@agilesyndrome/cf-genai-base 5.0.2 → 6.0.0

package/dist/auth/subscriptions/index.js

@@ -0,0 +1,6 @@
+export * from "./model.js";
+export * from "./validation.js";
+export * from "./d1.js";
+export * from "./service.js";
+export * from "./domain.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/subscriptions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/subscriptions/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/dist/auth/subscriptions/model.d.ts

@@ -0,0 +1,20 @@
+export interface SubscriptionEntitlement {
+    entitlement: string;
+    value: unknown;
+}
+export interface Subscription {
+    id: string;
+    name: string;
+    created_at?: string;
+    updated_at?: string;
+    entitlements?: SubscriptionEntitlement[];
+}
+export interface SubscriptionManifestEntry {
+    id: string;
+    name: string;
+    entitlements: Record<string, unknown>;
+}
+export interface SubscriptionServiceOptions {
+    who?: string;
+}
+//# sourceMappingURL=model.d.ts.map

package/dist/auth/subscriptions/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/auth/subscriptions/model.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,uBAAuB,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd"}

package/dist/auth/subscriptions/model.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=model.js.map

package/dist/auth/subscriptions/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../src/auth/subscriptions/model.ts"],"names":[],"mappings":""}

package/dist/auth/subscriptions/service.d.ts

@@ -0,0 +1,12 @@
+import type { Subscription, SubscriptionEntitlement, SubscriptionServiceOptions } from "./model.js";
+export declare function listSubscriptions(env: unknown, options?: SubscriptionServiceOptions): Promise<Subscription[]>;
+export declare function getSubscription(env: unknown, subscriptionId: string, options?: SubscriptionServiceOptions): Promise<Subscription | null>;
+export declare function replaceTenantSubscriptions(env: unknown, tenantId: string, subscriptionIds: readonly string[], options?: SubscriptionServiceOptions): Promise<Subscription[]>;
+export declare function listTenantSubscriptions(env: unknown, tenantId: string, options?: SubscriptionServiceOptions): Promise<Subscription[]>;
+export declare function listSubscriptionEntitlements(env: unknown, subscriptionId: string, options?: SubscriptionServiceOptions): Promise<SubscriptionEntitlement[]>;
+export declare function ensureSubscriptionManifest(env: unknown, manifest?: readonly unknown[], { who }?: SubscriptionServiceOptions): Promise<void>;
+export declare function hasSubscription(env: unknown, tenantId: string, subscriptionId: string, options?: SubscriptionServiceOptions): Promise<boolean>;
+export declare function requireSubscription(env: unknown, tenantId: string, subscriptionId: string, options?: SubscriptionServiceOptions): Promise<true>;
+export declare function hasEntitlement(env: unknown, tenantId: string, entitlement: string, expectedValue?: unknown, options?: SubscriptionServiceOptions): Promise<boolean>;
+export declare function requireEntitlement(env: unknown, tenantId: string, entitlement: string, expectedValue?: unknown, options?: SubscriptionServiceOptions): Promise<true>;
+//# sourceMappingURL=service.d.ts.map

package/dist/auth/subscriptions/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/auth/subscriptions/service.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAKpG,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,YAAY,EAAE,CAAC,CAMzB;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,OAAO,EACZ,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAM9B;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,SAAS,MAAM,EAAE,EAClC,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,YAAY,EAAE,CAAC,CAEzB;AAED,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,YAAY,EAAE,CAAC,CAMzB;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,OAAO,EACZ,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAEpC;AAED,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,OAAO,EACZ,QAAQ,GAAE,SAAS,OAAO,EAAO,EACjC,EAAE,GAAqB,EAAE,GAAE,0BAA+B,GACzD,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,OAAO,EACvB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,OAAO,EACvB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/auth/subscriptions/service.js

@@ -0,0 +1,71 @@
+import { SubscriptionError } from "../constants.js";
+import { deepEqual } from "../encoding.js";
+import { hasSubscriptionRow, getSubscriptionRow, listSubscriptionRows, listEntitlementValueRows, listSubscriptionEntitlementRows, listTenantSubscriptionRows, replaceTenantSubscriptionRows, writeSubscriptionManifest, } from "./d1.js";
+import { normalizeSubscriptionManifest } from "./validation.js";
+const manifestPromises = new WeakMap();
+export async function listSubscriptions(env, options = {}) {
+    const subscriptions = await listSubscriptionRows(env, options);
+    return Promise.all(subscriptions.map(async (subscription) => ({
+        ...subscription,
+        entitlements: await listSubscriptionEntitlements(env, subscription.id, options),
+    })));
+}
+export async function getSubscription(env, subscriptionId, options = {}) {
+    const subscription = await getSubscriptionRow(env, subscriptionId, options);
+    return subscription ? {
+        ...subscription,
+        entitlements: await listSubscriptionEntitlements(env, subscription.id, options),
+    } : null;
+}
+export function replaceTenantSubscriptions(env, tenantId, subscriptionIds, options = {}) {
+    return replaceTenantSubscriptionRows(env, tenantId, [...new Set(subscriptionIds)], options);
+}
+export async function listTenantSubscriptions(env, tenantId, options = {}) {
+    const subscriptions = await listTenantSubscriptionRows(env, tenantId, options);
+    return Promise.all(subscriptions.map(async (subscription) => ({
+        ...subscription,
+        entitlements: await listSubscriptionEntitlements(env, subscription.id, options),
+    })));
+}
+export function listSubscriptionEntitlements(env, subscriptionId, options = {}) {
+    return listSubscriptionEntitlementRows(env, subscriptionId, options);
+}
+export async function ensureSubscriptionManifest(env, manifest = [], { who = "system:update" } = {}) {
+    const binding = env?.DB;
+    if (!binding)
+        return;
+    const normalized = normalizeSubscriptionManifest(manifest);
+    const key = JSON.stringify(normalized);
+    let registrations = manifestPromises.get(binding);
+    if (!registrations) {
+        registrations = new Map();
+        manifestPromises.set(binding, registrations);
+    }
+    let registration = registrations.get(key);
+    if (!registration) {
+        registration = writeSubscriptionManifest(env, normalized, who);
+        registrations.set(key, registration);
+        registration.catch(() => registrations?.delete(key));
+    }
+    await registration;
+}
+export function hasSubscription(env, tenantId, subscriptionId, options = {}) {
+    return hasSubscriptionRow(env, tenantId, subscriptionId, options);
+}
+export async function requireSubscription(env, tenantId, subscriptionId, options = {}) {
+    if (!await hasSubscription(env, tenantId, subscriptionId, options)) {
+        throw new SubscriptionError("Required subscription is not active for this tenant.");
+    }
+    return true;
+}
+export async function hasEntitlement(env, tenantId, entitlement, expectedValue, options = {}) {
+    const values = await listEntitlementValueRows(env, tenantId, entitlement, options);
+    return values.some((value) => expectedValue === undefined || deepEqual(value, expectedValue));
+}
+export async function requireEntitlement(env, tenantId, entitlement, expectedValue, options = {}) {
+    if (!await hasEntitlement(env, tenantId, entitlement, expectedValue, options)) {
+        throw new SubscriptionError(`Required entitlement is not active: ${entitlement}.`);
+    }
+    return true;
+}
+//# sourceMappingURL=service.js.map

package/dist/auth/subscriptions/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/auth/subscriptions/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,EACxB,+BAA+B,EAC/B,0BAA0B,EAC1B,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAC;AAEhE,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAsC,CAAC;AAE3E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAY,EACZ,OAAO,GAA+B,EAAE;IAExC,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC5D,GAAG,YAAY;QACf,YAAY,EAAE,MAAM,4BAA4B,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC;KAChF,CAAC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAY,EACZ,cAAsB,EACtB,OAAO,GAA+B,EAAE;IAExC,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;IAC5E,OAAO,YAAY,CAAC,CAAC,CAAC;QACpB,GAAG,YAAY;QACf,YAAY,EAAE,MAAM,4BAA4B,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC;KAChF,CAAC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,GAAY,EACZ,QAAgB,EAChB,eAAkC,EAClC,OAAO,GAA+B,EAAE;IAExC,OAAO,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAY,EACZ,QAAgB,EAChB,OAAO,GAA+B,EAAE;IAExC,MAAM,aAAa,GAAG,MAAM,0BAA0B,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/E,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC5D,GAAG,YAAY;QACf,YAAY,EAAE,MAAM,4BAA4B,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC;KAChF,CAAC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,GAAY,EACZ,cAAsB,EACtB,OAAO,GAA+B,EAAE;IAExC,OAAO,+BAA+B,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAY,EACZ,QAAQ,GAAuB,EAAE,EACjC,EAAE,GAAG,GAAG,eAAe,EAAE,GAA+B,EAAE;IAE1D,MAAM,OAAO,GAAI,GAA8B,EAAE,EAAE,CAAC;IACpD,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,UAAU,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,GAAG,EAAE,CAAC;QAC1B,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,yBAAyB,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QAC/D,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACrC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,YAAY,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAY,EACZ,QAAgB,EAChB,cAAsB,EACtB,OAAO,GAA+B,EAAE;IAExC,OAAO,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAY,EACZ,QAAgB,EAChB,cAAsB,EACtB,OAAO,GAA+B,EAAE;IAExC,IAAI,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,iBAAiB,CAAC,sDAAsD,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAY,EACZ,QAAgB,EAChB,WAAmB,EACnB,aAAuB,EACvB,OAAO,GAA+B,EAAE;IAExC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAY,EACZ,QAAgB,EAChB,WAAmB,EACnB,aAAuB,EACvB,OAAO,GAA+B,EAAE;IAExC,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,WAAW,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/subscriptions/validation.d.ts

@@ -0,0 +1,3 @@
+import type { SubscriptionManifestEntry } from "./model.js";
+export declare function normalizeSubscriptionManifest(manifest?: readonly unknown[]): SubscriptionManifestEntry[];
+//# sourceMappingURL=validation.d.ts.map

package/dist/auth/subscriptions/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/auth/subscriptions/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAI5D,wBAAgB,6BAA6B,CAAC,QAAQ,GAAE,SAAS,OAAO,EAAO,GAAG,yBAAyB,EAAE,CAkB5G"}

package/dist/auth/subscriptions/validation.js

@@ -0,0 +1,21 @@
+const SUBSCRIPTION_ID = /^[a-z0-9][a-z0-9_-]*$/;
+export function normalizeSubscriptionManifest(manifest = []) {
+    return manifest
+        .map((value) => {
+        const subscription = value && typeof value === "object"
+            ? value
+            : {};
+        const id = String(subscription.id ?? "").trim();
+        const name = String(subscription.name ?? subscription.id ?? "").trim();
+        const source = subscription.entitlements && typeof subscription.entitlements === "object"
+            ? subscription.entitlements
+            : {};
+        return {
+            id,
+            name,
+            entitlements: Object.fromEntries(Object.entries(source).map(([key, value]) => [String(key), value])),
+        };
+    })
+        .filter((subscription) => SUBSCRIPTION_ID.test(subscription.id) && Boolean(subscription.name));
+}
+//# sourceMappingURL=validation.js.map

package/dist/auth/subscriptions/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/auth/subscriptions/validation.ts"],"names":[],"mappings":"AAEA,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEhD,MAAM,UAAU,6BAA6B,CAAC,QAAQ,GAAuB,EAAE;IAC7E,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,YAAY,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YACrD,CAAC,CAAC,KAAgC;YAClC,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,IAAI,OAAO,YAAY,CAAC,YAAY,KAAK,QAAQ;YACvF,CAAC,CAAC,YAAY,CAAC,YAAuC;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,EAAE;YACF,IAAI;YACJ,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;SACrG,CAAC;IACJ,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AACnG,CAAC"}

package/dist/auth/tenants/d1.d.ts

@@ -0,0 +1,12 @@
+import type { AuthTenant, NewAuthTenant, TenantUser } from "./model.js";
+export interface TenantDatabaseOptions {
+    who?: string;
+}
+export declare function listTenantRows(env: unknown, { who }?: TenantDatabaseOptions): Promise<AuthTenant[]>;
+export declare function listUserTenantRows(env: unknown, userId: string, { who }?: TenantDatabaseOptions): Promise<AuthTenant[]>;
+export declare function getTenantRow(env: unknown, tenantId: string, { who }?: TenantDatabaseOptions): Promise<AuthTenant | null>;
+export declare function listTenantUserRows(env: unknown, tenantId: string, { who }?: TenantDatabaseOptions): Promise<TenantUser[]>;
+export declare function insertTenantRow(env: unknown, tenant: NewAuthTenant, { who }?: TenantDatabaseOptions): Promise<AuthTenant | null>;
+export declare function updateTenantRow(env: unknown, tenantId: string, name: string, { who }?: TenantDatabaseOptions): Promise<AuthTenant | null>;
+export declare function replaceUserTenantRows(env: unknown, userId: string, tenantIds: readonly string[], { who }?: TenantDatabaseOptions): Promise<AuthTenant[]>;
+//# sourceMappingURL=d1.d.ts.map

package/dist/auth/tenants/d1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1.d.ts","sourceRoot":"","sources":["../../../src/auth/tenants/d1.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,GAAmB,EAAE,GAAE,qBAA0B,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAG7H;AAED,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAmB,EAAE,GAAE,qBAA0B,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAGjJ;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAmB,EAAE,GAAE,qBAA0B,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAElJ;AAED,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAmB,EAAE,GAAE,qBAA0B,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAGnJ;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,GAAqB,EAAE,GAAE,qBAA0B,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAG5J;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAqB,EAAE,GAAE,qBAA0B,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAGrK;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,GAAqB,EAAE,GAAE,qBAA0B,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAapL"}

package/dist/auth/tenants/d1.js

@@ -0,0 +1,40 @@
+import { createD1 } from "../../core/database/index.js";
+export async function listTenantRows(env, { who = "system:read" } = {}) {
+    const result = await createD1(env, { who }).prepare("SELECT t.id,t.name,t.active,t.created_at,t.updated_at,COUNT(ut.user_id) AS user_count FROM auth_tenants t LEFT JOIN auth_user_tenants ut ON ut.tenant_id=t.id GROUP BY t.id ORDER BY t.name COLLATE NOCASE").all();
+    return result.results ?? [];
+}
+export async function listUserTenantRows(env, userId, { who = "system:read" } = {}) {
+    const result = await createD1(env, { who }).prepare("SELECT t.id,t.name,t.created_at,t.updated_at FROM auth_tenants t JOIN auth_user_tenants ut ON ut.tenant_id=t.id WHERE ut.user_id=? ORDER BY t.name COLLATE NOCASE").bind(userId).all();
+    return result.results ?? [];
+}
+export async function getTenantRow(env, tenantId, { who = "system:read" } = {}) {
+    return await createD1(env, { who }).prepare("SELECT t.id,t.name,t.active,t.created_at,t.updated_at,COUNT(ut.user_id) AS user_count FROM auth_tenants t LEFT JOIN auth_user_tenants ut ON ut.tenant_id=t.id WHERE t.id=? GROUP BY t.id").bind(tenantId).first();
+}
+export async function listTenantUserRows(env, tenantId, { who = "system:read" } = {}) {
+    const result = await createD1(env, { who }).prepare("SELECT u.id,u.email,u.display_name,ut.joined_at FROM auth_user_tenants ut JOIN auth_users u ON u.id=ut.user_id WHERE ut.tenant_id=? ORDER BY u.display_name COLLATE NOCASE,u.email").bind(tenantId).all();
+    return result.results ?? [];
+}
+export async function insertTenantRow(env, tenant, { who = "system:update" } = {}) {
+    await createD1(env, { who }).prepare("INSERT INTO auth_tenants (id,name) VALUES (?,?)").bind(tenant.id, tenant.name).run();
+    return getTenantRow(env, tenant.id, { who });
+}
+export async function updateTenantRow(env, tenantId, name, { who = "system:update" } = {}) {
+    await createD1(env, { who }).prepare("UPDATE auth_tenants SET name=?,updated_at=CURRENT_TIMESTAMP WHERE id=?").bind(name, tenantId).run();
+    return getTenantRow(env, tenantId, { who });
+}
+export async function replaceUserTenantRows(env, userId, tenantIds, { who = "system:update" } = {}) {
+    const db = createD1(env, { who });
+    if (tenantIds.length) {
+        const placeholders = tenantIds.map(() => "?").join(",");
+        const result = await db.prepare(`SELECT id FROM auth_tenants WHERE id IN (${placeholders})`).bind(...tenantIds).all();
+        const found = new Set((result.results ?? []).map((row) => row.id));
+        if (found.size !== tenantIds.length)
+            throw new Error("One or more tenants do not exist.");
+    }
+    await db.batch([
+        db.prepare("DELETE FROM auth_user_tenants WHERE user_id=?").bind(userId),
+        ...tenantIds.map((tenantId) => db.prepare("INSERT INTO auth_user_tenants (user_id,tenant_id) VALUES (?,?)").bind(userId, tenantId)),
+    ]);
+    return listUserTenantRows(env, userId, { who });
+}
+//# sourceMappingURL=d1.js.map

package/dist/auth/tenants/d1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1.js","sourceRoot":"","sources":["../../../src/auth/tenants/d1.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAOxD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,EAAE,GAAG,GAAG,aAAa,EAAE,GAA0B,EAAE;IACpG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,4MAA4M,CAAC,CAAC,GAAG,EAAgC,CAAC;IACtS,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAY,EAAE,MAAc,EAAE,EAAE,GAAG,GAAG,aAAa,EAAE,GAA0B,EAAE;IACxH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,mKAAmK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAgC,CAAC;IAC1Q,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAY,EAAE,QAAgB,EAAE,EAAE,GAAG,GAAG,aAAa,EAAE,GAA0B,EAAE;IACpH,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,0LAA0L,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAuB,CAAC;AACtR,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAY,EAAE,QAAgB,EAAE,EAAE,GAAG,GAAG,aAAa,EAAE,GAA0B,EAAE;IAC1H,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,oLAAoL,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAgC,CAAC;IAC7R,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAY,EAAE,MAAqB,EAAE,EAAE,GAAG,GAAG,eAAe,EAAE,GAA0B,EAAE;IAC9H,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3H,OAAO,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAY,EAAE,QAAgB,EAAE,IAAY,EAAE,EAAE,GAAG,GAAG,eAAe,EAAE,GAA0B,EAAE;IACvI,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,wEAAwE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC;IAC1I,OAAO,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAY,EAAE,MAAc,EAAE,SAA4B,EAAE,EAAE,GAAG,GAAG,eAAe,EAAE,GAA0B,EAAE;IAC3J,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,4CAA4C,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,EAAoC,CAAC;QACxJ,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC;QACb,EAAE,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACxE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,gEAAgE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;KACpI,CAAC,CAAC;IACH,OAAO,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AAClD,CAAC"}

package/dist/auth/tenants/delete.d.ts

@@ -0,0 +1,3 @@
+import type { TenantDatabaseOptions } from "./d1.js";
+export declare function deleteTenantRow(env: unknown, tenantId: string, { who }?: TenantDatabaseOptions): Promise<boolean>;
+//# sourceMappingURL=delete.d.ts.map

package/dist/auth/tenants/delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/auth/tenants/delete.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAErD,wBAAsB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAqB,EAAE,GAAE,qBAA0B,GAAG,OAAO,CAAC,OAAO,CAAC,CAsB7I"}

package/dist/auth/tenants/delete.js

@@ -0,0 +1,28 @@
+import { createD1 } from "../../core/database/index.js";
+import { DEFAULT_TENANT_ID } from "../constants.js";
+export async function deleteTenantRow(env, tenantId, { who = "system:update" } = {}) {
+    if (tenantId === DEFAULT_TENANT_ID)
+        throw new TypeError("The default tenant cannot be deleted.");
+    const db = createD1(env, { who });
+    const existing = await db.prepare("SELECT id FROM auth_tenants WHERE id=?").bind(tenantId).first();
+    if (!existing)
+        return false;
+    const dependencies = await db.prepare(`
+    SELECT
+      (SELECT COUNT(*) FROM auth_user_tenants WHERE tenant_id=?) AS users,
+      (SELECT COUNT(*) FROM auth_tenant_subscriptions WHERE tenant_id=?) AS subscriptions
+  `).bind(tenantId, tenantId).first();
+    if (Number(dependencies?.users || 0) || Number(dependencies?.subscriptions || 0)) {
+        throw new TypeError("Tenant must have no users or subscriptions before it can be deleted.");
+    }
+    const messagingTable = await db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='messaging_conversations'").first();
+    if (messagingTable) {
+        const conversations = await db.prepare("SELECT COUNT(*) AS count FROM messaging_conversations WHERE tenant_id=?").bind(tenantId).first();
+        if (Number(conversations?.count || 0)) {
+            throw new TypeError("Tenant must have no conversations before it can be deleted.");
+        }
+    }
+    await db.prepare("DELETE FROM auth_tenants WHERE id=?").bind(tenantId).run();
+    return true;
+}
+//# sourceMappingURL=delete.js.map

package/dist/auth/tenants/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../src/auth/tenants/delete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAY,EAAE,QAAgB,EAAE,EAAE,GAAG,GAAG,eAAe,EAAE,GAA0B,EAAE;IACzH,IAAI,QAAQ,KAAK,iBAAiB;QAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IACjG,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;IACnG,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;;;;GAIrC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,EAA4C,CAAC;IAC9E,IAAI,MAAM,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,aAAa,IAAI,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,SAAS,CAAC,sEAAsE,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,mFAAmF,CAAC,CAAC,KAAK,EAAE,CAAC;IACrI,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,yEAAyE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAqB,CAAC;QAC5J,IAAI,MAAM,CAAC,aAAa,EAAE,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,MAAM,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/tenants/domain.d.ts

@@ -0,0 +1,8 @@
+import { AppDomain } from "../../domain/index.js";
+import type { AuthTenant, TenantAuthorizationState } from "./model.js";
+/** Composes the tenant model, API policy, handlers, and server-rendered views. */
+export declare class AuthTenantsDomain extends AppDomain<AuthTenant, unknown, TenantAuthorizationState> {
+    constructor();
+}
+export declare const authTenants: AuthTenantsDomain;
+//# sourceMappingURL=domain.d.ts.map

package/dist/auth/tenants/domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../../../src/auth/tenants/domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA6B,MAAM,uBAAuB,CAAC;AAE7E,OAAO,KAAK,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAKvE,kFAAkF;AAClF,qBAAa,iBAAkB,SAAQ,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,wBAAwB,CAAC;IAC7F,cAcC;CACF;AA2CD,eAAO,MAAM,WAAW,mBAA0B,CAAC"}

package/dist/auth/tenants/domain.js

@@ -0,0 +1,64 @@
+import { AppDomain } from "../../domain/index.js";
+import { badRequest, errorMessage, notFound, readJsonObject, stringField } from "../../api/http.js";
+import { createTenant, deleteTenant, getTenant, listTenants, listTenantUsers, updateTenant } from "./service.js";
+import { TenantListView } from "./views/list.js";
+/** Composes the tenant model, API policy, handlers, and server-rendered views. */
+export class AuthTenantsDomain extends AppDomain {
+    constructor() {
+        super({ name: "auth.tenants", basePath: "/api/admin/tenants", auth: "user", scopes: "tenants:read" });
+        this.view("list", TenantListView);
+        this.route({
+            method: "GET",
+            handler: ({ env, identity }) => listTenants(env, { who: identity.who }).then((tenants) => Response.json({ tenants })),
+        });
+        this.route({ method: "POST", csrf: true, scopes: "tenants:manage", handler: create });
+        this.route({ method: "GET", path: "/:tenantId", handler: get });
+        this.route({ method: "GET", path: "/:tenantId/users", handler: ({ env, identity, params }) => listTenantUsers(env, params.tenantId, { who: identity.who }).then((users) => Response.json({ users })) });
+        this.route({ method: ["PUT", "PATCH"], path: "/:tenantId", csrf: true, scopes: "tenants:manage", handler: update });
+        this.route({ method: "DELETE", path: "/:tenantId", csrf: true, scopes: "tenants:delete", handler: remove });
+    }
+}
+async function create({ request, env, identity }) {
+    try {
+        const tenant = await createTenant(env, await readJsonObject(request), { who: identity.who });
+        return Response.json({ tenant }, { status: 201 });
+    }
+    catch (error) {
+        return badRequest(errorMessage(error));
+    }
+}
+async function get({ env, identity, params }) {
+    try {
+        const tenant = await getTenant(env, params.tenantId, { who: identity.who });
+        return tenant ? Response.json({ tenant }) : notFound("Tenant not found.");
+    }
+    catch (error) {
+        return badRequest(errorMessage(error));
+    }
+}
+async function update({ request, env, identity, params }) {
+    try {
+        const name = stringField(await readJsonObject(request), "name");
+        if (!name)
+            return badRequest("name is required");
+        const tenant = await updateTenant(env, params.tenantId, name, { who: identity.who });
+        return tenant ? Response.json({ tenant }) : notFound("Tenant not found.");
+    }
+    catch (error) {
+        return badRequest(errorMessage(error));
+    }
+}
+async function remove({ request, env, identity, params }) {
+    try {
+        if (request.headers.get("X-Confirm-Delete") !== params.tenantId) {
+            return badRequest("X-Confirm-Delete must match the tenant id.");
+        }
+        const deleted = await deleteTenant(env, params.tenantId, { who: identity.who });
+        return deleted ? new Response(null, { status: 204 }) : notFound("Tenant not found.");
+    }
+    catch (error) {
+        return badRequest(errorMessage(error));
+    }
+}
+export const authTenants = new AuthTenantsDomain();
+//# sourceMappingURL=domain.js.map

package/dist/auth/tenants/domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.js","sourceRoot":"","sources":["../../../src/auth/tenants/domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA6B,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEpG,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGjD,kFAAkF;AAClF,MAAM,OAAO,iBAAkB,SAAQ,SAAwD;IAC7F;QACE,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC;YACT,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAC7B,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;SACxF,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAC3F,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5G,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACpH,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9G,CAAC;CACF;AAED,KAAK,UAAU,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAW;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7F,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAW;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5E,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAW;IAC/D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI;YAAE,OAAO,UAAU,CAAC,kBAAkB,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACrF,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAW;IAC/D,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChE,OAAO,UAAU,CAAC,4CAA4C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACvF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,iBAAiB,EAAE,CAAC"}

package/dist/auth/tenants/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./model.js";
+export * from "./validation.js";
+export * from "./policy.js";
+export * from "./d1.js";
+export * from "./service.js";
+export * from "./domain.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/tenants/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/tenants/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/dist/auth/tenants/index.js

@@ -0,0 +1,7 @@
+export * from "./model.js";
+export * from "./validation.js";
+export * from "./policy.js";
+export * from "./d1.js";
+export * from "./service.js";
+export * from "./domain.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/tenants/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/tenants/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/dist/auth/tenants/model.d.ts

@@ -0,0 +1,28 @@
+/** Serializable tenant record. It intentionally has no framework behavior. */
+export interface AuthTenant {
+    id: string;
+    name: string;
+    created_at?: string;
+    updated_at?: string;
+    user_count?: number;
+    active?: boolean | number;
+}
+export interface NewAuthTenant {
+    id: string;
+    name: string;
+}
+export interface TenantUser {
+    id: string;
+    email?: string | null;
+    display_name?: string | null;
+    joined_at?: string;
+}
+export interface TenantAuthorizationState {
+    user?: {
+        auth_strategy?: string;
+    } | null;
+    authUser?: {
+        is_admin?: boolean;
+    } | null;
+}
+//# sourceMappingURL=model.d.ts.map

package/dist/auth/tenants/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/auth/tenants/model.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1C"}

package/dist/auth/tenants/model.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=model.js.map

package/dist/auth/tenants/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../src/auth/tenants/model.ts"],"names":[],"mappings":""}

package/dist/auth/tenants/policy.d.ts

@@ -0,0 +1,3 @@
+import type { TenantAuthorizationState } from "./model.js";
+export declare function canManageTenants(state: TenantAuthorizationState): boolean;
+//# sourceMappingURL=policy.d.ts.map

package/dist/auth/tenants/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/auth/tenants/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAEzE"}

package/dist/auth/tenants/policy.js

@@ -0,0 +1,4 @@
+export function canManageTenants(state) {
+    return state.user?.auth_strategy === "http_basic" || Boolean(state.authUser?.is_admin);
+}
+//# sourceMappingURL=policy.js.map

package/dist/auth/tenants/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/auth/tenants/policy.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,gBAAgB,CAAC,KAA+B;IAC9D,OAAO,KAAK,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACzF,CAAC"}

package/dist/auth/tenants/service.d.ts

@@ -0,0 +1,14 @@
+import type { TenantAuthorizationState, AuthTenant, TenantUser } from "./model.js";
+export interface TenantServiceOptions {
+    who?: string;
+}
+export declare function listTenants(env: unknown, options?: TenantServiceOptions): Promise<AuthTenant[]>;
+export declare function listUserTenants(env: unknown, userId: string, options?: TenantServiceOptions): Promise<AuthTenant[]>;
+export declare function listTenantUsers(env: unknown, tenantId: unknown, options?: TenantServiceOptions): Promise<TenantUser[]>;
+export declare function getTenant(env: unknown, tenantId: unknown, options?: TenantServiceOptions): Promise<AuthTenant | null>;
+export declare function createTenant(env: unknown, input: unknown, options?: TenantServiceOptions): Promise<AuthTenant | null>;
+export declare function updateTenant(env: unknown, tenantId: unknown, name: unknown, options?: TenantServiceOptions): Promise<AuthTenant | null>;
+export declare function deleteTenant(env: unknown, tenantId: unknown, options?: TenantServiceOptions): Promise<boolean>;
+export declare function replaceUserTenants(env: unknown, userId: string, tenantIds: readonly unknown[], options?: TenantServiceOptions): Promise<AuthTenant[]>;
+export declare function assertTenantAdministrator(state: TenantAuthorizationState): void;
+//# sourceMappingURL=service.d.ts.map

package/dist/auth/tenants/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/auth/tenants/service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEnF,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAEnG;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAEvH;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE1H;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAEzH;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAEzH;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAK3I;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAElH;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAEzJ;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI,CAE/E"}

package/dist/auth/tenants/service.js

@@ -0,0 +1,37 @@
+import { deleteTenantRow } from "./delete.js";
+import { getTenantRow, insertTenantRow, listTenantRows, listTenantUserRows, listUserTenantRows, replaceUserTenantRows, updateTenantRow } from "./d1.js";
+import { canManageTenants } from "./policy.js";
+import { validateTenantId, validateTenantInput, validateTenantIds } from "./validation.js";
+export function listTenants(env, options = {}) {
+    return listTenantRows(env, options);
+}
+export function listUserTenants(env, userId, options = {}) {
+    return listUserTenantRows(env, userId, options);
+}
+export function listTenantUsers(env, tenantId, options = {}) {
+    return listTenantUserRows(env, validateTenantId(tenantId), options);
+}
+export function getTenant(env, tenantId, options = {}) {
+    return getTenantRow(env, validateTenantId(tenantId), options);
+}
+export function createTenant(env, input, options = {}) {
+    return insertTenantRow(env, validateTenantInput(input), options);
+}
+export function updateTenant(env, tenantId, name, options = {}) {
+    const id = validateTenantId(tenantId);
+    const tenantName = typeof name === "string" ? name.trim() : "";
+    if (!tenantName)
+        throw new TypeError("Tenant name is required.");
+    return updateTenantRow(env, id, tenantName, options);
+}
+export function deleteTenant(env, tenantId, options = {}) {
+    return deleteTenantRow(env, validateTenantId(tenantId), options);
+}
+export function replaceUserTenants(env, userId, tenantIds, options = {}) {
+    return replaceUserTenantRows(env, userId, validateTenantIds(tenantIds), options);
+}
+export function assertTenantAdministrator(state) {
+    if (!canManageTenants(state))
+        throw new Error("Administrator access is required.");
+}
+//# sourceMappingURL=service.js.map

package/dist/auth/tenants/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/auth/tenants/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AACxJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAO3F,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,OAAO,GAAyB,EAAE;IAC1E,OAAO,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,MAAc,EAAE,OAAO,GAAyB,EAAE;IAC9F,OAAO,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,QAAiB,EAAE,OAAO,GAAyB,EAAE;IACjG,OAAO,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAY,EAAE,QAAiB,EAAE,OAAO,GAAyB,EAAE;IAC3F,OAAO,YAAY,CAAC,GAAG,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAY,EAAE,KAAc,EAAE,OAAO,GAAyB,EAAE;IAC3F,OAAO,eAAe,CAAC,GAAG,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAY,EAAE,QAAiB,EAAE,IAAa,EAAE,OAAO,GAAyB,EAAE;IAC7G,MAAM,EAAE,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACjE,OAAO,eAAe,CAAC,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAY,EAAE,QAAiB,EAAE,OAAO,GAAyB,EAAE;IAC9F,OAAO,eAAe,CAAC,GAAG,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,MAAc,EAAE,SAA6B,EAAE,OAAO,GAAyB,EAAE;IAChI,OAAO,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAA+B;IACvE,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;AACrF,CAAC"}

package/dist/auth/tenants/validation.d.ts

@@ -0,0 +1,5 @@
+import type { NewAuthTenant } from "./model.js";
+export declare function validateTenantId(value: unknown): string;
+export declare function validateTenantInput(value: unknown): NewAuthTenant;
+export declare function validateTenantIds(values: readonly unknown[]): string[];
+//# sourceMappingURL=validation.d.ts.map

package/dist/auth/tenants/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/auth/tenants/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIhD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIvD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAOjE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,EAAE,CAEtE"}

package/dist/auth/tenants/validation.js

@@ -0,0 +1,21 @@
+const TENANT_ID = /^[a-z0-9][a-z0-9_-]*$/;
+export function validateTenantId(value) {
+    const id = typeof value === "string" ? value.trim() : "";
+    if (!TENANT_ID.test(id))
+        throw new TypeError("Tenant id must contain lowercase letters, numbers, hyphens, or underscores.");
+    return id;
+}
+export function validateTenantInput(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("A tenant object is required.");
+    const input = value;
+    const id = validateTenantId(input.id);
+    const name = typeof input.name === "string" ? input.name.trim() : "";
+    if (!name)
+        throw new TypeError("Tenant name is required.");
+    return { id, name };
+}
+export function validateTenantIds(values) {
+    return [...new Set(values.map(validateTenantId))];
+}
+//# sourceMappingURL=validation.js.map

package/dist/auth/tenants/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/auth/tenants/validation.ts"],"names":[],"mappings":"AAEA,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAE1C,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,6EAA6E,CAAC,CAAC;IAC5H,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACrH,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/auth/tenants/views/list.d.ts

@@ -0,0 +1,8 @@
+/** @jsxImportSource hono/jsx */
+import type { FC } from "hono/jsx";
+import type { AuthTenant } from "../model.js";
+export declare const TenantListView: FC<{
+    tenants: readonly AuthTenant[];
+    title?: string;
+}>;
+//# sourceMappingURL=list.d.ts.map

package/dist/auth/tenants/views/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../../src/auth/tenants/views/list.tsx"],"names":[],"mappings":"AAAA,gCAAgC;AAEhC,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,eAAO,MAAM,cAAc,EAAE,EAAE,CAAC;IAAE,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAKjF,CAAC"}

package/dist/auth/tenants/views/list.js

@@ -0,0 +1,3 @@
+import { jsx as _jsx, jsxs as _jsxs } from "hono/jsx/jsx-runtime";
+export const TenantListView = ({ tenants, title = "Tenants" }) => (_jsxs("section", { children: [_jsx("h1", { children: title }), tenants.length ? _jsx("ul", { children: tenants.map((tenant) => _jsxs("li", { children: [_jsx("strong", { children: tenant.name }), _jsx("small", { children: tenant.id })] }, tenant.id)) }) : _jsx("p", { children: "No tenants registered." })] }));
+//# sourceMappingURL=list.js.map

package/dist/auth/tenants/views/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../../src/auth/tenants/views/list.tsx"],"names":[],"mappings":";AAKA,MAAM,CAAC,MAAM,cAAc,GAA2D,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,SAAS,EAAE,EAAE,EAAE,CAAC,CACxH,8BACE,uBAAK,KAAK,GAAM,EACf,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,uBAAK,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,yBAAoB,2BAAS,MAAM,CAAC,IAAI,GAAU,EAAA,0BAAQ,MAAM,CAAC,EAAE,GAAS,KAAnE,MAAM,CAAC,EAAE,CAA+D,CAAC,GAAM,CAAC,CAAC,CAAC,iDAA6B,IAC/J,CACX,CAAC"}