@shapio/cms 0.3.0 → 0.3.1

package/dist/{worker-BLXy8aRW.js → worker-BAmQPoTJ.js}

@@ -6,10 +6,10 @@ import { dirname, join, relative, resolve, sep } from "node:path";
 import Fastify from "fastify";
 import { AliasNode, AndNode, BinaryOperationNode, ColumnNode, ColumnUpdateNode, IdentifierNode, InsertQueryNode, Kysely, ListNode, MysqlAdapter, MysqlIntrospector, MysqlQueryCompiler, OnDuplicateKeyNode, OperationNodeTransformer, OperatorNode, OrNode, OrderByItemNode, ParensNode, PostgresDialect, PrimitiveValueListNode, RawNode, ReferenceNode, SelectAllNode, SelectModifierNode, SelectQueryNode, SelectionNode, SqliteAdapter, SqliteIntrospector, SqliteQueryCompiler, TableNode, UpdateQueryNode, ValueListNode, ValueNode, ValuesNode, WhereNode, sql } from "kysely";
 import pg from "pg";
+import { AsyncLocalStorage } from "node:async_hooks";
 import mysql from "mysql2";
 import { EventEmitter } from "node:events";
 import { DatabaseSync } from "node:sqlite";
-import { AsyncLocalStorage } from "node:async_hooks";
 import { Type } from "typebox";
 import { Value } from "typebox/value";
 import { isDeepStrictEqual } from "node:util";
@@ -116,6 +116,44 @@ const purgeDeletedEntriesOfModels = async (modelIds, trx) => {
 	await trx.deleteFrom("entries").where("model_id", "in", modelIds).where("deleted_at", "is not", null).execute();
 };
 //#endregion
+//#region src/db/connectionScope.ts
+const scopes$1 = new AsyncLocalStorage();
+var NestedPoolAcquireError = class extends Error {
+	constructor() {
+		super("A query inside an open transaction asked the pool for a second connection; under load every connection waits for another. Run it on the transaction (trx) instead.");
+		this.name = "NestedPoolAcquireError";
+	}
+};
+const holdsConnection = (scope) => {
+	for (let current = scope; current; current = current.parent) if (current.acquired) return true;
+	return false;
+};
+/**
+* Called by a driver before it takes a pooled connection. The first acquisition of a scope is the
+* transaction's own connection; any later one, or one inside a scope that already holds a connection, is
+* nested.
+*/
+const assertNotNested = () => {
+	const scope = scopes$1.getStore();
+	if (!scope) return;
+	if (holdsConnection(scope)) throw new NestedPoolAcquireError();
+	scope.acquired = true;
+};
+/**
+* Runs `fn` as if no transaction were open: for work that does not belong to the enclosing transaction and
+* that it never waits for (notifications published at commit, a test's independent request).
+*/
+const outsideConnectionScope = (fn) => scopes$1.exit(fn);
+/** Runs every `execute` of a transaction builder (and of the builders it returns) in a connection scope. */
+const withConnectionScope = (builder) => new Proxy(builder, { get(target, property, receiver) {
+	if (property === "execute") return (callback) => scopes$1.run({
+		acquired: false,
+		parent: scopes$1.getStore()
+	}, () => target.execute(callback));
+	if (property === "setIsolationLevel" || property === "setAccessMode") return (value) => withConnectionScope(target[property](value));
+	return Reflect.get(target, property, receiver);
+} });
+//#endregion
 //#region src/db/dialect.ts
 const SQLITE_PREFIX = "sqlite:";
 const MEMORY = ":memory:";
@@ -2509,6 +2547,63 @@ const subscribeNotifications = (databaseKey, handler) => {
 	};
 };
 //#endregion
+//#region src/helpers/appError.ts
+/**
+* An error with a stable machine-readable code, rendered by the central error handler as
+* `{ error: { code, message, details? } }`. Services throw these; they carry no HTTP objects.
+*/
+var AppError = class extends Error {
+	statusCode;
+	code;
+	details;
+	constructor(statusCode, code, message, details, options) {
+		super(message, options);
+		this.name = "AppError";
+		this.statusCode = statusCode;
+		this.code = code;
+		this.details = details;
+	}
+};
+//#endregion
+//#region src/db/poolAcquire.ts
+/**
+* How long a query waits for a free pooled connection (PostgreSQL and MySQL) before it fails with
+* `PoolAcquireTimeoutError`. Without a bound, an exhausted pool queues requests forever and the server
+* stops answering until it restarts. SQLite has no such wait (see `db/sqlite/driver.ts`).
+*/
+const DEFAULT_POOL_ACQUIRE_TIMEOUT_MS = 1e4;
+/**
+* No pooled connection became free in time. A 503 the client may retry; the central error handler logs it
+* as a failed request, so an exhausted pool shows in the logs instead of as a silent hang.
+*/
+var PoolAcquireTimeoutError = class extends AppError {
+	constructor(timeoutMs, poolMax, options) {
+		super(503, "DATABASE_BUSY", `No database connection became free within ${timeoutMs} ms (pool of ${poolMax}); try again shortly`, void 0, options);
+		this.name = "PoolAcquireTimeoutError";
+	}
+};
+/**
+* Opening a new connection took longer than the acquire timeout: the database is unreachable or overloaded.
+* A 503 the client may retry, logged by the central error handler like `PoolAcquireTimeoutError`.
+*/
+var DatabaseUnavailableError = class extends AppError {
+	constructor(timeoutMs, options) {
+		super(503, "DATABASE_UNAVAILABLE", `Could not connect to the database within ${timeoutMs} ms; try again shortly`, void 0, options);
+		this.name = "DatabaseUnavailableError";
+	}
+};
+/** pg-pool's error when `connectionTimeoutMillis` passes while the request waits in the pool's queue. */
+const PG_QUEUE_TIMEOUT_MESSAGE = "timeout exceeded when trying to connect";
+/** pg-pool's error when `connectionTimeoutMillis` passes while it opens a new connection. */
+const PG_CONNECT_TIMEOUT_MESSAGE = "Connection terminated due to connection timeout";
+/** The 503 for a pg-pool acquisition error, or the error itself when it is not a timeout. */
+const pgAcquireError = (error, poolMax, timeoutMs) => {
+	if (!(error instanceof Error)) return error;
+	if (error.message === PG_QUEUE_TIMEOUT_MESSAGE) return new PoolAcquireTimeoutError(timeoutMs, poolMax, { cause: error });
+	if (error.message === PG_CONNECT_TIMEOUT_MESSAGE) return new DatabaseUnavailableError(timeoutMs, { cause: error });
+	return error;
+};
+//#endregion
 //#region src/db/mysql/codec.ts
 /**
 * The MySQL value codec (ADR 0001, "MySQL"). Shapio's PostgreSQL types map to MySQL like this, and rows
@@ -2691,7 +2786,9 @@ var MysqlConnection = class {
 		this.#pending = [];
 		this.#inTransaction = false;
 		await Promise.all([this.#query(command), this.#query(UNPIN_TIMESTAMP)]);
-		if (command === "commit") for (const { channel, payload, id } of pending) publishNotification(this.#databaseKey, channel, payload, id);
+		if (command === "commit") outsideConnectionScope(() => {
+			for (const { channel, payload, id } of pending) publishNotification(this.#databaseKey, channel, payload, id);
+		});
 	}
 	async #nextSequenceValue(name) {
 		const table = sequenceTableOf(name);
@@ -2775,6 +2872,9 @@ var MysqlConnection = class {
 var MysqlDriver = class {
 	#options;
 	databaseKey;
+	get strict() {
+		return this.#options.strict ?? false;
+	}
 	#pool;
 	#connections = /* @__PURE__ */ new WeakMap();
 	constructor(options) {
@@ -2798,10 +2898,29 @@ var MysqlDriver = class {
 		if (!this.#pool) throw new Error("The MySQL driver is not initialised");
 		return this.#pool;
 	}
-	async acquireConnection() {
-		const raw = await new Promise((resolve, reject) => {
-			this.#pooled().getConnection((error, connection) => error ? reject(error) : resolve(connection));
+	/**
+	* A pooled connection, or `PoolAcquireTimeoutError` once `acquireTimeoutMs` passes. mysql2 cannot withdraw
+	* a queued request, so a connection that arrives after the timeout goes straight back to the pool.
+	*/
+	#getConnection() {
+		const { acquireTimeoutMs = DEFAULT_POOL_ACQUIRE_TIMEOUT_MS, poolMax } = this.#options;
+		return new Promise((resolve, reject) => {
+			let timedOut = false;
+			const timer = setTimeout(() => {
+				timedOut = true;
+				reject(new PoolAcquireTimeoutError(acquireTimeoutMs, poolMax));
+			}, acquireTimeoutMs);
+			this.#pooled().getConnection((error, connection) => {
+				clearTimeout(timer);
+				if (timedOut) connection?.release();
+				else if (error) reject(error);
+				else resolve(connection);
+			});
 		});
+	}
+	async acquireConnection() {
+		if (this.#options.strict) assertNotNested();
+		const raw = await this.#getConnection();
 		let connection = this.#connections.get(raw);
 		if (!connection) {
 			connection = new MysqlConnection(raw, this.databaseKey);
@@ -3246,6 +3365,11 @@ var MysqlKysely = class extends Kysely {
 		});
 		this.mysqlDriver = driver;
 	}
+	/** Strict mode runs transactions in a connection scope (`db/connectionScope.ts`). */
+	transaction() {
+		const builder = super.transaction();
+		return this.mysqlDriver.strict ? withConnectionScope(builder) : builder;
+	}
 };
 const createMysqlDb = (options) => new MysqlKysely(new MysqlDriver(options));
 /** The MySQL driver behind a handle, or undefined for another dialect. */
@@ -4272,6 +4396,29 @@ const sqliteDriverOf = (db) => db instanceof SqliteKysely ? db.sqliteDriver : vo
 //#endregion
 //#region src/db/index.ts
 const warnIdleConnectionError = (error) => process.emitWarning(`PostgreSQL connection lost while idle: ${error.message}`);
+/**
+* The pg pool as Kysely sees it: an exhausted pool's queue timeout becomes `PoolAcquireTimeoutError`, a
+* connection that cannot be opened in time `DatabaseUnavailableError`, and in strict mode a nested
+* acquisition fails at once.
+*/
+const acquiringPool = (pool, poolMax, acquireTimeoutMs, strict) => ({
+	options: pool.options,
+	connect: async () => {
+		if (strict) assertNotNested();
+		try {
+			return await pool.connect();
+		} catch (error) {
+			throw pgAcquireError(error, poolMax, acquireTimeoutMs);
+		}
+	},
+	end: () => pool.end()
+});
+/** Kysely on PostgreSQL in strict mode: transactions run in a connection scope (`db/connectionScope.ts`). */
+var StrictPostgresKysely = class extends Kysely {
+	transaction() {
+		return withConnectionScope(super.transaction());
+	}
+};
 const warnIdleMysqlConnectionError = (error) => process.emitWarning(`MySQL connection lost while idle: ${error.message}`);
 /**
 * The database handle for DATABASE_URL: PostgreSQL through a `pg` pool, MySQL (`mysql://…`) through a
@@ -4279,7 +4426,7 @@ const warnIdleMysqlConnectionError = (error) => process.emitWarning(`MySQL conne
 * number of read connections (one connection writes).
 * Sets the process dialect (`db/dialect.ts`) that SQL builders read.
 */
-const createDb = ({ connectionString, poolMax, applicationName = "shapio", onIdleConnectionError, strict = false }) => {
+const createDb = ({ connectionString, poolMax, acquireTimeoutMs = DEFAULT_POOL_ACQUIRE_TIMEOUT_MS, applicationName = "shapio", onIdleConnectionError, strict = false }) => {
 	if (dialectOfUrl(connectionString) === "sqlite") {
 		setCurrentDialect("sqlite");
 		return createSqliteDb({
@@ -4293,21 +4440,28 @@ const createDb = ({ connectionString, poolMax, applicationName = "shapio", onIdl
 		return createMysqlDb({
 			url: connectionString,
 			poolMax,
+			acquireTimeoutMs,
 			applicationName,
-			onIdleConnectionError: onIdleConnectionError ?? warnIdleMysqlConnectionError
+			onIdleConnectionError: onIdleConnectionError ?? warnIdleMysqlConnectionError,
+			strict
 		});
 	}
 	setCurrentDialect("postgres");
 	const pool = new pg.Pool({
 		connectionString,
 		max: poolMax,
+		connectionTimeoutMillis: acquireTimeoutMs,
 		application_name: applicationName
 	});
 	pool.on("error", onIdleConnectionError ?? warnIdleConnectionError);
 	pool.on("connect", (client) => {
 		client.on("error", () => void 0);
 	});
-	return new Kysely({ dialect: new PostgresDialect({ pool }) });
+	const dialect = new PostgresDialect({
+		pool: acquiringPool(pool, poolMax, acquireTimeoutMs, strict),
+		controlClient: pg.Client
+	});
+	return strict ? new StrictPostgresKysely({ dialect }) : new Kysely({ dialect });
 };
 /**
 * The process-wide database handle used as the default executor by repositories.
@@ -7786,23 +7940,182 @@ const plainTextToRichText = (text) => {
 		}
 	};
 };
-//#endregion
-//#region src/helpers/appError.ts
 /**
-* An error with a stable machine-readable code, rendered by the central error handler as
-* `{ error: { code, message, details? } }`. Services throw these; they carry no HTTP objects.
+* Admin themes (docs/plans/themes.md): a theme is a named, complete set of these tokens for a light variant, a
+* dark variant or both. One list, shared by the admin's stylesheets (and their tests) and the API, which
+* validates themes declared by extensions (`shapio.config` `themes`).
+*/
+/** The UI tokens: every theme variant sets all of them. */
+const THEME_SEMANTIC_TOKENS = [
+	"background",
+	"foreground",
+	"card",
+	"card-foreground",
+	"popover",
+	"popover-foreground",
+	"primary",
+	"primary-foreground",
+	"primary-hover",
+	"secondary",
+	"secondary-foreground",
+	"muted",
+	"muted-foreground",
+	"accent",
+	"accent-foreground",
+	"destructive",
+	"destructive-foreground",
+	"destructive-muted",
+	"success",
+	"success-muted",
+	"warning",
+	"warning-muted",
+	"info",
+	"info-muted",
+	"border",
+	"input",
+	"ring",
+	"link",
+	"overlay",
+	"sidebar",
+	"sidebar-foreground",
+	"sidebar-primary",
+	"sidebar-primary-foreground",
+	"sidebar-accent",
+	"sidebar-accent-foreground",
+	"sidebar-border",
+	"sidebar-ring"
+];
+/**
+* The logo (tile, S, letters) and the signed-out screens' brand panel. Built-in themes set them all; an
+* extension theme may leave them out and gets Shapio's for that variant.
+*/
+const THEME_BRAND_TOKENS = [
+	"brand-logo",
+	"brand-logo-foreground",
+	"brand-letters",
+	"brand-panel-from",
+	"brand-panel-to",
+	"brand-panel-foreground",
+	"brand-panel-mark"
+];
+[...THEME_SEMANTIC_TOKENS, ...THEME_BRAND_TOKENS];
+const THEME_VARIANTS = ["light", "dark"];
+/** A theme key: used in `data-theme` and in CSS selectors, so deliberately narrow. */
+const THEME_KEY_PATTERN = /^[a-z][a-z0-9-]{0,40}$/;
+/** The themes the admin ships; an extension theme may not reuse these keys. */
+const BUILT_IN_THEME_KEYS = [
+	"shapio",
+	"classic",
+	"murdered-out",
+	"snowed"
+];
+/**
+* A token value an extension may use: a hex colour or a colour function whose arguments are numbers, units
+* and separators only (no `;`, quotes, braces or nested functions such as `url()` or `var()`), so a value
+* can never escape its declaration.
 */
-var AppError = class extends Error {
-	statusCode;
-	code;
-	details;
-	constructor(statusCode, code, message, details, options) {
-		super(message, options);
-		this.name = "AppError";
-		this.statusCode = statusCode;
-		this.code = code;
-		this.details = details;
-	}
+const THEME_COLOUR_PATTERN = /^(?:#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})|(?:rgba?|hsla?|oklch|oklab)\([0-9a-z.,%\s/+-]{1,80}\))$/;
+const SURFACES = [
+	"background",
+	"card",
+	"popover"
+];
+const THEME_TEXT_PAIRS = [
+	...SURFACES.map((surface) => ["foreground", surface]),
+	...[
+		...SURFACES,
+		"muted",
+		"secondary",
+		"accent",
+		"sidebar"
+	].map((surface) => ["muted-foreground", surface]),
+	["primary-foreground", "primary"],
+	["primary-foreground", "primary-hover"],
+	["secondary-foreground", "secondary"],
+	["accent-foreground", "accent"],
+	["destructive-foreground", "destructive"],
+	["destructive", "background"],
+	["destructive", "card"],
+	["success", "background"],
+	["success", "card"],
+	["success", "success-muted"],
+	["warning", "warning-muted"],
+	["warning", "card"],
+	["info", "info-muted"],
+	["info", "card"],
+	["destructive", "destructive-muted"],
+	["foreground", "muted"],
+	["link", "background"],
+	["link", "card"],
+	["sidebar-foreground", "sidebar"],
+	["sidebar-primary-foreground", "sidebar-primary"],
+	["sidebar-accent-foreground", "sidebar-accent"],
+	["sidebar-foreground", "sidebar-accent"],
+	["muted-foreground", "sidebar-accent"],
+	...[
+		"destructive",
+		"success",
+		"warning",
+		"link"
+	].flatMap((text) => [[text, "popover"], [text, "muted"]]),
+	["brand-panel-foreground", "brand-panel-from"],
+	["brand-panel-foreground", "brand-panel-to"]
+];
+const THEME_UI_PAIRS = [
+	...[
+		...SURFACES,
+		"muted",
+		"secondary"
+	].map((surface) => ["input", surface]),
+	...SURFACES.map((surface) => ["ring", surface]),
+	["ring", "muted"],
+	["ring", "accent"],
+	["primary", "background"],
+	["primary", "card"],
+	["primary", "popover"],
+	["primary", "muted"],
+	["info", "muted"],
+	["sidebar-ring", "sidebar"],
+	["sidebar-primary", "sidebar"],
+	["sidebar-primary", "sidebar-accent"]
+];
+/**
+* Dark only: control borders on the selection surface. In light, selected table rows use accent/40, which
+* passes, and other selected surfaces hold no controls.
+*/
+const THEME_DARK_UI_PAIRS = [["input", "accent"]];
+const HEX = /^#[0-9a-fA-F]{6}$/;
+const channel = (value) => {
+	const c = value / 255;
+	return c <= .03928 ? c / 12.92 : ((c + .055) / 1.055) ** 2.4;
+};
+const luminance = (hex) => {
+	const [r, g, b] = [
+		1,
+		3,
+		5
+	].map((index) => channel(parseInt(hex.slice(index, index + 2), 16)));
+	return .2126 * (r ?? 0) + .7152 * (g ?? 0) + .0722 * (b ?? 0);
+};
+/** The WCAG contrast ratio of two `#rrggbb` colours. */
+const contrastRatio = (a, b) => {
+	const [high = 0, low = 0] = [luminance(a), luminance(b)].sort((x, y) => y - x);
+	return (high + .05) / (low + .05);
+};
+/** Every pair the variant must meet, with its ratio. Missing tokens report an undefined ratio. */
+const checkThemeContrast = (tokens, variant) => {
+	const uiPairs = variant === "dark" ? [...THEME_UI_PAIRS, ...THEME_DARK_UI_PAIRS] : THEME_UI_PAIRS;
+	const measure = ([foreground, background], required) => {
+		const a = tokens[foreground];
+		const b = tokens[background];
+		return {
+			foreground,
+			background,
+			required,
+			ratio: a && b && HEX.test(a) && HEX.test(b) ? contrastRatio(a, b) : void 0
+		};
+	};
+	return [...THEME_TEXT_PAIRS.map((pair) => measure(pair, 4.5)), ...uiPairs.map((pair) => measure(pair, 3))];
 };
 //#endregion
 //#region src/content/model.ts
@@ -10648,9 +10961,10 @@ const toAssetView = async (deps, asset, variants) => {
 /**
 * API views of assets with their variants (one query for all variants) and URLs: stable for public
 * assets, signed and expiring for private ones. Package E can use this to resolve media fields.
+* `executor`: the caller's open transaction, when there is one.
 */
-const toAssetViews = async (deps, assets) => {
-	const variants = await listForAssets(assets.map((asset) => asset.id));
+const toAssetViews = async (deps, assets, executor) => {
+	const variants = await listForAssets(assets.map((asset) => asset.id), executor);
 	const byAsset = Map.groupBy(variants, (variant) => variant.asset_id);
 	return Promise.all(assets.map((asset) => toAssetView(deps, asset, byAsset.get(asset.id) ?? [])));
 };
@@ -11636,38 +11950,40 @@ const groupByRole = (grants) => {
 /**
 * Every role's grants, held in memory and reloaded when `system_versions.permissions_version` moves.
 * The version is read on every lookup: that durable check is what makes a permission change visible to
-* every instance at once (NOTIFY would only be an optimisation). Concurrent reloads share one query.
+* every instance at once (NOTIFY would only be an optimisation). Lookups on the pool share one reload; a
+* lookup inside a transaction reads (and, when stale, reloads) through that transaction alone, never
+* through a reload running on another request's transaction.
 */
 const createPermissionCache = (database) => {
 	let snapshot;
 	let reloading;
-	const reload = async (version) => {
-		const grants = [...await listAllPermissions$1(database), ...await listAllPermissions(database)].map(toGrant$1).filter((grant) => grant !== void 0);
-		const bindings = groupBindings(await listAll(database));
+	const reload = async (version, executor) => {
+		const grants = [...await listAllPermissions$1(executor), ...await listAllPermissions(executor)].map(toGrant$1).filter((grant) => grant !== void 0);
+		const bindings = groupBindings(await listAll(executor));
 		return {
 			version,
 			byRole: groupByRole(grants),
 			bindings
 		};
 	};
-	const current = async () => {
-		const version = await getPermissionsVersion(database);
+	const sharedReload = (version) => reloading ??= reload(version, database).finally(() => {
+		reloading = void 0;
+	});
+	const current = async (executor) => {
+		const version = await getPermissionsVersion(executor ?? database);
 		if (snapshot && snapshot.version === version) return snapshot;
-		reloading ??= reload(version).finally(() => {
-			reloading = void 0;
-		});
-		const loaded = await reloading;
+		const loaded = await (executor ? reload(version, executor) : sharedReload(version));
 		if (!snapshot || loaded.version >= snapshot.version) snapshot = loaded;
 		return loaded;
 	};
 	return {
-		getGrants: async (roleIds) => {
+		getGrants: async (roleIds, executor) => {
 			if (roleIds.length === 0) return [];
-			const { byRole } = await current();
+			const { byRole } = await current(executor);
 			return roleIds.flatMap((roleId) => byRole.get(roleId) ?? []);
 		},
-		getSiteAppRoleIds: async (siteId, audience) => {
-			const { bindings } = await current();
+		getSiteAppRoleIds: async (siteId, audience, executor) => {
+			const { bindings } = await current(executor);
 			return bindings.get(bindingKey(siteId, audience)) ?? [];
 		}
 	};
@@ -11758,7 +12074,7 @@ const APP_ACTIONS = new Set(APP_CONTENT_ACTIONS);
 * outside a site holds no role). Both are delivery audiences: they see `public: false` fields only where a
 * grant names them.
 */
-const rolesOf = async (principal, grants) => {
+const rolesOf = async (principal, grants, executor) => {
 	switch (principal.kind) {
 		case "system": return "all";
 		case "admin": return {
@@ -11779,13 +12095,13 @@ const rolesOf = async (principal, grants) => {
 			actions: READ_ONLY$1
 		};
 		case "appUser": return {
-			roleIds: [...await grants.getSiteAppRoleIds(principal.siteId, "authenticated"), ...principal.roleIds],
+			roleIds: [...await grants.getSiteAppRoleIds(principal.siteId, "authenticated", executor), ...principal.roleIds],
 			networkRoleIds: [],
 			audience: "delivery",
 			actions: APP_ACTIONS
 		};
 		case "anonymous": return {
-			roleIds: principal.siteId === null ? [] : await grants.getSiteAppRoleIds(principal.siteId, "public"),
+			roleIds: principal.siteId === null ? [] : await grants.getSiteAppRoleIds(principal.siteId, "public", executor),
 			networkRoleIds: [],
 			audience: "delivery",
 			actions: APP_ACTIONS
@@ -11808,33 +12124,33 @@ const actsOnSite = (principal, siteId) => {
 * Deny by default at every step.
 */
 const createPermissionEvaluator = ({ grants, fields }) => ({
-	evaluate: async (principal, request) => {
-		const roles = await rolesOf(principal, grants);
+	evaluate: async (principal, request, executor) => {
+		const roles = await rolesOf(principal, grants, executor);
 		if (roles === "all") return ALLOW_ALL_POLICY;
 		if (roles.actions !== "all" && !roles.actions.has(request.action)) return DENIED_POLICY;
 		let roleIds = roles.roleIds;
 		if (NETWORK_CONTENT_ACTIONS.has(request.action)) {
-			const modelSite = await fields.getModelSite(request.modelId);
+			const modelSite = await fields.getModelSite(request.modelId, executor);
 			roleIds = modelSite !== null && actsOnSite(principal, modelSite) ? roles.roleIds : roles.networkRoleIds;
 		}
-		const held = await grants.getGrants(roleIds);
+		const held = await grants.getGrants(roleIds, executor);
 		if (held.length === 0) return DENIED_POLICY;
-		const modelFields = roles.audience === "delivery" ? await fields.getModelFields(request.modelId) : void 0;
+		const modelFields = roles.audience === "delivery" ? await fields.getModelFields(request.modelId, executor) : void 0;
 		return buildPolicy(held, request, roles.audience, modelFields);
 	},
-	canPerform: async (principal, action) => {
-		const roles = await rolesOf(principal, grants);
+	canPerform: async (principal, action, executor) => {
+		const roles = await rolesOf(principal, grants, executor);
 		if (roles === "all") return true;
 		if (roles.audience === "delivery") return false;
 		const roleIds = NETWORK_ACTION_SET.has(action) ? roles.networkRoleIds : roles.roleIds;
-		return allowsGlobalAction(await grants.getGrants(roleIds), action);
+		return allowsGlobalAction(await grants.getGrants(roleIds, executor), action);
 	},
-	canPerformOnSite: async (principal, action, siteId) => {
-		const roles = await rolesOf(principal, grants);
+	canPerformOnSite: async (principal, action, siteId, executor) => {
+		const roles = await rolesOf(principal, grants, executor);
 		if (roles === "all") return true;
 		if (roles.audience === "delivery") return false;
 		const counted = !NETWORK_ACTION_SET.has(action) || SITE_GRANTABLE_ACTIONS.has(action) && actsOnSite(principal, siteId) ? roles.roleIds : roles.networkRoleIds;
-		return allowsGlobalAction(await grants.getGrants(counted), action);
+		return allowsGlobalAction(await grants.getGrants(counted, executor), action);
 	}
 });
 //#endregion
@@ -11846,17 +12162,17 @@ const createPermissionEvaluator = ({ grants, fields }) => ({
 * hidden from the API unless a role names them explicitly. Components are not delivery models.
 */
 const createSchemaFieldVisibility = (registry) => {
-	const activeModel = async (modelId) => {
-		const active = (await registry.getSnapshot()).byId.get(modelId);
+	const activeModel = async (modelId, executor) => {
+		const active = (await registry.getSnapshot(executor)).byId.get(modelId);
 		return active && active.definition.kind !== "component" ? active.definition : void 0;
 	};
 	return {
-		getModelFields: async (modelId) => (await activeModel(modelId))?.fields.map((field) => ({
+		getModelFields: async (modelId, executor) => (await activeModel(modelId, executor))?.fields.map((field) => ({
 			id: field.id,
 			public: field.public && !field.deprecated
 		})),
-		hasModel: async (modelId) => await activeModel(modelId) !== void 0,
-		getModelSite: async (modelId) => (await registry.getSnapshot()).scopeOf(modelId) ?? null
+		hasModel: async (modelId, executor) => await activeModel(modelId, executor) !== void 0,
+		getModelSite: async (modelId, executor) => (await registry.getSnapshot(executor)).scopeOf(modelId) ?? null
 	};
 };
 //#endregion
@@ -11898,10 +12214,10 @@ const createSchemaRegistry = ({ db, log }) => {
 		}
 	};
 	return {
-		getSnapshot: async () => {
-			const version = await getSchemaVersion(db);
+		getSnapshot: async (executor) => {
+			const version = await getSchemaVersion(executor ?? db);
 			if (cached && cached.version >= version) return cached;
-			return loadAtLeast(version);
+			return executor ? readSnapshot(executor) : loadAtLeast(version);
 		},
 		peek: () => cached,
 		hint: (version) => {
@@ -12619,6 +12935,21 @@ const RESERVED_SERVICE_NAMES = /* @__PURE__ */ new Set([
 	"logger"
 ]);
 const modelHooksSchema = Type.Object(Object.fromEntries([...BEFORE_EVENTS, ...AFTER_EVENTS].map((event) => [event, Type.Optional(anyFunction)])), closed$11);
+/** One theme variant: every UI token, brand tokens optional; values are checked in findThemeProblems. */
+const themeTokensSchema = Type.Object({
+	...Object.fromEntries(THEME_SEMANTIC_TOKENS.map((token) => [token, Type.String()])),
+	...Object.fromEntries(THEME_BRAND_TOKENS.map((token) => [token, Type.Optional(Type.String())]))
+}, closed$11);
+const themeSchema = Type.Object({
+	key: Type.String(),
+	name: Type.String({
+		minLength: 1,
+		maxLength: 60
+	}),
+	description: Type.Optional(Type.String({ maxLength: 200 })),
+	light: Type.Optional(themeTokensSchema),
+	dark: Type.Optional(themeTokensSchema)
+}, closed$11);
 const shapioConfigSchema = Type.Object({
 	hooks: Type.Optional(Type.Record(Type.String(), modelHooksSchema)),
 	routes: Type.Optional(Type.Array(Type.Object({
@@ -12627,7 +12958,8 @@ const shapioConfigSchema = Type.Object({
 	}, closed$11))),
 	services: Type.Optional(Type.Record(Type.String(), anyFunction)),
 	editors: Type.Optional(Type.Array(Type.String())),
-	jobs: Type.Optional(Type.Record(Type.String(), anyFunction))
+	jobs: Type.Optional(Type.Record(Type.String(), anyFunction)),
+	themes: Type.Optional(Type.Array(themeSchema))
 }, closed$11);
 const isRecord$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const TOP_LEVEL_KEYS$1 = Object.keys(shapioConfigSchema.properties);
@@ -12638,6 +12970,7 @@ const unknownKeyMessage = (path) => {
 	const key = segments.at(-1) ?? "";
 	if (segments.length === 1) return `unknown setting "${key}"; allowed: ${TOP_LEVEL_KEYS$1.join(", ")}`;
 	if (segments[0] === "hooks" && segments.length === 3) return `unknown hook "${key}"; allowed: ${HOOK_EVENTS.join(", ")}`;
+	if (segments[0] === "themes" && segments.length === 4) return `unknown theme token "${key}"; the tokens are listed in documentation/extensions.md`;
 	return `unknown key "${key}"`;
 };
 const keysOf = (value) => isRecord$6(value) ? Object.keys(value) : [];
@@ -12673,6 +13006,43 @@ const findNamingProblems = (config) => {
 		path: `/jobs/${name}`,
 		message: "must start with a letter and use letters, digits, \".\", \"_\" or \"-\""
 	});
+	return [...problems, ...findThemeProblems(config.themes)];
+};
+const BUILT_IN_THEMES = new Set(BUILT_IN_THEME_KEYS);
+/** Theme keys (pattern, built-in, unique), at least one variant, and colour values (no CSS injection). */
+const findThemeProblems = (themes) => {
+	const problems = [];
+	const keys = /* @__PURE__ */ new Set();
+	(Array.isArray(themes) ? themes : []).forEach((theme, index) => {
+		if (!isRecord$6(theme)) return;
+		const path = `/themes/${index}`;
+		if (typeof theme.key === "string") {
+			if (!THEME_KEY_PATTERN.test(theme.key)) problems.push({
+				path: `${path}/key`,
+				message: "must start with a lower-case letter and use lower-case letters, digits and dashes (41 at most)"
+			});
+			else if (BUILT_IN_THEMES.has(theme.key)) problems.push({
+				path: `${path}/key`,
+				message: `"${theme.key}" is a built-in theme`
+			});
+			else if (keys.has(theme.key)) problems.push({
+				path: `${path}/key`,
+				message: `"${theme.key}" is used twice`
+			});
+			keys.add(theme.key);
+		}
+		if (!THEME_VARIANTS.some((variant) => theme[variant] !== void 0)) problems.push({
+			path,
+			message: "needs a light or a dark variant (or both)"
+		});
+		for (const variant of THEME_VARIANTS) {
+			const tokens = theme[variant];
+			for (const [token, value] of Object.entries(isRecord$6(tokens) ? tokens : {})) if (typeof value === "string" && !THEME_COLOUR_PATTERN.test(value)) problems.push({
+				path: `${path}/${variant}/${token}`,
+				message: `"${value}" is not a colour: use #rrggbb, rgb(), hsl(), oklch() or oklab()`
+			});
+		}
+	});
 	return problems;
 };
 /** Every problem with a loaded config export, or none. */
@@ -13736,10 +14106,11 @@ const populateRelations = async (env, rows, fields, tree) => {
 };
 //#endregion
 //#region src/content/read.ts
+/** Evaluated through the read's executor: a read inside a transaction never asks the pool for a second connection. */
 const readPolicy = (env, modelId) => env.permissions.evaluate(env.actor, {
 	action: "read",
 	modelId
-});
+}, env.executor);
 /**
 * Heads of the given entries that the policy lets the caller read, served per the locale chain (or per
 * `locales` when given: GraphQL's `fallback: false` and `localizations`).
@@ -13784,7 +14155,7 @@ const loadMediaViews = async (env, model, rows, fields) => {
 	const ids = mediaIdsOf(model, rows.map((row) => row.data), fields);
 	if (ids.size === 0) return /* @__PURE__ */ new Map();
 	const assets = await findLiveManyOnSite(env.siteId, [...ids], env.executor);
-	const views = await toAssetViews(env.media, assets);
+	const views = await toAssetViews(env.media, assets, env.executor);
 	return new Map(views.map((view) => [view.id, env.audience === "delivery" ? toDeliveryAsset(view) : view]));
 };
 const toDeliveryAsset = (view) => ({
@@ -13850,13 +14221,16 @@ const ACTION_LABELS = {
 	publish: "publishing",
 	schemaManage: "managing"
 };
-/** Resolves the model and the caller's policy for one action; 403 when not allowed (CONTRIBUTING.md rule 5). */
-const modelWithPolicy = async (context, modelKey, action) => {
+/**
+* Resolves the model and the caller's policy for one action; 403 when not allowed (CONTRIBUTING.md rule 5).
+* `executor`: the caller's open transaction, when there is one.
+*/
+const modelWithPolicy = async (context, modelKey, action, executor) => {
 	const model = resolveModel(context.snapshot, modelKey);
 	const policy = await context.permissions.evaluate(context.actor, {
 		action,
 		modelId: model.definition.id
-	});
+	}, executor);
 	assertAllowed(policy, `${ACTION_LABELS[action]} "${modelKey}" entries`);
 	return {
 		model,
@@ -14292,6 +14666,27 @@ const loadExtensionRuntime = async (options) => {
 	});
 };
 //#endregion
+//#region src/extensions/themeStylesheet.ts
+const block = (selector, tokens) => `${selector} {\n${Object.entries(tokens).map(([token, value]) => `  --${token}: ${value};`).join("\n")}\n}\n`;
+const variantsOf = (theme) => THEME_VARIANTS.filter((variant) => theme[variant] !== void 0);
+const themeCss = (theme) => {
+	const variants = variantsOf(theme);
+	return variants.map((variant) => {
+		const tokens = theme[variant] ?? {};
+		const selector = variant === "dark" && variants.length > 1 ? `[data-theme='${theme.key}'].dark` : `[data-theme='${theme.key}']`;
+		return block(selector, tokens);
+	}).join("\n");
+};
+const buildThemeCatalogue = (themes) => ({
+	items: themes.map((theme) => ({
+		key: theme.key,
+		name: theme.name,
+		description: theme.description,
+		variants: variantsOf(theme)
+	})),
+	stylesheet: themes.length > 0 ? `/* Shapio extension themes (shapio.config) */\n${themes.map(themeCss).join("\n")}` : ""
+});
+//#endregion
 //#region src/helpers/publicUrl.ts
 var InvalidUrlPathError = class extends Error {
 	constructor(path) {
@@ -15342,7 +15737,7 @@ const isApiTokenFormat = (value) => value.startsWith(API_TOKEN_PREFIX);
 * Network tokens (no site) are visible and revocable only by admins who could mint them (`users.manage`, a
 * network action); everyone else sees their site's tokens only.
 */
-const managesNetworkTokens = (context, permissions) => permissions.canPerform(context.actor, "users.manage");
+const managesNetworkTokens = (context, permissions, executor) => permissions.canPerform(context.actor, "users.manage", executor);
 /** The request site's tokens, plus network tokens for those who manage them. */
 const listApiTokens = async (context, permissions) => (await listForSite(context.site.id, await managesNetworkTokens(context, permissions))).map(toApiTokenView);
 /**
@@ -15351,13 +15746,13 @@ const listApiTokens = async (context, permissions) => (await listForSite(context
 * into network actions, so only someone who may assign roles on every site (`users.manage`, a network
 * action) may mint one. Delivery tokens always belong to a site.
 */
-const isNetworkToken = async (context, permissions, roleKind, requested) => {
+const isNetworkToken = async (context, permissions, roleKind, requested, trx) => {
 	if (roleKind === "delivery") {
 		if (requested === true) throw new AppError(400, "INVALID_TOKEN_SITE", "Delivery tokens always belong to one site");
 		return false;
 	}
 	if (requested !== true) return false;
-	if (!await managesNetworkTokens(context, permissions)) throw new AppError(403, "FORBIDDEN", "Only admins who manage users on every site can create network tokens");
+	if (!await managesNetworkTokens(context, permissions, trx)) throw new AppError(403, "FORBIDDEN", "Only admins who manage users on every site can create network tokens");
 	return true;
 };
 /**
@@ -15372,7 +15767,7 @@ const createApiToken = async (context, permissions, input) => {
 		const role = await findById$14(input.roleId, trx);
 		if (!role) throw new AppError(400, "INVALID_ROLES", "The role does not exist");
 		if (role.key === SYSTEM_ROLE_KEYS.owner) throw new AppError(400, "INVALID_ROLES", "API tokens cannot hold the owner role");
-		const network = await isNetworkToken(context, permissions, role.kind, input.network);
+		const network = await isNetworkToken(context, permissions, role.kind, input.network, trx);
 		const { id } = await insert$14({
 			name: input.name.trim(),
 			token_hash: hashToken(token),
@@ -17916,23 +18311,35 @@ const createLoaders = (siteId, content) => {
 /**
 * The request's evaluator, memoized per (model, action): a GraphQL request touches the same models many
 * times (lists, relation batches, localizations), and evaluates each policy once (ADR 0005). Calls for
-* another principal (never made by content services today) bypass the memo.
+* another principal (never made by content services today) bypass the memo. The memo is kept per executor:
+* a policy evaluated inside one root field's read transaction is never awaited from another's.
 */
 const memoizePermissions = (base, principal) => {
-	const policies = /* @__PURE__ */ new Map();
+	const pooled = /* @__PURE__ */ new Map();
+	const byTransaction = /* @__PURE__ */ new WeakMap();
+	const memoFor = (executor) => {
+		if (!executor) return pooled;
+		let memo = byTransaction.get(executor);
+		if (!memo) {
+			memo = /* @__PURE__ */ new Map();
+			byTransaction.set(executor, memo);
+		}
+		return memo;
+	};
 	return {
-		evaluate: (caller, request) => {
-			if (caller !== principal) return base.evaluate(caller, request);
+		evaluate: (caller, request, executor) => {
+			if (caller !== principal) return base.evaluate(caller, request, executor);
+			const memo = memoFor(executor);
 			const key = `${request.action}:${request.modelId}`;
-			let policy = policies.get(key);
+			let policy = memo.get(key);
 			if (!policy) {
-				policy = base.evaluate(caller, request);
-				policies.set(key, policy);
+				policy = base.evaluate(caller, request, executor);
+				memo.set(key, policy);
 			}
 			return policy;
 		},
-		canPerform: (caller, action) => base.canPerform(caller, action),
-		canPerformOnSite: (caller, action, siteId) => base.canPerformOnSite(caller, action, siteId)
+		canPerform: (caller, action, executor) => base.canPerform(caller, action, executor),
+		canPerformOnSite: (caller, action, siteId, executor) => base.canPerformOnSite(caller, action, siteId, executor)
 	};
 };
 //#endregion
@@ -20544,6 +20951,12 @@ const staticAdminPlugin = fp(async (app, { distPath, urls, frameSources }) => {
 	if (urls.basePath !== "") app.get(urls.basePath, async (_request, reply) => reply.redirect(adminPrefix, 302));
 }, { name: "shapio-static-admin" });
 //#endregion
+//#region src/plugins/themeCatalogue.ts
+/** The catalogue is built from the project config by the app (extensions/themeStylesheet.ts). */
+const themeCataloguePlugin = fp(async (app, { catalogue }) => {
+	app.decorate("themeCatalogue", catalogue);
+}, { name: "shapio-theme-catalogue" });
+//#endregion
 //#region src/repositories/usage.ts
 const upsertFieldReads = async (rows, trx = db) => {
 	if (rows.length === 0) return;
@@ -21163,10 +21576,13 @@ const validatePermissions = (kind, permissions) => {
 		seen.add(key);
 	});
 };
-/** Every model a grant names must exist (the registry decides; package D implements the lookup). */
-const assertModelsExist = async (permissions, schema) => {
+/**
+* Every model a grant names must exist (the registry decides; package D implements the lookup).
+* `executor`: the caller's open transaction, when there is one.
+*/
+const assertModelsExist = async (permissions, schema, executor) => {
 	const modelIds = [...new Set(permissions.flatMap((p) => p.modelId === null ? [] : [p.modelId]))];
-	const exists = await Promise.all(modelIds.map((modelId) => schema.hasModel(modelId)));
+	const exists = await Promise.all(modelIds.map((modelId) => schema.hasModel(modelId, executor)));
 	const unknown = modelIds.filter((_modelId, index) => !exists[index]);
 	if (unknown.length > 0) throw new AppError(400, "UNKNOWN_MODEL", "Grants name models that do not exist", { modelIds: unknown });
 };
@@ -21233,7 +21649,7 @@ const updateRole$1 = async (context, id, input, schema) => db.transaction().exec
 	const kind = role.kind === "delivery" ? "delivery" : "admin";
 	if (input.permissions) {
 		validatePermissions(kind, input.permissions);
-		await assertModelsExist(input.permissions, schema);
+		await assertModelsExist(input.permissions, schema, trx);
 	}
 	if (!await updateIfVersion$1(id, input.expectedVersion, {
 		...input.name !== void 0 ? { name: input.name.trim() } : {},
@@ -21372,7 +21788,7 @@ const updateAppRole$1 = async (context, id, input, schema) => db.transaction().e
 	if (role.is_system && (input.name !== void 0 || input.description !== void 0)) throw new AppError(409, "SYSTEM_ROLE", "Built-in app roles keep their name; only their permissions change");
 	if (input.permissions) {
 		validateAppPermissions(input.permissions);
-		await assertModelsExist(input.permissions, schema);
+		await assertModelsExist(input.permissions, schema, trx);
 	}
 	if (!await updateIfVersion(id, input.expectedVersion, {
 		...input.name !== void 0 ? { name: input.name.trim() } : {},
@@ -23439,6 +23855,11 @@ const configSchema = Type.Object({
 		minimum: 2,
 		maximum: 200
 	}),
+	/**
+	* How long a request waits for a free pooled connection (PostgreSQL and MySQL) before it fails with
+	* 503 `DATABASE_BUSY` and a logged error, instead of queueing forever. SQLite never waits for one.
+	*/
+	DATABASE_POOL_ACQUIRE_TIMEOUT_MS: Type.Integer({ minimum: 100 }),
 	MIGRATE_ON_START: Type.Boolean(),
 	/**
 	* LISTEN for schema-change notifications to refresh caches early. Turn off where LISTEN does not work
@@ -23655,6 +24076,7 @@ const CONFIG_DEFAULTS = {
 	MEDIA_RATE_LIMIT_MAX: 6e3,
 	TLS_RELOAD_INTERVAL_MS: 6e4,
 	DATABASE_POOL_MAX: 10,
+	DATABASE_POOL_ACQUIRE_TIMEOUT_MS: DEFAULT_POOL_ACQUIRE_TIMEOUT_MS,
 	MIGRATE_ON_START: true,
 	SETUP_REQUIRE_TOKEN: false,
 	SCHEMA_LISTEN: true,
@@ -24809,20 +25231,21 @@ const requestChange = (db, request) => db.transaction().execute(async (trx) => {
 * services safe to call from anywhere (CONTRIBUTING.md rule 5).
 */
 const forbidden$1 = (message) => new AppError(403, "FORBIDDEN", message);
-const assertCanManage = async (context, definitionId) => {
+/** `executor` (here and below): the caller's open transaction, when there is one. */
+const assertCanManage = async (context, definitionId, executor) => {
 	if (!(await context.permissions.evaluate(context.actor, {
 		action: "schemaManage",
 		modelId: definitionId
-	})).allowed) throw forbidden$1("Your role does not allow changing this definition");
+	}, executor)).allowed) throw forbidden$1("Your role does not allow changing this definition");
 };
 /**
 * Creating a definition in `scope` (plan site-schema, rule 4): a site's own definition needs `schema.create`
 * from the roles that apply on that site; a shared one (null) from roles on every site. The scope of a
 * site definition is always the request's site: a view never creates on another site.
 */
-const assertCanCreate = async (context, scope) => {
+const assertCanCreate = async (context, scope, executor) => {
 	if (scope !== null && scope !== context.snapshot.siteId) throw forbidden$1("A definition can only be created on the site of the request");
-	if (!(scope === null ? await context.permissions.canPerform(context.actor, "schema.create") : await context.permissions.canPerformOnSite(context.actor, "schema.create", scope))) throw forbidden$1(scope === null ? "Sharing a definition with all sites needs schema.create on every site" : "Your role does not allow schema.create");
+	if (!(scope === null ? await context.permissions.canPerform(context.actor, "schema.create", executor) : await context.permissions.canPerformOnSite(context.actor, "schema.create", scope, executor))) throw forbidden$1(scope === null ? "Sharing a definition with all sites needs schema.create on every site" : "Your role does not allow schema.create");
 };
 /** Instance-wide schema settings (locales, the read-only lock): `schema.create` from roles on every site. */
 const assertCanChangeNetworkSchema = async (context) => {
@@ -25682,6 +26105,30 @@ const getEditorFile = async (request, reply) => {
 	return reply.type("text/javascript; charset=utf-8").header("cache-control", "private, max-age=31536000, immutable").send(await readFile(entry.path));
 };
 //#endregion
+//#region src/controllers/themeCatalogue.ts
+/** The project's extension themes, for the admin's theme menu. */
+const listThemes = async (request) => ({ items: request.server.themeCatalogue.items });
+let stylesheetEtag;
+const etagOf = (stylesheet) => {
+	if (stylesheetEtag?.stylesheet !== stylesheet) stylesheetEtag = {
+		stylesheet,
+		etag: `"${createHash("sha256").update(stylesheet).digest("base64url").slice(0, 22)}"`
+	};
+	return stylesheetEtag.etag;
+};
+/**
+* Their CSS, linked render-blocking from the admin's index.html (empty without extension themes). Public:
+* it holds colours only, and the signed-out screens render in the chosen theme too. Revalidated on each
+* load (it changes only with a restart), so a changed theme shows without a stale cache.
+*/
+const getThemeStylesheet = async (request, reply) => {
+	const { stylesheet } = request.server.themeCatalogue;
+	const etag = etagOf(stylesheet);
+	reply.header("etag", etag).header("cache-control", "no-cache").type("text/css; charset=utf-8");
+	if (request.headers["if-none-match"] === etag) return reply.code(304).send();
+	return reply.send(stylesheet);
+};
+//#endregion
 //#region src/routes/admin/extensions/schemas.ts
 const closed$3 = { additionalProperties: false };
 const listEditorsSchema = { response: { 200: Type.Object({ items: Type.Array(Type.Object({
@@ -25696,9 +26143,18 @@ const getEditorFileSchema = {
 	}) }, closed$3),
 	querystring: Type.Object({ v: Type.Optional(Type.String({ maxLength: 64 })) }, closed$3)
 };
+const listThemesSchema = { response: { 200: Type.Object({ items: Type.Array(Type.Object({
+	key: Type.String(),
+	name: Type.String(),
+	description: Type.Optional(Type.String()),
+	variants: Type.Array(Type.Union([Type.Literal("light"), Type.Literal("dark")]))
+})) }) } };
 //#endregion
 //#region src/routes/admin/extensions/index.ts
-/** /api/admin/extensions: what the project installed for the admin (custom field editors, ADR 0009). */
+/**
+* /api/admin/extensions: what the project installed for the admin (custom field editors, ADR 0009; colour
+* themes, docs/plans/themes.md).
+*/
 const adminExtensionsRoutes = async (app) => {
 	declareSiteScope(app, "network");
 	const admin = { preHandler: app.requireAdmin };
@@ -25710,6 +26166,8 @@ const adminExtensionsRoutes = async (app) => {
 		...admin,
 		schema: getEditorFileSchema
 	}, getEditorFile);
+	app.get("/themes", { schema: listThemesSchema }, listThemes);
+	app.get("/themes.css", getThemeStylesheet);
 };
 //#endregion
 //#region src/repositories/auditLog.ts
@@ -30622,8 +31080,8 @@ const staleDraft = (plans) => {
 		activeVersion: stale.activeVersion
 	});
 };
-const authorizeDrafts = async (context, plans) => {
-	for (const planned of plans) await (planned.activeVersion === null ? assertCanCreate(context, draftScopeOf(context, planned.draft)) : assertCanManage(context, planned.draft.definition_id));
+const authorizeDrafts = async (context, plans, executor) => {
+	for (const planned of plans) await (planned.activeVersion === null ? assertCanCreate(context, draftScopeOf(context, planned.draft), executor) : assertCanManage(context, planned.draft.definition_id, executor));
 };
 /** Loads and checks a set's items for shipping, with the acknowledgements given (interactive or stored). */
 /**
@@ -30631,11 +31089,11 @@ const authorizeDrafts = async (context, plans) => {
 * can prepare change sets without making them live. Checked here so interactive, scheduled and job-run
 * ships all check it, with the actor that asked for the ship.
 */
-const assertCanShip = async (context) => {
-	if (!await context.permissions.canPerform(context.actor, "changes.ship")) throw new AppError(403, "FORBIDDEN", "Your role does not allow changes.ship");
+const assertCanShip = async (context, executor) => {
+	if (!await context.permissions.canPerform(context.actor, "changes.ship", executor)) throw new AppError(403, "FORBIDDEN", "Your role does not allow changes.ship");
 };
 const planShip = async (context, row, ack, executor) => {
-	await assertCanShip(context);
+	await assertCanShip(context, executor);
 	const items = await listForSet$1(row.id, executor);
 	const entryItems = items.filter((item) => item.kind === "entry");
 	const drafts = await listForSet(row.id, executor);
@@ -30646,9 +31104,13 @@ const planShip = async (context, row, ack, executor) => {
 		schema: [],
 		needsJob: false
 	};
-	await assertWritable(context);
-	const plans = await planDrafts(context, drafts);
-	await authorizeDrafts(context, plans);
+	const inTransaction = {
+		...context,
+		db: executor
+	};
+	await assertWritable(inTransaction);
+	const plans = await planDrafts(inTransaction, drafts);
+	await authorizeDrafts(context, plans, executor);
 	const stale = staleDraft(plans);
 	if (stale) throw stale;
 	const invalid = plans.flatMap((planned) => planned.issues);
@@ -32239,13 +32701,13 @@ var PublicationItemError = class extends AppError {
 		this.ref = ref;
 	}
 };
-const resolveModels = async (context, items) => {
+const resolveModels = async (context, trx, items) => {
 	const models = /* @__PURE__ */ new Map();
 	for (const modelId of new Set(items.map((item) => item.modelId))) {
 		const model = resolveModelById(context.snapshot, modelId);
 		if (!model) throw new PublicationItemError(items.find((item) => item.modelId === modelId)?.ref ?? modelId, modelNotFound(modelId));
 		if (!model.definition.draftAndPublish) throw new PublicationItemError(items.find((item) => item.modelId === modelId)?.ref ?? modelId, publishingDisabled(model.definition.apiKey));
-		models.set(modelId, await modelWithPolicy(context, model.definition.apiKey, "publish"));
+		models.set(modelId, await modelWithPolicy(context, model.definition.apiKey, "publish", trx));
 	}
 	return models;
 };
@@ -32404,7 +32866,7 @@ const processEntry = async (context, trx, resolved, entry, via) => {
 * order and publishes everything with the one number from `seq`.
 */
 const runPublicationBatchInTransaction = async (context, trx, items, via, seq) => {
-	const models = await resolveModels(context, items);
+	const models = await resolveModels(context, trx, items);
 	await guardModelVersions(trx, [...models.values()].map((resolved) => resolved.model), context.site.id);
 	await lockItemLocales(trx, items, models);
 	const byEntry = /* @__PURE__ */ new Map();
@@ -37363,7 +37825,7 @@ const openStoredBundle = (storage, stored) => storage.get(stored.driver).getStre
 const removeStoredBundle = (storage, stored) => storage.get(stored.driver).delete(stored.key);
 //#endregion
 //#region src/constants/version.ts
-const SHAPIO_VERSION = "0.3.0";
+const SHAPIO_VERSION = "0.3.1";
 //#endregion
 //#region src/repositories/transferExport.ts
 /**
@@ -44944,12 +45406,12 @@ const createPreviewPermissions = (base, creator, fields, binding) => {
 		siteId: binding.siteId
 	} : void 0;
 	return {
-		evaluate: async (_principal, request) => {
+		evaluate: async (_principal, request, executor) => {
 			if (request.action !== "read") return DENIED_POLICY;
-			const policy = await base.evaluate(creator, request);
-			const modelFields = await fields.getModelFields(request.modelId);
+			const policy = await base.evaluate(creator, request, executor);
+			const modelFields = await fields.getModelFields(request.modelId, executor);
 			if (!policy.allowed || !modelFields) return DENIED_POLICY;
-			const sitePolicy = site ? await base.evaluate(site, request) : void 0;
+			const sitePolicy = site ? await base.evaluate(site, request, executor) : void 0;
 			if (sitePolicy && !sitePolicy.allowed) return DENIED_POLICY;
 			const visible = modelFields.filter((field) => allows(policy.readMask, field.id) && (sitePolicy ? allows(sitePolicy.readMask, field.id) : field.public));
 			return {
@@ -45291,6 +45753,7 @@ const buildApp = async (config, deps) => {
 	await app.register(contentHooksPlugin, { hooks: deps.contentHooks ?? extensions.hooks });
 	await app.register(adminContentRoutes, { prefix: urls.withBasePath("/api/admin/content") });
 	await app.register(editorManifestPlugin, { manifest: deps.editorManifest ?? buildEditorManifest(extensions.loaded.projectDir, extensions.loaded.config.editors ?? [], app.log.child({ component: "extensions" })) });
+	await app.register(themeCataloguePlugin, { catalogue: buildThemeCatalogue(extensions.loaded.config.themes ?? []) });
 	await app.register(adminExtensionsRoutes, { prefix: urls.withBasePath("/api/admin/extensions") });
 	await app.register(deliveryRoutes, { prefix: urls.withBasePath("/api/content") });
 	await app.register(snapshotsRoutes, { prefix: urls.withBasePath("/api/snapshots") });
@@ -45605,6 +46068,7 @@ const toAppConfig = (raw) => {
 		database: {
 			url: raw.DATABASE_URL,
 			poolMax: raw.DATABASE_POOL_MAX,
+			acquireTimeoutMs: raw.DATABASE_POOL_ACQUIRE_TIMEOUT_MS,
 			migrateOnStart: raw.MIGRATE_ON_START
 		},
 		schema: { listen: raw.SCHEMA_LISTEN },
@@ -47322,6 +47786,7 @@ const prepareTls = async ({ config, urls, log }) => {
 const openDatabase = (config, role, logger) => createDb({
 	connectionString: config.database.url,
 	poolMax: config.database.poolMax,
+	acquireTimeoutMs: config.database.acquireTimeoutMs,
 	applicationName: `shapio-${role}`,
 	onIdleConnectionError: (error) => logger.warn({ err: error }, "database connection lost; it will be replaced on the next query")
 });
@@ -47496,6 +47961,7 @@ const startDedicatedWorker = async (config) => {
 	const db = createDb({
 		connectionString: config.database.url,
 		poolMax: Math.max(2, config.worker.concurrency + 1),
+		acquireTimeoutMs: config.database.acquireTimeoutMs,
 		applicationName: "shapio-worker",
 		onIdleConnectionError: (error) => logger.warn({ err: error }, "database connection lost; it will be replaced on the next query")
 	});
@@ -47527,6 +47993,6 @@ const startDedicatedWorker = async (config) => {
 	return worker;
 };
 //#endregion
-export { validateSchema as $, update$8 as A, hashDefinition as B, BEFORE_EVENTS as C, listForAssets as D, buildEditorManifest as E, RESERVED_FIELD_API_KEYS as F, parseLockFile as G, lockEntriesForSite as H, RESERVED_TYPE_NAMES as I, serializeDefinition as J, schemaFilePath as K, SCHEMA_KIND_DIRECTORIES as L, describeError as M, LOCK_FILE_PATH as N, listLiveByDriver as O, RESERVED_DEFINITION_API_KEYS as P, upgradeLockFile as Q, SITES_DIRECTORY as R, AFTER_EVENTS as S, EXTENSION_ROUTE_ROOT as T, mergePulledLock as U, lockCoversSite as V, parseDefinition as W, suggestPlural as X, serializeLockFile as Y, toTypeName as Z, createLogger as _, loadConfig as a, createDb as at, SITE_KEY_PATTERN as b, getPendingMigrations as c, createMediaStorage as d, withSiteCovered as et, createSite$1 as f, generateToken as g, SYSTEM_CLI_ACTOR as h, assertDatabaseReachable as i, validateRichText as it, STORAGE_DRIVERS$1 as j, lockById$5 as k, migrateToLatest as l, createAdminDirect as m, startServer as n, SAFE_LINK_PATTERN as nt, loadEnvFileIfPresent as o, sqliteDriverOf as ot, listAllSites as p, scopeDirectory as q, copyObjectVerified as r, createStableId as rt, buildApp as s, startDedicatedWorker as t, RICHTEXT_FORMAT as tt, SHAPIO_VERSION as u, createUrlBuilder as v, EXTENSION_JOB_PREFIX as w, loadProjectConfig as x, loopbackUrl as y, foldApiKey as z };
+export { toTypeName as $, update$8 as A, checkThemeContrast as B, BEFORE_EVENTS as C, listForAssets as D, buildEditorManifest as E, RESERVED_FIELD_API_KEYS as F, mergePulledLock as G, hashDefinition as H, RESERVED_TYPE_NAMES as I, schemaFilePath as J, parseDefinition as K, SCHEMA_KIND_DIRECTORIES as L, describeError as M, LOCK_FILE_PATH as N, listLiveByDriver as O, RESERVED_DEFINITION_API_KEYS as P, suggestPlural as Q, SITES_DIRECTORY as R, AFTER_EVENTS as S, EXTENSION_ROUTE_ROOT as T, lockCoversSite as U, foldApiKey as V, lockEntriesForSite as W, serializeDefinition as X, scopeDirectory as Y, serializeLockFile as Z, createLogger as _, loadConfig as a, createStableId as at, SITE_KEY_PATTERN as b, getPendingMigrations as c, sqliteDriverOf as ct, createMediaStorage as d, upgradeLockFile as et, createSite$1 as f, generateToken as g, SYSTEM_CLI_ACTOR as h, assertDatabaseReachable as i, SAFE_LINK_PATTERN as it, STORAGE_DRIVERS$1 as j, lockById$5 as k, migrateToLatest as l, createAdminDirect as m, startServer as n, withSiteCovered as nt, loadEnvFileIfPresent as o, validateRichText as ot, listAllSites as p, parseLockFile as q, copyObjectVerified as r, RICHTEXT_FORMAT as rt, buildApp as s, createDb as st, startDedicatedWorker as t, validateSchema as tt, SHAPIO_VERSION as u, createUrlBuilder as v, EXTENSION_JOB_PREFIX as w, loadProjectConfig as x, loopbackUrl as y, THEME_VARIANTS as z };
 
-//# sourceMappingURL=worker-BLXy8aRW.js.map
+//# sourceMappingURL=worker-BAmQPoTJ.js.map