@authhero/multi-tenancy 14.24.1 → 14.25.1

package/dist/types/index.d.ts

@@ -3,8 +3,8 @@ import { MultiTenancyConfig, MultiTenancyHooks, MultiTenancyBindings, MultiTenan
 export * from "./types";
 export { initMultiTenant } from "./init";
 export type { MultiTenantConfig, MultiTenantResult, ControlPlaneConfig, } from "./init";
-export { createDirectRolloutAdapter, projectControlPlaneDefaults, } from "./rollout";
-export type { ControlPlaneRolloutAdapter, DefaultsProjectionConfig, DefaultsProjectionEntities, DefaultsProjectionResult, EntityProjectionOutcome, } from "./rollout";
+export { createDirectRolloutAdapter, projectControlPlaneDefaults, buildControlPlaneDefaultsPayload, applyControlPlaneDefaultsPayload, } from "./rollout";
+export type { ControlPlaneRolloutAdapter, DefaultsProjectionConfig, DefaultsProjectionEntities, DefaultsProjectionResult, EntityProjectionOutcome, ProjectableDefaults, ControlPlaneDefaultsPayload, ControlPlaneDefaultsApplyResult, ControlPlaneTenantSeed, DefaultsPayloadEntities, } from "./rollout";
 export { createSyncHooks } from "./hooks/sync";
 export type { EntitySyncConfig, SyncHooksResult } from "./hooks/sync";
 export { createTenantsOpenAPIRouter } from "./routes";

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAajB,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAKhB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,kCAAkC,EAClC,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEhF,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAgBnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB;cAE/C,oBAAoB;eACnB,qBAAqB;0CASnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB;;;;;;;kBAnD9C,oBAAoB;mBACnB,qBAAqB;;;IAwDhC;;;;;;;OAOG;6BAES,OAAO,UAAU,EAAE,YAAY,qBACtB;QAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE;EAOzD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAajB,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAKhB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,kCAAkC,EAClC,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEhF,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAgBnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB;cAE/C,oBAAoB;eACnB,qBAAqB;0CASnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB;;;;;;;kBAnD9C,oBAAoB;mBACnB,qBAAqB;;;IAwDhC;;;;;;;OAOG;6BAES,OAAO,UAAU,EAAE,YAAY,qBACtB;QAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE;EAOzD"}

package/dist/types/rollout/defaults-projection.d.ts

@@ -1,4 +1,4 @@
-import { DataAdapters } from "authhero";
+import { DataAdapters, Connection, ResourceServer, Hook, EmailProvider, Branding, PromptSetting } from "authhero";
 /**
  * Which control plane entities to project into a tenant's own database. Every
  * entity defaults to `true`.
@@ -18,6 +18,30 @@ export interface DefaultsProjectionEntities {
     branding?: boolean;
     promptSettings?: boolean;
 }
+/** Entity flags resolved to concrete booleans (all defaulted to `true`). */
+export interface ResolvedDefaultsEntities {
+    connections: boolean;
+    resourceServers: boolean;
+    hooks: boolean;
+    emailProvider: boolean;
+    branding: boolean;
+    promptSettings: boolean;
+}
+export declare function resolveDefaultsEntities(entities?: DefaultsProjectionEntities): ResolvedDefaultsEntities;
+/**
+ * The control plane defaults as plain data — the result of reading them off a
+ * control plane adapter. This is also the non-key half of the wire payload
+ * (`ControlPlaneDefaultsPayload`), so the same `writeControlPlaneDefaults` path
+ * serves both the in-process projection and the apply-a-payload path.
+ */
+export interface ProjectableDefaults {
+    connections: Connection[];
+    resourceServers: ResourceServer[];
+    hooks: Hook[];
+    emailProvider: EmailProvider | null;
+    branding: Branding | null;
+    promptSettings: PromptSetting | null;
+}
 export interface DefaultsProjectionConfig {
     /**
      * The control plane tenant id. Projected rows are written into the target
@@ -62,6 +86,28 @@ export interface DefaultsProjectionResult {
     branding: EntityProjectionOutcome;
     promptSettings: EntityProjectionOutcome;
 }
+export declare function emptyOutcome(): EntityProjectionOutcome;
+export declare function emptyResult(tenantId: string): DefaultsProjectionResult;
+export declare function isInheritableHook(hook: Hook): boolean;
+/**
+ * Runs `op`, routing any failure either to a thrown error (loud, default) or to
+ * the outcome's `errors` array (when `continueOnError`).
+ */
+export declare function attempt(outcome: EntityProjectionOutcome, label: string, continueOnError: boolean, op: () => Promise<void>): Promise<void>;
+/**
+ * Reads the control plane's defaults off `cp` into plain data. Returns the full
+ * (unfiltered) set; the `is_system` / `inheritable` filters are applied on the
+ * write side so reads stay uniform. Entities whose flag is false are skipped
+ * (empty array / null) so callers don't pay for rows they won't write.
+ */
+export declare function readControlPlaneDefaults(cp: DataAdapters, cpId: string, project: ResolvedDefaultsEntities): Promise<ProjectableDefaults>;
+/**
+ * Writes `data` into `target` under `cpId`, upserting each row by its stable id
+ * so re-runs converge. Resource servers are filtered to `is_system` and hooks
+ * to `inheritable` — the same set the runtime fallback reads — so passing the
+ * full (unfiltered) read result here is safe. `result` is mutated in place.
+ */
+export declare function writeControlPlaneDefaults(data: ProjectableDefaults, target: DataAdapters, cpId: string, project: ResolvedDefaultsEntities, continueOnError: boolean, result: DefaultsProjectionResult): Promise<void>;
 /**
  * Projects the control plane tenant's inheritable defaults into a single target
  * tenant's database, writing the rows under the control plane tenant id so the

package/dist/types/rollout/defaults-projection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaults-projection.d.ts","sourceRoot":"","sources":["../../../src/rollout/defaults-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAQb,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;OAIG;IACH,uBAAuB,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;IAErD;;;;;OAKG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzD,sDAAsD;IACtD,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IAEtC;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,uBAAuB,CAAC;IACrC,eAAe,EAAE,uBAAuB,CAAC;IACzC,KAAK,EAAE,uBAAuB,CAAC;IAC/B,aAAa,EAAE,uBAAuB,CAAC;IACvC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,cAAc,EAAE,uBAAuB,CAAC;CACzC;AAgCD;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,wBAAwB,EAChC,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,wBAAwB,CAAC,CAyJnC"}
+{"version":3,"file":"defaults-projection.d.ts","sourceRoot":"","sources":["../../../src/rollout/defaults-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,UAAU,EACV,cAAc,EACd,IAAI,EACJ,aAAa,EACb,QAAQ,EACR,aAAa,EAKd,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,4EAA4E;AAC5E,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,GAAE,0BAA+B,GACxC,wBAAwB,CAS1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,aAAa,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;OAIG;IACH,uBAAuB,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;IAErD;;;;;OAKG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzD,sDAAsD;IACtD,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IAEtC;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,uBAAuB,CAAC;IACrC,eAAe,EAAE,uBAAuB,CAAC;IACzC,KAAK,EAAE,uBAAuB,CAAC;IAC/B,aAAa,EAAE,uBAAuB,CAAC;IACvC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,cAAc,EAAE,uBAAuB,CAAC;CACzC;AAED,wBAAgB,YAAY,IAAI,uBAAuB,CAEtD;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,CAUtE;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAGrD;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,MAAM,EACb,eAAe,EAAE,OAAO,EACxB,EAAE,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GACtB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,YAAY,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,mBAAmB,CAAC,CAyC9B;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,wBAAwB,EACjC,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAqGf;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,wBAAwB,EAChC,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,wBAAwB,CAAC,CA0BnC"}

package/dist/types/rollout/index.d.ts

@@ -1,6 +1,8 @@
 import { DefaultsProjectionConfig, DefaultsProjectionResult } from "./defaults-projection";
-export type { DefaultsProjectionConfig, DefaultsProjectionEntities, DefaultsProjectionResult, EntityProjectionOutcome, } from "./defaults-projection";
+export type { DefaultsProjectionConfig, DefaultsProjectionEntities, DefaultsProjectionResult, EntityProjectionOutcome, ProjectableDefaults, } from "./defaults-projection";
 export { projectControlPlaneDefaults } from "./defaults-projection";
+export type { ControlPlaneDefaultsPayload, ControlPlaneDefaultsApplyResult, ControlPlaneTenantSeed, DefaultsPayloadEntities, } from "./payload";
+export { buildControlPlaneDefaultsPayload, applyControlPlaneDefaultsPayload, } from "./payload";
 /**
  * A control plane rollout applies the control plane's state to one or more
  * tenant databases. `syncDefaults` is the only operation today; schema

package/dist/types/rollout/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rollout/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAExE;;;OAGG;IACH,qBAAqB,CACnB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,wBAAwB,GAC/B,0BAA0B,CAa5B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rollout/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE,YAAY,EACV,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,WAAW,CAAC;AAEnB;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAExE;;;OAGG;IACH,qBAAqB,CACnB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,wBAAwB,GAC/B,0BAA0B,CAa5B"}

package/dist/types/rollout/payload.d.ts

@@ -0,0 +1,91 @@
+import { DataAdapters, SigningKey } from "authhero";
+import { DefaultsProjectionEntities, DefaultsProjectionResult, EntityProjectionOutcome, ProjectableDefaults } from "./defaults-projection";
+/**
+ * Entity flags for the wire payload — the six default entities plus signing
+ * keys and tenant rows, which only flow through the payload (build + apply),
+ * never through the in-process `projectControlPlaneDefaults`.
+ */
+export type DefaultsPayloadEntities = DefaultsProjectionEntities & {
+    signingKeys?: boolean;
+    /**
+     * Seed the FK-target `tenants` rows into the tenant DB before writing the
+     * keyed defaults. Defaults to `true`. See {@link ControlPlaneTenantSeed}.
+     */
+    tenants?: boolean;
+};
+/**
+ * A minimal `tenants` row the payload carries so the tenant DB has the foreign
+ * key targets every other write depends on. D1 enforces the
+ * `tenant_id -> tenants(id)` FK, so a freshly provisioned tenant DB (which only
+ * has the empty `tenants` table the migrations create) rejects every
+ * tenant-scoped insert until these rows exist:
+ *
+ *  1. the **control-plane tenant id** — the projected defaults
+ *     (connections / resource servers / hooks / …) are keyed under it; and
+ *  2. the **target tenant's own id** — the tenant's own users / connections /
+ *     sessions reference it.
+ *
+ * Deliberately minimal (`id` + `friendly_name`): the FK only needs the row to
+ * exist, `friendly_name` is the only required create field, and keeping it
+ * minimal avoids shipping control-plane tenant settings/secrets into a tenant
+ * DB. Rows are create-if-missing on apply, so a re-sync never clobbers a row a
+ * tenant has since edited.
+ */
+export interface ControlPlaneTenantSeed {
+    id: string;
+    friendly_name: string;
+}
+/**
+ * Wire shape pushed from a control plane to a tenant database. Transport-
+ * agnostic: a Cloudflare dispatch push, an HTTP POST, or an in-process call all
+ * carry this same object. Built on the control plane with
+ * {@link buildControlPlaneDefaultsPayload} and applied on the tenant with
+ * {@link applyControlPlaneDefaultsPayload}.
+ */
+export interface ControlPlaneDefaultsPayload extends ProjectableDefaults {
+    /**
+     * Control-plane shared `jwt_signing` keys, PUBLIC material only. Invariant:
+     * `pkcs7` (the private key) is stripped on build AND re-stripped on apply, so
+     * a private key can never cross the wire or land in a tenant DB. Used to
+     * verify tokens the control plane signed (e.g. forwarded admin tokens).
+     */
+    signingKeys: SigningKey[];
+    /**
+     * FK-target `tenants` rows upserted into the tenant DB *before* any keyed
+     * default, so the `tenant_id -> tenants(id)` FK resolves. See
+     * {@link ControlPlaneTenantSeed}.
+     */
+    tenants: ControlPlaneTenantSeed[];
+}
+/** Result of applying a payload — the projection result plus the key/tenant outcomes. */
+export interface ControlPlaneDefaultsApplyResult extends DefaultsProjectionResult {
+    signingKeys: EntityProjectionOutcome;
+    tenants: EntityProjectionOutcome;
+}
+/**
+ * Reads the control plane's defaults + public signing keys off a control-plane
+ * adapter and filters them down to the inheritable, shareable set — the wire
+ * payload. Mirrors what `projectControlPlaneDefaults` writes, minus the write.
+ *
+ * The signing-key selection reuses authhero's `listControlPlaneKeys`
+ * (`-_exists_:tenant_id`) so the public-key query has a single source of truth;
+ * this layer only strips `pkcs7`.
+ */
+export declare function buildControlPlaneDefaultsPayload(controlPlaneAdapters: DataAdapters, controlPlaneTenantId: string, entities?: DefaultsPayloadEntities, targetTenantId?: string): Promise<ControlPlaneDefaultsPayload>;
+/**
+ * Applies a control-plane defaults payload to a tenant's own adapter, writing
+ * the rows under `controlPlaneTenantId` so the runtime fallback resolves them
+ * locally. Reuses the same upsert/filter path as `projectControlPlaneDefaults`
+ * (via `writeControlPlaneDefaults`) and adds the dedicated signing-key path.
+ *
+ * The payload is a trust boundary: every singleton is re-parsed with its schema
+ * and signing keys are re-stripped of `pkcs7` before anything is written.
+ *
+ * `result.tenantId` is the control-plane tenant id the rows are keyed under
+ * (the target adapter already _is_ the tenant's database).
+ */
+export declare function applyControlPlaneDefaultsPayload(payload: ControlPlaneDefaultsPayload, targetAdapters: DataAdapters, controlPlaneTenantId: string, options?: {
+    continueOnError?: boolean;
+    entities?: DefaultsPayloadEntities;
+}): Promise<ControlPlaneDefaultsApplyResult>;
+//# sourceMappingURL=payload.d.ts.map

package/dist/types/rollout/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../src/rollout/payload.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,UAAU,EAKX,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EAQpB,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,0BAA0B,GAAG;IACjE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE;;;;;OAKG;IACH,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B;;;;OAIG;IACH,OAAO,EAAE,sBAAsB,EAAE,CAAC;CACnC;AAED,yFAAyF;AACzF,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAC/E,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAkBD;;;;;;;;GAQG;AACH,wBAAsB,gCAAgC,CACpD,oBAAoB,EAAE,YAAY,EAClC,oBAAoB,EAAE,MAAM,EAC5B,QAAQ,GAAE,uBAA4B,EACtC,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,2BAA2B,CAAC,CAqCtC;AA0FD;;;;;;;;;;;GAWG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,2BAA2B,EACpC,cAAc,EAAE,YAAY,EAC5B,oBAAoB,EAAE,MAAM,EAC5B,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CAC/B,GACL,OAAO,CAAC,+BAA+B,CAAC,CAoD1C"}

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "14.24.1",
+  "version": "14.25.1",
   "description": "Multi-tenancy support for AuthHero with organization-based access control and per-tenant database isolation",
   "files": [
     "dist"
@@ -38,7 +38,7 @@
     "vitest": "^4.1.7",
     "@authhero/adapter-interfaces": "3.1.1",
     "@authhero/kysely-adapter": "11.8.9",
-    "authhero": "8.4.1"
+    "authhero": "8.7.0"
   },
   "dependencies": {
     "zod": "^4.4.3"