clay-server 4.1.0-beta.8 → 4.1.0

package/lib/project-logs-service.js

@@ -253,6 +253,11 @@ function attachProjectLogsService(ctx) {
 
   function createProjectBound(initial, revalidate) {
     var store = storeForStatus(initial.status);
+    var scheduledResultViewerId = initial.principal.userId || null;
+
+    function withScheduledResultViewer(args) {
+      return Object.assign({}, args || {}, { scheduledResultOwnerId: scheduledResultViewerId });
+    }
 
     // Identity, authorization, and the target store are all re-derived per
     // call. revalidate() re-checks exact session identity where there is one;
@@ -288,7 +293,15 @@ function attachProjectLogsService(ctx) {
 
     function scopedEntry(args) {
       var scope = currentScope();
-      return visibleEntry(live(), args && args.ref, scope.status, scope.worktreeOnly);
+      var entry = visibleEntry(live(), args && args.ref, scope.status, scope.worktreeOnly);
+      if (entry.scheduledResult && (entry.scheduledResult.ownerId || null) !== scheduledResultViewerId) throw new Error("Log entry not found.");
+      return entry;
+    }
+
+    function mutableEntry(args) {
+      var entry = scopedEntry(args);
+      if (entry.scheduledResult) throw new Error("Scheduled results are server-owned records.");
+      return entry;
     }
 
     function mutationContext() {
@@ -312,7 +325,7 @@ function attachProjectLogsService(ctx) {
       listLogs: function (args) {
         var scope = currentScope();
         var status = scope.status;
-        var options = scopedArgs(args, status, scope.worktreeOnly);
+        var options = withScheduledResultViewer(scopedArgs(args, status, scope.worktreeOnly));
         var result = live().list(options);
         result.contextMode = options.contextMode;
         result.currentChangeSetId = status.changeSetId || null;
@@ -322,7 +335,7 @@ function attachProjectLogsService(ctx) {
       searchLogs: function (args) {
         var scope = currentScope();
         var status = scope.status;
-        var options = scopedArgs(args, status, scope.worktreeOnly);
+        var options = withScheduledResultViewer(scopedArgs(args, status, scope.worktreeOnly));
         var result = live().search(options);
         result.contextMode = options.contextMode;
         result.currentChangeSetId = status.changeSetId || null;
@@ -334,18 +347,20 @@ function attachProjectLogsService(ctx) {
       },
       logHistory: function (args) { scopedEntry(args); return live().history(args && args.ref, args || {}); },
       commentLog: function (args) { scopedEntry(args); return live().comment(args && args.ref, args || {}, author(), mutationContext()); },
+      scheduledResultsState: function () { var scope = currentScope(); return live().unreadScheduledResults(scheduledResultViewerId, scopedArgs({}, scope.status, scope.worktreeOnly)); },
+      markScheduledResultRead: function (args) { var scope = currentScope(); scopedEntry(args); return live().markScheduledResultRead(args && args.ref, scheduledResultViewerId, scopedArgs({}, scope.status, scope.worktreeOnly)); },
       readLogRevision: function (args) { scopedEntry(args); return live().readRevision(args && args.ref, args && args.revision); },
       listLogFeedback: canonical ? function (args) {
         var scope = currentScope();
-        return live().feedback(scopedArgs(args, scope.status, scope.worktreeOnly));
+        return live().feedback(withScheduledResultViewer(scopedArgs(args, scope.status, scope.worktreeOnly)));
       } : driverOnly,
-      reviewLogComment: canonical ? function (args) { scopedEntry(args); return live().review(args && args.ref, args || {}, author(), mutationContext()); } : driverOnly,
+      reviewLogComment: canonical ? function (args) { if (args && args.action === "incorporate") mutableEntry(args); else scopedEntry(args); return live().review(args && args.ref, args || {}, author(), mutationContext()); } : driverOnly,
       revertLog: canonical
-        ? function (args) { scopedEntry(args); return live().revert(args && args.ref, args && args.revision, args && args.reason, author(), mutationContext()); }
+        ? function (args) { mutableEntry(args); return live().revert(args && args.ref, args && args.revision, args && args.reason, author(), mutationContext()); }
         : driverOnly,
       createLog: canonical ? function (args) { return live().create(args || {}, author(), mutationContext()); } : agentOnly,
-      updateLog: canonical ? function (args) { scopedEntry(args); return live().update(args && args.ref, args || {}, author(), mutationContext()); } : agentOnly,
-      linkLog: canonical ? function (args) { scopedEntry(args); return live().link(args && args.ref, args && args.links, author(), mutationContext()); } : agentOnly,
+      updateLog: canonical ? function (args) { mutableEntry(args); return live().update(args && args.ref, args || {}, author(), mutationContext()); } : agentOnly,
+      linkLog: canonical ? function (args) { mutableEntry(args); return live().link(args && args.ref, args && args.links, author(), mutationContext()); } : agentOnly,
       removeLog: canDelete ? function (args) {
         var current = revalidate();
         var project = projectFor(current.principal.projectSlug);
@@ -353,7 +368,7 @@ function attachProjectLogsService(ctx) {
         if (!project || !authorizedProject(current.principal, currentStatus)) {
           throw new Error("Project Logs are not available for this project.");
         }
-        visibleEntry(storeForStatus(currentStatus), args && args.ref, currentStatus, projectAuthorization(current.principal, currentStatus).worktreeOnly);
+        mutableEntry(args);
         if (current.principal.kind !== "session" && !ownsProject(current.principal, currentStatus)) ownerOnly();
         return storeForStatus(currentStatus).remove(args && args.ref, current.author, recordContext(currentStatus));
       } : ownerOnly,
@@ -367,6 +382,20 @@ function attachProjectLogsService(ctx) {
     return storeForStatus(projectStatus).setContextState(recordContext(projectStatus), status);
   }
 
+  // Trusted server lifecycle path. It is deliberately not part of any bound
+  // human or MCP write capability, so system results cannot be impersonated.
+  function recordScheduledResult(source) {
+    var data = source || {};
+    var project = projectFor(data.projectSlug);
+    if (!project) throw new Error("Project not found.");
+    var status = project.getStatus();
+    if (!status || status.isMate === true) throw new Error("Scheduled results require a project.");
+    if (isMultiUser()) {
+      if (!data.ownerId || !findUserById(data.ownerId)) throw new Error("Scheduled result owner is unavailable.");
+    }
+    return storeForStatus(status).createScheduledResult(data, recordContext(status));
+  }
+
   function createClayBound(revalidate) {
     function target(args) {
       var principal = revalidate();
@@ -374,14 +403,16 @@ function attachProjectLogsService(ctx) {
       if (!slug) throw new Error("An exact project slug is required.");
       var status = statusFor(principal, slug);
       var decision = projectAuthorization(principal, status);
-      return { store: storeForStatus(status), status: status, worktreeOnly: decision.worktreeOnly };
+      return { store: storeForStatus(status), status: status, worktreeOnly: decision.worktreeOnly, viewerId: principal.userId || null };
     }
 
     function targetEntry(args) {
       var selected = target(args);
+      var entry = visibleEntry(selected.store, args && args.ref, selected.status, selected.worktreeOnly);
+      if (entry.scheduledResult && (entry.scheduledResult.ownerId || null) !== selected.viewerId) throw new Error("Log entry not found.");
       return {
         selected: selected,
-        entry: visibleEntry(selected.store, args && args.ref, selected.status, selected.worktreeOnly),
+        entry: entry,
       };
     }
 
@@ -405,6 +436,7 @@ function attachProjectLogsService(ctx) {
         seenScopes.add(scopeKey);
         var entry = null;
         try { entry = visibleEntry(storeForStatus(status), ref, status, decision.worktreeOnly); } catch (e) { return; }
+        if (entry && entry.scheduledResult && (entry.scheduledResult.ownerId || null) !== (principal.userId || null)) return;
         if (!entry) return;
         var targetSlug = decision.worktreeOnly
           ? slug
@@ -425,11 +457,11 @@ function attachProjectLogsService(ctx) {
       author: null,
       listLogs: function (args) {
         var selected = target(args);
-        return selected.store.list(scopedArgs(args, selected.status, selected.worktreeOnly));
+        return selected.store.list(Object.assign({}, scopedArgs(args, selected.status, selected.worktreeOnly), { scheduledResultOwnerId: selected.viewerId }));
       },
       searchLogs: function (args) {
         var selected = target(args);
-        return selected.store.search(scopedArgs(args, selected.status, selected.worktreeOnly));
+        return selected.store.search(Object.assign({}, scopedArgs(args, selected.status, selected.worktreeOnly), { scheduledResultOwnerId: selected.viewerId }));
       },
       readLog: function (args) {
         return targetEntry(args).entry;
@@ -458,6 +490,7 @@ function attachProjectLogsService(ctx) {
     bindProjectSession: bindProjectSession,
     bindUser: bindUser,
     bindMate: bindMate,
+    recordScheduledResult: recordScheduledResult,
     setContextState: setContextState,
   };
 }

package/lib/project-logs-store.js

@@ -1,5 +1,4 @@
 // Project Logs projection over the Clay-wide knowledge record backend.
-
 var fs = require("fs");
 var path = require("path");
 var crypto = require("crypto");
@@ -12,6 +11,7 @@ var logsVersioning = require("./project-logs-versioning");
 var logsRoot = require("./project-logs-root");
 var logContext = require("./project-log-context");
 var contextState = require("./project-logs-context-state");
+var scheduledResultStore = require("./project-scheduled-result-store");
 
 var MAX_SUMMARY_CHARS = logsSchema.MAX_SUMMARY_CHARS;
 var MAX_COMMENT_CHARS = 4000;
@@ -34,7 +34,6 @@ var normalizeTags = logsSchema.normalizeTags;
 var normalizeLinks = logsSchema.normalizeLinks;
 
 var page = logsQuery.page;
-
 // Filters accept any well-formed category. An unknown but valid one matches
 // nothing, which is a real answer. A supplied malformed one is an error:
 // silently dropping it would widen the result set to everything the caller is
@@ -45,7 +44,6 @@ function validateKind(kind, fallback) {
   return logsSchema.normalizeCategory(kind);
 }
 
-
 function createProjectLogsStore(opts) {
   var options = opts || {};
   var root = options.root ? path.resolve(options.root) : logsRoot.resolveProjectRoot(options.cwd, options.runGit);
@@ -116,6 +114,7 @@ function createProjectLogsStore(opts) {
       deletedAt: history.deleted ? history.deleted.at : null,
       deletedBy: history.deleted ? history.deleted.author : null,
       context: logContext.normalizeRecordContext(originRecord && originRecord.context),
+      scheduledResult: scheduledResultStore.normalizeMetadata(originRecord && originRecord.scheduledResult),
     };
     if (entry.context.changeSetId) {
       var states = knownContextStates || contexts.states();
@@ -132,13 +131,14 @@ function createProjectLogsStore(opts) {
     return entry;
   }
 
-  function entries(includeDeleted) {
+  function entries(includeDeleted, scheduledResultOwnerId) {
     var out = [];
     var states = contexts.states();
     chains().forEach(function (chain, rootId) {
       var entry = fold(rootId, chain, states);
       if (!entry) return;
       if (entry.deleted && !includeDeleted) return;
+      if (!scheduledResultStore.visibleTo(entry.scheduledResult, scheduledResultOwnerId)) return;
       out.push(entry);
     });
     // Latest canonical update first, ref as a deterministic tie-break. Only a
@@ -157,12 +157,13 @@ function createProjectLogsStore(opts) {
     return found;
   }
 
-  function read(ref, includeDeleted) {
+  function read(ref, includeDeleted, scheduledResultOwnerId) {
     var located = findChain(ref);
     if (!located) return null;
     var entry = fold(located.rootId, located.chain);
     if (!entry) return null;
     if (entry.deleted && !includeDeleted) return null;
+    if (!scheduledResultStore.visibleTo(entry.scheduledResult, scheduledResultOwnerId)) return null;
     return entry;
   }
 
@@ -212,8 +213,7 @@ function createProjectLogsStore(opts) {
     return read(refFor(id), false);
   }
 
-  // Build the complete snapshot a revision will store, from the current state
-  // plus the requested changes. Every new canonical edit is self-contained.
+  // Build the complete snapshot a revision will store from current state.
   function nextSnapshot(current, validated, data) {
     var snapshot = logsSnapshot.cloneSnapshot(current);
     if (validated.category !== undefined) snapshot.category = validated.category;
@@ -251,7 +251,6 @@ function createProjectLogsStore(opts) {
   }
 
   // One append per canonical revision, always carrying a complete snapshot.
-  // Legacy field names ride along so an older build can still read the record.
   function appendRevision(rootId, op, snapshot, author, extra) {
     var record = {
       id: recordStore.newRecordId(),
@@ -275,9 +274,7 @@ function createProjectLogsStore(opts) {
     return record;
   }
 
-  // Human participation. Append-only for this slice: no edit, no delete, and
-  // never a canonical revision. The author is supplied by the authorization
-  // layer, never by the caller's payload.
+  // Human participation is append-only and never a canonical revision.
   function comment(ref, input, author, context) {
     var located = requireLive(ref);
     var data = input || {};
@@ -344,7 +341,7 @@ function createProjectLogsStore(opts) {
   function categories(options) {
     var seen = {};
     var out = [];
-    var live = entries(false);
+    var live = entries(false, options && options.scheduledResultOwnerId);
     for (var i = 0; i < live.length; i++) {
       if (!logsQuery.matchesContext(live[i], options || {})) continue;
       var value = live[i].category;
@@ -379,7 +376,7 @@ function createProjectLogsStore(opts) {
     var limit = Number(options2.limit);
     if (!Number.isFinite(limit)) limit = MAX_FEEDBACK_ITEMS;
     limit = Math.max(1, Math.min(MAX_FEEDBACK_ITEMS, Math.floor(limit)));
-    var live = entries(false);
+    var live = entries(false, options2.scheduledResultOwnerId);
     var out = [];
     var total = 0;
     for (var i = 0; i < live.length; i++) {
@@ -409,13 +406,13 @@ function createProjectLogsStore(opts) {
 
   function list(args) {
     var options2 = args || {};
-    var result = logsQuery.listEntries(entries(options2.includeDeleted === true), options2, cleanLine, validateKind);
+    var result = logsQuery.listEntries(entries(options2.includeDeleted === true, options2.scheduledResultOwnerId), options2, cleanLine, validateKind);
     result.categories = categories(options2);
     return result;
   }
 
   function search(args) {
-    var result = logsQuery.searchEntries(entries(false), args || {}, cleanLine, validateKind);
+    var result = logsQuery.searchEntries(entries(false, args && args.scheduledResultOwnerId), args || {}, cleanLine, validateKind);
     result.categories = categories(args || {});
     return result;
   }
@@ -457,6 +454,8 @@ function createProjectLogsStore(opts) {
     };
   }
 
+  var scheduledResults = scheduledResultStore.attachScheduledResultStore({ store: store, scopeId: scopeId, refFor: refFor, read: read, entries: entries, findChain: findChain, matchesContext: logsQuery.matchesContext });
+
   return {
     root: root,
     scopeId: scopeId,
@@ -477,6 +476,9 @@ function createProjectLogsStore(opts) {
     search: search,
     history: history,
     stats: stats,
+    createScheduledResult: scheduledResults.create,
+    unreadScheduledResults: scheduledResults.unread,
+    markScheduledResultRead: scheduledResults.markRead,
   };
 }
 

package/lib/project-logs.js

@@ -72,6 +72,8 @@ var HANDLED_TYPES = [
   "project_log_read",
   "project_log_comment",
   "project_log_delete",
+  "scheduled_task_result_mark_read",
+  "scheduled_task_result_open_session",
   // Retired human mutations. Still claimed so an older client gets an
   // explicit refusal rather than silence.
   "project_log_create",
@@ -155,6 +157,31 @@ function attachProjectLogs(ctx) {
     return service.bindUser({ projectSlug: slug, user: (ws && ws._clayUser) || null });
   }
 
+  function scheduledResultState(bound, autoFocus) {
+    var state = bound.scheduledResultsState();
+    return { type: "scheduled_task_results_state", unreadCount: state.count, newestUnreadRef: state.newestRef, autoFocus: autoFocus === true };
+  }
+
+  function sendScheduledResultState(ws) {
+    if (!ws || ws._clayPane) return false;
+    var bound = userBinding(ws);
+    if (!bound) return false;
+    try { sendTo(ws, scheduledResultState(bound, true)); return true; } catch (e) { return false; }
+  }
+
+  function broadcastScheduledResultState(sourceWs) {
+    var sourceUserId = sourceWs && sourceWs._clayUser ? sourceWs._clayUser.id : null;
+    var clients = getClients();
+    for (var client of clients) {
+      if (!client || client.readyState !== 1 || client._clayPane) continue;
+      var clientUserId = client._clayUser ? client._clayUser.id : null;
+      if (clientUserId !== sourceUserId) continue;
+      var bound = userBinding(client);
+      if (!bound) continue;
+      try { sendTo(client, scheduledResultState(bound)); } catch (e) {}
+    }
+  }
+
   // --- WebSocket surface -----------------------------------------------
 
   function fail(ws, requestId, message) {
@@ -253,6 +280,27 @@ function attachProjectLogs(ctx) {
         sendTo(ws, { type: "project_log_commented", requestId: requestId, entry: commented, reviewQueued: reviewQueued });
         return true;
       }
+
+      if (msg.type === "scheduled_task_result_mark_read") {
+        bound.markScheduledResultRead({ ref: msg.ref });
+        broadcastScheduledResultState(ws);
+        return true;
+      }
+
+      if (msg.type === "scheduled_task_result_open_session") {
+        var resultEntry = bound.readLog({ ref: msg.ref });
+        var resultMeta = resultEntry && resultEntry.scheduledResult;
+        if (!resultMeta) throw new Error("Scheduled result not found.");
+        var target = null;
+        sm.sessions.forEach(function (session) {
+          if (target || !session || session.sessionOriginId !== resultMeta.driverOriginId) return;
+          var marker = session.scheduledTaskRun;
+          if ((session.ownerId || null) === (resultMeta.ownerId || null) && marker && marker.role === "driver" && marker.runId === resultMeta.runId && marker.scheduleId === resultMeta.scheduleId) target = session;
+        });
+        if (!target) throw new Error("This scheduled session is no longer available.");
+        sendTo(ws, { type: "scheduled_task_result_session", requestId: requestId, ref: resultEntry.ref, sessionId: target.localId });
+        return true;
+      }
     } catch (e) {
       fail(ws, requestId, (e && e.message) || "Project Logs could not complete the request.");
       return true;
@@ -378,6 +426,26 @@ function attachProjectLogs(ctx) {
       "\n" + logsMcp.REVIEW_CONTRACT + pendingFeedbackSignal(session);
   }
 
+  function recordScheduledResult(data) {
+    if (!service || isMate) return null;
+    var result = service.recordScheduledResult(Object.assign({}, data || {}, { projectSlug: slug }));
+    if (!result || !result.entry || !result.created) return result;
+    var clients = getClients();
+    for (var client of clients) {
+      if (!client || client.readyState !== 1 || client._clayPane) continue;
+      if (result.entry.scheduledResult.ownerId && (!client._clayUser || client._clayUser.id !== result.entry.scheduledResult.ownerId)) continue;
+      var bound = userBinding(client);
+      if (!bound) continue;
+      try { bound.readLog({ ref: result.entry.ref }); } catch (e) { continue; }
+      sendTo(client, {
+        type: "scheduled_task_result_created", ref: result.entry.ref,
+        title: result.entry.title, summary: result.entry.summary,
+        outcome: result.entry.scheduledResult.outcome,
+      });
+    }
+    return result;
+  }
+
   return {
     handleLogsMessage: handleLogsMessage,
     createMcpServer: createMcpServer,
@@ -386,6 +454,8 @@ function attachProjectLogs(ctx) {
     getBridgeTools: getBridgeTools,
     callBridgeTool: callBridgeTool,
     getSystemPrompt: getSystemPrompt,
+    recordScheduledResult: recordScheduledResult,
+    sendScheduledResultState: sendScheduledResultState,
   };
 }
 

package/lib/project-loop.js

@@ -373,6 +373,7 @@ function attachLoop(ctx) {
       if (durableSchedule) durableSchedule.sync();
       send({ type: "loop_registry_updated", records: getHubSchedules() });
     },
+    onRunTerminal: ctx.onScheduledRunTerminal,
   });
   loopRegistry.load();
   if (ctx.durableScheduler) {

package/lib/project-notifications.js

@@ -67,7 +67,7 @@ var formatters = {
       type: "permission_request",
       title: data.title || "Permission requested",
       body: data.body || "",
-      meta: { requestId: data.requestId, toolName: data.toolName, toolInput: data.toolInput || null },
+      meta: { requestId: data.requestId, toolName: data.toolName, toolInput: data.toolInput || null, defaultToNo: data.defaultToNo === true, suppressAlwaysAllowRule: data.suppressAlwaysAllowRule === true },
     };
   },
 

package/lib/project-pending-message-queue.js

@@ -37,6 +37,7 @@ function createPendingMessageQueue(opts) {
     for (var i = 0; i < parsed.items.length; i++) {
       var item = parsed.items[i];
       if (!item || typeof item.id !== "string" || typeof item.sessionKey !== "string" || typeof item.projectSlug !== "string" || typeof item.actorId !== "string" || !item.message || ["pending", "claimed", "consumed", "cancelled", "failed"].indexOf(item.state) < 0) return false;
+      if (item.schedule !== undefined && (!item.schedule || typeof item.schedule !== "object" || typeof item.schedule.jobId !== "string" || typeof item.schedule.revision !== "string" || typeof item.schedule.ready !== "boolean" || !Number.isFinite(Number(item.schedule.notBefore)))) return false;
     }
     return true;
   }
@@ -113,30 +114,42 @@ function createPendingMessageQueue(opts) {
     for (var i = 0; i < data.items.length; i++) if (sameTarget(data.items[i], session) && (data.items[i].state === "pending" || data.items[i].state === "claimed")) return true;
     return false;
   }
-  function admit(session, message, actor) {
+  function admitInternal(session, message, actor, trustedSchedule) {
     if (loadError) return result(false, loadError, session, actor);
     if (!session || !canMutate(session, actor, null)) return result(false, "Not authorized", session, actor);
     var validationError = validateMessage(message);
     if (validationError) return result(false, validationError, session, actor);
+    var clientId = message.clientMessageId ? String(message.clientMessageId) : null;
+    var duplicate = inspect(session, actor, clientId);
+    if (duplicate) {
+      var duplicateResult = result(duplicate.state !== "cancelled" && duplicate.state !== "failed", duplicate.state === "cancelled" ? "Message was cancelled" : duplicate.state === "failed" ? "Message delivery failed" : null, session, actor);
+      duplicateResult.item = duplicate;
+      return duplicateResult;
+    }
     var activeCount = 0;
     for (var activeIndex = 0; activeIndex < data.items.length; activeIndex++) {
       if (sameTarget(data.items[activeIndex], session) && (data.items[activeIndex].state === "pending" || data.items[activeIndex].state === "claimed")) activeCount++;
     }
     if (activeCount >= MAX_ACTIVE_ITEMS) return result(false, "Pending message queue is full", session, actor);
-    var clientId = message.clientMessageId ? String(message.clientMessageId) : null;
-    var duplicate = inspect(session, actor, clientId);
-    if (duplicate) return result(duplicate.state !== "cancelled" && duplicate.state !== "failed", duplicate.state === "cancelled" ? "Message was cancelled" : duplicate.state === "failed" ? "Message delivery failed" : null, session, actor);
     var before = copy(data);
     var storedMessage = copy(message);
+    delete storedMessage.schedule;
     if (Object.prototype.hasOwnProperty.call(storedMessage, "images")) storedMessage.images = sanitizeImages(storedMessage.images);
     var item = { id: "pm_" + data.nextId++, sessionKey: key(session), sessionLocalId: session.localId, projectSlug: opts.slug, actorId: actorId(actor), actorName: actor && (actor.displayName || actor.username || actor.name) ? String(actor.displayName || actor.username || actor.name).slice(0, 120) : null, clientMessageId: clientId, message: storedMessage, createdAt: Date.now(), state: "pending" };
+    if (trustedSchedule) item.schedule = copy(trustedSchedule);
     delete item.message._pendingConsumed;
+    delete item.message._scheduledJobId;
+    delete item.message._scheduledRevision;
+    delete item.message._scheduledNotBefore;
     data.items.push(item);
     data.revision++;
     try { persist(); } catch (e) { restore(before); return result(false, "Queue storage failed", session, actor); }
     broadcast(session, { type: "pending_message_queued", sessionId: session.localId, projectSlug: opts.slug, paused: isPaused(session), item: copy(item), revision: data.revision });
-    return result(true, null, session, actor);
+    var admitted = result(true, null, session, actor);
+    admitted.item = copy(item);
+    return admitted;
   }
+  function admit(session, message, actor) { return admitInternal(session, message, actor, null); }
   function mutate(session, actor, id, expectedRevision, expectedSessionId, operation, allowedStates) {
     if (loadError) return result(false, loadError, session, actor);
     if (!session || session.localId !== expectedSessionId || !authorize(session, actor)) return result(false, "Session changed", session, actor);
@@ -151,6 +164,7 @@ function createPendingMessageQueue(opts) {
     try { persist(); } catch (e) { restore(before); return result(false, "Queue storage failed", session, actor); }
     if (data.items[index].state === "cancelled" && session._pendingMessageClaimId === data.items[index].id) delete session._pendingMessageClaimId;
     broadcast(session, { type: "pending_message_state", sessionId: session.localId, projectSlug: opts.slug, paused: isPaused(session), revision: data.revision, items: visible(session, actor) });
+    if (data.items[index].state === "cancelled" && typeof opts.onItemCancelled === "function") opts.onItemCancelled(copy(data.items[index]));
     return result(true, null, session, actor);
   }
   function edit(session, actor, id, revision, expectedSessionId, message) {
@@ -166,8 +180,9 @@ function createPendingMessageQueue(opts) {
       var validationError = validateMessage(proposed);
       if (validationError) return result(false, validationError, session, actor);
     }
+    if (current && (!session || session.localId !== expectedSessionId || !authorize(session, actor) || revision !== data.revision || current.state !== "pending" || !canMutate(session, actor, current))) return result(false, "Pending message not found", session, actor);
     return mutate(session, actor, id, revision, expectedSessionId, function (items, index) {
-      var nextMessage = Object.assign({}, items[index].message, { text: text });
+      var nextMessage = Object.assign({}, items[index].message, proposed || { text: text });
       if (message && Object.prototype.hasOwnProperty.call(message, "images")) nextMessage.images = sanitizeImages(message.images);
       items[index].message = nextMessage;
     });
@@ -229,6 +244,7 @@ function createPendingMessageQueue(opts) {
     try { persist(); } catch (e) { restore(before); return false; }
     if (session._pendingMessageClaimId === id) delete session._pendingMessageClaimId;
     broadcast(session, { type: ok === "release" ? "pending_message_state" : "pending_message_consumed", sessionId: session.localId, projectSlug: opts.slug, paused: isPaused(session), id: id, state: data.items[index].state, items: ok === "release" ? visible(session, { id: data.items[index].actorId }) : undefined, revision: data.revision });
+    if (ok === true && typeof opts.onItemConsumed === "function") opts.onItemConsumed(copy(data.items[index]));
     return true;
   }
   function consumeOne(session, dispatch) {
@@ -237,6 +253,7 @@ function createPendingMessageQueue(opts) {
     for (var i = 0; i < data.items.length; i++) {
       var item = data.items[i];
       if (!sameTarget(item, session) || item.state !== "pending") continue;
+      if (item.schedule && !item.schedule.ready) continue;
       if (!canMutate(session, { id: item.actorId }, item)) continue;
       var before = copy(data);
       item.state = "claimed";
@@ -258,7 +275,54 @@ function createPendingMessageQueue(opts) {
     for (var i = 0; i < data.items.length; i++) if (data.items[i].id === id && sameTarget(data.items[i], session) && data.items[i].state === "claimed") return true;
     return false;
   }
-  return { admit: admit, edit: edit, cancel: cancel, reorder: reorder, pause: pause, resume: resume, consumeOne: consumeOne, hydrate: hydrate, inspect: inspect, hasActive: hasActive, isClaimed: isClaimed, isPaused: isPaused, list: visible, getRevision: function () { return data.revision; }, getLoadError: function () { return loadError; }, filePath: filePath };
+  function upsertScheduled(session, message, actor, trustedSchedule) {
+    message = copy(message);
+    var schedule = trustedSchedule || message.schedule;
+    delete message.schedule;
+    if (!schedule || typeof schedule.jobId !== "string" || typeof schedule.revision !== "string" || typeof schedule.ready !== "boolean" || !Number.isFinite(Number(schedule.notBefore))) return result(false, "Invalid scheduled queue metadata", session, actor);
+    var validationError = validateMessage(message);
+    if (validationError) return result(false, validationError, session, actor);
+    if (Object.prototype.hasOwnProperty.call(message, "images")) message.images = sanitizeImages(message.images);
+    delete message._pendingConsumed;
+    delete message._scheduledJobId;
+    delete message._scheduledRevision;
+    delete message._scheduledNotBefore;
+    for (var i = 0; i < data.items.length; i++) {
+      if (sameTarget(data.items[i], session) && data.items[i].schedule && data.items[i].schedule.jobId === schedule.jobId && data.items[i].state !== "pending") return result(false, "Scheduled queue item is terminal", session, actor);
+      if (sameTarget(data.items[i], session) && data.items[i].schedule && data.items[i].schedule.jobId === schedule.jobId && data.items[i].state === "pending") {
+        if (!authorize(session, actor) || !canMutate(session, actor, data.items[i])) return result(false, "Not authorized", session, actor);
+        var before = copy(data);
+        data.items[i].message = copy(message);
+        data.items[i].schedule = copy(schedule);
+        data.revision++;
+        try { persist(); } catch (error) { restore(before); return result(false, "Queue storage failed", session, actor); }
+        broadcast(session, { type: "pending_message_state", sessionId: session.localId, projectSlug: opts.slug, paused: isPaused(session), revision: data.revision, items: visible(session, actor) });
+        return { ok: true, item: copy(data.items[i]), revision: data.revision };
+      }
+    }
+    return admitInternal(session, message, actor, schedule);
+  }
+  function cancelScheduled(session, jobId, actor) {
+    for (var i = 0; i < data.items.length; i++) {
+      if (sameTarget(data.items[i], session) && data.items[i].schedule && data.items[i].schedule.jobId === jobId && (data.items[i].state === "pending" || data.items[i].state === "claimed")) return cancel(session, actor, data.items[i].id, data.revision, session.localId);
+    }
+    return false;
+  }
+  function releaseScheduled(session, jobId, revision) {
+    for (var i = 0; i < data.items.length; i++) {
+      var item = data.items[i];
+      if (!sameTarget(item, session) || !item.schedule || item.schedule.jobId !== jobId || item.schedule.revision !== revision) continue;
+      if (item.state !== "pending" || item.schedule.ready) return item.state === "pending" ? copy(item) : null;
+      var before = copy(data);
+      item.schedule.ready = true;
+      data.revision++;
+      try { persist(); } catch (error) { restore(before); return null; }
+      broadcast(session, { type: "pending_message_state", sessionId: session.localId, projectSlug: opts.slug, paused: isPaused(session), revision: data.revision, items: visible(session, { id: item.actorId }) });
+      return copy(item);
+    }
+    return null;
+  }
+  return { admit: admit, upsertScheduled: upsertScheduled, releaseScheduled: releaseScheduled, cancelScheduled: cancelScheduled, edit: edit, cancel: cancel, reorder: reorder, pause: pause, resume: resume, consumeOne: consumeOne, hydrate: hydrate, inspect: inspect, hasActive: hasActive, isClaimed: isClaimed, isPaused: isPaused, list: visible, getRevision: function () { return data.revision; }, getLoadError: function () { return loadError; }, filePath: filePath };
 }
 
 module.exports = { createPendingMessageQueue: createPendingMessageQueue };