@nylorun/runtime 0.10.0-beta → 0.12.0-beta

package/dist/tenant/model-setting.js

@@ -0,0 +1,12 @@
+export const FIXTURE_MODEL_SETTING = "model.fixture";
+/** Whether the Tenant uses the fixture model. */
+export async function usesFixtureModel(t) {
+    return (await t.getSetting(FIXTURE_MODEL_SETTING)) === "true";
+}
+/** Seeds the setting if absent. Returns whether it was inserted. */
+export async function seedFixtureModel(t) {
+    if ((await t.getSetting(FIXTURE_MODEL_SETTING)) !== undefined)
+        return false;
+    await t.putSetting(FIXTURE_MODEL_SETTING, "true");
+    return true;
+}

package/dist/tenant/module.d.ts

@@ -1,17 +1,38 @@
 import { isQuarantineError, quarantine, TenantBusyError, TenantConflictError } from "./quarantine.js";
-import type { Logger, OpenTenantRuntime, TenantConfig, TenantModule, TenantStore } from "./types.js";
+import { TenantNotFoundError, TenantUnavailableError, type Logger, type OpenTenantRuntime, type TenantConfig, type TenantModule, type TenantStore } from "./types.js";
 export interface CreateTenantModuleOptions {
-    hostRoot: string;
     store: TenantStore;
-    openRuntime: OpenTenantRuntime;
-    configFor: (tenantId: string) => TenantConfig;
+    /** Unused: the store derives paths. Accepted so callers can pass the store's options. */
+    hostRoot?: string;
+    /** Unused: the store opens Tenants. Accepted so callers can pass the store's options. */
+    openRuntime?: OpenTenantRuntime;
+    /** Unused; see `openRuntime`. */
+    configFor?: (tenantId: string) => TenantConfig;
     logger: Logger;
-    openConcurrency?: number;
+    /** Bound on one Tenant open; a slower open quarantines it with `open-timeout`. */
     openTimeoutMs?: number;
+    /**
+     * Runs after a Tenant is created in the store, before it opens: creates what lives outside
+     * it (its Durable Streams basin). A failure is logged; opening the Tenant repairs it.
+     */
+    onCreated?: (tenantId: string) => Promise<void>;
+    /**
+     * Runs after a Tenant is removed from the store: removes what lives outside it (its
+     * Durable Streams basin, its armed sweep). A failure is logged; the Tenant stays deleted.
+     */
+    onDeleted?: (tenantId: string) => Promise<void>;
 }
 /**
- * Deep Tenant module (§8). Discovery, create, resolve, list, delete and
- * summarize. Storage and Tenant Runtime are injected so WS-B tests without WS-A.
+ * Deep Tenant module (§8): discovery, create, resolve, list, delete and summarize over an
+ * injected `TenantStore`.
+ *
+ * Handles open on demand and are cached (architecture §8.2). The first call that needs a
+ * Tenant (`resolve`, `status`, `worker`, `delete`) opens it once, even when several ask at
+ * the same time; a failed open is cached as a quarantine, and a missing Tenant is not
+ * cached. A failure outside the Tenant (`TenantUnavailableError`: the database is down, its
+ * sweep could not be armed) is thrown to the caller and not cached either, so the next use
+ * tries again. A Tenant being deleted resolves as not found, so a late request or Worker
+ * call cannot reopen it while its storage is removed.
  */
 export declare function createTenantModule(options: CreateTenantModuleOptions): TenantModule;
-export { TenantBusyError, TenantConflictError, isQuarantineError, quarantine, };
+export { TenantBusyError, TenantConflictError, TenantNotFoundError, TenantUnavailableError, isQuarantineError, quarantine, };

package/dist/tenant/module.js

@@ -1,11 +1,9 @@
-import { existsSync } from "node:fs";
 import { isTenantId } from "@nylorun/core/compatibility";
-import { TENANT_SCHEMA_VERSION } from "./schema.js";
+import { POSTGRES_SCHEMA_VERSION } from "../store/postgres/migrations/index.js";
 import { envelopeNow } from "./envelope.js";
-import { tenantPaths } from "./paths.js";
-import { mapPool, TimeoutError, withTimeout } from "./pool.js";
+import { TimeoutError, withTimeout } from "./pool.js";
 import { asQuarantine, isQuarantineError, quarantine, TenantBusyError, TenantConflictError, } from "./quarantine.js";
-const OPEN_CONCURRENCY = 4;
+import { TenantNotFoundError, TenantUnavailableError, } from "./types.js";
 const OPEN_TIMEOUT_MS = 30_000;
 function hasLiveWork(summary) {
     return (summary.runningSessions > 0 ||
@@ -13,15 +11,7 @@ function hasLiveWork(summary) {
         summary.pendingActions > 0);
 }
 function toAdmin(id, entry, envelope) {
-    if (!entry) {
-        return {
-            id,
-            name: envelope?.name ?? null,
-            state: "quarantined",
-            envelope,
-        };
-    }
-    if (entry.kind === "open") {
+    if (entry?.kind === "open") {
         return {
             id,
             name: entry.handle.envelope.name,
@@ -32,69 +22,98 @@ function toAdmin(id, entry, envelope) {
     return {
         id,
         name: envelope?.name ?? null,
-        state: "quarantined",
+        state: entry ? "quarantined" : "open",
         envelope,
     };
 }
+/** The quarantine an open failure carries, from either quarantine error type. */
+function quarantineOf(error) {
+    const carried = error?.quarantine;
+    if (carried && typeof carried === "object" && "code" in carried)
+        return carried;
+    return asQuarantine(error);
+}
 /**
- * Deep Tenant module (§8). Discovery, create, resolve, list, delete and
- * summarize. Storage and Tenant Runtime are injected so WS-B tests without WS-A.
+ * Deep Tenant module (§8): discovery, create, resolve, list, delete and summarize over an
+ * injected `TenantStore`.
+ *
+ * Handles open on demand and are cached (architecture §8.2). The first call that needs a
+ * Tenant (`resolve`, `status`, `worker`, `delete`) opens it once, even when several ask at
+ * the same time; a failed open is cached as a quarantine, and a missing Tenant is not
+ * cached. A failure outside the Tenant (`TenantUnavailableError`: the database is down, its
+ * sweep could not be armed) is thrown to the caller and not cached either, so the next use
+ * tries again. A Tenant being deleted resolves as not found, so a late request or Worker
+ * call cannot reopen it while its storage is removed.
  */
 export function createTenantModule(options) {
-    const { hostRoot, store, logger, openConcurrency = OPEN_CONCURRENCY, openTimeoutMs = OPEN_TIMEOUT_MS, } = options;
-    // openRuntime / configFor are consumed by the store; kept on options for B1.
-    void options.openRuntime;
-    void options.configFor;
+    const { store, logger, openTimeoutMs = OPEN_TIMEOUT_MS } = options;
     const entries = new Map();
+    const opening = new Map();
+    const deleting = new Set();
     let started = false;
     let closed = false;
-    function rememberOpen(handle) {
-        entries.set(handle.envelope.id, { kind: "open", handle });
-    }
     function rememberQuarantine(id, q) {
-        entries.set(id, { kind: "quarantined", quarantine: q });
+        const entry = { kind: "quarantined", quarantine: q };
+        entries.set(id, entry);
         logger.warn("tenant quarantined", {
             tenantId: id,
             code: q.code,
             repair: q.repair,
         });
+        return entry;
     }
-    async function openOne(id) {
-        const existing = entries.get(id);
-        if (existing?.kind === "open")
-            return;
+    async function openEntry(id) {
+        let handle;
         try {
-            const handle = await withTimeout(store.open(id), openTimeoutMs, (late) => {
-                void late
-                    .then((h) => h.close())
-                    .catch(() => undefined);
+            handle = await withTimeout(store.open(id), openTimeoutMs, (late) => {
+                void late.then((h) => h.close()).catch(() => undefined);
             });
-            rememberOpen(handle);
         }
         catch (error) {
-            if (error instanceof TimeoutError) {
-                rememberQuarantine(id, quarantine("open-timeout", `open timed out after ${openTimeoutMs}ms`, {
+            if (error instanceof TenantNotFoundError)
+                return undefined;
+            if (closed || deleting.has(id))
+                return undefined;
+            if (error instanceof TenantUnavailableError) {
+                // Not the Tenant's fault: not cached, so the next use opens it again.
+                logger.warn("tenant unavailable", {
                     tenantId: id,
-                }).toQuarantine());
-                return;
-            }
-            const q = asQuarantine(error);
-            if (q) {
-                rememberQuarantine(id, q);
-                return;
+                    message: error.cause instanceof Error ? error.cause.message : String(error.cause),
+                });
+                throw error;
             }
-            rememberQuarantine(id, quarantine("open-failed", error instanceof Error ? error.message : "open failed", { tenantId: id }).toQuarantine());
+            if (error instanceof TimeoutError)
+                return rememberQuarantine(id, quarantine("open-timeout", `open timed out after ${openTimeoutMs}ms`, {
+                    tenantId: id,
+                }).toQuarantine());
+            return rememberQuarantine(id, quarantineOf(error) ??
+                quarantine("open-failed", error instanceof Error ? error.message : "open failed", { tenantId: id }).toQuarantine());
         }
+        if (closed || deleting.has(id)) {
+            await handle.close().catch(() => undefined);
+            return undefined;
+        }
+        const entry = { kind: "open", handle };
+        entries.set(id, entry);
+        return entry;
     }
-    async function discoverId(id) {
-        if (entries.has(id))
-            return entries.get(id);
-        const paths = tenantPaths(hostRoot, id);
-        if (!existsSync(paths.root))
+    /** The cached entry, or the result of opening the Tenant once. */
+    async function load(id) {
+        if (deleting.has(id))
             return undefined;
-        await openOne(id);
-        return entries.get(id);
+        const cached = entries.get(id);
+        if (cached)
+            return cached;
+        if (closed)
+            return undefined;
+        let pending = opening.get(id);
+        if (!pending) {
+            pending = openEntry(id).finally(() => opening.delete(id));
+            opening.set(id, pending);
+        }
+        return pending;
     }
+    const openEntries = () => [...entries.values()].filter((e) => e.kind === "open");
     const module = {
         get started() {
             return started;
@@ -103,38 +122,25 @@ export function createTenantModule(options) {
             if (closed)
                 throw new Error("Tenant module is closed");
             const ids = await store.enumerate();
-            await mapPool(ids, openConcurrency, async (id) => {
-                await openOne(id);
-            });
             started = true;
-            logger.info("tenant module started", {
-                tenants: ids.length,
-                open: [...entries.values()].filter((e) => e.kind === "open").length,
-                quarantined: [...entries.values()].filter((e) => e.kind === "quarantined").length,
-            });
+            logger.info("tenant module started", { tenants: ids.length });
         },
-        resolve(id) {
+        async resolve(id) {
             if (!isTenantId(id))
                 return { kind: "not-found" };
-            const entry = entries.get(id);
-            if (!entry) {
-                // Sync miss: existence check only (disk I/O allowed on miss). Full open
-                // happens on list()/status()/create(); Host sees opaque not-found until then.
-                try {
-                    const paths = tenantPaths(hostRoot, id);
-                    if (!existsSync(paths.root))
-                        return { kind: "not-found" };
-                }
-                catch {
-                    return { kind: "not-found" };
-                }
+            const entry = await load(id);
+            if (!entry)
                 return { kind: "not-found" };
-            }
-            if (entry.kind === "open") {
+            if (entry.kind === "open")
                 return { kind: "open", handle: entry.handle };
-            }
             return { kind: "quarantined", quarantine: entry.quarantine };
         },
+        async worker(id) {
+            if (!isTenantId(id))
+                return undefined;
+            const entry = await load(id);
+            return entry?.kind === "open" ? entry.handle.worker : undefined;
+        },
         async create(input) {
             if (!isTenantId(input.tenantId)) {
                 throw new Error(`Invalid tenant id: ${input.tenantId}`);
@@ -143,11 +149,18 @@ export function createTenantModule(options) {
                 principalId: input.principalId,
                 credentialHash: input.credentialHash,
                 idempotencyKey: input.idempotencyKey,
+                ...(input.studioCredentialHash
+                    ? { studioCredentialHash: input.studioCredentialHash }
+                    : {}),
+                ...(input.derivedPrincipals?.length
+                    ? { derivedPrincipals: input.derivedPrincipals }
+                    : {}),
             };
+            // The store records its own schema version.
             const envelope = envelopeNow({
                 id: input.tenantId,
                 name: input.name,
-                schemaVersion: TENANT_SCHEMA_VERSION,
+                schemaVersion: POSTGRES_SCHEMA_VERSION,
             });
             let outcome;
             try {
@@ -162,53 +175,63 @@ export function createTenantModule(options) {
                 if (!matches)
                     throw new TenantConflictError();
                 const existing = await store.readEnvelope(input.tenantId);
-                const entry = entries.get(input.tenantId);
-                if (!entry || entry.kind !== "open") {
-                    await openOne(input.tenantId);
-                }
+                await load(input.tenantId).catch(() => undefined);
                 return { envelope: existing, created: false };
             }
-            await openOne(input.tenantId);
-            const opened = entries.get(input.tenantId);
+            await options.onCreated?.(input.tenantId).catch((error) => logger.warn("tenant create step failed; open repairs it", {
+                tenantId: input.tenantId,
+                message: error instanceof Error ? error.message : String(error),
+            }));
+            const opened = await load(input.tenantId).catch(() => undefined);
             if (opened?.kind === "open") {
                 return { envelope: opened.handle.envelope, created: true };
             }
-            // Created on disk but failed to open — still report the written envelope.
-            return { envelope, created: true };
+            // Created but failed to open: report the stored envelope.
+            return {
+                envelope: await store
+                    .readEnvelope(input.tenantId)
+                    .catch(() => envelope),
+                created: true,
+            };
         },
         async list() {
             const ids = new Set(await store.enumerate());
             for (const id of entries.keys())
                 ids.add(id);
             const result = [];
-            for (const id of ids) {
-                if (!isTenantId(id))
+            for (const id of [...ids].sort()) {
+                if (!isTenantId(id) || deleting.has(id))
                     continue;
                 let entry = entries.get(id);
-                if (!entry) {
-                    await openOne(id);
-                    entry = entries.get(id);
+                if (entry?.kind === "open") {
+                    result.push(toAdmin(id, entry, null));
+                    continue;
                 }
                 let envelope = null;
                 try {
                     envelope = await store.readEnvelope(id);
                     if (envelope.id !== id) {
-                        rememberQuarantine(id, quarantine("envelope-invalid", `tenant.json id ${envelope.id} does not match directory ${id}`, { tenantId: id }).toQuarantine());
-                        entry = entries.get(id);
+                        entry = {
+                            kind: "quarantined",
+                            quarantine: quarantine("envelope-invalid", `Tenant envelope id ${envelope.id} does not match ${id}`, { tenantId: id }).toQuarantine(),
+                        };
                         envelope = null;
                     }
                 }
                 catch (error) {
-                    const q = asQuarantine(error);
-                    if (q) {
-                        rememberQuarantine(id, q);
-                        entry = entries.get(id);
-                    }
-                    else {
-                        rememberQuarantine(id, quarantine("envelope-invalid", "tenant.json is unreadable", { tenantId: id }).toQuarantine());
-                        entry = entries.get(id);
-                    }
-                    envelope = null;
+                    // Deleted since it was enumerated.
+                    if (error instanceof TenantNotFoundError)
+                        continue;
+                    if (error instanceof TenantUnavailableError)
+                        throw error;
+                    // Listed as quarantined; only opening it caches a quarantine.
+                    entry ??= {
+                        kind: "quarantined",
+                        quarantine: quarantineOf(error) ??
+                            quarantine("envelope-invalid", "Tenant envelope is unreadable", {
+                                tenantId: id,
+                            }).toQuarantine(),
+                    };
                 }
                 result.push(toAdmin(id, entry, envelope));
             }
@@ -217,99 +240,83 @@ export function createTenantModule(options) {
         async status(id) {
             if (!isTenantId(id))
                 return undefined;
-            let entry = entries.get(id);
-            if (!entry) {
-                entry = await discoverId(id);
-                if (!entry) {
-                    // Not in memory and not on disk.
-                    const known = (await store.enumerate()).includes(id);
-                    if (!known)
-                        return undefined;
-                    await openOne(id);
-                    entry = entries.get(id);
-                }
-            }
+            const entry = await load(id);
             if (!entry)
                 return undefined;
-            let envelope = null;
-            try {
-                envelope =
-                    entry.kind === "open"
-                        ? entry.handle.envelope
-                        : await store.readEnvelope(id);
-            }
-            catch {
-                envelope = null;
-            }
-            const base = toAdmin(id, entry, envelope);
-            if (entry.kind === "quarantined") {
-                return { ...base, quarantine: entry.quarantine };
-            }
-            return base;
+            if (entry.kind === "open")
+                return toAdmin(id, entry, null);
+            const envelope = await store.readEnvelope(id).catch(() => null);
+            return { ...toAdmin(id, entry, envelope), quarantine: entry.quarantine };
         },
         async delete(id, activeWork) {
             if (!isTenantId(id))
                 throw new Error(`Invalid tenant id: ${id}`);
-            let entry = entries.get(id);
-            if (!entry) {
-                await discoverId(id);
-                entry = entries.get(id);
-            }
-            if (!entry) {
-                // Still on disk without an entry?
-                const ids = await store.enumerate();
-                if (!ids.includes(id)) {
-                    throw quarantine("open-failed", `Tenant ${id} not found`, {
-                        tenantId: id,
-                    });
-                }
-                await openOne(id);
-                entry = entries.get(id);
-            }
-            if (entry?.kind === "open") {
-                const summary = entry.handle.summary();
+            if (deleting.has(id))
+                throw new TenantBusyError("Tenant is being deleted");
+            const entry = await load(id);
+            if (!entry)
+                throw new TenantNotFoundError(id);
+            if (entry.kind === "open") {
+                const summary = await entry.handle.summary();
                 if (activeWork === "refuse" && hasLiveWork(summary)) {
                     throw new TenantBusyError();
                 }
                 if (activeWork === "drain" || activeWork === "cancel") {
                     await entry.handle.drain(activeWork);
                 }
-                // Sandbox prefix cleanup is owned by TenantHandle.close() (WS-A).
-                await entry.handle.close();
             }
-            await store.trash(id, new Date());
-            entries.delete(id);
+            deleting.add(id);
+            try {
+                entries.delete(id);
+                // Sandbox prefix cleanup is owned by TenantHandle.close().
+                if (entry.kind === "open")
+                    await entry.handle.close();
+                await store.trash(id, new Date());
+            }
+            finally {
+                deleting.delete(id);
+            }
             logger.info("tenant deleted", { tenantId: id, activeWork });
+            await options.onDeleted?.(id).catch((error) => logger.warn("tenant delete cleanup failed", {
+                tenantId: id,
+                message: error instanceof Error ? error.message : String(error),
+            }));
         },
-        summarize() {
+        async summarize() {
             let runningSessions = 0;
             let connectedExecutors = 0;
             let pendingActions = 0;
             let uncertainEffects = 0;
-            for (const entry of entries.values()) {
-                if (entry.kind !== "open")
-                    continue;
-                const s = entry.handle.summary();
+            let outboxDepth;
+            let relayLagMs;
+            for (const s of await Promise.all(openEntries().map((e) => e.handle.summary()))) {
                 runningSessions += s.runningSessions;
                 connectedExecutors += s.connectedExecutors;
                 pendingActions += s.pendingActions;
                 uncertainEffects += s.uncertainEffects;
+                if (s.outboxDepth !== undefined)
+                    outboxDepth = (outboxDepth ?? 0) + s.outboxDepth;
+                if (s.relayLagMs !== undefined)
+                    relayLagMs = Math.max(relayLagMs ?? 0, s.relayLagMs);
             }
             return {
                 runningSessions,
                 connectedExecutors,
                 pendingActions,
                 uncertainEffects,
+                ...(outboxDepth !== undefined ? { outboxDepth } : {}),
+                ...(relayLagMs !== undefined ? { relayLagMs } : {}),
             };
         },
         async close() {
             closed = true;
             started = false;
-            const open = [...entries.values()].filter((e) => e.kind === "open");
-            await Promise.all(open.map((e) => e.handle.close().catch(() => undefined)));
+            await Promise.allSettled([...opening.values()]);
+            const open = openEntries();
             entries.clear();
+            await Promise.all(open.map((e) => e.handle.close().catch(() => undefined)));
         },
     };
     return module;
 }
-export { TenantBusyError, TenantConflictError, isQuarantineError, quarantine, };
+export { TenantBusyError, TenantConflictError, TenantNotFoundError, TenantUnavailableError, isQuarantineError, quarantine, };

package/dist/tenant/paths.d.ts

@@ -1,24 +1,28 @@
-import type { TenantPaths } from "./types.js";
+import type { Logger, TenantPaths } from "./types.js";
 export interface HostPaths {
     root: string;
     config: string;
-    state: string;
     credentials: string;
-    log: string;
     home: string;
     tmp: string;
-    runtime: string;
     tenants: string;
     trash: string;
 }
 /** Host layout under NYLORUN_HOME / ~/.nylorun. */
 export declare function hostPaths(hostRoot: string): HostPaths;
 /**
- * Absolute Tenant paths under `<hostRoot>/tenants/<tenantId>/`.
+ * Absolute Tenant directory paths under `<hostRoot>/tenants/<tenantId>/`.
  * Validates the id and asserts containment after realpath.
  *
- * Basenames frozen here for Wave 0 (design Rev 3 absent):
- * `tenant.json`, `tenant.sqlite`, `.runtime-lock`, `vault-kek`,
- * `home/`, `tmp/`, `.migration/`, `sandboxes/`, `plugin-data/`, `logs/tenant.log`.
+ * The directory holds what stays on the Host (the Tenant's data is its Postgres schema):
+ * `vault-kek`, `home/`, `tmp/`, `sandboxes/`, `plugin-data/`, `logs/tenant.log`.
  */
 export declare function tenantPaths(hostRoot: string, tenantId: string): TenantPaths;
+/**
+ * Moves every Tenant directory that holds a `tenant.sqlite` to `trash/`, logging each.
+ *
+ * Those are beta Tenants from the SQLite Runtime. They are not migrated (recreate them); a
+ * Postgres Tenant's directory never holds that file. Moving them at Host start keeps a new
+ * Postgres Tenant with the same id from sharing the old directory. Returns the moved ids.
+ */
+export declare function trashSqliteTenants(hostRoot: string, logger: Logger): string[];

package/dist/tenant/paths.js

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, realpathSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, realpathSync, renameSync, } from "node:fs";
 import { join, resolve, sep } from "node:path";
 import { isTenantId } from "@nylorun/core/compatibility";
 function ensureDir(path) {
@@ -17,23 +17,19 @@ export function hostPaths(hostRoot) {
     return {
         root,
         config: join(root, "host.json"),
-        state: join(root, "host-state.json"),
         credentials: join(root, "host-credentials.json"),
-        log: join(root, "runtime.log"),
         home: join(root, "home"),
         tmp: join(root, "tmp"),
-        runtime: join(root, "runtime"),
         tenants: join(root, "tenants"),
         trash: join(root, "trash"),
     };
 }
 /**
- * Absolute Tenant paths under `<hostRoot>/tenants/<tenantId>/`.
+ * Absolute Tenant directory paths under `<hostRoot>/tenants/<tenantId>/`.
  * Validates the id and asserts containment after realpath.
  *
- * Basenames frozen here for Wave 0 (design Rev 3 absent):
- * `tenant.json`, `tenant.sqlite`, `.runtime-lock`, `vault-kek`,
- * `home/`, `tmp/`, `.migration/`, `sandboxes/`, `plugin-data/`, `logs/tenant.log`.
+ * The directory holds what stays on the Host (the Tenant's data is its Postgres schema):
+ * `vault-kek`, `home/`, `tmp/`, `sandboxes/`, `plugin-data/`, `logs/tenant.log`.
  */
 export function tenantPaths(hostRoot, tenantId) {
     if (!isTenantId(tenantId)) {
@@ -50,16 +46,46 @@ export function tenantPaths(hostRoot, tenantId) {
     }
     return {
         root: resolvedRoot,
-        envelope: join(resolvedRoot, "tenant.json"),
-        database: join(resolvedRoot, "tenant.sqlite"),
-        lock: join(resolvedRoot, ".runtime-lock"),
         kek: join(resolvedRoot, "vault-kek"),
         home: join(resolvedRoot, "home"),
         tmp: join(resolvedRoot, "tmp"),
-        migration: join(resolvedRoot, ".migration"),
         sandboxes: join(resolvedRoot, "sandboxes"),
         pluginData: join(resolvedRoot, "plugin-data"),
         logs: join(resolvedRoot, "logs"),
         log: join(resolvedRoot, "logs", "tenant.log"),
     };
 }
+/** The database file of a Tenant from before the Postgres Session Store. */
+const SQLITE_DATABASE = "tenant.sqlite";
+/**
+ * Moves every Tenant directory that holds a `tenant.sqlite` to `trash/`, logging each.
+ *
+ * Those are beta Tenants from the SQLite Runtime. They are not migrated (recreate them); a
+ * Postgres Tenant's directory never holds that file. Moving them at Host start keeps a new
+ * Postgres Tenant with the same id from sharing the old directory. Returns the moved ids.
+ */
+export function trashSqliteTenants(hostRoot, logger) {
+    const host = hostPaths(hostRoot);
+    if (!existsSync(host.tenants))
+        return [];
+    const moved = [];
+    const stamp = new Date().toISOString().replaceAll(":", "-");
+    for (const entry of readdirSync(host.tenants, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
+        const directory = join(host.tenants, entry.name);
+        if (!existsSync(join(directory, SQLITE_DATABASE)))
+            continue;
+        mkdirSync(host.trash, { recursive: true });
+        const destination = join(host.trash, `${entry.name}-sqlite-${stamp}`);
+        renameSync(directory, destination);
+        moved.push(entry.name);
+        logger.warn("sqlite_tenant_moved_to_trash", {
+            tenant: entry.name,
+            from: directory,
+            to: destination,
+            reason: "SQLite Tenants are not migrated to the Postgres Session Store; recreate the Tenant",
+        });
+    }
+    return moved;
+}