no access.
+*/
+const buildPolicy = (grants, request, audience, fields) => {
+	if (audience === "delivery" && fields === void 0) return DENIED_POLICY;
+	const matching = grantsFor(grants, request.action, request.modelId);
+	if (matching.length === 0) return DENIED_POLICY;
+	const readGrants = request.action === "read" ? matching : grantsFor(grants, "read", request.modelId);
+	return {
+		allowed: true,
+		rowFilter: combineRowFilters(matching),
+		readMask: combineFieldMasks(readGrants, audience, fields),
+		writeMask: WRITE_ACTIONS.has(request.action) ? combineFieldMasks(matching, audience, fields) : EMPTY_MASK
+	};
+};
+/** Global actions are granted only by a grant on that action with no model. */
+const allowsGlobalAction = (grants, action) => grants.some((grant) => grant.action === action && grant.modelId === null);
+//#endregion
+//#region ../../apps/api/src/permissions/evaluator.ts
+const NETWORK_ACTION_SET = new Set(NETWORK_ACTIONS);
+const READ_ONLY = /* @__PURE__ */ new Set(["read"]);
+const APP_ACTIONS = new Set(APP_CONTENT_ACTIONS);
+/**
+* Which roles a principal holds and how its masks are computed. App users hold the custom app roles assigned
+* to them plus the roles their site binds to `authenticated`; anonymous callers hold the roles the request's
+* site binds to `public` (`site_app_roles`: a site that binds nothing grants nothing, and an anonymous caller
+* outside a site holds no role). Both are delivery audiences: they see `public: false` fields only where a
+* grant names them.
+*/
+const rolesOf = async (principal, grants, executor, versions) => {
+	switch (principal.kind) {
+		case "system": return "all";
+		case "admin": return {
+			roleIds: principal.roleIds,
+			networkRoleIds: principal.networkRoleIds,
+			audience: "admin",
+			actions: "all"
+		};
+		case "token": return principal.scope === "admin" ? {
+			roleIds: [principal.roleId],
+			networkRoleIds: tokenNetworkRoleIds(principal),
+			audience: "admin",
+			actions: "all"
+		} : {
+			roleIds: [principal.roleId],
+			networkRoleIds: [],
+			audience: "delivery",
+			actions: READ_ONLY
+		};
+		case "appUser": return {
+			roleIds: [...await grants.getSiteAppRoleIds(principal.siteId, "authenticated", executor, versions), ...principal.roleIds],
+			networkRoleIds: [],
+			audience: "delivery",
+			actions: APP_ACTIONS
+		};
+		case "anonymous": return {
+			roleIds: principal.siteId === null ? [] : await grants.getSiteAppRoleIds(principal.siteId, "public", executor, versions),
+			networkRoleIds: [],
+			audience: "delivery",
+			actions: APP_ACTIONS
+		};
+	}
+};
+/**
+* Whether the principal acts on `siteId`: an admin narrowed to it, a site token of it, or a network token
+* (whose role applies on every site). Never an app user or anonymous caller (schema actions are admin-only).
+*/
+const actsOnSite = (principal, siteId) => {
+	switch (principal.kind) {
+		case "admin": return principal.siteId === siteId;
+		case "token": return principal.scope === "admin" && (principal.siteId === null || principal.siteId === siteId);
+		default: return false;
+	}
+};
+/**
+* The one permission evaluator (ADR 0005): principal → roles → grants → Policy, for REST and GraphQL.
+* Deny by default at every step. `atVersions` gives the same evaluator for one request, whose caches are
+* checked against the versions the request read once instead of read again on every call.
+*/
+const createPermissionEvaluator = ({ grants, fields }) => {
+	const at = (versions) => ({
+		evaluate: async (principal, request, executor) => {
+			const roles = await rolesOf(principal, grants, executor, versions);
+			if (roles === "all") return ALLOW_ALL_POLICY;
+			if (roles.actions !== "all" && !roles.actions.has(request.action)) return DENIED_POLICY;
+			let roleIds = roles.roleIds;
+			if (NETWORK_CONTENT_ACTIONS.has(request.action)) {
+				const modelSite = await fields.getModelSite(request.modelId, executor, versions);
+				roleIds = modelSite !== null && actsOnSite(principal, modelSite) ? roles.roleIds : roles.networkRoleIds;
+			}
+			const held = await grants.getGrants(roleIds, executor, versions);
+			if (held.length === 0) return DENIED_POLICY;
+			const modelFields = roles.audience === "delivery" ? await fields.getModelFields(request.modelId, executor, versions) : void 0;
+			return buildPolicy(held, request, roles.audience, modelFields);
+		},
+		canPerform: async (principal, action, executor) => {
+			const roles = await rolesOf(principal, grants, executor, versions);
+			if (roles === "all") return true;
+			if (roles.audience === "delivery") return false;
+			const roleIds = NETWORK_ACTION_SET.has(action) ? roles.networkRoleIds : roles.roleIds;
+			return allowsGlobalAction(await grants.getGrants(roleIds, executor, versions), action);
+		},
+		canPerformOnSite: async (principal, action, siteId, executor) => {
+			const roles = await rolesOf(principal, grants, executor, versions);
+			if (roles === "all") return true;
+			if (roles.audience === "delivery") return false;
+			const counted = !NETWORK_ACTION_SET.has(action) || SITE_GRANTABLE_ACTIONS.has(action) && actsOnSite(principal, siteId) ? roles.roleIds : roles.networkRoleIds;
+			return allowsGlobalAction(await grants.getGrants(counted, executor, versions), action);
+		},
+		atVersions: at
+	});
+	return at(void 0);
+};
+//#endregion
+//#region ../../apps/api/src/repositories/systemSettings.ts
+const findValue = async (key, trx = db) => (await trx.selectFrom("system_settings").select("value").where("key", "=", key).executeTakeFirst())?.value;
+//#endregion
+//#region ../../apps/api/src/schema/fieldVisibility.ts
+/**
+* The permission evaluator's view of field visibility (`public` flags), served from the active schema.
+* Uses the durable version check on every call (or the version the request read once, `versions`), so a
+* field made non-public is hidden on every instance from the next request, whether or not it got the
+* notification. Deprecated fields are reported as non-public: they are hidden from the API unless a role
+* names them explicitly. Components are not delivery models.
+*/
+const createSchemaFieldVisibility = (registry) => {
+	const activeModel = async (modelId, executor, versions) => {
+		const active = (await registry.getSnapshot(executor, versions)).byId.get(modelId);
+		return active && active.definition.kind !== "component" ? active.definition : void 0;
+	};
+	return {
+		getModelFields: async (modelId, executor, versions) => (await activeModel(modelId, executor, versions))?.fields.map((field) => ({
+			id: field.id,
+			public: field.public && !field.deprecated
+		})),
+		hasModel: async (modelId, executor, versions) => await activeModel(modelId, executor, versions) !== void 0,
+		getModelSite: async (modelId, executor, versions) => (await registry.getSnapshot(executor, versions)).scopeOf(modelId) ?? null
+	};
+};
+//#endregion
+//#region ../../apps/api/src/repositories/locales.ts
+const COLUMNS = [
+	"code",
+	"label",
+	"is_default",
+	"fallbacks",
+	"created_at",
+	"updated_at"
+];
+const list = (executor = db) => executor.selectFrom("locales").select(COLUMNS).orderBy("is_default", "desc").orderBy("code").execute();
+//#endregion
+//#region ../../apps/api/src/schema/snapshot.ts
+/**
+* On a collision the model whose API ID is the route key keeps it (a singleton keeps the URL it always
+* had); otherwise the first definition does. Deterministic, so every instance serves the same model.
+*/
+const indexByRouteKey = (definitions) => {
+	const modelsByRouteKey = /* @__PURE__ */ new Map();
+	const routeKeyCollisions = [];
+	for (const active of definitions) {
+		if (isComponentDefinition(active.definition)) continue;
+		const routeKey = routeKeyOf(active.definition);
+		const existing = modelsByRouteKey.get(routeKey);
+		if (!existing) {
+			modelsByRouteKey.set(routeKey, active);
+			continue;
+		}
+		const [served, hidden] = active.definition.apiKey === routeKey ? [active, existing] : [existing, active];
+		modelsByRouteKey.set(routeKey, served);
+		routeKeyCollisions.push({
+			routeKey,
+			servedApiKey: served.definition.apiKey,
+			hiddenApiKey: hidden.definition.apiKey
+		});
+	}
+	return {
+		modelsByRouteKey,
+		routeKeyCollisions
+	};
+};
+const byIdPart = (version, definitions, locales) => {
+	const byId = new Map(definitions.map((active) => [active.definition.id, active]));
+	const all = definitions.map((active) => active.definition);
+	const dependents = /* @__PURE__ */ new Map();
+	return {
+		version,
+		definitions,
+		byId,
+		scopeOf: (id) => byId.get(id)?.siteId,
+		locales,
+		defaultLocale: locales.find((locale) => locale.isDefault)?.code ?? "en",
+		dependentModelIds: (componentId) => {
+			let ids = dependents.get(componentId);
+			if (!ids) {
+				ids = findDependentModels(all, componentId).map((definition) => definition.id);
+				dependents.set(componentId, ids);
+			}
+			return ids;
+		}
+	};
+};
+const buildView = (network, siteId, definitions) => {
+	const modelsByApiKey = /* @__PURE__ */ new Map();
+	const componentsByApiKey = /* @__PURE__ */ new Map();
+	for (const active of definitions) (isComponentDefinition(active.definition) ? componentsByApiKey : modelsByApiKey).set(active.definition.apiKey, active);
+	const { modelsByRouteKey, routeKeyCollisions } = indexByRouteKey(definitions);
+	return Object.freeze({
+		...byIdPart(network.version, definitions, network.locales),
+		siteId,
+		modelsByApiKey,
+		modelsByRouteKey,
+		routeKeyCollisions,
+		componentsByApiKey,
+		network
+	});
+};
+/** The full schema at one version; views are built on first use and kept for the snapshot's lifetime. */
+const buildNetworkSchema = (version, definitions, locales) => {
+	const views = /* @__PURE__ */ new Map();
+	const viewOf = (siteId) => {
+		let view = views.get(siteId);
+		if (!view) {
+			view = buildView(network, siteId, definitions.filter((active) => active.siteId === null || active.siteId === siteId));
+			views.set(siteId, view);
+		}
+		return view;
+	};
+	const network = Object.freeze({
+		...byIdPart(version, definitions, locales),
+		forSite: (siteId) => viewOf(siteId),
+		shared: () => viewOf(null)
+	});
+	return network;
+};
+/** The sites whose views hold a definition of `definitions` (null: the shared definitions). */
+const siteIdsOf = (definitions) => [...new Set(definitions.flatMap((active) => active.siteId === null ? [] : [active.siteId]))];
+//#endregion
+//#region ../../apps/api/src/schema/storedDefinition.ts
+/**
+* A stored definition with a hash that matches it: the stored hash, or, when a plural API ID was filled,
+* the hash of the filled definition (the hash a pull of it records, so pull → apply shows no change).
+*/
+const readStoredRevision = async (stored, hash) => {
+	const { definition, filled } = withDerivedPlural(stored);
+	return {
+		definition,
+		hash: filled ? await hashDefinition(definition) : hash
+	};
+};
+//#endregion
+//#region ../../apps/api/src/schema/loadSnapshot.ts
+const toLocaleDefinition = (row) => ({
+	code: row.code,
+	label: row.label,
+	isDefault: row.is_default,
+	fallbacks: row.fallbacks
+});
+const toActiveDefinition = async (row) => ({
+	...await readStoredRevision(row.definition, row.hash),
+	siteId: row.siteId,
+	version: row.version,
+	revisionId: row.revisionId,
+	activatedAt: row.activatedAt
+});
+const toActiveDefinitions = (rows) => Promise.all(rows.map(toActiveDefinition));
+/** The schema as the executor sees it (inside an activation transaction: the state right after the flip). */
+const readSnapshot = async (executor) => {
+	const version = await getSchemaVersion(executor);
+	const rows = await findActiveDefinitions(executor);
+	const locales = await list(executor);
+	return buildNetworkSchema(version, await toActiveDefinitions(rows), locales.map(toLocaleDefinition));
+};
+/**
+* Reads the global version, every active definition and the locales in one REPEATABLE READ transaction,
+* so the snapshot is exactly the state at that version even if an activation commits meanwhile.
+*/
+const loadSnapshot = (db) => db.transaction().setIsolationLevel("repeatable read").setAccessMode("read only").execute((trx) => readSnapshot(trx));
+//#endregion
+//#region ../../apps/api/src/schema/registry.ts
+const createSchemaRegistry = ({ db, log }) => {
+	let cached;
+	let loading;
+	let closed = false;
+	/** Reloads started by `hint`, which nobody else awaits. */
+	const background = /* @__PURE__ */ new Set();
+	const listeners = /* @__PURE__ */ new Set();
+	const publish = (snapshot) => {
+		if (cached && cached.version >= snapshot.version) return cached;
+		cached = snapshot;
+		const views = [snapshot.shared(), ...siteIdsOf(snapshot.definitions).map((id) => snapshot.forSite(id))];
+		for (const view of views) for (const collision of view.routeKeyCollisions) log.error({
+			...collision,
+			siteId: view.siteId,
+			schemaVersion: snapshot.version
+		}, "two models share a delivery route key; set a plural API ID on the hidden one");
+		for (const listener of listeners) try {
+			listener(snapshot);
+		} catch (error) {
+			log.error({
+				err: error,
+				schemaVersion: snapshot.version
+			}, "schema change listener failed");
+		}
+		return snapshot;
+	};
+	/** Single-flight: concurrent callers share one load; a load that turns out too old is repeated. */
+	const loadAtLeast = async (version) => {
+		for (;;) {
+			loading ??= loadSnapshot(db).finally(() => {
+				loading = void 0;
+			});
+			const snapshot = publish(await loading);
+			if (snapshot.version >= version) return snapshot;
+		}
+	};
+	return {
+		getSnapshot: async (executor, versions) => {
+			const version = versions?.schemaVersion ?? await getSchemaVersion(executor ?? db);
+			if (cached && cached.version >= version) return cached;
+			return executor ? readSnapshot(executor) : loadAtLeast(version);
+		},
+		peek: () => cached,
+		hint: (version) => {
+			if (closed || version !== void 0 && cached && cached.version >= version) return;
+			const reload = loadAtLeast(version ?? 0).then(() => void 0, (error) => {
+				log.warn({ err: error }, "schema snapshot refresh failed; the next request will retry");
+			});
+			background.add(reload);
+			reload.finally(() => background.delete(reload));
+		},
+		onChange: (listener) => {
+			listeners.add(listener);
+			return () => listeners.delete(listener);
+		},
+		close: async () => {
+			closed = true;
+			await Promise.all(background);
+		}
+	};
+};
+//#endregion
+//#region ../../apps/api/src/services/deliveryDescriptor.ts
+/**
+* What an in-process delivery reader (plan next-in-process §2) needs from the server's configuration to answer
+* exactly as the server does, without its environment: where Shapio is served (absolute media URLs) and where
+* media lives. Never a secret: S3 credentials and the signing secret are the reader's own options.
+*/
+const DeliveryDescriptorSchema = Type.Object({
+	format: Type.Literal(1),
+	publicUrl: Type.String(),
+	basePath: Type.String(),
+	media: Type.Object({
+		publicBaseUrl: Type.Union([Type.String(), Type.Null()]),
+		s3: Type.Union([Type.Object({
+			bucket: Type.String(),
+			region: Type.Union([Type.String(), Type.Null()]),
+			endpoint: Type.Union([Type.String(), Type.Null()]),
+			forcePathStyle: Type.Boolean()
+		}), Type.Null()])
+	})
+});
+var InvalidDeliveryDescriptorError = class extends Error {
+	constructor(options) {
+		super("The delivery descriptor stored by the Shapio server is not readable by this release", options);
+		this.name = "InvalidDeliveryDescriptorError";
+	}
+};
+/** Parses the stored descriptor; throws when it is not in a format this release reads. */
+const parseDeliveryDescriptor = (stored) => {
+	let value;
+	try {
+		value = JSON.parse(stored);
+	} catch (error) {
+		throw new InvalidDeliveryDescriptorError({ cause: error });
+	}
+	if (!Value.Check(DeliveryDescriptorSchema, value)) throw new InvalidDeliveryDescriptorError();
+	return value;
+};
+//#endregion
+//#region ../../apps/api/src/delivery/runtime.ts
+/** One runtime per database per process, kept on `globalThis` so a re-evaluated module (dev reloads, a
+* bundler's second copy) never opens a second pool. */
+const RUNTIMES = Symbol.for("shapio.delivery");
+const runtimes = () => {
+	const holder = globalThis;
+	holder[RUNTIMES] ??= /* @__PURE__ */ new Map();
+	return holder[RUNTIMES];
+};
+const DEFAULT_POOL_MAX = 4;
+/** Local media is never read from disk here; the adapter only builds URLs. Any file access fails loudly. */
+const NO_LOCAL_MEDIA_ROOT = resolve("/", ".shapio-in-process-has-no-media");
+const storageConfigOf = (descriptor, credentials) => {
+	const { s3 } = descriptor.media;
+	return {
+		driver: "local",
+		mediaPath: NO_LOCAL_MEDIA_ROOT,
+		s3: s3 ? {
+			bucket: s3.bucket,
+			region: s3.region ?? void 0,
+			endpoint: s3.endpoint ?? void 0,
+			forcePathStyle: s3.forcePathStyle,
+			accessKeyId: credentials?.accessKeyId,
+			secretAccessKey: credentials?.secretAccessKey
+		} : void 0,
+		publicBaseUrl: descriptor.media.publicBaseUrl ?? void 0,
+		maxUploadBytes: 0,
+		allowedTypes: []
+	};
+};
+const assertSupported = (options) => {
+	const dialect = dialectOfUrl(options.databaseUrl);
+	if (dialect === "sqlite") throw new DeliveryRuntimeError$1("In-process delivery needs PostgreSQL or MySQL: a SQLite database is served by one process only. Read over HTTP with @shapio/client's createClient instead");
+	if (dialect === void 0) throw new DeliveryRuntimeError$1("databaseUrl must be a postgres:// or mysql:// URL");
+	if (options.onVersionSkew === "http" && !options.fallbackUrl) throw new DeliveryRuntimeError$1("onVersionSkew: 'http' needs fallbackUrl, the Shapio server's URL");
+};
+const openRuntime = (options) => {
+	const log = options.logger ?? pino({ level: "warn" });
+	const db = createDb({
+		connectionString: options.databaseUrl,
+		poolMax: options.poolMax ?? DEFAULT_POOL_MAX,
+		...options.acquireTimeoutMs !== void 0 ? { acquireTimeoutMs: options.acquireTimeoutMs } : {},
+		applicationName: "shapio-in-process",
+		onIdleConnectionError: (error) => log.warn({ err: error }, "database connection lost; it will be replaced on the next query")
+	});
+	const ownsProcessHandle = !hasDb();
+	if (ownsProcessHandle) setDb(db);
+	const registryLog = log.child({ component: "schema-registry" });
+	const registry = createSchemaRegistry({
+		db,
+		log: registryLog
+	});
+	const permissions = createPermissionEvaluator({
+		grants: createPermissionCache(db),
+		fields: createSchemaFieldVisibility(registry)
+	});
+	let media;
+	let users = 0;
+	let closing;
+	const buildMedia = async (stored) => {
+		const descriptor = parseDeliveryDescriptor(stored);
+		const urls = createUrlBuilder(descriptor);
+		const signingSecret = options.signingSecret ?? await findValue("signing_secret", db);
+		return {
+			storage: await createMediaStorage(storageConfigOf(descriptor, options.s3Credentials), {
+				urls,
+				...signingSecret !== void 0 ? { signingSecret } : {}
+			}),
+			urls
+		};
+	};
+	const runtime = {
+		databaseUrl: options.databaseUrl,
+		db,
+		registry,
+		permissions,
+		log,
+		onVersionSkew: options.onVersionSkew ?? "throw",
+		fallbackUrl: options.fallbackUrl,
+		tokens: /* @__PURE__ */ new Map(),
+		mediaFor: (descriptor) => {
+			if (media?.descriptor !== descriptor) {
+				const dependencies = buildMedia(descriptor);
+				media = {
+					descriptor,
+					dependencies
+				};
+				dependencies.catch(() => {
+					if (media?.dependencies === dependencies) media = void 0;
+				});
+			}
+			return media.dependencies;
+		},
+		retain: () => {
+			users += 1;
+			let released = false;
+			return async () => {
+				if (released) return;
+				released = true;
+				users -= 1;
+				if (users === 0) await runtime.close();
+			};
+		},
+		close: () => {
+			closing ??= (async () => {
+				if (runtimes().get(options.databaseUrl) === runtime) runtimes().delete(options.databaseUrl);
+				await registry.close();
+				await db.destroy();
+				if (ownsProcessHandle) clearDb(db);
+			})();
+			return closing;
+		}
+	};
+	return runtime;
+};
+/**
+* The in-process delivery runtime for a database: created once per process and shared (the same URL returns
+* the same runtime; the first caller's options apply). A process reads one Shapio database: another URL is
+* refused. Nothing is read until the first call, so creating it never fails on a database that is down.
+*/
+const createDeliveryRuntime = (options) => {
+	assertSupported(options);
+	const all = runtimes();
+	const existing = all.get(options.databaseUrl);
+	if (existing) return existing;
+	const [other] = all.keys();
+	if (other !== void 0) throw new DeliveryRuntimeError$1(`This process already reads ${describeDatabaseTarget(other)} in process; one Shapio database per process`);
+	const created = openRuntime(options);
+	all.set(options.databaseUrl, created);
+	return created;
+};
+//#endregion
+//#region src/index.ts
+/** The Shapio release this package reads; the server must run the same one. */
+const SHAPIO_VERSION = SHAPIO_VERSION$1;
+/** Thrown (or 503 `VERSION_SKEW` caught as `ShapioApiError`) when the server runs another release. */
+const ShapioVersionSkewError = ShapioVersionSkewError$1;
+/** Thrown by `createLocalClient` for options it cannot serve (SQLite, an unknown URL, a second database). */
+const DeliveryRuntimeError = DeliveryRuntimeError$1;
+/**
+* Shapio's delivery API as function calls in this process: the `delivery`, `site` and `snapshots` groups of
+* `@shapio/client`, with the same paths, permissions, response shapes and `ShapioApiError`s, answered from the
+* database without an HTTP hop. Reads as `token` (a delivery API token) or, without one, as an anonymous
+* caller (the site's `public` role). Model changes made in the admin show on the next call.
+*
+* Needs PostgreSQL or MySQL, the Node.js runtime, and the same Shapio release as the server (`SHAPIO_VERSION`);
+* see `onVersionSkew`. Nothing is read until the first call.
+*/
+const createLocalClient = ({ token, site, ...runtimeOptions }) => {
+	assertNodeRuntime();
+	const runtime = createDeliveryRuntime(runtimeOptions);
+	const release = runtime.retain();
+	const request = createInProcessRequest(runtime, {
+		...token !== void 0 ? { token } : {},
+		...site !== void 0 ? { site } : {}
+	});
+	return {
+		...createDeliveryClient(request, site !== void 0 ? { site } : {}),
+		close: release
+	};
+};
+//#endregion
+export { DeliveryRuntimeError, SHAPIO_VERSION, ShapioVersionSkewError, createLocalClient };
+
+//# sourceMappingURL=index.js.map