@shapio/local 0.5.6 → 0.5.7

package/dist/index.js

@@ -1,5 +1,5 @@
-import { c as assertNotNested, d as toDatetimeText, f as AppError, i as createMysqlDb, l as withConnectionScope, n as createSqliteDb, o as DEFAULT_POOL_ACQUIRE_TIMEOUT_MS, s as pgAcquireError, t as lockKeyFromId, u as toStoredTimestamp } from "./advisoryLocks-COlJQc1r.js";
-import { i as isValidStorageKey, n as ObjectNotFoundError, r as encodeKeyPath, t as InvalidStorageKeyError } from "./errors-SK0PwPKC.js";
+import { c as assertNotNested, d as toDatetimeText, f as AppError, i as createMysqlDb, l as withConnectionScope, n as createSqliteDb, o as DEFAULT_POOL_ACQUIRE_TIMEOUT_MS, s as pgAcquireError, t as lockKeyFromId, u as toStoredTimestamp } from "./advisoryLocks-ajVNBhfa.js";
+import { a as visibilityOfKey, i as isValidStorageKey, n as ObjectNotFoundError, o as withVisibility, r as encodeKeyPath, t as InvalidStorageKeyError } from "./errors-nQvt9bs7.js";
 import { t as assertNodeRuntime } from "./nodeRuntime-DzuiHUhY.js";
 import { ShapioApiError, createClient, createDeliveryClient } from "@shapio/client";
 import { Value } from "typebox/value";
@@ -9,13 +9,13 @@ import { Kysely, PostgresDialect, sql } from "kysely";
 import { createHash, createHmac, randomBytes } from "node:crypto";
 import pg from "pg";
 import { dirname, relative, resolve, sep } from "node:path";
-import { pino } from "pino";
 import { createReadStream, createWriteStream } from "node:fs";
+import { pino } from "pino";
 import { mkdir, rename, rm, rmdir, stat, writeFile } from "node:fs/promises";
 import { pipeline } from "node:stream/promises";
 //#endregion
 //#region ../../apps/api/src/constants/version.ts
-const SHAPIO_VERSION$1 = "0.5.6";
+const SHAPIO_VERSION$1 = "0.5.7";
 //#endregion
 //#region ../../apps/api/src/helpers/errorResponse.ts
 const STATUS_CODES = {
@@ -255,13 +255,16 @@ const SITE_ACTIONS = [
 const GLOBAL_ACTIONS = [...NETWORK_ACTIONS, ...SITE_ACTIONS];
 const EMPTY_MASK$1 = {
 	mode: "only",
-	fieldIds: []
+	fieldIds: [],
+	componentFields: "public"
 };
 const DENIED_POLICY = Object.freeze({
 	allowed: false,
 	rowFilter: null,
 	readMask: EMPTY_MASK$1,
-	writeMask: EMPTY_MASK$1
+	rowReadMasks: null,
+	writeMask: EMPTY_MASK$1,
+	rowWriteMasks: null
 });
 //#endregion
 //#region ../../apps/api/src/routes/schemas/adminIdentity.ts
@@ -313,7 +316,13 @@ const AdminUserSchema = Type.Object({
 	roleIds: Type.Array(UuidSchema),
 	lastLoginAt: NullableDateTimeSchema,
 	createdAt: DateTimeSchema,
-	updatedAt: DateTimeSchema
+	updatedAt: DateTimeSchema,
+	/** Usable API tokens this admin created: refused while the account is disabled, revoked when it is deleted. */
+	apiTokens: Type.Array(Type.Object({
+		id: UuidSchema,
+		name: Type.String(),
+		siteId: Type.Union([UuidSchema, Type.Null()])
+	}, { additionalProperties: false }))
 });
 Type.Object({
 	user: AdminUserSchema,
@@ -357,7 +366,13 @@ const ERRORS = {
 	401: ErrorResponseSchema
 };
 const SnapshotChangesQuerySchema = Type.Object({
-	from: SeqSchema,
+	/** Exactly one of `from` and `recent`. */
+	from: Type.Optional(SeqSchema),
+	/** Start where the diff covers the last N entries the caller may read that went live or were updated. */
+	recent: Type.Optional(Type.Integer({
+		minimum: 1,
+		maximum: 100
+	})),
 	/** Defaults to the current snapshot. */
 	to: Type.Optional(SeqSchema),
 	/** `nextCursor` of the previous page. */
@@ -556,6 +571,117 @@ const canonicalBigInteger = (value) => {
 */
 const COMPONENT_KEY = "__component";
 //#endregion
+//#region ../../apps/api/src/permissions/policy.ts
+const EMPTY_MASK = {
+	mode: "only",
+	fieldIds: [],
+	componentFields: "public"
+};
+const ALLOW_ALL_POLICY = Object.freeze({
+	allowed: true,
+	rowFilter: null,
+	readMask: { mode: "all" },
+	rowReadMasks: null,
+	writeMask: { mode: "all" },
+	rowWriteMasks: null
+});
+const WRITE_ACTIONS = /* @__PURE__ */ new Set(["create", "update"]);
+const grantsFor = (grants, action, modelId) => grants.filter((grant) => grant.action === action && (grant.modelId === null || grant.modelId === modelId));
+/** Rows: the union of what each grant allows. Any unconditional grant means no restriction. */
+const combineRowFilters = (grants) => {
+	if (grants.some((grant) => grant.condition === null)) return null;
+	const filters = [...new Set(grants.map((grant) => grant.condition))].filter((kind) => kind !== null).map((kind) => ({ kind }));
+	if (filters.length === 1 && filters[0]) return filters[0];
+	return {
+		kind: "or",
+		filters
+	};
+};
+/**
+* Fields: the union of what each grant allows. For delivery audiences a wildcard grant expands to the
+* model's public fields, so `public: false` fields stay hidden unless a grant names them. Delivery masks
+* are always explicit lists, so a field added after evaluation is never exposed by accident. Grants name model
+* fields only, so inside components delivery audiences see the `public` fields alone, whatever they hold.
+*/
+const combineFieldMasks = (grants, audience, fields) => {
+	if (grants.length === 0) return EMPTY_MASK;
+	const hasWildcard = grants.some((grant) => grant.fieldIds === null);
+	if (audience === "admin" && hasWildcard) return { mode: "all" };
+	const named = new Set(grants.flatMap((grant) => grant.fieldIds ?? []));
+	if (audience === "delivery") return {
+		mode: "only",
+		fieldIds: (fields ?? []).filter((field) => named.has(field.id) || hasWildcard && field.public).map((field) => field.id),
+		componentFields: "public"
+	};
+	return {
+		mode: "only",
+		fieldIds: [...named].sort(),
+		componentFields: "all"
+	};
+};
+/** Fields either mask allows. */
+const unionMasks = (left, right) => left.mode === "all" || right.mode === "all" ? { mode: "all" } : {
+	mode: "only",
+	fieldIds: [.../* @__PURE__ */ new Set([...left.fieldIds, ...right.fieldIds])].sort(),
+	componentFields: left.componentFields === "all" || right.componentFields === "all" ? "all" : "public"
+};
+/** Fields both masks allow. */
+const intersectMasks = (left, right) => {
+	if (left.mode === "all") return right;
+	if (right.mode === "all") return left;
+	const kept = new Set(right.fieldIds);
+	return {
+		mode: "only",
+		fieldIds: left.fieldIds.filter((id) => kept.has(id)),
+		componentFields: left.componentFields === "all" && right.componentFields === "all" ? "all" : "public"
+	};
+};
+/** Whether `outer` allows every field `inner` allows. */
+const covers = (outer, inner) => outer.mode === "all" || inner.mode === "only" && inner.fieldIds.every((id) => outer.fieldIds.includes(id));
+/**
+* Field masks per row, for reads (issue #75) and writes (issue #80). Row access and field access are not
+* independent across grants: a field allowed only by a grant with a row condition is allowed only on rows
+* matching that condition. The mask for every row is that of the unconditioned grants; without any, the fields
+* every condition allows (each row the principal acts on matches at least one). null when every row the
+* principal acts on gets the same fields.
+*/
+const combineRowFieldMasks = (grants, audience, fields) => {
+	const kinds = [...new Set(grants.map((grant) => grant.condition))].filter((kind) => kind !== null);
+	if (kinds.length === 0) return null;
+	const byCondition = kinds.map((kind) => ({
+		condition: { kind },
+		mask: combineFieldMasks(grants.filter((grant) => grant.condition === kind), audience, fields)
+	}));
+	const unconditioned = grants.filter((grant) => grant.condition === null);
+	const everyRow = unconditioned.length > 0 ? combineFieldMasks(unconditioned, audience, fields) : byCondition.map((entry) => entry.mask).reduce(intersectMasks);
+	const when = byCondition.filter((entry) => !covers(everyRow, entry.mask));
+	return when.length === 0 ? null : {
+		everyRow,
+		when
+	};
+};
+/**
+* The policy for one (action, model) request from a principal's grants. Pure: no I/O, so it is unit- and
+* property-tested directly. Deny by default: no matching grant, no access.
+*/
+const buildPolicy = (grants, request, audience, fields) => {
+	if (audience === "delivery" && fields === void 0) return DENIED_POLICY;
+	const matching = grantsFor(grants, request.action, request.modelId);
+	if (matching.length === 0) return DENIED_POLICY;
+	const readGrants = request.action === "read" ? matching : grantsFor(grants, "read", request.modelId);
+	const writes = WRITE_ACTIONS.has(request.action);
+	return {
+		allowed: true,
+		rowFilter: combineRowFilters(matching),
+		readMask: combineFieldMasks(readGrants, audience, fields),
+		rowReadMasks: combineRowFieldMasks(readGrants, audience, fields),
+		writeMask: writes ? combineFieldMasks(matching, audience, fields) : EMPTY_MASK,
+		rowWriteMasks: writes ? combineRowFieldMasks(matching, audience, fields) : null
+	};
+};
+/** Global actions are granted only by a grant on that action with no model. */
+const allowsGlobalAction = (grants, action) => grants.some((grant) => grant.action === action && grant.modelId === null);
+//#endregion
 //#region ../../apps/api/src/db/dialect.ts
 const SQLITE_PREFIX = "sqlite:";
 const MEMORY = ":memory:";
@@ -689,6 +815,37 @@ const COLUMN_TYPES = {
 };
 const addIndexColumn = ({ name, table, expression, cast, numericString }) => sql`alter table ${sql.table(table)} add column ${sql.id(fieldIndexColumnName(name))} ${numericString ? DECIMAL : COLUMN_TYPES[cast]}
     generated always as (${expression}) virtual invisible, algorithm=inplace, lock=none`;
+/** Published revisions of a model as of a publication sequence (`snapshotCte`, relation targets). */
+const snapshotRows$2 = ({ siteId, modelId, seq }) => sql`
+    select pl.entry_id, pl.site_id, pl.model_id, pl.locale, 'published' as state, r.data, 0 as version,
+      r.id as revision_id, pl.published_at as updated_at, null as autosaved_at,
+      en.created_at as entry_created_at
+    from publication_log pl
+    join content_revisions r on r.id = pl.revision_id
+    join entries en on en.id = pl.entry_id
+    where pl.site_id = ${siteId} and pl.model_id = ${modelId}
+      and pl.from_seq <= ${seq}
+      and (pl.to_seq is null or pl.to_seq > ${seq})`;
+/**
+* One row per field: a list stays one JSON array that the nested subquery tests with `member of` (a correlated
+* `json_table` there loses its rows once the target query has the locale chain's `not exists`, on MySQL 8.4);
+* a single ID is converted to the ASCII, case-insensitive form of UUID columns, so it matches them and their
+* indexes.
+*/
+const referenceIds$3 = (fieldId, list) => {
+	if (list) {
+		const json = fieldJson$1(fieldId);
+		return {
+			from: sql`(select case when json_type(${json}) = 'ARRAY' collate utf8mb4_bin then ${json} end as ids) v`,
+			matches: (column) => sql`${column} member of (v.ids)`
+		};
+	}
+	const text = sql`json_value(${DATA$2}, ${path(fieldId)} returning char(36) null on error)`;
+	return {
+		from: sql`(select convert(${text} using ascii) collate ascii_general_ci as id) v`,
+		matches: (column) => sql`${column} = v.id`
+	};
+};
 const mysqlContentDialect = {
 	name: "mysql",
 	uuid: (value) => sql`${value}`,
@@ -728,17 +885,10 @@ const mysqlContentDialect = {
 		const order = direction === "desc" ? sql`desc` : sql`asc`;
 		return nullable ? sql`(${expression} is null) ${order}, ${expression} ${order}` : sql`${expression} ${order}`;
 	},
-	snapshotCte: ({ name, siteId, modelId, seq }) => sql`with ${sql.id(name)} as (
-    select pl.entry_id, pl.site_id, pl.model_id, pl.locale, 'published' as state, r.data, 0 as version,
-      r.id as revision_id, pl.published_at as updated_at, null as autosaved_at,
-      en.created_at as entry_created_at
-    from publication_log pl
-    join content_revisions r on r.id = pl.revision_id
-    join entries en on en.id = pl.entry_id
-    where pl.site_id = ${siteId} and pl.model_id = ${modelId}
-      and pl.from_seq <= ${seq}
-      and (pl.to_seq is null or pl.to_seq > ${seq})
+	snapshotCte: (source) => sql`with ${sql.id(source.name)} as (${snapshotRows$2(source)}
   ) `,
+	snapshotRows: snapshotRows$2,
+	referenceIds: referenceIds$3,
 	fieldIndexColumn: {
 		add: addIndexColumn,
 		drop: (name) => sql`alter table ${sql.table(CONTENT_HEADS_TABLE)} drop column ${sql.id(fieldIndexColumnName(name))}, algorithm=inplace, lock=none`
@@ -799,6 +949,30 @@ const castParameter$2 = (value, cast) => {
 * so nothing from the request is ever spliced into the SQL text.
 */
 const containment = (document) => sql`(${DATA$1} @> ${JSON.stringify(document)}::jsonb)`;
+/** Published revisions of a model as of a publication sequence (`snapshotCte`, relation targets). */
+const snapshotRows$1 = ({ siteId, modelId, seq }) => sql`
+    select pl.entry_id, pl.site_id, pl.model_id, pl.locale, 'published'::text as state, r.data, 0 as version,
+      r.id as revision_id, pl.published_at as updated_at, null::timestamptz as autosaved_at,
+      en.created_at as entry_created_at
+    from publication_log pl
+    join content_revisions r on r.id = pl.revision_id
+    join entries en on en.id = pl.entry_id
+    where pl.site_id = ${siteId}::uuid and pl.model_id = ${modelId}
+      and pl.from_seq <= ${seq}::bigint
+      and (pl.to_seq is null or pl.to_seq > ${seq}::bigint)`;
+/** A UUID-shaped text cast to uuid; anything else is no ID (a cast would fail the whole statement). */
+const asUuid = (text) => sql`(case when ${text} ~ '^[0-9A-Fa-f-]{36}$' then (${text})::uuid end)`;
+/** One row per stored ID: `jsonb_array_elements_text` for a list, a one-row select for a single ID. */
+const referenceIds$2 = (fieldId, list) => {
+	const json = sql`(${DATA$1} -> ${sql.lit(fieldId)})`;
+	return list ? {
+		from: sql`jsonb_array_elements_text(case when jsonb_typeof(${json}) = 'array' then ${json} end) as v(id)`,
+		matches: (column) => sql`${column} = ${asUuid(sql`v.id`)}`
+	} : {
+		from: sql`(select ${asUuid(sql`(case when jsonb_typeof(${json}) = 'string' then ${fieldText$1(fieldId)} end)`)} as id) v`,
+		matches: (column) => sql`${column} = v.id`
+	};
+};
 const postgresContentDialect = {
 	name: "postgres",
 	uuid: (value) => sql`${value}::uuid`,
@@ -825,17 +999,10 @@ const postgresContentDialect = {
 	containsInsensitive: (fieldId, text) => sql`(${fieldText$1(fieldId)} ilike ${likePattern("$containsi", text)})`,
 	localeRank: (chain, column) => sql`array_position(${[...chain]}::text[], ${column})`,
 	sortDirection: (direction) => direction === "desc" ? sql`desc` : sql`asc`,
-	snapshotCte: ({ name, siteId, modelId, seq }) => sql`with ${sql.id(name)} as (
-    select pl.entry_id, pl.site_id, pl.model_id, pl.locale, 'published'::text as state, r.data, 0 as version,
-      r.id as revision_id, pl.published_at as updated_at, null::timestamptz as autosaved_at,
-      en.created_at as entry_created_at
-    from publication_log pl
-    join content_revisions r on r.id = pl.revision_id
-    join entries en on en.id = pl.entry_id
-    where pl.site_id = ${siteId}::uuid and pl.model_id = ${modelId}
-      and pl.from_seq <= ${seq}::bigint
-      and (pl.to_seq is null or pl.to_seq > ${seq}::bigint)
+	snapshotCte: (source) => sql`with ${sql.id(source.name)} as (${snapshotRows$1(source)}
   ) `,
+	snapshotRows: snapshotRows$1,
+	referenceIds: referenceIds$2,
 	createFieldIndex: ({ name, table, leading, expression, modelIdColumn, modelId }) => sql`create index concurrently if not exists ${sql.id(name)} on ${sql.table(table)} (${leading}, ${expression}) where ${sql.ref(modelIdColumn)} = ${modelId}`,
 	createFieldStatistics: (name, expression, table) => sql`create statistics if not exists ${sql.id(name)} on ${expression} from ${sql.table(table)}`,
 	dropFieldIndex: (name) => sql`drop index concurrently if exists ${sql.id(name)}`,
@@ -876,6 +1043,28 @@ const castParameter$1 = (value, cast) => {
 		default: return sql`${value}`;
 	}
 };
+/** Published revisions of a model as of a publication sequence (`snapshotCte`, relation targets). */
+const snapshotRows = ({ siteId, modelId, seq }) => sql`
+    select pl.entry_id, pl.site_id, pl.model_id, pl.locale, 'published' as state, r.data, 0 as version,
+      r.id as revision_id, pl.published_at as updated_at, null as autosaved_at,
+      en.created_at as entry_created_at
+    from publication_log pl
+    join content_revisions r on r.id = pl.revision_id
+    join entries en on en.id = pl.entry_id
+    where pl.site_id = ${siteId} and pl.model_id = ${modelId}
+      and pl.from_seq <= ${seq}
+      and (pl.to_seq is null or pl.to_seq > ${seq})`;
+/** One row per stored ID: `json_each` for a list, a one-row select for a single ID (UUIDs are text). */
+const referenceIds$1 = (fieldId, list) => {
+	const json = fieldJson(fieldId);
+	return list ? {
+		from: sql`json_each(case when json_type(${json}) = 'array' then ${json} end) v`,
+		matches: (column) => sql`${column} = v.value`
+	} : {
+		from: sql`(select case when json_type(${json}) = 'text' then ${fieldText(fieldId)} end as id) v`,
+		matches: (column) => sql`${column} = v.id`
+	};
+};
 //#endregion
 //#region ../../apps/api/src/content/compiler/dialect/index.ts
 const DIALECTS = {
@@ -918,17 +1107,10 @@ const DIALECTS = {
 			if (!nullable) return direction === "desc" ? sql`desc` : sql`asc`;
 			return direction === "desc" ? sql`desc nulls first` : sql`asc nulls last`;
 		},
-		snapshotCte: ({ name, siteId, modelId, seq }) => sql`with ${sql.id(name)} as (
-    select pl.entry_id, pl.site_id, pl.model_id, pl.locale, 'published' as state, r.data, 0 as version,
-      r.id as revision_id, pl.published_at as updated_at, null as autosaved_at,
-      en.created_at as entry_created_at
-    from publication_log pl
-    join content_revisions r on r.id = pl.revision_id
-    join entries en on en.id = pl.entry_id
-    where pl.site_id = ${siteId} and pl.model_id = ${modelId}
-      and pl.from_seq <= ${seq}
-      and (pl.to_seq is null or pl.to_seq > ${seq})
+		snapshotCte: (source) => sql`with ${sql.id(source.name)} as (${snapshotRows(source)}
   ) `,
+		snapshotRows,
+		referenceIds: referenceIds$1,
 		createFieldIndex: ({ name, table, leading, expression, modelIdColumn, modelId }) => sql`create index if not exists ${sql.id(name)} on ${sql.table(table)} (${leading}, ${expression}) where ${sql.ref(modelIdColumn)} = ${modelId}`,
 		createFieldStatistics: () => null,
 		dropFieldIndex: (name) => sql`drop index if exists ${sql.id(name)}`,
@@ -972,11 +1154,36 @@ const compileRowFilter = (filter, principal, dialect = contentDialect()) => {
 		}
 	}
 };
+/** The same row filter evaluated on one loaded entry (writes check it before touching the entry). */
+const matchesRowFilter = (filter, principal, entry) => {
+	if (!filter) return true;
+	switch (filter.kind) {
+		case "ownedByPrincipal": return principal.kind === "admin" && entry.created_by_admin_id === principal.adminUserId || principal.kind === "appUser" && entry.owner_app_user_id === principal.appUserId;
+		case "and": return filter.filters.every((child) => matchesRowFilter(child, principal, entry));
+		case "or": return filter.filters.some((child) => matchesRowFilter(child, principal, entry));
+	}
+};
 /**
 * Whether a mask lets the caller see a field. A wildcard mask covers every live field; deprecated fields
 * stay hidden unless a mask names them explicitly.
 */
 const maskAllows = (mask, field) => mask.mode === "all" ? !field.deprecated : mask.fieldIds.includes(field.id);
+/** Whether a mask hides a component's `public: false` fields (delivery audiences, at any depth). */
+const hidesPrivateComponentFields = (mask) => mask.mode === "only" && mask.componentFields === "public";
+/** A per-row mask on one entry: the mask for every row, plus each conditioned mask whose condition holds. */
+const maskForRow = (base, rowMasks, principal, entry) => rowMasks ? rowMasks.when.reduce((mask, extra) => matchesRowFilter(extra.condition, principal, entry) ? unionMasks(mask, extra.mask) : mask, rowMasks.everyRow) : base;
+/**
+* The fields the caller may read on one loaded entry (issue #75): the mask for every row, plus each
+* row-conditioned mask whose condition holds for the entry. Evaluated with the same rule the row filter
+* compiles to, on the entry's loaded ownership columns, never re-queried.
+*/
+const rowReadMask = (policy, principal, entry) => maskForRow(policy.readMask, policy.rowReadMasks, principal, entry);
+/**
+* The fields the caller may read on every row it may read. Filters, sorts and searches use it (a filter on a
+* field hidden on some rows would reveal those rows' values), and so does any reader that shows values
+* without the entry's ownership at hand.
+*/
+const everyRowReadMask = (policy) => policy.rowReadMasks?.everyRow ?? policy.readMask;
 /**
 * One condition over the entries row `e` for reads spanning several models (the snapshot diff): an entry
 * passes when its model is readable without a row filter, or its model's row filter holds for it.
@@ -1031,7 +1238,7 @@ const projectRelation = (field, value, options, topLevel) => {
 	});
 	return field.settings.cardinality === "many" ? shown : shown[0] ?? null;
 };
-const projectComponent = (component, value, options) => component && isRecord$2(value) ? projectFields(component.fields.filter((field) => !field.deprecated), value, options, false) : null;
+const projectComponent = (component, value, options) => component && isRecord$2(value) ? projectFields(component.fields.filter((field) => !field.deprecated && (field.public || !options.publicComponentFieldsOnly)), value, options, false) : null;
 const isStringOrStrings = (value) => typeof value === "string" || Array.isArray(value) && value.every((item) => typeof item === "string");
 /**
 * Whether a stored value has the shape the field's current type produces. Old snapshots are served through
@@ -1074,7 +1281,8 @@ const projectValue = (field, value, options, topLevel) => {
 			if (!options.mediaAssets) return value;
 			const assets = (Array.isArray(value) ? value : [value]).flatMap((id) => {
 				const asset = typeof id === "string" ? options.mediaAssets?.get(id) : void 0;
-				return asset ? [asset] : [];
+				if (asset) return [asset];
+				return options.keepUnresolvedMedia && typeof id === "string" ? [id] : [];
 			});
 			return field.settings.multiple ? assets : assets[0] ?? null;
 		}
@@ -1162,6 +1370,11 @@ const fieldMissingExpression = (fieldId, dialect = contentDialect()) => {
 	assertStableId(fieldId, "a field ID");
 	return dialect.fieldMissing(fieldId);
 };
+/** The IDs a top-level relation or media field stores, one row each (`v`; see `ContentSqlDialect`). */
+const referenceIdsExpression = (fieldId, list, dialect = contentDialect()) => {
+	assertStableId(fieldId, "a field ID");
+	return dialect.referenceIds(fieldId, list);
+};
 /** Case-sensitive text match on a top-level field; `text` is a parameter, never SQL. */
 const textMatchExpression = (fieldId, operator, text, dialect = contentDialect()) => {
 	assertStableId(fieldId, "a field ID");
@@ -1398,9 +1611,41 @@ const systemCondition = (name, operator, value, dialect) => {
 		}
 	}
 };
-const fieldCondition = (target, operator, value, dialect) => {
+/**
+* Whether the head `h` stores a reference the read shows: `exists` over the stored IDs (`v`), each looked up
+* as a target head of the same source, locale chain and row filter (relations: the target query reuses the
+* aliases `h` and `e`, so the row filter and the locale chain compile as for any head query), or as a live
+* asset of the site (media).
+*/
+const showsReference = ({ field }, shown, dialect) => {
+	if (shown.kind === "none") return sql`false`;
+	const ids = referenceIdsExpression(field.id, isListValued(field), dialect);
+	if (shown.kind === "media") return sql`exists (select 1 from ${ids.from} where exists (select 1 from media_assets m
+      where ${ids.matches(sql`m.id`)} and m.site_id = ${dialect.uuid(shown.siteId)} and m.deleted_at is null))`;
+	const table = shown.source.kind === "heads" ? sql.table("entry_heads") : sql`(${dialect.snapshotRows({
+		siteId: shown.siteId,
+		modelId: modelIdLiteral(shown.modelId),
+		seq: shown.source.seq
+	})})`;
+	const rowFilter = compileRowFilter(shown.rowFilter, shown.actor, dialect);
+	const where = whereOf({
+		siteId: shown.siteId,
+		modelId: shown.modelId,
+		source: shown.source,
+		locales: shown.locales,
+		conditions: [ids.matches(sql`h.entry_id`), ...rowFilter ? [rowFilter] : []],
+		orderBy: []
+	}, table, dialect);
+	return sql`exists (select 1 from ${ids.from} where exists (select 1 from ${table} h
+      join entries e on e.id = h.entry_id and e.deleted_at is null where ${where}))`;
+};
+const fieldCondition = (target, operator, value, dialect, shown) => {
 	const { field } = target;
 	const equals = (item) => fieldEqualsExpression(equalityTarget(target), item, dialect);
+	if (shown && (operator === "$null" || operator === "$notNull")) {
+		const present = showsReference(target, shown, dialect);
+		return operator === "$null" === value ? sql`(not ${present})` : present;
+	}
 	switch (operator) {
 		case "$eq": return equals(value);
 		case "$ne": return sql`(not ${equals(value)})`;
@@ -1428,8 +1673,8 @@ const compileFilter = (node, dialect = contentDialect()) => {
 	switch (node.kind) {
 		case "and": return sql`(${sql.join(node.nodes.map(compileChild), sql` and `)})`;
 		case "or": return sql`(${sql.join(node.nodes.map(compileChild), sql` or `)})`;
-		case "not": return sql`(not ${compileChild(node.node)})`;
-		case "condition": return node.target.kind === "system" ? systemCondition(node.target.name, node.operator, node.value, dialect) : fieldCondition(node.target, node.operator, node.value, dialect);
+		case "not": return sql`(not coalesce(${compileChild(node.node)}, false))`;
+		case "condition": return node.target.kind === "system" ? systemCondition(node.target.name, node.operator, node.value, dialect) : fieldCondition(node.target, node.operator, node.value, dialect, node.shownTargets);
 	}
 };
 /**
@@ -1749,6 +1994,7 @@ const MEDIA_SIGNED_URL_TTL_SECONDS = 3600;
 * Shapio's stable route. Private: always an expiring signed URL; nothing else reaches private bytes.
 */
 const resolveObjectUrl = async (storage, urls, object, ttlSeconds = MEDIA_SIGNED_URL_TTL_SECONDS) => {
+	if (visibilityOfKey(object.key) !== object.visibility) return resolveMovingObjectUrl(storage, urls, object, ttlSeconds);
 	const adapter = storage.get(object.driver);
 	if (object.visibility === "public") return {
 		url: adapter.publicUrl(object.key) ?? urls.absoluteUrl(`/api/media/f/${encodeKeyPath(object.key)}`),
@@ -1763,6 +2009,28 @@ const resolveObjectUrl = async (storage, urls, object, ttlSeconds = MEDIA_SIGNED
 		expiresAt: new Date(Date.now() + ttlSeconds * 1e3)
 	};
 };
+/**
+* An object whose visibility changed while the relocate job has not moved it yet (its key still has the old
+* prefix). Neither the old key (purged after the move) nor the bucket or CDN at the new key (empty until the
+* copy) works at every moment, so the URL goes through Shapio's own file route with the key under the new
+* prefix: the route serves whichever copy the row points at, before and after the move. Private objects get
+* a route URL signed like the local adapter's (local storage is always configured, with the same secret).
+*/
+const resolveMovingObjectUrl = async (storage, urls, object, ttlSeconds) => {
+	const key = withVisibility(object.key, object.visibility);
+	if (object.visibility === "public") return {
+		url: urls.absoluteUrl(`${MEDIA_FILE_ROUTE_PREFIX}${encodeKeyPath(key)}`),
+		expiresAt: null
+	};
+	return {
+		url: await storage.get("local").signedGetUrl(key, {
+			expiresInSeconds: ttlSeconds,
+			filename: object.filename,
+			contentType: object.mimeType
+		}),
+		expiresAt: new Date(Date.now() + ttlSeconds * 1e3)
+	};
+};
 //#endregion
 //#region ../../apps/api/src/repositories/mediaVariants.ts
 const listForAssets = (assetIds, trx = db) => assetIds.length === 0 ? Promise.resolve([]) : trx.selectFrom("media_variants").selectAll().where("asset_id", "in", assetIds).orderBy("asset_id").orderBy("width").execute();
@@ -1832,7 +2100,7 @@ const toAssetViews = async (deps, assets, executor) => {
 };
 //#endregion
 //#region ../../apps/api/src/content/compiler/populate.ts
-const idsOf = (rows, fieldId) => {
+const idsOf$1 = (rows, fieldId) => {
 	const ids = /* @__PURE__ */ new Set();
 	for (const row of rows) {
 		const value = row.data[fieldId];
@@ -1851,7 +2119,7 @@ const populateRelations = async (env, rows, fields, tree) => {
 		const target = resolveModelById(env.snapshot, field.settings.target);
 		if (!target) continue;
 		const policy = await env.policyFor(env, target.definition.id);
-		const targetRows = await env.fetch(env, target, policy, idsOf(rows, fieldId));
+		const targetRows = await env.fetch(env, target, policy, idsOf$1(rows, fieldId));
 		for (const { row, data } of await env.project(env, target, policy, targetRows, {
 			fields: null,
 			populate: subtree
@@ -1947,9 +2215,9 @@ const keysOf = (model) => {
 	return keys;
 };
 /** The entry's own title, only when the caller may read the title field (never a hidden value). */
-const fallbackTitleOf = (model, policy, row) => {
+const fallbackTitleOf = (env, model, policy, row) => {
 	const field = effectiveTitleField(model.definition);
-	if (!field || !maskAllows(policy.readMask, field)) return null;
+	if (!field || !maskAllows(rowReadMask(policy, env.actor, row), field)) return null;
 	const value = row.data[field.id];
 	return typeof value === "string" ? value : null;
 };
@@ -1965,7 +2233,7 @@ const resolveSeoFields = (env, options, model, policy, fields, row, data) => {
 	const context = {
 		defaults: seoDefaultsForLocale(options.defaults, fallbackChain(env.snapshot, defaultsLocaleOf(env, model, row))),
 		image: options.image,
-		fallbackTitle: fallbackTitleOf(model, policy, row),
+		fallbackTitle: fallbackTitleOf(env, model, policy, row),
 		keys
 	};
 	const output = { ...data };
@@ -2109,6 +2377,15 @@ const systemAttributes = (env, row) => ({
 	updatedAt: row.updated_at.toISOString(),
 	...env.audience === "delivery" ? { publishedAt: row.updated_at.toISOString() } : {}
 });
+/**
+* The selected fields this row shows: all of them unless the policy's read masks differ by row, then those
+* the row's own mask allows (a field granted only on the caller's own entries stays off everyone else's).
+*/
+const fieldsOnRow = (env, policy, fields, row) => {
+	if (!policy.rowReadMasks) return fields;
+	const mask = rowReadMask(policy, env.actor, row);
+	return fields.filter((field) => maskAllows(mask, field));
+};
 const projectRows = async (env, model, policy, rows, query) => {
 	const fields = selectFields(model, policy.readMask, query.fields);
 	const { visible: visibleTargets, fetched } = await relationTargets(env, model, rows, fields);
@@ -2122,24 +2399,132 @@ const projectRows = async (env, model, policy, rows, query) => {
 	const populated = await populateRelations(populateEnv, rows, fields, query.populate);
 	const media = await loadMediaViews(env, model, rows, fields);
 	return rows.map((row) => {
+		const rowFields = fieldsOnRow(env, policy, fields, row);
 		const data = projectData(row.data, {
 			model,
-			fields,
+			fields: rowFields,
 			visibleTargets,
 			populated,
-			...env.audience === "delivery" ? { richText: env.richText ?? "json" } : {},
-			mediaAssets: media.byId
+			...env.audience === "delivery" ? { richText: env.richText ?? "json" } : { keepUnresolvedMedia: true },
+			mediaAssets: media.byId,
+			publicComponentFieldsOnly: hidesPrivateComponentFields(policy.readMask)
 		});
 		return {
 			row,
 			data: env.seo ? resolveSeoFields(env, {
 				defaults: env.seo,
 				image: media.seoImage
-			}, model, policy, fields, row, data) : data
+			}, model, policy, rowFields, row, data) : data
 		};
 	});
 };
 //#endregion
+//#region ../../apps/api/src/content/visibleReferences.ts
+const ID_OPERATORS = /* @__PURE__ */ new Set([
+	"$eq",
+	"$ne",
+	"$in",
+	"$nin"
+]);
+const referenceFieldOf = (node) => node.target.kind === "field" && (node.target.field.type === "relation" || node.target.field.type === "media") ? node.target.field : void 0;
+const conditionsOf = (node) => {
+	switch (node.kind) {
+		case "and":
+		case "or": return node.nodes.flatMap(conditionsOf);
+		case "not": return conditionsOf(node.node);
+		case "condition": return [node];
+	}
+};
+const idsOf = (node) => ID_OPERATORS.has(node.operator) ? (Array.isArray(node.value) ? node.value : [node.value]).map(String) : [];
+/** What the read shows of these conditions' fields: relation targets and live assets. */
+const visibleIds = async (env, conditions) => {
+	const visible = /* @__PURE__ */ new Map();
+	for (const node of conditions) {
+		const field = referenceFieldOf(node);
+		if (!field || visible.has(field.id)) continue;
+		const ids = [...new Set(conditions.filter((other) => referenceFieldOf(other)?.id === field.id).flatMap(idsOf))];
+		if (field.type === "media") {
+			if (env.media) {
+				const assets = await findLiveManyOnSite(env.siteId, ids, env.executor);
+				visible.set(field.id, {
+					ids: new Set(assets.map((asset) => asset.id)),
+					shown: {
+						kind: "media",
+						siteId: env.siteId
+					}
+				});
+			}
+			continue;
+		}
+		if (env.audience === "admin") continue;
+		const policy = await readPolicy(env, field.settings.target);
+		if (!policy.allowed) throw queryForbidden(`You may not filter on "${field.apiKey}": you may not read the entries it links to`, { field: field.apiKey });
+		const target = resolveModelById(env.snapshot, field.settings.target);
+		if (!target) {
+			visible.set(field.id, {
+				ids: /* @__PURE__ */ new Set(),
+				shown: { kind: "none" }
+			});
+			continue;
+		}
+		const rows = await fetchHeadsByIds(env, target, policy, ids);
+		visible.set(field.id, {
+			ids: new Set(rows.map((row) => row.entry_id)),
+			shown: {
+				kind: "relation",
+				siteId: env.siteId,
+				modelId: target.definition.id,
+				source: env.source,
+				locales: readScopeFor(env.snapshot, target.definition, env.locale, { fallback: true }),
+				rowFilter: policy.rowFilter,
+				actor: env.actor
+			}
+		});
+	}
+	return visible;
+};
+/**
+* A condition limited to what the read shows: `$eq hidden` matches nothing, `$ne hidden` everything, and
+* `$null`/`$notNull` carry the rule for what is shown.
+*/
+const rewrite = (node, visible) => {
+	switch (node.kind) {
+		case "and":
+		case "or": return {
+			...node,
+			nodes: node.nodes.map((child) => rewrite(child, visible))
+		};
+		case "not": return {
+			...node,
+			node: rewrite(node.node, visible)
+		};
+		case "condition": {
+			const field = node.target.kind === "field" ? visible.get(node.target.field.id) : void 0;
+			if (!field) return node;
+			if (node.operator === "$null" || node.operator === "$notNull") return {
+				...node,
+				shownTargets: field.shown
+			};
+			if (!ID_OPERATORS.has(node.operator)) return node;
+			const ids = idsOf(node).filter((id) => field.ids.has(id));
+			const negated = node.operator === "$ne" || node.operator === "$nin";
+			if (ids.length === idsOf(node).length) return node;
+			return {
+				...node,
+				operator: negated ? "$nin" : "$in",
+				value: ids
+			};
+		}
+	}
+};
+/** The query's filter with relation and media conditions limited to what this read shows. */
+const visibleReferenceFilter = async (env, filter) => {
+	if (!filter) return null;
+	const conditions = conditionsOf(filter).filter((node) => referenceFieldOf(node) !== void 0);
+	if (conditions.length === 0) return filter;
+	return rewrite(filter, await visibleIds(env, conditions));
+};
+//#endregion
 //#region ../../apps/api/src/content/compiler/querystring.ts
 const SEGMENT = /^\[([^[\]]*)\]/;
 const MAX_DEPTH = 10;
@@ -2233,14 +2618,14 @@ const positiveInteger = (value, name, max) => {
 	if (!/^\d{1,15}$/.test(text) || Number(text) < 1 || Number(text) > max) throw queryInvalid(`"${name}" must be an integer between 1 and ${max}`);
 	return Number(text);
 };
-const resolveTarget = (context, key) => {
+const resolveTarget = (context, key, use = "query") => {
 	if (SYSTEM_ATTRIBUTES.includes(key)) return {
 		kind: "system",
 		name: key
 	};
 	const field = findFieldByApiKey(context.model.fields, key);
 	if (!field) throw queryInvalid(`Unknown field "${key}"`, { field: key });
-	if (!context.isReadable(field)) throw queryForbidden(`You may not filter, sort or search on "${key}"`, { field: key });
+	if (use === "select" ? !context.isReadable(field) : !context.isQueryable(field)) throw queryForbidden(use === "select" ? `You may not read the field "${key}"` : `You may not filter, sort or search on "${key}"`, { field: key });
 	return {
 		kind: "field",
 		field
@@ -2315,7 +2700,7 @@ const parseFields = (context, value) => {
 	if (value === void 0) return null;
 	return toList(value).map((item) => {
 		if (typeof item !== "string") throw queryInvalid("fields needs a list of field names");
-		const target = resolveTarget(context, item);
+		const target = resolveTarget(context, item, "select");
 		if (target.kind === "system") throw queryInvalid(`"${item}" is always returned; list only model fields`);
 		return target.field;
 	});
@@ -2354,7 +2739,7 @@ const parseSearch = (context, value) => {
 	if (!text) return null;
 	const field = effectiveTitleField(context.model);
 	if (!field || !TEXT_TITLE_FIELD_TYPES.has(field.type)) throw queryInvalid(`"${context.model.apiKey}" has no text title field to search`);
-	if (!context.isReadable(field)) throw queryForbidden("You may not search this model", { field: field.apiKey });
+	if (!context.isQueryable(field)) throw queryForbidden("You may not search this model", { field: field.apiKey });
 	return {
 		field,
 		text
@@ -2445,6 +2830,12 @@ sql`uuid[]`, sql`text[]`;
 * `items` is the inside of `group_concat`: JSON text per row and its ORDER BY.
 */
 const mysqlJsonArrayOf = (items) => sql`cast(concat('[', group_concat(${items} separator ','), ']') as json)`;
+//#endregion
+//#region ../../apps/api/src/repositories/publications.ts
+const currentSeq = async (siteId, executor = db) => {
+	const row = await executor.selectFrom("publication_state").select("last_seq").where("site_id", "=", siteId).executeTakeFirstOrThrow();
+	return Number(row.last_seq);
+};
 sql`jsonb_build_object`, sql`jsonb_agg`, sql`'[]'::jsonb`, sql`json_build_object`, sql`json_agg`, sql`'[]'::json`;
 sql``, sql` desc`;
 sql` nulls first`, sql` nulls last`;
@@ -2467,6 +2858,7 @@ const parseQueryFor = (context, model, policy, rawQuery, options) => parseConten
 	model: model.definition,
 	locales: context.snapshot.locales.map((locale) => locale.code),
 	isReadable: (field) => maskAllows(policy.readMask, field),
+	isQueryable: (field) => maskAllows(everyRowReadMask(policy), field),
 	allowSnapshot: options.allowSnapshot,
 	allowAdminFilters: options.allowAdminFilters ?? false,
 	allowRichText: options.allowRichText ?? false,
@@ -2622,9 +3014,13 @@ const toEntries = async (read, env, rows) => (await projectRows(env, read.model,
 */
 const readEntryPage = async (unloaded, options = { total: true }) => {
 	const read = await withSeoDefaults(unloaded);
-	const { context, model, policy, query } = read;
+	const { context, model, policy } = read;
+	const query = {
+		...read.query,
+		filter: await visibleReferenceFilter(environmentOf(read, context.db), read.query.filter)
+	};
 	const { limit, offset } = toLimitOffset(query.page, query.pageSize);
-	const sort = query.sort.length > 0 ? query.sort : defaultSortTerms(model.definition, (field) => maskAllows(policy.readMask, field));
+	const sort = query.sort.length > 0 ? query.sort : defaultSortTerms(model.definition, (field) => maskAllows(everyRowReadMask(policy), field));
 	const plan = {
 		siteId: context.site.id,
 		modelId: model.definition.id,
@@ -2780,10 +3176,13 @@ const DELIVERY_PARSE = {
 	allowSeo: true,
 	allowPublicationState: true
 };
-/** Meta every delivery response carries; draft reads add `publicationState` (published ones are unchanged). */
+/**
+* Meta every delivery response carries. Draft reads report `snapshot: null` (drafts cannot be pinned, as in
+* GraphQL) and add `publicationState`; published ones are unchanged.
+*/
 const metaOf = (locale, snapshot, drafts) => drafts ? {
 	locale,
-	snapshot,
+	snapshot: null,
 	publicationState: "draft"
 } : {
 	locale,
@@ -2860,12 +3259,6 @@ const getDelivery = async (context, modelKey, id, rawQuery, options = {}) => {
 	};
 };
 //#endregion
-//#region ../../apps/api/src/repositories/publications.ts
-const currentSeq = async (siteId, executor = db) => {
-	const row = await executor.selectFrom("publication_state").select("last_seq").where("site_id", "=", siteId).executeTakeFirstOrThrow();
-	return Number(row.last_seq);
-};
-//#endregion
 //#region ../../apps/api/src/repositories/schemaVersions.ts
 /** The global schema version: the durable value every instance compares its cached snapshot against. */
 const getSchemaVersion = async (executor = db) => {
@@ -3000,6 +3393,20 @@ const schemaVersionsAt = async (siteId, seqs, executor = db) => {
 };
 /** When the site's snapshot `seq` was created, from the ledger (undefined without a ledger row). */
 const snapshotCreatedAt = async (siteId, seq, executor = db) => (await executor.selectFrom("publication_snapshots").select("created_at").where("site_id", "=", siteId).where("seq", "=", String(seq)).executeTakeFirst())?.created_at;
+/**
+* Where a diff ending at `to` must start to cover the last `count` entries that went live or were updated
+* (by the snapshot their live revision opened at), counting only entries in the given models that pass the
+* row filter and are still live at `to`. 0 when fewer than `count` exist, so the diff covers everything.
+* Schema-only snapshots open no period, so they never use up the window.
+*/
+const recentWindowStart = async (query, executor = db) => {
+	if (query.modelIds.length === 0) return 0;
+	const to = String(query.to);
+	const rowFilter = query.rowFilter?.$castTo();
+	const rows = await executor.selectFrom("publication_log as p").innerJoin("entries as e", "e.id", "p.entry_id").select((eb) => ["p.entry_id", eb.fn.max("p.from_seq").as("last_seq")]).where("p.site_id", "=", query.siteId).where("p.model_id", "in", query.modelIds).where("p.from_seq", "<=", to).where((eb) => eb.or([eb("p.to_seq", "is", null), eb("p.to_seq", ">", to)])).$call((qb) => rowFilter ? qb.where(rowFilter) : qb).groupBy("p.entry_id").orderBy("last_seq", "desc").limit(query.count).execute();
+	if (rows.length < query.count) return 0;
+	return Math.max(0, Math.min(...rows.map((row) => Number(row.last_seq))) - 1);
+};
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /**
 * Models the caller may read. An authenticated caller (session, token, app user) with none (or an instance
@@ -3017,7 +3424,7 @@ const readableModels = async (context) => {
 		if (policy.allowed) readable.push({
 			definition,
 			rowFilter: policy.rowFilter,
-			readMask: policy.readMask
+			readMask: everyRowReadMask(policy)
 		});
 	}
 	if (readable.length === 0 && context.actor.kind === "anonymous") throw new AppError(401, "UNAUTHENTICATED", "Snapshots need a delivery token");
@@ -3058,32 +3465,42 @@ const boundedLimit = (limit) => Math.min(Math.max(limit ?? 100, 1), 500);
 /** `GET /api/snapshots/changes`, GraphQL `_changes`: one page of entries changed between `from` and `to`. */
 const listSnapshotChanges = async (context, query) => {
 	if (query.after !== void 0 && !UUID.test(query.after)) throw queryInvalid("\"after\" must be a cursor returned by a previous page");
+	if (query.from === void 0 === (query.recent === void 0)) throw queryInvalid("Pass exactly one of \"from\" and \"recent\"");
 	const readable = await readableModels(context);
 	const byId = new Map(readable.map((model) => [model.definition.id, model]));
+	const modelIds = [...byId.keys()];
+	const rowFilter = compileModelRowFilters(readable.map((model) => ({
+		modelId: model.definition.id,
+		rowFilter: model.rowFilter
+	})), context.actor);
 	return withConsistentRead(async (trx) => {
 		const current = await currentSeq(context.site.id, trx);
 		const to = query.to ?? current;
 		if (to > current) throw snapshotInvalid(to, current);
-		if (query.from < 0 || query.from > to) throw queryInvalid("\"from\" must be between 0 and \"to\"");
+		const from = query.from ?? await recentWindowStart({
+			siteId: context.site.id,
+			to,
+			count: query.recent ?? 0,
+			modelIds,
+			rowFilter
+		}, trx);
+		if (from < 0 || from > to) throw queryInvalid("\"from\" must be between 0 and \"to\"");
 		const page = await listChanges({
 			siteId: context.site.id,
-			from: query.from,
+			from,
 			to,
 			after: query.after,
 			limit: boundedLimit(query.limit),
-			modelIds: [...byId.keys()],
-			rowFilter: compileModelRowFilters(readable.map((model) => ({
-				modelId: model.definition.id,
-				rowFilter: model.rowFilter
-			})), context.actor)
+			modelIds,
+			rowFilter
 		}, trx);
-		const versions = await schemaVersionsAt(context.site.id, [query.from, to], trx);
+		const versions = await schemaVersionsAt(context.site.id, [from, to], trx);
 		const describe = await describeEntries(page.items, byId, context.snapshot.defaultLocale, trx);
 		return {
-			from: query.from,
+			from,
 			to,
 			schemaVersions: {
-				from: versions.get(query.from) ?? null,
+				from: versions.get(from) ?? null,
 				to: versions.get(to) ?? null
 			},
 			items: page.items.flatMap((item) => {
@@ -3271,10 +3688,11 @@ const readForDelivery = async (input, trx = db) => {
 		"sites.id as site_id",
 		"sites.key as site_key",
 		"system_settings.value as descriptor"
-	]).$if(tokenId !== void 0, (query) => query.leftJoin("api_tokens", (join) => join.on("api_tokens.id", "=", tokenId ?? "")).select([
+	]).$if(tokenId !== void 0, (query) => query.leftJoin("api_tokens", (join) => join.on("api_tokens.id", "=", tokenId ?? "")).leftJoin("admin_users", "admin_users.id", "api_tokens.created_by").select([
 		"api_tokens.id as token_id",
 		"api_tokens.revoked_at as token_revoked_at",
-		"api_tokens.expires_at as token_expires_at"
+		"api_tokens.expires_at as token_expires_at",
+		"admin_users.status as token_creator_status"
 	])).executeTakeFirstOrThrow();
 	return {
 		schemaVersion: row.schema_version,
@@ -3287,7 +3705,8 @@ const readForDelivery = async (input, trx = db) => {
 		descriptor: row.descriptor,
 		token: row.token_id === void 0 || row.token_id === null ? null : {
 			revokedAt: row.token_revoked_at ?? null,
-			expiresAt: row.token_expires_at ?? null
+			expiresAt: row.token_expires_at ?? null,
+			creatorDisabled: row.token_creator_status === "disabled"
 		}
 	};
 };
@@ -3330,18 +3749,23 @@ const LIST_COLUMNS = [
 	"api_tokens.revoked_at",
 	"api_tokens.created_at",
 	"api_tokens.site_id",
-	"admin_roles.kind as role_kind"
+	"admin_roles.kind as role_kind",
+	"admin_users.status as creator_status"
 ];
-const withRole = (trx) => trx.selectFrom("api_tokens").innerJoin("admin_roles", "admin_roles.id", "api_tokens.role_id").select(LIST_COLUMNS);
-/** A usable token for this hash: not revoked. Expiry is checked by the caller. */
-const findLiveByHash = (tokenHash, trx = db) => withRole(trx).where("api_tokens.token_hash", "=", tokenHash).where("api_tokens.revoked_at", "is", null).executeTakeFirst();
+/** Tokens with their role's kind and their creator's status (null when no admin is recorded as creator). */
+const withRole = (trx) => trx.selectFrom("api_tokens").innerJoin("admin_roles", "admin_roles.id", "api_tokens.role_id").leftJoin("admin_users", "admin_users.id", "api_tokens.created_by").select(LIST_COLUMNS);
+/**
+* A usable token for this hash: not revoked, and its creator (if one is recorded) is not disabled. Expiry is
+* checked by the caller.
+*/
+const findLiveByHash = (tokenHash, trx = db) => withRole(trx).where("api_tokens.token_hash", "=", tokenHash).where("api_tokens.revoked_at", "is", null).where((eb) => eb.or([eb("admin_users.id", "is", null), eb("admin_users.status", "=", "active")])).executeTakeFirst();
 const touchLastUsed = (id, now, staleBefore, trx = db) => trx.updateTable("api_tokens").set({ last_used_at: now }).where("id", "=", id).where((eb) => eb.or([eb("last_used_at", "is", null), eb("last_used_at", "<", staleBefore)])).execute();
 //#endregion
 //#region ../../apps/api/src/services/apiTokens.ts
 const scopeOf = (roleKind) => roleKind === "delivery" ? "delivery" : "admin";
 /** Whether a token with this expiry has expired at `now`. */
 const isTokenExpired = (expiresAt, now) => expiresAt !== null && expiresAt.getTime() <= now.getTime();
-/** The principal for a bearer API token, or undefined when unknown, revoked or expired. */
+/** The principal for a bearer API token, or undefined when unknown, revoked, expired or its creator is disabled. */
 const resolveApiToken = async (value, now = /* @__PURE__ */ new Date(), { recordUse = true, executor = db } = {}) => {
 	const row = await findLiveByHash(hashToken(value), executor);
 	if (!row || isTokenExpired(row.expires_at, now)) return;
@@ -3477,7 +3901,7 @@ const guardingSkew = async (runtime, statement) => {
 		return await statement();
 	} catch (error) {
 		if (error instanceof AppError) throw error;
-		const { getPendingMigrations } = await import("./migrator-CIKnDfZy.js");
+		const { getPendingMigrations } = await import("./migrator-CO5sXosL.js");
 		if ((await getPendingMigrations(runtime.db)).length > 0) throw new ShapioVersionSkewError$1(null, SHAPIO_VERSION$1, { cause: error });
 		throw error;
 	}
@@ -3489,8 +3913,8 @@ const readState = (runtime, site, tokenId) => guardingSkew(runtime, () => readFo
 }, runtime.db));
 /**
 * The caller: anonymous, or a delivery token resolved once per runtime (read-only: in-process reads never
-* record a token's use) and checked for liveness on every call by the state read. Admin-scope tokens are
-* refused: in-process reads are delivery reads only (rule 7).
+* record a token's use) and checked for liveness (revoked, expired, creator disabled) on every call by the
+* state read. Admin-scope tokens are refused: in-process reads are delivery reads only (rule 7).
 */
 const callerOf = async (runtime, token) => {
 	if (token === void 0) return { principal: ANONYMOUS };
@@ -3532,7 +3956,7 @@ const openCallScope = async (runtime, { token, site: requestedKey }) => {
 	if (!state) throw new Error("The site was resolved without reading the request state");
 	if (caller.tokenKey !== void 0) {
 		const live = state.token;
-		if (!live || live.revokedAt !== null || isTokenExpired(live.expiresAt, /* @__PURE__ */ new Date())) {
+		if (!live || live.revokedAt !== null || live.creatorDisabled || isTokenExpired(live.expiresAt, /* @__PURE__ */ new Date())) {
 			runtime.tokens.delete(caller.tokenKey);
 			throw invalidToken();
 		}
@@ -3830,7 +4254,7 @@ const createMediaStorage = async (config, deps) => {
 		publicBaseUrl: config.publicBaseUrl
 	}));
 	if (config.s3) {
-		const { createS3Adapter } = await import("./s3Adapter-BqCKtI3Y.js");
+		const { createS3Adapter } = await import("./s3Adapter-BC5QP2rS.js");
 		adapters.set("s3", createS3Adapter({
 			config: config.s3,
 			publicBaseUrl: config.publicBaseUrl
@@ -3964,67 +4388,6 @@ const APP_CONTENT_ACTIONS = [
 	"publish"
 ];
 //#endregion
-//#region ../../apps/api/src/permissions/policy.ts
-const EMPTY_MASK = {
-	mode: "only",
-	fieldIds: []
-};
-const ALLOW_ALL_POLICY = Object.freeze({
-	allowed: true,
-	rowFilter: null,
-	readMask: { mode: "all" },
-	writeMask: { mode: "all" }
-});
-const WRITE_ACTIONS = /* @__PURE__ */ new Set(["create", "update"]);
-const grantsFor = (grants, action, modelId) => grants.filter((grant) => grant.action === action && (grant.modelId === null || grant.modelId === modelId));
-/** Rows: the union of what each grant allows. Any unconditional grant means no restriction. */
-const combineRowFilters = (grants) => {
-	if (grants.some((grant) => grant.condition === null)) return null;
-	const filters = [...new Set(grants.map((grant) => grant.condition))].filter((kind) => kind !== null).map((kind) => ({ kind }));
-	if (filters.length === 1 && filters[0]) return filters[0];
-	return {
-		kind: "or",
-		filters
-	};
-};
-/**
-* Fields: the union of what each grant allows. For delivery audiences a wildcard grant expands to the
-* model's public fields, so `public: false` fields stay hidden unless a grant names them. Delivery masks
-* are always explicit lists, so a field added after evaluation is never exposed by accident.
-*/
-const combineFieldMasks = (grants, audience, fields) => {
-	if (grants.length === 0) return EMPTY_MASK;
-	const hasWildcard = grants.some((grant) => grant.fieldIds === null);
-	if (audience === "admin" && hasWildcard) return { mode: "all" };
-	const named = new Set(grants.flatMap((grant) => grant.fieldIds ?? []));
-	if (audience === "delivery") return {
-		mode: "only",
-		fieldIds: (fields ?? []).filter((field) => named.has(field.id) || hasWildcard && field.public).map((field) => field.id)
-	};
-	return {
-		mode: "only",
-		fieldIds: [...named].sort()
-	};
-};
-/**
-* The policy for one (action, model) request from a principal's grants. Pure: no I/O, so it is unit- and
-* property-tested directly. Deny by default: no matching grant, no access.
-*/
-const buildPolicy = (grants, request, audience, fields) => {
-	if (audience === "delivery" && fields === void 0) return DENIED_POLICY;
-	const matching = grantsFor(grants, request.action, request.modelId);
-	if (matching.length === 0) return DENIED_POLICY;
-	const readGrants = request.action === "read" ? matching : grantsFor(grants, "read", request.modelId);
-	return {
-		allowed: true,
-		rowFilter: combineRowFilters(matching),
-		readMask: combineFieldMasks(readGrants, audience, fields),
-		writeMask: WRITE_ACTIONS.has(request.action) ? combineFieldMasks(matching, audience, fields) : EMPTY_MASK
-	};
-};
-/** Global actions are granted only by a grant on that action with no model. */
-const allowsGlobalAction = (grants, action) => grants.some((grant) => grant.action === action && grant.modelId === null);
-//#endregion
 //#region ../../apps/api/src/permissions/evaluator.ts
 const NETWORK_ACTION_SET = new Set(NETWORK_ACTIONS);
 /** Delivery tokens read, and read drafts where their role grants `readDrafts`. */
@@ -4032,11 +4395,12 @@ const DELIVERY_TOKEN_ACTIONS = new Set(DELIVERY_ACTIONS);
 /** App users and anonymous callers: never `readDrafts`, whatever a role says. */
 const APP_ACTIONS = new Set(APP_CONTENT_ACTIONS);
 /**
-* Which roles a principal holds and how its masks are computed. App users hold the custom app roles assigned
-* to them plus the roles their site binds to `authenticated`; anonymous callers hold the roles the request's
-* site binds to `public` (`site_app_roles`: a site that binds nothing grants nothing, and an anonymous caller
-* outside a site holds no role). Both are delivery audiences: they see `public: false` fields only where a
-* grant names them.
+* Which roles a principal holds and how its masks are computed. Anonymous callers hold the roles the
+* request's site binds to `public` (`site_app_roles`: a site that binds nothing grants nothing, and an
+* anonymous caller outside a site holds no role). `public` is a floor: app users hold those roles too, plus
+* the roles their site binds to `authenticated` and the custom app roles assigned to them, so signing in never
+* takes anything away. Both are delivery audiences: they see `public: false` fields only where a grant names
+* them.
 */
 const rolesOf = async (principal, grants, executor, versions) => {
 	switch (principal.kind) {
@@ -4059,7 +4423,11 @@ const rolesOf = async (principal, grants, executor, versions) => {
 			actions: DELIVERY_TOKEN_ACTIONS
 		};
 		case "appUser": return {
-			roleIds: [...await grants.getSiteAppRoleIds(principal.siteId, "authenticated", executor, versions), ...principal.roleIds],
+			roleIds: [.../* @__PURE__ */ new Set([
+				...await grants.getSiteAppRoleIds(principal.siteId, "public", executor, versions),
+				...await grants.getSiteAppRoleIds(principal.siteId, "authenticated", executor, versions),
+				...principal.roleIds
+			])],
 			networkRoleIds: [],
 			audience: "delivery",
 			actions: APP_ACTIONS