@authhero/multi-tenancy 15.1.1 → 15.2.0

package/dist/types/index.d.ts

@@ -11,6 +11,7 @@ export type { EntitySyncConfig, SyncHooksResult } from "./hooks/sync";
 export { createTenantsOpenAPIRouter } from "./routes";
 export { createMultiTenancyMiddleware, createAccessControlMiddleware, createControlPlaneTenantMiddleware, createSubdomainMiddleware, createDatabaseMiddleware, createProtectSyncedMiddleware, createRuntimeFallbackAdapter, withRuntimeFallback, withSystemResourceServerInheritance, mergeClientWithFallback, } from "./middleware";
 export type { RuntimeFallbackConfig, ControlPlaneResolver } from "./middleware";
+export * from "./inheritance";
 export { createMultiTenancyPlugin } from "./plugin";
 export type { AuthHeroPlugin } from "./plugin";
 export { createAccessControlHooks, createDatabaseHooks, createProvisioningHooks, } from "./hooks";

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAajB,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAKhB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAMnB,cAAc,cAAc,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,kCAAkC,EAClC,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEhF,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAgBnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB;cAE/C,oBAAoB;eACnB,qBAAqB;0CASnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB;;;;;;;kBAnD9C,oBAAoB;mBACnB,qBAAqB;;;IAwDhC;;;;;;;OAOG;6BAES,OAAO,UAAU,EAAE,YAAY,qBACtB;QAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE;EAOzD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAajB,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAKhB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAMnB,cAAc,cAAc,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,kCAAkC,EAClC,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAChF,cAAc,eAAe,CAAC;AAE9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAgBnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB;cAE/C,oBAAoB;eACnB,qBAAqB;0CASnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB;;;;;;;kBAnD9C,oBAAoB;mBACnB,qBAAqB;;;IAwDhC;;;;;;;OAOG;6BAES,OAAO,UAAU,EAAE,YAAY,qBACtB;QAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE;EAOzD"}

package/dist/types/inheritance/chain.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Resolves a tenant's ancestors, nearest first.
+ *
+ * A tenant with `parent_tenant_id` follows that chain. A tenant without one
+ * falls back to the legacy control plane as an implicit single parent, so the
+ * result matches what read-time inheritance does today. `legacyControlPlane`
+ * is `undefined` when the tenant opts out of inheritance.
+ */
+export declare function resolveTenantChain(params: {
+    tenantId: string;
+    getTenant: (id: string) => Promise<{
+        id: string;
+        parent_tenant_id?: string | null;
+    } | null>;
+    legacyControlPlane?: string;
+    maxDepth?: number;
+}): Promise<string[]>;
+//# sourceMappingURL=chain.d.ts.map

package/dist/types/inheritance/chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../../src/inheritance/chain.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,CACT,EAAE,EAAE,MAAM,KACP,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACtE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAgCpB"}

package/dist/types/inheritance/index.d.ts

@@ -0,0 +1,10 @@
+export { resolveTenantChain } from "./chain";
+export { effectiveOverride, effectiveScope, mergeConfig } from "./merge";
+export { computeLegacyConfig } from "./legacy";
+export { readConfigRows } from "./read";
+export { compareShadow, diffConfig } from "./shadow";
+export type { ShadowDiff } from "./shadow";
+export { createShadowReporter } from "./report";
+export type { InheritanceShadowOptions, ShadowReporter } from "./report";
+export type { ConfigRows, ConfigEntity, ResolvedConfig } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/inheritance/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/inheritance/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACrD,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,YAAY,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACzE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC"}

package/dist/types/inheritance/legacy.d.ts

@@ -0,0 +1,7 @@
+import { ConfigRows } from "./types";
+/**
+ * What read-time inheritance returns for a tenant today, computed from plain
+ * rows with the very helpers the runtime fallback adapter uses.
+ */
+export declare function computeLegacyConfig(tenant: ConfigRows, controlPlane: ConfigRows | undefined): ConfigRows;
+//# sourceMappingURL=legacy.d.ts.map

package/dist/types/inheritance/legacy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy.d.ts","sourceRoot":"","sources":["../../../src/inheritance/legacy.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiCrC;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,YAAY,EAAE,UAAU,GAAG,SAAS,GACnC,UAAU,CAiCZ"}

package/dist/types/inheritance/merge.d.ts

@@ -0,0 +1,39 @@
+import type { ConfigOverride, ConfigScope } from "authhero";
+import { ConfigEntity, ConfigRows, ResolvedConfig } from "./types";
+type Publishable = {
+    scope?: ConfigScope | null;
+    override?: ConfigOverride | null;
+    is_system?: boolean;
+    metadata?: unknown;
+};
+/**
+ * Scope of a row. An explicit `scope` wins. Unset falls back to what
+ * read-time inheritance does today for that entity, so rows nobody has
+ * annotated behave as before.
+ */
+export declare function effectiveScope(entity: ConfigEntity, row: Publishable): ConfigScope;
+/**
+ * What a child may change on a row. Unset is "fields" because that is how the
+ * legacy merge behaves: the tenant's values win.
+ */
+export declare function effectiveOverride(row: Publishable): ConfigOverride;
+type Layer = ConfigRows;
+/**
+ * Merges the config of a parent chain with the tenant's own, with no I/O.
+ *
+ * `chain` is the ancestors' rows **nearest first** (the same order as
+ * `resolveTenantChain`); `tenant` is the tenant's own rows. Rules
+ * (docs/design/tenant-config-inheritance.md, 3.3):
+ * - rows merge by a stable key and the nearest layer wins, limited by the
+ *   `override` of the layer above;
+ * - hooks and actions add up: an ancestor's shared rows appear in addition to
+ *   the tenant's own;
+ * - `local` rows of an ancestor are not visible; `platform` rows are merged
+ *   but listed in `hidden`.
+ *
+ * `enforce` does not affect the merged result yet; it constrains edits and
+ * deletes, which come with the management API changes.
+ */
+export declare function mergeConfig(chain: Layer[], tenant: Layer): ResolvedConfig;
+export {};
+//# sourceMappingURL=merge.d.ts.map

package/dist/types/inheritance/merge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../../src/inheritance/merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,cAAc,EACd,WAAW,EAIZ,MAAM,UAAU,CAAC;AAKlB,OAAO,EACL,YAAY,EACZ,UAAU,EACV,cAAc,EAEf,MAAM,SAAS,CAAC;AAEjB,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,WAAW,GACf,WAAW,CAcb;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAElE;AA4ED,KAAK,KAAK,GAAG,UAAU,CAAC;AAExB;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,GAAG,cAAc,CA0GzE"}

package/dist/types/inheritance/read.d.ts

@@ -0,0 +1,5 @@
+import { DataAdapters } from "authhero";
+import { ConfigRows } from "./types";
+/** Reads every config entity of one tenant as plain rows. */
+export declare function readConfigRows(adapters: DataAdapters, tenantId: string): Promise<ConfigRows>;
+//# sourceMappingURL=read.d.ts.map

package/dist/types/inheritance/read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/inheritance/read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAoB,MAAM,UAAU,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,6DAA6D;AAC7D,wBAAsB,cAAc,CAClC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CAerB"}

package/dist/types/inheritance/report.d.ts

@@ -0,0 +1,20 @@
+import { DataAdapters } from "authhero";
+/**
+ * Options for config inheritance shadow mode. Shadow mode compares the parent
+ * chain resolver with read-time inheritance and logs differences; it never
+ * changes what a request sees.
+ */
+export interface InheritanceShadowOptions {
+    /** Fraction of reads (0..1) that may start a comparison. @default 1 */
+    sample?: number;
+    /** Minimum time between comparisons of the same tenant. @default 60000 */
+    intervalMs?: number;
+    /** Also log differences that are expected (inherited rows the tenant lacks). @default false */
+    includeExpected?: boolean;
+}
+export interface ShadowReporter {
+    /** Starts a comparison for `tenantId` in the background, if due. */
+    schedule(tenantId: string, legacyControlPlane: string | undefined): void;
+}
+export declare function createShadowReporter(adapters: DataAdapters, options: InheritanceShadowOptions): ShadowReporter;
+//# sourceMappingURL=report.d.ts.map

package/dist/types/inheritance/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../../src/inheritance/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAY,MAAM,UAAU,CAAC;AAGlD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAKD,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;CAC1E;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,wBAAwB,GAChC,cAAc,CAiDhB"}

package/dist/types/inheritance/shadow.d.ts

@@ -0,0 +1,30 @@
+import type { DataAdapters } from "authhero";
+import { ConfigEntity, ConfigRows } from "./types";
+export interface ShadowDiff {
+    entity: ConfigEntity;
+    key: string;
+    kind: "missing" | "extra" | "changed";
+    /** Top-level fields that differ (`changed` only). Values are never logged. */
+    fields: string[];
+    /**
+     * The new model materialises inherited rows into the tenant, where
+     * read-time inheritance only overlays rows the tenant already has. A row
+     * that is `extra` for that reason is expected and not a bug.
+     */
+    expected: boolean;
+    legacy_hash?: string;
+    new_hash?: string;
+}
+export declare function sha256(input: string): Promise<string>;
+export declare function diffConfig(legacy: ConfigRows, next: ConfigRows): Promise<ShadowDiff[]>;
+/**
+ * Computes the new resolver's result and the legacy result for a tenant and
+ * returns their differences. Reads only; the resolver result is never used.
+ */
+export declare function compareShadow(params: {
+    adapters: DataAdapters;
+    tenantId: string;
+    legacyControlPlane?: string;
+    maxDepth?: number;
+}): Promise<ShadowDiff[]>;
+//# sourceMappingURL=shadow.d.ts.map

package/dist/types/inheritance/shadow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shadow.d.ts","sourceRoot":"","sources":["../../../src/inheritance/shadow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAK7C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEnD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACtC,8EAA8E;IAC9E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAgBD,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS3D;AA2FD,wBAAsB,UAAU,CAC9B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,EAAE,CAAC,CA+CvB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE;IAC1C,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CA0BxB"}

package/dist/types/inheritance/types.d.ts

@@ -0,0 +1,22 @@
+import type { Action, Branding, Connection, EmailProvider, Hook, PromptSetting, ResourceServer } from "authhero";
+/** Plain config rows for one tenant. Singletons are `null` when unset. */
+export interface ConfigRows {
+    connections: Connection[];
+    resourceServers: ResourceServer[];
+    hooks: Hook[];
+    actions: Action[];
+    emailProvider: EmailProvider | null;
+    branding: Branding | null;
+    promptSettings: PromptSetting | null;
+}
+export declare const emptyConfigRows: () => ConfigRows;
+export type ConfigEntity = "connection" | "resourceServer" | "hook" | "action" | "emailProvider" | "branding" | "promptSettings";
+/** Result of merging a parent chain into one tenant's config. */
+export interface ResolvedConfig extends ConfigRows {
+    /**
+     * Keys (`<entity>:<key>`) of rows that came from a `platform`-scoped
+     * ancestor row: merged so they can run, but hidden from the tenant.
+     */
+    hidden: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types/inheritance/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/inheritance/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EACR,UAAU,EACV,aAAa,EACb,IAAI,EACJ,aAAa,EACb,cAAc,EACf,MAAM,UAAU,CAAC;AAElB,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,aAAa,GAAG,IAAI,CAAC;CACtC;AAED,eAAO,MAAM,eAAe,QAAO,UAQjC,CAAC;AAEH,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,gBAAgB,GAChB,MAAM,GACN,QAAQ,GACR,eAAe,GACf,UAAU,GACV,gBAAgB,CAAC;AAErB,iEAAiE;AACjE,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB"}

package/dist/types/init.d.ts

@@ -1,5 +1,6 @@
 import { init, AuthHeroConfig, DataAdapters } from "authhero";
 import type { ControlPlaneResolver } from "./middleware";
+import type { InheritanceShadowOptions } from "./inheritance";
 /**
  * Control plane configuration for multi-tenancy.
  */
@@ -53,6 +54,15 @@ export interface MultiTenantConfig extends Omit<AuthHeroConfig, "entityHooks" |
      * ```
      */
     resolveControlPlane?: ControlPlaneResolver;
+    /**
+     * Shadow mode for config inheritance: compares the parent chain resolver
+     * with read-time inheritance in the background and logs differences as log
+     * type `cfgdiff`, queryable per tenant. Never affects a response.
+     * `true` uses the defaults.
+     *
+     * @default false
+     */
+    inheritanceShadow?: boolean | InheritanceShadowOptions;
     /**
      * Control which entities to sync from control plane to child tenants.
      * Set to `false` to disable all syncing.

package/dist/types/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,cAAc,EAEd,YAAY,EAGb,MAAM,UAAU,CAAC;AAUlB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGzD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,cAAc,EACd,aAAa,GAAG,yBAAyB,CAC1C;IACC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;OAIG;IACH,IAAI,CAAC,EACD;QACE,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACD,KAAK,CAAC;IAEV;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE9B;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,cAAc,CAAC,yBAAyB,CAAC,CAAC;IAEpE;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAE5C;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5C;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,GAAG,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,kCAAkC;IAClC,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CA4N5E"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,cAAc,EAEd,YAAY,EAGb,MAAM,UAAU,CAAC;AAUlB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,cAAc,EACd,aAAa,GAAG,yBAAyB,CAC1C;IACC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAC;IAEvD;;;;OAIG;IACH,IAAI,CAAC,EACD;QACE,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACD,KAAK,CAAC;IAEV;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE9B;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,cAAc,CAAC,yBAAyB,CAAC,CAAC;IAEpE;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAE5C;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5C;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,GAAG,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,kCAAkC;IAClC,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CA8N5E"}

package/dist/types/middleware/settings-inheritance.d.ts

@@ -1,4 +1,18 @@
-import { DataAdapters, Client } from "authhero";
+import { DataAdapters, Connection, Client, ResourceServer, ResourceServerScope } from "authhero";
+import { InheritanceShadowOptions } from "../inheritance/report";
+/**
+ * Merges a connection with control plane fallback options.
+ */
+export declare function mergeConnectionWithFallback(connection: Connection, controlPlaneConnections: Connection[]): Connection;
+/**
+ * Merges resource server scopes with control plane fallback.
+ * Tenant-specific scopes override control plane scopes with the same value.
+ */
+export declare function mergeResourceServerScopes(tenantScopes: ResourceServerScope[] | undefined, controlPlaneScopes: ResourceServerScope[] | undefined): ResourceServerScope[];
+/**
+ * Merges a resource server with control plane fallback scopes.
+ */
+export declare function mergeResourceServerWithFallback(resourceServer: ResourceServer, controlPlaneResourceServer: ResourceServer | null): ResourceServer;
 /**
  * Merges a client with control plane fallback URLs.
  *
@@ -75,6 +89,15 @@ export interface RuntimeFallbackConfig {
      * control plane id.
      */
     resolveControlPlane?: ControlPlaneResolver;
+    /**
+     * Shadow mode for config inheritance. When set, reads also start a
+     * background comparison of the parent chain resolver against the result of
+     * this adapter and log differences with log type `cfgdiff`. The comparison
+     * never changes what a request sees. `true` uses the defaults.
+     *
+     * @default false
+     */
+    inheritanceShadow?: boolean | InheritanceShadowOptions;
 }
 /**
  * Creates a data adapter wrapper that provides runtime settings fallback from a control plane tenant.
@@ -112,6 +135,13 @@ export interface RuntimeFallbackConfig {
  * ```
  */
 export declare function createRuntimeFallbackAdapter(baseAdapters: DataAdapters, config: RuntimeFallbackConfig): DataAdapters;
+/**
+ * Returns true when a hook is marked as inheritable by the control plane.
+ * Inheritable hooks surface on every sub-tenant's `hooks.list` so a single
+ * control-plane row drives behaviour fleet-wide. Reads `metadata.inheritable`
+ * on any hook variant (web/form/template/code).
+ */
+export declare function isInheritableHook(hook: unknown): boolean;
 /**
  * Helper function to wrap data adapters with runtime fallback from control plane.
  *

package/dist/types/middleware/settings-inheritance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAEZ,MAAM,EAKP,MAAM,UAAU,CAAC;AA8FlB;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAChC,MAAM,CAqBR;AAED;;;GAGG;AACH,KAAK,oBAAoB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB,KAAK,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAyH3D;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE;IACN,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C,GACA,YAAY,CAYd;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CA6Jd;AA2FD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}
+{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,UAAU,EACV,MAAM,EACN,cAAc,EACd,mBAAmB,EAGpB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAE/B;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,UAAU,EACtB,uBAAuB,EAAE,UAAU,EAAE,GACpC,UAAU,CAwBZ;AAcD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,mBAAmB,EAAE,GAAG,SAAS,EAC/C,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,SAAS,GACpD,mBAAmB,EAAE,CAmBvB;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,cAAc,EAAE,cAAc,EAC9B,0BAA0B,EAAE,cAAc,GAAG,IAAI,GAChD,cAAc,CAYhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAChC,MAAM,CAqBR;AAED;;;GAGG;AACH,KAAK,oBAAoB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB,KAAK,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAyH3D;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE;IACN,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C,GACA,YAAY,CAYd;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAC;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CA8Kd;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAKxD;AA8ED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}

package/dist/types/routes/tenants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenants.d.ts","sourceRoot":"","sources":["../../../src/routes/tenants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAkB,MAAM,mBAAmB,CAAC;AAWhE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,UAAU,CAAC;AAyClB;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB;cAGZ,oBAAoB;eACnB,qBAAqB;YA0hBnC"}
+{"version":3,"file":"tenants.d.ts","sourceRoot":"","sources":["../../../src/routes/tenants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAkB,MAAM,mBAAmB,CAAC;AAWhE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,UAAU,CAAC;AA0ClB;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB;cAGZ,oBAAoB;eACnB,qBAAqB;YAujBnC"}

package/dist/types/utils/index.d.ts

@@ -1,3 +1,4 @@
 export { fetchAll } from "authhero";
 export type { FetchAllOptions } from "authhero";
+export { validateTenantParent, DEFAULT_MAX_TENANT_DEPTH } from "./tenant-tree";
 //# sourceMappingURL=index.d.ts.map

package/dist/types/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC"}

package/dist/types/utils/tenant-tree.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Default maximum number of ancestors a tenant may have. The tree is limited
+ * to two levels above a tenant to begin with, but callers pass the limit so it
+ * is not hard-coded in the model (docs/design/tenant-config-inheritance.md,
+ * section 3.1).
+ */
+export declare const DEFAULT_MAX_TENANT_DEPTH = 2;
+/**
+ * Validates `parent_tenant_id` for a tenant that is being created or
+ * re-parented. Throws a 400 when the parent does not exist, when the new
+ * parent would create a cycle, or when the resulting chain of ancestors is
+ * longer than `maxDepth`.
+ *
+ * Pure with respect to storage: ancestors are read through `getTenant`.
+ * Nothing reads the parent yet; this only keeps the stored tree valid.
+ */
+export declare function validateTenantParent(params: {
+    tenantId: string | undefined;
+    parentTenantId: string | null | undefined;
+    getTenant: (id: string) => Promise<{
+        id: string;
+        parent_tenant_id?: string | null;
+    } | null>;
+    /**
+     * Returns the ids of a tenant's direct children. When given, the subtree
+     * below `tenantId` is validated too: re-parenting pushes every descendant
+     * down, so each resulting chain must still fit within `maxDepth`.
+     */
+    getChildren?: (id: string) => Promise<string[]>;
+    maxDepth?: number;
+}): Promise<void>;
+//# sourceMappingURL=tenant-tree.d.ts.map

package/dist/types/utils/tenant-tree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-tree.d.ts","sourceRoot":"","sources":["../../../src/utils/tenant-tree.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC1C,SAAS,EAAE,CACT,EAAE,EAAE,MAAM,KACP,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACtE;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkEhB"}

package/package.json

@@ -9,9 +9,9 @@
   "homepage": "https://authhero.net",
   "repository": {
     "type": "git",
-    "url": "https://github.com/markusahlstrand/authhero"
+    "url": "https://github.com/sesamyab/authhero"
   },
-  "version": "15.1.1",
+  "version": "15.2.0",
   "description": "Multi-tenancy support for AuthHero with organization-based access control and per-tenant database isolation",
   "files": [
     "dist"
@@ -36,9 +36,9 @@
     "typescript": "^5.6.0",
     "vite": "^8.0.14",
     "vitest": "^4.1.7",
-    "@authhero/adapter-interfaces": "4.19.0",
-    "@authhero/kysely-adapter": "12.13.0",
-    "authhero": "9.22.0"
+    "@authhero/adapter-interfaces": "4.22.0",
+    "@authhero/kysely-adapter": "12.16.0",
+    "authhero": "9.25.0"
   },
   "dependencies": {
     "zod": "^4.4.3"