@tianshu-ai/tianshu 0.3.0

package/packages/server/dist/core/config.js

@@ -0,0 +1,155 @@
+// Two-layer configuration: ~/.tianshu/config.json (global)
+// + ~/.tianshu/tenants/<id>/config.json (tenant override).
+//
+// Tenant config can only override fields on a whitelist (ADR-0001 §7).
+// Server-process knobs (port, log path) are global-only — a tenant must
+// not be able to flip the listener port.
+//
+// We DO NOT use a heavy schema library for v0; a hand-written validator
+// keeps the dependency footprint small and the behaviour obvious. As the
+// config grows, swap to typebox.
+import fs from "node:fs";
+import path from "node:path";
+import { getGlobalConfigPath, getTenantConfigPath, getTianshuHome, } from "./paths.js";
+// ─── Defaults ─────────────────────────────────────────────────────────
+export const DEFAULTS = {
+    autoCreateDefault: true,
+    server: { port: 3110, corsOrigin: "http://localhost:5183" },
+    logging: { level: "info" },
+};
+// ─── Whitelist enforcement ────────────────────────────────────────────
+/** Field names a tenant config is allowed to set. Reject any others. */
+const TENANT_WHITELIST = new Set([
+    "defaultModel",
+    "models",
+    "worker",
+    "oauth",
+    "branding",
+    "apiKeys",
+    "plugins",
+    "mcp",
+]);
+export class TenantConfigForbiddenFieldError extends Error {
+    tenantId;
+    field;
+    code = "TENANT_CONFIG_FORBIDDEN_FIELD";
+    constructor(tenantId, field) {
+        super(`tenant "${tenantId}" config.json sets "${field}", which is not in the override whitelist`);
+        this.tenantId = tenantId;
+        this.field = field;
+        this.name = "TenantConfigForbiddenFieldError";
+    }
+}
+function assertOnlyOverridable(tenantId, raw) {
+    for (const key of Object.keys(raw)) {
+        if (!TENANT_WHITELIST.has(key)) {
+            throw new TenantConfigForbiddenFieldError(tenantId, key);
+        }
+    }
+}
+// ─── Read / merge ─────────────────────────────────────────────────────
+function readJsonOrEmpty(filepath) {
+    try {
+        const buf = fs.readFileSync(filepath, "utf8");
+        const parsed = JSON.parse(buf);
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error(`expected JSON object, got ${typeof parsed}`);
+        }
+        return parsed;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return {};
+        throw new Error(`failed to read config ${filepath}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+export function loadGlobalConfig(home = getTianshuHome()) {
+    const raw = readJsonOrEmpty(getGlobalConfigPath(home));
+    return raw;
+}
+export function loadTenantConfig(tenantId, home = getTianshuHome()) {
+    const raw = readJsonOrEmpty(getTenantConfigPath(tenantId, home));
+    assertOnlyOverridable(tenantId, raw);
+    return raw;
+}
+/** Compute the effective config for a tenant. */
+export function resolveTenantConfig(tenantId, home = getTianshuHome()) {
+    const global = loadGlobalConfig(home);
+    const tenant = loadTenantConfig(tenantId, home);
+    return mergeConfigs(global, tenant);
+}
+/**
+ * Merge global and tenant configs. Tenant wins on overridable fields.
+ *
+ * - Scalars and arrays: tenant replaces global wholesale.
+ * - Objects (worker, branding, apiKeys): shallow-merge so tenant can override
+ *   single keys without restating the whole object.
+ */
+export function mergeConfigs(global, tenant) {
+    // models is wholesale-replace, not deep-merge: tenants typically
+    // bring their own provider catalog (different SAP gateway, qwen
+    // dashscope, etc.) and don't want to inherit global's anthropic /
+    // openai entries that almost certainly use a different key. So
+    // when tenant.models is set, it replaces global.models entirely.
+    const models = tenant.models ?? global.models;
+    // defaultModel needs to follow models. If the tenant supplies its
+    // own catalog and DOESN'T set defaultModel, falling back to
+    // global.defaultModel points at a provider that no longer exists
+    // in the resolved catalog — every chat request then 500s with
+    // "unknown provider". Mismatch caught 2026-06-21 on a tenant
+    // that defined `qwen` only; defaultModel inherited as
+    // 'anthropic/claude-sonnet-4-6' from global.
+    //
+    // Resolution rule:
+    //   1. tenant.defaultModel wins outright if set
+    //   2. else, if tenant brought its own models, pick the first
+    //      provider/model in that catalog (deterministic: tenant
+    //      author has full control by ordering)
+    //   3. else, inherit global.defaultModel (the original behaviour
+    //      for tenants that don't override models)
+    let defaultModel = tenant.defaultModel ?? global.defaultModel;
+    if (!tenant.defaultModel && tenant.models && models?.providers) {
+        const firstProviderId = Object.keys(models.providers)[0];
+        const firstProvider = firstProviderId
+            ? models.providers[firstProviderId]
+            : undefined;
+        const firstModelId = firstProvider?.models?.[0]?.id;
+        if (firstProviderId && firstModelId) {
+            defaultModel = `${firstProviderId}/${firstModelId}`;
+        }
+    }
+    return {
+        // global-only — never touched by tenant
+        server: global.server,
+        logging: global.logging,
+        autoCreateDefault: global.autoCreateDefault ?? DEFAULTS.autoCreateDefault,
+        builtinConfigDir: global.builtinConfigDir,
+        // overridable — tenant wins
+        defaultModel,
+        models,
+        worker: { ...global.worker, ...tenant.worker },
+        oauth: tenant.oauth ?? global.oauth,
+        branding: { ...global.branding, ...tenant.branding },
+        apiKeys: { ...global.apiKeys, ...tenant.apiKeys },
+        plugins: { ...global.plugins, ...tenant.plugins },
+        mcp: tenant.mcp ?? global.mcp,
+    };
+}
+/** Atomic write. Writes to a temp file first, then rename. */
+export function writeTenantConfig(tenantId, cfg, home = getTianshuHome()) {
+    // Validate before writing so callers can't sneak forbidden fields in.
+    assertOnlyOverridable(tenantId, cfg);
+    const target = getTenantConfigPath(tenantId, home);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
+    fs.writeFileSync(tmp, JSON.stringify(cfg, null, 2) + "\n", { mode: 0o600 });
+    fs.renameSync(tmp, target);
+}
+export function writeGlobalConfig(cfg, home = getTianshuHome()) {
+    const target = getGlobalConfigPath(home);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
+    fs.writeFileSync(tmp, JSON.stringify(cfg, null, 2) + "\n", { mode: 0o600 });
+    fs.renameSync(tmp, target);
+}
+//# sourceMappingURL=config.js.map

package/packages/server/dist/core/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,2DAA2D;AAC3D,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,yCAAyC;AACzC,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,iCAAiC;AAEjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,GACf,MAAM,YAAY,CAAC;AAoKpB,yEAAyE;AAEzE,MAAM,CAAC,MAAM,QAAQ,GAC4B;IAC/C,iBAAiB,EAAE,IAAI;IACvB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,uBAAuB,EAAE;IAC3D,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;CAC3B,CAAC;AAEF,yEAAyE;AAEzE,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAA0B;IACxD,cAAc;IACd,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,UAAU;IACV,SAAS;IACT,SAAS;IACT,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAE5B;IAAkC;IADrD,IAAI,GAAG,+BAAwC,CAAC;IACzD,YAA4B,QAAgB,EAAkB,KAAa;QACzE,KAAK,CACH,WAAW,QAAQ,uBAAuB,KAAK,2CAA2C,CAC3F,CAAC;QAHwB,aAAQ,GAAR,QAAQ,CAAQ;QAAkB,UAAK,GAAL,KAAK,CAAQ;QAIzE,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAED,SAAS,qBAAqB,CAAC,QAAgB,EAAE,GAA4B;IAC3E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAA8B,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,+BAA+B,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,MAAM,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,cAAc,EAAE;IAC9D,MAAM,GAAG,GAAG,eAAe,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,OAAO,GAAmB,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,OAAe,cAAc,EAAE;IAChF,MAAM,GAAG,GAAG,eAAe,CAAC,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,qBAAqB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACrC,OAAO,GAAmB,CAAC;AAC7B,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,OAAe,cAAc,EAAE;IACnF,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChD,OAAO,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,MAAoB,EAAE,MAAoB;IACrE,iEAAiE;IACjE,gEAAgE;IAChE,kEAAkE;IAClE,+DAA+D;IAC/D,iEAAiE;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;IAE9C,kEAAkE;IAClE,4DAA4D;IAC5D,iEAAiE;IACjE,8DAA8D;IAC9D,6DAA6D;IAC7D,sDAAsD;IACtD,6CAA6C;IAC7C,EAAE;IACF,mBAAmB;IACnB,gDAAgD;IAChD,8DAA8D;IAC9D,6DAA6D;IAC7D,4CAA4C;IAC5C,iEAAiE;IACjE,+CAA+C;IAC/C,IAAI,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;IAC9D,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,eAAe;YACnC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC;YACnC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,YAAY,GAAG,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACpD,IAAI,eAAe,IAAI,YAAY,EAAE,CAAC;YACpC,YAAY,GAAG,GAAG,eAAe,IAAI,YAAY,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO;QACL,wCAAwC;QACxC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,QAAQ,CAAC,iBAAiB;QACzE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QAEzC,4BAA4B;QAC5B,YAAY;QACZ,MAAM;QACN,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;QAC9C,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK;QACnC,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE;QACpD,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;QACjD,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;QACjD,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG;KAC9B,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,GAAiB,EACjB,OAAe,cAAc,EAAE;IAE/B,sEAAsE;IACtE,qBAAqB,CAAC,QAAQ,EAAE,GAA8B,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,MAAM,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACzD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAiB,EAAE,OAAe,cAAc,EAAE;IAClF,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,MAAM,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACzD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7B,CAAC"}

package/packages/server/dist/core/db-pool.d.ts

@@ -0,0 +1,32 @@
+import { type Database as DB } from "better-sqlite3";
+export interface DbPoolOptions {
+    /** Max number of concurrently-open tenant DBs. */
+    maxOpen?: number;
+    home?: string;
+}
+/**
+ * The pool maintains insertion-order in a Map. On access, we delete +
+ * re-insert the entry so the most-recently-used is always at the tail.
+ * When size > max, we evict from the head.
+ */
+export declare class DbPool {
+    private readonly entries;
+    private readonly maxOpen;
+    private readonly home;
+    constructor(opts?: DbPoolOptions);
+    /** Open (or return cached) DB for a tenant, running pending migrations. */
+    get(tenantId: string): DB;
+    /** Close and forget a tenant's DB (e.g. on tenant delete). */
+    close(tenantId: string): void;
+    /** Close all open DBs. Call on shutdown. */
+    closeAll(): void;
+    /** For tests / introspection. */
+    get openCount(): number;
+    private open;
+    private evictIfNeeded;
+}
+/** Process-wide singleton, used by routes and middleware. Tests should use `new DbPool()`. */
+export declare function getDefaultPool(): DbPool;
+/** For tests: replace the default pool. */
+export declare function __setDefaultPool(pool: DbPool | null): void;
+//# sourceMappingURL=db-pool.d.ts.map

package/packages/server/dist/core/db-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-pool.d.ts","sourceRoot":"","sources":["../../src/core/db-pool.ts"],"names":[],"mappings":"AAMA,OAAiB,EAAE,KAAK,QAAQ,IAAI,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAM/D,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AASD;;;;GAIG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;gBAE9B,IAAI,GAAE,aAAkB;IAKpC,2EAA2E;IAC3E,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,EAAE;IAczB,8DAA8D;IAC9D,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAW7B,4CAA4C;IAC5C,QAAQ,IAAI,IAAI;IAWhB,iCAAiC;IACjC,IAAI,SAAS,IAAI,MAAM,CAEtB;IAID,OAAO,CAAC,IAAI;IAWZ,OAAO,CAAC,aAAa;CAetB;AAID,8FAA8F;AAC9F,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED,2CAA2C;AAC3C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE1D"}

package/packages/server/dist/core/db-pool.js

@@ -0,0 +1,108 @@
+// Per-tenant SQLite connection pool with LRU eviction.
+//
+// better-sqlite3 is synchronous; each Database instance holds one fd. We
+// don't want a 100-tenant deploy holding 100 fds, so we cap to N most-
+// recently-used DBs and reopen on demand. Reopening is cheap with WAL.
+import Database from "better-sqlite3";
+import fs from "node:fs";
+import path from "node:path";
+import { getTenantDbPath } from "./paths.js";
+import { runMigrations } from "./migrations/index.js";
+const DEFAULT_MAX_OPEN = 32;
+/**
+ * The pool maintains insertion-order in a Map. On access, we delete +
+ * re-insert the entry so the most-recently-used is always at the tail.
+ * When size > max, we evict from the head.
+ */
+export class DbPool {
+    entries = new Map();
+    maxOpen;
+    home;
+    constructor(opts = {}) {
+        this.maxOpen = opts.maxOpen ?? DEFAULT_MAX_OPEN;
+        this.home = opts.home;
+    }
+    /** Open (or return cached) DB for a tenant, running pending migrations. */
+    get(tenantId) {
+        const cached = this.entries.get(tenantId);
+        if (cached) {
+            // bump to MRU
+            this.entries.delete(tenantId);
+            this.entries.set(tenantId, cached);
+            return cached.db;
+        }
+        const db = this.open(tenantId);
+        this.entries.set(tenantId, { tenantId, db });
+        this.evictIfNeeded();
+        return db;
+    }
+    /** Close and forget a tenant's DB (e.g. on tenant delete). */
+    close(tenantId) {
+        const entry = this.entries.get(tenantId);
+        if (!entry)
+            return;
+        try {
+            entry.db.close();
+        }
+        catch {
+            /* ignore */
+        }
+        this.entries.delete(tenantId);
+    }
+    /** Close all open DBs. Call on shutdown. */
+    closeAll() {
+        for (const entry of this.entries.values()) {
+            try {
+                entry.db.close();
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        this.entries.clear();
+    }
+    /** For tests / introspection. */
+    get openCount() {
+        return this.entries.size;
+    }
+    // ─── internals ───────────────────────────────────────────────────
+    open(tenantId) {
+        const dbPath = getTenantDbPath(tenantId, this.home);
+        fs.mkdirSync(path.dirname(dbPath), { recursive: true });
+        const db = new Database(dbPath);
+        db.pragma("journal_mode = WAL");
+        db.pragma("foreign_keys = ON");
+        db.pragma("synchronous = NORMAL");
+        runMigrations(db);
+        return db;
+    }
+    evictIfNeeded() {
+        while (this.entries.size > this.maxOpen) {
+            const lru = this.entries.keys().next().value;
+            if (!lru)
+                break;
+            const entry = this.entries.get(lru);
+            this.entries.delete(lru);
+            if (entry) {
+                try {
+                    entry.db.close();
+                }
+                catch {
+                    /* ignore */
+                }
+            }
+        }
+    }
+}
+let defaultPool = null;
+/** Process-wide singleton, used by routes and middleware. Tests should use `new DbPool()`. */
+export function getDefaultPool() {
+    if (!defaultPool)
+        defaultPool = new DbPool();
+    return defaultPool;
+}
+/** For tests: replace the default pool. */
+export function __setDefaultPool(pool) {
+    defaultPool = pool;
+}
+//# sourceMappingURL=db-pool.js.map

package/packages/server/dist/core/db-pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-pool.js","sourceRoot":"","sources":["../../src/core/db-pool.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AAEvE,OAAO,QAAiC,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAQtD,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAO5B;;;;GAIG;AACH,MAAM,OAAO,MAAM;IACA,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IACnC,OAAO,CAAS;IAChB,IAAI,CAAqB;IAE1C,YAAY,OAAsB,EAAE;QAClC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,2EAA2E;IAC3E,GAAG,CAAC,QAAgB;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,cAAc;YACd,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACnC,OAAO,MAAM,CAAC,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,QAAgB;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,4CAA4C;IAC5C,QAAQ;QACN,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,iCAAiC;IACjC,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,oEAAoE;IAE5D,IAAI,CAAC,QAAgB;QAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAChC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC/B,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAClC,aAAa,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,aAAa;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC7C,IAAI,CAAC,GAAG;gBAAE,MAAM;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACnB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,IAAI,WAAW,GAAkB,IAAI,CAAC;AAEtC,8FAA8F;AAC9F,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,WAAW;QAAE,WAAW,GAAG,IAAI,MAAM,EAAE,CAAC;IAC7C,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,gBAAgB,CAAC,IAAmB;IAClD,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC"}

package/packages/server/dist/core/dev-mode.d.ts

@@ -0,0 +1,13 @@
+import { type GlobalConfig } from "./config.js";
+import { GlobalOps } from "./global-ops.js";
+export declare const DEV_TENANT_ID = "default";
+export declare const DEV_USER_ID = "dev";
+export declare const DEV_USER_EXTERNAL_ID = "dev@local";
+export declare const DEV_USER_PROVIDER = "dev";
+export interface BootstrapResult {
+    created: boolean;
+    tenantId: string | null;
+    userId: string | null;
+}
+export declare function bootstrapDevTenantIfNeeded(ops?: GlobalOps, cfg?: GlobalConfig): BootstrapResult;
+//# sourceMappingURL=dev-mode.d.ts.map

package/packages/server/dist/core/dev-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-mode.d.ts","sourceRoot":"","sources":["../../src/core/dev-mode.ts"],"names":[],"mappings":"AAWA,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG5C,eAAO,MAAM,aAAa,YAAY,CAAC;AACvC,eAAO,MAAM,WAAW,QAAQ,CAAC;AACjC,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAChD,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,0BAA0B,CACxC,GAAG,CAAC,EAAE,SAAS,EACf,GAAG,CAAC,EAAE,YAAY,GACjB,eAAe,CAwCjB"}

package/packages/server/dist/core/dev-mode.js

@@ -0,0 +1,51 @@
+// Dev-mode bootstrap.
+//
+// On first boot, if no tenants exist and the global config allows it, we
+// auto-create a `default` tenant with a single dev user. This is what
+// makes `git clone && npm run dev` work without any setup —
+// the user opens http://localhost:5173, hits /api/health, and there's a
+// real (if empty) tenant context backing them.
+//
+// The dev user has a fixed id `dev`. JWT-mode deployments must turn
+// this off in global config (`autoCreateDefault: false`).
+import { loadGlobalConfig, loadTenantConfig, writeTenantConfig, } from "./config.js";
+import { GlobalOps } from "./global-ops.js";
+import { getTianshuHome } from "./paths.js";
+export const DEV_TENANT_ID = "default";
+export const DEV_USER_ID = "dev";
+export const DEV_USER_EXTERNAL_ID = "dev@local";
+export const DEV_USER_PROVIDER = "dev";
+export function bootstrapDevTenantIfNeeded(ops, cfg) {
+    const home = getTianshuHome();
+    const globalOps = ops ?? new GlobalOps({ home });
+    const config = cfg ?? loadGlobalConfig(home);
+    const allow = config.autoCreateDefault ?? true;
+    if (!allow)
+        return { created: false, tenantId: null, userId: null };
+    const existing = globalOps.list();
+    if (existing.length > 0) {
+        return { created: false, tenantId: null, userId: null };
+    }
+    const ctx = globalOps.create(DEV_TENANT_ID);
+    globalOps.ensureUser(ctx, {
+        userId: DEV_USER_ID,
+        provider: DEV_USER_PROVIDER,
+        externalId: DEV_USER_EXTERNAL_ID,
+        displayName: "Dev User",
+    });
+    // Pre-enable the `files` builtin plugin so a fresh dev tenant has
+    // the basic chat workflow (browse + attach files — the files
+    // plugin contributes both the right-side panel and the composer
+    // paperclip button) out of the box. Per ADR-0003 §11, the other
+    // builtin plugins ship opt-in (browser / task-board / ...).
+    const tenantConfig = loadTenantConfig(DEV_TENANT_ID, home);
+    writeTenantConfig(DEV_TENANT_ID, {
+        ...tenantConfig,
+        plugins: {
+            ...(tenantConfig.plugins ?? {}),
+            files: { enabled: true, ...(tenantConfig.plugins?.files ?? {}) },
+        },
+    }, home);
+    return { created: true, tenantId: DEV_TENANT_ID, userId: DEV_USER_ID };
+}
+//# sourceMappingURL=dev-mode.js.map

package/packages/server/dist/core/dev-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-mode.js","sourceRoot":"","sources":["../../src/core/dev-mode.ts"],"names":[],"mappings":"AAAA,sBAAsB;AACtB,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,4DAA4D;AAC5D,wEAAwE;AACxE,+CAA+C;AAC/C,EAAE;AACF,oEAAoE;AACpE,0DAA0D;AAE1D,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC;AACjC,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAQvC,MAAM,UAAU,0BAA0B,CACxC,GAAe,EACf,GAAkB;IAElB,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAE7C,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAEpE,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC5C,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE;QACxB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,iBAAiB;QAC3B,UAAU,EAAE,oBAAoB;QAChC,WAAW,EAAE,UAAU;KACxB,CAAC,CAAC;IAEH,kEAAkE;IAClE,6DAA6D;IAC7D,gEAAgE;IAChE,gEAAgE;IAChE,4DAA4D;IAC5D,MAAM,YAAY,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAC3D,iBAAiB,CACf,aAAa,EACb;QACE,GAAG,YAAY;QACf,OAAO,EAAE;YACP,GAAG,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC;YAC/B,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;SACjE;KACF,EACD,IAAI,CACL,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACzE,CAAC"}

package/packages/server/dist/core/global-ops.d.ts

@@ -0,0 +1,54 @@
+import { DbPool } from "./db-pool.js";
+import { TenantContext } from "./tenant-context.js";
+import { InvalidTenantIdError } from "./tenant-id.js";
+export declare class TenantNotFoundError extends Error {
+    readonly tenantId: string;
+    readonly code: "TENANT_NOT_FOUND";
+    constructor(tenantId: string);
+}
+export declare class TenantAlreadyExistsError extends Error {
+    readonly tenantId: string;
+    readonly code: "TENANT_ALREADY_EXISTS";
+    constructor(tenantId: string);
+}
+export interface GlobalOpsOptions {
+    home?: string;
+    pool?: DbPool;
+}
+/**
+ * Tenant lifecycle. Holds a reference to the DbPool so opening a tenant
+ * always goes through the same connection cache.
+ */
+export declare class GlobalOps {
+    private readonly home;
+    private readonly pool;
+    constructor(opts?: GlobalOpsOptions);
+    /** List visible tenant ids (skips `*.deleted*` and dot-files). */
+    list(): string[];
+    /** True iff this tenant's directory exists and is not soft-deleted. */
+    exists(tenantId: string): boolean;
+    /** Open a TenantContext, throwing if the tenant doesn't exist. */
+    open(tenantId: string): TenantContext;
+    /** Create a brand-new tenant. Throws if one already exists. */
+    create(tenantId: string): TenantContext;
+    /** Idempotent: returns existing if present, creates otherwise. */
+    ensure(tenantId: string): TenantContext;
+    /**
+     * Soft-delete: rename to `<id>.deleted.<ts>`. Future scans skip it.
+     * The DB connection is closed before the rename.
+     */
+    softDelete(tenantId: string): void;
+    /** Provision a new user under this tenant: seed workspace, ensure DB row exists. */
+    ensureUser(ctx: TenantContext, args: {
+        userId: string;
+        provider: string;
+        externalId: string;
+        displayName?: string;
+    }): void;
+    closePool(): void;
+    get poolRef(): DbPool;
+    /** Resolved TIANSHU_HOME this ops instance is rooted at. */
+    get homeDir(): string;
+}
+export { InvalidTenantIdError, };
+//# sourceMappingURL=global-ops.d.ts.map

package/packages/server/dist/core/global-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-ops.d.ts","sourceRoot":"","sources":["../../src/core/global-ops.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAWtC,OAAO,EAEL,aAAa,EACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAoB,MAAM,gBAAgB,CAAC;AAExE,qBAAa,mBAAoB,SAAQ,KAAK;aAEhB,QAAQ,EAAE,MAAM;IAD5C,QAAQ,CAAC,IAAI,EAAG,kBAAkB,CAAU;gBAChB,QAAQ,EAAE,MAAM;CAI7C;AAED,qBAAa,wBAAyB,SAAQ,KAAK;aAErB,QAAQ,EAAE,MAAM;IAD5C,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;gBACrB,QAAQ,EAAE,MAAM;CAI7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,IAAI,GAAE,gBAAqB;IAKvC,kEAAkE;IAClE,IAAI,IAAI,MAAM,EAAE;IAehB,uEAAuE;IACvE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAUjC,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa;IAOrC,+DAA+D;IAC/D,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa;IAoBvC,kEAAkE;IAClE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa;IAIvC;;;OAGG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IASlC,oFAAoF;IACpF,UAAU,CACR,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GACnF,IAAI;IAgBP,SAAS,IAAI,IAAI;IAIjB,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,4DAA4D;IAC5D,IAAI,OAAO,IAAI,MAAM,CAEpB;CACF;AAED,OAAO,EACL,oBAAoB,GACrB,CAAC"}

package/packages/server/dist/core/global-ops.js

@@ -0,0 +1,143 @@
+// Tenant lifecycle and cross-tenant operations.
+//
+// Routes / middleware NEVER reach into tenants/ directly; everything goes
+// through here. That keeps "find a tenant", "create a tenant", "delete a
+// tenant" in one place where we can enforce naming, soft-delete, and
+// scan-skipping for `*.deleted` directories.
+//
+// Per ADR-0001 §9 — soft delete = rename to `<id>.deleted.<ts>`. Hard
+// delete (--purge) is a separate operation we don't implement in PR #20.
+import fs from "node:fs";
+import path from "node:path";
+import { writeTenantConfig } from "./config.js";
+import { DbPool } from "./db-pool.js";
+import { getDeletedTenantPath, getTenantRoot, getTenantSecretsDir, getTenantsRoot, getTianshuHome, isSoftDeletedDirName, isSystemReserved, } from "./paths.js";
+import { seedTenantWorkspace, seedUserWorkspace } from "./templates.js";
+import { buildTenantContext, } from "./tenant-context.js";
+import { InvalidTenantIdError, validateTenantId } from "./tenant-id.js";
+export class TenantNotFoundError extends Error {
+    tenantId;
+    code = "TENANT_NOT_FOUND";
+    constructor(tenantId) {
+        super(`tenant "${tenantId}" not found`);
+        this.tenantId = tenantId;
+        this.name = "TenantNotFoundError";
+    }
+}
+export class TenantAlreadyExistsError extends Error {
+    tenantId;
+    code = "TENANT_ALREADY_EXISTS";
+    constructor(tenantId) {
+        super(`tenant "${tenantId}" already exists`);
+        this.tenantId = tenantId;
+        this.name = "TenantAlreadyExistsError";
+    }
+}
+/**
+ * Tenant lifecycle. Holds a reference to the DbPool so opening a tenant
+ * always goes through the same connection cache.
+ */
+export class GlobalOps {
+    home;
+    pool;
+    constructor(opts = {}) {
+        this.home = opts.home ?? getTianshuHome();
+        this.pool = opts.pool ?? new DbPool({ home: this.home });
+    }
+    /** List visible tenant ids (skips `*.deleted*` and dot-files). */
+    list() {
+        const root = getTenantsRoot(this.home);
+        if (!fs.existsSync(root))
+            return [];
+        const entries = fs.readdirSync(root, { withFileTypes: true });
+        const ids = [];
+        for (const e of entries) {
+            if (!e.isDirectory())
+                continue;
+            if (e.name.startsWith("."))
+                continue;
+            if (isSoftDeletedDirName(e.name))
+                continue;
+            if (isSystemReserved(e.name))
+                continue;
+            ids.push(e.name);
+        }
+        return ids.sort();
+    }
+    /** True iff this tenant's directory exists and is not soft-deleted. */
+    exists(tenantId) {
+        try {
+            validateTenantId(tenantId);
+        }
+        catch {
+            return false;
+        }
+        const root = getTenantRoot(tenantId, this.home);
+        return fs.existsSync(root) && !isSoftDeletedDirName(path.basename(root));
+    }
+    /** Open a TenantContext, throwing if the tenant doesn't exist. */
+    open(tenantId) {
+        const id = validateTenantId(tenantId);
+        if (!this.exists(id))
+            throw new TenantNotFoundError(id);
+        const db = this.pool.get(id);
+        return buildTenantContext(id, db, this.home);
+    }
+    /** Create a brand-new tenant. Throws if one already exists. */
+    create(tenantId) {
+        const id = validateTenantId(tenantId);
+        if (this.exists(id))
+            throw new TenantAlreadyExistsError(id);
+        const root = getTenantRoot(id, this.home);
+        fs.mkdirSync(root, { recursive: true });
+        // secrets/ — mode 0700 so other local users can't read API keys
+        fs.mkdirSync(getTenantSecretsDir(id, this.home), { recursive: true, mode: 0o700 });
+        // workspace seed
+        seedTenantWorkspace(id, this.home);
+        // empty config.json (acts as a marker that a creator made it)
+        writeTenantConfig(id, {}, this.home);
+        // running this opens & migrates the DB
+        const db = this.pool.get(id);
+        return buildTenantContext(id, db, this.home);
+    }
+    /** Idempotent: returns existing if present, creates otherwise. */
+    ensure(tenantId) {
+        return this.exists(tenantId) ? this.open(tenantId) : this.create(tenantId);
+    }
+    /**
+     * Soft-delete: rename to `<id>.deleted.<ts>`. Future scans skip it.
+     * The DB connection is closed before the rename.
+     */
+    softDelete(tenantId) {
+        const id = validateTenantId(tenantId);
+        if (!this.exists(id))
+            throw new TenantNotFoundError(id);
+        this.pool.close(id);
+        const src = getTenantRoot(id, this.home);
+        const dst = getDeletedTenantPath(id, Date.now(), this.home);
+        fs.renameSync(src, dst);
+    }
+    /** Provision a new user under this tenant: seed workspace, ensure DB row exists. */
+    ensureUser(ctx, args) {
+        seedUserWorkspace(ctx.tenantId, args.userId, this.home);
+        const now = Date.now();
+        ctx.db
+            .prepare(`INSERT INTO users (id, external_id, provider, display_name, created_at)
+         VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT(provider, external_id) DO NOTHING`)
+            .run(args.userId, args.externalId, args.provider, args.displayName ?? null, now);
+    }
+    // For tests / shutdown.
+    closePool() {
+        this.pool.closeAll();
+    }
+    get poolRef() {
+        return this.pool;
+    }
+    /** Resolved TIANSHU_HOME this ops instance is rooted at. */
+    get homeDir() {
+        return this.home;
+    }
+}
+export { InvalidTenantIdError, };
+//# sourceMappingURL=global-ops.js.map

package/packages/server/dist/core/global-ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-ops.js","sourceRoot":"","sources":["../../src/core/global-ops.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,qEAAqE;AACrE,6CAA6C;AAC7C,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AAEzE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EACL,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAExE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEhB;IADnB,IAAI,GAAG,kBAA2B,CAAC;IAC5C,YAA4B,QAAgB;QAC1C,KAAK,CAAC,WAAW,QAAQ,aAAa,CAAC,CAAC;QADd,aAAQ,GAAR,QAAQ,CAAQ;QAE1C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAErB;IADnB,IAAI,GAAG,uBAAgC,CAAC;IACjD,YAA4B,QAAgB;QAC1C,KAAK,CAAC,WAAW,QAAQ,kBAAkB,CAAC,CAAC;QADnB,aAAQ,GAAR,QAAQ,CAAQ;QAE1C,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAOD;;;GAGG;AACH,MAAM,OAAO,SAAS;IACH,IAAI,CAAS;IACb,IAAI,CAAS;IAE9B,YAAY,OAAyB,EAAE;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,kEAAkE;IAClE,IAAI;QACF,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;gBAAE,SAAS;YAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACrC,IAAI,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC3C,IAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YACvC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,uEAAuE;IACvE,MAAM,CAAC,QAAgB;QACrB,IAAI,CAAC;YACH,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,QAAgB;QACnB,MAAM,EAAE,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,OAAO,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,+DAA+D;IAC/D,MAAM,CAAC,QAAgB;QACrB,MAAM,EAAE,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,wBAAwB,CAAC,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExC,gEAAgE;QAChE,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEnF,iBAAiB;QACjB,mBAAmB,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEnC,8DAA8D;QAC9D,iBAAiB,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAErC,uCAAuC;QACvC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,OAAO,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,kEAAkE;IAClE,MAAM,CAAC,QAAgB;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,QAAgB;QACzB,MAAM,EAAE,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,oFAAoF;IACpF,UAAU,CACR,GAAkB,EAClB,IAAoF;QAEpF,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,GAAG,CAAC,EAAE;aACH,OAAO,CAIN;;uDAE+C,CAChD;aACA,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,EAAE,GAAG,CAAC,CAAC;IACrF,CAAC;IAED,wBAAwB;IACxB,SAAS;QACP,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,4DAA4D;IAC5D,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;CACF;AAED,OAAO,EACL,oBAAoB,GACrB,CAAC"}