@caelo-cms/provisioning 0.11.10 → 0.11.12

package/dist/agent-db.js

@@ -18856,6 +18856,7 @@ async function recordAudit(tx, opts) {
 var SYSTEM_ACTOR_ID = "00000000-0000-0000-0000-00000000ffff";
 
 // ../query-api/src/branch-access.ts
+import { AsyncLocalStorage } from "async_hooks";
 var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function namedBranches(ctx, input) {
   const out = new Set;
@@ -18879,12 +18880,71 @@ function branchNotFound(operation, chatBranchId) {
 function firstMalformedBranch(branches) {
   return branches.find((b) => !UUID_RE2.test(b)) ?? null;
 }
-async function firstInvisibleBranch(tx, branches) {
+var VERDICT_MAX_AGE_MS = 30000;
+var visibilityScope = new AsyncLocalStorage;
+function verdictKey(ctx, branch) {
+  return `${ctx.actorKind}|${ctx.actorId}|${ctx.chatTaskId ?? ""}|${branch}`;
+}
+function rememberedVerdict(ctx, branch) {
+  const scope = visibilityScope.getStore();
+  if (!scope)
+    return;
+  const key = verdictKey(ctx, branch);
+  const hit = scope.verdicts.get(key);
+  if (!hit)
+    return;
+  if (Date.now() - hit.at > VERDICT_MAX_AGE_MS) {
+    scope.verdicts.delete(key);
+    return;
+  }
+  return hit.visible;
+}
+function rememberVerdict(ctx, branch, visible) {
+  const scope = visibilityScope.getStore();
+  if (!scope)
+    return;
+  const key = verdictKey(ctx, branch);
+  const entry = { visible, at: Date.now() };
+  scope.verdicts.set(key, entry);
+  visible.catch(() => {
+    if (scope.verdicts.get(key) === entry)
+      scope.verdicts.delete(key);
+  });
+}
+async function rememberedFirstInvisible(ctx, branches) {
+  const pending = [];
   for (const branch of branches) {
     if (!UUID_RE2.test(branch))
       return branch;
-    const rows = await tx.execute(sql`SELECT caelo_branch_visible(${branch}::uuid) AS visible`);
-    if (rows[0]?.visible !== true)
+    const visible = rememberedVerdict(ctx, branch);
+    if (!visible)
+      return;
+    pending.push({ branch, visible });
+  }
+  for (const p of pending) {
+    try {
+      if (!await p.visible)
+        return p.branch;
+    } catch {
+      return;
+    }
+  }
+  return null;
+}
+async function firstInvisibleBranch(tx, branches, ctx) {
+  for (const branch of branches) {
+    if (!UUID_RE2.test(branch))
+      return branch;
+    let visible = ctx ? rememberedVerdict(ctx, branch) : undefined;
+    if (!visible) {
+      visible = (async () => {
+        const rows = await tx.execute(sql`SELECT caelo_branch_visible(${branch}::uuid) AS visible`);
+        return rows[0]?.visible === true;
+      })();
+      if (ctx)
+        rememberVerdict(ctx, branch, visible);
+    }
+    if (!await visible)
       return branch;
   }
   return null;
@@ -19106,7 +19166,7 @@ async function provisionPluginSchemaInTx(tx, caller, opts) {
 }
 
 // ../query-api/src/pool-guard.ts
-import { AsyncLocalStorage } from "async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 var POOL_ACQUIRE_TIMEOUT_MS = 1e4;
 var LONG_TRANSACTIONS = [
   {
@@ -19146,13 +19206,14 @@ class PoolAcquireTimeoutError extends Error {
   timeoutMs;
   name = "PoolAcquireTimeoutError";
   constructor(pool, requester, timeoutMs) {
-    super(`the ${pool} database pool had no free connection for ${requester} within ${timeoutMs} ms: every connection is busy. ` + "Nothing was changed. Retry in a few seconds; if it keeps happening the admin is overloaded or a request holds its connections \u2014 the server log names it.");
+    super(`the ${pool} database pool had no free connection for ${requester} within ${timeoutMs} ms: every connection is busy. ` + `Nothing was changed. Retry in a few seconds (wait about ${Math.round(POOL_BUSY_RETRY_AFTER_MS / 1000)} s, then send the same call again unchanged); ` + "if it keeps happening the admin is overloaded or a request holds its connections \u2014 the server log names it.");
     this.pool = pool;
     this.requester = requester;
     this.timeoutMs = timeoutMs;
   }
 }
-var joining = new AsyncLocalStorage;
+var POOL_BUSY_RETRY_AFTER_MS = 5000;
+var joining = new AsyncLocalStorage2;
 function newMarker(holder, root) {
   return {
     holder,
@@ -19168,8 +19229,8 @@ function newMarker(holder, root) {
 
 class PoolGuard {
   #stores = {
-    admin: new AsyncLocalStorage,
-    public: new AsyncLocalStorage
+    admin: new AsyncLocalStorage2,
+    public: new AsyncLocalStorage2
   };
   plan(pool, holder) {
     const outer = this.held(pool);
@@ -19231,6 +19292,50 @@ function detachedRunner(operation, open) {
   });
 }
 
+// ../query-api/src/pool-pressure.ts
+var BUN_DEFAULT_POOL_MAX = 10;
+
+class PoolDemand {
+  #pool;
+  #max;
+  #now;
+  #next = 0;
+  #waiting = new Map;
+  #holding = new Map;
+  constructor(pool, max, now = Date.now) {
+    this.#pool = pool;
+    this.#max = max;
+    this.#now = now;
+  }
+  beginWait() {
+    const id = this.#next++;
+    this.#waiting.set(id, this.#now());
+    return () => {
+      this.#waiting.delete(id);
+    };
+  }
+  beginHold(holder) {
+    const id = this.#next++;
+    this.#holding.set(id, { holder, since: this.#now() });
+    return () => {
+      this.#holding.delete(id);
+    };
+  }
+  snapshot() {
+    const now = this.#now();
+    const firstWait = this.#waiting.values().next();
+    const holders = [...this.#holding.values()].map((h) => ({ holder: h.holder, heldMs: now - h.since })).sort((a, b) => b.heldMs - a.heldMs);
+    return {
+      pool: this.#pool,
+      max: this.#max,
+      inUse: this.#holding.size,
+      waiting: this.#waiting.size,
+      oldestWaitMs: firstWait.done ? 0 : now - firstWait.value,
+      holders
+    };
+  }
+}
+
 // ../query-api/src/post-commit.ts
 var pendingByTx = new WeakMap;
 function collectPostCommitEffects(tx) {
@@ -19367,20 +19472,24 @@ class DatabaseAdapter {
   #adminRaw;
   #publicRaw;
   #adminUrl;
+  #tls;
   #publicUrl;
   #listeners = new Map;
   #listenLost = new Map;
   #listenersClosing = false;
   #skipVerify;
   #roles;
+  #publicDatabase;
   #acquireTimeoutMs;
   #guard = new PoolGuard;
+  #demand;
   #verifyPromise = null;
   #projectionPublisher = null;
   #onStatement;
   #drizzleOptions;
   constructor(config) {
     this.#roles = config.expectedRoles ?? DEFAULT_ROLES;
+    this.#publicDatabase = config.publicDatabase ?? "cms_public";
     if (config.adminDatabaseUrl === null !== (this.#roles.admin === null)) {
       throw new Error("DatabaseAdapter: a public-only adapter (adminDatabaseUrl: null) must expect no admin role, and an adapter with an admin URL must expect one");
     }
@@ -19388,7 +19497,9 @@ class DatabaseAdapter {
     const poolMax = resolvePoolMax(config.poolMax);
     const publicPoolMax = resolvePublicPoolMax(config.publicPoolMax, config.poolMax);
     const idleTimeout = config.poolIdleTimeoutSeconds ?? POOL_IDLE_TIMEOUT_SECONDS;
-    const open = (url, max) => new SQL3(url, max === undefined ? { idleTimeout } : { max, idleTimeout });
+    this.#tls = config.tls ?? null;
+    const tls = this.#tls ? { tls: this.#tls } : {};
+    const open = (url, max) => new SQL3(url, max === undefined ? { idleTimeout, ...tls } : { max, idleTimeout, ...tls });
     this.#adminRaw = config.adminDatabaseUrl === null ? null : open(config.adminDatabaseUrl, poolMax);
     this.#publicRaw = open(config.publicDatabaseUrl, publicPoolMax);
     this.#adminUrl = config.adminDatabaseUrl;
@@ -19400,6 +19511,13 @@ class DatabaseAdapter {
     this.#public = drizzle(this.#publicRaw, this.#drizzleOptions);
     this.#skipVerify = config.skipRoleVerification === true;
     this.#acquireTimeoutMs = config.poolAcquireTimeoutMs ?? POOL_ACQUIRE_TIMEOUT_MS;
+    this.#demand = {
+      admin: new PoolDemand("admin", poolMax ?? BUN_DEFAULT_POOL_MAX),
+      public: new PoolDemand("public", publicPoolMax ?? BUN_DEFAULT_POOL_MAX)
+    };
+  }
+  poolPressure(pool) {
+    return this.#demand[pool].snapshot();
   }
   async#transaction(pool, holder, fn) {
     const raw = pool === "admin" ? this.#adminRaw : this.#publicRaw;
@@ -19410,6 +19528,7 @@ class DatabaseAdapter {
       return this.#joinHeld(pool, plan.outer, plan.marker, fn);
     const marker = plan.marker;
     const reserved = await this.#reserve(pool, raw, holder);
+    const endHold = this.#demand[pool].beginHold(holder);
     try {
       const db = drizzle({ client: reserved, ...this.#drizzleOptions });
       this.#onStatement?.("BEGIN");
@@ -19423,6 +19542,7 @@ class DatabaseAdapter {
       return out;
     } finally {
       reserved.release();
+      endHold();
       await this.#runAfterEnd(marker);
     }
   }
@@ -19466,6 +19586,7 @@ class DatabaseAdapter {
   async#reserve(pool, raw, requester) {
     const deadline = new AbortController;
     const timer = setTimeout(() => deadline.abort(), this.#acquireTimeoutMs);
+    const endWait = this.#demand[pool].beginWait();
     try {
       return await raw.reserve({ signal: deadline.signal });
     } catch (e) {
@@ -19474,6 +19595,7 @@ class DatabaseAdapter {
       }
       throw e;
     } finally {
+      endWait();
       clearTimeout(timer);
     }
   }
@@ -19520,8 +19642,8 @@ class DatabaseAdapter {
       }
       return;
     }
-    if (id.database !== "cms_public") {
-      throw new Error(`DatabaseAdapter public pool expected database cms_public but connected to ${id.database}. Check PUBLIC_DATABASE_URL / PUBLIC_ADMIN_DATABASE_URL.`);
+    if (id.database !== this.#publicDatabase) {
+      throw new Error(`DatabaseAdapter public pool expected database ${this.#publicDatabase} but connected to ${id.database}. Check ${this.#publicDatabase === "cms_public" ? "PUBLIC_DATABASE_URL / PUBLIC_ADMIN_DATABASE_URL" : "PUBLIC_DATABASE_URL / PUBLIC_STAGING_ADMIN_DATABASE_URL"}.`);
     }
     if (!this.#roles.public.includes(id.user)) {
       throw new Error(`DatabaseAdapter public pool expected user ${this.#roles.public.join(" or ")}, got ${id.user}.`);
@@ -19585,7 +19707,7 @@ class DatabaseAdapter {
           postCommit = collectPostCommitEffects(tx);
         await this.#setIdentity(tx, ctx, op.name);
         if (op.database === "cms_admin") {
-          const denied = await firstInvisibleBranch(tx, namedBranches(ctx, validatedInput));
+          const denied = await firstInvisibleBranch(tx, namedBranches(ctx, validatedInput), ctx);
           if (denied !== null)
             return err(branchNotFound(op.name, denied));
         }
@@ -19642,9 +19764,10 @@ class DatabaseAdapter {
     try {
       const branches = op.database === "cms_admin" ? namedBranches(ctx, validatedInput) : [];
       if (branches.length > 0) {
-        const denied = await this.#transaction("admin", op.name, async (tx) => {
+        const remembered = await rememberedFirstInvisible(ctx, branches);
+        const denied = remembered !== undefined ? remembered : await this.#transaction("admin", op.name, async (tx) => {
           await this.#setIdentity(tx, ctx);
-          return firstInvisibleBranch(tx, branches);
+          return firstInvisibleBranch(tx, branches, ctx);
         });
         if (denied !== null)
           return err(branchNotFound(op.name, denied));
@@ -19710,6 +19833,7 @@ class DatabaseAdapter {
     if (!conn) {
       conn = new SQL3(url, {
         max: LISTEN_CONNECTIONS_PER_INSTANCE,
+        ...this.#tls ? { tls: this.#tls } : {},
         onclose: (cause) => {
           if (this.#listenersClosing)
             return;
@@ -19743,7 +19867,8 @@ class DatabaseAdapter {
     try {
       const branches = namedBranches(ctx, validatedInput);
       if (branches.length > 0) {
-        const denied = await this.#shortRead(ctx, op.name, (tx) => firstInvisibleBranch(tx, branches));
+        const remembered = await rememberedFirstInvisible(ctx, branches);
+        const denied = remembered !== undefined ? remembered : await this.#shortRead(ctx, op.name, (tx) => firstInvisibleBranch(tx, branches, ctx));
         if (denied !== null)
           return err(branchNotFound(op.name, denied));
       }
@@ -19823,7 +19948,7 @@ class DatabaseAdapter {
       if (!joined)
         postCommit = collectPostCommitEffects(tx);
       await this.#setIdentity(tx, ctx, options.holder ?? null);
-      const denied = await firstInvisibleBranch(tx, namedBranches(ctx, undefined));
+      const denied = await firstInvisibleBranch(tx, namedBranches(ctx, undefined), ctx);
       if (denied !== null) {
         throw new OperationAbortError(branchNotFound("withAdminTransaction", denied));
       }
@@ -19860,11 +19985,40 @@ class DatabaseAdapter {
     if (this.#adminRaw === null)
       throw new AdminDatabaseUnavailableError("rawAdmin");
     this.#guard.assertNoHeldTransaction("admin", "rawAdmin()");
-    return this.#adminRaw;
+    return this.#trackedRaw("admin", this.#adminRaw);
   }
   rawPublic() {
     this.#guard.assertNoHeldTransaction("public", "rawPublic()");
-    return this.#publicRaw;
+    return this.#trackedRaw("public", this.#publicRaw);
+  }
+  #trackedRaw(pool, raw) {
+    const demand = this.#demand[pool];
+    return new Proxy(raw, {
+      get(target, property, receiver) {
+        const value = Reflect.get(target, property, receiver);
+        if (property !== "begin" || typeof value !== "function") {
+          return typeof value === "function" ? value.bind(target) : value;
+        }
+        return (...args) => {
+          const last = args.length - 1;
+          const fn = args[last];
+          if (typeof fn !== "function")
+            return value.apply(target, args);
+          const endWait = demand.beginWait();
+          const counted = async (tx) => {
+            endWait();
+            const endHold = demand.beginHold("raw.begin");
+            try {
+              return await fn(tx);
+            } finally {
+              endHold();
+            }
+          };
+          const out = value.apply(target, [...args.slice(0, last), counted]);
+          return out.finally(endWait);
+        };
+      }
+    });
   }
   async provisionPluginPublicSchema(opts) {
     if (!/^[0-9a-f-]{36}$/i.test(opts.pluginId)) {
@@ -19875,12 +20029,23 @@ class DatabaseAdapter {
     const outcome = await this.#transaction("public", "provisionPluginPublicSchema", async (tx) => {
       return provisionPluginSchemaInTx(tx, "provisionPluginPublicSchema", opts);
     });
-    if (outcome.droppedColumns.length > 0) {
-      await this.#transaction("admin", "provisionPluginPublicSchema", async (tx) => {
-        await tx.execute(sql.raw("SELECT set_config('caelo.actor_kind', 'system', true)"));
-        await auditDroppedColumns(tx, "cms_public", opts.pluginId, outcome);
-      });
+    const result = {
+      database: this.#publicDatabase,
+      schemaName: outcome.schemaName,
+      droppedColumns: outcome.droppedColumns
+    };
+    if (outcome.droppedColumns.length > 0 && this.#adminRaw !== null) {
+      await this.auditPluginSchemaDrop(opts.pluginId, result);
     }
+    return result;
+  }
+  async auditPluginSchemaDrop(pluginId, outcome) {
+    if (outcome.droppedColumns.length === 0)
+      return;
+    await this.#transaction("admin", "provisionPluginPublicSchema", async (tx) => {
+      await tx.execute(sql.raw("SELECT set_config('caelo.actor_kind', 'system', true)"));
+      await auditDroppedColumns(tx, outcome.database, pluginId, outcome);
+    });
   }
   async provisionPluginAdminSchema(opts) {
     if (!/^[0-9a-f-]{36}$/i.test(opts.pluginId)) {
@@ -19946,6 +20111,14 @@ async function auditDroppedColumns(tx, database, pluginId, outcome) {
 }
 function thrownToQueryError(operation, thrown, access) {
   const raw = thrown instanceof Error ? thrown.message : String(thrown);
+  if (thrown instanceof PoolAcquireTimeoutError) {
+    return {
+      kind: "HandlerError",
+      operation,
+      message: raw,
+      busy: { retryAfterMs: POOL_BUSY_RETRY_AFTER_MS }
+    };
+  }
   if (isRlsDenial(thrown)) {
     console.warn(`[query-api] ${operation}: RLS denied the ${access}: ${raw}`);
     return { kind: "RLSDenied", operation, detail: rlsDenialMessage(operation, access) };

package/dist/cli-routing.js

@@ -136,7 +136,7 @@ export const CLI_COMMANDS = [
 ];
 /** The text `cms-provision --help` prints, built from {@link CLI_COMMANDS}. */
 export function cliUsage() {
-    return (`Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r>] [--local|--install-job] | <${CLI_COMMANDS.map((c) => c.name).join("|")}> [options]\n` +
+    return (`Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r> [--scheduler-interval-minutes 1-15]] [--local|--install-job] | <${CLI_COMMANDS.map((c) => c.name).join("|")}> [options]\n` +
         "With several installs on this machine, pick one with --install <install-id or domain> (status, upgrade and backup also take --install all); in a terminal you are asked otherwise.\n" +
         "Pass --no-wizard with no sub-command to print this usage instead of the wizard.");
 }

package/dist/cli-routing.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-routing.js","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAenC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,YAA8B;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,KAAK,aAAa,CAAC;AACpC,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAA6B;IACpD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,sIAAsI;QAC5I,OAAO,EACL,4MAA4M;KAC/M;IACD;QACE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,EAAE;QACR,OAAO,EACL,iHAAiH;KACpH;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EACL,oGAAoG;KACvG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,2DAA2D;KACrE;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,4JAA4J;QAClK,OAAO,EACL,sGAAsG;KACzG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,2CAA2C;QACjD,OAAO,EACL,2IAA2I;KAC9I;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,8BAA8B;QACpC,OAAO,EACL,gHAAgH;KACnH;IACD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,+EAA+E;KACzF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,EAAE;QACR,OAAO,EACL,0GAA0G;KAC7G;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,2EAA2E;KACrF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,sFAAsF;KAChG;IACD;QACE,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,QAAQ;QACd,OAAO,EACL,8FAA8F;KACjG;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,wFAAwF;QAC9F,OAAO,EACL,mHAAmH;KACtH;IACD;QACE,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,mCAAmC;QACzC,OAAO,EACL,wGAAwG;KAC3G;IACD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,iEAAiE;QACvE,OAAO,EAAE,mFAAmF;KAC7F;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,qFAAqF;KAC/F;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,EAAE;QACR,OAAO,EACL,0HAA0H;KAC7H;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,0BAA0B;KACpC;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,QAAQ;IACtB,OAAO,CACL,sJAAsJ,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe;QAC9M,sLAAsL;QACtL,iFAAiF,CAClF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cli-routing.js","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAenC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,YAA8B;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,KAAK,aAAa,CAAC;AACpC,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAA6B;IACpD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,sIAAsI;QAC5I,OAAO,EACL,4MAA4M;KAC/M;IACD;QACE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,EAAE;QACR,OAAO,EACL,iHAAiH;KACpH;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EACL,oGAAoG;KACvG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,2DAA2D;KACrE;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,4JAA4J;QAClK,OAAO,EACL,sGAAsG;KACzG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,2CAA2C;QACjD,OAAO,EACL,2IAA2I;KAC9I;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,8BAA8B;QACpC,OAAO,EACL,gHAAgH;KACnH;IACD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,+EAA+E;KACzF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,EAAE;QACR,OAAO,EACL,0GAA0G;KAC7G;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,2EAA2E;KACrF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,sFAAsF;KAChG;IACD;QACE,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,QAAQ;QACd,OAAO,EACL,8FAA8F;KACjG;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,wFAAwF;QAC9F,OAAO,EACL,mHAAmH;KACtH;IACD;QACE,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,mCAAmC;QACzC,OAAO,EACL,wGAAwG;KAC3G;IACD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,iEAAiE;QACvE,OAAO,EAAE,mFAAmF;KAC7F;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,qFAAqF;KAC/F;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,EAAE;QACR,OAAO,EACL,0HAA0H;KAC7H;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,0BAA0B;KACpC;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,QAAQ;IACtB,OAAO,CACL,0LAA0L,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe;QAClP,sLAAsL;QACtL,iFAAiF,CAClF,CAAC;AACJ,CAAC"}

package/dist/cli.js

@@ -47,7 +47,8 @@ import { selfCommand } from "./self-command.js";
 import { ensureSelfHostedDbTls, selfHostedDbTlsServerCertSha256 } from "./self-hosted-db-tls.js";
 import { ensureInternalSecret, writeInternalSecret } from "./self-hosted-internal-secret.js";
 import { bunHostRunner, readRelease, recordRelease, releaseImages, resolveVerifiedRelease, } from "./self-hosted-release.js";
-import { applyPublicRoleLimits, convergeSelfHostedRoles, decideUp, selfHostedBootstrapScript, } from "./self-hosted-roles.js";
+import { applyPreMigrationRoles, convergeSelfHostedRoles, decideUp, selfHostedBootstrapScript, } from "./self-hosted-roles.js";
+import { parseSchedulerIntervalMinutes } from "./stack-contract.js";
 const REPO_ROOT = resolve(import.meta.dir, "../../..");
 /**
  * Whether this CLI runs from a Caelo source checkout (contributor) rather
@@ -139,6 +140,15 @@ function loadConfig() {
         cfg.composeProject ??= "caelo";
         saveConfig(cfg);
     }
+    // #1329 — the staging gateway's login came with the staging database. An
+    // install from before gets its own password now; the next `up` or
+    // upgrade creates the role with it (self-hosted-roles.ts) before anything
+    // uses it, so the roles count as not converged until then.
+    if (cfg.rolePasswords && !cfg.rolePasswords.publicStaging) {
+        cfg.rolePasswords = { ...cfg.rolePasswords, publicStaging: randomSecret(32) };
+        cfg.rolesConverged = false;
+        saveConfig(cfg);
+    }
     return cfg;
 }
 function saveConfig(c) {
@@ -152,9 +162,9 @@ function arg(name) {
         return undefined;
     return process.argv[idx + 1];
 }
-/** Fresh passwords for the two application roles. */
+/** Fresh passwords for the application roles. */
 function newRolePasswords() {
-    return { admin: randomSecret(32), public: randomSecret(32) };
+    return { admin: randomSecret(32), public: randomSecret(32), publicStaging: randomSecret(32) };
 }
 function emitConfig(cfg, extraDomains = []) {
     // Back-fill caeloSecretKek for installs created before P18. Persists
@@ -246,6 +256,9 @@ function renderCompose(cfg, images) {
         images,
         ports: cfg.ports,
         project: cfg.composeProject,
+        ...(cfg.schedulerIntervalMinutes !== undefined
+            ? { schedulerIntervalMinutes: cfg.schedulerIntervalMinutes }
+            : {}),
         ...(activeAgent(cfg) ? { agent: activeAgent(cfg) } : {}),
     });
 }
@@ -282,7 +295,20 @@ function agentContext(cfg) {
                 ...(activeAgent(cfg) ? { agentPassword: activeAgent(cfg)?.dbPassword } : {}),
             });
         },
-        applyPublicRoleLimits: () => applyPublicRoleLimits({ probe: postgresIsUp, psql: superuserPsql }),
+        applyPreMigrationRoles: () => {
+            if (!cfg.rolePasswords) {
+                return Promise.resolve({
+                    ok: false,
+                    reachable: true,
+                    error: "config.json has no role passwords — run `cms-provision up` first",
+                });
+            }
+            return applyPreMigrationRoles({
+                probe: postgresIsUp,
+                psql: superuserPsql,
+                stagingPassword: cfg.rolePasswords.publicStaging,
+            });
+        },
         renderCompose: (images) => renderCompose(cfg, images),
         refreshCaddy: () => refreshCaddyfile(cfg),
         randomSecret: () => randomSecret(32),
@@ -421,7 +447,7 @@ async function init() {
         return;
     }
     if (!domain || !ownerEmail) {
-        console.error("Usage: cms-provision init [--provider self-hosted] --domain example.com [--staging-domain staging.example.com] --owner-email me@example.com [--version x.y.z] [--skip-verify] [--dev] [--tls acme|internal] [--http-port 80] [--https-port 443]\n" +
+        console.error("Usage: cms-provision init [--provider self-hosted] --domain example.com [--staging-domain staging.example.com] --owner-email me@example.com [--version x.y.z] [--skip-verify] [--dev] [--tls acme|internal] [--http-port 80] [--https-port 443] [--scheduler-interval-minutes 5]\n" +
             "Cloud providers (gcp | gcp-firebase | aws | azure) run the wizard: cms-provision --provider <name>");
         process.exit(2);
     }
@@ -435,6 +461,18 @@ async function init() {
         console.error("--http-port and --https-port must differ");
         process.exit(2);
     }
+    const schedulerArg = arg("scheduler-interval-minutes");
+    let schedulerIntervalMinutes;
+    try {
+        schedulerIntervalMinutes =
+            schedulerArg === undefined
+                ? undefined
+                : parseSchedulerIntervalMinutes(schedulerArg, "--scheduler-interval-minutes");
+    }
+    catch (e) {
+        console.error(e.message);
+        process.exit(2);
+    }
     const stagingArg = arg("staging-domain");
     const stagingProblem = stagingArg
         ? stagingHostProblem(stagingArg, {
@@ -502,6 +540,7 @@ async function init() {
         tls,
         ports,
         composeProject: composeProjectName(domain),
+        ...(schedulerIntervalMinutes !== undefined ? { schedulerIntervalMinutes } : {}),
     };
     saveConfig(cfg);
     // P15.1 — the shared HMAC secret for /api/internal/* endpoints, read by
@@ -859,7 +898,7 @@ async function upgradeSelfHostedCommand(opts) {
             runner: bunHostRunner,
             renderCompose: (images) => renderCompose(cfg, images),
             convergeRoles: agentContext(cfg).convergeRoles,
-            applyPublicRoleLimits: agentContext(cfg).applyPublicRoleLimits,
+            applyPreMigrationRoles: agentContext(cfg).applyPreMigrationRoles,
             refreshCaddy: () => refreshCaddyfile(cfg),
             log: {
                 step: (m) => console.log(`\n==> ${m}`),
@@ -1356,13 +1395,26 @@ async function waitForDomainMappingCert(target) {
  * §11.C — interactive wizard. Loaded lazily so the bare-CLI startup
  * cost stays small (clack + kleur are pulled in only when needed).
  * Reads `--provider`, `--domain`, `--owner-email`, `--project-id`, `--region`,
- * `--non-interactive` and the run mode (`--local` / `--install-job`, default:
+ * `--scheduler-interval-minutes` (#1140), `--non-interactive` and the run mode (`--local` / `--install-job`, default:
  * the install job in Cloud Shell, local elsewhere — run-mode.ts) from argv.
  */
 async function wizardCommand() {
     const { runWizard } = await import("./wizard.js");
     const { chooseRunMode } = await import("./run-mode.js");
+    const schedulerArg = arg("scheduler-interval-minutes");
+    let schedulerIntervalMinutes;
+    try {
+        schedulerIntervalMinutes =
+            schedulerArg === undefined
+                ? undefined
+                : parseSchedulerIntervalMinutes(schedulerArg, "--scheduler-interval-minutes");
+    }
+    catch (e) {
+        console.error(e.message);
+        process.exit(2);
+    }
     await runWizard({
+        ...(schedulerIntervalMinutes !== undefined ? { schedulerIntervalMinutes } : {}),
         runMode: chooseRunMode(process.argv, process.env),
         nonInteractive: process.argv.includes("--non-interactive"),
         provider: arg("provider"),