@serve.zone/dcrouter 17.2.3 → 17.3.0

package/dist_ts_web/elements/ops-view-logs.js

@@ -34,6 +34,7 @@ var __runInitializers = (this && this.__runInitializers) || function (thisArg, i
 };
 import * as shared from './shared/index.js';
 import * as appstate from '../appstate.js';
+import './ops-platform-events.js';
 import { DeesElement, customElement, html, state, css, cssManager, } from '@design.estate/dees-element';
 let OpsViewLogs = (() => {
     let _classDecorators = [customElement('ops-view-logs')];
@@ -44,12 +45,22 @@ let OpsViewLogs = (() => {
     let _logState_decorators;
     let _logState_initializers = [];
     let _logState_extraInitializers = [];
+    let _activeTab_decorators;
+    let _activeTab_initializers = [];
+    let _activeTab_extraInitializers = [];
+    let _unacknowledgedCount_decorators;
+    let _unacknowledgedCount_initializers = [];
+    let _unacknowledgedCount_extraInitializers = [];
     var OpsViewLogs = class extends _classSuper {
         static { _classThis = this; }
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
             _logState_decorators = [state()];
+            _activeTab_decorators = [state()];
+            _unacknowledgedCount_decorators = [state()];
             __esDecorate(this, null, _logState_decorators, { kind: "accessor", name: "logState", static: false, private: false, access: { has: obj => "logState" in obj, get: obj => obj.logState, set: (obj, value) => { obj.logState = value; } }, metadata: _metadata }, _logState_initializers, _logState_extraInitializers);
+            __esDecorate(this, null, _activeTab_decorators, { kind: "accessor", name: "activeTab", static: false, private: false, access: { has: obj => "activeTab" in obj, get: obj => obj.activeTab, set: (obj, value) => { obj.activeTab = value; } }, metadata: _metadata }, _activeTab_initializers, _activeTab_extraInitializers);
+            __esDecorate(this, null, _unacknowledgedCount_decorators, { kind: "accessor", name: "unacknowledgedCount", static: false, private: false, access: { has: obj => "unacknowledgedCount" in obj, get: obj => obj.unacknowledgedCount, set: (obj, value) => { obj.unacknowledgedCount = value; } }, metadata: _metadata }, _unacknowledgedCount_initializers, _unacknowledgedCount_extraInitializers);
             __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
             OpsViewLogs = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
@@ -61,7 +72,13 @@ let OpsViewLogs = (() => {
         });
         get logState() { return this.#logState_accessor_storage; }
         set logState(value) { this.#logState_accessor_storage = value; }
-        lastPushedCount = (__runInitializers(this, _logState_extraInitializers), 0);
+        #activeTab_accessor_storage = (__runInitializers(this, _logState_extraInitializers), __runInitializers(this, _activeTab_initializers, 'application'));
+        get activeTab() { return this.#activeTab_accessor_storage; }
+        set activeTab(value) { this.#activeTab_accessor_storage = value; }
+        #unacknowledgedCount_accessor_storage = (__runInitializers(this, _activeTab_extraInitializers), __runInitializers(this, _unacknowledgedCount_initializers, 0));
+        get unacknowledgedCount() { return this.#unacknowledgedCount_accessor_storage; }
+        set unacknowledgedCount(value) { this.#unacknowledgedCount_accessor_storage = value; }
+        lastPushedCount = (__runInitializers(this, _unacknowledgedCount_extraInitializers), 0);
         constructor() {
             super();
             const subscription = appstate.logStatePart
@@ -70,27 +87,97 @@ let OpsViewLogs = (() => {
                 this.logState = logState;
             });
             this.rxSubscriptions.push(subscription);
+            const configEventSubscription = appstate.configEventStatePart
+                .select((stateArg) => stateArg)
+                .subscribe((eventState) => {
+                this.unacknowledgedCount = eventState.unacknowledgedCount;
+            });
+            this.rxSubscriptions.push(configEventSubscription);
         }
         static styles = [
             cssManager.defaultStyles,
             shared.viewHostCss,
-            css ``,
+            css `
+      .logTabs {
+        display: flex;
+        gap: 8px;
+        margin-bottom: 12px;
+      }
+
+      .logTab {
+        border: 1px solid var(--dees-color-border-default);
+        background: transparent;
+        color: var(--dees-color-text-secondary);
+        border-radius: 6px;
+        padding: 4px 12px;
+        font-size: 12px;
+        cursor: pointer;
+        transition: all 0.15s ease;
+      }
+
+      .logTab:hover {
+        background: var(--dees-color-hover);
+        color: var(--dees-color-text-primary);
+      }
+
+      .logTab.active {
+        border-color: var(--dees-color-border-strong);
+        color: var(--dees-color-text-primary);
+      }
+
+      .logTab .countBadge {
+        display: inline-block;
+        margin-left: 6px;
+        padding: 0 6px;
+        border-radius: 8px;
+        font-size: 11px;
+        font-weight: 600;
+        background: ${cssManager.bdTheme('rgba(220, 38, 38, 0.1)', 'rgba(220, 38, 38, 0.25)')};
+        color: ${cssManager.bdTheme('#dc2626', '#f87171')};
+      }
+    `,
         ];
         render() {
             return html `
       <dees-heading level="3">Logs</dees-heading>
 
-      <dees-chart-log
-        .label=${'Application Logs'}
-        .autoScroll=${true}
-        .maxEntries=${2000}
-        .showMetrics=${true}
-      ></dees-chart-log>
+      <div class="logTabs">
+        <button
+          class="logTab ${this.activeTab === 'application' ? 'active' : ''}"
+          @click=${() => this.switchTab('application')}
+        >Application Logs</button>
+        <button
+          class="logTab ${this.activeTab === 'platform' ? 'active' : ''}"
+          @click=${() => this.switchTab('platform')}
+        >Platform Events${this.unacknowledgedCount > 0 ? html `<span class="countBadge">${this.unacknowledgedCount}</span>` : ''}</button>
+      </div>
+
+      ${this.activeTab === 'application' ? html `
+        <dees-chart-log
+          .label=${'Application Logs'}
+          .autoScroll=${true}
+          .maxEntries=${2000}
+          .showMetrics=${true}
+        ></dees-chart-log>
+      ` : html `
+        <ops-platform-events></ops-platform-events>
+      `}
     `;
         }
+        switchTab(tab) {
+            if (this.activeTab === tab)
+                return;
+            this.activeTab = tab;
+            if (tab === 'application') {
+                // The chart element is recreated on tab switch; re-push everything.
+                this.lastPushedCount = 0;
+            }
+        }
         async connectedCallback() {
             super.connectedCallback();
             this.lastPushedCount = 0;
+            // Populate the platform-events badge without requiring a tab visit.
+            void appstate.configEventStatePart.dispatchAction(appstate.fetchConfigEventsAction, null);
             // Only fetch if state is empty (streaming will handle new entries)
             if (this.logState.recentLogs.length === 0) {
                 await appstate.logStatePart.dispatchAction(appstate.fetchRecentLogsAction, { limit: 100 });
@@ -156,4 +243,4 @@ let OpsViewLogs = (() => {
     return OpsViewLogs = _classThis;
 })();
 export { OpsViewLogs };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3BzLXZpZXctbG9ncy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzX3dlYi9lbGVtZW50cy9vcHMtdmlldy1sb2dzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxPQUFPLEtBQUssTUFBTSxNQUFNLG1CQUFtQixDQUFDO0FBQzVDLE9BQU8sS0FBSyxRQUFRLE1BQU0sZ0JBQWdCLENBQUM7QUFFM0MsT0FBTyxFQUNMLFdBQVcsRUFDWCxhQUFhLEVBQ2IsSUFBSSxFQUNKLEtBQUssRUFDTCxHQUFHLEVBQ0gsVUFBVSxHQUNYLE1BQU0sNkJBQTZCLENBQUM7SUFHeEIsV0FBVzs0QkFEdkIsYUFBYSxDQUFDLGVBQWUsQ0FBQzs7OztzQkFDRSxXQUFXOzs7OzJCQUFuQixTQUFRLFdBQVc7Ozs7b0NBQ3pDLEtBQUssRUFBRTtZQUNSLDZLQUFTLFFBQVEsNkJBQVIsUUFBUSwyRkFJZjtZQU5KLDZLQXNHQzs7OztRQXBHQyw2RUFBd0M7WUFDdEMsVUFBVSxFQUFFLEVBQUU7WUFDZCxXQUFXLEVBQUUsS0FBSztZQUNsQixPQUFPLEVBQUUsRUFBRTtTQUNaLEVBQUM7UUFKRixJQUFTLFFBQVEsOENBSWY7UUFKRixJQUFTLFFBQVEsb0RBSWY7UUFFTSxlQUFlLDBEQUFHLENBQUMsRUFBQztRQUU1QjtZQUNFLEtBQUssRUFBRSxDQUFDO1lBQ1IsTUFBTSxZQUFZLEdBQUcsUUFBUSxDQUFDLFlBQVk7aUJBQ3ZDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDO2lCQUM5QixTQUFTLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRTtnQkFDdEIsSUFBSSxDQUFDLFFBQVEsR0FBRyxRQUFRLENBQUM7WUFDM0IsQ0FBQyxDQUFDLENBQUM7WUFDTCxJQUFJLENBQUMsZUFBZSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUMxQyxDQUFDO1FBRU0sTUFBTSxDQUFDLE1BQU0sR0FBRztZQUNyQixVQUFVLENBQUMsYUFBYTtZQUN4QixNQUFNLENBQUMsV0FBVztZQUNsQixHQUFHLENBQUEsRUFBRTtTQUNOLENBQUM7UUFFSyxNQUFNO1lBQ1gsT0FBTyxJQUFJLENBQUE7Ozs7aUJBSUUsa0JBQWtCO3NCQUNiLElBQUk7c0JBQ0osSUFBSTt1QkFDSCxJQUFJOztLQUV0QixDQUFDO1FBQ0osQ0FBQztRQUVELEtBQUssQ0FBQyxpQkFBaUI7WUFDckIsS0FBSyxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDMUIsSUFBSSxDQUFDLGVBQWUsR0FBRyxDQUFDLENBQUM7WUFDekIsbUVBQW1FO1lBQ25FLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO2dCQUMxQyxNQUFNLFFBQVEsQ0FBQyxZQUFZLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxxQkFBcUIsRUFBRSxFQUFFLEtBQUssRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1lBQzdGLENBQUM7UUFDSCxDQUFDO1FBRUQsS0FBSyxDQUFDLE9BQU8sQ0FBQyxpQkFBbUM7WUFDL0MsS0FBSyxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1lBQ2pDLElBQUksaUJBQWlCLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7Z0JBQ3RDLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQztZQUN6QixDQUFDO1FBQ0gsQ0FBQztRQUVPLEtBQUssQ0FBQyxlQUFlO1lBQzNCLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxVQUFVLEVBQUUsYUFBYSxDQUFDLGdCQUFnQixDQUFRLENBQUM7WUFDekUsSUFBSSxDQUFDLFFBQVE7Z0JBQUUsT0FBTztZQUV0QiwrREFBK0Q7WUFDL0QsTUFBTSxRQUFRLENBQUMsY0FBYyxDQUFDO1lBRTlCLDREQUE0RDtZQUM1RCxJQUFJLENBQUMsUUFBUSxDQUFDLGFBQWEsRUFBRSxDQUFDO2dCQUM1QixNQUFNLElBQUksT0FBTyxDQUFPLENBQUMsT0FBTyxFQUFFLEVBQUU7b0JBQ2xDLElBQUksUUFBUSxHQUFHLENBQUMsQ0FBQztvQkFDakIsTUFBTSxXQUFXLEdBQUcsR0FBRyxDQUFDLENBQUMsMEJBQTBCO29CQUNuRCxNQUFNLEtBQUssR0FBRyxHQUFHLEVBQUU7d0JBQ2pCLElBQUksUUFBUSxDQUFDLGFBQWEsRUFBRSxDQUFDOzRCQUFDLE9BQU8sRUFBRSxDQUFDOzRCQUFDLE9BQU87d0JBQUMsQ0FBQzt3QkFDbEQsSUFBSSxFQUFFLFFBQVEsSUFBSSxXQUFXLEVBQUUsQ0FBQzs0QkFDOUIsT0FBTyxDQUFDLElBQUksQ0FBQyxpREFBaUQsQ0FBQyxDQUFDOzRCQUNoRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLHVDQUF1Qzs0QkFDbEQsT0FBTzt3QkFDVCxDQUFDO3dCQUNELFVBQVUsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7b0JBQ3hCLENBQUMsQ0FBQztvQkFDRixLQUFLLEVBQUUsQ0FBQztnQkFDVixDQUFDLENBQUMsQ0FBQztZQUNMLENBQUM7WUFFRCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsbUJBQW1CLEVBQUUsQ0FBQztZQUM5QyxJQUFJLElBQUksQ0FBQyxlQUFlLEtBQUssQ0FBQyxJQUFJLFVBQVUsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3hELGlDQUFpQztnQkFDakMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQztnQkFDL0IsSUFBSSxDQUFDLGVBQWUsR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDO1lBQzNDLENBQUM7aUJBQU0sSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQztnQkFDcEQscUNBQXFDO2dCQUNyQyxNQUFNLFVBQVUsR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQztnQkFDMUQsUUFBUSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQztnQkFDL0IsSUFBSSxDQUFDLGVBQWUsR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDO1lBQzNDLENBQUM7UUFDSCxDQUFDO1FBRU8sbUJBQW1CO1lBQ3pCLE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFDO2dCQUM1QyxTQUFTLEVBQUUsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDLFdBQVcsRUFBRTtnQkFDaEQsS0FBSyxFQUFFLEdBQUcsQ0FBQyxLQUE0QztnQkFDdkQsT0FBTyxFQUFFLEdBQUcsQ0FBQyxPQUFPO2dCQUNwQixNQUFNLEVBQUUsR0FBRyxDQUFDLFFBQVE7YUFDckIsQ0FBQyxDQUFDLENBQUM7UUFDTixDQUFDOztZQXBHVSx1REFBVzs7Ozs7U0FBWCxXQUFXIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3BzLXZpZXctbG9ncy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzX3dlYi9lbGVtZW50cy9vcHMtdmlldy1sb2dzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxPQUFPLEtBQUssTUFBTSxNQUFNLG1CQUFtQixDQUFDO0FBQzVDLE9BQU8sS0FBSyxRQUFRLE1BQU0sZ0JBQWdCLENBQUM7QUFDM0MsT0FBTywwQkFBMEIsQ0FBQztBQUVsQyxPQUFPLEVBQ0wsV0FBVyxFQUNYLGFBQWEsRUFDYixJQUFJLEVBQ0osS0FBSyxFQUNMLEdBQUcsRUFDSCxVQUFVLEdBQ1gsTUFBTSw2QkFBNkIsQ0FBQztJQUd4QixXQUFXOzRCQUR2QixhQUFhLENBQUMsZUFBZSxDQUFDOzs7O3NCQUNFLFdBQVc7Ozs7Ozs7Ozs7MkJBQW5CLFNBQVEsV0FBVzs7OztvQ0FDekMsS0FBSyxFQUFFO3FDQU9QLEtBQUssRUFBRTsrQ0FHUCxLQUFLLEVBQUU7WUFUUiw2S0FBUyxRQUFRLDZCQUFSLFFBQVEsMkZBSWY7WUFHRixnTEFBUyxTQUFTLDZCQUFULFNBQVMsNkZBQTZDO1lBRy9ELDhNQUFTLG1CQUFtQiw2QkFBbkIsbUJBQW1CLGlIQUFLO1lBWm5DLDZLQWtMQzs7OztRQWhMQyw2RUFBd0M7WUFDdEMsVUFBVSxFQUFFLEVBQUU7WUFDZCxXQUFXLEVBQUUsS0FBSztZQUNsQixPQUFPLEVBQUUsRUFBRTtTQUNaLEVBQUM7UUFKRixJQUFTLFFBQVEsOENBSWY7UUFKRixJQUFTLFFBQVEsb0RBSWY7UUFHRixzSUFBaUQsYUFBYSxHQUFDO1FBQS9ELElBQVMsU0FBUywrQ0FBNkM7UUFBL0QsSUFBUyxTQUFTLHFEQUE2QztRQUcvRCwySkFBK0IsQ0FBQyxHQUFDO1FBQWpDLElBQVMsbUJBQW1CLHlEQUFLO1FBQWpDLElBQVMsbUJBQW1CLCtEQUFLO1FBRXpCLGVBQWUscUVBQUcsQ0FBQyxFQUFDO1FBRTVCO1lBQ0UsS0FBSyxFQUFFLENBQUM7WUFDUixNQUFNLFlBQVksR0FBRyxRQUFRLENBQUMsWUFBWTtpQkFDdkMsTUFBTSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUM7aUJBQzlCLFNBQVMsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFO2dCQUN0QixJQUFJLENBQUMsUUFBUSxHQUFHLFFBQVEsQ0FBQztZQUMzQixDQUFDLENBQUMsQ0FBQztZQUNMLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDO1lBQ3hDLE1BQU0sdUJBQXVCLEdBQUcsUUFBUSxDQUFDLG9CQUFvQjtpQkFDMUQsTUFBTSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUM7aUJBQzlCLFNBQVMsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFO2dCQUN4QixJQUFJLENBQUMsbUJBQW1CLEdBQUcsVUFBVSxDQUFDLG1CQUFtQixDQUFDO1lBQzVELENBQUMsQ0FBQyxDQUFDO1lBQ0wsSUFBSSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsdUJBQXVCLENBQUMsQ0FBQztRQUNyRCxDQUFDO1FBRU0sTUFBTSxDQUFDLE1BQU0sR0FBRztZQUNyQixVQUFVLENBQUMsYUFBYTtZQUN4QixNQUFNLENBQUMsV0FBVztZQUNsQixHQUFHLENBQUE7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O3NCQW1DZSxVQUFVLENBQUMsT0FBTyxDQUFDLHdCQUF3QixFQUFFLHlCQUF5QixDQUFDO2lCQUM1RSxVQUFVLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUM7O0tBRXBEO1NBQ0YsQ0FBQztRQUVLLE1BQU07WUFDWCxPQUFPLElBQUksQ0FBQTs7Ozs7MEJBS1csSUFBSSxDQUFDLFNBQVMsS0FBSyxhQUFhLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRTttQkFDdkQsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUM7OzswQkFHNUIsSUFBSSxDQUFDLFNBQVMsS0FBSyxVQUFVLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRTttQkFDcEQsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUM7MEJBQ3pCLElBQUksQ0FBQyxtQkFBbUIsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQSw0QkFBNEIsSUFBSSxDQUFDLG1CQUFtQixTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUU7OztRQUd2SCxJQUFJLENBQUMsU0FBUyxLQUFLLGFBQWEsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFBOzttQkFFNUIsa0JBQWtCO3dCQUNiLElBQUk7d0JBQ0osSUFBSTt5QkFDSCxJQUFJOztPQUV0QixDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUE7O09BRVA7S0FDRixDQUFDO1FBQ0osQ0FBQztRQUVPLFNBQVMsQ0FBQyxHQUErQjtZQUMvQyxJQUFJLElBQUksQ0FBQyxTQUFTLEtBQUssR0FBRztnQkFBRSxPQUFPO1lBQ25DLElBQUksQ0FBQyxTQUFTLEdBQUcsR0FBRyxDQUFDO1lBQ3JCLElBQUksR0FBRyxLQUFLLGFBQWEsRUFBRSxDQUFDO2dCQUMxQixvRUFBb0U7Z0JBQ3BFLElBQUksQ0FBQyxlQUFlLEdBQUcsQ0FBQyxDQUFDO1lBQzNCLENBQUM7UUFDSCxDQUFDO1FBRUQsS0FBSyxDQUFDLGlCQUFpQjtZQUNyQixLQUFLLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUMxQixJQUFJLENBQUMsZUFBZSxHQUFHLENBQUMsQ0FBQztZQUN6QixvRUFBb0U7WUFDcEUsS0FBSyxRQUFRLENBQUMsb0JBQW9CLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyx1QkFBdUIsRUFBRSxJQUFJLENBQUMsQ0FBQztZQUMxRixtRUFBbUU7WUFDbkUsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQzFDLE1BQU0sUUFBUSxDQUFDLFlBQVksQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLHFCQUFxQixFQUFFLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUM7WUFDN0YsQ0FBQztRQUNILENBQUM7UUFFRCxLQUFLLENBQUMsT0FBTyxDQUFDLGlCQUFtQztZQUMvQyxLQUFLLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLENBQUM7WUFDakMsSUFBSSxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztnQkFDdEMsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1lBQ3pCLENBQUM7UUFDSCxDQUFDO1FBRU8sS0FBSyxDQUFDLGVBQWU7WUFDM0IsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFVBQVUsRUFBRSxhQUFhLENBQUMsZ0JBQWdCLENBQVEsQ0FBQztZQUN6RSxJQUFJLENBQUMsUUFBUTtnQkFBRSxPQUFPO1lBRXRCLCtEQUErRDtZQUMvRCxNQUFNLFFBQVEsQ0FBQyxjQUFjLENBQUM7WUFFOUIsNERBQTREO1lBQzVELElBQUksQ0FBQyxRQUFRLENBQUMsYUFBYSxFQUFFLENBQUM7Z0JBQzVCLE1BQU0sSUFBSSxPQUFPLENBQU8sQ0FBQyxPQUFPLEVBQUUsRUFBRTtvQkFDbEMsSUFBSSxRQUFRLEdBQUcsQ0FBQyxDQUFDO29CQUNqQixNQUFNLFdBQVcsR0FBRyxHQUFHLENBQUMsQ0FBQywwQkFBMEI7b0JBQ25ELE1BQU0sS0FBSyxHQUFHLEdBQUcsRUFBRTt3QkFDakIsSUFBSSxRQUFRLENBQUMsYUFBYSxFQUFFLENBQUM7NEJBQUMsT0FBTyxFQUFFLENBQUM7NEJBQUMsT0FBTzt3QkFBQyxDQUFDO3dCQUNsRCxJQUFJLEVBQUUsUUFBUSxJQUFJLFdBQVcsRUFBRSxDQUFDOzRCQUM5QixPQUFPLENBQUMsSUFBSSxDQUFDLGlEQUFpRCxDQUFDLENBQUM7NEJBQ2hFLE9BQU8sRUFBRSxDQUFDLENBQUMsdUNBQXVDOzRCQUNsRCxPQUFPO3dCQUNULENBQUM7d0JBQ0QsVUFBVSxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztvQkFDeEIsQ0FBQyxDQUFDO29CQUNGLEtBQUssRUFBRSxDQUFDO2dCQUNWLENBQUMsQ0FBQyxDQUFDO1lBQ0wsQ0FBQztZQUVELE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1lBQzlDLElBQUksSUFBSSxDQUFDLGVBQWUsS0FBSyxDQUFDLElBQUksVUFBVSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFDeEQsaUNBQWlDO2dCQUNqQyxRQUFRLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxDQUFDO2dCQUMvQixJQUFJLENBQUMsZUFBZSxHQUFHLFVBQVUsQ0FBQyxNQUFNLENBQUM7WUFDM0MsQ0FBQztpQkFBTSxJQUFJLFVBQVUsQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO2dCQUNwRCxxQ0FBcUM7Z0JBQ3JDLE1BQU0sVUFBVSxHQUFHLFVBQVUsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxDQUFDO2dCQUMxRCxRQUFRLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxDQUFDO2dCQUMvQixJQUFJLENBQUMsZUFBZSxHQUFHLFVBQVUsQ0FBQyxNQUFNLENBQUM7WUFDM0MsQ0FBQztRQUNILENBQUM7UUFFTyxtQkFBbUI7WUFDekIsT0FBTyxJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQzVDLFNBQVMsRUFBRSxJQUFJLElBQUksQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLENBQUMsV0FBVyxFQUFFO2dCQUNoRCxLQUFLLEVBQUUsR0FBRyxDQUFDLEtBQTRDO2dCQUN2RCxPQUFPLEVBQUUsR0FBRyxDQUFDLE9BQU87Z0JBQ3BCLE1BQU0sRUFBRSxHQUFHLENBQUMsUUFBUTthQUNyQixDQUFDLENBQUMsQ0FBQztRQUNOLENBQUM7O1lBaExVLHVEQUFXOzs7OztTQUFYLFdBQVcifQ==

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@serve.zone/dcrouter",
   "private": false,
-  "version": "17.2.3",
+  "version": "17.3.0",
   "description": "A multifaceted routing service handling mail and SMS delivery functions.",
   "type": "module",
   "bin": {
@@ -62,8 +62,8 @@
     "@push.rocks/smartunique": "^3.0.10",
     "@push.rocks/smartvpn": "1.21.0",
     "@push.rocks/taskbuffer": "^8.0.2",
-    "@serve.zone/catalog": "^2.15.0",
-    "@serve.zone/interfaces": "^16.3.0",
+    "@serve.zone/catalog": "^2.16.0",
+    "@serve.zone/interfaces": "^17.1.0",
     "@serve.zone/remoteingress": "^5.0.0",
     "@tsclass/tsclass": "^9.5.1",
     "@types/qrcode": "^1.5.6",

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '17.2.3',
+  version: '17.3.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts/classes.dcrouter.ts

@@ -25,7 +25,7 @@ import { createMigrationRunner } from '../ts_migrations/index.js';
 import { commitinfo } from './00_commitinfo_data.js';
 
 import { OpsServer } from './opsserver/index.js';
-import { MetricsManager } from './monitoring/index.js';
+import { MetricsManager, OpsEventManager } from './monitoring/index.js';
 import { RadiusServer, type IRadiusServerConfig } from './radius/index.js';
 import { RemoteIngressHubLifecycle, RemoteIngressManager, TunnelManager, buildEdgeOnlyDerivationRoutes } from './remoteingress/index.js';
 import { VpnAccessResolver, VpnManager, type IVpnManagerConfig } from './vpn/index.js';
@@ -35,6 +35,7 @@ import { SecurityLogger, ContentScanner, IPReputationChecker, SecurityPolicyMana
 import { type IHttp3Config, augmentRoutesWithHttp3 } from './http3/index.js';
 import { DnsManager } from './dns/manager.dns.js';
 import { DnsServerRuntime } from './dns/classes.dns-server-runtime.js';
+import { GatewayRouteDnsReconciler } from './dns/classes.gateway-route-dns-reconciler.js';
 import { AcmeConfigManager } from './acme/manager.acme-config.js';
 import { SmartAcmeLifecycle } from './acme/classes.smartacme-lifecycle.js';
 import { AcceptedEmailSpool, EmailDomainManager, EmailRouteBuilder, EmailSettingsManager, MailDnsSync, MailEdgeEligibility, MailEgressCoordinator, ReleasedRemoteIngressEgressIdentitySource, SmartMtaBlobStorageManager, SmartMtaStorageManager, WorkAppMailManager, type ISmartMtaBlobStorageConfig, type TSmartMtaQueueItemLike } from './email/index.js';
@@ -311,6 +312,10 @@ export class DcRouter {
 
   // Domain / DNS management (DB-backed providers, domains, records)
   public dnsManager?: DnsManager;
+  public gatewayRouteDnsReconciler?: GatewayRouteDnsReconciler;
+
+  // Durable, acknowledgeable platform configuration events (DB-backed)
+  public opsEventManager?: OpsEventManager;
 
   // ACME configuration (DB-backed singleton, replaces tls.contactEmail)
   public acmeConfigManager?: AcmeConfigManager;
@@ -464,6 +469,27 @@ export class DcRouter {
         .withRetry({ maxRetries: 1, baseDelayMs: 1000 }),
     );
 
+    // OpsEventManager: optional, depends on DcRouterDb — durable acknowledgeable
+    // platform configuration events (config conflicts, not runtime errors).
+    if (this.options.dbConfig?.enabled !== false) {
+      this.serviceManager.addService(
+        new plugins.taskbuffer.Service('OpsEventManager')
+          .optional()
+          .dependsOn('DcRouterDb')
+          .withStart(async () => {
+            this.opsEventManager = new OpsEventManager();
+            await this.opsEventManager.start();
+          })
+          .withStop(async () => {
+            if (this.opsEventManager) {
+              await this.opsEventManager.stop();
+              this.opsEventManager = undefined;
+            }
+          })
+          .withRetry({ maxRetries: 1, baseDelayMs: 500 }),
+      );
+    }
+
     // DnsManager: optional, depends on DcRouterDb — owns DB-backed DNS state
     // (providers, domains, records). Must run before SmartProxy so ACME DNS-01
     // wiring can look up providers.
@@ -727,6 +753,27 @@ export class DcRouter {
       );
     }
 
+    // Gateway route DNS reconciliation starts only after durable route config
+    // and DNS providers are available.
+    if (this.options.dbConfig?.enabled !== false) {
+      this.serviceManager.addService(
+        new plugins.taskbuffer.Service('GatewayRouteDnsReconciler')
+          .optional()
+          .dependsOn('ConfigManagers', 'DnsManager')
+          .withStart(async () => {
+            this.gatewayRouteDnsReconciler = new GatewayRouteDnsReconciler(this);
+            await this.gatewayRouteDnsReconciler.start();
+          })
+          .withStop(async () => {
+            if (this.gatewayRouteDnsReconciler) {
+              await this.gatewayRouteDnsReconciler.stop();
+              this.gatewayRouteDnsReconciler = undefined;
+            }
+          })
+          .withRetry({ maxRetries: 1, baseDelayMs: 500 }),
+      );
+    }
+
     // Email Server: optional, depends on SmartProxy and durable DB persistence.
     if (this.options.dbConfig?.enabled !== false) {
       const emailServiceDeps = ['SmartProxy', 'MetricsManager'];

package/ts/config/classes.api-token-manager.ts

@@ -3,6 +3,7 @@ import { logger } from '../logger.js';
 import { ApiTokenDoc } from '../db/index.js';
 import type {
   IApiTokenPolicy,
+  IGatewayCredentialLifecycle,
   IStoredApiToken,
   IApiTokenInfo,
   TApiTokenScope,
@@ -11,9 +12,11 @@ import type {
 const TOKEN_PREFIX_STR = 'dcr_';
 const ENV_ADMIN_TOKEN_ID = 'env-admin-token';
 const ENV_ADMIN_TOKEN_CREATED_BY = 'dcrouter-env';
+const LAST_USED_PERSIST_INTERVAL_MS = 60_000;
 
 export class ApiTokenManager {
   private tokens = new Map<string, IStoredApiToken>();
+  private lastUsedPersistedAt = new Map<string, number>();
 
   constructor() {}
 
@@ -38,6 +41,7 @@ export class ApiTokenManager {
     expiresInDays: number | null,
     createdBy: string,
     policy?: IApiTokenPolicy,
+    gatewayCredentialLifecycle: IGatewayCredentialLifecycle | null = null,
   ): Promise<{ id: string; rawToken: string }> {
     const id = plugins.uuid.v4();
     const randomBytes = plugins.crypto.randomBytes(32);
@@ -53,6 +57,7 @@ export class ApiTokenManager {
       tokenHash,
       scopes,
       policy,
+      gatewayCredentialLifecycle: this.normalizeGatewayCredentialLifecycle(gatewayCredentialLifecycle, id),
       createdAt: now,
       expiresAt: expiresInDays != null ? now + expiresInDays * 86400000 : null,
       lastUsedAt: null,
@@ -66,6 +71,33 @@ export class ApiTokenManager {
     return { id, rawToken };
   }
 
+  public async createProvisionedGatewayCredentialCandidate(
+    name: string,
+    scopes: TApiTokenScope[],
+    expiresInDays: number | null,
+    createdBy: string,
+    policy: IApiTokenPolicy,
+    credentialSequence: number,
+    policyDigest: string,
+  ): Promise<{ id: string; rawToken: string }> {
+    if (policy.role !== 'gatewayClient' || !policy.gatewayClient?.id
+      || !Number.isSafeInteger(policy.gatewayClient.policyGeneration)
+      || !Number.isSafeInteger(credentialSequence) || credentialSequence < 1
+      || !/^[a-f0-9]{64}$/.test(policyDigest)) {
+      throw new Error('Provisioned gateway credentials require a bound gateway-client policy');
+    }
+    return await this.createToken(name, scopes, expiresInDays, createdBy, policy, {
+      source: 'provisioned',
+      state: 'candidate',
+      sequence: credentialSequence,
+      policyGeneration: policy.gatewayClient.policyGeneration,
+      policyDigest,
+      finalizedAt: null,
+      cleanupCompletedAt: null,
+      revokedCredentialCount: null,
+    });
+  }
+
   /**
    * Validate a raw token string. Returns the stored token if valid, null otherwise.
    * Also updates lastUsedAt.
@@ -80,9 +112,18 @@ export class ApiTokenManager {
         if (!stored.enabled) return null;
         if (stored.expiresAt !== null && stored.expiresAt < Date.now()) return null;
 
-        // Update lastUsedAt (fire and forget)
-        stored.lastUsedAt = Date.now();
-        this.persistToken(stored).catch(() => {});
+        const now = Date.now();
+        stored.lastUsedAt = now;
+        const persistedAt = this.lastUsedPersistedAt.get(stored.id) || 0;
+        if (now - persistedAt >= LAST_USED_PERSIST_INTERVAL_MS) {
+          this.lastUsedPersistedAt.set(stored.id, now);
+          try {
+            await this.persistToken(stored);
+          } catch (error) {
+            this.lastUsedPersistedAt.set(stored.id, persistedAt);
+            throw error;
+          }
+        }
         return stored;
       }
     }
@@ -146,13 +187,148 @@ export class ApiTokenManager {
   public async revokeToken(id: string): Promise<boolean> {
     if (!this.tokens.has(id)) return false;
     const token = this.tokens.get(id)!;
-    this.tokens.delete(id);
+    // Disable durably before deletion so a failed delete cannot resurrect the
+    // credential after a restart.
+    token.enabled = false;
+    await this.persistToken(token);
     const doc = await ApiTokenDoc.findById(id);
     if (doc) await doc.delete();
+    this.tokens.delete(id);
+    this.lastUsedPersistedAt.delete(id);
     logger.log('info', `API token '${token.name}' revoked (id: ${id})`);
     return true;
   }
 
+  /** Revoke only ordinary gateway-client credentials bound to one live client. */
+  public async revokeGatewayClientCredentials(
+    gatewayClientId: string,
+    excludingTokenId?: string,
+  ): Promise<number> {
+    const ids = Array.from(this.tokens.values())
+      .filter((token) => token.id !== excludingTokenId)
+      .filter((token) => token.id !== ENV_ADMIN_TOKEN_ID)
+      .filter((token) => token.policy?.role === 'gatewayClient')
+      .filter((token) => token.policy?.gatewayClient?.id === gatewayClientId)
+      .map((token) => token.id);
+    let revoked = 0;
+    for (const id of ids) {
+      if (await this.revokeToken(id)) revoked++;
+    }
+    return revoked;
+  }
+
+  /** Revoke only older provisioned credentials during a finalized handover. */
+  public async revokeOlderProvisionedGatewayCredentials(
+    gatewayClientId: string,
+    finalizedSequence: number,
+    excludingTokenId: string,
+  ): Promise<number> {
+    if (!Number.isSafeInteger(finalizedSequence) || finalizedSequence < 1) {
+      throw new Error('Gateway credential finalization sequence is invalid');
+    }
+    const ids = Array.from(this.tokens.values())
+      .filter((token) => token.id !== excludingTokenId)
+      .filter((token) => token.policy?.role === 'gatewayClient')
+      .filter((token) => token.policy?.gatewayClient?.id === gatewayClientId)
+      .filter((token) => token.gatewayCredentialLifecycle?.source === 'provisioned')
+      .filter((token) => Number(token.gatewayCredentialLifecycle?.sequence) < finalizedSequence)
+      .map((token) => token.id);
+    let revoked = 0;
+    for (const id of ids) {
+      if (await this.revokeToken(id)) revoked++;
+    }
+    return revoked;
+  }
+
+  /** Durably activate a provisioned candidate while preserving retry identity. */
+  public async activateProvisionedGatewayCredential(
+    tokenId: string,
+    gatewayClientId: string,
+  ): Promise<{
+    finalizedAt: number;
+    wasAlreadyActive: boolean;
+    lifecycle: IGatewayCredentialLifecycle;
+  }> {
+    const token = this.tokens.get(tokenId);
+    if (!token || token.policy?.role !== 'gatewayClient'
+      || token.policy.gatewayClient?.id !== gatewayClientId) {
+      throw new Error('Provisioned gateway credential is missing or has the wrong owner');
+    }
+    const lifecycle = this.normalizeGatewayCredentialLifecycle(
+      token.gatewayCredentialLifecycle,
+      token.id,
+    );
+    if (!lifecycle) {
+      throw new Error('Manual gateway credentials cannot be finalized');
+    }
+    if (lifecycle.state === 'active') {
+      return {
+        finalizedAt: lifecycle.finalizedAt!,
+        wasAlreadyActive: true,
+        lifecycle,
+      };
+    }
+
+    const previousLifecycle = lifecycle;
+    const finalizedAt = Date.now();
+    token.gatewayCredentialLifecycle = {
+      ...lifecycle,
+      state: 'active',
+      finalizedAt,
+      cleanupCompletedAt: null,
+      revokedCredentialCount: null,
+    };
+    try {
+      await this.persistToken(token);
+    } catch (error) {
+      token.gatewayCredentialLifecycle = previousLifecycle;
+      throw error;
+    }
+    return {
+      finalizedAt,
+      wasAlreadyActive: false,
+      lifecycle: token.gatewayCredentialLifecycle,
+    };
+  }
+
+  /** Mark sibling cleanup complete so later retries never touch newer tokens. */
+  public async completeProvisionedGatewayCredentialHandover(
+    tokenId: string,
+    gatewayClientId: string,
+    revokedCredentialCount: number,
+  ): Promise<IGatewayCredentialLifecycle> {
+    const token = this.tokens.get(tokenId);
+    if (!token || token.policy?.role !== 'gatewayClient'
+      || token.policy.gatewayClient?.id !== gatewayClientId) {
+      throw new Error('Provisioned gateway credential is missing or has the wrong owner');
+    }
+    const lifecycle = this.normalizeGatewayCredentialLifecycle(
+      token.gatewayCredentialLifecycle,
+      token.id,
+    );
+    if (!lifecycle || lifecycle.state !== 'active') {
+      throw new Error('Provisioned gateway credential is not active');
+    }
+    if (lifecycle.cleanupCompletedAt !== null) return lifecycle;
+    if (!Number.isSafeInteger(revokedCredentialCount) || revokedCredentialCount < 0) {
+      throw new Error('Revoked credential count is invalid');
+    }
+    const previousLifecycle = lifecycle;
+    token.gatewayCredentialLifecycle = {
+      ...lifecycle,
+      cleanupCompletedAt: Date.now(),
+      revokedCredentialCount,
+    };
+    try {
+      await this.persistToken(token);
+    } catch (error) {
+      token.gatewayCredentialLifecycle = previousLifecycle;
+      throw error;
+    }
+    return token.gatewayCredentialLifecycle;
+  }
+
+
   /**
    * Roll (regenerate) a token's secret while keeping its identity.
    * Returns the new raw token value (shown once).
@@ -197,12 +373,14 @@ export class ApiTokenManager {
           tokenHash: doc.tokenHash,
           scopes: doc.scopes,
           policy: doc.policy,
+          gatewayCredentialLifecycle: this.normalizeGatewayCredentialLifecycle(doc.gatewayCredentialLifecycle, doc.id),
           createdAt: doc.createdAt,
           expiresAt: doc.expiresAt,
           lastUsedAt: doc.lastUsedAt,
           createdBy: doc.createdBy,
           enabled: doc.enabled,
         });
+        this.lastUsedPersistedAt.set(doc.id, doc.lastUsedAt || 0);
       }
     }
   }
@@ -226,6 +404,7 @@ export class ApiTokenManager {
       tokenHash: this.hashToken(rawToken),
       scopes: ['*'],
       policy: { role: 'admin' },
+      gatewayCredentialLifecycle: null,
       createdAt: existing?.createdAt || now,
       expiresAt: null,
       lastUsedAt: existing?.lastUsedAt || null,
@@ -238,6 +417,58 @@ export class ApiTokenManager {
     logger.log('info', `Environment admin API token ensured (id: ${stored.id})`);
   }
 
+  private normalizeGatewayCredentialLifecycle(
+    valueArg: unknown,
+    tokenIdArg: string,
+  ): IGatewayCredentialLifecycle | null {
+    if (valueArg == null) return null;
+    if (typeof valueArg !== 'object' || Array.isArray(valueArg)) {
+      throw new Error(`API token '${tokenIdArg}' has malformed gateway credential lifecycle`);
+    }
+    const value = valueArg as Partial<IGatewayCredentialLifecycle>;
+    if (value.source !== 'provisioned') {
+      throw new Error(`API token '${tokenIdArg}' has malformed gateway credential lifecycle`);
+    }
+    if (!Number.isSafeInteger(value.sequence) || Number(value.sequence) < 1
+      || !Number.isSafeInteger(value.policyGeneration) || Number(value.policyGeneration) < 1
+      || typeof value.policyDigest !== 'string' || !/^[a-f0-9]{64}$/.test(value.policyDigest)) {
+      throw new Error(`API token '${tokenIdArg}' has malformed gateway credential lifecycle`);
+    }
+    const base = {
+      source: 'provisioned' as const,
+      sequence: Number(value.sequence),
+      policyGeneration: Number(value.policyGeneration),
+      policyDigest: value.policyDigest,
+    };
+    if (value.state === 'candidate' && value.finalizedAt === null
+      && value.cleanupCompletedAt === null && value.revokedCredentialCount === null) {
+      return {
+        ...base,
+        state: 'candidate',
+        finalizedAt: null,
+        cleanupCompletedAt: null,
+        revokedCredentialCount: null,
+      };
+    }
+    if (value.state === 'active' && Number.isSafeInteger(value.finalizedAt) && Number(value.finalizedAt) > 0) {
+      const cleanupPending = value.cleanupCompletedAt === null && value.revokedCredentialCount === null;
+      const cleanupComplete = Number.isSafeInteger(value.cleanupCompletedAt)
+        && Number(value.cleanupCompletedAt) > 0
+        && Number.isSafeInteger(value.revokedCredentialCount)
+        && Number(value.revokedCredentialCount) >= 0;
+      if (cleanupPending || cleanupComplete) {
+        return {
+          ...base,
+          state: 'active',
+          finalizedAt: Number(value.finalizedAt),
+          cleanupCompletedAt: cleanupComplete ? Number(value.cleanupCompletedAt) : null,
+          revokedCredentialCount: cleanupComplete ? Number(value.revokedCredentialCount) : null,
+        };
+      }
+    }
+    throw new Error(`API token '${tokenIdArg}' has malformed gateway credential lifecycle`);
+  }
+
   private hashToken(rawToken: string): string {
     return plugins.crypto.createHash('sha256').update(rawToken).digest('hex');
   }
@@ -249,6 +480,7 @@ export class ApiTokenManager {
       existing.tokenHash = stored.tokenHash;
       existing.scopes = stored.scopes;
       existing.policy = stored.policy;
+      existing.gatewayCredentialLifecycle = stored.gatewayCredentialLifecycle ?? null;
       existing.createdAt = stored.createdAt;
       existing.expiresAt = stored.expiresAt;
       existing.lastUsedAt = stored.lastUsedAt;
@@ -262,6 +494,7 @@ export class ApiTokenManager {
       doc.tokenHash = stored.tokenHash;
       doc.scopes = stored.scopes;
       doc.policy = stored.policy;
+      doc.gatewayCredentialLifecycle = stored.gatewayCredentialLifecycle ?? null;
       doc.createdAt = stored.createdAt;
       doc.expiresAt = stored.expiresAt;
       doc.lastUsedAt = stored.lastUsedAt;