fix(objectql): thread transaction through beforeUpdate/beforeDelete hooks

Prior to this fix, calling engine.update or engine.delete inside an
engine.transaction() block would deadlock for ~60s on SQLite (knex
pool=1) before completing. Root cause: the built-in
sys_fetch_previous_update / sys_fetch_previous_delete hooks and the
audit captureBefore hook both issue a findOne to snapshot the row,
but neither carries the active transaction through. On a single-
connection driver this read waits the full acquireConnectionTimeout
for a fresh connection that never comes (the outer transaction owns
the only one), then eventually proceeds when the trx commits.

Concrete impact: convertLead (4 ops in a single transaction) took
60.1s end-to-end even though the actual SQL took <50ms.

Fix:
  * sys_fetch_previous_update / delete hooks (packages/objectql/
    src/plugin.ts) now pass context.isSystem + the open trx when
    hookCtx.transaction is set.
  * Audit captureBefore (packages/plugins/plugin-audit/src/audit-
    writers.ts) now prefers ctx.ql.findOne with isSystem + trx and
    only falls back to api.sudo() when no engine ref is available.

Verified: 3 sequential convertLead calls now complete in 77ms-116ms
(was 60.1s each). All 232 objectql tests, 55 plugin-security tests,
and 215 metadata tests still pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: hotlong

packages/objectql/src/plugin.ts

@@ -400,7 +400,13 @@ export class ObjectQLPlugin implements Plugin {
           if (hookCtx.input?.id && !hookCtx.previous) {
             try {
               const existing = await this.ql!.findOne(hookCtx.object, {
-                where: { id: hookCtx.input.id }
+                where: { id: hookCtx.input.id },
+                context: {
+                  roles: [],
+                  permissions: [],
+                  isSystem: true,
+                  ...(hookCtx.transaction ? { transaction: hookCtx.transaction } : {}),
+                } as any,
               });
               if (existing) hookCtx.previous = existing;
             } catch (_e) {
@@ -419,7 +425,13 @@ export class ObjectQLPlugin implements Plugin {
           if (hookCtx.input?.id && !hookCtx.previous) {
             try {
               const existing = await this.ql!.findOne(hookCtx.object, {
-                where: { id: hookCtx.input.id }
+                where: { id: hookCtx.input.id },
+                context: {
+                  roles: [],
+                  permissions: [],
+                  isSystem: true,
+                  ...(hookCtx.transaction ? { transaction: hookCtx.transaction } : {}),
+                } as any,
               });
               if (existing) hookCtx.previous = existing;
             } catch (_e) {

packages/objectql/src/protocol.ts

@@ -1101,7 +1101,6 @@ export class ObjectStackProtocolImplementation implements ObjectStackProtocol {
         const runConversion = async (trxCtx: any) => {
             const opCtx = trxCtx ?? ctx;
             const trxCtxOpt = opCtx !== undefined ? { context: opCtx } : undefined;
-            console.log('[convertLead] entered runConversion, trx present:', !!opCtx?.transaction);
 
             // 1) Account
             let account: any;
@@ -1125,7 +1124,6 @@ export class ObjectStackProtocolImplementation implements ObjectStackProtocol {
                 if (lead.address)         accountPayload.billing_address = lead.address;
                 if (lead.owner)           accountPayload.owner = lead.owner;
                 account = await this.engine.insert('account', accountPayload, trxCtxOpt as any);
-                console.log('[convertLead] account inserted');
             }
 
             // 2) Contact
@@ -1152,7 +1150,6 @@ export class ObjectStackProtocolImplementation implements ObjectStackProtocol {
                 if (lead.owner)      contactPayload.owner = lead.owner;
                 if (account?.id)     contactPayload.account = account.id;
                 contact = await this.engine.insert('contact', contactPayload, trxCtxOpt as any);
-                console.log('[convertLead] contact inserted');
             }
 
             // 3) Opportunity (optional)

packages/plugins/plugin-audit/src/audit-writers.ts

@@ -120,9 +120,25 @@ export function installAuditWriters(engine: any, packageId = 'com.objectstack.au
     if (SKIP_OBJECTS.has(ctx.object)) return;
     const id = (ctx.input as any)?.id;
     if (!id) return; // bulk update/delete — too costly to snapshot every row here
-    const api: any = (ctx as any).api;
-    if (!api?.sudo) return;
     try {
+      // Use the engine directly (not api.sudo) so we can thread the
+      // active transaction through. On drivers with single-connection
+      // pools (e.g. SQLite via knex) a sudo() findOne that does NOT
+      // carry the open transaction will deadlock for the full
+      // acquireConnectionTimeout (~60s) because the outer transaction
+      // holds the only connection.
+      const trx = (ctx as any).transaction;
+      const ql = (ctx as any).ql ?? (ctx as any).api?.engine;
+      if (ql?.findOne) {
+        const prev = await ql.findOne(ctx.object, {
+          where: { id },
+          context: { isSystem: true, ...(trx ? { transaction: trx } : {}) },
+        });
+        if (prev) (ctx as any).__previous = prev;
+        return;
+      }
+      const api: any = (ctx as any).api;
+      if (!api?.sudo) return;
       const prev = await api.sudo().object(ctx.object).findOne({ where: { id } });
       if (prev) (ctx as any).__previous = prev;
     } catch {