@caelo-cms/provisioning 0.11.5 → 0.11.7

package/dist/agent-db.js

@@ -6614,6 +6614,8 @@ var LIST_RESERVED_NAMES = new Set([
   "site_text",
   "recurse"
 ]);
+var LIST_RESERVED_PREFIXES = ["is_", "has_", "count_"];
+var LIST_RESERVED_NAMES_CLAUSE = `reserved: ${[...LIST_RESERVED_NAMES].join(", ")}, ${LIST_RESERVED_PREFIXES.map((p) => `${p}*`).join(", ")}`;
 var listNameSchema = string2().regex(/^[a-z][a-z0-9_]{0,63}$/, "must be snake_case (lowercase letters, digits, underscores)");
 var fieldLabel = string2().min(1).max(128);
 var fieldExtSchema = record(string2().regex(/^[a-z0-9-]+$/), unknown());
@@ -6769,6 +6771,22 @@ var listItemInputSchema = lazy(() => object({
   query: record(string2(), unknown()).optional()
 }).strict());
 
+// ../shared/src/lists/page-type.ts
+var pageTypeDefSchema = object({
+  slug: string2().regex(/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/),
+  name: string2().min(1).max(200),
+  purpose: string2().min(1).max(1000),
+  collection: boolean2(),
+  templates: array(string2().uuid()).min(1).max(64),
+  defaultTemplate: string2().uuid(),
+  properties: array(fieldDefSchema).max(32).default([]),
+  vocabularies: array(object({
+    list: string2().uuid(),
+    cardinality: _enum(["one", "many"]),
+    required: boolean2().optional()
+  }).strict()).max(16).default([])
+}).strict();
+
 // ../shared/src/lists/pagination.ts
 var PAGINATION_FOLLOW_UPS = ["index", "noindex"];
 var listPaginationSchema = object({
@@ -6827,7 +6845,7 @@ var noCorruptCss = (value, ctx) => {
 var moduleHtml = string2().max(MODULE_HTML_MAX, `html exceeds ${MODULE_HTML_MAX} bytes`).superRefine(noCorruptMarkup("html"));
 var CDATA_OPEN = "<![CDATA[";
 var noCdata = (value) => !value.includes(CDATA_OPEN);
-var cdataMessage = (field) => `${field} contains an XML CDATA marker (${CDATA_OPEN}) \u2014 module ${field} is stored and served ` + `verbatim, so CDATA wrappers reach the browser unparsed and break rendering. ` + `Remove the wrapper and resend plain ${field === "css" ? "CSS" : "JavaScript"}.`;
+var cdataMessage = (field) => `${field} contains an XML CDATA marker (${CDATA_OPEN}) \u2014 module ${field} is stored and served ` + `verbatim, so CDATA wrappers reach the browser unparsed and break rendering. ` + `Remove the wrapper: pass plain ${field === "css" ? "CSS" : "JavaScript"}.`;
 var moduleCss = string2().max(MODULE_CSS_MAX, `css exceeds ${MODULE_CSS_MAX} bytes`).refine(noCdata, cdataMessage("css")).superRefine(noCorruptCss);
 var moduleJs = string2().max(MODULE_JS_MAX, `js exceeds ${MODULE_JS_MAX} bytes`).refine(noCdata, cdataMessage("js")).superRefine(noJsonEncodedCode("js"));
 var MODULE_FIELD_PRIMITIVE_KINDS = [
@@ -7026,10 +7044,13 @@ var moduleUpdateSchema = object({
   fields: moduleFieldsArray.optional()
 }).strict();
 var pageTypeSlugSchema = string2().regex(/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/, "page type slug: lowercase letters, digits, hyphens");
+var pageTypeDistinctFromSchema = array(pageTypeSlugSchema).max(16);
+var newPageTypeSchema = pageTypeDefSchema.omit({ templates: true, defaultTemplate: true }).extend({ distinctFrom: pageTypeDistinctFromSchema.optional() }).strict();
 var templateCreateSchema = object({
   slug: slugSchema,
   displayName: displayNameSchema,
   pageType: pageTypeSlugSchema.optional(),
+  newPageType: newPageTypeSchema.optional(),
   html: string2().max(TEMPLATE_HTML_MAX, `html exceeds ${TEMPLATE_HTML_MAX} bytes`).superRefine(noCorruptMarkup("html")),
   css: string2().max(TEMPLATE_CSS_MAX, `css exceeds ${TEMPLATE_CSS_MAX} bytes`).default(""),
   layoutId: string2().uuid().optional(),
@@ -7366,7 +7387,8 @@ var chatCreateSessionInput = object({
   templateId: string2().uuid().optional(),
   subagentRole: string2().min(1).max(120).optional(),
   parentChatSessionId: string2().uuid().nullable().optional(),
-  isolation: _enum(["experiment", "migration"]).optional()
+  isolation: _enum(["experiment", "migration"]).optional(),
+  agentClient: string2().min(1).max(200).optional()
 }).strict();
 var CHAT_IMAGE_MIMES = ["image/png", "image/jpeg", "image/webp", "image/gif"];
 var CHAT_MAX_ATTACHMENT_BYTES = 5 * 1024 * 1024;
@@ -7457,6 +7479,7 @@ var createTemplateToolInput = object({
   css: sourceTextArg(string2().max(2000000), "css").default(""),
   layoutId: string2().uuid().optional(),
   pageType: pageTypeSlugSchema.optional(),
+  newPageType: newPageTypeSchema.optional(),
   blocks: array(object({
     name: string2().min(1).max(80),
     displayName: string2().min(1).max(200),
@@ -7484,17 +7507,15 @@ var createLayoutToolInput = object({
   }).strict()).min(1).max(20)
 }).strict();
 var setSiteDefaultsToolInput = object({
-  defaultLayoutSlug: slugInputSchema.optional(),
-  defaultTemplateSlug: slugInputSchema.optional()
-}).strict().refine((v) => v.defaultLayoutSlug !== undefined || v.defaultTemplateSlug !== undefined, {
-  message: "must provide at least one of defaultLayoutSlug, defaultTemplateSlug"
-});
+  defaultLayoutSlug: slugInputSchema
+}).strict();
 var duplicatePageToolInput = object({
   sourcePageId: string2().uuid(),
   newSlug: slugInputSchema,
   newTitle: string2().min(1).max(256).optional(),
   newShortTitle: pageShortTitleSchema.optional(),
   targetTemplateId: string2().uuid().optional(),
+  pageType: pageTypeSlugSchema.optional(),
   newParentPageId: string2().uuid().nullable().optional()
 }).strict();
 var repointPageTemplateToolInput = object({
@@ -7628,6 +7649,7 @@ var bootstrapSiteScaffoldToolInput = object({
   })).max(8).optional(),
   templateSlug: string2().min(1).max(120).optional(),
   templateDisplayName: string2().min(1).max(256).optional(),
+  templatePageType: newPageTypeSchema.optional(),
   setAsDefaults: boolean2().optional()
 }).strict();
 var revertChatChangesToolInput = object({
@@ -7964,6 +7986,98 @@ var pageModuleContentSetManySchema = object({
 }).strict();
 // ../shared/src/cap-failures.ts
 var counters = new Map;
+// ../shared/src/change-journal.ts
+var JOURNAL_KINDS = [
+  "page",
+  "page_terms",
+  "page_seo",
+  "page_layout",
+  "page_module_content",
+  "module",
+  "template",
+  "template_blocks",
+  "layout",
+  "layout_blocks",
+  "layout_module",
+  "content_instance",
+  "list",
+  "list_type",
+  "page_type",
+  "theme",
+  "media",
+  "media_variant",
+  "media_crop",
+  "font",
+  "redirect",
+  "domain",
+  "site_defaults",
+  "site_settings",
+  "site_memory",
+  "skill",
+  "plugin",
+  "plugin_installation",
+  "plugin_grant",
+  "plugin_file",
+  "plugin_row",
+  "plugin_storage",
+  "snapshot"
+];
+var KIND_SET = new Set(JOURNAL_KINDS);
+var row = (kind, key, pair, extra = {}) => ({ kind, mode: "row", key, pair, ...extra });
+var snapshot = (kind, key, extra = {}) => ({ kind, mode: "snapshot", key, pair: ["id"], ...extra });
+var JOURNALED_TABLES = {
+  pages: row("page", "id", ["id"], { branch: "chat_branch_id" }),
+  page_terms: row("page_terms", "page_id", ["page_id", "list_id", "item_id"]),
+  pages_seo: row("page_seo", "page_id", ["page_id"]),
+  page_modules: row("page_layout", "page_id", ["page_id", "block_name", "position"]),
+  page_module_content: row("page_module_content", "id", ["id"], { parent: "page_id" }),
+  modules: row("module", "id", ["id"], { branch: "chat_branch_id" }),
+  templates: row("template", "id", ["id"], { branch: "chat_branch_id" }),
+  template_blocks: row("template_blocks", "template_id", ["template_id", "name"]),
+  layouts: row("layout", "id", ["id"], { branch: "chat_branch_id" }),
+  layout_blocks: row("layout_blocks", "layout_id", ["layout_id", "name"]),
+  layout_modules: row("layout_module", "layout_id", ["layout_id", "block_name", "position"]),
+  content_instances: row("content_instance", "id", ["id"], {
+    branch: "chat_branch_id",
+    parent: "module_id"
+  }),
+  lists: row("list", "id", ["id"], { branch: "chat_branch_id" }),
+  list_types: row("list_type", "id", ["id"], { branch: "chat_branch_id" }),
+  page_types: row("page_type", "id", ["id"], { branch: "chat_branch_id" }),
+  themes: row("theme", "id", ["id"]),
+  media_assets: row("media", "id", ["id"]),
+  media_variants: row("media_variant", "asset_id", ["asset_id", "variant"]),
+  media_crops: row("media_crop", "id", ["id"], { parent: "asset_id" }),
+  font_assets: row("font", "id", ["id"]),
+  redirects: row("redirect", "id", ["id"]),
+  domains: row("domain", "id", ["id"]),
+  site_defaults: row("site_defaults", "id", ["id"]),
+  site_settings: row("site_settings", "id", ["id"]),
+  site_ai_memory: row("site_memory", "id", ["id"]),
+  skills: row("skill", "id", ["id"]),
+  plugins: row("plugin", "id", ["id"]),
+  plugin_installation_versions: row("plugin_installation", "id", ["id"], { parent: "plugin_id" }),
+  plugin_capability_grants: row("plugin_grant", "id", ["id"], { parent: "plugin_id" }),
+  plugin_private_files: row("plugin_file", "id", ["plugin_id", "id"], { plugin: "plugin_id" }),
+  site_snapshots: { kind: "snapshot", mode: "header", key: "id", pair: ["id"] },
+  page_snapshots: snapshot("page", "page_id"),
+  page_layout_snapshots: snapshot("page_layout", "page_id"),
+  page_module_content_snapshots: snapshot("page_module_content", "page_module_content_id", {
+    parent: "page_id"
+  }),
+  module_snapshots: snapshot("module", "module_id"),
+  template_snapshots: snapshot("template", "template_id"),
+  layout_module_snapshots: snapshot("layout_module", "layout_id"),
+  content_instance_snapshots: snapshot("content_instance", "content_instance_id"),
+  list_snapshots: snapshot("list", "list_id"),
+  list_type_snapshots: snapshot("list_type", "list_type_id"),
+  page_type_snapshots: snapshot("page_type", "page_type_id"),
+  theme_snapshots: snapshot("theme", "theme_id"),
+  plugin_row_snapshots: snapshot("plugin_row", "row_id", {
+    parent: "table_name",
+    plugin: "plugin_id"
+  })
+};
 // ../shared/src/css-scope-scan.ts
 var GROUPING_AT_RULES = new Set(["media", "supports", "layer", "container", "document"]);
 // ../shared/src/interactions.ts
@@ -8026,6 +8140,13 @@ var RASTER_IMAGE_MIMES = new Set([
 ]);
 var mediaUrlPattern = new RegExp(`${MEDIA_URL_PREFIX}/([a-z0-9][a-z0-9-]{0,63})(?:/([a-z][a-z0-9-]{0,63}))?`, "g");
 var sha256Schema = string2().regex(/^[0-9a-f]{64}$/, "must be hex sha256");
+var publishedDigestSchema = object({
+  contentSha256: sha256Schema,
+  size: number2().int().nonnegative(),
+  gzipSha256: sha256Schema,
+  gzipSize: number2().int().nonnegative(),
+  profile: string2().min(1).max(64)
+}).strict();
 var mediaVisibilitySchema = _enum(["library", "reference"]);
 var mediaUploadInputSchema = object({
   sha256: sha256Schema,
@@ -8049,7 +8170,8 @@ var mediaUploadInputSchema = object({
     width: number2().int().positive().nullable(),
     height: number2().int().positive().nullable(),
     sizeBytes: number2().int().positive(),
-    storageKey: string2().min(1)
+    storageKey: string2().min(1),
+    digest: publishedDigestSchema
   })).min(1)
 }).strict();
 var mediaListInputSchema = object({
@@ -9058,20 +9180,6 @@ var NESTED_KINDS = new Set(["module", "module-list"]);
 // ../shared/src/lists/address.ts
 var SEG = "[a-z0-9_-]+";
 var ADDRESS_RE = new RegExp(`^(?:list/(${SEG})/item/(${SEG})/(${SEG})` + `|instance/(${SEG})/(${SEG})/item/(${SEG})/(${SEG})` + `|page/(${SEG})/props/(${SEG})` + `|list_type/(${SEG})/node/(${SEG})/(${SEG}))$`);
-// ../shared/src/lists/page-type.ts
-var pageTypeDefSchema = object({
-  slug: string2().regex(/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/),
-  name: string2().min(1).max(200),
-  purpose: string2().min(1).max(1000),
-  templates: array(string2().uuid()).min(1).max(64),
-  defaultTemplate: string2().uuid(),
-  properties: array(fieldDefSchema).max(32).default([]),
-  vocabularies: array(object({
-    list: string2().uuid(),
-    cardinality: _enum(["one", "many"]),
-    required: boolean2().optional()
-  }).strict()).max(16).default([])
-}).strict();
 // ../shared/src/lists/resolve.ts
 var SEG2 = "[a-z0-9_-]+";
 var LIST_VALUE_RE = new RegExp(`^list/(${SEG2})/item/(${SEG2})/(${SEG2})$`);
@@ -9087,7 +9195,8 @@ var LIVE_TOPICS = [
   "credentials",
   "quality",
   "crawl",
-  "deploys"
+  "deploys",
+  "draft"
 ];
 var TOPIC_SET = new Set(LIVE_TOPICS);
 // ../shared/src/markup-structure.ts
@@ -9122,8 +9231,43 @@ var pageLogEntrySchema = object({
 // ../shared/src/phase-timer.ts
 var phaseTimingSchema = object({
   phase: string2().min(1),
-  ms: number2().int().nonnegative()
+  ms: number2().int().nonnegative(),
+  peakRssMb: number2().int().nonnegative().optional(),
+  cpuMs: number2().int().nonnegative().optional()
 });
+var RSS_SAMPLE_MS = 25;
+var MIB = 1024 * 1024;
+function rssNow() {
+  return typeof process !== "undefined" && typeof process.memoryUsage === "function" ? process.memoryUsage().rss : 0;
+}
+var sampler = (() => {
+  const listeners = new Set;
+  let timer = null;
+  return {
+    add(fn) {
+      listeners.add(fn);
+      if (timer === null) {
+        timer = setInterval(() => {
+          const rss = rssNow();
+          for (const l of listeners)
+            l(rss);
+        }, RSS_SAMPLE_MS);
+        timer.unref?.();
+      }
+    },
+    remove(fn) {
+      listeners.delete(fn);
+      if (listeners.size === 0 && timer !== null) {
+        clearInterval(timer);
+        timer = null;
+      }
+    }
+  };
+})();
+// ../shared/src/pool-budget.ts
+var DB_POOL_MAX_ENV = "CAELO_DB_POOL_MAX";
+var DB_PUBLIC_POOL_MAX_ENV = "CAELO_DB_PUBLIC_POOL_MAX";
+var MIN_POOL_MAX = 2;
 // ../shared/src/proposal-status.ts
 var PROPOSAL_STATUSES = ["pending", "applied", "rejected", "superseded"];
 var proposalStatus = _enum(PROPOSAL_STATUSES);
@@ -9214,6 +9358,36 @@ var revertPageInput = object({
   pageId: string2().uuid(),
   snapshotId: string2().uuid()
 }).strict();
+// ../shared/src/stage-status.ts
+var stagePhaseSchema = _enum([
+  "queued",
+  "preparing",
+  "building",
+  "publishing",
+  "succeeded",
+  "failed"
+]);
+var stageEtaBasisSchema = _enum(["this_run_rate", "last_successful_run"]);
+var stageEtaSchema = object({
+  remainingMs: number2().int().nonnegative(),
+  basis: stageEtaBasisSchema,
+  includesPublish: boolean2()
+});
+var stageStatusRunSchema = object({
+  runId: string2(),
+  targetName: string2(),
+  status: _enum(["queued", "running", "succeeded", "failed"]),
+  phase: stagePhaseSchema,
+  pagesDone: number2().int().nonnegative().nullable(),
+  pagesTotal: number2().int().nonnegative().nullable(),
+  startedAt: string2(),
+  finishedAt: string2().nullable(),
+  elapsedMs: number2().int().nonnegative(),
+  error: string2().nullable(),
+  failedPhase: string2().nullable(),
+  eta: stageEtaSchema.nullable(),
+  etaUnavailable: string2().nullable()
+});
 // ../shared/src/staging-gate.ts
 var STAGING_SESSION_TTL_SECONDS = 12 * 60 * 60;
 var ENCODER = new TextEncoder;
@@ -18665,7 +18839,8 @@ function extractPgFields(error) {
   let current = error;
   for (let depth = 0;depth < 5 && typeof current === "object" && current !== null; depth++) {
     const e = current;
-    const code = typeof e.code === "string" ? e.code : typeof e.errno === "string" ? e.errno : undefined;
+    const sqlstate = typeof e.errno === "string" && /^[0-9A-Z]{5}$/.test(e.errno) ? e.errno : undefined;
+    const code = sqlstate ?? (typeof e.code === "string" ? e.code : undefined);
     const constraint = typeof e.constraint === "string" ? e.constraint : undefined;
     const table = typeof e.table === "string" ? e.table : undefined;
     const column = typeof e.column === "string" ? e.column : undefined;
@@ -18682,6 +18857,11 @@ function extractPgFields(error) {
         out.column = column;
       if (detail)
         out.detail = detail;
+      const message = typeof e.message === "string" ? e.message : "";
+      if (code === "57014" && message.includes("statement timeout"))
+        out.timeout = "statement";
+      if (code === "55P03" && message.includes("lock timeout"))
+        out.timeout = "lock";
       return out;
     }
     current = e.cause;
@@ -18737,6 +18917,88 @@ function defineOperation(def) {
   };
 }
 
+// ../query-api/src/pg-failure.ts
+var DATABASE_STATEMENT_TIMEOUT_SECONDS = 60;
+var DATABASE_LOCK_TIMEOUT_SECONDS = 15;
+function parseKey(detail) {
+  if (!detail)
+    return null;
+  const start = detail.indexOf("Key (");
+  if (start === -1)
+    return null;
+  const sep = detail.indexOf(")=(", start + 5);
+  const end = detail.lastIndexOf(")");
+  if (sep === -1 || end <= sep + 2)
+    return null;
+  const columns = detail.slice(start + 5, sep);
+  if (columns.includes(")"))
+    return null;
+  return { columns, values: detail.slice(sep + 3, end) };
+}
+function keyPhrase(key) {
+  return key.columns.includes(",") ? `the combination \`${key.columns}\` = (${key.values})` : `\`${key.columns}\` "${key.values}"`;
+}
+function describePgFailure(fields) {
+  const key = parseKey(fields.detail);
+  switch (fields.code) {
+    case "23505":
+      return {
+        message: key ? `${keyPhrase(key)} already exists \u2014 choose a different value` : "a row with the same unique value already exists \u2014 choose a different value",
+        internal: false
+      };
+    case "23503":
+      if (fields.detail?.includes("still referenced")) {
+        return {
+          message: "the row is still referenced by other content \u2014 remove those references first",
+          internal: false
+        };
+      }
+      return {
+        message: key ? `${keyPhrase(key)} names a row that does not exist or was deleted \u2014 use an id from the matching list tool` : "a referenced row does not exist or was deleted \u2014 use an id from the matching list tool",
+        internal: false
+      };
+    case "23502":
+      return {
+        message: fields.column ? `\`${fields.column}\` is required but was empty` : "a required value was empty",
+        internal: false
+      };
+    case "23514":
+      return { message: "a value is outside the allowed range or set", internal: false };
+    case "22P02":
+      return {
+        message: "a value has the wrong format (e.g. an id that is not a UUID) \u2014 copy ids exactly",
+        internal: false
+      };
+    case "22001":
+      return { message: "a text value is longer than allowed \u2014 shorten it", internal: false };
+    case "22003":
+      return { message: "a number is out of range", internal: false };
+    case "57014":
+      if (fields.timeout === "statement") {
+        return {
+          message: `timed out after ${DATABASE_STATEMENT_TIMEOUT_SECONDS} s (the database's statement timeout) \u2014 a defect in Caelo, reported automatically`,
+          internal: true
+        };
+      }
+      break;
+    case "55P03":
+      if (fields.timeout === "lock") {
+        return {
+          message: `waited ${DATABASE_LOCK_TIMEOUT_SECONDS} s for a row another change holds \u2014 try the call again once that change finished`,
+          internal: false
+        };
+      }
+      break;
+  }
+  return {
+    message: "a database error the call cannot fix \u2014 a defect in Caelo, reported automatically",
+    internal: true
+  };
+}
+function rlsDenialMessage(operation, access) {
+  return `permission denied: ${operation} may not ${access} that row as the current actor ` + "(it is not visible on this chat's branch, or belongs to another actor or plugin). " + "Check the ids against the matching list tool; if they are right, the change needs a human with the permission.";
+}
+
 // ../query-api/src/plugin-schema-provision.ts
 import { createHash } from "crypto";
 var DROPPED_COLUMNS_SETTING = "caelo.plugin_dropped_columns";
@@ -18763,6 +19025,9 @@ async function provisionPluginSchemaInTx(tx, caller, opts) {
     return { schemaName, droppedColumns: [] };
   await tx.execute(sql.raw(opts.sql));
   const dropped = await tx.execute(sql.raw(`SELECT coalesce(current_setting('${DROPPED_COLUMNS_SETTING}', true), '') AS v`));
+  if (opts.journal === true) {
+    await tx.execute(sql`SELECT caelo_journal_attach_plugin_schema(${schemaName}, ${opts.pluginId}::uuid)`);
+  }
   await tx.execute(sql`
     INSERT INTO plugin_schema_provisions (schema_name, sql_digest)
     VALUES (${schemaName}, ${digest})
@@ -18778,18 +19043,25 @@ async function provisionPluginSchemaInTx(tx, caller, opts) {
 // ../query-api/src/pool-guard.ts
 import { AsyncLocalStorage } from "async_hooks";
 var POOL_ACQUIRE_TIMEOUT_MS = 1e4;
-var NESTED_CHECKOUTS = [
-  { holder: "plugins.render_hook", issue: 1220 }
-];
 var LONG_TRANSACTIONS = [
   {
     holder: "static-generator.build",
     reason: "a static site build runs in one transaction for as long as the build takes, idle while plugins render and files are written."
   }
 ];
-var NESTED_CHECKOUT_ALLOWLIST = new Map(NESTED_CHECKOUTS.map((entry) => [entry.holder, entry]));
 var LONG_TRANSACTION_ALLOWLIST = new Map(LONG_TRANSACTIONS.map((entry) => [entry.holder, entry]));
 
+class SerialQueue {
+  #tail = Promise.resolve();
+  run(fn) {
+    const next = this.#tail.then(fn, fn);
+    this.#tail = next.catch(() => {
+      return;
+    });
+    return next;
+  }
+}
+
 class NestedPoolCheckoutError extends Error {
   pool;
   holder;
@@ -18815,24 +19087,55 @@ class PoolAcquireTimeoutError extends Error {
     this.timeoutMs = timeoutMs;
   }
 }
-var allowances = new AsyncLocalStorage;
+var joining = new AsyncLocalStorage;
+function newMarker(holder, root) {
+  return {
+    holder,
+    active: true,
+    tx: null,
+    identity: null,
+    identityOpName: null,
+    root,
+    joined: new SerialQueue,
+    afterEnd: []
+  };
+}
+
 class PoolGuard {
   #stores = {
     admin: new AsyncLocalStorage,
     public: new AsyncLocalStorage
   };
-  enter(pool, holder) {
-    const allowedBy = this.assertMayCheckout(pool, holder);
-    return { holder, active: true, allowedBy };
+  plan(pool, holder) {
+    const outer = this.held(pool);
+    if (outer === null)
+      return { kind: "own", marker: newMarker(holder, null) };
+    this.assertMayCheckout(pool, holder);
+    return { kind: "join", outer, marker: newMarker(holder, outer.root ?? outer) };
+  }
+  held(pool) {
+    const outer = this.#stores[pool].getStore();
+    return outer?.active ? outer : null;
   }
   assertMayCheckout(pool, requester) {
-    const outer = this.#stores[pool].getStore();
-    if (outer === undefined || !outer.active)
-      return null;
-    const allowedBy = outer.allowedBy ?? (NESTED_CHECKOUT_ALLOWLIST.has(outer.holder) ? outer.holder : null) ?? allowances.getStore() ?? null;
-    if (allowedBy === null)
+    const outer = this.held(pool);
+    if (outer === null || joining.getStore() === true)
+      return;
+    throw new NestedPoolCheckoutError(pool, outer.holder, requester);
+  }
+  assertNoHeldTransaction(pool, requester) {
+    const outer = this.held(pool);
+    if (outer !== null)
       throw new NestedPoolCheckoutError(pool, outer.holder, requester);
-    return allowedBy;
+  }
+  async deferUntilEnd(pool, work) {
+    const outer = this.held(pool);
+    if (outer === null) {
+      await work();
+      return false;
+    }
+    (outer.root ?? outer).afterEnd.push(work);
+    return true;
   }
   async run(pool, marker, fn) {
     try {
@@ -18870,6 +19173,15 @@ function collectPostCommitEffects(tx) {
   pendingByTx.set(tx, pending);
   return pending;
 }
+function mergeSavepointEffects(effects, parentTx) {
+  if (effects.length === 0)
+    return;
+  const pending = pendingByTx.get(parentTx);
+  if (pending === undefined) {
+    throw new Error(`afterCommit(${effects[0]?.label}): the transaction this call joined collects no post-commit effects`);
+  }
+  pending.push(...effects);
+}
 async function runPostCommitEffects(effects) {
   const failures = [];
   for (const effect of effects) {
@@ -18894,6 +19206,10 @@ function notifyOperationCommitted(operationName) {
     }
   }
 }
+var commitNotice = null;
+function commitNoticeOf(operationName) {
+  return commitNotice === null ? null : commitNotice(operationName);
+}
 
 // ../query-api/src/adapter.ts
 var SQL3 = globalThis.Bun?.SQL;
@@ -18932,13 +19248,21 @@ class AdminDatabaseUnavailableError extends Error {
 function resolvePoolMax(explicit) {
   if (explicit !== undefined)
     return validatePoolMax(explicit, "poolMax option");
-  const raw = process.env.CAELO_DB_POOL_MAX;
+  const raw = process.env[DB_POOL_MAX_ENV];
   if (raw === undefined || raw === "")
     return;
-  return validatePoolMax(Number(raw), "CAELO_DB_POOL_MAX");
+  return validatePoolMax(Number(raw), DB_POOL_MAX_ENV);
+}
+function resolvePublicPoolMax(explicitPublic, explicitAll) {
+  if (explicitPublic !== undefined)
+    return validatePoolMax(explicitPublic, "publicPoolMax option");
+  const raw = process.env[DB_PUBLIC_POOL_MAX_ENV];
+  if (raw !== undefined && raw !== "")
+    return validatePoolMax(Number(raw), DB_PUBLIC_POOL_MAX_ENV);
+  return resolvePoolMax(explicitAll);
 }
 function validatePoolMax(value, source) {
-  if (!Number.isInteger(value) || value < 2) {
+  if (!Number.isInteger(value) || value < MIN_POOL_MAX) {
     throw new Error(`${source} must be an integer >= 2 (got ${value}); ` + `1 self-deadlocks the pool. Leave it unset for the Bun default of 10.`);
   }
   return value;
@@ -18962,12 +19286,18 @@ function postCommitFailureMessage(failures) {
   const list = failures.map((f) => `${f.effect.label} (${f.message})`).join("; ");
   return `The change is saved, but its follow-up in the running server failed: ${list}. Do not repeat the change. Restart the admin server so the running state is rebuilt from the saved data; the failure is in the audit log.`;
 }
+var LISTEN_CONNECTIONS_PER_INSTANCE = 1;
 
 class DatabaseAdapter {
   #admin;
   #public;
   #adminRaw;
   #publicRaw;
+  #adminUrl;
+  #publicUrl;
+  #listeners = new Map;
+  #listenLost = new Map;
+  #listenersClosing = false;
   #skipVerify;
   #roles;
   #acquireTimeoutMs;
@@ -18983,10 +19313,13 @@ class DatabaseAdapter {
     }
     assertPoolSafeBun(globalThis.Bun?.version ?? "0");
     const poolMax = resolvePoolMax(config.poolMax);
+    const publicPoolMax = resolvePublicPoolMax(config.publicPoolMax, config.poolMax);
     const idleTimeout = config.poolIdleTimeoutSeconds ?? POOL_IDLE_TIMEOUT_SECONDS;
-    const open = (url) => new SQL3(url, poolMax === undefined ? { idleTimeout } : { max: poolMax, idleTimeout });
-    this.#adminRaw = config.adminDatabaseUrl === null ? null : open(config.adminDatabaseUrl);
-    this.#publicRaw = open(config.publicDatabaseUrl);
+    const open = (url, max) => new SQL3(url, max === undefined ? { idleTimeout } : { max, idleTimeout });
+    this.#adminRaw = config.adminDatabaseUrl === null ? null : open(config.adminDatabaseUrl, poolMax);
+    this.#publicRaw = open(config.publicDatabaseUrl, publicPoolMax);
+    this.#adminUrl = config.adminDatabaseUrl;
+    this.#publicUrl = config.publicDatabaseUrl;
     this.#onStatement = config.onStatement ?? null;
     const observe = this.#onStatement;
     this.#drizzleOptions = observe ? { logger: { logQuery: (query) => observe(query) } } : {};
@@ -18999,22 +19332,64 @@ class DatabaseAdapter {
     const raw = pool === "admin" ? this.#adminRaw : this.#publicRaw;
     if (raw === null)
       throw new AdminDatabaseUnavailableError(holder);
-    const marker = this.#guard.enter(pool, holder);
+    const plan = this.#guard.plan(pool, holder);
+    if (plan.kind === "join")
+      return this.#joinHeld(pool, plan.outer, plan.marker, fn);
+    const marker = plan.marker;
     const reserved = await this.#reserve(pool, raw, holder);
     try {
       const db = drizzle({ client: reserved, ...this.#drizzleOptions });
       this.#onStatement?.("BEGIN");
       const out = await db.transaction((tx) => this.#guard.run(pool, marker, async () => {
+        marker.tx = tx;
         if (exemptFromSessionTimeouts(holder))
           await liftSessionTimeouts(tx);
-        return fn(tx);
+        return fn(tx, false);
       }));
       this.#onStatement?.("COMMIT");
       return out;
     } finally {
       reserved.release();
+      await this.#runAfterEnd(marker);
     }
   }
+  #joinHeld(pool, outer, marker, fn) {
+    return outer.joined.run(async () => {
+      const outerTx = outer.tx;
+      if (outerTx === null || !outer.active) {
+        throw new NestedPoolCheckoutError(pool, outer.holder, marker.holder);
+      }
+      let effects = [];
+      const out = await outerTx.transaction((savepoint) => this.#guard.run(pool, marker, async () => {
+        marker.tx = savepoint;
+        effects = collectPostCommitEffects(savepoint);
+        return fn(savepoint, true);
+      }));
+      mergeSavepointEffects(effects, outerTx);
+      if (outer.identity !== null) {
+        await this.#setIdentity(outerTx, outer.identity, outer.identityOpName);
+      }
+      return out;
+    });
+  }
+  async#runAfterEnd(marker) {
+    for (const work of marker.afterEnd.splice(0)) {
+      try {
+        await work();
+      } catch (thrown) {
+        console.error("[query-api] work deferred until a transaction ended failed", {
+          holder: marker.holder,
+          error: thrown instanceof Error ? thrown.message : String(thrown)
+        });
+      }
+    }
+  }
+  deferUntilHeldTransactionEnds(work) {
+    return this.#guard.deferUntilEnd("admin", work);
+  }
+  holdsTransaction(pool) {
+    return this.#guard.held(pool) !== null;
+  }
   async#reserve(pool, raw, requester) {
     const deadline = new AbortController;
     const timer = setTimeout(() => deadline.abort(), this.#acquireTimeoutMs);
@@ -19129,10 +19504,13 @@ class DatabaseAdapter {
     let postCommit = [];
     let result;
     let handlerError = null;
+    let joinedHolder = false;
     try {
-      result = await this.#transaction(pool, op.name, async (tx) => {
-        postCommit = collectPostCommitEffects(tx);
-        await this.#setIdentity(tx, ctx);
+      result = await this.#transaction(pool, op.name, async (tx, joined) => {
+        joinedHolder = joined;
+        if (!joined)
+          postCommit = collectPostCommitEffects(tx);
+        await this.#setIdentity(tx, ctx, op.name);
         if (op.database === "cms_admin") {
           const denied = await firstInvisibleBranch(tx, namedBranches(ctx, validatedInput));
           if (denied !== null)
@@ -19142,7 +19520,12 @@ class DatabaseAdapter {
         if (!out.ok)
           handlerError = out;
         if (out.ok && op.database === "cms_admin") {
-          publishAfterCommit = await this.#projectionDirty(tx);
+          if (!joined)
+            publishAfterCommit = await this.#projectionDirty(tx);
+          const notice = commitNoticeOf(op.name);
+          if (notice !== null) {
+            await tx.execute(sql`SELECT pg_notify(${notice.channel}, ${notice.payload})`);
+          }
         }
         return out;
       });
@@ -19152,23 +19535,11 @@ class DatabaseAdapter {
       if (thrown instanceof OperationAbortError) {
         return err(thrown.queryError);
       }
-      if (isRlsDenial(thrown)) {
-        return err({
-          kind: "RLSDenied",
-          operation: op.name,
-          detail: thrown.message ?? "RLS policy denied the write"
-        });
-      }
       const pgDetail = extractPgFields(thrown);
       if (pgDetail?.code === COMMIT_ROLLED_BACK && handlerError !== null) {
         return handlerError;
       }
-      return err({
-        kind: "HandlerError",
-        operation: op.name,
-        message: thrown instanceof Error ? thrown.message : String(thrown),
-        ...pgDetail ? { pgDetail } : {}
-      });
+      return err(thrownToQueryError(op.name, thrown, "write"));
     }
     const effectFailures = await this.#settlePostCommit(op.name, ctx, postCommit);
     let publishFailure = null;
@@ -19179,7 +19550,7 @@ class DatabaseAdapter {
         publishFailure = `The change is saved, but the public site does not serve it yet: publishing it failed (${thrown instanceof Error ? thrown.message : String(thrown)}). Do not repeat the change; it is published automatically within seconds once the public database answers.`;
       }
     }
-    if (result.ok)
+    if (result.ok && !joinedHolder)
       notifyOperationCommitted(op.name);
     if (effectFailures.length > 0) {
       const effects = postCommitFailureMessage(effectFailures);
@@ -19213,22 +19584,77 @@ class DatabaseAdapter {
         throw thrown;
       if (thrown instanceof OperationAbortError)
         return err(thrown.queryError);
-      const pgDetail = extractPgFields(thrown);
-      return err({
-        kind: "HandlerError",
-        operation: op.name,
-        message: thrown instanceof Error ? thrown.message : String(thrown),
-        ...pgDetail ? { pgDetail } : {}
-      });
+      return err(thrownToQueryError(op.name, thrown, "write"));
     }
   }
-  async#setIdentity(tx, ctx) {
+  async#setIdentity(tx, ctx, opName = null) {
     await tx.execute(sql`SELECT
       set_config('caelo.actor_id', ${ctx.actorId}, true),
       set_config('caelo.actor_kind', ${ctx.actorKind}, true),
       set_config('caelo.plugin_id', ${ctx.pluginId ?? ""}, true),
       set_config('caelo.chat_branch_id', ${ctx.chatBranchId ?? ""}, true),
-      set_config('caelo.chat_task_id', ${ctx.chatTaskId ?? ""}, true)`);
+      set_config('caelo.chat_task_id', ${ctx.chatTaskId ?? ""}, true),
+      set_config('caelo.op_name', ${opName ?? ""}, true)`);
+    this.#recordIdentity(tx, ctx, opName);
+  }
+  async#setPublicIdentity(tx, ctx) {
+    await tx.execute(sql`SELECT
+      set_config('caelo.actor_id', ${ctx.actorId}, true),
+      set_config('caelo.actor_kind', ${ctx.actorKind}, true),
+      set_config('caelo.plugin_id', ${ctx.pluginId ?? ""}, true)`);
+    this.#recordIdentity(tx, ctx, null);
+  }
+  #recordIdentity(tx, ctx, opName) {
+    for (const pool of ["admin", "public"]) {
+      const marker = this.#guard.held(pool);
+      if (marker !== null && marker.tx === tx) {
+        marker.identity = ctx;
+        marker.identityOpName = opName;
+      }
+    }
+  }
+  async listen(pool, channel, callbacks) {
+    const url = pool === "admin" ? this.#adminUrl : this.#publicUrl;
+    if (url === null)
+      throw new AdminDatabaseUnavailableError(`listen(${channel})`);
+    let lost = this.#listenLost.get(pool);
+    if (!lost) {
+      lost = new Set;
+      this.#listenLost.set(pool, lost);
+    }
+    const lostSet = lost;
+    let conn = this.#listeners.get(pool);
+    if (!conn) {
+      conn = new SQL3(url, {
+        max: LISTEN_CONNECTIONS_PER_INSTANCE,
+        onclose: (cause) => {
+          if (this.#listenersClosing)
+            return;
+          for (const onLost of lostSet) {
+            try {
+              onLost(cause);
+            } catch (thrown) {
+              console.error(`[query-api] a LISTEN onLost callback failed`, thrown);
+            }
+          }
+        }
+      });
+      this.#listeners.set(pool, conn);
+    }
+    const onLost = callbacks.onLost;
+    lostSet.add(onLost);
+    const handle = await conn.listen(channel, callbacks.onNotify, callbacks.onListen);
+    return {
+      unlisten: async () => {
+        lostSet.delete(onLost);
+        await handle.unlisten();
+      }
+    };
+  }
+  async notify(channel, payload) {
+    await this.#transaction("admin", "notify", async (tx) => {
+      await tx.execute(sql`SELECT pg_notify(${channel}, ${payload})`);
+    });
   }
   async#runReadOperation(op, ctx, validatedInput) {
     try {
@@ -19244,20 +19670,7 @@ class DatabaseAdapter {
         throw thrown;
       if (thrown instanceof OperationAbortError)
         return err(thrown.queryError);
-      if (isRlsDenial(thrown)) {
-        return err({
-          kind: "RLSDenied",
-          operation: op.name,
-          detail: thrown.message ?? "RLS policy denied the read"
-        });
-      }
-      const pgDetail = extractPgFields(thrown);
-      return err({
-        kind: "HandlerError",
-        operation: op.name,
-        message: thrown instanceof Error ? thrown.message : String(thrown),
-        ...pgDetail ? { pgDetail } : {}
-      });
+      return err(thrownToQueryError(op.name, thrown, "read"));
     }
   }
   readScope(ctx, holder = "reads.read") {
@@ -19306,7 +19719,14 @@ class DatabaseAdapter {
     return failures;
   }
   async close() {
-    await Promise.all([this.#adminRaw?.end(), this.#publicRaw.end()]);
+    this.#listenersClosing = true;
+    const listeners = [...this.#listeners.values()];
+    this.#listeners.clear();
+    await Promise.all([
+      this.#adminRaw?.end(),
+      this.#publicRaw.end(),
+      ...listeners.map((l) => l.close())
+    ]);
   }
   async withAdminTransaction(ctx, fn, options = {}) {
     const holder = options.holder ?? "withAdminTransaction";
@@ -19316,15 +19736,17 @@ class DatabaseAdapter {
       await this.verifyRoles();
     let publishAfterCommit = false;
     let postCommit = [];
-    const out = await this.#transaction("admin", holder, async (tx) => {
-      postCommit = collectPostCommitEffects(tx);
-      await this.#setIdentity(tx, ctx);
+    const out = await this.#transaction("admin", holder, async (tx, joined) => {
+      if (!joined)
+        postCommit = collectPostCommitEffects(tx);
+      await this.#setIdentity(tx, ctx, options.holder ?? null);
       const denied = await firstInvisibleBranch(tx, namedBranches(ctx, undefined));
       if (denied !== null) {
         throw new OperationAbortError(branchNotFound("withAdminTransaction", denied));
       }
       const result = await fn(tx);
-      publishAfterCommit = await this.#projectionDirty(tx);
+      if (!joined)
+        publishAfterCommit = await this.#projectionDirty(tx);
       return result;
     });
     const effectFailures = await this.#settlePostCommit(holder, ctx, postCommit);
@@ -19340,11 +19762,10 @@ class DatabaseAdapter {
     if (!this.#skipVerify)
       await this.verifyRoles();
     let postCommit = [];
-    const out = await this.#transaction("public", holder, async (tx) => {
-      postCommit = collectPostCommitEffects(tx);
-      await tx.execute(sql`SELECT set_config('caelo.actor_id', ${ctx.actorId}, true)`);
-      await tx.execute(sql`SELECT set_config('caelo.actor_kind', ${ctx.actorKind}, true)`);
-      await tx.execute(sql`SELECT set_config('caelo.plugin_id', ${ctx.pluginId ?? ""}, true)`);
+    const out = await this.#transaction("public", holder, async (tx, joined) => {
+      if (!joined)
+        postCommit = collectPostCommitEffects(tx);
+      await this.#setPublicIdentity(tx, ctx);
       return await fn(tx);
     });
     const effectFailures = await this.#settlePostCommit(holder, ctx, postCommit);
@@ -19355,11 +19776,11 @@ class DatabaseAdapter {
   rawAdmin() {
     if (this.#adminRaw === null)
       throw new AdminDatabaseUnavailableError("rawAdmin");
-    this.#guard.assertMayCheckout("admin", "rawAdmin()");
+    this.#guard.assertNoHeldTransaction("admin", "rawAdmin()");
     return this.#adminRaw;
   }
   rawPublic() {
-    this.#guard.assertMayCheckout("public", "rawPublic()");
+    this.#guard.assertNoHeldTransaction("public", "rawPublic()");
     return this.#publicRaw;
   }
   async provisionPluginPublicSchema(opts) {
@@ -19386,7 +19807,10 @@ class DatabaseAdapter {
     if (!this.#skipVerify)
       await this.verifyRoles();
     await this.#transaction("admin", "provisionPluginAdminSchema", async (tx) => {
-      const outcome = await provisionPluginSchemaInTx(tx, "provisionPluginAdminSchema", opts);
+      const outcome = await provisionPluginSchemaInTx(tx, "provisionPluginAdminSchema", {
+        ...opts,
+        journal: true
+      });
       if (outcome.droppedColumns.length > 0) {
         await auditDroppedColumns(tx, "cms_admin", opts.pluginId, outcome);
       }
@@ -19419,11 +19843,11 @@ class DatabaseAdapter {
   }
   get admin() {
     const db = this.#adminDb("admin pool");
-    this.#guard.assertMayCheckout("admin", "adapter.admin");
+    this.#guard.assertNoHeldTransaction("admin", "adapter.admin");
     return db;
   }
   get public() {
-    this.#guard.assertMayCheckout("public", "adapter.public");
+    this.#guard.assertNoHeldTransaction("public", "adapter.public");
     return this.#public;
   }
 }
@@ -19437,6 +19861,39 @@ async function auditDroppedColumns(tx, database, pluginId, outcome) {
     resultSummary: `${database}.${outcome.schemaName}: dropped ${outcome.droppedColumns.join(", ")}`
   });
 }
+function thrownToQueryError(operation, thrown, access) {
+  const raw = thrown instanceof Error ? thrown.message : String(thrown);
+  if (isRlsDenial(thrown)) {
+    console.warn(`[query-api] ${operation}: RLS denied the ${access}: ${raw}`);
+    return { kind: "RLSDenied", operation, detail: rlsDenialMessage(operation, access) };
+  }
+  const pgDetail = extractPgFields(thrown);
+  if (pgDetail?.code) {
+    const described = describePgFailure(pgDetail);
+    if (described.internal)
+      console.error(`[query-api] ${operation} failed: ${raw}`, pgDetail);
+    return {
+      kind: "HandlerError",
+      operation,
+      message: described.message,
+      pgDetail,
+      ...described.internal ? { internal: true } : {}
+    };
+  }
+  return {
+    kind: "HandlerError",
+    operation,
+    message: raw,
+    internal: true,
+    ...pgDetail ? { pgDetail } : {}
+  };
+}
+// ../query-api/src/change-journal.ts
+function textArray(values) {
+  return sql`ARRAY(SELECT jsonb_array_elements_text((${JSON.stringify(values)}::text)::jsonb))`;
+}
+var JOURNAL_RETENTION_MS = 24 * 60 * 60 * 1000;
+var JOURNAL_STALLED_CONSUMER_MS = 7 * 24 * 60 * 60 * 1000;
 // ../query-api/src/execute.ts
 var allowAllRateLimiter = {
   async check() {
@@ -19472,8 +19929,15 @@ async function execute(registry, adapter, ctx, name, rawInput, options = {}) {
       adapter,
       ...options.signal ? { signal: options.signal } : {}
     });
-    if (result.ok)
+    if (result.ok) {
       notifyOperationCommitted(op.name);
+      const notice = commitNoticeOf(op.name);
+      if (notice !== null) {
+        await adapter.notify(notice.channel, notice.payload).catch((thrown) => {
+          console.error(`[query-api] could not notify other instances of ${op.name}`, thrown);
+        });
+      }
+    }
     return result;
   }
   return adapter.runOperation(op, ctx, parsed.data);
@@ -19537,6 +20001,7 @@ var claimOutput = object({
 });
 var jobClaimOp = defineOperation({
   name: "platform_updates.job_claim",
+  readScope: "request",
   actorScope: ["system"],
   database: "cms_admin",
   input: object({
@@ -19637,6 +20102,7 @@ var jobClaimOp = defineOperation({
 });
 var jobHandoverOp = defineOperation({
   name: "platform_updates.job_handover",
+  readScope: "request",
   actorScope: ["system"],
   database: "cms_admin",
   input: object({
@@ -19667,6 +20133,7 @@ var jobHandoverOp = defineOperation({
 });
 var jobEventOp = defineOperation({
   name: "platform_updates.job_event",
+  readScope: "request",
   actorScope: ["system"],
   database: "cms_admin",
   input: object({
@@ -19687,6 +20154,7 @@ var jobEventOp = defineOperation({
 var digest2 = string2().regex(/^sha256:[0-9a-f]{64}$/);
 var jobRecordOp = defineOperation({
   name: "platform_updates.job_record",
+  readScope: "request",
   actorScope: ["system"],
   database: "cms_admin",
   input: object({
@@ -19722,6 +20190,7 @@ var jobRecordOp = defineOperation({
 });
 var jobFinishOp = defineOperation({
   name: "platform_updates.job_finish",
+  readScope: "request",
   actorScope: ["system"],
   database: "cms_admin",
   input: object({
@@ -19733,7 +20202,7 @@ var jobFinishOp = defineOperation({
   }).strict(),
   output: object({ finished: boolean2() }),
   handler: async (ctx, input, tx) => {
-    const codes = input.codes.length > 0 ? sql`ARRAY[${sql.join(input.codes.map((c) => sql`${c}`), sql`, `)}]::text[]` : sql`'{}'::text[]`;
+    const codes = textArray(input.codes);
     const rows = await tx.execute(sql`
       UPDATE platform_update_requests
          SET status = ${input.status}, status_reason = ${input.reason},
@@ -19763,6 +20232,7 @@ var jobFinishOp = defineOperation({
 });
 var agentHeartbeatOp = defineOperation({
   name: "platform_updates.agent_heartbeat",
+  readScope: "request",
   actorScope: ["system"],
   database: "cms_admin",
   input: object({