@nylorun/runtime 0.8.0-beta → 0.10.0-beta

package/dist/tenant/module.js

@@ -0,0 +1,315 @@
+import { existsSync } from "node:fs";
+import { isTenantId } from "@nylorun/core/compatibility";
+import { TENANT_SCHEMA_VERSION } from "./schema.js";
+import { envelopeNow } from "./envelope.js";
+import { tenantPaths } from "./paths.js";
+import { mapPool, TimeoutError, withTimeout } from "./pool.js";
+import { asQuarantine, isQuarantineError, quarantine, TenantBusyError, TenantConflictError, } from "./quarantine.js";
+const OPEN_CONCURRENCY = 4;
+const OPEN_TIMEOUT_MS = 30_000;
+function hasLiveWork(summary) {
+    return (summary.runningSessions > 0 ||
+        summary.connectedExecutors > 0 ||
+        summary.pendingActions > 0);
+}
+function toAdmin(id, entry, envelope) {
+    if (!entry) {
+        return {
+            id,
+            name: envelope?.name ?? null,
+            state: "quarantined",
+            envelope,
+        };
+    }
+    if (entry.kind === "open") {
+        return {
+            id,
+            name: entry.handle.envelope.name,
+            state: "open",
+            envelope: entry.handle.envelope,
+        };
+    }
+    return {
+        id,
+        name: envelope?.name ?? null,
+        state: "quarantined",
+        envelope,
+    };
+}
+/**
+ * Deep Tenant module (§8). Discovery, create, resolve, list, delete and
+ * summarize. Storage and Tenant Runtime are injected so WS-B tests without WS-A.
+ */
+export function createTenantModule(options) {
+    const { hostRoot, store, logger, openConcurrency = OPEN_CONCURRENCY, openTimeoutMs = OPEN_TIMEOUT_MS, } = options;
+    // openRuntime / configFor are consumed by the store; kept on options for B1.
+    void options.openRuntime;
+    void options.configFor;
+    const entries = new Map();
+    let started = false;
+    let closed = false;
+    function rememberOpen(handle) {
+        entries.set(handle.envelope.id, { kind: "open", handle });
+    }
+    function rememberQuarantine(id, q) {
+        entries.set(id, { kind: "quarantined", quarantine: q });
+        logger.warn("tenant quarantined", {
+            tenantId: id,
+            code: q.code,
+            repair: q.repair,
+        });
+    }
+    async function openOne(id) {
+        const existing = entries.get(id);
+        if (existing?.kind === "open")
+            return;
+        try {
+            const handle = await withTimeout(store.open(id), openTimeoutMs, (late) => {
+                void late
+                    .then((h) => h.close())
+                    .catch(() => undefined);
+            });
+            rememberOpen(handle);
+        }
+        catch (error) {
+            if (error instanceof TimeoutError) {
+                rememberQuarantine(id, quarantine("open-timeout", `open timed out after ${openTimeoutMs}ms`, {
+                    tenantId: id,
+                }).toQuarantine());
+                return;
+            }
+            const q = asQuarantine(error);
+            if (q) {
+                rememberQuarantine(id, q);
+                return;
+            }
+            rememberQuarantine(id, quarantine("open-failed", error instanceof Error ? error.message : "open failed", { tenantId: id }).toQuarantine());
+        }
+    }
+    async function discoverId(id) {
+        if (entries.has(id))
+            return entries.get(id);
+        const paths = tenantPaths(hostRoot, id);
+        if (!existsSync(paths.root))
+            return undefined;
+        await openOne(id);
+        return entries.get(id);
+    }
+    const module = {
+        get started() {
+            return started;
+        },
+        async start() {
+            if (closed)
+                throw new Error("Tenant module is closed");
+            const ids = await store.enumerate();
+            await mapPool(ids, openConcurrency, async (id) => {
+                await openOne(id);
+            });
+            started = true;
+            logger.info("tenant module started", {
+                tenants: ids.length,
+                open: [...entries.values()].filter((e) => e.kind === "open").length,
+                quarantined: [...entries.values()].filter((e) => e.kind === "quarantined").length,
+            });
+        },
+        resolve(id) {
+            if (!isTenantId(id))
+                return { kind: "not-found" };
+            const entry = entries.get(id);
+            if (!entry) {
+                // Sync miss: existence check only (disk I/O allowed on miss). Full open
+                // happens on list()/status()/create(); Host sees opaque not-found until then.
+                try {
+                    const paths = tenantPaths(hostRoot, id);
+                    if (!existsSync(paths.root))
+                        return { kind: "not-found" };
+                }
+                catch {
+                    return { kind: "not-found" };
+                }
+                return { kind: "not-found" };
+            }
+            if (entry.kind === "open") {
+                return { kind: "open", handle: entry.handle };
+            }
+            return { kind: "quarantined", quarantine: entry.quarantine };
+        },
+        async create(input) {
+            if (!isTenantId(input.tenantId)) {
+                throw new Error(`Invalid tenant id: ${input.tenantId}`);
+            }
+            const bootstrap = {
+                principalId: input.principalId,
+                credentialHash: input.credentialHash,
+                idempotencyKey: input.idempotencyKey,
+            };
+            const envelope = envelopeNow({
+                id: input.tenantId,
+                name: input.name,
+                schemaVersion: TENANT_SCHEMA_VERSION,
+            });
+            let outcome;
+            try {
+                outcome = await store.create(envelope, bootstrap);
+            }
+            catch (error) {
+                await store.removePartial(input.tenantId).catch(() => undefined);
+                throw error;
+            }
+            if (outcome === "exists") {
+                const matches = await store.bootstrapMatches(input.tenantId, bootstrap);
+                if (!matches)
+                    throw new TenantConflictError();
+                const existing = await store.readEnvelope(input.tenantId);
+                const entry = entries.get(input.tenantId);
+                if (!entry || entry.kind !== "open") {
+                    await openOne(input.tenantId);
+                }
+                return { envelope: existing, created: false };
+            }
+            await openOne(input.tenantId);
+            const opened = entries.get(input.tenantId);
+            if (opened?.kind === "open") {
+                return { envelope: opened.handle.envelope, created: true };
+            }
+            // Created on disk but failed to open — still report the written envelope.
+            return { envelope, created: true };
+        },
+        async list() {
+            const ids = new Set(await store.enumerate());
+            for (const id of entries.keys())
+                ids.add(id);
+            const result = [];
+            for (const id of ids) {
+                if (!isTenantId(id))
+                    continue;
+                let entry = entries.get(id);
+                if (!entry) {
+                    await openOne(id);
+                    entry = entries.get(id);
+                }
+                let envelope = null;
+                try {
+                    envelope = await store.readEnvelope(id);
+                    if (envelope.id !== id) {
+                        rememberQuarantine(id, quarantine("envelope-invalid", `tenant.json id ${envelope.id} does not match directory ${id}`, { tenantId: id }).toQuarantine());
+                        entry = entries.get(id);
+                        envelope = null;
+                    }
+                }
+                catch (error) {
+                    const q = asQuarantine(error);
+                    if (q) {
+                        rememberQuarantine(id, q);
+                        entry = entries.get(id);
+                    }
+                    else {
+                        rememberQuarantine(id, quarantine("envelope-invalid", "tenant.json is unreadable", { tenantId: id }).toQuarantine());
+                        entry = entries.get(id);
+                    }
+                    envelope = null;
+                }
+                result.push(toAdmin(id, entry, envelope));
+            }
+            return result;
+        },
+        async status(id) {
+            if (!isTenantId(id))
+                return undefined;
+            let entry = entries.get(id);
+            if (!entry) {
+                entry = await discoverId(id);
+                if (!entry) {
+                    // Not in memory and not on disk.
+                    const known = (await store.enumerate()).includes(id);
+                    if (!known)
+                        return undefined;
+                    await openOne(id);
+                    entry = entries.get(id);
+                }
+            }
+            if (!entry)
+                return undefined;
+            let envelope = null;
+            try {
+                envelope =
+                    entry.kind === "open"
+                        ? entry.handle.envelope
+                        : await store.readEnvelope(id);
+            }
+            catch {
+                envelope = null;
+            }
+            const base = toAdmin(id, entry, envelope);
+            if (entry.kind === "quarantined") {
+                return { ...base, quarantine: entry.quarantine };
+            }
+            return base;
+        },
+        async delete(id, activeWork) {
+            if (!isTenantId(id))
+                throw new Error(`Invalid tenant id: ${id}`);
+            let entry = entries.get(id);
+            if (!entry) {
+                await discoverId(id);
+                entry = entries.get(id);
+            }
+            if (!entry) {
+                // Still on disk without an entry?
+                const ids = await store.enumerate();
+                if (!ids.includes(id)) {
+                    throw quarantine("open-failed", `Tenant ${id} not found`, {
+                        tenantId: id,
+                    });
+                }
+                await openOne(id);
+                entry = entries.get(id);
+            }
+            if (entry?.kind === "open") {
+                const summary = entry.handle.summary();
+                if (activeWork === "refuse" && hasLiveWork(summary)) {
+                    throw new TenantBusyError();
+                }
+                if (activeWork === "drain" || activeWork === "cancel") {
+                    await entry.handle.drain(activeWork);
+                }
+                // Sandbox prefix cleanup is owned by TenantHandle.close() (WS-A).
+                await entry.handle.close();
+            }
+            await store.trash(id, new Date());
+            entries.delete(id);
+            logger.info("tenant deleted", { tenantId: id, activeWork });
+        },
+        summarize() {
+            let runningSessions = 0;
+            let connectedExecutors = 0;
+            let pendingActions = 0;
+            let uncertainEffects = 0;
+            for (const entry of entries.values()) {
+                if (entry.kind !== "open")
+                    continue;
+                const s = entry.handle.summary();
+                runningSessions += s.runningSessions;
+                connectedExecutors += s.connectedExecutors;
+                pendingActions += s.pendingActions;
+                uncertainEffects += s.uncertainEffects;
+            }
+            return {
+                runningSessions,
+                connectedExecutors,
+                pendingActions,
+                uncertainEffects,
+            };
+        },
+        async close() {
+            closed = true;
+            started = false;
+            const open = [...entries.values()].filter((e) => e.kind === "open");
+            await Promise.all(open.map((e) => e.handle.close().catch(() => undefined)));
+            entries.clear();
+        },
+    };
+    return module;
+}
+export { TenantBusyError, TenantConflictError, isQuarantineError, quarantine, };

package/dist/tenant/paths.d.ts

@@ -0,0 +1,24 @@
+import type { TenantPaths } from "./types.js";
+export interface HostPaths {
+    root: string;
+    config: string;
+    state: string;
+    credentials: string;
+    log: string;
+    home: string;
+    tmp: string;
+    runtime: string;
+    tenants: string;
+    trash: string;
+}
+/** Host layout under NYLORUN_HOME / ~/.nylorun. */
+export declare function hostPaths(hostRoot: string): HostPaths;
+/**
+ * Absolute Tenant paths under `<hostRoot>/tenants/<tenantId>/`.
+ * Validates the id and asserts containment after realpath.
+ *
+ * Basenames frozen here for Wave 0 (design Rev 3 absent):
+ * `tenant.json`, `tenant.sqlite`, `.runtime-lock`, `vault-kek`,
+ * `home/`, `tmp/`, `.migration/`, `sandboxes/`, `plugin-data/`, `logs/tenant.log`.
+ */
+export declare function tenantPaths(hostRoot: string, tenantId: string): TenantPaths;

package/dist/tenant/paths.js

@@ -0,0 +1,65 @@
+import { existsSync, mkdirSync, realpathSync } from "node:fs";
+import { join, resolve, sep } from "node:path";
+import { isTenantId } from "@nylorun/core/compatibility";
+function ensureDir(path) {
+    mkdirSync(path, { recursive: true });
+    return realpathSync(path);
+}
+function assertContained(parent, child) {
+    const root = parent.endsWith(sep) ? parent : parent + sep;
+    if (child !== parent && !child.startsWith(root)) {
+        throw new Error(`Path ${child} escapes host tenants root ${parent}`);
+    }
+}
+/** Host layout under NYLORUN_HOME / ~/.nylorun. */
+export function hostPaths(hostRoot) {
+    const root = resolve(hostRoot);
+    return {
+        root,
+        config: join(root, "host.json"),
+        state: join(root, "host-state.json"),
+        credentials: join(root, "host-credentials.json"),
+        log: join(root, "runtime.log"),
+        home: join(root, "home"),
+        tmp: join(root, "tmp"),
+        runtime: join(root, "runtime"),
+        tenants: join(root, "tenants"),
+        trash: join(root, "trash"),
+    };
+}
+/**
+ * Absolute Tenant paths under `<hostRoot>/tenants/<tenantId>/`.
+ * Validates the id and asserts containment after realpath.
+ *
+ * Basenames frozen here for Wave 0 (design Rev 3 absent):
+ * `tenant.json`, `tenant.sqlite`, `.runtime-lock`, `vault-kek`,
+ * `home/`, `tmp/`, `.migration/`, `sandboxes/`, `plugin-data/`, `logs/tenant.log`.
+ */
+export function tenantPaths(hostRoot, tenantId) {
+    if (!isTenantId(tenantId)) {
+        throw new Error(`Invalid tenant id: ${String(tenantId)}`);
+    }
+    const host = hostPaths(hostRoot);
+    const tenantsRoot = ensureDir(host.tenants);
+    const root = join(tenantsRoot, tenantId);
+    // Containment before the Tenant directory exists: resolve under real tenants root.
+    const resolvedRoot = resolve(tenantsRoot, tenantId);
+    assertContained(tenantsRoot, resolvedRoot);
+    if (existsSync(root)) {
+        assertContained(tenantsRoot, realpathSync(root));
+    }
+    return {
+        root: resolvedRoot,
+        envelope: join(resolvedRoot, "tenant.json"),
+        database: join(resolvedRoot, "tenant.sqlite"),
+        lock: join(resolvedRoot, ".runtime-lock"),
+        kek: join(resolvedRoot, "vault-kek"),
+        home: join(resolvedRoot, "home"),
+        tmp: join(resolvedRoot, "tmp"),
+        migration: join(resolvedRoot, ".migration"),
+        sandboxes: join(resolvedRoot, "sandboxes"),
+        pluginData: join(resolvedRoot, "plugin-data"),
+        logs: join(resolvedRoot, "logs"),
+        log: join(resolvedRoot, "logs", "tenant.log"),
+    };
+}

package/dist/tenant/pool.d.ts

@@ -0,0 +1,10 @@
+/** Run async work over items with a fixed concurrency limit. */
+export declare function mapPool<T, R>(items: readonly T[], concurrency: number, worker: (item: T, index: number) => Promise<R>): Promise<R[]>;
+export declare class TimeoutError extends Error {
+    constructor(message?: string);
+}
+/**
+ * Race a promise against a timeout. On timeout the late result is handed to
+ * `onLate` (Risk R6: mark quarantined and close a late handle).
+ */
+export declare function withTimeout<T>(promise: Promise<T>, timeoutMs: number, onLate?: (late: Promise<T>) => void): Promise<T>;

package/dist/tenant/pool.js

@@ -0,0 +1,54 @@
+/** Run async work over items with a fixed concurrency limit. */
+export async function mapPool(items, concurrency, worker) {
+    if (items.length === 0)
+        return [];
+    const limit = Math.max(1, Math.min(concurrency, items.length));
+    const results = new Array(items.length);
+    let next = 0;
+    async function run() {
+        for (;;) {
+            const index = next++;
+            if (index >= items.length)
+                return;
+            results[index] = await worker(items[index], index);
+        }
+    }
+    await Promise.all(Array.from({ length: limit }, () => run()));
+    return results;
+}
+export class TimeoutError extends Error {
+    constructor(message = "operation timed out") {
+        super(message);
+        this.name = "TimeoutError";
+    }
+}
+/**
+ * Race a promise against a timeout. On timeout the late result is handed to
+ * `onLate` (Risk R6: mark quarantined and close a late handle).
+ */
+export async function withTimeout(promise, timeoutMs, onLate) {
+    let timer;
+    let timedOut = false;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            timedOut = true;
+            reject(new TimeoutError(`timed out after ${timeoutMs}ms`));
+        }, timeoutMs);
+    });
+    try {
+        const result = await Promise.race([promise, timeout]);
+        return result;
+    }
+    catch (error) {
+        if (timedOut && onLate) {
+            onLate(promise.then((value) => value, (lateError) => {
+                throw lateError;
+            }));
+        }
+        throw error;
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}

package/dist/tenant/principals.d.ts

@@ -0,0 +1,17 @@
+import type { DatabaseSync } from "node:sqlite";
+import type { BootstrapPrincipal } from "./types.js";
+export interface PrincipalRow {
+    id: string;
+    role: "application";
+    tokenHash: string;
+    idempotencyKey: string | null;
+    createdAt: string;
+}
+/**
+ * Writes the application principal and idempotency key in one transaction.
+ * Exported for WS-B's `TenantStore.create` (A3).
+ */
+export declare function bootstrapPrincipal(db: DatabaseSync, bootstrap: BootstrapPrincipal): void;
+export declare function findPrincipalByTokenHash(db: DatabaseSync, tokenHash: string): PrincipalRow | undefined;
+export declare function applicationTokenHashes(db: DatabaseSync): readonly string[];
+export declare function isApplicationTokenHash(db: DatabaseSync, tokenHash: string): boolean;

package/dist/tenant/principals.js

@@ -0,0 +1,44 @@
+/**
+ * Writes the application principal and idempotency key in one transaction.
+ * Exported for WS-B's `TenantStore.create` (A3).
+ */
+export function bootstrapPrincipal(db, bootstrap) {
+    const now = new Date().toISOString();
+    db.exec("BEGIN IMMEDIATE");
+    try {
+        db.prepare(`INSERT INTO principals(id, role, token_hash, idempotency_key, created_at)
+       VALUES(?, 'application', ?, ?, ?)`).run(bootstrap.principalId, bootstrap.credentialHash, bootstrap.idempotencyKey, now);
+        db.exec("COMMIT");
+    }
+    catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+    }
+}
+export function findPrincipalByTokenHash(db, tokenHash) {
+    const row = db
+        .prepare(`SELECT id, role, token_hash, idempotency_key, created_at
+       FROM principals WHERE token_hash = ?`)
+        .get(tokenHash);
+    if (!row)
+        return undefined;
+    return {
+        id: String(row.id),
+        role: "application",
+        tokenHash: String(row.token_hash),
+        idempotencyKey: row.idempotency_key == null ? null : String(row.idempotency_key),
+        createdAt: String(row.created_at),
+    };
+}
+export function applicationTokenHashes(db) {
+    return db
+        .prepare(`SELECT token_hash FROM principals WHERE role = 'application'`)
+        .all()
+        .map((row) => String(row.token_hash));
+}
+export function isApplicationTokenHash(db, tokenHash) {
+    const row = db
+        .prepare(`SELECT 1 AS ok FROM principals WHERE role = 'application' AND token_hash = ?`)
+        .get(tokenHash);
+    return !!row;
+}

package/dist/tenant/quarantine-error.d.ts

@@ -0,0 +1,6 @@
+import type { Quarantine } from "./types.js";
+/** Typed quarantine raised while opening a Tenant Runtime (A7). */
+export declare class QuarantineError extends Error {
+    readonly quarantine: Quarantine;
+    constructor(code: Quarantine["code"], message: string, repair?: string, extra?: Pick<Quarantine, "lockPath" | "lockPid">);
+}

package/dist/tenant/quarantine-error.js

@@ -0,0 +1,15 @@
+/** Typed quarantine raised while opening a Tenant Runtime (A7). */
+export class QuarantineError extends Error {
+    quarantine;
+    constructor(code, message, repair = "nylorun tenant status", extra) {
+        super(message);
+        this.name = "QuarantineError";
+        this.quarantine = {
+            code,
+            message,
+            repair,
+            ...(extra?.lockPath === undefined ? {} : { lockPath: extra.lockPath }),
+            ...(extra?.lockPid === undefined ? {} : { lockPid: extra.lockPid }),
+        };
+    }
+}

package/dist/tenant/quarantine.d.ts

@@ -0,0 +1,35 @@
+import type { Quarantine } from "./types.js";
+/** Typed quarantine failure thrown by stores and migration. */
+export declare class QuarantineError extends Error implements Quarantine {
+    readonly code: Quarantine["code"];
+    readonly repair: string;
+    readonly lockPath?: string;
+    readonly lockPid?: number;
+    constructor(fields: Quarantine);
+    toQuarantine(): Quarantine;
+}
+export declare function isQuarantineError(error: unknown): error is QuarantineError;
+export declare function asQuarantine(error: unknown): Quarantine | undefined;
+/** CLI-facing repair strings for every quarantine code (B9). */
+export declare function repairFor(code: Quarantine["code"], detail?: {
+    tenantId?: string;
+    lockPath?: string;
+    lockPid?: number;
+    migrationPath?: string;
+}): string;
+export declare function quarantine(code: Quarantine["code"], message: string, detail?: {
+    tenantId?: string;
+    lockPath?: string;
+    lockPid?: number;
+    migrationPath?: string;
+}): QuarantineError;
+/** Conflict when create bootstrap material does not match an existing Tenant (HTTP 409). */
+export declare class TenantConflictError extends Error {
+    readonly statusCode: 409;
+    constructor(message?: string);
+}
+/** Delete refused because the Tenant still has live work (HTTP 409). */
+export declare class TenantBusyError extends Error {
+    readonly statusCode: 409;
+    constructor(message?: string);
+}

package/dist/tenant/quarantine.js

@@ -0,0 +1,94 @@
+/** Typed quarantine failure thrown by stores and migration. */
+export class QuarantineError extends Error {
+    code;
+    repair;
+    lockPath;
+    lockPid;
+    constructor(fields) {
+        super(fields.message);
+        this.name = "QuarantineError";
+        this.code = fields.code;
+        this.repair = fields.repair;
+        if (fields.lockPath !== undefined)
+            this.lockPath = fields.lockPath;
+        if (fields.lockPid !== undefined)
+            this.lockPid = fields.lockPid;
+    }
+    toQuarantine() {
+        return {
+            code: this.code,
+            message: this.message,
+            repair: this.repair,
+            ...(this.lockPath !== undefined ? { lockPath: this.lockPath } : {}),
+            ...(this.lockPid !== undefined ? { lockPid: this.lockPid } : {}),
+        };
+    }
+}
+export function isQuarantineError(error) {
+    return error instanceof QuarantineError;
+}
+export function asQuarantine(error) {
+    if (isQuarantineError(error))
+        return error.toQuarantine();
+    if (error &&
+        typeof error === "object" &&
+        "code" in error &&
+        "message" in error &&
+        "repair" in error) {
+        return error;
+    }
+    return undefined;
+}
+/** CLI-facing repair strings for every quarantine code (B9). */
+export function repairFor(code, detail = {}) {
+    const id = detail.tenantId ? ` ${detail.tenantId}` : "";
+    switch (code) {
+        case "locked":
+            return (`nylorun tenant status${id}` +
+                (detail.lockPath !== undefined && detail.lockPid !== undefined
+                    ? ` — stop pid ${detail.lockPid} holding ${detail.lockPath}, or remove a stale lock`
+                    : " — resolve the .runtime-lock conflict"));
+        case "kek-missing":
+            return `nylorun tenant status${id} — restore vault-kek for this Tenant (ciphertext cannot be opened without it)`;
+        case "corrupt":
+            return `nylorun tenant status${id} — repair or restore the Tenant directory from backup`;
+        case "schema-too-new":
+            return `nylorun runtime restart` +
+                `${id ? ` — Tenant${id} needs a newer Host` : " — Host schema is older than this Tenant"}`;
+        case "migration-failed":
+            return detail.migrationPath
+                ? `restore ${detail.migrationPath} over the Tenant files, then nylorun tenant status${id}`
+                : `nylorun tenant status${id} — restore from .migration/ snapshot, then retry`;
+        case "envelope-invalid":
+            return `nylorun tenant status${id} — fix or replace tenant.json so its id matches the directory name`;
+        case "open-timeout":
+            return `nylorun tenant status${id} — open timed out; inspect locks and SQLite, then retry`;
+        case "open-failed":
+            return `nylorun tenant status${id} — inspect Tenant logs and repair before the Host retries open`;
+    }
+}
+export function quarantine(code, message, detail = {}) {
+    return new QuarantineError({
+        code,
+        message,
+        repair: repairFor(code, detail),
+        ...(detail.lockPath !== undefined ? { lockPath: detail.lockPath } : {}),
+        ...(detail.lockPid !== undefined ? { lockPid: detail.lockPid } : {}),
+    });
+}
+/** Conflict when create bootstrap material does not match an existing Tenant (HTTP 409). */
+export class TenantConflictError extends Error {
+    statusCode = 409;
+    constructor(message = "Tenant already exists with different bootstrap material") {
+        super(message);
+        this.name = "TenantConflictError";
+    }
+}
+/** Delete refused because the Tenant still has live work (HTTP 409). */
+export class TenantBusyError extends Error {
+    statusCode = 409;
+    constructor(message = "Tenant has live work; pass activeWork=drain|cancel or retry later") {
+        super(message);
+        this.name = "TenantBusyError";
+    }
+}