@alneas/eaos-server 0.0.0-stage → 0.1.0

package/dist/chunk-6KV5CJBW.js

@@ -0,0 +1,221 @@
+import {
+  createAuthMiddleware
+} from "./chunk-XIEY2OF4.js";
+import {
+  createErrorHandler
+} from "./chunk-AVDMLTPF.js";
+import {
+  createModuleGuard
+} from "./chunk-VC2PCK2S.js";
+import {
+  createHealthRouter
+} from "./chunk-R4ADP2DC.js";
+import {
+  createLifecycleGuard,
+  resolveLifecycleBackend
+} from "./chunk-L6PMAEMB.js";
+import {
+  createMcpRouter
+} from "./chunk-VF5YDZJC.js";
+import {
+  createPluginEntitlementGuard,
+  resolveEngineEntitlementPrincipal
+} from "./chunk-46UWPEW2.js";
+
+// src/engine.ts
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { PluginRegistry } from "@alneas/eaos-core";
+import { McpGatekeeper } from "@alneas/eaos-core";
+import { SecretResolver } from "@alneas/eaos-core";
+function defineConfig(config) {
+  return config;
+}
+var ErpEngine = class {
+  /** Public plugin registry populated during initialize; external mutation affects subsequently composed apps. */
+  registry = new PluginRegistry();
+  /** Shared MCP policy registry populated from plugin manifests during initialize. */
+  gatekeeper = new McpGatekeeper();
+  initialized = false;
+  config;
+  /**
+   * Retains host composition configuration for registration and future app creation.
+   * @param config - App label, plugin manifests, and optional host composition settings.
+   */
+  constructor(config) {
+    this.config = config;
+  }
+  /**
+   * Registers manifests and gatekeeper policies and validates declared plugin secrets by default.
+   * @returns No value; resolves after registration and validation, or immediately after a prior successful initialization.
+   * @throws Rejects duplicate plugin IDs, registry failures, or secret validation failures.
+   * @remarks Registration occurs before secret validation, so failure can leave partial registry state. Concurrent initialization is not serialized and retrying a failed initialization may encounter already-registered IDs. Create a new engine after correcting failed setup. No migrations or plugin activation are performed.
+   * @example
+   * ```typescript
+   * import { createErpEngine } from "@alneas/eaos-server/engine";
+   * const engine = createErpEngine({ appName: "example-service", plugins: [] });
+   * await engine.initialize();
+   * console.log(engine.getRegisteredPlugins().length); // 0
+   * ```
+   */
+  async initialize() {
+    if (this.initialized) return;
+    console.log(`[ErpEngine] Initializing ${this.config.appName}...`);
+    for (const manifest of this.config.plugins) {
+      if (this.registry.get(manifest.id)) throw new Error(`Duplicate plugin: ${manifest.id}`);
+      this.registry.register(manifest);
+      if (manifest.agentCapabilities?.gatekeeperPolicies) {
+        for (const [toolName, policy] of Object.entries(
+          manifest.agentCapabilities.gatekeeperPolicies
+        )) {
+          this.gatekeeper.registerPolicy(toolName, policy);
+        }
+      }
+      if (this.config.validateSecrets !== false && manifest.secrets && manifest.secrets.length > 0) {
+        await SecretResolver.validatePluginSecrets(manifest.id, manifest.secrets);
+      }
+    }
+    this.initialized = true;
+    console.log(
+      `[ErpEngine] Successfully loaded ${this.registry.getAll().length} plugins.`
+    );
+  }
+  /**
+   * Composes registered plugin routes, shared middleware, optional MCP/custom routes, and public health endpoints.
+   * @param options - Live host adapters and route settings; see {@link CreateAppOptions}.
+   * @returns A new Hono app sharing this engine registry, gatekeeper, and configured adapters; it does not start a server.
+   * @throws Before initialization, or for synchronous middleware, plugin route factory, or health setup failures. Request-time adapter errors pass through the app error handler.
+   * @remarks Module guarding defaults on. Lifecycle enforcement is installed only when supplied, while declared plugin entitlements require their corresponding runtime checks. CORS uses configured origins with credentials enabled; unknown origins receive the first configured allow-origin value. Repeated calls create separate routers but may reuse host dependencies.
+   * @example
+   * ```typescript
+   * import { createErpEngine } from "@alneas/eaos-server/engine";
+   * const engine = createErpEngine({ appName: "example-service", plugins: [] });
+   * await engine.initialize();
+   * const app = engine.createApp();
+   * console.log((await app.request("/health/live")).status);
+   * ```
+   */
+  createApp(options) {
+    if (!this.initialized) throw new Error("Call initialize() before createApp()");
+    const app = new Hono();
+    app.onError(createErrorHandler());
+    if (this.config.cors?.allowOrigins && this.config.cors.allowOrigins.length > 0) {
+      const allowed = this.config.cors.allowOrigins;
+      app.use(
+        "*",
+        cors({
+          origin: (origin) => allowed.includes(origin) ? origin : allowed[0],
+          allowMethods: ["POST", "GET", "PUT", "PATCH", "DELETE", "OPTIONS"],
+          credentials: true
+        })
+      );
+    }
+    const verifier = options?.verifier || this.config.auth?.verifier;
+    if (verifier) {
+      app.use("*", createAuthMiddleware({ verifier, skipPaths: this.config.auth?.skipPaths }));
+    }
+    if (this.config.middleware) {
+      for (const mw of this.config.middleware) {
+        mw(app);
+      }
+    }
+    for (const plugin of this.registry.getAll()) {
+      if (plugin.entitlement?.allowedTenants) {
+        const conceal = async (c, next) => {
+          const principal = await (options?.resolveEntitlementPrincipal ?? resolveEngineEntitlementPrincipal)(c);
+          if (!principal) return c.json({ error: "Unauthorized" }, 401);
+          if (!plugin.entitlement.allowedTenants.includes(principal.tenantId)) return c.json({ error: "Plugin unavailable" }, 404);
+          await next();
+        };
+        app.use(`${plugin.api.prefix}/*`, conceal);
+      }
+      if (options?.lifecycle) {
+        const guard = createLifecycleGuard(options.lifecycle, plugin.id);
+        app.use(plugin.api.prefix, guard);
+        app.use(`${plugin.api.prefix}/*`, guard);
+      }
+      if (options?.enableModuleGuard !== false) {
+        const guard = options?.requireModule ? options.requireModule(plugin.id) : createModuleGuard(plugin.id);
+        app.use(`${plugin.api.prefix}/*`, guard);
+        if (plugin.extensions) {
+          for (const ext of plugin.extensions) {
+            const requiredKey = ext.industry ? `industry_${ext.industry}` : ext.id;
+            const extGuard = options?.requireModule ? options.requireModule(requiredKey) : createModuleGuard(requiredKey);
+            app.use(`${plugin.api.prefix}/${ext.id}/*`, extGuard);
+          }
+        }
+      }
+      if (plugin.entitlement) {
+        const guard = createPluginEntitlementGuard(plugin.id, plugin.entitlement, options?.entitlements, options?.resolveEntitlementPrincipal);
+        app.use(`${plugin.api.prefix}/*`, guard);
+      }
+      if (plugin.createRoutes) {
+        app.route(plugin.api.prefix, plugin.createRoutes(options?.pluginOptions?.[plugin.id]));
+      }
+    }
+    if (options?.mcp) app.route(options.mcp.prefix ?? "/api/mcp", createMcpRouter(this, {
+      ...options.mcp,
+      entitlements: options.entitlements ?? options.mcp.entitlements,
+      isPluginEnabled: async (principal, id) => (!options.lifecycle || await options.lifecycle.lifecycle.isEnabled(await resolveLifecycleBackend(options.lifecycle, principal.tenantId), principal.tenantId, id)) && (!options.mcp?.isPluginEnabled || await options.mcp.isPluginEnabled(principal, id))
+    }));
+    if (options?.customRoutes) {
+      for (const { prefix, router } of options.customRoutes) {
+        app.route(prefix, router);
+      }
+    }
+    app.route("/", createHealthRouter({ appName: this.config.appName, ...options?.health }));
+    return app;
+  }
+  /**
+   * Reads the manifests currently registered in this engine.
+   * @returns Registry manifest list, empty before registration or with no configured plugins; objects are not deep-cloned by this method.
+   * @example
+   * ```typescript
+   * import { createErpEngine } from "@alneas/eaos-server/engine";
+   * const engine = createErpEngine({ appName: "example-service", plugins: [] });
+   * await engine.initialize();
+   * console.log(engine.getRegisteredPlugins()); // []
+   * ```
+   */
+  getRegisteredPlugins() {
+    return this.registry.getAll();
+  }
+  /**
+   * Collects MCP tool definitions from all currently registered manifests.
+   * @returns Registry tool definitions, or an empty array when none exist; this list is not filtered for a request principal or tenant.
+   * @example
+   * ```typescript
+   * import { createErpEngine } from "@alneas/eaos-server/engine";
+   * const engine = createErpEngine({ appName: "example-service", plugins: [] });
+   * await engine.initialize();
+   * console.log(engine.getAllMcpTools()); // []
+   * ```
+   */
+  getAllMcpTools() {
+    return this.registry.getAllMcpTools();
+  }
+  /**
+   * Reads the host configuration retained at construction.
+   * @returns The original mutable configuration object; no cloning occurs.
+   * @example
+   * ```typescript
+   * import { createErpEngine } from "@alneas/eaos-server/engine";
+   * const engine = createErpEngine({ appName: "example-service", plugins: [] });
+   * await engine.initialize();
+   * console.log(engine.getConfig().appName);
+   * ```
+   */
+  getConfig() {
+    return this.config;
+  }
+};
+function createErpEngine(config) {
+  return new ErpEngine(config);
+}
+
+export {
+  defineConfig,
+  ErpEngine,
+  createErpEngine
+};
+//# sourceMappingURL=chunk-6KV5CJBW.js.map

package/dist/chunk-6KV5CJBW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/engine.ts"],"sourcesContent":["import { resolveLifecycleBackend, createLifecycleGuard, type LifecycleRuntime } from './lifecycle/index'\nimport { createMcpRouter, type McpRouterOptions } from './mcp'\nimport { Hono } from 'hono'\nimport { cors } from 'hono/cors'\nimport { PluginRegistry } from '@alneas/eaos-core'\nimport { McpGatekeeper } from '@alneas/eaos-core'\nimport { SecretResolver } from '@alneas/eaos-core'\nimport { createModuleGuard } from './middleware/module-guard'\nimport { createAuthMiddleware, type AuthSessionVerifier } from './middleware/auth'\nimport { createErrorHandler } from './middleware/error-handler'\nimport type { PluginManifest } from '@alneas/eaos-core'\nimport type { EaosEnv } from '@alneas/eaos-core'\nimport { createHealthRouter, type HealthRouterOptions } from './health/index'\nimport { createPluginEntitlementGuard, resolveEngineEntitlementPrincipal, type PluginEntitlementRuntime, type EntitlementPrincipalResolver } from './entitlements/index'\n\n// ---------- Config 型 ----------\n\n/**\n * Engine composition settings retained by {@link ErpEngine}; host adapters own authentication and persistence.\n */\nexport interface EaosConfig {\n  /** Nonblank application label used by public health responses. */\n  appName: string\n  /** Trusted plugin manifests registered sequentially during initialize. */\n  plugins: PluginManifest[]\n  /** Optional host UI theme metadata retained in config; the server engine does not apply it. */\n  theme?: {\n    /** Optional host UI accent color; not interpreted by this engine. */\n    primaryColor?: string\n    /** Optional host UI logo URL; not fetched by this engine. */\n    logoUrl?: string\n  }\n  /** Optional host driver metadata retained in config; this engine does not create a database connection. */\n  database?: {\n    /** Selected host database dialect; does not create or migrate a connection. */\n    driver: 'oracle' | 'supabase' | 'postgres'\n  }\n  /** Optional exact browser allowOrigins list; empty/absent disables CORS middleware. */\n  cors?: {\n    /** Exact allowed browser origins; credentials are enabled for configured CORS. */\n    allowOrigins: string[]\n  }\n  /** Optional verifier and skipped path prefixes; see AuthMiddlewareOptions. */\n  auth?: {\n    /** Optional verified session/API-key adapter; omission installs no authentication. */\n    verifier?: AuthSessionVerifier\n    /** Authentication-exempt path prefixes; defaults follow createAuthMiddleware. */\n    skipPaths?: string[]\n  }\n  /** Validate each manifest's declared secrets unless exactly false. Defaults to true. */\n  validateSecrets?: boolean\n  /** Host composition callbacks invoked synchronously after shared authentication and before plugin route guards; each receives the app and returns no value. */\n  middleware?: Array<(app: Hono<EaosEnv>) => void>\n}\n\n/**\n * Returns an engine configuration unchanged while checking its TypeScript shape.\n * @param config - Configuration to retain; no runtime validation or cloning occurs.\n * @returns The same object reference.\n * @example\n * ```typescript\n * import { defineConfig } from \"@alneas/eaos-server/engine\";\n * const config = defineConfig({ appName: \"example-service\", plugins: [] });\n * console.log(config.appName);\n * ```\n */\nexport function defineConfig(config: EaosConfig): EaosConfig {\n  return config\n}\n\n// ---------- Engine ----------\n\n/**\n * Per-application host authorization, route, and health adapters for {@link ErpEngine.createApp}.\n */\nexport interface CreateAppOptions {\n  /** Optional shared runtime for declared commercial/usage entitlement admission. */\n  entitlements?: PluginEntitlementRuntime\n  /** Optional verified principal resolver; defaults to resolveEngineEntitlementPrincipal. */\n  resolveEntitlementPrincipal?: EntitlementPrincipalResolver\n  /** Optional current lifecycle/tenant/backend admission for plugin routes and MCP tools. */\n  lifecycle?: LifecycleRuntime\n  /** Optional module middleware factory called at composition for each plugin/extension requirement; defaults to createModuleGuard. */\n  requireModule?: (moduleId: string) => any\n  /** Optional authentication verifier overriding config.auth.verifier. */\n  verifier?: AuthSessionVerifier\n  /** Install module guards unless exactly false. Defaults to true. */\n  enableModuleGuard?: boolean\n  /** Per-plugin dependencies passed to the route factory. */\n  pluginOptions?: Record<string, unknown>\n  /** Optional MCP adapter configuration; prefix defaults to /api/mcp and shared entitlements take precedence. */\n  mcp?: McpRouterOptions & { \n  /**\n   * Optional mount path for the shared MCP router; defaults to /api/mcp when the engine composes routes.\n   */\n  prefix?: string }\n  /** Additional host routers mounted after plugin/MCP routes; no plugin-specific guard is automatically added. */\n  customRoutes?: Array<{\n    /** Host-selected mount prefix passed directly to Hono route composition; this entry receives no automatic plugin/module-specific guard. */\n    prefix: string\n    /** Trusted Hono child router; host composition must install its route-specific authorization before exposing handlers. */\n    router: Hono<any>\n  }>\n  /** Optional dependency readiness checks and clock; engine appName is supplied automatically. */\n  health?: Omit<HealthRouterOptions, 'appName'>\n}\n\n/**\n * Registers plugin manifests and composes Hono routes with host authentication, entitlement, and lifecycle adapters.\n * @remarks Constructing the engine creates no HTTP listener or persistent store. Initialize once before composing apps. Configuration is retained by reference. Authentication is installed only when a verifier is supplied; custom routes need their own authorization policies beyond the shared middleware.\n * @example\n * ```typescript\n * import { createErpEngine } from \"@alneas/eaos-server/engine\";\n * const engine = createErpEngine({ appName: \"example-service\", plugins: [] });\n * await engine.initialize();\n * const app = engine.createApp();\n * console.log((await app.request(\"/health/live\")).status); // 200\n * ```\n */\nexport class ErpEngine {\n  /** Public plugin registry populated during initialize; external mutation affects subsequently composed apps. */\n  readonly registry = new PluginRegistry()\n  /** Shared MCP policy registry populated from plugin manifests during initialize. */\n  readonly gatekeeper = new McpGatekeeper()\n  private initialized = false\n  private config: EaosConfig\n\n  /**\n   * Retains host composition configuration for registration and future app creation.\n   * @param config - App label, plugin manifests, and optional host composition settings.\n   */\n  constructor(config: EaosConfig) {\n    this.config = config\n  }\n\n  /**\n   * Registers manifests and gatekeeper policies and validates declared plugin secrets by default.\n   * @returns No value; resolves after registration and validation, or immediately after a prior successful initialization.\n   * @throws Rejects duplicate plugin IDs, registry failures, or secret validation failures.\n   * @remarks Registration occurs before secret validation, so failure can leave partial registry state. Concurrent initialization is not serialized and retrying a failed initialization may encounter already-registered IDs. Create a new engine after correcting failed setup. No migrations or plugin activation are performed.\n   * @example\n   * ```typescript\n   * import { createErpEngine } from \"@alneas/eaos-server/engine\";\n   * const engine = createErpEngine({ appName: \"example-service\", plugins: [] });\n   * await engine.initialize();\n   * console.log(engine.getRegisteredPlugins().length); // 0\n   * ```\n   */\n  async initialize(): Promise<void> {\n    if (this.initialized) return\n    console.log(`[ErpEngine] Initializing ${this.config.appName}...`)\n\n    for (const manifest of this.config.plugins) {\n      if (this.registry.get(manifest.id)) throw new Error(`Duplicate plugin: ${manifest.id}`)\n      this.registry.register(manifest)\n\n      if (manifest.agentCapabilities?.gatekeeperPolicies) {\n        for (const [toolName, policy] of Object.entries(\n          manifest.agentCapabilities.gatekeeperPolicies\n        )) {\n          this.gatekeeper.registerPolicy(toolName, policy)\n        }\n      }\n\n      if (\n        this.config.validateSecrets !== false &&\n        manifest.secrets &&\n        manifest.secrets.length > 0\n      ) {\n        await SecretResolver.validatePluginSecrets(manifest.id, manifest.secrets)\n      }\n    }\n\n    this.initialized = true\n    console.log(\n      `[ErpEngine] Successfully loaded ${this.registry.getAll().length} plugins.`\n    )\n  }\n\n  /**\n   * Composes registered plugin routes, shared middleware, optional MCP/custom routes, and public health endpoints.\n   * @param options - Live host adapters and route settings; see {@link CreateAppOptions}.\n   * @returns A new Hono app sharing this engine registry, gatekeeper, and configured adapters; it does not start a server.\n   * @throws Before initialization, or for synchronous middleware, plugin route factory, or health setup failures. Request-time adapter errors pass through the app error handler.\n   * @remarks Module guarding defaults on. Lifecycle enforcement is installed only when supplied, while declared plugin entitlements require their corresponding runtime checks. CORS uses configured origins with credentials enabled; unknown origins receive the first configured allow-origin value. Repeated calls create separate routers but may reuse host dependencies.\n   * @example\n   * ```typescript\n   * import { createErpEngine } from \"@alneas/eaos-server/engine\";\n   * const engine = createErpEngine({ appName: \"example-service\", plugins: [] });\n   * await engine.initialize();\n   * const app = engine.createApp();\n   * console.log((await app.request(\"/health/live\")).status);\n   * ```\n   */\n  createApp(options?: CreateAppOptions): Hono<EaosEnv> {\n    if (!this.initialized) throw new Error(\"Call initialize() before createApp()\")\n    const app = new Hono<EaosEnv>()\n\n    // 1. エラーハンドラ登録\n    app.onError(createErrorHandler())\n\n    // 2. CORS\n    if (this.config.cors?.allowOrigins && this.config.cors.allowOrigins.length > 0) {\n      const allowed = this.config.cors.allowOrigins\n      app.use(\n        '*',\n        cors({\n          origin: (origin) =>\n            allowed.includes(origin) ? origin : allowed[0],\n          allowMethods: ['POST', 'GET', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],\n          credentials: true,\n        })\n      )\n    }\n\n    // 3. 認証ミドルウェア (Ory Kratos / API Key / Bearer)\n    const verifier = options?.verifier || this.config.auth?.verifier\n    if (verifier) {\n      app.use('*', createAuthMiddleware({ verifier, skipPaths: this.config.auth?.skipPaths }))\n    }\n\n    // 4. Config 層から注入された独自ミドルウェア\n    if (this.config.middleware) {\n      for (const mw of this.config.middleware) {\n        mw(app)\n      }\n    }\n\n    // 5. Plugin 層のルートを動的マウント & ライセンス認可ガード (requireModule)\n    for (const plugin of this.registry.getAll()) {\n      if (plugin.entitlement?.allowedTenants) {\n        const conceal = async (c: any, next: () => Promise<void>) => {\n          const principal = await (options?.resolveEntitlementPrincipal ?? resolveEngineEntitlementPrincipal)(c)\n          if (!principal) return c.json({ error: 'Unauthorized' }, 401)\n          if (!plugin.entitlement!.allowedTenants!.includes(principal.tenantId)) return c.json({ error: 'Plugin unavailable' }, 404)\n          await next()\n        }\n        app.use(`${plugin.api.prefix}/*`, conceal)\n      }\n      if (options?.lifecycle) {\n        const guard = createLifecycleGuard(options.lifecycle, plugin.id)\n        app.use(plugin.api.prefix, guard)\n        app.use(`${plugin.api.prefix}/*`, guard)\n      }\n      if (options?.enableModuleGuard !== false) {\n        const guard = options?.requireModule ? options.requireModule(plugin.id) : createModuleGuard(plugin.id)\n        app.use(`${plugin.api.prefix}/*`, guard)\n\n        if (plugin.extensions) {\n          for (const ext of plugin.extensions) {\n            const requiredKey = ext.industry ? `industry_${ext.industry}` : ext.id\n            const extGuard = options?.requireModule ? options.requireModule(requiredKey) : createModuleGuard(requiredKey)\n            app.use(`${plugin.api.prefix}/${ext.id}/*`, extGuard)\n          }\n        }\n      }\n\n      if (plugin.entitlement) {\n        const guard = createPluginEntitlementGuard(plugin.id, plugin.entitlement, options?.entitlements, options?.resolveEntitlementPrincipal)\n        app.use(`${plugin.api.prefix}/*`, guard)\n      }\n      if (plugin.createRoutes) {\n        app.route(plugin.api.prefix, plugin.createRoutes(options?.pluginOptions?.[plugin.id]))\n      }\n    }\n\n    if (options?.mcp) app.route(options.mcp.prefix ?? '/api/mcp', createMcpRouter(this, {\n      ...options.mcp,\n      entitlements: options.entitlements ?? options.mcp.entitlements,\n      isPluginEnabled: async (principal, id) =>\n        (!options.lifecycle || await options.lifecycle.lifecycle.isEnabled(await resolveLifecycleBackend(options.lifecycle, principal.tenantId), principal.tenantId, id)) &&\n        (!options.mcp?.isPluginEnabled || await options.mcp.isPluginEnabled(principal, id)),\n    }))\n\n    // 6. カスタムルートのマウント\n    if (options?.customRoutes) {\n      for (const { prefix, router } of options.customRoutes) {\n        app.route(prefix, router)\n      }\n    }\n\n    // 7. Liveness/readiness. Dependency checks are explicit host adapters.\n    app.route('/', createHealthRouter({ appName: this.config.appName, ...options?.health }))\n\n    return app\n  }\n\n  /**\n   * Reads the manifests currently registered in this engine.\n   * @returns Registry manifest list, empty before registration or with no configured plugins; objects are not deep-cloned by this method.\n   * @example\n   * ```typescript\n   * import { createErpEngine } from \"@alneas/eaos-server/engine\";\n   * const engine = createErpEngine({ appName: \"example-service\", plugins: [] });\n   * await engine.initialize();\n   * console.log(engine.getRegisteredPlugins()); // []\n   * ```\n   */\n  getRegisteredPlugins(): PluginManifest[] {\n    return this.registry.getAll()\n  }\n\n  /**\n   * Collects MCP tool definitions from all currently registered manifests.\n   * @returns Registry tool definitions, or an empty array when none exist; this list is not filtered for a request principal or tenant.\n   * @example\n   * ```typescript\n   * import { createErpEngine } from \"@alneas/eaos-server/engine\";\n   * const engine = createErpEngine({ appName: \"example-service\", plugins: [] });\n   * await engine.initialize();\n   * console.log(engine.getAllMcpTools()); // []\n   * ```\n   */\n  getAllMcpTools() {\n    return this.registry.getAllMcpTools()\n  }\n\n  /**\n   * Reads the host configuration retained at construction.\n   * @returns The original mutable configuration object; no cloning occurs.\n   * @example\n   * ```typescript\n   * import { createErpEngine } from \"@alneas/eaos-server/engine\";\n   * const engine = createErpEngine({ appName: \"example-service\", plugins: [] });\n   * await engine.initialize();\n   * console.log(engine.getConfig().appName);\n   * ```\n   */\n  getConfig(): EaosConfig {\n    return this.config\n  }\n}\n\n/**\n * Creates an uninitialized engine retaining the supplied host configuration.\n * @param config - Engine composition settings; see {@link EaosConfig}.\n * @returns A new engine; await initialize before createApp.\n * @example\n * ```typescript\n * import { createErpEngine } from \"@alneas/eaos-server/engine\";\n * const engine = createErpEngine({ appName: \"example-service\", plugins: [] });\n * await engine.initialize();\n * const app = engine.createApp();\n * console.log((await app.request(\"/health/live\")).status);\n * ```\n */\nexport function createErpEngine(config: EaosConfig): ErpEngine {\n  return new ErpEngine(config)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAEA,SAAS,YAAY;AACrB,SAAS,YAAY;AACrB,SAAS,sBAAsB;AAC/B,SAAS,qBAAqB;AAC9B,SAAS,sBAAsB;AA4DxB,SAAS,aAAa,QAAgC;AAC3D,SAAO;AACT;AAmDO,IAAM,YAAN,MAAgB;AAAA;AAAA,EAEZ,WAAW,IAAI,eAAe;AAAA;AAAA,EAE9B,aAAa,IAAI,cAAc;AAAA,EAChC,cAAc;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMR,YAAY,QAAoB;AAC9B,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,aAA4B;AAChC,QAAI,KAAK,YAAa;AACtB,YAAQ,IAAI,4BAA4B,KAAK,OAAO,OAAO,KAAK;AAEhE,eAAW,YAAY,KAAK,OAAO,SAAS;AAC1C,UAAI,KAAK,SAAS,IAAI,SAAS,EAAE,EAAG,OAAM,IAAI,MAAM,qBAAqB,SAAS,EAAE,EAAE;AACtF,WAAK,SAAS,SAAS,QAAQ;AAE/B,UAAI,SAAS,mBAAmB,oBAAoB;AAClD,mBAAW,CAAC,UAAU,MAAM,KAAK,OAAO;AAAA,UACtC,SAAS,kBAAkB;AAAA,QAC7B,GAAG;AACD,eAAK,WAAW,eAAe,UAAU,MAAM;AAAA,QACjD;AAAA,MACF;AAEA,UACE,KAAK,OAAO,oBAAoB,SAChC,SAAS,WACT,SAAS,QAAQ,SAAS,GAC1B;AACA,cAAM,eAAe,sBAAsB,SAAS,IAAI,SAAS,OAAO;AAAA,MAC1E;AAAA,IACF;AAEA,SAAK,cAAc;AACnB,YAAQ;AAAA,MACN,mCAAmC,KAAK,SAAS,OAAO,EAAE,MAAM;AAAA,IAClE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,UAAU,SAA2C;AACnD,QAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM,sCAAsC;AAC7E,UAAM,MAAM,IAAI,KAAc;AAG9B,QAAI,QAAQ,mBAAmB,CAAC;AAGhC,QAAI,KAAK,OAAO,MAAM,gBAAgB,KAAK,OAAO,KAAK,aAAa,SAAS,GAAG;AAC9E,YAAM,UAAU,KAAK,OAAO,KAAK;AACjC,UAAI;AAAA,QACF;AAAA,QACA,KAAK;AAAA,UACH,QAAQ,CAAC,WACP,QAAQ,SAAS,MAAM,IAAI,SAAS,QAAQ,CAAC;AAAA,UAC/C,cAAc,CAAC,QAAQ,OAAO,OAAO,SAAS,UAAU,SAAS;AAAA,UACjE,aAAa;AAAA,QACf,CAAC;AAAA,MACH;AAAA,IACF;AAGA,UAAM,WAAW,SAAS,YAAY,KAAK,OAAO,MAAM;AACxD,QAAI,UAAU;AACZ,UAAI,IAAI,KAAK,qBAAqB,EAAE,UAAU,WAAW,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC;AAAA,IACzF;AAGA,QAAI,KAAK,OAAO,YAAY;AAC1B,iBAAW,MAAM,KAAK,OAAO,YAAY;AACvC,WAAG,GAAG;AAAA,MACR;AAAA,IACF;AAGA,eAAW,UAAU,KAAK,SAAS,OAAO,GAAG;AAC3C,UAAI,OAAO,aAAa,gBAAgB;AACtC,cAAM,UAAU,OAAO,GAAQ,SAA8B;AAC3D,gBAAM,YAAY,OAAO,SAAS,+BAA+B,mCAAmC,CAAC;AACrG,cAAI,CAAC,UAAW,QAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAC5D,cAAI,CAAC,OAAO,YAAa,eAAgB,SAAS,UAAU,QAAQ,EAAG,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;AACzH,gBAAM,KAAK;AAAA,QACb;AACA,YAAI,IAAI,GAAG,OAAO,IAAI,MAAM,MAAM,OAAO;AAAA,MAC3C;AACA,UAAI,SAAS,WAAW;AACtB,cAAM,QAAQ,qBAAqB,QAAQ,WAAW,OAAO,EAAE;AAC/D,YAAI,IAAI,OAAO,IAAI,QAAQ,KAAK;AAChC,YAAI,IAAI,GAAG,OAAO,IAAI,MAAM,MAAM,KAAK;AAAA,MACzC;AACA,UAAI,SAAS,sBAAsB,OAAO;AACxC,cAAM,QAAQ,SAAS,gBAAgB,QAAQ,cAAc,OAAO,EAAE,IAAI,kBAAkB,OAAO,EAAE;AACrG,YAAI,IAAI,GAAG,OAAO,IAAI,MAAM,MAAM,KAAK;AAEvC,YAAI,OAAO,YAAY;AACrB,qBAAW,OAAO,OAAO,YAAY;AACnC,kBAAM,cAAc,IAAI,WAAW,YAAY,IAAI,QAAQ,KAAK,IAAI;AACpE,kBAAM,WAAW,SAAS,gBAAgB,QAAQ,cAAc,WAAW,IAAI,kBAAkB,WAAW;AAC5G,gBAAI,IAAI,GAAG,OAAO,IAAI,MAAM,IAAI,IAAI,EAAE,MAAM,QAAQ;AAAA,UACtD;AAAA,QACF;AAAA,MACF;AAEA,UAAI,OAAO,aAAa;AACtB,cAAM,QAAQ,6BAA6B,OAAO,IAAI,OAAO,aAAa,SAAS,cAAc,SAAS,2BAA2B;AACrI,YAAI,IAAI,GAAG,OAAO,IAAI,MAAM,MAAM,KAAK;AAAA,MACzC;AACA,UAAI,OAAO,cAAc;AACvB,YAAI,MAAM,OAAO,IAAI,QAAQ,OAAO,aAAa,SAAS,gBAAgB,OAAO,EAAE,CAAC,CAAC;AAAA,MACvF;AAAA,IACF;AAEA,QAAI,SAAS,IAAK,KAAI,MAAM,QAAQ,IAAI,UAAU,YAAY,gBAAgB,MAAM;AAAA,MAClF,GAAG,QAAQ;AAAA,MACX,cAAc,QAAQ,gBAAgB,QAAQ,IAAI;AAAA,MAClD,iBAAiB,OAAO,WAAW,QAChC,CAAC,QAAQ,aAAa,MAAM,QAAQ,UAAU,UAAU,UAAU,MAAM,wBAAwB,QAAQ,WAAW,UAAU,QAAQ,GAAG,UAAU,UAAU,EAAE,OAC9J,CAAC,QAAQ,KAAK,mBAAmB,MAAM,QAAQ,IAAI,gBAAgB,WAAW,EAAE;AAAA,IACrF,CAAC,CAAC;AAGF,QAAI,SAAS,cAAc;AACzB,iBAAW,EAAE,QAAQ,OAAO,KAAK,QAAQ,cAAc;AACrD,YAAI,MAAM,QAAQ,MAAM;AAAA,MAC1B;AAAA,IACF;AAGA,QAAI,MAAM,KAAK,mBAAmB,EAAE,SAAS,KAAK,OAAO,SAAS,GAAG,SAAS,OAAO,CAAC,CAAC;AAEvF,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,uBAAyC;AACvC,WAAO,KAAK,SAAS,OAAO;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,iBAAiB;AACf,WAAO,KAAK,SAAS,eAAe;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,YAAwB;AACtB,WAAO,KAAK;AAAA,EACd;AACF;AAeO,SAAS,gBAAgB,QAA+B;AAC7D,SAAO,IAAI,UAAU,MAAM;AAC7B;","names":[]}

package/dist/chunk-6XZXYNJR.js

@@ -0,0 +1,74 @@
+// src/agentic/agent-runner.ts
+import {
+  parseWorkflowAgentProposal
+} from "@alneas/eaos-core";
+function createWorkflowAgentRunner(options) {
+  if (typeof options?.executor !== "function") throw new Error("Workflow agent executor is required");
+  return {
+    async run(request) {
+      const startedAt = Date.now();
+      const task = {
+        id: request.taskId,
+        tenantId: request.tenantId,
+        userId: request.userId,
+        title: request.purpose,
+        workerType: "custom",
+        ...request.jobKind === void 0 ? {} : { jobKind: request.jobKind },
+        instructions: JSON.stringify({
+          schemaVersion: "1.0",
+          purpose: request.purpose,
+          input: request.input,
+          toolScope: request.toolScope,
+          output: "Return only a JSON WorkflowAgentProposal with schemaVersion 1.0."
+        }),
+        executionContext: {
+          workflowId: request.workflowId,
+          correlationId: request.correlationId,
+          idempotencyKey: request.idempotencyKey,
+          toolMode: request.toolScope.mode,
+          allowedToolNames: request.toolScope.allowedToolNames
+        },
+        timeoutMs: request.timeoutMs
+      };
+      let rawOutput;
+      try {
+        rawOutput = await options.executor(task);
+      } catch (error) {
+        const failureCode = isAgentFailureCode(error) ? error.failureCode : "RUNTIME_FAILED";
+        const retryable = isAgentRetryable(error) ?? (failureCode === "AGENT_UNAVAILABLE" || failureCode === "TIMEOUT" || failureCode === "RUNTIME_FAILED");
+        return {
+          status: failureCode === "AGENT_UNAVAILABLE" ? "UNAVAILABLE" : "FAILED",
+          error: error instanceof Error ? error.message : "Workflow agent execution failed",
+          failureCode,
+          retryable,
+          ...options.runtimeId ? { runtimeId: options.runtimeId } : {},
+          durationMs: Date.now() - startedAt
+        };
+      }
+      try {
+        const proposal = parseWorkflowAgentProposal(rawOutput);
+        return { status: "COMPLETED", proposal, ...options.runtimeId ? { runtimeId: options.runtimeId } : {}, durationMs: Date.now() - startedAt };
+      } catch (error) {
+        return {
+          status: "FAILED",
+          error: error instanceof Error ? error.message : "Invalid workflow agent proposal",
+          failureCode: "INVALID_PROPOSAL",
+          retryable: false,
+          ...options.runtimeId ? { runtimeId: options.runtimeId } : {},
+          durationMs: Date.now() - startedAt
+        };
+      }
+    }
+  };
+}
+function isAgentFailureCode(error) {
+  return typeof error === "object" && error !== null && "failureCode" in error && typeof error.failureCode === "string";
+}
+function isAgentRetryable(error) {
+  return typeof error === "object" && error !== null && "retryable" in error && typeof error.retryable === "boolean" ? error.retryable : void 0;
+}
+
+export {
+  createWorkflowAgentRunner
+};
+//# sourceMappingURL=chunk-6XZXYNJR.js.map

package/dist/chunk-6XZXYNJR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/agentic/agent-runner.ts"],"sourcesContent":["import {\n  parseWorkflowAgentProposal,\n  type WorkflowAgentRequest,\n  type WorkflowAgentRunResult,\n  type WorkflowAgentRunner,\n} from '@alneas/eaos-core'\nimport type { ServerAgentExecutor, ServerAgentTaskRequest } from './types'\n\n/**\n * Host executor configuration for {@link createWorkflowAgentRunner}.\n */\nexport interface ServerWorkflowAgentRunnerOptions {\n  /** Host-owned executor. It may be backed by Goose, Hermes or another runtime. */\n  executor: ServerAgentExecutor\n  /** Optional host runtime label copied into every normalized run result. */\n  runtimeId?: string\n}\n\n/**\n * Bridges the host/server executor contract to the vendor-neutral workflow\n * runner contract. The executor output is parsed as a proposal; it is never\n * treated as an instruction to perform a side effect.\n * @param options - Host-owned executor and optional runtime label.\n * @returns A runner whose generic run method accepts a WorkflowAgentRequest and resolves a parsed proposal or a failure result. Executor errors become FAILED/UNAVAILABLE data; parse errors become nonretryable INVALID_PROPOSAL data.\n * @throws Synchronously when executor is missing. run may reject before execution when request serialization fails.\n * @remarks The runner forwards workflow/correlation/idempotency/tool context but does not independently authorize, retry, deduplicate, execute tools, or enforce timeouts. Those boundaries belong to the host executor. Runtime text must parse as a version 1.0 proposal; domain-specific output still needs plugin validation.\n * @example\n * ```typescript\n * import { createWorkflowAgentRunner } from \"@alneas/eaos-server/agentic/agent-runner\";\n * import type { ServerAgentExecutor } from \"@alneas/eaos-server/agentic/types\";\n * export function workflowRunner(executor: ServerAgentExecutor) {\n *   return createWorkflowAgentRunner({ executor, runtimeId: \"host-runtime\" });\n * }\n * ```\n */\nexport function createWorkflowAgentRunner(options: ServerWorkflowAgentRunnerOptions): WorkflowAgentRunner {\n  if (typeof options?.executor !== 'function') throw new Error('Workflow agent executor is required')\n\n  return {\n    async run<TOutput>(request: WorkflowAgentRequest): Promise<WorkflowAgentRunResult<TOutput>> {\n      const startedAt = Date.now()\n      const task: ServerAgentTaskRequest = {\n        id: request.taskId,\n        tenantId: request.tenantId,\n        userId: request.userId,\n        title: request.purpose,\n        workerType: 'custom',\n        ...(request.jobKind === undefined ? {} : { jobKind: request.jobKind }),\n        instructions: JSON.stringify({\n          schemaVersion: '1.0',\n          purpose: request.purpose,\n          input: request.input,\n          toolScope: request.toolScope,\n          output: 'Return only a JSON WorkflowAgentProposal with schemaVersion 1.0.',\n        }),\n        executionContext: {\n          workflowId: request.workflowId,\n          correlationId: request.correlationId,\n          idempotencyKey: request.idempotencyKey,\n          toolMode: request.toolScope.mode,\n          allowedToolNames: request.toolScope.allowedToolNames,\n        },\n        timeoutMs: request.timeoutMs,\n      }\n\n      let rawOutput: string\n      try {\n        rawOutput = await options.executor(task)\n      } catch (error) {\n        const failureCode = isAgentFailureCode(error) ? error.failureCode : 'RUNTIME_FAILED'\n        const retryable = isAgentRetryable(error) ?? (failureCode === 'AGENT_UNAVAILABLE' || failureCode === 'TIMEOUT' || failureCode === 'RUNTIME_FAILED')\n        return {\n          status: failureCode === 'AGENT_UNAVAILABLE' ? 'UNAVAILABLE' : 'FAILED',\n          error: error instanceof Error ? error.message : 'Workflow agent execution failed',\n          failureCode,\n          retryable,\n          ...(options.runtimeId ? { runtimeId: options.runtimeId } : {}),\n          durationMs: Date.now() - startedAt,\n        }\n      }\n\n      try {\n        const proposal = parseWorkflowAgentProposal<TOutput>(rawOutput)\n        return { status: 'COMPLETED', proposal, ...(options.runtimeId ? { runtimeId: options.runtimeId } : {}), durationMs: Date.now() - startedAt }\n      } catch (error) {\n        return {\n          status: 'FAILED',\n          error: error instanceof Error ? error.message : 'Invalid workflow agent proposal',\n          failureCode: 'INVALID_PROPOSAL',\n          retryable: false,\n          ...(options.runtimeId ? { runtimeId: options.runtimeId } : {}),\n          durationMs: Date.now() - startedAt,\n        }\n      }\n    },\n  }\n}\n\nfunction isAgentFailureCode(error: unknown): error is { failureCode: NonNullable<WorkflowAgentRunResult['failureCode']> } {\n  return typeof error === 'object' && error !== null && 'failureCode' in error && typeof error.failureCode === 'string'\n}\n\nfunction isAgentRetryable(error: unknown): boolean | undefined {\n  return typeof error === 'object' && error !== null && 'retryable' in error && typeof error.retryable === 'boolean'\n    ? error.retryable\n    : undefined\n}\n"],"mappings":";AAAA;AAAA,EACE;AAAA,OAIK;AA8BA,SAAS,0BAA0B,SAAgE;AACxG,MAAI,OAAO,SAAS,aAAa,WAAY,OAAM,IAAI,MAAM,qCAAqC;AAElG,SAAO;AAAA,IACL,MAAM,IAAa,SAAyE;AAC1F,YAAM,YAAY,KAAK,IAAI;AAC3B,YAAM,OAA+B;AAAA,QACnC,IAAI,QAAQ;AAAA,QACZ,UAAU,QAAQ;AAAA,QAClB,QAAQ,QAAQ;AAAA,QAChB,OAAO,QAAQ;AAAA,QACf,YAAY;AAAA,QACZ,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,QACpE,cAAc,KAAK,UAAU;AAAA,UAC3B,eAAe;AAAA,UACf,SAAS,QAAQ;AAAA,UACjB,OAAO,QAAQ;AAAA,UACf,WAAW,QAAQ;AAAA,UACnB,QAAQ;AAAA,QACV,CAAC;AAAA,QACD,kBAAkB;AAAA,UAChB,YAAY,QAAQ;AAAA,UACpB,eAAe,QAAQ;AAAA,UACvB,gBAAgB,QAAQ;AAAA,UACxB,UAAU,QAAQ,UAAU;AAAA,UAC5B,kBAAkB,QAAQ,UAAU;AAAA,QACtC;AAAA,QACA,WAAW,QAAQ;AAAA,MACrB;AAEA,UAAI;AACJ,UAAI;AACF,oBAAY,MAAM,QAAQ,SAAS,IAAI;AAAA,MACzC,SAAS,OAAO;AACd,cAAM,cAAc,mBAAmB,KAAK,IAAI,MAAM,cAAc;AACpE,cAAM,YAAY,iBAAiB,KAAK,MAAM,gBAAgB,uBAAuB,gBAAgB,aAAa,gBAAgB;AAClI,eAAO;AAAA,UACL,QAAQ,gBAAgB,sBAAsB,gBAAgB;AAAA,UAC9D,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,UAChD;AAAA,UACA;AAAA,UACA,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,UAC5D,YAAY,KAAK,IAAI,IAAI;AAAA,QAC3B;AAAA,MACF;AAEA,UAAI;AACF,cAAM,WAAW,2BAAoC,SAAS;AAC9D,eAAO,EAAE,QAAQ,aAAa,UAAU,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC,GAAI,YAAY,KAAK,IAAI,IAAI,UAAU;AAAA,MAC7I,SAAS,OAAO;AACd,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,UAChD,aAAa;AAAA,UACb,WAAW;AAAA,UACX,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,UAC5D,YAAY,KAAK,IAAI,IAAI;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAA8F;AACxH,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,iBAAiB,SAAS,OAAO,MAAM,gBAAgB;AAC/G;AAEA,SAAS,iBAAiB,OAAqC;AAC7D,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,eAAe,SAAS,OAAO,MAAM,cAAc,YACrG,MAAM,YACN;AACN;","names":[]}

package/dist/chunk-753HWDSC.js

@@ -0,0 +1,222 @@
+// src/platform-admin/index.ts
+import { Hono } from "hono";
+import { assertBackendMigrationCutover, planBackendMigration } from "@alneas/eaos-server/lifecycle-engine";
+function object(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Request body must be an object");
+  return value;
+}
+function string(value, name, max = 256) {
+  if (typeof value !== "string" || !value.trim() || value.length > max) throw new Error(`Invalid ${name}`);
+  return value;
+}
+function stringArray(value, name, max = 128) {
+  if (!Array.isArray(value) || value.length === 0 || value.length > max || value.some((item) => typeof item !== "string" || !item.trim())) throw new Error(`Invalid ${name}`);
+  return [...value];
+}
+async function body(c) {
+  return object(await c.req.json().catch(() => null));
+}
+function publicBackend(backend) {
+  return {
+    id: backend.id,
+    databaseId: backend.databaseId,
+    dialect: backend.dialect,
+    mode: backend.mode,
+    ...backend.tenantId === void 0 ? {} : { tenantId: backend.tenantId },
+    ...backend.label === void 0 ? {} : { label: backend.label },
+    ...backend.provider === void 0 ? {} : { provider: backend.provider },
+    ...backend.capabilities === void 0 ? {} : { capabilities: backend.capabilities }
+  };
+}
+function createPlatformAdminRouter(options) {
+  if (!options?.store || !options.resolvePrincipal || !options.authorize || !options.audit) throw new Error("Platform admin router dependencies are required");
+  const app = new Hono();
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const access = async (request, action, tenantId) => {
+    const principal = await options.resolvePrincipal(request);
+    if (!principal) return new Response(JSON.stringify({ error: "Authentication required" }), { status: 401, headers: { "content-type": "application/json" } });
+    const allowed = principal.isPlatformAdmin === true && await options.authorize(principal, action, tenantId);
+    if (!allowed) {
+      await options.audit({ action, actorId: principal.userId, ...tenantId ? { tenantId } : {}, outcome: "denied", occurredAt: now().toISOString() });
+      return new Response(JSON.stringify({ error: "Platform administrator access required" }), { status: 403, headers: { "content-type": "application/json" } });
+    }
+    return { principal };
+  };
+  const failure = (error, status = 400) => new Response(JSON.stringify({ error: error instanceof Error ? error.message : "Request failed" }), { status, headers: { "content-type": "application/json" } });
+  app.get("/tenants", async (c) => {
+    const authorized = await access(c.req.raw, "tenant:list");
+    if (authorized instanceof Response) return authorized;
+    return c.json({ tenants: await options.store.listTenants() });
+  });
+  app.post("/tenants", async (c) => {
+    const authorized = await access(c.req.raw, "tenant:create");
+    if (authorized instanceof Response) return authorized;
+    try {
+      const input = await body(c);
+      const tenant = await options.store.createTenant({ id: string(input.id, "tenant id"), name: string(input.name, "tenant name"), domains: stringArray(input.domains, "domains"), backendId: string(input.backendId, "initial backend id") });
+      await options.audit({ action: "tenant:create", actorId: authorized.principal.userId, tenantId: tenant.id, outcome: "allowed", occurredAt: now().toISOString() });
+      return c.json({ tenant }, 201);
+    } catch (error) {
+      return failure(error);
+    }
+  });
+  app.patch("/tenants/:tenantId", async (c) => {
+    const tenantId = string(c.req.param("tenantId"), "tenant id");
+    const authorized = await access(c.req.raw, "tenant:update", tenantId);
+    if (authorized instanceof Response) return authorized;
+    try {
+      const input = await body(c);
+      const patch = {
+        ...input.name === void 0 ? {} : { name: string(input.name, "tenant name") },
+        ...input.active === void 0 ? {} : { active: input.active === true },
+        ...input.domains === void 0 ? {} : { domains: stringArray(input.domains, "domains") }
+      };
+      if (!Object.keys(patch).length) throw new Error("Tenant patch is empty");
+      const tenant = await options.store.updateTenant(tenantId, patch);
+      await options.audit({ action: "tenant:update", actorId: authorized.principal.userId, tenantId, outcome: "allowed", occurredAt: now().toISOString() });
+      return c.json({ tenant });
+    } catch (error) {
+      return failure(error);
+    }
+  });
+  app.get("/backends", async (c) => {
+    const authorized = await access(c.req.raw, "backend:list");
+    if (authorized instanceof Response) return authorized;
+    return c.json({ backends: (await options.store.listBackends()).map(publicBackend) });
+  });
+  app.get("/tenants/:tenantId/placement", async (c) => {
+    const tenantId = string(c.req.param("tenantId"), "tenant id");
+    const authorized = await access(c.req.raw, "placement:read", tenantId);
+    if (authorized instanceof Response) return authorized;
+    const placement = await options.store.getTenantPlacement(tenantId);
+    if (!placement) return failure(new Error("Tenant placement not found"), 404);
+    return c.json({ placement: { ...placement, backend: publicBackend(placement.backend) } });
+  });
+  app.post("/tenants/:tenantId/placement/plan", async (c) => {
+    const tenantId = string(c.req.param("tenantId"), "tenant id");
+    const authorized = await access(c.req.raw, "placement:plan", tenantId);
+    if (authorized instanceof Response) return authorized;
+    try {
+      const input = await body(c);
+      const targetBackendId = string(input.targetBackendId, "target backend id");
+      const pluginIds = stringArray(input.pluginIds, "pluginIds");
+      const reason = string(input.reason, "migration reason", 1024);
+      const current = await options.store.getTenantPlacement(tenantId);
+      if (!current) return failure(new Error("Tenant placement not found"), 404);
+      const target = await options.store.getBackend(targetBackendId);
+      if (!target) return failure(new Error("Target backend not found"), 404);
+      const plan = planBackendMigration({
+        migrationId: `platform-${crypto.randomUUID()}`,
+        source: current.backend,
+        target,
+        scope: { kind: "tenants", tenantIds: [tenantId] },
+        pluginIds,
+        requestedAt: now().toISOString(),
+        reason
+      });
+      await options.store.saveMigrationPlan(plan);
+      await options.audit({ action: "placement:plan", actorId: authorized.principal.userId, tenantId, sourceBackendId: plan.request.source.id, targetBackendId: plan.request.target.id, migrationId: plan.id, outcome: "allowed", occurredAt: now().toISOString() });
+      return c.json({ plan }, 201);
+    } catch (error) {
+      return failure(error);
+    }
+  });
+  app.post("/tenants/:tenantId/placement/execute", async (c) => {
+    const tenantId = string(c.req.param("tenantId"), "tenant id");
+    const authorized = await access(c.req.raw, "placement:cutover", tenantId);
+    if (authorized instanceof Response) return authorized;
+    if (!options.placementExecutor) return failure(new Error("Placement execution is not configured"), 501);
+    let migrationId = "";
+    let executionId = "";
+    try {
+      const input = await body(c);
+      migrationId = string(input.migrationId, "migration id");
+      executionId = string(input.executionId, "execution id");
+      const plan = await options.store.getMigrationPlan(migrationId);
+      if (!plan) return failure(new Error("Migration plan not found"), 404);
+      if (plan.request.scope.kind !== "tenants" || !plan.request.scope.tenantIds.includes(tenantId)) return failure(new Error("Migration plan tenant mismatch"), 409);
+      const previous = await options.store.getMigrationStatus(migrationId);
+      const current = await options.store.getTenantPlacement(tenantId);
+      if (previous?.status === "cutover") return c.json({ status: previous.status, cutover: previous.cutover, placement: current ? { ...current, backend: publicBackend(current.backend) } : null });
+      if (!current || current.backend.id !== plan.request.source.id || current.backend.databaseId !== plan.request.source.databaseId) return failure(new Error("Migration plan is stale"), 409);
+      const previousStatus = previous?.status;
+      const previousExecutionId = previous?.executionId;
+      const record = await options.store.beginMigrationExecution({ tenantId, migrationId, executionId });
+      if (record.status === "cutover") return c.json({ status: record.status, cutover: record.cutover, placement: { ...current, backend: publicBackend(current.backend) } });
+      if (previousStatus === "running" && previousExecutionId === executionId) return c.json({ status: "running", migrationId }, 202);
+      if (record.status === "running") {
+        const result = await options.placementExecutor.execute(plan);
+        const cutover2 = assertBackendMigrationCutover(plan, result.verification, result.cutover);
+        await options.store.recordMigrationVerification({ tenantId, plan, executionId, verification: result.verification, cutover: cutover2 });
+      } else if (record.status !== "verified" || !record.cutover) {
+        return failure(new Error("Migration is not executable"), 409);
+      }
+      const verified = await options.store.getMigrationStatus(migrationId);
+      if (!verified?.cutover) return failure(new Error("Migration verification is missing"), 409);
+      const cutover = verified.cutover;
+      const placement = await options.store.recordTenantPlacement({ tenantId, plan, cutover });
+      await options.audit({ action: "placement:cutover", actorId: authorized.principal.userId, tenantId, sourceBackendId: plan.request.source.id, targetBackendId: plan.request.target.id, migrationId: plan.id, outcome: "allowed", occurredAt: now().toISOString() });
+      return c.json({ cutover, placement: { ...placement, backend: publicBackend(placement.backend) } });
+    } catch (error) {
+      if (migrationId) await options.store.markMigrationFailure({ migrationId, executionId: executionId || void 0, status: "reconciling", message: error instanceof Error ? error.message : "Migration execution failed" }).catch(() => void 0);
+      return failure(error, 409);
+    }
+  });
+  app.get("/tenants/:tenantId/placement/migrations/:migrationId", async (c) => {
+    const tenantId = string(c.req.param("tenantId"), "tenant id");
+    const migrationId = string(c.req.param("migrationId"), "migration id");
+    const authorized = await access(c.req.raw, "placement:read", tenantId);
+    if (authorized instanceof Response) return authorized;
+    const plan = await options.store.getMigrationPlan(migrationId);
+    const migration = await options.store.getMigrationStatus(migrationId);
+    if (!plan || !migration) return failure(new Error("Migration not found"), 404);
+    if (plan.request.scope.kind !== "tenants" || !plan.request.scope.tenantIds.includes(tenantId)) return failure(new Error("Migration plan tenant mismatch"), 409);
+    return c.json({ migration: { ...migration, plan } });
+  });
+  app.post("/tenants/:tenantId/placement/rollback", async (c) => {
+    const tenantId = string(c.req.param("tenantId"), "tenant id");
+    const authorized = await access(c.req.raw, "placement:rollback", tenantId);
+    if (authorized instanceof Response) return authorized;
+    try {
+      const input = await body(c);
+      const migrationId = string(input.migrationId, "migration id");
+      const reason = string(input.reason, "rollback reason", 1024);
+      const plan = await options.store.createRollbackPlan({ tenantId, migrationId, reason, requestedAt: now().toISOString() });
+      await options.audit({ action: "placement:rollback", actorId: authorized.principal.userId, tenantId, sourceBackendId: plan.request.source.id, targetBackendId: plan.request.target.id, migrationId: plan.id, outcome: "allowed", occurredAt: now().toISOString() });
+      return c.json({ plan }, 201);
+    } catch (error) {
+      return failure(error, 409);
+    }
+  });
+  app.post("/tenants/:tenantId/placement/reconcile", async (c) => {
+    const tenantId = string(c.req.param("tenantId"), "tenant id");
+    const authorized = await access(c.req.raw, "placement:reconcile", tenantId);
+    if (authorized instanceof Response) return authorized;
+    try {
+      const input = await body(c);
+      const migrationId = string(input.migrationId, "migration id");
+      const action = string(input.action, "reconciliation action");
+      const note = string(input.note, "reconciliation note", 2048);
+      const plan = await options.store.getMigrationPlan(migrationId);
+      if (!plan || plan.request.scope.kind !== "tenants" || !plan.request.scope.tenantIds.includes(tenantId)) return failure(new Error("Migration plan not found"), 404);
+      if (action === "commit-verified") {
+        const migration2 = await options.store.getMigrationStatus(migrationId);
+        if (!migration2?.verification || !migration2.cutover) return failure(new Error("Verified migration data is missing"), 409);
+        const placement = await options.store.recordTenantPlacement({ tenantId, plan, cutover: migration2.cutover });
+        await options.audit({ action: "placement:reconcile", actorId: authorized.principal.userId, tenantId, sourceBackendId: plan.request.source.id, targetBackendId: plan.request.target.id, migrationId: plan.id, outcome: "allowed", occurredAt: now().toISOString() });
+        return c.json({ migration: await options.store.getMigrationStatus(migrationId), placement: { ...placement, backend: publicBackend(placement.backend) } });
+      }
+      const migration = await options.store.reconcileMigration({ migrationId, action, note });
+      await options.audit({ action: "placement:reconcile", actorId: authorized.principal.userId, tenantId, sourceBackendId: plan.request.source.id, targetBackendId: plan.request.target.id, migrationId: plan.id, outcome: "allowed", occurredAt: now().toISOString() });
+      return c.json({ migration });
+    } catch (error) {
+      return failure(error, 409);
+    }
+  });
+  return app;
+}
+
+export {
+  createPlatformAdminRouter
+};
+//# sourceMappingURL=chunk-753HWDSC.js.map