@alneas/eaos-server 0.0.0-stage → 0.1.0

package/dist/chunk-XUP6CNOM.js

@@ -0,0 +1,34 @@
+// src/browser-auth/platform-session.ts
+function createPlatformSessionResolver(options) {
+  const requests = /* @__PURE__ */ new WeakMap();
+  return (context, resolution) => {
+    const cached = requests.get(context);
+    if (cached && !resolution?.refresh) return cached;
+    const result = (async () => {
+      const bearer = context.req.header("Authorization");
+      if (bearer && !/^Bearer [^\s]+$/.test(bearer)) return null;
+      const identity = await options.verify({ cookie: context.req.header("Cookie"), sessionToken: bearer?.slice(7) ?? context.req.header("X-Session-Token") });
+      if (!identity) return null;
+      const tenantId = context.req.header("X-Tenant-Id");
+      if (tenantId && !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(tenantId)) return null;
+      const matches = await options.memberships(identity.userId, tenantId, identity.identity);
+      if (matches.length !== 1) return null;
+      const member = matches[0];
+      if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(member.tenantId) || tenantId && member.tenantId !== tenantId) return null;
+      if (!Array.isArray(member.roles) || !Array.isArray(member.enabledModules)) throw new Error("Invalid membership");
+      if (![...member.roles, ...member.enabledModules].every((x) => typeof x === "string" && x.length > 0)) throw new Error("Invalid membership");
+      const state = await options.store.read();
+      if (!state.platform.tenants[member.tenantId]?.active) return null;
+      const expected = options.targetFor(member.tenantId);
+      if (state.platform.placements[member.tenantId]?.backendId !== expected.id) throw new Error("Tenant backend placement mismatch");
+      return { userId: identity.userId, tenantId: member.tenantId, roles: [...member.roles], enabledModules: [...member.enabledModules] };
+    })();
+    requests.set(context, result);
+    return result;
+  };
+}
+
+export {
+  createPlatformSessionResolver
+};
+//# sourceMappingURL=chunk-XUP6CNOM.js.map

package/dist/chunk-XUP6CNOM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/browser-auth/platform-session.ts"],"sourcesContent":["import type { Context } from 'hono'\nimport { createKratosSessionVerifier, type BrowserSession } from './index'\nimport type { LifecycleStore, BackendTarget } from '@alneas/eaos-server/lifecycle-engine'\n\n/**\n * Verified tenant membership candidate supplied to {@link createPlatformSessionResolver}.\n */\nexport interface Membership {\n /** Tenant ID matching the selected header, if provided; validated as a 1–128-character scope identifier. */\n tenantId: string\n /** Verified role names, each a nonempty string. */\n roles: string[]\n /** Verified entitlement names, each a nonempty string. */\n enabledModules: string[]\n}\n/**\n * Combines a verified Kratos identity, unambiguous membership, active tenant, and expected backend placement.\n * @param options - verify checks credentials; memberships receives verified userId, optional selected tenant ID, and provider identity and resolves candidate memberships; store supplies lifecycle state; targetFor synchronously resolves the expected backend for a selected tenant.\n * @returns A resolver accepting Hono context and optional refresh flag. It resolves a BrowserSession or null for invalid credentials/selection, ambiguous membership, or inactive tenant. Each context caches the in-flight/result Promise unless refresh is true.\n * @throws The resolver rejects verifier, membership, store, and targetFor errors, malformed membership fields, or backend placement mismatch. Rejected Promises are cached until refresh.\n * @remarks Authorization accepts only the exact Bearer syntax with one space and a nonwhitespace token. Bearer token takes precedence over X-Session-Token; the verifier gives session tokens precedence over cookies. X-Tenant-Id selects a candidate but never grants membership. No default tenant or role is invented. The WeakMap cache is per resolver/context; refresh starts another lookup without cancelling previous work.\n * @example\n * ```typescript\n * import { createPlatformSessionResolver } from \"@alneas/eaos-server/browser-auth/platform-session\";\n * export function hostSessionResolver(options: Parameters<typeof createPlatformSessionResolver>[0]) {\n *   // Supply verified membership reads, lifecycle store, and backend routing.\n *   return createPlatformSessionResolver(options);\n * }\n * ```\n */\nexport function createPlatformSessionResolver(options: {\n  /**\n   * Server whoami verifier receiving cookie/session-token credentials; token transport takes precedence over cookies.\n   */\n  verify: ReturnType<typeof createKratosSessionVerifier>\n  /**\n   * Host callback receiving verified user ID, optional requested tenant, and provider identity; must resolve exactly one authorized membership or resolution returns null.\n   */\n  memberships: (userId: string, tenantId: string | undefined, identity: Record<string, unknown>) => Promise<Membership[]>\n  /**\n   * Authoritative lifecycle store used to require an active tenant and its expected backend placement.\n   */\n  store: LifecycleStore\n  /**\n   * Synchronous host backend selector for the verified membership tenant; an ID differing from lifecycle placement rejects resolution.\n   */\n  targetFor: (tenantId: string) => BackendTarget\n}) {\n  const requests = new WeakMap<Context, Promise<BrowserSession | null>>()\n  return (context: Context, resolution?: { refresh?: boolean }): Promise<BrowserSession | null> => {\n    const cached = requests.get(context)\n    if (cached && !resolution?.refresh) return cached\n    const result = (async () => {\n      const bearer = context.req.header('Authorization')\n      if (bearer && !/^Bearer [^\\s]+$/.test(bearer)) return null\n      const identity = await options.verify({ cookie: context.req.header('Cookie'), sessionToken: bearer?.slice(7) ?? context.req.header('X-Session-Token') })\n      if (!identity) return null\n      const tenantId = context.req.header('X-Tenant-Id')\n      if (tenantId && !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(tenantId)) return null\n      const matches = await options.memberships(identity.userId, tenantId, identity.identity)\n      if (matches.length !== 1) return null // No default tenant or role for ambiguous/unregistered users.\n      const member = matches[0]\n      if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(member.tenantId) || (tenantId && member.tenantId !== tenantId)) return null\n      if (!Array.isArray(member.roles) || !Array.isArray(member.enabledModules)) throw new Error('Invalid membership')\n      if (![...member.roles, ...member.enabledModules].every(x => typeof x === 'string' && x.length > 0)) throw new Error('Invalid membership')\n      const state = await options.store.read()\n      if (!state.platform.tenants[member.tenantId]?.active) return null\n      const expected = options.targetFor(member.tenantId)\n      if (state.platform.placements[member.tenantId]?.backendId !== expected.id) throw new Error('Tenant backend placement mismatch')\n      return { userId: identity.userId, tenantId: member.tenantId, roles: [...member.roles], enabledModules: [...member.enabledModules] }\n    })()\n    requests.set(context, result)\n    return result\n  }\n}\n"],"mappings":";AA8BO,SAAS,8BAA8B,SAiB3C;AACD,QAAM,WAAW,oBAAI,QAAiD;AACtE,SAAO,CAAC,SAAkB,eAAuE;AAC/F,UAAM,SAAS,SAAS,IAAI,OAAO;AACnC,QAAI,UAAU,CAAC,YAAY,QAAS,QAAO;AAC3C,UAAM,UAAU,YAAY;AAC1B,YAAM,SAAS,QAAQ,IAAI,OAAO,eAAe;AACjD,UAAI,UAAU,CAAC,kBAAkB,KAAK,MAAM,EAAG,QAAO;AACtD,YAAM,WAAW,MAAM,QAAQ,OAAO,EAAE,QAAQ,QAAQ,IAAI,OAAO,QAAQ,GAAG,cAAc,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,iBAAiB,EAAE,CAAC;AACvJ,UAAI,CAAC,SAAU,QAAO;AACtB,YAAM,WAAW,QAAQ,IAAI,OAAO,aAAa;AACjD,UAAI,YAAY,CAAC,oCAAoC,KAAK,QAAQ,EAAG,QAAO;AAC5E,YAAM,UAAU,MAAM,QAAQ,YAAY,SAAS,QAAQ,UAAU,SAAS,QAAQ;AACtF,UAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,YAAM,SAAS,QAAQ,CAAC;AACxB,UAAI,CAAC,oCAAoC,KAAK,OAAO,QAAQ,KAAM,YAAY,OAAO,aAAa,SAAW,QAAO;AACrH,UAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,KAAK,CAAC,MAAM,QAAQ,OAAO,cAAc,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC/G,UAAI,CAAC,CAAC,GAAG,OAAO,OAAO,GAAG,OAAO,cAAc,EAAE,MAAM,OAAK,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC,EAAG,OAAM,IAAI,MAAM,oBAAoB;AACxI,YAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK;AACvC,UAAI,CAAC,MAAM,SAAS,QAAQ,OAAO,QAAQ,GAAG,OAAQ,QAAO;AAC7D,YAAM,WAAW,QAAQ,UAAU,OAAO,QAAQ;AAClD,UAAI,MAAM,SAAS,WAAW,OAAO,QAAQ,GAAG,cAAc,SAAS,GAAI,OAAM,IAAI,MAAM,mCAAmC;AAC9H,aAAO,EAAE,QAAQ,SAAS,QAAQ,UAAU,OAAO,UAAU,OAAO,CAAC,GAAG,OAAO,KAAK,GAAG,gBAAgB,CAAC,GAAG,OAAO,cAAc,EAAE;AAAA,IACpI,GAAG;AACH,aAAS,IAAI,SAAS,MAAM;AAC5B,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/chunk-YABTQZDJ.js

@@ -0,0 +1,25 @@
+// src/agentic/types.ts
+var ServerAgentExecutionError = class extends Error {
+  /** Classification used by runner normalization and durable retry handling. */
+  failureCode;
+  /** Host retry advice; true does not itself retry or make execution idempotent. */
+  retryable;
+  /**
+   * Creates a runtime failure retaining an optional underlying cause.
+   * @param message - Human-readable failure description.
+   * @param failureCode - Stable classification for caller retry policy.
+   * @param retryable - Whether the caller may consider retrying this failure.
+   * @param options - Optional cause; omission does not attach an error cause.
+   */
+  constructor(message, failureCode, retryable, options) {
+    super(message, options?.cause === void 0 ? void 0 : { cause: options.cause });
+    this.name = "ServerAgentExecutionError";
+    this.failureCode = failureCode;
+    this.retryable = retryable;
+  }
+};
+
+export {
+  ServerAgentExecutionError
+};
+//# sourceMappingURL=chunk-YABTQZDJ.js.map

package/dist/chunk-YABTQZDJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/agentic/types.ts"],"sourcesContent":["import type { AgentJobKind, AgentRuntimeResourcePolicy, ApprovalLevel, RiskLevel, WorkflowAgentFailureCode, WorkflowAgentToolMode } from '@alneas/eaos-core'\n\n/**\n * Runtime selector used to dispatch server tasks to built-in or host-provided executors.\n * @see ServerAgentExecutor for the host adapter contract.\n */\nexport type ServerAgentWorkerType = 'goose' | 'hermes_agent' | 'litellm' | 'local_cli' | 'local_mlx' | 'external_no_training' | 'custom'\n/**\n * Selects server-side queue execution or authenticated local runner pull delivery.\n * @see ServerAgentExecutionContext.\n */\nexport type ServerAgentDispatchMode = 'server-queue' | 'local-pull'\n\n/**\n * Host-admitted task passed to an agent runtime; tenant/user claims must already be verified.\n * @see ServerAgentExecutor for a complete adapter example.\n */\nexport interface ServerAgentTaskRequest {\n  /** Stable task identifier used for result and checkpoint binding. */\n  id: string\n  /** Verified tenant ID; never accepted directly as an authenticated request-body claim. */\n  tenantId: string\n  /** Verified submitting user ID. */\n  userId: string\n  /** Nonblank task label; ServerAutonomousWorker limits this to 500 characters. */\n  title: string\n  /** Nonblank runtime instructions; ServerAutonomousWorker limits this to 1000000 characters. */\n  instructions: string\n  /** Selected built-in or host runtime adapter key. */\n  workerType: ServerAgentWorkerType\n  /** Why the agent is running; not limited to task-graph workflows. */\n  jobKind?: AgentJobKind\n  /** Optional domain context; interpretation belongs to the executor. */\n  context?: Record<string, unknown>\n  /** Host-verified workflow context propagated to the external runtime. */\n  executionContext?: ServerAgentExecutionContext\n  /** Framework-selected resource policy. Callers cannot loosen this policy. */\n  runtimePolicy?: AgentRuntimeResourcePolicy\n  /** Optional execution timeout in milliseconds; built-in executors default to 60000 and accept safe integers from 1 to 3600000. */\n  timeoutMs?: number\n}\n\n/**\n * Host-selected workflow, correlation, tool scope, and local-runner bindings sent to the runtime.\n * @see ServerAgentTaskRequest.\n */\nexport interface ServerAgentExecutionContext {\n  /** Optional workflow/session association. */\n  workflowId?: string\n  /** Optional host tracing identifier. */\n  correlationId?: string\n  /** Optional host deduplication key; propagation alone does not enforce idempotency. */\n  idempotencyKey?: string\n  /** Optional workflow tool-execution mode admitted by the host. */\n  toolMode?: WorkflowAgentToolMode\n  /** Optional allowlisted tool names; runtime adapters must enforce the intended boundary. */\n  allowedToolNames?: readonly string[]\n  /** Selected by the server broker; clients cannot override it. */\n  routeId?: string\n  /** Optional delivery mode; local-pull jobs are claimed by authenticated local runners. */\n  dispatchMode?: ServerAgentDispatchMode\n  /** User/runner binding for local subscription or MLX execution. */\n  runnerId?: string\n}\n\n/**\n * Normalized runtime outcome; FAILED and PENDING_APPROVAL are returned data rather than successful output.\n * @see ServerAgentExecutor.\n */\nexport interface ServerAgentTaskResult {\n  /** Task identifier to which this result belongs. */\n  taskId: string\n  /** COMPLETED has runtime output; PENDING_APPROVAL awaits a host decision; FAILED records a rejected or failed run. */\n  status: 'COMPLETED' | 'PENDING_APPROVAL' | 'FAILED'\n  /** Runtime text when available; omitted on failures and pending approval. */\n  output?: string\n  /** Optional failure message for FAILED results. */\n  error?: string\n  /** Stable failure classification for durable retry/circuit-breaker handling. */\n  failureCode?: WorkflowAgentFailureCode\n  /** Optional retry advice; absence leaves retry policy to the caller. */\n  retryable?: boolean\n  /** Optional generated approval binding for PENDING_APPROVAL. */\n  approvalTicketId?: string\n  /** Optional human-approval level returned by the gatekeeper. */\n  approvalLevel?: ApprovalLevel\n  /** Optional risk classification returned by the gatekeeper. */\n  riskLevel?: RiskLevel\n  /** Elapsed wall-clock milliseconds for this attempt. */\n  durationMs: number\n}\n\n/**\n * Carries stable failure classification and retry advice from runtime adapters to queue coordination.\n * @example\n * ```typescript\n * import { ServerAgentExecutionError } from \"@alneas/eaos-server/agentic/types\";\n * const error = new ServerAgentExecutionError(\"Runtime unavailable\", \"AGENT_UNAVAILABLE\", true);\n * console.log(error.failureCode, error.retryable);\n * ```\n */\nexport class ServerAgentExecutionError extends Error {\n  /** Classification used by runner normalization and durable retry handling. */\n  readonly failureCode: WorkflowAgentFailureCode\n  /** Host retry advice; true does not itself retry or make execution idempotent. */\n  readonly retryable: boolean\n\n  /**\n   * Creates a runtime failure retaining an optional underlying cause.\n   * @param message - Human-readable failure description.\n   * @param failureCode - Stable classification for caller retry policy.\n   * @param retryable - Whether the caller may consider retrying this failure.\n   * @param options - Optional cause; omission does not attach an error cause.\n   */\n  constructor(message: string, failureCode: WorkflowAgentFailureCode, retryable: boolean, options?: { \n  /**\n   * Optional underlying error attached through the standard Error cause option; omission leaves the cause unset.\n   */\n  cause?: unknown }) {\n    super(message, options?.cause === undefined ? undefined : { cause: options.cause })\n    this.name = 'ServerAgentExecutionError'\n    this.failureCode = failureCode\n    this.retryable = retryable\n  }\n}\n\n/**\n * Host- or plugin-owned agent execution adapter.\n *\n * The server owns admission, authorization and result normalization; the\n * adapter owns the configured runtime (OpenCode, Codex, Goose, LiteLLM, etc.).\n * @param request - Verified task and execution context; adapters must enforce host runtime/tool boundaries.\n * @returns Runtime text output, which is not permission to perform business side effects.\n * @throws Reject for unavailable, failed, timed-out, or invalid runtime work; ServerAgentExecutionError preserves classification and retry advice.\n * @example\n * ```typescript\n * import type { ServerAgentExecutor } from \"@alneas/eaos-server/agentic/types\";\n * export function instrument(execute: ServerAgentExecutor): ServerAgentExecutor {\n *   return async request => execute(structuredClone(request));\n * }\n * ```\n */\nexport type ServerAgentExecutor = (request: ServerAgentTaskRequest) => Promise<string>\n\n/**\n * Host-verified approval decision submitted against a pending task checkpoint.\n * @remarks The host authenticates the approver and verifies role authority before passing this payload to a coordinator.\n * @see ServerAgentTaskResult.\n */\nexport interface ServerApprovalCallbackPayload {\n  /** Task checkpoint identifier whose approval is being decided. */\n  taskId: string\n  /** Optional external ticket binding; when supplied it must match the checkpoint. */\n  approvalId?: string\n  /** Optional binding hash for clients that persist the approval payload. */\n  bindingHash?: string\n  /** True to approve; false to reject the pending work. */\n  approved: boolean\n  /** Authenticated host approver identifier. */\n  approverId: string\n  /** Verified role used for approval authorization. */\n  approverRole: string\n  /** Optional human decision note. */\n  comment?: string\n}\n"],"mappings":";AAqGO,IAAM,4BAAN,cAAwC,MAAM;AAAA;AAAA,EAE1C;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAST,YAAY,SAAiB,aAAuC,WAAoB,SAIrE;AACjB,UAAM,SAAS,SAAS,UAAU,SAAY,SAAY,EAAE,OAAO,QAAQ,MAAM,CAAC;AAClF,SAAK,OAAO;AACZ,SAAK,cAAc;AACnB,SAAK,YAAY;AAAA,EACnB;AACF;","names":[]}

package/dist/chunk-YMJ7BRKU.js

@@ -0,0 +1,510 @@
+// src/platform-admin/store.ts
+import { assertBackendMigrationCutover, canonical, normalizeLifecycleState, planBackendMigration } from "@alneas/eaos-server/lifecycle-engine";
+var key = (...parts) => JSON.stringify(parts);
+var identifier = (value, name) => {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/.test(value)) throw new Error(`Invalid ${name}`);
+  return value;
+};
+var text = (value, name, max = 256) => {
+  if (!value.trim() || value.length > max) throw new Error(`Invalid ${name}`);
+  return value;
+};
+var timestamp = (value, name) => {
+  if (!Number.isFinite(Date.parse(value))) throw new Error(`Invalid ${name}`);
+  return value;
+};
+function materializeBackend(state, backendId) {
+  const backend = state.backends[backendId];
+  if (!backend) return null;
+  return { ...backend, ...state.platform.backendMetadata[backendId] };
+}
+function targetOf(backend) {
+  return { id: backend.id, databaseId: backend.databaseId, dialect: backend.dialect, mode: backend.mode, ...backend.tenantId === void 0 ? {} : { tenantId: backend.tenantId } };
+}
+function placement(state, tenantId) {
+  const record = state.platform.placements[tenantId];
+  if (!record) return null;
+  const backend = materializeBackend(state, record.backendId);
+  if (!backend) throw new Error(`Tenant placement references unknown backend: ${record.backendId}`);
+  return { tenantId, backend, routingRevision: record.routingRevision, changedAt: record.changedAt };
+}
+function validateBackend(backend) {
+  identifier(backend.id, "backend id");
+  identifier(backend.databaseId, "database id");
+  if (!["sqlite", "postgres", "oracle"].includes(backend.dialect) || !["shared", "dedicated"].includes(backend.mode)) throw new Error("Invalid backend target");
+  if (backend.mode === "dedicated") identifier(backend.tenantId ?? "", "dedicated backend tenant");
+  if (backend.mode === "shared" && backend.tenantId !== void 0) throw new Error("Shared backend cannot bind a tenant");
+}
+var LifecyclePlatformControlStore = class {
+  /**
+   * Captures the shared authoritative lifecycle ledger and clock.
+   * @param lifecycle - Host store providing consistent reads and exclusive writer callbacks.
+   * @param now - Clock for mutation timestamps; defaults to a fresh Date.
+   */
+  constructor(lifecycle, now = () => /* @__PURE__ */ new Date()) {
+    this.lifecycle = lifecycle;
+    this.now = now;
+  }
+  lifecycle;
+  now;
+  async read() {
+    return normalizeLifecycleState(await this.lifecycle.read());
+  }
+  async mutate(fn) {
+    return this.lifecycle.withLock(async (writer) => {
+      const state = normalizeLifecycleState(await writer.read());
+      const result = await fn(state);
+      state.revision += 1;
+      await writer.write(state);
+      return result;
+    });
+  }
+  /**
+   * Lists tenant records from the authoritative normalized lifecycle snapshot.
+   * @returns Tenant records with cloned domains arrays, or an empty array.
+   * @throws Host read/normalization failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function listTenants(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["listTenants"]>) {
+   *   return store.listTenants(...args);
+   * }
+   * ```
+   */
+  async listTenants() {
+    const state = await this.read();
+    return Object.values(state.platform.tenants).map((tenant) => ({ ...tenant, domains: [...tenant.domains] }));
+  }
+  /**
+   * Creates an active tenant and its initial backend routing record under the lifecycle writer lock.
+   * @param input - Valid scope ID, nonblank name, nonempty domain strings, and registered initial backendId; a dedicated backend must bind the same tenant.
+   * @returns Created tenant record with clock timestamps; initial routing revision is one.
+   * @throws Invalid input, duplicate tenant, missing/mismatched backend, or host lock/write/clock failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function createTenant(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["createTenant"]>) {
+   *   return store.createTenant(...args);
+   * }
+   * ```
+   */
+  async createTenant(input) {
+    const id = identifier(input.id, "tenant id");
+    const name = text(input.name, "tenant name");
+    const backendId = identifier(input.backendId, "initial backend id");
+    if (!Array.isArray(input.domains) || input.domains.length === 0 || input.domains.some((domain) => typeof domain !== "string" || !domain.trim())) throw new Error("Invalid tenant domains");
+    return this.mutate((state) => {
+      if (state.platform.tenants[id]) throw new Error("Tenant already exists");
+      const backend = materializeBackend(state, backendId);
+      if (!backend) throw new Error("Initial backend not found");
+      if (backend.mode === "dedicated" && backend.tenantId !== id) throw new Error("Initial backend tenant mismatch");
+      const at = this.now().toISOString();
+      const tenant = { id, name, active: true, domains: [...input.domains], createdAt: at, updatedAt: at };
+      state.platform.tenants[id] = tenant;
+      state.platform.placements[id] = { tenantId: id, backendId, routingRevision: 1, changedAt: at };
+      return tenant;
+    });
+  }
+  /**
+   * Updates an existing tenant name, active flag, or domains and refreshes updatedAt.
+   * @param tenantId - Existing valid tenant scope ID.
+   * @param patch - Optional nonblank name, boolean active, and nonempty nonblank domains; omitted fields remain unchanged.
+   * @returns Updated tenant with cloned domains.
+   * @throws Missing tenant, invalid supplied fields, or host lock/write/clock failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function updateTenant(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["updateTenant"]>) {
+   *   return store.updateTenant(...args);
+   * }
+   * ```
+   */
+  async updateTenant(tenantId, patch) {
+    identifier(tenantId, "tenant id");
+    return this.mutate((state) => {
+      const current = state.platform.tenants[tenantId];
+      if (!current) throw new Error("Tenant not found");
+      if (patch.name !== void 0) current.name = text(patch.name, "tenant name");
+      if (patch.active !== void 0) {
+        if (typeof patch.active !== "boolean") throw new Error("Invalid tenant active state");
+        current.active = patch.active;
+      }
+      if (patch.domains !== void 0) {
+        if (!Array.isArray(patch.domains) || patch.domains.length === 0 || patch.domains.some((domain) => typeof domain !== "string" || !domain.trim())) throw new Error("Invalid tenant domains");
+        current.domains = [...patch.domains];
+      }
+      current.updatedAt = this.now().toISOString();
+      return { ...current, domains: [...current.domains] };
+    });
+  }
+  /**
+   * Registers an immutable backend placement identity and replaceable public metadata.
+   * @param backend - Valid backend/database IDs, dialect/mode, optional dedicated tenant binding, and metadata.
+   * @returns Materialized registered target with metadata.
+   * @throws Invalid target, changed placement for an existing ID, database dialect conflict, or host store failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function registerBackend(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["registerBackend"]>) {
+   *   return store.registerBackend(...args);
+   * }
+   * ```
+   */
+  async registerBackend(backend) {
+    validateBackend(backend);
+    return this.mutate((state) => {
+      const existing = state.backends[backend.id];
+      const target = { id: backend.id, databaseId: backend.databaseId, dialect: backend.dialect, mode: backend.mode, ...backend.tenantId === void 0 ? {} : { tenantId: backend.tenantId } };
+      if (existing && canonical(existing) !== canonical(target)) throw new Error("Backend placement is immutable; register a new backend ID");
+      for (const other of Object.values(state.backends)) if (other.id !== backend.id && other.databaseId === backend.databaseId && other.dialect !== backend.dialect) throw new Error("Database dialect conflict");
+      state.backends[backend.id] = target;
+      const { id: _id, databaseId: _databaseId, dialect: _dialect, mode: _mode, tenantId: _tenantId, ...metadata } = backend;
+      state.platform.backendMetadata[backend.id] = metadata;
+      return { ...target, ...metadata };
+    });
+  }
+  /**
+   * Materializes registered backend targets with their public metadata.
+   * @returns Backend list, or an empty array.
+   * @throws Host read/normalization failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function listBackends(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["listBackends"]>) {
+   *   return store.listBackends(...args);
+   * }
+   * ```
+   */
+  async listBackends() {
+    const state = await this.read();
+    return Object.keys(state.backends).map((id) => materializeBackend(state, id)).filter(Boolean);
+  }
+  /**
+   * Reads a registered backend target and its public metadata.
+   * @param backendId - Valid registered backend scope ID.
+   * @returns Materialized backend, or null when unregistered.
+   * @throws Invalid ID or host read failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function getBackend(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["getBackend"]>) {
+   *   return store.getBackend(...args);
+   * }
+   * ```
+   */
+  async getBackend(backendId) {
+    identifier(backendId, "backend id");
+    return materializeBackend(await this.read(), backendId);
+  }
+  /**
+   * Resolves a tenant routing record into its registered backend target.
+   * @param tenantId - Valid tenant scope ID.
+   * @returns Placement with routing revision/time and backend, or null when absent.
+   * @throws Invalid ID, dangling backend reference, or host read failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function getTenantPlacement(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["getTenantPlacement"]>) {
+   *   return store.getTenantPlacement(...args);
+   * }
+   * ```
+   */
+  async getTenantPlacement(tenantId) {
+    identifier(tenantId, "tenant id");
+    return placement(await this.read(), tenantId);
+  }
+  /**
+   * Persists an immutable migration plan after checking registered backend identities.
+   * @param plan - Reviewed plan matching currently registered source/target; identical saved plans may be accepted before completion.
+   * @returns No value; resolves after storing the plan and initial planned record if absent.
+   * @throws Unregistered/changed backend, conflicting reused plan ID, already completed plan, clone or host store failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function saveMigrationPlan(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["saveMigrationPlan"]>) {
+   *   return store.saveMigrationPlan(...args);
+   * }
+   * ```
+   */
+  async saveMigrationPlan(plan) {
+    await this.mutate((state) => {
+      if (!state.backends[plan.request.source.id] || !state.backends[plan.request.target.id]) throw new Error("Migration backend is not registered");
+      if (canonical(targetOf(state.backends[plan.request.source.id])) !== canonical(targetOf(plan.request.source)) || canonical(targetOf(state.backends[plan.request.target.id])) !== canonical(targetOf(plan.request.target))) throw new Error("Migration backend changed since planning");
+      const existing = state.platform.migrationPlans[plan.id];
+      if (existing && canonical(existing) !== canonical(plan)) throw new Error("Migration plan ID already contains a different plan");
+      const current = state.platform.migrationRecords[plan.id];
+      if (current?.status === "cutover" || current?.status === "rolled-back") throw new Error("Migration plan has already completed");
+      state.platform.migrationPlans[plan.id] = structuredClone(plan);
+      state.platform.migrationRecords[plan.id] ??= { status: "planned", updatedAt: plan.request.requestedAt };
+    });
+  }
+  /**
+   * Reads a cloned persisted migration plan by ID.
+   * @param migrationId - Valid migration scope ID.
+   * @returns Plan clone, or null when absent.
+   * @throws Invalid ID or host read/clone failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function getMigrationPlan(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["getMigrationPlan"]>) {
+   *   return store.getMigrationPlan(...args);
+   * }
+   * ```
+   */
+  async getMigrationPlan(migrationId) {
+    identifier(migrationId, "migration id");
+    const state = await this.read();
+    const plan = state.platform.migrationPlans[migrationId];
+    return plan ? structuredClone(plan) : null;
+  }
+  /**
+   * Reads the persisted migration execution/reconciliation record.
+   * @param migrationId - Valid migration scope ID.
+   * @returns Cloned status record, or null when absent.
+   * @throws Invalid ID or host read/clone failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function getMigrationStatus(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["getMigrationStatus"]>) {
+   *   return store.getMigrationStatus(...args);
+   * }
+   * ```
+   */
+  async getMigrationStatus(migrationId) {
+    identifier(migrationId, "migration id");
+    const record = (await this.read()).platform.migrationRecords[migrationId];
+    return record ? structuredClone(record) : null;
+  }
+  /**
+   * Binds an execution token and transitions a tenant migration record to running.
+   * @param input - Verified tenantId, persisted migrationId, and unique host executionId; plan scope must include the tenant.
+   * @returns Cloned running record, or completed cutover/rolled-back record unchanged.
+   * @throws Missing plan, tenant mismatch, conflicting active token, reconciling state, invalid IDs, or host store failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function beginMigrationExecution(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["beginMigrationExecution"]>) {
+   *   return store.beginMigrationExecution(...args);
+   * }
+   * ```
+   */
+  async beginMigrationExecution(input) {
+    identifier(input.tenantId, "tenant id");
+    identifier(input.migrationId, "migration id");
+    identifier(input.executionId, "execution id");
+    return this.mutate((state) => {
+      const plan = state.platform.migrationPlans[input.migrationId];
+      const record = state.platform.migrationRecords[input.migrationId];
+      if (!plan || !record) throw new Error("Migration plan not found");
+      if (plan.request.scope.kind !== "tenants" || !plan.request.scope.tenantIds.includes(input.tenantId)) throw new Error("Migration plan tenant mismatch");
+      if (record.status === "cutover" || record.status === "rolled-back") return structuredClone(record);
+      if ((record.status === "running" || record.status === "verified") && record.executionId !== input.executionId) throw new Error("Migration execution already in progress");
+      if (record.status === "reconciling") throw new Error("Migration requires reconciliation before retry");
+      record.status = "running";
+      record.executionId = input.executionId;
+      record.error = void 0;
+      record.updatedAt = this.now().toISOString();
+      return structuredClone(record);
+    });
+  }
+  /**
+   * Records verified migration evidence and cutover data for the active execution token.
+   * @param input - Tenant, exact persisted plan, active executionId, verification report, and matching validated cutover.
+   * @returns Cloned verified migration record.
+   * @throws Invalid cutover/report, nonpersisted/changed plan, tenant/token/state mismatch, changed retry verification, or host store failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function recordMigrationVerification(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["recordMigrationVerification"]>) {
+   *   return store.recordMigrationVerification(...args);
+   * }
+   * ```
+   */
+  async recordMigrationVerification(input) {
+    identifier(input.tenantId, "tenant id");
+    identifier(input.executionId, "execution id");
+    assertBackendMigrationCutover(input.plan, input.verification, input.cutover);
+    return this.mutate((state) => {
+      const saved = state.platform.migrationPlans[input.plan.id];
+      const record = state.platform.migrationRecords[input.plan.id];
+      if (!saved || canonical(saved) !== canonical(input.plan) || !record) throw new Error("Migration plan is not the persisted plan");
+      if (input.plan.request.scope.kind !== "tenants" || !input.plan.request.scope.tenantIds.includes(input.tenantId)) throw new Error("Migration plan tenant mismatch");
+      if (record.executionId !== input.executionId || !["running", "verified"].includes(record.status)) throw new Error("Migration execution is not active");
+      if (record.status === "verified" && canonical(record.verification) !== canonical(input.verification)) throw new Error("Migration verification changed during retry");
+      record.status = "verified";
+      record.verification = structuredClone(input.verification);
+      record.cutover = structuredClone(input.cutover);
+      record.updatedAt = this.now().toISOString();
+      return structuredClone(record);
+    });
+  }
+  /**
+   * Records a failed or reconciling migration status with host diagnostic text.
+   * @param input - Persisted migrationId, optional expected executionId, failure status, and nonblank message up to 2048 characters.
+   * @returns Cloned updated failure record.
+   * @throws Missing/completed migration, mismatched token, invalid input, or host store/clock failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function markMigrationFailure(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["markMigrationFailure"]>) {
+   *   return store.markMigrationFailure(...args);
+   * }
+   * ```
+   */
+  async markMigrationFailure(input) {
+    identifier(input.migrationId, "migration id");
+    text(input.message, "migration failure", 2048);
+    return this.mutate((state) => {
+      const record = state.platform.migrationRecords[input.migrationId];
+      if (!record) throw new Error("Migration plan not found");
+      if (input.executionId && record.executionId !== input.executionId) throw new Error("Migration execution token mismatch");
+      if (record.status === "cutover" || record.status === "rolled-back") throw new Error("Completed migration cannot be marked failed");
+      record.status = input.status;
+      record.error = { message: input.message, occurredAt: this.now().toISOString() };
+      record.updatedAt = this.now().toISOString();
+      return structuredClone(record);
+    });
+  }
+  /**
+   * Applies an operator reconciliation status action and records its note.
+   * @param input - Persisted migrationId, action, and nonblank note up to 2048 characters; retry only permits failed/reconciling state and clears execution/verification/cutover.
+   * @returns Cloned updated migration record.
+   * @throws Missing record, retry from an ineligible state, completed record for mark-failed/mark-reconciling, invalid text, or host store failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function reconcileMigration(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["reconcileMigration"]>) {
+   *   return store.reconcileMigration(...args);
+   * }
+   * ```
+   */
+  async reconcileMigration(input) {
+    identifier(input.migrationId, "migration id");
+    text(input.note, "reconciliation note", 2048);
+    return this.mutate((state) => {
+      const record = state.platform.migrationRecords[input.migrationId];
+      if (!record) throw new Error("Migration plan not found");
+      if (input.action === "retry") {
+        if (!["failed", "reconciling"].includes(record.status)) throw new Error("Only failed or reconciling migrations can be retried");
+        record.status = "planned";
+        record.executionId = void 0;
+        record.verification = void 0;
+        record.cutover = void 0;
+      } else if (input.action === "mark-failed") {
+        if (record.status === "cutover" || record.status === "rolled-back") throw new Error("Completed migration cannot be marked failed");
+        record.status = "failed";
+      } else if (input.action === "mark-reconciling") {
+        if (record.status === "cutover" || record.status === "rolled-back") throw new Error("Completed migration cannot be reconciled");
+        record.status = "reconciling";
+      }
+      record.error = { message: input.note, occurredAt: this.now().toISOString() };
+      record.updatedAt = this.now().toISOString();
+      return structuredClone(record);
+    });
+  }
+  /**
+   * Creates a reverse migration plan for a completed cutover without executing rollback.
+   * @param input - Verified tenantId, completed migrationId, nonblank reason up to 1024 characters, and parseable requestedAt timestamp.
+   * @returns New planned reverse migration linked to the original record.
+   * @throws Incomplete/already rollback-planned migration, tenant no longer on migrated target, invalid input/planning, or host store failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function createRollbackPlan(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["createRollbackPlan"]>) {
+   *   return store.createRollbackPlan(...args);
+   * }
+   * ```
+   */
+  async createRollbackPlan(input) {
+    identifier(input.tenantId, "tenant id");
+    identifier(input.migrationId, "migration id");
+    text(input.reason, "rollback reason", 1024);
+    timestamp(input.requestedAt, "rollback requestedAt");
+    return this.mutate((state) => {
+      const original = state.platform.migrationRecords[input.migrationId];
+      const originalPlan = state.platform.migrationPlans[input.migrationId];
+      if (!original || !originalPlan || original.status !== "cutover") throw new Error("Only a completed migration can be rolled back");
+      if (original.rollbackPlanId) throw new Error("Migration rollback already exists");
+      const current = placement(state, input.tenantId);
+      if (!current || current.backend.id !== originalPlan.request.target.id) throw new Error("Current tenant placement is not the migrated target");
+      const rollback = planBackendMigration({
+        migrationId: `rollback-${crypto.randomUUID()}`,
+        source: originalPlan.request.target,
+        target: originalPlan.request.source,
+        scope: originalPlan.request.scope,
+        pluginIds: originalPlan.request.pluginIds,
+        requestedAt: input.requestedAt,
+        reason: input.reason
+      });
+      state.platform.migrationPlans[rollback.id] = structuredClone(rollback);
+      state.platform.migrationRecords[rollback.id] = { status: "planned", updatedAt: input.requestedAt, rollbackOf: input.migrationId };
+      original.rollbackPlanId = rollback.id;
+      original.updatedAt = this.now().toISOString();
+      return rollback;
+    });
+  }
+  /**
+   * Commits a verified migration routing change and transfers active plugin activations to the target backend.
+   * @param input - Tenant included by the exact persisted plan and its previously recorded cutover proof.
+   * @returns New target placement, or current placement for an already-cutover record.
+   * @throws Unverified/stale/changed plan, invalid cutover or nonadvancing routing revision, target tenant mismatch, missing planned active plugin or target installation, or host lock/write failure.
+   * @example
+   * ```typescript
+   * import { LifecyclePlatformControlStore } from "@alneas/eaos-server/platform-admin/store";
+   * export async function recordTenantPlacement(store: LifecyclePlatformControlStore, ...args: Parameters<LifecyclePlatformControlStore["recordTenantPlacement"]>) {
+   *   return store.recordTenantPlacement(...args);
+   * }
+   * ```
+   */
+  async recordTenantPlacement(input) {
+    identifier(input.tenantId, "tenant id");
+    return this.mutate((state) => {
+      const { plan, cutover } = input;
+      const saved = state.platform.migrationPlans[plan.id];
+      const record = state.platform.migrationRecords[plan.id];
+      if (!saved || canonical(saved) !== canonical(plan) || !record) throw new Error("Migration plan is not the persisted plan");
+      if (plan.request.scope.kind !== "tenants" || !plan.request.scope.tenantIds.includes(input.tenantId)) throw new Error("Migration plan tenant mismatch");
+      if (record.status === "cutover") return placement(state, input.tenantId);
+      if (record.status !== "verified" || !record.executionId || !record.verification || !record.cutover || canonical(record.cutover) !== canonical(cutover)) throw new Error("Migration must be verified before cutover");
+      if (cutover.migrationId !== plan.request.migrationId || cutover.targetBackendId !== plan.request.target.id || cutover.sourceRetained !== true || !Number.isSafeInteger(cutover.routingRevision) || cutover.routingRevision < 0 || !Number.isFinite(Date.parse(cutover.cutoverAt))) throw new Error("Invalid migration cutover");
+      const current = placement(state, input.tenantId);
+      if (!current || current.backend.id !== plan.request.source.id || current.backend.databaseId !== plan.request.source.databaseId) throw new Error("Migration plan is stale");
+      if (cutover.routingRevision <= current.routingRevision) throw new Error("Migration routing revision must advance");
+      const target = materializeBackend(state, plan.request.target.id);
+      if (!target || canonical(targetOf(target)) !== canonical(targetOf(plan.request.target))) throw new Error("Migration target backend changed");
+      if (target.mode === "dedicated" && target.tenantId !== input.tenantId) throw new Error("Migration target tenant mismatch");
+      const active = Object.entries(state.activations).filter(([, activation]) => activation.backendId === plan.request.source.id && activation.tenantId === input.tenantId && activation.enabled);
+      const planned = new Set(plan.request.pluginIds);
+      for (const [, activation] of active) {
+        if (!planned.has(activation.pluginId)) throw new Error(`Migration plan does not include active plugin: ${activation.pluginId}`);
+        const installation = state.installations[key(plan.request.target.id, activation.pluginId)];
+        if (!installation || installation.status !== "installed") throw new Error(`Target backend is missing installed plugin: ${activation.pluginId}`);
+      }
+      for (const [activationKey, activation] of active) {
+        activation.enabled = false;
+        const targetKey = key(plan.request.target.id, input.tenantId, activation.pluginId);
+        const installation = state.installations[key(plan.request.target.id, activation.pluginId)];
+        state.activations[targetKey] = { ...activation, backendId: plan.request.target.id, digest: installation.digest, enabled: true };
+        state.activations[activationKey] = activation;
+      }
+      state.platform.placements[input.tenantId] = { tenantId: input.tenantId, backendId: plan.request.target.id, routingRevision: cutover.routingRevision, changedAt: timestamp(cutover.cutoverAt, "cutover time") };
+      record.status = "cutover";
+      record.updatedAt = this.now().toISOString();
+      record.cutover = structuredClone(cutover);
+      if (record.rollbackOf) {
+        const original = state.platform.migrationRecords[record.rollbackOf];
+        if (original) {
+          original.status = "rolled-back";
+          original.updatedAt = this.now().toISOString();
+          original.rollbackPlanId = plan.id;
+        }
+      }
+      return placement(state, input.tenantId);
+    });
+  }
+};
+
+export {
+  LifecyclePlatformControlStore
+};
+//# sourceMappingURL=chunk-YMJ7BRKU.js.map