@caelo-cms/provisioning 0.10.53 → 0.10.57

package/dist/agent-db.js

@@ -382,6 +382,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a;
   for (let i = start;i < issues.length; i++) {
@@ -1379,7 +1391,7 @@ ${content.join(`
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
 // ../../node_modules/zod/v4/core/schemas.js
@@ -1931,6 +1943,29 @@ var $ZodNever = /* @__PURE__ */ $constructor("$ZodNever", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse(payload, ctx);
+  };
+}
+var arraySize = (input) => Array.isArray(input) ? input.length : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -1974,6 +2009,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
   const isPresent = key in input;
@@ -6905,6 +6941,7 @@ var PLATFORM_UPDATE_PHASES = [
   "verify",
   "assess",
   "backup",
+  "converge",
   "health-baseline",
   "migrations",
   "roll",
@@ -6914,6 +6951,7 @@ var PLATFORM_UPDATE_PHASES = [
   "self-update",
   "finish"
 ];
+var PLATFORM_UPDATE_ROUTES = ["app_roll", "converge"];
 var PLATFORM_UPDATE_EVENT_LEVELS = ["info", "success", "warn", "error"];
 var PLATFORM_UPDATE_TRIGGERS = ["manual", "auto"];
 var PLATFORM_UPDATE_STALE_MINUTES = 90;
@@ -6921,7 +6959,7 @@ var PLATFORM_UPDATE_STALE_REASON = "The upgrader stopped before it finished (its
 var PLATFORM_UPDATE_EVENT_MAX = 4000;
 var SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/;
 var releaseVersionSchema = string2().regex(SEMVER, "expected a release version like 0.11.0 (no leading v)");
-var UPDATE_POLICY_MODES = ["off", "notify", "auto"];
+var UPDATE_POLICY_MODES = ["notify", "auto"];
 var UPDATE_POLICY_CHANNELS = ["stable", "rc", "beta", "alpha"];
 var WALL_CLOCK = /^([01]\d|2[0-3]):[0-5]\d$/;
 function isKnownTimeZone(tz) {
@@ -6937,6 +6975,7 @@ var updatePolicySchema = object({
   autoSecurity: boolean2(),
   autoPatch: boolean2(),
   autoMinor: boolean2(),
+  autoConverge: boolean2(),
   channel: _enum(UPDATE_POLICY_CHANNELS),
   windowStart: string2().regex(WALL_CLOCK, "expected HH:MM").nullable(),
   windowEnd: string2().regex(WALL_CLOCK, "expected HH:MM").nullable(),
@@ -7079,6 +7118,119 @@ var counters = new Map;
 var NAV_FUNCTIONAL_CSS = ".caelo-nav-menu .caelo-nav-toggle{display:none;background:none;border:0;cursor:pointer;padding:0.5rem;color:inherit;font:inherit}" + ".caelo-nav-menu .caelo-nav-toggle .caelo-nav-bar{display:block;width:1.25em;height:2px;background:currentColor;margin:0.25em 0}" + "@media (max-width: 720px){" + ".caelo-nav-menu .caelo-nav-toggle{display:inline-block}" + ".caelo-nav-menu > ul{display:none}" + '.caelo-nav-menu[data-nav-open="true"] > ul{display:block}' + "}";
 var NAV_TOGGLE_JS = "(function(){" + "document.querySelectorAll('.caelo-nav-menu').forEach(function(nav){" + "var btn=nav.querySelector('.caelo-nav-toggle');if(!btn)return;" + "btn.addEventListener('click',function(){" + "var open=nav.getAttribute('data-nav-open')==='true';" + "nav.setAttribute('data-nav-open',String(!open));" + "btn.setAttribute('aria-expanded',String(!open));" + "});" + "nav.addEventListener('keydown',function(e){" + "if(e.key==='Escape'&&nav.getAttribute('data-nav-open')==='true'){" + "nav.setAttribute('data-nav-open','false');" + "btn.setAttribute('aria-expanded','false');btn.focus();" + "}});" + "});" + "})();";
 
+// ../shared/src/media.ts
+var MEDIA_ALLOWED_MIMES = [
+  "image/jpeg",
+  "image/png",
+  "image/webp",
+  "image/avif",
+  "image/gif",
+  "image/svg+xml",
+  "image/x-icon",
+  "application/pdf",
+  "video/mp4",
+  "font/woff2",
+  "font/woff",
+  "font/ttf",
+  "font/otf"
+];
+var MEDIA_SIZE_CAPS = {
+  "image/jpeg": 10 * 1024 * 1024,
+  "image/png": 10 * 1024 * 1024,
+  "image/webp": 10 * 1024 * 1024,
+  "image/avif": 10 * 1024 * 1024,
+  "image/gif": 8 * 1024 * 1024,
+  "image/svg+xml": 1 * 1024 * 1024,
+  "image/x-icon": 1 * 1024 * 1024,
+  "application/pdf": 20 * 1024 * 1024,
+  "video/mp4": 50 * 1024 * 1024,
+  "font/woff2": 5 * 1024 * 1024,
+  "font/woff": 5 * 1024 * 1024,
+  "font/ttf": 5 * 1024 * 1024,
+  "font/otf": 5 * 1024 * 1024
+};
+var MEDIA_HARD_LIMIT_BYTES = 50 * 1024 * 1024;
+var MEDIA_URL_PREFIX = "/_caelo/media";
+var RASTER_IMAGE_MIMES = new Set([
+  "image/jpeg",
+  "image/png",
+  "image/webp",
+  "image/avif",
+  "image/gif"
+]);
+var mediaUrlPattern = new RegExp(`${MEDIA_URL_PREFIX}/([a-z0-9][a-z0-9-]{0,63})(?:/([a-z][a-z0-9-]{0,63}))?`, "g");
+var sha256Schema = string2().regex(/^[0-9a-f]{64}$/, "must be hex sha256");
+var mediaVisibilitySchema = _enum(["library", "reference"]);
+var mediaUploadInputSchema = object({
+  sha256: sha256Schema,
+  originalName: string2().min(1).max(512),
+  name: string2().max(200).optional(),
+  mime: _enum(MEDIA_ALLOWED_MIMES),
+  sizeBytes: number2().int().positive(),
+  width: number2().int().positive().nullable(),
+  height: number2().int().positive().nullable(),
+  alt: string2().max(2048).default(""),
+  storageKey: string2().min(1),
+  storageProvider: string2().min(1).max(64).default("local"),
+  sourceKind: _enum(["upload", "ai_generated", "imported", "external"]).optional(),
+  sourceDetail: string2().max(2048).optional(),
+  license: string2().max(200).optional(),
+  visibility: mediaVisibilitySchema.optional(),
+  derivedFromId: string2().uuid().optional(),
+  variants: array(object({
+    variant: string2().min(1).max(64),
+    format: string2().min(1).max(32),
+    width: number2().int().positive().nullable(),
+    height: number2().int().positive().nullable(),
+    sizeBytes: number2().int().positive(),
+    storageKey: string2().min(1)
+  })).min(1)
+}).strict();
+var mediaListInputSchema = object({
+  query: string2().max(256).optional(),
+  mime: _enum(MEDIA_ALLOWED_MIMES).optional(),
+  sort: _enum(["recent", "most_used"]).default("recent"),
+  visibility: _enum(["library", "reference", "all"]).default("library"),
+  limit: number2().int().positive().max(200).default(60),
+  offset: number2().int().nonnegative().default(0)
+}).strict();
+var mediaUpdateAltInputSchema = object({
+  assetId: string2().uuid(),
+  alt: string2().max(2048)
+}).strict();
+var mediaSetSourceInputSchema = object({
+  assetId: string2().uuid(),
+  sourceKind: _enum(["upload", "ai_generated", "imported", "external"]).optional(),
+  sourceDetail: string2().max(2048).optional(),
+  license: string2().max(200).optional()
+}).strict();
+var mediaSetVisibilityInputSchema = object({
+  assetId: string2().uuid(),
+  visibility: mediaVisibilitySchema
+}).strict();
+var mediaDeleteInputSchema = object({
+  assetId: string2().uuid(),
+  force: boolean2().default(false)
+}).strict();
+var mediaRecordUsageInputSchema = object({
+  deltas: record(string2().uuid(), number2().int())
+}).strict();
+var mediaSetCdnInputSchema = object({
+  enabled: boolean2(),
+  threshold: number2().int().min(1).max(1e4)
+}).strict();
+
+// ../shared/src/link-refs.ts
+var UUID_SRC = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+var QUERY_SRC = "[A-Za-z0-9_\\-.~%=&;+/:@!$()*]{1,512}";
+var ANCHOR_SRC = "[A-Za-z0-9_\\-.~%:]{1,256}";
+var VARIANT_SRC = "[a-z][a-z0-9-]{0,63}";
+var ID_END_SRC = "(?![A-Za-z0-9_/\\-])";
+var PAGE_BODY_SRC = `page/(${UUID_SRC})${ID_END_SRC}(?:\\?(${QUERY_SRC}))?(?:#(${ANCHOR_SRC}))?`;
+var MEDIA_BODY_SRC = `media/(${UUID_SRC})(?:/(${VARIANT_SRC}))?${ID_END_SRC}`;
+var PAGE_REF_EXACT = new RegExp(`^caelo:${PAGE_BODY_SRC}$`);
+var MEDIA_REF_EXACT = new RegExp(`^caelo:${MEDIA_BODY_SRC}$`);
+
 // ../../node_modules/mustache/mustache.mjs
 /*!
  * mustache.js - Logic-less {{mustache}} templates with JavaScript
@@ -7551,6 +7703,21 @@ var THEME_ASSET_KEY_TO_SLOT = {
 };
 var THEME_ASSET_KEYS = Object.keys(THEME_ASSET_KEY_TO_SLOT);
 
+// ../shared/src/template-balance.ts
+var RAW_TEXT_ELEMENTS = new Set([
+  "script",
+  "style",
+  "textarea",
+  "title",
+  "xmp",
+  "iframe",
+  "noembed",
+  "noframes",
+  "noscript"
+]);
+var CODE_ELEMENTS = new Set(["script", "style"]);
+var FOREIGN_ROOTS = new Set(["svg", "math"]);
+
 // ../shared/src/font-assets.ts
 var fontRef = object({ id: string2().uuid(), sha256: string2().regex(/^[a-f0-9]{64}$/) }).strict();
 var fontLicense = object({
@@ -7908,6 +8075,8 @@ var SYSTEM_FONT_FAMILIES = new Set([
   "lucida console",
   "lucida sans"
 ].map((f) => f.toLowerCase()));
+var UNICODE_RANGE_ITEM = "U\\+[0-9A-F?]{1,6}(?:-[0-9A-F]{1,6})?";
+var UNICODE_RANGE_RE = new RegExp(`^${UNICODE_RANGE_ITEM}(?:, *${UNICODE_RANGE_ITEM})*$`, "i");
 // ../shared/src/genesis.ts
 var designBriefSchema = object({
   audience: string2().min(1).max(500).optional(),
@@ -7994,107 +8163,6 @@ var GENERIC_FONT_KEYWORDS = new Set([
 ]);
 // ../shared/src/markup-structure.ts
 var LEAF_TAGS = new Set(["svg", "math", "script", "style", "noscript", "iframe"]);
-// ../shared/src/media.ts
-var MEDIA_ALLOWED_MIMES = [
-  "image/jpeg",
-  "image/png",
-  "image/webp",
-  "image/avif",
-  "image/gif",
-  "image/svg+xml",
-  "image/x-icon",
-  "application/pdf",
-  "video/mp4",
-  "font/woff2",
-  "font/woff",
-  "font/ttf",
-  "font/otf"
-];
-var MEDIA_SIZE_CAPS = {
-  "image/jpeg": 10 * 1024 * 1024,
-  "image/png": 10 * 1024 * 1024,
-  "image/webp": 10 * 1024 * 1024,
-  "image/avif": 10 * 1024 * 1024,
-  "image/gif": 8 * 1024 * 1024,
-  "image/svg+xml": 1 * 1024 * 1024,
-  "image/x-icon": 1 * 1024 * 1024,
-  "application/pdf": 20 * 1024 * 1024,
-  "video/mp4": 50 * 1024 * 1024,
-  "font/woff2": 5 * 1024 * 1024,
-  "font/woff": 5 * 1024 * 1024,
-  "font/ttf": 5 * 1024 * 1024,
-  "font/otf": 5 * 1024 * 1024
-};
-var MEDIA_HARD_LIMIT_BYTES = 50 * 1024 * 1024;
-var MEDIA_URL_PREFIX = "/_caelo/media";
-var RASTER_IMAGE_MIMES = new Set([
-  "image/jpeg",
-  "image/png",
-  "image/webp",
-  "image/avif",
-  "image/gif"
-]);
-var mediaUrlPattern = new RegExp(`${MEDIA_URL_PREFIX}/([a-z0-9][a-z0-9-]{0,63})(?:/([a-z][a-z0-9-]{0,63}))?`, "g");
-var sha256Schema = string2().regex(/^[0-9a-f]{64}$/, "must be hex sha256");
-var mediaVisibilitySchema = _enum(["library", "reference"]);
-var mediaUploadInputSchema = object({
-  sha256: sha256Schema,
-  originalName: string2().min(1).max(512),
-  name: string2().max(200).optional(),
-  mime: _enum(MEDIA_ALLOWED_MIMES),
-  sizeBytes: number2().int().positive(),
-  width: number2().int().positive().nullable(),
-  height: number2().int().positive().nullable(),
-  alt: string2().max(2048).default(""),
-  storageKey: string2().min(1),
-  storageProvider: string2().min(1).max(64).default("local"),
-  sourceKind: _enum(["upload", "ai_generated", "imported", "external"]).optional(),
-  sourceDetail: string2().max(2048).optional(),
-  license: string2().max(200).optional(),
-  visibility: mediaVisibilitySchema.optional(),
-  derivedFromId: string2().uuid().optional(),
-  variants: array(object({
-    variant: string2().min(1).max(64),
-    format: string2().min(1).max(32),
-    width: number2().int().positive().nullable(),
-    height: number2().int().positive().nullable(),
-    sizeBytes: number2().int().positive(),
-    storageKey: string2().min(1)
-  })).min(1)
-}).strict();
-var mediaListInputSchema = object({
-  query: string2().max(256).optional(),
-  mime: _enum(MEDIA_ALLOWED_MIMES).optional(),
-  sort: _enum(["recent", "most_used"]).default("recent"),
-  visibility: _enum(["library", "reference", "all"]).default("library"),
-  limit: number2().int().positive().max(200).default(60),
-  offset: number2().int().nonnegative().default(0)
-}).strict();
-var mediaUpdateAltInputSchema = object({
-  assetId: string2().uuid(),
-  alt: string2().max(2048)
-}).strict();
-var mediaSetSourceInputSchema = object({
-  assetId: string2().uuid(),
-  sourceKind: _enum(["upload", "ai_generated", "imported", "external"]).optional(),
-  sourceDetail: string2().max(2048).optional(),
-  license: string2().max(200).optional()
-}).strict();
-var mediaSetVisibilityInputSchema = object({
-  assetId: string2().uuid(),
-  visibility: mediaVisibilitySchema
-}).strict();
-var mediaDeleteInputSchema = object({
-  assetId: string2().uuid(),
-  force: boolean2().default(false)
-}).strict();
-var mediaRecordUsageInputSchema = object({
-  deltas: record(string2().uuid(), number2().int())
-}).strict();
-var mediaSetCdnInputSchema = object({
-  enabled: boolean2(),
-  threshold: number2().int().min(1).max(1e4)
-}).strict();
 // ../shared/src/page-log.ts
 var pageLogEntryKinds = [
   "edited",
@@ -18018,6 +18086,9 @@ class DatabaseAdapter {
     return this.#publicRaw;
   }
   async provisionPluginPublicSchema(opts) {
+    if (!/^[0-9a-f-]{36}$/i.test(opts.pluginId)) {
+      throw new Error(`provisionPluginPublicSchema: pluginId "${opts.pluginId}" is not a UUID`);
+    }
     if (!this.#skipVerify)
       await this.verifyRoles();
     await this.#public.transaction(async (tx) => {
@@ -18027,12 +18098,15 @@ class DatabaseAdapter {
     });
   }
   async provisionPluginAdminSchema(opts) {
+    if (!/^[0-9a-f-]{36}$/i.test(opts.pluginId)) {
+      throw new Error(`provisionPluginAdminSchema: pluginId "${opts.pluginId}" is not a UUID`);
+    }
     const admin = this.#adminDb("provisionPluginAdminSchema");
     if (!this.#skipVerify)
       await this.verifyRoles();
     await admin.transaction(async (tx) => {
       await tx.execute(sql.raw("SELECT set_config('caelo.actor_kind', 'system', true)"));
-      await tx.execute(sql.raw(`SELECT set_config('caelo.plugin_id', '${opts.pluginId}', true)`));
+      await tx.execute(sql`SELECT set_config('caelo.plugin_id', ${opts.pluginId}, true)`);
       await tx.execute(sql.raw(opts.sql));
     });
   }
@@ -18067,7 +18141,18 @@ class DatabaseAdapter {
   }
 }
 // ../query-api/src/audit.ts
-var SENSITIVE_KEYS = new Set(["password", "token", "csrfToken", "passwordHash"]);
+var SENSITIVE_KEYS = new Set([
+  "password",
+  "newPassword",
+  "currentPassword",
+  "token",
+  "csrfToken",
+  "passwordHash",
+  "secret",
+  "apiKey",
+  "clientSecret"
+]);
+var SENSITIVE_KEY_RE = /pass(word|wd|phrase)?|secret|token|api[-_]?key|credential|private[-_]?key/i;
 function redact2(value) {
   if (value === null || value === undefined)
     return value;
@@ -18076,7 +18161,9 @@ function redact2(value) {
   if (typeof value === "object") {
     const out = {};
     for (const [k, v] of Object.entries(value)) {
-      out[k] = SENSITIVE_KEYS.has(k) ? "<redacted>" : redact2(v);
+      if (k === "__proto__" || k === "constructor" || k === "prototype")
+        continue;
+      out[k] = SENSITIVE_KEYS.has(k) || SENSITIVE_KEY_RE.test(k) ? "<redacted>" : redact2(v);
     }
     return out;
   }
@@ -18212,11 +18299,12 @@ class OperationRegistry {
 }
 // ../platform-updater/src/ops.ts
 var policySchema = object({
-  mode: _enum(["off", "notify", "auto"]),
+  mode: _enum(UPDATE_POLICY_MODES),
   autoSecurity: boolean2(),
   autoPatch: boolean2(),
   autoMinor: boolean2(),
-  channel: _enum(["stable", "rc", "beta", "alpha"]),
+  autoConverge: boolean2(),
+  channel: _enum(UPDATE_POLICY_CHANNELS),
   windowStart: string2().nullable(),
   windowEnd: string2().nullable(),
   windowTimezone: string2(),
@@ -18236,14 +18324,19 @@ var claimOutput = object({
     targetVersion: string2(),
     trigger: _enum(PLATFORM_UPDATE_TRIGGERS),
     autoBasis: _enum(AUTO_UPDATE_BASES).nullable(),
-    policy: policySchema
+    policy: policySchema,
+    resume: boolean2(),
+    execution: string2().nullable()
   }).nullable()
 });
 var jobClaimOp = defineOperation({
   name: "platform_updates.job_claim",
   actorScope: ["system"],
   database: "cms_admin",
-  input: object({ execution: string2().min(1).max(200).nullable() }).strict(),
+  input: object({
+    execution: string2().min(1).max(200).nullable(),
+    route: _enum(PLATFORM_UPDATE_ROUTES).default("app_roll")
+  }).strict(),
   output: claimOutput,
   handler: async (_ctx, input, tx) => {
     const stale = await tx.execute(sql`
@@ -18269,23 +18362,31 @@ var jobClaimOp = defineOperation({
          WHERE id = 1
       `);
     }
-    const claimed = await tx.execute(sql`
-      UPDATE platform_update_requests
-         SET status = 'running', started_at = now(), execution = ${input.execution}
-       WHERE id = (
-         SELECT id FROM platform_update_requests
-          WHERE status = 'pending'
-          ORDER BY requested_at
-          LIMIT 1
-          FOR UPDATE SKIP LOCKED
-       )
-       RETURNING id::text AS id, target_version, trigger, auto_basis
-    `);
-    const row = claimed[0];
+    const running = input.route === "converge" ? await tx.execute(sql`
+            SELECT id::text AS id, target_version, trigger, auto_basis, execution
+              FROM platform_update_requests
+             WHERE status = 'running' AND route = 'converge'
+             ORDER BY requested_at
+             LIMIT 1
+          `) : [];
+    const resumed = running[0];
+    const claimed = resumed ? [] : await tx.execute(sql`
+          UPDATE platform_update_requests
+             SET status = 'running', started_at = now(), execution = ${input.execution}
+           WHERE id = (
+             SELECT id FROM platform_update_requests
+              WHERE status = 'pending' AND route = ${input.route}
+              ORDER BY requested_at
+              LIMIT 1
+              FOR UPDATE SKIP LOCKED
+           )
+           RETURNING id::text AS id, target_version, trigger, auto_basis, execution
+        `);
+    const row = resumed ?? claimed[0];
     if (!row)
       return ok({ recovered: stale.map((s) => s.id), claimed: null });
     const policies = await tx.execute(sql`
-      SELECT mode, auto_security, auto_patch, auto_minor, channel,
+      SELECT mode, auto_security, auto_patch, auto_minor, auto_converge, channel,
              to_char(window_start, 'HH24:MI') AS window_start,
              to_char(window_end, 'HH24:MI') AS window_end,
              window_timezone, soak_hours, security_soak_hours, paused, paused_reason,
@@ -18303,11 +18404,14 @@ var jobClaimOp = defineOperation({
         targetVersion: row.target_version,
         trigger: row.trigger,
         autoBasis: row.auto_basis,
+        resume: resumed !== undefined,
+        execution: row.execution,
         policy: {
           mode: p.mode,
           autoSecurity: p.auto_security,
           autoPatch: p.auto_patch,
           autoMinor: p.auto_minor,
+          autoConverge: p.auto_converge,
           channel: p.channel,
           windowStart: p.window_start,
           windowEnd: p.window_end,
@@ -18325,6 +18429,36 @@ var jobClaimOp = defineOperation({
     });
   }
 });
+var jobHandoverOp = defineOperation({
+  name: "platform_updates.job_handover",
+  actorScope: ["system"],
+  database: "cms_admin",
+  input: object({
+    requestId: string2().uuid(),
+    from: string2().min(1).max(200).nullable(),
+    to: string2().min(1).max(200).nullable()
+  }).strict(),
+  output: object({ handedOver: boolean2() }),
+  handler: async (ctx, input, tx) => {
+    const rows = await tx.execute(sql`
+      UPDATE platform_update_requests
+         SET execution = ${input.to}, started_at = now()
+       WHERE id = ${input.requestId}::uuid AND status = 'running' AND route = 'converge'
+         AND execution IS NOT DISTINCT FROM ${input.from}
+       RETURNING id
+    `);
+    await recordAudit(tx, {
+      actorId: SYSTEM_ACTOR_ID,
+      requestId: ctx.requestId,
+      operation: "platform_updates.job_handover",
+      input: { requestId: input.requestId, from: input.from, to: input.to },
+      succeeded: rows.length > 0,
+      entityId: input.requestId,
+      resultSummary: rows.length > 0 ? input.to === null ? "released for the next run" : `run ${input.to}` : "not handed over (moved on)"
+    });
+    return ok({ handedOver: rows.length > 0 });
+  }
+});
 var jobEventOp = defineOperation({
   name: "platform_updates.job_event",
   actorScope: ["system"],
@@ -18450,26 +18584,36 @@ function upgraderRegistry() {
   registry.register(jobEventOp);
   registry.register(jobRecordOp);
   registry.register(jobFinishOp);
+  registry.register(jobHandoverOp);
   registry.register(agentHeartbeatOp);
   return registry;
 }
-function createDbAgentQueue(adapter, registry = upgraderRegistry()) {
+function opCaller(adapter, registry) {
   let n = 0;
   const ctx = () => ({
     actorId: SYSTEM_ACTOR_ID,
     actorKind: "system",
     requestId: `upgrader-job-${Date.now()}-${n++}`
   });
-  const call = async (op, input) => {
+  return async (op, input) => {
     const r = await execute(registry, adapter, ctx(), op, input);
     if (!r.ok)
       throw new Error(`${op}: ${JSON.stringify(r.error)}`);
     return r.value;
   };
+}
+function createDbAgentQueue(adapter, registry = upgraderRegistry()) {
+  const call = opCaller(adapter, registry);
   return {
     async claim(execution) {
-      const r = await call("platform_updates.job_claim", { execution });
-      return r.claimed;
+      const r = await call("platform_updates.job_claim", {
+        execution,
+        route: "app_roll"
+      });
+      if (!r.claimed)
+        return null;
+      const { resume: _resume, execution: _execution, ...request } = r.claimed;
+      return request;
     },
     async event(requestId, phase, level, message) {
       await call("platform_updates.job_event", { requestId, phase, level, message });

package/dist/audit-job-setup.d.ts

@@ -0,0 +1,69 @@
+import { type GcloudRunner, type Sleep } from "./gcloud-retry.js";
+import type { GcpProvider } from "./stack-contract.js";
+/** Where the admin image ships the task's entry point. */
+export declare const AUDIT_TASK_SCRIPT = "/app/packages/admin-core/src/quality/audit-task.ts";
+/** How many audit tasks run at once by default: 5 pages x 3 runs. */
+export declare const AUDIT_PARALLELISM_DEFAULT = 15;
+/**
+ * Roles the audit job's identity must never hold anywhere. Prefix matches
+ * (`roles/secretmanager.` = every Secret Manager role).
+ */
+export declare const AUDIT_FORBIDDEN_ROLES: readonly ["roles/owner", "roles/editor", "roles/run.", "roles/iam.", "roles/secretmanager.", "roles/cloudsql.", "roles/compute.", "roles/resourcemanager.", "roles/storage.admin", "roles/storage.objectAdmin", "roles/storage.objectUser"];
+/** Delete results after a day: the admin reads them within minutes. */
+export declare const AUDIT_RESULTS_LIFECYCLE: {
+    rule: {
+        action: {
+            type: string;
+        };
+        condition: {
+            age: number;
+        };
+    }[];
+};
+export interface AuditJobTarget {
+    readonly provider: GcpProvider;
+    readonly projectId: string;
+    readonly region: string;
+    /** Pulumi stack name (`production`). */
+    readonly env: string;
+    /** The admin image the job runs, digest-pinned (`…/admin@sha256:…`). */
+    readonly adminImageRef: string;
+    /**
+     * Tasks at once (`auditParallelism`, 1–15). Absent on converge: an
+     * existing job keeps the value it has, so an operator's choice survives
+     * `upgrade`; a job the converge creates gets
+     * {@link AUDIT_PARALLELISM_DEFAULT}, as a fresh install's does.
+     */
+    readonly parallelism?: number;
+}
+export type AuditJobResult = {
+    readonly ok: true;
+    readonly done: string[];
+} | {
+    readonly ok: false;
+    readonly done: string[];
+    readonly error: string;
+};
+/** Ensure the audit job and everything it needs. Never throws for a gcloud failure. */
+export declare function ensureAuditJob(target: AuditJobTarget, deps?: {
+    run?: GcloudRunner;
+    sleep?: Sleep;
+}): Promise<AuditJobResult>;
+/**
+ * {@link ensureAuditJob}'s image: the deployed admin's, so the job runs the
+ * code the admin runs.
+ */
+export declare function resolveAdminImage(opts: {
+    readonly projectId: string;
+    readonly region: string;
+    readonly env: string;
+}, deps?: {
+    run?: GcloudRunner;
+}): Promise<{
+    ok: true;
+    imageRef: string;
+} | {
+    ok: false;
+    error: string;
+}>;
+//# sourceMappingURL=audit-job-setup.d.ts.map

package/dist/audit-job-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-job-setup.d.ts","sourceRoot":"","sources":["../src/audit-job-setup.ts"],"names":[],"mappings":"AAgDA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAS3F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,uDAAuD,CAAC;AAEtF,qEAAqE;AACrE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAS5C;;;GAGG;AACH,eAAO,MAAM,qBAAqB,6OAYxB,CAAC;AAEX,uEAAuE;AACvE,eAAO,MAAM,uBAAuB;;;;;;;;;CAEnC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,uFAAuF;AACvF,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,cAAc,CAAC,CA6NzB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACnF,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAQxE"}