velocious 1.0.569 → 1.0.571

package/README.md

@@ -26,6 +26,7 @@
 * Translated model attributes with current-locale relationship sorting (see [docs/translations.md](docs/translations.md))
 * Cross-process broadcast bus for `broadcastToChannel` via `velocious beacon`, including background job runner processes (see [docs/beacon.md](docs/beacon.md))
 * Configurable HTTP server worker handlers plus backpressured, descriptor-only file responses with completion callbacks (see [docs/http-server.md](docs/http-server.md))
+* Default-on buffered HTTP response compression with Brotli/gzip content negotiation, global and per-response opt-outs, and HEAD-correct representation headers (see [docs/http-server.md](docs/http-server.md#response-compression))
 * Background jobs with failure events for production reporting and authorized database-scoped dashboard count snapshots/deltas (see [docs/background-jobs.md](docs/background-jobs.md) and [docs/background-jobs-dashboard.md](docs/background-jobs-dashboard.md))
 * Durable one-off background-job scheduling with exact epoch timestamps (see [docs/scheduled-background-job-enqueue.md](docs/scheduled-background-job-enqueue.md))
 * Rails-style request and database query logging (see [docs/logging.md](docs/logging.md))
@@ -34,7 +35,7 @@
 * In-process driver schema metadata caching (see [docs/schema-metadata-cache.md](docs/schema-metadata-cache.md))
 * Planned local-first shared-resource sync architecture (see [docs/offline-sync.md](docs/offline-sync.md))
 * Selective named database connection checkouts, bounded pool waits, and debugging held connections (see [docs/database-connections.md](docs/database-connections.md))
-* Explicit singular-database operation transactions whose model scopes preserve ownership through records, relationships, lifecycle work, nested savepoints, and commit callbacks (see [docs/operation-scoped-transactions.md](docs/operation-scoped-transactions.md))
+* Explicit singular-database operation transactions whose model scopes preserve ownership through records, relationships, lifecycle work, nested savepoints, pre-commit guards, and commit callbacks (see [docs/operation-scoped-transactions.md](docs/operation-scoped-transactions.md))
 * AbortSignal-driven MySQL/MariaDB query cancellation for raw, model, and cross-tenant aggregate queries (see [docs/database-query-cancellation.md](docs/database-query-cancellation.md))
 * Optional built-in debug endpoint for inspecting server and database connection state (see [docs/debug-endpoint.md](docs/debug-endpoint.md))
 * Optional built-in API manifest endpoint describing every registered frontend-model resource as human- and machine-readable JSON (see [docs/api-manifest-endpoint.md](docs/api-manifest-endpoint.md))
@@ -63,13 +64,23 @@ await configuration.withTransaction({databaseIdentifier: "default", name: "accep
   ticket.setAccepted(true)
   await ticket.save()
 
+  await operation.beforeCommit(async ({operation: guardedOperation}) => {
+    const currentTicket = await guardedOperation
+      .forModel(Ticket)
+      .findByOrFail({id: ticketId})
+
+    if (!currentTicket.acceptanceStillOwnedBy(workerId)) {
+      throw new Error("Ticket acceptance ownership changed")
+    }
+  })
+
   await operation.afterCommit(async () => {
     await publishAcceptedTicket(ticket.id())
   })
 })
 ```
 
-Use operation-bound model scopes and their loaded records throughout the callback. `operation.transaction` adds a nested savepoint, and `operation.connection()` is the deliberate escape hatch for owned raw SQL. Cross-database models, same-identifier tenant switches to another physical database, and operation handles used after the callback are rejected. On shared SQLite/SQL.js pools, unrelated work waits for the operation lease, while admission during an already-open ordinary transaction is rejected. See [operation-scoped transactions](docs/operation-scoped-transactions.md) for pool behavior, after-commit failure semantics, and migration guidance.
+Use operation-bound model scopes and their loaded records throughout the callback. `operation.beforeCommit` runs a final operation-owned guard after callback success but before outer commit or nested savepoint release; a rejection rolls back that frame. `operation.transaction` adds a nested savepoint, and `operation.connection()` is the deliberate escape hatch for owned raw SQL. Cross-database models, same-identifier tenant switches to another physical database, and operation handles used after the callback are rejected. On shared SQLite/SQL.js pools, unrelated work waits for the operation lease, while admission during an already-open ordinary transaction is rejected. See [operation-scoped transactions](docs/operation-scoped-transactions.md) for guard, pool, after-commit failure, and migration semantics.
 
 # Development
 
@@ -83,6 +94,45 @@ npm run test:expo
 
 Maintainers cutting a package release must follow the [Velocious release runbook](docs/releasing.md); `npm run release:patch` commits, pushes, and publishes rather than acting as a local-only version command.
 
+# Docker development environment
+
+The checked-in root `Dockerfile` and `compose.yml` define one canonical `dev` service used by humans, CI, and agent systems alike (see [docs/docker-development-environment.md](docs/docker-development-environment.md)). The image is Ubuntu 26.04 LTS (pinned by digest) with Node.js 24.x from signed NodeSource, the universal apt coding/debugging baseline, and the newest published provider CLIs; it is source-independent — no project source is copied and no project dependencies are installed at image build time.
+
+Prerequisites: Docker with the Compose v2 plugin, and this repository checked out at `$DEV_HOME_PATH/velocious` (default `DEV_HOME_PATH`: `/home/dev`).
+
+First-use setup: copy `.env.example` to the git-ignored `.env` and set `GH_CONFIG_SOURCE_PATH` to an existing host GitHub CLI config directory:
+
+```bash
+cp .env.example .env
+```
+
+`$DEV_HOME_PATH` must be a dedicated development home that already exists, holds no credentials or secrets, and is owned by (or at least writable by) UID/GID 1000 — the in-container `dev` user. Do not point it at a general host home directory, and do not recursively chown an existing home; the external environment owns safe initial provisioning.
+
+Normal usage:
+
+```bash
+docker compose up --build --detach dev
+docker compose exec dev bash
+scripts/docker-run.sh npm ci   # one-off command in a disposable container
+```
+
+The dev service preserves the complete `$DEV_HOME_PATH` bind at `/home/dev`, so dependencies, caches, settings, and `node_modules` persist naturally across runs. Install dependencies with the normal package commands inside the service (for example `docker compose exec dev npm ci`), never at image build time.
+
+Concurrent isolated instances use the standard Compose project-name contract plus a distinct development home per instance:
+
+```bash
+COMPOSE_PROJECT_NAME=velocious-review DEV_HOME_PATH=/srv/dev-homes/review \
+  docker compose up --build --detach dev
+```
+
+GitHub CLI authentication is the sole authorized credential boundary: the host config directory named by `GH_CONFIG_SOURCE_PATH` is mounted read-only at `/home/dev/.config/gh`, with container-side `GH_CONFIG_DIR` pointing there. Do not add SSH keys or other credential mounts. Kimi (and other provider) credentials are intentionally kept out of the tracked Compose files — they are an external operational override layered on by the calling environment. Threadwire is not installed in the image or the project; it remains parent orchestration resolved through unversioned `npx` outside the container.
+
+After changing the Docker artifacts, run the checked-in static contract verifier:
+
+```bash
+npm run verify:docker-dev-environment
+```
+
 # Code quality (fallow)
 
 [fallow](https://github.com/fallow-rs/fallow) analyzes the codebase for unused/dead code, duplication, and complexity. CI runs it as a **regression gate**: it fails only on findings beyond the committed baseline in `fallow-baselines/`, so existing backlog never blocks a PR but new issues do.
@@ -1821,6 +1871,8 @@ this.getConfiguration().getWebsocketEvents().publish(channel, payload)
 this.renderJsonArg({status: "published"})
 ```
 
+Publishes are queued per channel: events on the same channel are persisted and dispatched in FIFO order, while a slow or failing channel never delays unrelated channels. `configuration.awaitPendingBroadcasts()` settles once every broadcast accepted before the call has settled. See [docs/websocket-channels.md](docs/websocket-channels.md#publish-ordering-and-failure-semantics) for the full ordering and failure contract.
+
 ## Websocket channels
 
 You can resolve websocket channel classes from subscribe messages and let them decide which streams to allow:
@@ -2355,6 +2407,8 @@ When the server runs in the `development` environment, Velocious watches applica
 
 Starting the HTTP server creates `tmp/server.lock` under the configured application directory before Beacon, workers, or the TCP listener start. A second server for the same app fails fast with the lock owner details instead of partially starting. Normal shutdown removes the lock; stale locks with a dead local PID are reclaimed automatically, while locks from another host or unreadable metadata should be removed manually only after confirming no server is running. See [docs/http-server.md](docs/http-server.md#server-lock).
 
+Buffered string and `Uint8Array` responses are compressed with Brotli (`br`) or gzip by default whenever request negotiation and response eligibility allow — no opt-in is required. Disable compression globally with `httpServer.compression: false` or `httpServer.compression: {enabled: false}`, and tune it with `threshold`/`brotliQuality`/`gzipLevel` overrides. Negotiation honors `Accept-Encoding` q-values, wildcards, and identity semantics (empty `406` when no acceptable representation exists), merges `Accept-Encoding` into `Vary`, and skips streamed `sendFile` responses, already-encoded or `no-transform` responses, server-sent events, partial/range responses, bodyless statuses, and non-allowlisted content types. Transformation is additionally excluded automatically for credentialed traffic and validator-carrying responses — requests with `Authorization`/`Cookie` and responses with `Set-Cookie`, `ETag`, `Digest`, or `Content-Digest` are never compressed (compression-oracle protection, and validators stay application-owned). Controllers opt out per response with `response.disableCompression()`, and HEAD requests compute GET-equivalent representation headers without emitting a body. See [docs/http-server.md](docs/http-server.md#response-compression).
+
 # Authorization (CanCan-style)
 
 Define resource classes with an `abilities()` method and use `can` / `cannot` rules to constrain model access.

package/build/configuration-types.js

@@ -249,8 +249,25 @@
  * @property {number} [unreachableReportMs] - Grace window (ms) a beacon connect/disconnect blip must persist before it is reported as a framework-error. Transient outages that recover within this window (e.g. a deploy restarting the broker) are not reported. Defaults to 30000.
  */
 
+/**
+ * @typedef {object} HttpCompressionConfiguration
+ * @property {boolean} [enabled] - Whether buffered response compression is enabled. Defaults to true; set false to disable globally.
+ * @property {number} [threshold] - Minimum buffered body size in bytes before compression is applied. Defaults to 1024.
+ * @property {number} [brotliQuality] - Brotli encoder quality (0-11). Defaults to 4.
+ * @property {number} [gzipLevel] - Gzip compression level (0-9). Defaults to 6.
+ */
+
+/**
+ * @typedef {object} NormalizedHttpCompressionConfiguration
+ * @property {boolean} enabled - Whether buffered HTTP response compression is enabled.
+ * @property {number} threshold - Minimum buffered body size in bytes before compression is applied.
+ * @property {number} brotliQuality - Brotli encoder quality (0-11).
+ * @property {number} gzipLevel - Gzip compression level (0-9).
+ */
+
 /**
  * @typedef {object} HttpServerConfiguration
+ * @property {boolean | HttpCompressionConfiguration} [compression] - Buffered response compression. Enabled with documented defaults when absent; false or {enabled: false} disables it globally.
  * @property {string} [host] - Hostname to bind the HTTP server to.
  * @property {boolean} [inProcess] - Run HTTP handlers in the main thread instead of worker threads.
  * @property {number} [maxWorkers] - Backward-compatible alias for workers.

package/build/configuration.js

@@ -120,6 +120,10 @@ const DEFAULT_WEBSOCKET_INBOUND_MAX_PENDING_MESSAGES = 256
 const DEFAULT_WEBSOCKET_OUTBOUND_MAX_PENDING_BYTES = 16 * 1024 * 1024
 const DEFAULT_WEBSOCKET_OUTBOUND_MAX_PENDING_FRAMES = 256
 
+const DEFAULT_COMPRESSION_THRESHOLD = 1024
+const DEFAULT_COMPRESSION_BROTLI_QUALITY = 4
+const DEFAULT_COMPRESSION_GZIP_LEVEL = 6
+
 /**
  * Validates a positive safe integer configuration value.
  * @param {?} value - Configured positive safe integer.
@@ -136,6 +140,63 @@ function positiveSafeInteger(value, name, defaultValue) {
   return value
 }
 
+/**
+ * Validates an integer configuration value inside an inclusive range.
+ * @param {?} value - Configured integer.
+ * @param {string} name - Configuration key.
+ * @param {number} min - Minimum accepted value (inclusive).
+ * @param {number} max - Maximum accepted value (inclusive).
+ * @param {number} defaultValue - Default value.
+ * @returns {number} - Validated configured or default value.
+ */
+function integerInRange(value, name, min, max, defaultValue) {
+  if (value === undefined) return defaultValue
+  if (typeof value !== "number" || !Number.isInteger(value) || value < min || value > max) {
+    throw new TypeError(`${name} must be an integer between ${min} and ${max}`)
+  }
+
+  return value
+}
+
+/**
+ * Normalizes the buffered HTTP response compression configuration. Compression is
+ * enabled by default when the setting is absent; `false` or `{enabled: false}`
+ * disables it globally.
+ * @param {boolean | import("./configuration-types.js").HttpCompressionConfiguration | undefined} value - Configured compression value.
+ * @returns {import("./configuration-types.js").NormalizedHttpCompressionConfiguration} - Normalized compression configuration.
+ */
+function normalizeHttpCompression(value) {
+  if (value === undefined || value === true) {
+    return {enabled: true, threshold: DEFAULT_COMPRESSION_THRESHOLD, brotliQuality: DEFAULT_COMPRESSION_BROTLI_QUALITY, gzipLevel: DEFAULT_COMPRESSION_GZIP_LEVEL}
+  }
+
+  if (value === false) {
+    return {enabled: false, threshold: DEFAULT_COMPRESSION_THRESHOLD, brotliQuality: DEFAULT_COMPRESSION_BROTLI_QUALITY, gzipLevel: DEFAULT_COMPRESSION_GZIP_LEVEL}
+  }
+
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`httpServer.compression must be a boolean or an object, got: ${String(value)}`)
+  }
+
+  const {brotliQuality, enabled, gzipLevel, threshold, ...restCompression} = value
+  const restCompressionKeys = Object.keys(restCompression)
+
+  if (restCompressionKeys.length > 0) {
+    throw new TypeError(`httpServer.compression received unknown keys: ${restCompressionKeys.join(", ")} (supported: brotliQuality, enabled, gzipLevel, threshold)`)
+  }
+
+  if (enabled !== undefined && typeof enabled !== "boolean") {
+    throw new TypeError(`httpServer.compression.enabled must be a boolean, got: ${String(enabled)}`)
+  }
+
+  return {
+    enabled: enabled ?? true,
+    threshold: positiveSafeInteger(threshold, "httpServer.compression.threshold", DEFAULT_COMPRESSION_THRESHOLD),
+    brotliQuality: integerInRange(brotliQuality, "httpServer.compression.brotliQuality", 0, 11, DEFAULT_COMPRESSION_BROTLI_QUALITY),
+    gzipLevel: integerInRange(gzipLevel, "httpServer.compression.gzipLevel", 0, 9, DEFAULT_COMPRESSION_GZIP_LEVEL)
+  }
+}
+
 export default class VelociousConfiguration {
   /**
    * Close database connections promise.
@@ -236,6 +297,7 @@ export default class VelociousConfiguration {
 
     this.httpServer = {
       ...(httpServer || {}),
+      compression: normalizeHttpCompression(httpServer?.compression),
       websocketInboundQueue: {
         maxPendingBytes: positiveSafeInteger(websocketInboundQueue?.maxPendingBytes, "httpServer.websocketInboundQueue.maxPendingBytes", DEFAULT_WEBSOCKET_INBOUND_MAX_PENDING_BYTES),
         maxPendingMessages: positiveSafeInteger(websocketInboundQueue?.maxPendingMessages, "httpServer.websocketInboundQueue.maxPendingMessages", DEFAULT_WEBSOCKET_INBOUND_MAX_PENDING_MESSAGES)
@@ -500,6 +562,14 @@ export default class VelociousConfiguration {
     return this.cors
   }
 
+  /**
+   * Runs get http server compression.
+   * @returns {import("./configuration-types.js").NormalizedHttpCompressionConfiguration} - Normalized buffered response compression configuration.
+   */
+  getHttpServerCompression() {
+    return this.httpServer.compression
+  }
+
   /**
    * Runs get cookie secret.
    * @returns {string | undefined} - Cookie secret.

package/build/database/drivers/base.js

@@ -42,6 +42,12 @@
  * @typedef {Record<string, ?>} QueryRowType
  * @typedef {Array<QueryRowType>} QueryResultType
  */
+/**
+ * TransactionCallbackFrame type.
+ * @typedef {object} TransactionCallbackFrame
+ * @property {Array<() => void | Promise<void>>} afterCommitCallbacks - Callbacks to merge or run after commit.
+ * @property {Array<() => void | Promise<void>>} beforeCommitCallbacks - Guards to run before this frame completes.
+ */
 /**
  * RetryableDatabaseErrorResult type.
  * @typedef {object} RetryableDatabaseErrorResult
@@ -171,8 +177,8 @@ export default class VelociousDatabaseDriversBase {
   idSeq = undefined
   /**
    * Narrows the runtime value to the documented type.
-   * @type {Array<Array<() => void | Promise<void>>>} */
-  _afterCommitCallbackFrames
+   * @type {TransactionCallbackFrame[]} */
+  _transactionCallbackFrames
   /**
    * Narrows the runtime value to the documented type.
    * @type {Map<string, Promise<?>>} */
@@ -207,7 +213,7 @@ export default class VelociousDatabaseDriversBase {
     this.configuration = configuration
     this.mutex = new Mutex() // Can be used to lock this instance for exclusive use
     this.logger = new Logger(this)
-    this._afterCommitCallbackFrames = []
+    this._transactionCallbackFrames = []
     this._transactionsCount = 0
     this._transactionsActionsMutex = new Mutex()
     this._schemaCache = new Map()
@@ -1068,14 +1074,15 @@ export default class VelociousDatabaseDriversBase {
    */
   async _runTransactionAttempt(callback, options) {
     const savePointName = this.generateSavePointName()
-    /**
-     * Callback frame.
-     * @type {Array<() => void | Promise<void>>} */
-    const callbackFrame = []
+    /** @type {TransactionCallbackFrame} */
+    const callbackFrame = {
+      afterCommitCallbacks: [],
+      beforeCommitCallbacks: []
+    }
     let transactionStarted = false
     let savePointStarted = false
 
-    this._afterCommitCallbackFrames.push(callbackFrame)
+    this._transactionCallbackFrames.push(callbackFrame)
 
     try {
       if (this._transactionsCount == 0) {
@@ -1088,7 +1095,7 @@ export default class VelociousDatabaseDriversBase {
         savePointStarted = true
       }
     } catch (error) {
-      this._afterCommitCallbackFrames.pop()
+      this._transactionCallbackFrames.pop()
       throw error
     }
 
@@ -1096,6 +1103,7 @@ export default class VelociousDatabaseDriversBase {
 
     try {
       result = await callback()
+      await this._runBeforeCommitCallbacks(callbackFrame)
 
       if (savePointStarted) {
         this.logger.debug("Release savepoint", savePointName)
@@ -1113,42 +1121,44 @@ export default class VelociousDatabaseDriversBase {
         this.logger.debug("Transaction error", error)
       }
 
-      let transactionRolledBack = false
-
-      if (savePointStarted) {
-        this.logger.debug("Rollback savepoint", savePointName)
-        try {
-          await this.rollbackSavePoint(savePointName, options)
-        } catch (savePointError) {
-          const message = savePointError instanceof Error ? savePointError.message : `${savePointError}`
-
-          // MySQL sometimes drops savepoints unexpectedly; fall back to rolling back the full transaction
-          if (message.includes("SAVEPOINT") || message.includes("ER_SP_DOES_NOT_EXIST")) {
-            this.logger.debug("Savepoint rollback failed; rolling back entire transaction instead")
-            await this.rollbackTransaction(options)
-            transactionRolledBack = true
-          } else {
-            throw savePointError
+      try {
+        let transactionRolledBack = false
+
+        if (savePointStarted) {
+          this.logger.debug("Rollback savepoint", savePointName)
+          try {
+            await this.rollbackSavePoint(savePointName, options)
+          } catch (savePointError) {
+            const message = savePointError instanceof Error ? savePointError.message : `${savePointError}`
+
+            // MySQL sometimes drops savepoints unexpectedly; fall back to rolling back the full transaction
+            if (message.includes("SAVEPOINT") || message.includes("ER_SP_DOES_NOT_EXIST")) {
+              this.logger.debug("Savepoint rollback failed; rolling back entire transaction instead")
+              await this.rollbackTransaction(options)
+              transactionRolledBack = true
+            } else {
+              throw savePointError
+            }
           }
         }
-      }
 
-      // Only roll back if a transaction is still open. A nested savepoint whose rollback failed
-      // falls back to rolling back the whole transaction (above), which already closed it and
-      // dropped the count to 0; rolling back again here would issue a second ROLLBACK and drive
-      // `_transactionsCount` below zero, which would then defeat the outermost deadlock-retry guard.
-      if (transactionStarted && !transactionRolledBack && this._transactionsCount > 0) {
-        this.logger.debug("Rollback transaction")
-        await this.rollbackTransaction(options)
+        // Only roll back if a transaction is still open. A nested savepoint whose rollback failed
+        // falls back to rolling back the whole transaction (above), which already closed it and
+        // dropped the count to 0; rolling back again here would issue a second ROLLBACK and drive
+        // `_transactionsCount` below zero, which would then defeat the outermost deadlock-retry guard.
+        if (transactionStarted && !transactionRolledBack && this._transactionsCount > 0) {
+          this.logger.debug("Rollback transaction")
+          await this.rollbackTransaction(options)
+        }
+      } finally {
+        this._transactionCallbackFrames.pop()
       }
 
-      this._afterCommitCallbackFrames.pop()
-
       throw error
     }
 
     try {
-      await this._commitAfterCommitCallbackFrame()
+      await this._commitTransactionCallbackFrame()
     } catch (error) {
       throw new VelociousDatabaseAfterCommitCallbackError(error)
     }
@@ -1156,6 +1166,23 @@ export default class VelociousDatabaseDriversBase {
     return result
   }
 
+  /**
+   * Registers a guard to run after the current transaction callback succeeds and before its
+   * outer commit or nested savepoint release.
+   * @param {() => void | Promise<void>} callback - Guard callback.
+   * @param {Pick<QueryOptions, "operationOwner">} [options] - Callback ownership.
+   * @returns {Promise<void>} - Resolves when the guard has been registered.
+   */
+  async beforeCommit(callback, options = {}) {
+    await this._waitForOperationLease(options.operationOwner)
+
+    const currentFrame = this._transactionCallbackFrames[this._transactionCallbackFrames.length - 1]
+
+    if (!currentFrame) throw new Error("beforeCommit requires an active transaction")
+
+    currentFrame.beforeCommitCallbacks.push(callback)
+  }
+
   /**
    * Runs a callback after the surrounding transaction commits.
    * If no transaction is active, the callback runs immediately.
@@ -1166,14 +1193,14 @@ export default class VelociousDatabaseDriversBase {
   async afterCommit(callback, options = {}) {
     await this._waitForOperationLease(options.operationOwner)
 
-    const currentFrame = this._afterCommitCallbackFrames[this._afterCommitCallbackFrames.length - 1]
+    const currentFrame = this._transactionCallbackFrames[this._transactionCallbackFrames.length - 1]
 
     if (!currentFrame) {
       await callback()
       return
     }
 
-    currentFrame.push(callback)
+    currentFrame.afterCommitCallbacks.push(callback)
   }
 
   /**
@@ -1240,23 +1267,34 @@ export default class VelociousDatabaseDriversBase {
     await this.query("COMMIT", options)
   }
 
+  /**
+   * Runs every guard registered to the transaction frame.
+   * @param {TransactionCallbackFrame} callbackFrame - Frame whose guards are completing.
+   * @returns {Promise<void>} - Resolves when every guard accepts the commit.
+   */
+  async _runBeforeCommitCallbacks(callbackFrame) {
+    for (const callback of callbackFrame.beforeCommitCallbacks) {
+      await callback()
+    }
+  }
+
   /**
    * Merges committed callbacks into the parent transaction frame or runs them when the outermost commit completes.
    * @returns {Promise<void>} - Resolves when complete.
    */
-  async _commitAfterCommitCallbackFrame() {
-    const committedCallbacks = this._afterCommitCallbackFrames.pop()
+  async _commitTransactionCallbackFrame() {
+    const committedFrame = this._transactionCallbackFrames.pop()
 
-    if (!committedCallbacks || committedCallbacks.length === 0) return
+    if (!committedFrame || committedFrame.afterCommitCallbacks.length === 0) return
 
-    const parentFrame = this._afterCommitCallbackFrames[this._afterCommitCallbackFrames.length - 1]
+    const parentFrame = this._transactionCallbackFrames[this._transactionCallbackFrames.length - 1]
 
     if (parentFrame) {
-      parentFrame.push(...committedCallbacks)
+      parentFrame.afterCommitCallbacks.push(...committedFrame.afterCommitCallbacks)
       return
     }
 
-    for (const callback of committedCallbacks) {
+    for (const callback of committedFrame.afterCommitCallbacks) {
       await callback()
     }
   }

package/build/database/operation-connection.js

@@ -87,6 +87,17 @@ export default class VelociousDatabaseOperationConnection {
     return /** @type {Promise<T>} */ (this._physicalConnection.transaction(callback, {operationOwner: this._owner}))
   }
 
+  /**
+   * Registers an operation-owned before-commit guard.
+   * @param {() => void | Promise<void>} callback - Guard callback.
+   * @returns {Promise<void>} - Resolves after registration.
+   */
+  async beforeCommit(callback) {
+    this._operation.assertActive()
+
+    await this._physicalConnection.beforeCommit(callback, {operationOwner: this._owner})
+  }
+
   /**
    * Registers an operation-owned after-commit callback.
    * @param {() => void | Promise<void>} callback - Callback.

package/build/database/operation.js

@@ -85,6 +85,16 @@ export default class VelociousDatabaseOperation {
     await this.connection().afterCommit(callback)
   }
 
+  /**
+   * Registers a guard owned by the current transaction/savepoint frame.
+   * @param {(context: {operation: VelociousDatabaseOperation}) => void | Promise<void>} callback - Guard callback.
+   * @returns {Promise<void>} - Resolves after registration.
+   */
+  async beforeCommit(callback) {
+    this.assertActive()
+    await this.connection().beforeCommit(() => callback({operation: this}))
+  }
+
   /**
    * Runs a nested operation transaction/savepoint.
    * @template T

package/build/http-server/client/index.js

@@ -8,6 +8,7 @@ import EventEmitter from "../../utils/event-emitter.js"
 import Logger from "../../logger.js"
 import Request from "./request.js"
 import RequestRunner from "./request-runner.js"
+import {applyResponseCompression} from "./response-compression.js"
 import WebsocketSession from "./websocket-session.js"
 
 /**
@@ -38,6 +39,16 @@ export default class VeoliciousHttpServerClient {
   events = new EventEmitter()
   state = "initial"
 
+  /**
+   * Whether a done-requests drain is currently sending responses for this client.
+   * @type {boolean} */
+  _doneRequestsDrainActive = false
+
+  /**
+   * Whether another drain was requested while one was already active.
+   * @type {boolean} */
+  _doneRequestsDrainPending = false
+
   /**
    * Runs constructor.
    * @param {object} args - Options object.
@@ -311,12 +322,38 @@ export default class VeoliciousHttpServerClient {
 
   requestDone = () => {
     this.logger.debug(() => ["requestDone", {clientCount: this.clientCount, queueLength: this.requestRunners.length}])
-    void this.sendDoneRequests().catch((error) => {
+
+    return this._drainDoneRequests().catch((error) => {
       this.logger.warn("Failed while sending done requests", error)
       this.events.emit("close")
     })
   }
 
+  /**
+   * Drains done requests one at a time. A runner is shifted out of the queue before
+   * its response finishes sending (async compression, file transfer), so an
+   * overlapping drain would otherwise pick up the next runner and reorder pipelined
+   * socket writes. Calls that arrive while a drain is active are folded into it.
+   * @returns {Promise<void>} - Resolves when every done response has been sent.
+   */
+  async _drainDoneRequests() {
+    if (this._doneRequestsDrainActive) {
+      this._doneRequestsDrainPending = true
+      return
+    }
+
+    this._doneRequestsDrainActive = true
+
+    try {
+      do {
+        this._doneRequestsDrainPending = false
+        await this.sendDoneRequests()
+      } while (this._doneRequestsDrainPending)
+    } finally {
+      this._doneRequestsDrainActive = false
+    }
+  }
+
   async sendDoneRequests() {
     while (true) {
       const requestRunner = this.requestRunners[0]
@@ -393,6 +430,14 @@ export default class VeoliciousHttpServerClient {
     // arrive — drop the body entirely for those codes.
     const isBodylessStatus = isNoBodyStatusCode(response.getStatusCode())
 
+    // HEAD responses select and compute the exact same representation headers as the
+    // equivalent GET (including Content-Length and any negotiated Content-Encoding),
+    // but no buffered or file body is emitted below.
+    const isHeadRequest = request.httpMethod() == "HEAD"
+
+    /** @type {string | Uint8Array | null} */
+    let bodyToEmit = body
+
     if (!isBodylessStatus) {
       let contentLength
 
@@ -400,9 +445,34 @@ export default class VeoliciousHttpServerClient {
         const stats = await fs.stat(filePath)
         contentLength = stats.size
       } else {
-        contentLength = bodyIsString ? Buffer.byteLength(body, "utf8") : body.byteLength
+        // String bodies are UTF-8 framed, so the buffered bytes are the UTF-8 encoding;
+        // Uint8Array bodies are already the exact wire bytes.
+        const bodyBuffer = bodyIsString ? Buffer.from(body, "utf8") : Buffer.from(body)
+        const compressionResult = await applyResponseCompression({
+          bodyBuffer,
+          compression: this.configuration.getHttpServerCompression(),
+          request,
+          response
+        })
+
+        if (compressionResult.outcome == "not-acceptable") {
+          // The client forbids identity and no supported coding is acceptable: answer
+          // with an empty 406 instead of an unacceptable representation.
+          response.setStatus(406)
+          response.setBody("")
+          bodyToEmit = ""
+          contentLength = 0
+        } else if (compressionResult.outcome == "compressed") {
+          bodyToEmit = compressionResult.body
+          contentLength = compressionResult.body.length
+        } else {
+          contentLength = bodyBuffer.length
+        }
       }
 
+      // Remove any application pre-set Content-Length (any casing) so exactly one
+      // recomputed value goes on the wire.
+      response.removeHeader("Content-Length")
       response.setHeader("Content-Length", contentLength)
     }
 
@@ -427,11 +497,14 @@ export default class VeoliciousHttpServerClient {
     if (isBodylessStatus) {
       this.logger.debug(() => ["sendResponse body suppressed for no-body status", {clientCount: this.clientCount, statusCode: response.getStatusCode()}])
       if (hasFilePath) await this.sendFileOutput(filePath, false, fileOnFinished)
+    } else if (isHeadRequest) {
+      this.logger.debug(() => ["sendResponse body suppressed for HEAD request", {clientCount: this.clientCount}])
+      if (hasFilePath) await this.sendFileOutput(filePath, false, fileOnFinished)
     } else if (hasFilePath) {
       await this.sendFileOutput(filePath, true, fileOnFinished)
     } else {
-      this.events.emit("output", body)
-      this.logger.debug(() => ["sendResponse body emitted", {clientCount: this.clientCount, bodyLength: bodyIsString ? body.length : body.byteLength}])
+      this.events.emit("output", bodyToEmit)
+      this.logger.debug(() => ["sendResponse body emitted", {clientCount: this.clientCount, bodyLength: bodyToEmit ? bodyToEmit.length : 0}])
     }
 
     await requestRunner.logCompletedRequest()