@hasna/todos 0.15.52 → 0.16.0

package/dist/task-manifest/postgres.d.ts

@@ -13,7 +13,7 @@ export declare class PostgresTodosTaskManifestBackend implements TodosTaskManife
     private persistTerminal;
     apply(input: NormalizedTaskManifest, faults: PreparedTaskManifestFaults): Promise<TodosTaskManifestApplyResult>;
     readExact(receiptId: string): Promise<TodosTaskManifestApplyResult>;
-    lookupBindingByPlanId(planId: string): Promise<Omit<import("./types.js").TodosTaskManifestBindingLookupResult, "schema_version" | "authority" | "route" | "tenant_id">>;
+    lookupBindingByPlanId(planId: string): Promise<Omit<import("./types.js").TodosTaskManifestBindingLookupResult, "authority" | "route" | "tenant_id" | "schema_version">>;
     markOutboxDelivered(outboxId: string, deliveredAt: string): Promise<void>;
     compensate(input: TodosTaskManifestCompensateRequest, receipt: TodosTaskManifestReceipt, compensationReceiptId: string, requestDigest: string, now: string): Promise<TodosTaskManifestCompensationResult>;
     private readback;

package/dist/task-manifest/sqlite.d.ts

@@ -10,7 +10,7 @@ export declare class SqliteTodosTaskManifestBackend implements TodosTaskManifest
     apply(input: NormalizedTaskManifest, faults: PreparedTaskManifestFaults): Promise<TodosTaskManifestApplyResult>;
     private persistTerminal;
     readExact(receiptId: string): Promise<TodosTaskManifestApplyResult>;
-    lookupBindingByPlanId(planId: string): Promise<Omit<import("./types.js").TodosTaskManifestBindingLookupResult, "schema_version" | "authority" | "route" | "tenant_id">>;
+    lookupBindingByPlanId(planId: string): Promise<Omit<import("./types.js").TodosTaskManifestBindingLookupResult, "authority" | "route" | "tenant_id" | "schema_version">>;
     markOutboxDelivered(outboxId: string, deliveredAt: string): Promise<void>;
     compensate(input: TodosTaskManifestCompensateRequest, receipt: TodosTaskManifestReceipt, compensationReceiptId: string, requestDigest: string, now: string): Promise<TodosTaskManifestCompensationResult>;
     private readback;

package/dist/task-manifest.js

@@ -46,7 +46,7 @@ function isBlockingDependencyStatus(status) {
 function isTerminalStatus(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
-var TASK_STATUSES, TASK_PRIORITIES, PLAN_STATUSES, VersionConflictError, TaskNotFoundError, TaskNotStartableError, TaskReferenceAmbiguousError, ProjectNotFoundError, ResourceConflictError, PlanRevisionConflictError, PlanNotFoundError, LockError, StaleLockHandoffError, AgentNotFoundError, IdentityAliasAmbiguousError, IdentityIdImmutableError, TaskListNotFoundError, DependencyCycleError, CompletionGuardError, DISPATCH_STATUSES, DispatchNotFoundError;
+var TASK_STATUSES, TASK_PRIORITIES, PLAN_STATUSES, VersionConflictError, TaskNotFoundError, TaskNotStartableError, TaskReferenceAmbiguousError, ProjectNotFoundError, ResourceConflictError, PlanRevisionConflictError, PlanNotFoundError, LockError, StaleLockHandoffError, AgentNotFoundError, IdentityAliasAmbiguousError, IdentityIdImmutableError, TaskListNotFoundError, DependencyCycleError, CompletionGuardError, DISPATCH_STATUSES, DispatchNotFoundError, InputValidationError;
 var init_types = __esm(() => {
   TASK_STATUSES = [
     "pending",
@@ -61,7 +61,7 @@ var init_types = __esm(() => {
     "high",
     "critical"
   ];
-  PLAN_STATUSES = ["active", "completed", "archived"];
+  PLAN_STATUSES = ["active", "completed", "archived", "planning", "cancelled"];
   VersionConflictError = class VersionConflictError extends Error {
     taskId;
     expectedVersion;
@@ -250,6 +250,16 @@ var init_types = __esm(() => {
       this.name = "DispatchNotFoundError";
     }
   };
+  InputValidationError = class InputValidationError extends Error {
+    static code = "INVALID_INPUT";
+    code = InputValidationError.code;
+    suggestion;
+    constructor(message, suggestion) {
+      super(message);
+      this.name = "InputValidationError";
+      this.suggestion = suggestion;
+    }
+  };
 });
 
 // src/lib/slugs.ts
@@ -323,83 +333,68 @@ function validateSnapshotRoutingDestinationConflicts(projects, taskLists, existi
   return errors2;
 }
 
-// node_modules/.bun/@hasna+paths@0.1.0/node_modules/@hasna/paths/dist/index.js
+// src/lib/paths.ts
+import { existsSync } from "fs";
 import { homedir } from "os";
-import { join } from "path";
-function assertApp(app) {
+import { join, resolve } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+function pathsResolverAssertApp(app) {
   if (typeof app !== "string" || app.length === 0) {
     throw new TypeError("paths: app must be a non-empty string");
   }
-  if (!APP_SLUG_RE.test(app)) {
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
     throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
   }
 }
-function envOf(options) {
-  return options.env ?? process.env;
-}
-function envValue(options, kind) {
-  const value = envOf(options)[KIND_ENV[kind]];
-  return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-function isMacOS(platform) {
-  return platform === "darwin";
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
 }
-function baseDir(kind, options) {
-  const override = envValue(options, kind);
-  if (override)
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
     return override;
-  const home = options.home ?? homedir();
+  const home = options.home ?? pathsResolverHomedir();
   const platform = options.platform ?? process.platform;
-  if (isMacOS(platform)) {
+  if (platform === "darwin") {
     switch (kind) {
       case "config":
       case "data":
-        return join(home, "Library", "Application Support", "Hasna");
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
       case "cache":
-        return join(home, "Library", "Caches", "Hasna");
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
       case "state":
-        return join(home, "Library", "Logs", "Hasna");
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
     }
   }
   switch (kind) {
     case "config":
-      return join(home, ".config", "hasna");
+      return pathsResolverJoin(home, ".config", "hasna");
     case "data":
-      return join(home, ".local", "share", "hasna");
+      return pathsResolverJoin(home, ".local", "share", "hasna");
     case "state":
-      return join(home, ".local", "state", "hasna");
+      return pathsResolverJoin(home, ".local", "state", "hasna");
     case "cache":
-      return join(home, ".cache", "hasna");
+      return pathsResolverJoin(home, ".cache", "hasna");
   }
 }
-function resolvePath(kind, options) {
-  assertApp(options.app);
-  const appSegment = options.internal === true ? join("internal", options.app) : options.app;
-  return join(baseDir(kind, options), appSegment);
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
 }
 function dataDir(options) {
-  return resolvePath("data", options);
+  return pathsResolverResolve("data", options);
 }
-var KIND_ENV, APP_SLUG_RE;
-var init_dist = __esm(() => {
-  KIND_ENV = {
-    config: "HASNA_CONFIG_HOME",
-    data: "HASNA_DATA_HOME",
-    state: "HASNA_STATE_HOME",
-    cache: "HASNA_CACHE_HOME"
-  };
-  APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-});
-
-// src/lib/paths.ts
-import { existsSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2, resolve } from "path";
 function effectiveHome(env = process.env) {
-  return env.HOME || env.USERPROFILE || homedir2();
+  return env.HOME || env.USERPROFILE || homedir();
 }
 function legacyHomeDir(env = process.env) {
-  return join2(effectiveHome(env), ".hasna", "todos");
+  return join(effectiveHome(env), ".hasna", "todos");
 }
 function resolverHome(env = process.env) {
   return dataDir({ app: "todos", home: effectiveHome(env), env });
@@ -408,23 +403,30 @@ function adoptResolverHome(resolved, env = process.env) {
   const dataOverride = env.HASNA_DATA_HOME;
   if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
     return true;
-  return existsSync(join2(resolved, "todos.db")) || existsSync(join2(resolved, "config.json"));
+  return existsSync(join(resolved, "todos.db")) || existsSync(join(resolved, "config.json"));
 }
 function getTodosDir(env = process.env) {
   const resolved = resolverHome(env);
   return resolve(adoptResolverHome(resolved, env) ? resolved : legacyHomeDir(env));
 }
+var PATHS_RESOLVER_KIND_ENV, PATHS_RESOLVER_APP_SLUG_RE;
 var init_paths = __esm(() => {
-  init_dist();
+  PATHS_RESOLVER_KIND_ENV = {
+    config: "HASNA_CONFIG_HOME",
+    data: "HASNA_DATA_HOME",
+    state: "HASNA_STATE_HOME",
+    cache: "HASNA_CACHE_HOME"
+  };
+  PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 });
 
 // src/lib/sync-utils.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
 import { createHash as createHash2 } from "crypto";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
 function getHomeDir() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || homedir3();
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir2();
 }
 function getTodosGlobalDir() {
   return getTodosDir();
@@ -450,14 +452,14 @@ function writeJsonFile(path, data) {
 `);
 }
 function readHighWaterMark(dir) {
-  const path = join3(dir, ".highwatermark");
+  const path = join2(dir, ".highwatermark");
   if (!existsSync2(path))
     return 1;
   const val = parseInt(readFileSync(path, "utf-8").trim(), 10);
   return isNaN(val) ? 1 : val;
 }
 function writeHighWaterMark(dir, value) {
-  writeFileSync(join3(dir, ".highwatermark"), String(value));
+  writeFileSync(join2(dir, ".highwatermark"), String(value));
 }
 function getFileMtimeMs(path) {
   try {
@@ -518,9 +520,9 @@ var init_sync_utils = __esm(() => {
 
 // src/lib/config.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { dirname, join as join4 } from "path";
+import { dirname, join as join3 } from "path";
 function getConfigPath() {
-  return join4(getTodosGlobalDir(), "config.json");
+  return join3(getTodosGlobalDir(), "config.json");
 }
 function normalizeAgent(agent) {
   return agent.trim().toLowerCase();
@@ -571,21 +573,6 @@ function normalizeApiUrl(value) {
     return null;
   return trimmed.replace(/\/+$/, "");
 }
-function getLocalApiConfig(env = process.env) {
-  const config = loadConfig();
-  const envApiUrl = normalizeApiUrl(env["TODOS_URL"]);
-  const configApiUrl = normalizeApiUrl(config.apiUrl);
-  const apiUrl = envApiUrl ?? configApiUrl;
-  const apiKey = env["TODOS_API_KEY"] || config.apiKey || null;
-  return {
-    apiUrl,
-    apiKey,
-    source: {
-      apiUrl: envApiUrl ? "TODOS_URL" : configApiUrl ? "config" : "none",
-      apiKey: env["TODOS_API_KEY"] ? "TODOS_API_KEY" : config.apiKey ? "config" : "none"
-    }
-  };
-}
 function getSyncAgentsFromConfig() {
   const config = loadConfig();
   const agents = config.sync_agents;
@@ -6108,6 +6095,171 @@ class SqliteTodosTaskManifestBackend {
   }
 }
 
+// src/storage/machine-registry.ts
+import { randomUUID } from "crypto";
+import { isDeepStrictEqual } from "util";
+class MachineRegistryError extends Error {
+  status;
+  constructor(message, status = 409) {
+    super(message);
+    this.status = status;
+  }
+}
+var fields = new Set(["id", "name", "hostname", "platform", "last_seen_at", "metadata", "created_at", "ssh_address", "is_primary", "archived_at"]);
+function validateMachines(value) {
+  if (!Array.isArray(value) || value.length > 1e4)
+    throw new MachineRegistryError("machines must be an array of at most 10000 complete records", 400);
+  for (const row of value) {
+    if (!row || typeof row !== "object" || Array.isArray(row) || Object.keys(row).some((key2) => !fields.has(key2)))
+      throw new MachineRegistryError("Invalid machine record fields", 400);
+    for (const key2 of ["id", "name", "last_seen_at", "created_at"])
+      if (typeof row[key2] !== "string" || !row[key2].trim() || row[key2].length > 1024)
+        throw new MachineRegistryError(`Invalid machine ${key2}`, 400);
+    for (const key2 of ["hostname", "platform", "ssh_address", "archived_at"])
+      if (row[key2] !== null && typeof row[key2] !== "string")
+        throw new MachineRegistryError(`Invalid machine ${key2}`, 400);
+    for (const key2 of ["last_seen_at", "created_at", "archived_at"])
+      if (row[key2] !== null && !Number.isFinite(Date.parse(row[key2])))
+        throw new MachineRegistryError(`Invalid machine ${key2}`, 400);
+    if (typeof row.is_primary !== "boolean" || !row.metadata || typeof row.metadata !== "object" || Array.isArray(row.metadata))
+      throw new MachineRegistryError("Invalid machine flags or metadata", 400);
+    if (!isDeepStrictEqual(JSON.parse(JSON.stringify(row.metadata)), row.metadata))
+      throw new MachineRegistryError("Machine metadata must preserve JSON values exactly", 400);
+    if (JSON.stringify(row.metadata).length > 262144)
+      throw new MachineRegistryError("Machine metadata is too large", 400);
+    if (row.is_primary && row.archived_at !== null)
+      throw new MachineRegistryError("An archived machine cannot be primary", 400);
+  }
+  return value;
+}
+function planMachineImport(existing, incoming) {
+  const rows = validateMachines(incoming);
+  const byId = new Map(existing.map((row) => [row.id, row]));
+  const byName = new Map(existing.map((row) => [row.name, row.id]));
+  const insert = [];
+  let skipped = 0;
+  for (const row of rows) {
+    const prior = byId.get(row.id);
+    if (prior && !isDeepStrictEqual(prior, row))
+      throw new MachineRegistryError("Machine migration conflicts with an existing identity; reconcile before retrying");
+    if (byName.has(row.name) && byName.get(row.name) !== row.id)
+      throw new MachineRegistryError("Machine name belongs to a different identity; migration was not applied");
+    if (prior)
+      skipped++;
+    else {
+      insert.push(row);
+      byId.set(row.id, row);
+      byName.set(row.name, row.id);
+    }
+  }
+  if ([...byId.values()].filter((row) => row.is_primary).length > 1)
+    throw new MachineRegistryError("Machine migration would create multiple primary machines");
+  return { rows: insert, skipped };
+}
+function createPostgresMachineRegistry(client, service, table, ensure) {
+  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(table))
+    throw new Error("Invalid machine registry table");
+  async function list(connection = client) {
+    await ensure();
+    const result = await connection.query(`SELECT payload FROM ${table} WHERE service=$1 AND object_type='machines' AND deleted_at IS NULL ORDER BY object_id`, [service]);
+    return validateMachines(result.rows.map((row) => typeof row.payload === "string" ? JSON.parse(row.payload) : row.payload));
+  }
+  return { list, async execute(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input) || !["register", "heartbeat", "set-primary", "archive", "unarchive", "delete", "import"].includes(input.action))
+      throw new MachineRegistryError("Invalid machine operation", 400);
+    if (Object.keys(input).some((key2) => !["action", "name", "id", "options", "machines"].includes(key2)))
+      throw new MachineRegistryError("Unknown machine operation fields", 400);
+    if (input.options !== undefined && (!input.options || typeof input.options !== "object" || Array.isArray(input.options)))
+      throw new MachineRegistryError("Invalid machine options", 400);
+    await ensure();
+    if (!client.transaction)
+      throw new MachineRegistryError("Machine registry requires a transactional server backend", 501);
+    return client.transaction(async (tx) => {
+      await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${service}:machine-registry`]);
+      const current = await list(tx);
+      let changed = [];
+      let skipped = 0;
+      let machine;
+      let deleted;
+      const stamp = new Date().toISOString();
+      if (input.action === "import") {
+        const plan = planMachineImport(current, input.machines);
+        const ids = plan.rows.map((row) => row.id);
+        if (ids.length) {
+          const retired = await tx.query(`SELECT object_id FROM ${table} WHERE service=$1 AND object_type='machines' AND object_id IN (SELECT jsonb_array_elements_text($2::text::jsonb)) AND deleted_at IS NOT NULL`, [service, JSON.stringify(ids)]);
+          if (retired.rows.length)
+            throw new MachineRegistryError("Machine migration contains a retired identity");
+        }
+        changed = plan.rows;
+        skipped = plan.skipped;
+      } else {
+        if (typeof input.name !== "string" || !input.name.trim() || input.name.length > 1024)
+          throw new MachineRegistryError("Machine name or ID is required", 400);
+        const matches = current.filter((row) => row.name === input.name || row.id === input.name);
+        if (matches.length > 1)
+          throw new MachineRegistryError("Machine selector is ambiguous between a name and another identity; use an unambiguous selector");
+        const prior = matches[0];
+        if (input.action === "register" || input.action === "heartbeat") {
+          const opts = input.options ?? {};
+          const allowed = new Set(["hostname", "platform", "ssh_address", "primary", "tailscale_name", "tailscale_ip", "lan_address", "workspace_path", "git_root", "arch"]);
+          for (const [key2, value] of Object.entries(opts)) {
+            if (!allowed.has(key2) || (key2 === "primary" ? typeof value !== "boolean" : typeof value !== "string" || value.length > 4096))
+              throw new MachineRegistryError("Invalid machine registration options", 400);
+          }
+          if (input.id !== undefined && (typeof input.id !== "string" || !input.id.trim() || input.id.length > 1024))
+            throw new MachineRegistryError("Invalid stable machine ID", 400);
+          if (prior && input.id && input.id !== prior.id)
+            throw new MachineRegistryError("Machine registration ID does not match existing identity");
+          if (!prior && input.id && current.some((row) => row.id === input.id))
+            throw new MachineRegistryError("Machine ID already belongs to another name");
+          const metadata = { ...prior?.metadata };
+          for (const key2 of ["tailscale_name", "tailscale_ip", "lan_address", "workspace_path", "git_root", "arch"])
+            if (opts[key2] !== undefined)
+              metadata[key2] = opts[key2];
+          if (!prior && input.id) {
+            const retired = await tx.query(`SELECT object_id FROM ${table} WHERE service=$1 AND object_type='machines' AND object_id=$2 AND deleted_at IS NOT NULL`, [service, input.id]);
+            if (retired.rows.length)
+              throw new MachineRegistryError("Machine identity has been retired");
+          }
+          machine = { id: prior?.id ?? input.id ?? randomUUID(), name: prior?.name ?? input.name, hostname: opts.hostname ?? prior?.hostname ?? null, platform: opts.platform ?? prior?.platform ?? null, ssh_address: opts.ssh_address ?? prior?.ssh_address ?? null, created_at: prior?.created_at ?? stamp, last_seen_at: stamp, archived_at: prior?.archived_at ?? null, is_primary: opts.primary === true || (prior?.is_primary ?? false), metadata };
+          if (machine.archived_at && machine.is_primary)
+            throw new MachineRegistryError("Cannot set archived machine as primary");
+          changed = [machine];
+          if (opts.primary === true)
+            changed.push(...current.filter((row) => row.is_primary && row.id !== machine.id).map((row) => ({ ...row, is_primary: false })));
+        } else {
+          if (!prior)
+            throw new MachineRegistryError("Machine not found", 404);
+          machine = { ...prior };
+          if (input.action === "set-primary") {
+            if (prior.archived_at)
+              throw new MachineRegistryError("Cannot set archived machine as primary");
+            machine.is_primary = true;
+            changed = current.filter((row) => row.is_primary && row.id !== prior.id).map((row) => ({ ...row, is_primary: false }));
+          } else if (input.action === "archive" || input.action === "delete") {
+            if (prior.is_primary)
+              throw new MachineRegistryError("Cannot archive or delete the primary machine");
+            const refs = await tx.query(`SELECT object_id FROM ${table} WHERE service=$1 AND object_type<>'machines' AND deleted_at IS NULL AND payload->>'machine_id'=$2 AND ($3='delete' OR (object_type='tasks' AND payload->>'status' IN ('pending','in_progress'))) LIMIT 1`, [service, prior.id, input.action]);
+            if (refs.rows.length)
+              throw new MachineRegistryError("Machine still has referenced records or active tasks");
+            machine.archived_at = stamp;
+            deleted = input.action === "delete" ? true : undefined;
+          } else if (input.action === "unarchive")
+            machine.archived_at = null;
+          else
+            throw new MachineRegistryError("Unknown machine action", 400);
+          changed.push(machine);
+        }
+      }
+      for (const row of changed) {
+        await tx.query(`INSERT INTO ${table} (service,object_type,object_id,payload,updated_at,deleted_at,version) VALUES ($1,'machines',$2,$3::text::jsonb,$4,$5,1) ON CONFLICT (service,object_type,object_id) DO UPDATE SET payload=EXCLUDED.payload,updated_at=EXCLUDED.updated_at,deleted_at=EXCLUDED.deleted_at,version=COALESCE(${table}.version,0)+1`, [service, row.id, JSON.stringify(row), stamp, deleted && row.id === machine?.id ? stamp : null]);
+      }
+      const machines = await list(tx);
+      return { schema_version: 2, machines, ...machine ? { machine } : {}, inserted: changed.filter((row) => !current.some((old) => old.id === row.id)).length, skipped, ...deleted ? { deleted } : {} };
+    });
+  } };
+}
+
 // src/storage/postgres-sync.ts
 init_types();
 
@@ -6330,6 +6482,10 @@ class PostgresTodosSyncStore {
     }
   }
   async pushSnapshot(snapshot, context = {}) {
+    if ((snapshot.tombstones ?? []).some((row) => row.object_type === "machines"))
+      throw new Error("Machine tombstones require explicit registry lifecycle operations");
+    if (snapshot.machines !== undefined)
+      validateMachines(snapshot.machines);
     const routingErrors = validateSnapshotRoutingRecords(snapshot.projects, snapshot.taskLists);
     if (routingErrors.length > 0) {
       throw new Error(`Invalid snapshot routing metadata: ${routingErrors.join("; ")}`);
@@ -6352,6 +6508,14 @@ class PostgresTodosSyncStore {
         throw new ResourceConflictError("SNAPSHOT_DESTINATION_CONFLICT", `Snapshot routing conflicts with destination: ${destinationErrors.join("; ")}`);
       }
       const result = { records: 0, objectTypes: {} };
+      if (snapshot.machines?.length) {
+        if (!this.client.transaction)
+          throw new Error("Machine snapshot migration requires transaction(callback)");
+        const registry = createPostgresMachineRegistry({ query: client.query.bind(client), transaction: (fn) => fn(client) }, this.service, this.tableName, async () => {});
+        const receipt = await registry.execute({ action: "import", machines: snapshot.machines });
+        result.records += receipt.inserted + receipt.skipped;
+        result.objectTypes.machines = receipt.inserted + receipt.skipped;
+      }
       const sourceMachineId = context.requestId ?? this.sourceMachineId ?? null;
       for (const entry of snapshotEntries(snapshot)) {
         if (entry.deletedAt === null)
@@ -6515,6 +6679,7 @@ function rowsToSnapshot(rows) {
     tasks: [],
     projects: [],
     projectMachinePaths: [],
+    machines: [],
     plans: [],
     agents: [],
     taskLists: [],
@@ -6526,6 +6691,12 @@ function rowsToSnapshot(rows) {
   for (const row of rows) {
     const payload = payloadRecord(row.payload);
     const deletedAt = stringValue(row.deleted_at);
+    if (row.object_type === "machines") {
+      if (deletedAt)
+        throw new Error("Snapshot contains retired machine identities; use the authoritative registry instead of silently discarding tombstones");
+      snapshot.machines.push(payload);
+      continue;
+    }
     if (deletedAt) {
       snapshot.tombstones ??= [];
       snapshot.tombstones.push({