@authhero/multi-tenancy 15.2.0 → 15.3.0

package/dist/types/index.d.ts

@@ -3,14 +3,17 @@ import { MultiTenancyConfig, MultiTenancyHooks, MultiTenancyBindings, MultiTenan
 export * from "./types";
 export { initMultiTenant } from "./init";
 export type { MultiTenantConfig, MultiTenantResult, ControlPlaneConfig, } from "./init";
-export { createDirectRolloutAdapter, projectControlPlaneDefaults, buildControlPlaneDefaultsPayload, applyControlPlaneDefaultsPayload, } from "./rollout";
-export type { ControlPlaneRolloutAdapter, DefaultsProjectionConfig, DefaultsProjectionEntities, DefaultsProjectionResult, EntityProjectionOutcome, ProjectableDefaults, ControlPlaneDefaultsPayload, ControlPlaneDefaultsApplyResult, ControlPlaneTenantSeed, DefaultsPayloadEntities, } from "./rollout";
+export { createDirectRolloutAdapter, projectControlPlaneDefaults, buildControlPlaneDefaultsPayload, applyControlPlaneDefaultsPayload, applyResolvedConfigBlock, buildResolvedConfigBlock, findUndecryptableKeyIds, syncedRowId, } from "./rollout";
+export type { ControlPlaneRolloutAdapter, DefaultsProjectionConfig, DefaultsProjectionEntities, DefaultsProjectionResult, EntityProjectionOutcome, ProjectableDefaults, ControlPlaneDefaultsPayload, ControlPlaneDefaultsApplyResult, ControlPlaneTenantSeed, DefaultsPayloadEntities, ApplyResolvedBlockOptions, ApplyResolvedBlockResult, BuildResolvedBlockOptions, ResolvedConfigBlock, SyncEntity, SyncEntityOutcome, } from "./rollout";
 export * from "./operations";
+export * from "./rollouts";
 export { createSyncHooks } from "./hooks/sync";
 export type { EntitySyncConfig, SyncHooksResult } from "./hooks/sync";
 export { createTenantsOpenAPIRouter } from "./routes";
 export { createMultiTenancyMiddleware, createAccessControlMiddleware, createControlPlaneTenantMiddleware, createSubdomainMiddleware, createDatabaseMiddleware, createProtectSyncedMiddleware, createRuntimeFallbackAdapter, withRuntimeFallback, withSystemResourceServerInheritance, mergeClientWithFallback, } from "./middleware";
 export type { RuntimeFallbackConfig, ControlPlaneResolver } from "./middleware";
+export { createConfigSyncResolver } from "./middleware";
+export type { ConfigSyncResolver, ConfigSyncResolverOptions, } from "./middleware";
 export * from "./inheritance";
 export { createMultiTenancyPlugin } from "./plugin";
 export type { AuthHeroPlugin } from "./plugin";

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAajB,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAKhB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAMnB,cAAc,cAAc,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,kCAAkC,EAClC,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAChF,cAAc,eAAe,CAAC;AAE9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAgBnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB;cAE/C,oBAAoB;eACnB,qBAAqB;0CASnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB;;;;;;;kBAnD9C,oBAAoB;mBACnB,qBAAqB;;;IAwDhC;;;;;;;OAOG;6BAES,OAAO,UAAU,EAAE,YAAY,qBACtB;QAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE;EAOzD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAajB,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAKhB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,gCAAgC,EAChC,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,WAAW,GACZ,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,UAAU,EACV,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAMnB,cAAc,cAAc,CAAC;AAI7B,cAAc,YAAY,CAAC;AAG3B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,kCAAkC,EAClC,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,YAAY,EACV,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,cAAc,eAAe,CAAC;AAE9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAgBnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB;cAE/C,oBAAoB;eACnB,qBAAqB;0CASnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB;;;;;;;kBAnD9C,oBAAoB;mBACnB,qBAAqB;;;IAwDhC;;;;;;;OAOG;6BAES,OAAO,UAAU,EAAE,YAAY,qBACtB;QAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE;EAOzD"}

package/dist/types/inheritance/legacy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"legacy.d.ts","sourceRoot":"","sources":["../../../src/inheritance/legacy.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiCrC;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,YAAY,EAAE,UAAU,GAAG,SAAS,GACnC,UAAU,CAiCZ"}
+{"version":3,"file":"legacy.d.ts","sourceRoot":"","sources":["../../../src/inheritance/legacy.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiCrC;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,YAAY,EAAE,UAAU,GAAG,SAAS,GACnC,UAAU,CAkCZ"}

package/dist/types/inheritance/merge.d.ts

@@ -17,6 +17,7 @@ export declare function effectiveScope(entity: ConfigEntity, row: Publishable):
  * legacy merge behaves: the tenant's values win.
  */
 export declare function effectiveOverride(row: Publishable): ConfigOverride;
+export declare const SECRET_KEY: RegExp;
 type Layer = ConfigRows;
 /**
  * Merges the config of a parent chain with the tenant's own, with no I/O.

package/dist/types/inheritance/merge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../../src/inheritance/merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,cAAc,EACd,WAAW,EAIZ,MAAM,UAAU,CAAC;AAKlB,OAAO,EACL,YAAY,EACZ,UAAU,EACV,cAAc,EAEf,MAAM,SAAS,CAAC;AAEjB,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,WAAW,GACf,WAAW,CAcb;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAElE;AA4ED,KAAK,KAAK,GAAG,UAAU,CAAC;AAExB;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,GAAG,cAAc,CA0GzE"}
+{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../../src/inheritance/merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,cAAc,EACd,WAAW,EAKZ,MAAM,UAAU,CAAC;AAKlB,OAAO,EACL,YAAY,EACZ,UAAU,EACV,cAAc,EAEf,MAAM,SAAS,CAAC;AAEjB,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,WAAW,GACf,WAAW,CAcb;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAElE;AAED,eAAO,MAAM,UAAU,QAA+C,CAAC;AA0EvE,KAAK,KAAK,GAAG,UAAU,CAAC;AAExB;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,GAAG,cAAc,CA0HzE"}

package/dist/types/inheritance/read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/inheritance/read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAoB,MAAM,UAAU,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,6DAA6D;AAC7D,wBAAsB,cAAc,CAClC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CAerB"}
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/inheritance/read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA8B,MAAM,UAAU,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,6DAA6D;AAC7D,wBAAsB,cAAc,CAClC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CA8BrB"}

package/dist/types/inheritance/types.d.ts

@@ -1,9 +1,11 @@
-import type { Action, Branding, Connection, EmailProvider, Hook, PromptSetting, ResourceServer } from "authhero";
+import type { Action, Branding, Connection, EmailProvider, Hook, HookCode, PromptSetting, ResourceServer } from "authhero";
 /** Plain config rows for one tenant. Singletons are `null` when unset. */
 export interface ConfigRows {
     connections: Connection[];
     resourceServers: ResourceServer[];
     hooks: Hook[];
+    /** Code referenced by `code_id` of the code hooks in `hooks`. */
+    hookCode: HookCode[];
     actions: Action[];
     emailProvider: EmailProvider | null;
     branding: Branding | null;

package/dist/types/inheritance/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/inheritance/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EACR,UAAU,EACV,aAAa,EACb,IAAI,EACJ,aAAa,EACb,cAAc,EACf,MAAM,UAAU,CAAC;AAElB,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,aAAa,GAAG,IAAI,CAAC;CACtC;AAED,eAAO,MAAM,eAAe,QAAO,UAQjC,CAAC;AAEH,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,gBAAgB,GAChB,MAAM,GACN,QAAQ,GACR,eAAe,GACf,UAAU,GACV,gBAAgB,CAAC;AAErB,iEAAiE;AACjE,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/inheritance/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EACR,UAAU,EACV,aAAa,EACb,IAAI,EACJ,QAAQ,EACR,aAAa,EACb,cAAc,EACf,MAAM,UAAU,CAAC;AAElB,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,iEAAiE;IACjE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,aAAa,GAAG,IAAI,CAAC;CACtC;AAED,eAAO,MAAM,eAAe,QAAO,UASjC,CAAC;AAEH,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,gBAAgB,GAChB,MAAM,GACN,QAAQ,GACR,eAAe,GACf,UAAU,GACV,gBAAgB,CAAC;AAErB,iEAAiE;AACjE,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB"}

package/dist/types/init.d.ts

@@ -1,4 +1,6 @@
 import { init, AuthHeroConfig, DataAdapters } from "authhero";
+import type { SyncConfigFn, TenantOperationExecutor } from "./operations";
+import { type RolloutDeps } from "./rollouts";
 import type { ControlPlaneResolver } from "./middleware";
 import type { InheritanceShadowOptions } from "./inheritance";
 /**
@@ -63,6 +65,19 @@ export interface MultiTenantConfig extends Omit<AuthHeroConfig, "entityHooks" |
      * @default false
      */
     inheritanceShadow?: boolean | InheritanceShadowOptions;
+    /**
+     * How the `sync-defaults` tenant operation reaches a tenant's database. The
+     * default syncs tenants that share the control plane's database in-process
+     * and refuses tenants with their own worker and database; pass a transport
+     * (for example a dispatch push to the tenant worker) to reach those.
+     */
+    syncDefaults?: SyncConfigFn;
+    /**
+     * Starts the per-tenant operations of a fleet rollout. Defaults to the same
+     * inline executor as `sync-defaults` requests; Workflows deployments pass
+     * `createCloudflareWorkflowsExecutor(...)` so waves run durably.
+     */
+    rolloutExecutor?: TenantOperationExecutor;
     /**
      * Control which entities to sync from control plane to child tenants.
      * Set to `false` to disable all syncing.
@@ -112,6 +127,19 @@ export interface MultiTenantResult {
     app: ReturnType<typeof init>["app"];
     /** The control plane tenant ID */
     controlPlaneTenantId: string;
+    /**
+     * What a scheduled handler needs to keep fleet rollouts moving, present when
+     * the control plane carries the rollouts and tenant operations adapters:
+     *
+     * ```typescript
+     * async scheduled(_event, env) {
+     *   if (!rollouts) return;
+     *   await reconcileConfigDrift(rollouts); // catches lost triggers
+     *   await advanceRollouts(rollouts);      // starts the next wave
+     * }
+     * ```
+     */
+    rollouts?: RolloutDeps;
 }
 /**
  * Initialize a multi-tenant AuthHero application with sensible defaults.

package/dist/types/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,cAAc,EAEd,YAAY,EAGb,MAAM,UAAU,CAAC;AAUlB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,cAAc,EACd,aAAa,GAAG,yBAAyB,CAC1C;IACC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAC;IAEvD;;;;OAIG;IACH,IAAI,CAAC,EACD;QACE,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACD,KAAK,CAAC;IAEV;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE9B;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,cAAc,CAAC,yBAAyB,CAAC,CAAC;IAEpE;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAE5C;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5C;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,GAAG,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,kCAAkC;IAClC,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CA8N5E"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,cAAc,EAEd,YAAY,EAGb,MAAM,UAAU,CAAC;AAUlB,OAAO,KAAK,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AASpB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,cAAc,EACd,aAAa,GAAG,yBAAyB,CAC1C;IACC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAC;IAEvD;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAE5B;;;;OAIG;IACH,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAE1C;;;;OAIG;IACH,IAAI,CAAC,EACD;QACE,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACD,KAAK,CAAC;IAEV;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE9B;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,cAAc,CAAC,yBAAyB,CAAC,CAAC;IAEpE;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAE5C;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5C;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,GAAG,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,kCAAkC;IAClC,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,WAAW,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAoT5E"}

package/dist/types/middleware/config-sync-mode.d.ts

@@ -0,0 +1,36 @@
+import type { ResolvedControlPlane } from "./settings-inheritance";
+/**
+ * Per-tenant config sync mode (docs/design/tenant-config-inheritance.md,
+ * section 5 step 3). A tenant in `synced` mode reads only its own database:
+ * the resolver below answers `undefined` ("do not inherit") for it, which every
+ * read-time inheritance path already understands.
+ */
+export interface ConfigSyncResolver {
+    /** The control plane to inherit from, or `undefined` for opted-out and synced tenants. */
+    resolve(params: {
+        tenant_id: string;
+    }): Promise<ResolvedControlPlane>;
+    /** Whether the tenant is in `synced` mode. Cached; never throws. */
+    isSynced(tenantId: string): Promise<boolean>;
+    /** Forget a tenant's cached mode (or all of them). */
+    invalidate(tenantId?: string): void;
+}
+export interface ConfigSyncResolverOptions {
+    /** The inheritance target for a tenant before the mode is considered. */
+    base: (tenantId: string) => Promise<ResolvedControlPlane>;
+    /** Reads the tenant row, from the raw (uncached) adapter. */
+    getTenant: (tenantId: string) => Promise<{
+        config_sync?: string | null;
+    } | null>;
+    /** The control plane tenant, which is never treated as synced. */
+    controlPlaneTenantId?: string;
+    /**
+     * How long a tenant's mode is remembered, per isolate. A mode change reaches
+     * other isolates within this time. @default 30000
+     */
+    ttlMs?: number;
+    /** Upper bound on remembered tenants. @default 1000 */
+    maxEntries?: number;
+}
+export declare function createConfigSyncResolver(options: ConfigSyncResolverOptions): ConfigSyncResolver;
+//# sourceMappingURL=config-sync-mode.d.ts.map

package/dist/types/middleware/config-sync-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-sync-mode.d.ts","sourceRoot":"","sources":["../../../src/middleware/config-sync-mode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;;;;GAKG;AAEH,MAAM,WAAW,kBAAkB;IACjC,0FAA0F;IAC1F,OAAO,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACtE,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,sDAAsD;IACtD,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,yEAAyE;IACzE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1D,6DAA6D;IAC7D,SAAS,EAAE,CACT,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACrD,kEAAkE;IAClE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,GACjC,kBAAkB,CAwCpB"}

package/dist/types/middleware/index.d.ts

@@ -109,6 +109,8 @@ export declare function createMultiTenancyMiddleware(config: MultiTenancyConfig)
     Variables: MultiTenancyVariables;
 }>;
 export { createProtectSyncedMiddleware } from "./protect-synced";
-export { createRuntimeFallbackAdapter, withRuntimeFallback, withSystemResourceServerInheritance, mergeClientWithFallback, } from "./settings-inheritance";
+export { createRuntimeFallbackAdapter, withRuntimeFallback, withSystemResourceServerInheritance, mergeClientWithFallback, buildResolver, } from "./settings-inheritance";
+export { createConfigSyncResolver } from "./config-sync-mode";
+export type { ConfigSyncResolver, ConfigSyncResolverOptions, } from "./config-sync-mode";
 export type { RuntimeFallbackConfig, ControlPlaneResolver, } from "./settings-inheritance";
 //# sourceMappingURL=index.d.ts.map

package/dist/types/middleware/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGzC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,UAAU,CAAC;AAIlB;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kCAAkC,CAChD,oBAAoB,EAAE,MAAM,GAC3B,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAUD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAsDD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAsED;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAiCD;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAiBD;AAGD,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAGjE,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGzC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,UAAU,CAAC;AAIlB;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kCAAkC,CAChD,oBAAoB,EAAE,MAAM,GAC3B,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAUD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAsDD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAsED;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAiCD;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAiBD;AAGD,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAGjE,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,EACvB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,YAAY,EACV,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC"}

package/dist/types/middleware/protect-synced.d.ts

@@ -1,5 +1,5 @@
 import { MiddlewareHandler } from "hono";
-import type { DataAdapters } from "authhero";
+import { type DataAdapters } from "authhero";
 /**
  * Bindings for the protect system middleware
  */

package/dist/types/middleware/protect-synced.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protect-synced.d.ts","sourceRoot":"","sources":["../../../src/middleware/protect-synced.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAG7C;;GAEG;AACH,UAAU,qBAAqB;IAC7B,IAAI,EAAE,YAAY,CAAC;CACpB;AAED;;GAEG;AACH,UAAU,sBAAsB;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AA4FD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,IAAI,iBAAiB,CAAC;IACjE,QAAQ,EAAE,qBAAqB,CAAC;IAChC,SAAS,EAAE,sBAAsB,CAAC;CACnC,CAAC,CAmCD"}
+{"version":3,"file":"protect-synced.d.ts","sourceRoot":"","sources":["../../../src/middleware/protect-synced.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEzC,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAG5D;;GAEG;AACH,UAAU,qBAAqB;IAC7B,IAAI,EAAE,YAAY,CAAC;CACpB;AAED;;GAEG;AACH,UAAU,sBAAsB;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAoRD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,IAAI,iBAAiB,CAAC;IACjE,QAAQ,EAAE,qBAAqB,CAAC;IAChC,SAAS,EAAE,sBAAsB,CAAC;CACnC,CAAC,CA0CD"}

package/dist/types/middleware/settings-inheritance.d.ts

@@ -1,5 +1,6 @@
 import { DataAdapters, Connection, Client, ResourceServer, ResourceServerScope } from "authhero";
 import { InheritanceShadowOptions } from "../inheritance/report";
+import { ConfigSyncResolver } from "./config-sync-mode";
 /**
  * Merges a connection with control plane fallback options.
  */
@@ -30,7 +31,7 @@ export declare function mergeClientWithFallback(client: Client, controlPlaneClie
  * Resolved inheritance target for a single tenant. `undefined` means the
  * tenant opts out of inheritance entirely.
  */
-type ResolvedControlPlane = {
+export type ResolvedControlPlane = {
     tenantId: string;
     clientId?: string;
 } | undefined;
@@ -45,6 +46,17 @@ type ResolvedControlPlane = {
 export type ControlPlaneResolver = (params: {
     tenant_id: string;
 }) => ResolvedControlPlane | Promise<ResolvedControlPlane>;
+/**
+ * Builds a single resolver from either a static `{tenantId, clientId}` pair
+ * or a user-supplied resolver. The user-supplied resolver, when present,
+ * fully replaces the static fallback — that's the lever a caller uses to
+ * disable inheritance for individual tenants by returning `undefined`.
+ */
+export declare function buildResolver(config: {
+    controlPlaneTenantId?: string;
+    controlPlaneClientId?: string;
+    resolveControlPlane?: ControlPlaneResolver;
+}): (tenantId: string) => Promise<ResolvedControlPlane>;
 /**
  * Wraps data adapters with is_system-gated resource server scope inheritance
  * from a control plane tenant.
@@ -98,6 +110,13 @@ export interface RuntimeFallbackConfig {
      * @default false
      */
     inheritanceShadow?: boolean | InheritanceShadowOptions;
+    /**
+     * Per-tenant `config_sync` mode support. Tenants in `synced` mode read only
+     * their own database. Pass a resolver to share its cache with other adapters
+     * (the management adapter); omit it and one is created. Failed lookups fall
+     * back to inheriting.
+     */
+    configSync?: ConfigSyncResolver;
 }
 /**
  * Creates a data adapter wrapper that provides runtime settings fallback from a control plane tenant.
@@ -162,5 +181,4 @@ export declare function isInheritableHook(hook: unknown): boolean;
  * ```
  */
 export declare function withRuntimeFallback(baseAdapters: DataAdapters, config: RuntimeFallbackConfig): DataAdapters;
-export {};
 //# sourceMappingURL=settings-inheritance.d.ts.map

package/dist/types/middleware/settings-inheritance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,UAAU,EACV,MAAM,EACN,cAAc,EACd,mBAAmB,EAGpB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAE/B;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,UAAU,EACtB,uBAAuB,EAAE,UAAU,EAAE,GACpC,UAAU,CAwBZ;AAcD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,mBAAmB,EAAE,GAAG,SAAS,EAC/C,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,SAAS,GACpD,mBAAmB,EAAE,CAmBvB;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,cAAc,EAAE,cAAc,EAC9B,0BAA0B,EAAE,cAAc,GAAG,IAAI,GAChD,cAAc,CAYhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAChC,MAAM,CAqBR;AAED;;;GAGG;AACH,KAAK,oBAAoB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB,KAAK,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAyH3D;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE;IACN,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C,GACA,YAAY,CAYd;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAC;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CA8Kd;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAKxD;AA8ED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}
+{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,UAAU,EACV,MAAM,EACN,cAAc,EACd,mBAAmB,EAGpB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,kBAAkB,EAEnB,MAAM,oBAAoB,CAAC;AAE5B;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,UAAU,EACtB,uBAAuB,EAAE,UAAU,EAAE,GACpC,UAAU,CAwBZ;AAcD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,mBAAmB,EAAE,GAAG,SAAS,EAC/C,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,SAAS,GACpD,mBAAmB,EAAE,CAmBvB;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,cAAc,EAAE,cAAc,EAC9B,0BAA0B,EAAE,cAAc,GAAG,IAAI,GAChD,cAAc,CAYhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAChC,MAAM,CAqBR;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC,SAAS,CAAC;AAEd;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB,KAAK,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAiBtD;AA4FD;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE;IACN,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C,GACA,YAAY,CAYd;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAC;IAEvD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CA6Ld;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAKxD;AA2FD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}

package/dist/types/operations/enqueue.d.ts

@@ -13,5 +13,12 @@ export declare function createOperationRow(stores: TenantOperationStores, params
  * finalized it) and the error is rethrown so callers keep their existing
  * failure semantics.
  */
-export declare function enqueueTenantOperation(stores: TenantOperationStores, executor: TenantOperationExecutor, params: EnqueueTenantOperationParams): Promise<TenantOperation>;
+export declare function enqueueTenantOperation(stores: TenantOperationStores, executor: TenantOperationExecutor, params: EnqueueTenantOperationParams, options?: {
+    /**
+     * Resolve with the failed operation row instead of rethrowing when the
+     * executor's run fails. For operations whose row is the deliverable
+     * (a sync reports its outcome there), not for callers that need the error.
+     */
+    returnFailed?: boolean;
+}): Promise<TenantOperation>;
 //# sourceMappingURL=enqueue.d.ts.map

package/dist/types/operations/enqueue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enqueue.d.ts","sourceRoot":"","sources":["../../../src/operations/enqueue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAIjB;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,4BAA4B,EACpC,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,GACxC,OAAO,CAAC,eAAe,CAAC,CAyB1B;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,uBAAuB,EACjC,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,eAAe,CAAC,CAgC1B"}
+{"version":3,"file":"enqueue.d.ts","sourceRoot":"","sources":["../../../src/operations/enqueue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAIjB;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,4BAA4B,EACpC,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,GACxC,OAAO,CAAC,eAAe,CAAC,CA0B1B;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,uBAAuB,EACjC,MAAM,EAAE,4BAA4B,EACpC,OAAO,GAAE;IACP;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACnB,GACL,OAAO,CAAC,eAAe,CAAC,CAmC1B"}

package/dist/types/operations/index.d.ts

@@ -4,6 +4,8 @@ export { createOperationRecorder, errorToMessage, isTerminalStatus, } from "./re
 export type { OperationRecorder } from "./recorder";
 export { createInlineExecutor, inlineStepRunner } from "./inline-executor";
 export type { InlineExecutorConfig, TenantOperationDefinitions, TenantOperationStep, TenantOperationStepContext, } from "./inline-executor";
-export { enqueueTenantOperation } from "./enqueue";
+export { createOperationRow, enqueueTenantOperation } from "./enqueue";
+export { createInProcessSyncConfig, runSyncDefaultsStep, summarizeSyncResult, syncErrors, syncOptionsOf, } from "./sync-defaults";
+export type { SyncConfigFn, SyncConfigOptions } from "./sync-defaults";
 export { runRecordedTenantOperation } from "./record-provision";
 //# sourceMappingURL=index.d.ts.map

package/dist/types/operations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/operations/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/operations/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/types/operations/recorder.d.ts

@@ -20,6 +20,8 @@ export declare function createOperationRecorder(stores: TenantOperationStores):
         detail?: Record<string, unknown>;
         attempt?: number;
     }): Promise<void>;
+    /** Stores the operation's outcome (e.g. a dry-run diff). Idempotent. */
+    setResult(operationId: string, result: Record<string, unknown>): Promise<void>;
     markSucceeded(operationId: string): Promise<void>;
     markFailed(operationId: string, error: unknown): Promise<void>;
 };

package/dist/types/operations/recorder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recorder.d.ts","sourceRoot":"","sources":["../../../src/operations/recorder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAIhD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAcrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB;6BAIlC,MAAM,gBAAgB,MAAM;gCAOzB,MAAM,QAAQ,MAAM;6BAKvC,MAAM,SACZ;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EACH,SAAS,GACT,WAAW,GACX,QAAQ,GACR,SAAS,GACT,SAAS,GACT,YAAY,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;+BAW8B,MAAM;4BAQT,MAAM,SAAS,OAAO;EAQvD;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE3E,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,OAAO,CAI3E"}
+{"version":3,"file":"recorder.d.ts","sourceRoot":"","sources":["../../../src/operations/recorder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAIhD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAcrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB;6BAIlC,MAAM,gBAAgB,MAAM;gCAOzB,MAAM,QAAQ,MAAM;6BAKvC,MAAM,SACZ;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EACH,SAAS,GACT,WAAW,GACX,QAAQ,GACR,SAAS,GACT,SAAS,GACT,YAAY,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;IAWH,wEAAwE;2BAC3C,MAAM,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;+BAInC,MAAM;4BAQT,MAAM,SAAS,OAAO;EAQvD;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE3E,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,OAAO,CAI3E"}

package/dist/types/operations/sync-defaults.d.ts

@@ -0,0 +1,55 @@
+import type { DataAdapters, TenantOperation } from "authhero";
+import { ApplyResolvedBlockResult } from "../rollout/resolved-sync";
+import type { ControlPlaneResolver } from "../middleware";
+import type { OperationRecorder } from "./recorder";
+/**
+ * The `sync-defaults` tenant operation (docs/design/tenant-config-inheritance.md
+ * sections 4.1 and 5 step 4): sync one tenant's resolved parent-chain config
+ * into its own database, as a tracked operation with history.
+ *
+ * Execution is split from transport. The steps below are shared by the inline
+ * and the Cloudflare Workflows executor; how the block reaches the tenant's
+ * database (in-process, or pushed to a tenant worker) is a `SyncConfigFn`.
+ */
+export interface SyncConfigOptions {
+    /** Compute and report the diff; write nothing. */
+    dryRun: boolean;
+    /** Apply even when the tenant's stored hash equals the block's. */
+    force: boolean;
+}
+/** Syncs one tenant and returns what happened (or, for a dry run, what would). */
+export type SyncConfigFn = (tenantId: string, options: SyncConfigOptions) => Promise<ApplyResolvedBlockResult>;
+/** Reads the operation's `input` (fixed at creation, never secrets). */
+export declare function syncOptionsOf(operation: Pick<TenantOperation, "input">): SyncConfigOptions;
+/** Every per-entity error message the sync reported. */
+export declare function syncErrors(result: ApplyResolvedBlockResult): string[];
+/**
+ * The JSON-serialisable outcome stored in the operation's `result`: the status,
+ * hash, per-entity counts and the changed `entity:key` list. Never row content
+ * or secrets.
+ */
+export declare function summarizeSyncResult(result: ApplyResolvedBlockResult, options: SyncConfigOptions): Record<string, unknown>;
+/**
+ * The step both executors run: sync, record the outcome on the operation row,
+ * and fail the step when any row reported an error. The result is written
+ * before the failure is raised so a failed run still shows what it did.
+ */
+export declare function runSyncDefaultsStep(params: {
+    operation: Pick<TenantOperation, "id" | "tenant_id" | "input">;
+    syncConfig: SyncConfigFn;
+    recorder: Pick<OperationRecorder, "setResult">;
+}): Promise<Record<string, unknown>>;
+/**
+ * Sync for tenants whose database is the control plane's own (shared
+ * deployments). Reads the chain from, and applies the block to, `adapters`,
+ * which should be the layer that returns secrets as stored (ciphertext) so they
+ * are copied without being decrypted. A tenant with its own worker and database
+ * (`deployment_type: "wfp"`) is not reachable this way: use a dispatch
+ * transport.
+ */
+export declare function createInProcessSyncConfig(adapters: DataAdapters, config: {
+    controlPlaneTenantId: string;
+    resolveControlPlane?: ControlPlaneResolver;
+    maxDepth?: number;
+}): SyncConfigFn;
+//# sourceMappingURL=sync-defaults.d.ts.map

package/dist/types/operations/sync-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-defaults.d.ts","sourceRoot":"","sources":["../../../src/operations/sync-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC9D,OAAO,EACL,wBAAwB,EAGzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;;;GAQG;AAEH,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,MAAM,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,kFAAkF;AAClF,MAAM,MAAM,YAAY,GAAG,CACzB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,KACvB,OAAO,CAAC,wBAAwB,CAAC,CAAC;AAEvC,wEAAwE;AACxE,wBAAgB,aAAa,CAC3B,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,GACxC,iBAAiB,CAGnB;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,EAAE,CAErE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,wBAAwB,EAChC,OAAO,EAAE,iBAAiB,GACzB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmBzB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,CAAC,CAAC;IAC/D,UAAU,EAAE,YAAY,CAAC;IACzB,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;CAChD,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAqBnC;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE;IACN,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,YAAY,CAwBd"}

package/dist/types/operations/types.d.ts

@@ -34,6 +34,8 @@ export interface EnqueueTenantOperationParams {
     initiated_by?: string;
     target_worker_version?: string;
     target_database_version?: string;
+    /** Kind-specific parameters, fixed at creation. Never contains secrets. */
+    input?: Record<string, unknown>;
 }
 /**
  * Executes an already-persisted operation row. Row-first contract: the

package/dist/types/operations/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/operations/types.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,UAAU,CAAC;AAElB;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;QACvB,OAAO,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,aAAa,CAAC;KACjD,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtD,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC3E;AAED,mEAAmE;AACnE,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,qBAAqB,EAAE,4BAA4B,CAAC;CACrD;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,mBAAmB,CAAC;IAC1B,sDAAsD;IACtD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,sBAAsB,CAAC;IACnD,KAAK,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,EAC3C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,OAAO,CAAC,IAAI,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/operations/types.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,UAAU,CAAC;AAElB;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;QACvB,OAAO,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,aAAa,CAAC;KACjD,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtD,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC3E;AAED,mEAAmE;AACnE,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,qBAAqB,EAAE,4BAA4B,CAAC;CACrD;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,mBAAmB,CAAC;IAC1B,sDAAsD;IACtD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,sBAAsB,CAAC;IACnD,KAAK,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,EAC3C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/types/rollout/index.d.ts

@@ -3,6 +3,8 @@ export type { DefaultsProjectionConfig, DefaultsProjectionEntities, DefaultsProj
 export { projectControlPlaneDefaults } from "./defaults-projection";
 export type { ControlPlaneDefaultsPayload, ControlPlaneDefaultsApplyResult, ControlPlaneTenantSeed, DefaultsPayloadEntities, } from "./payload";
 export { buildControlPlaneDefaultsPayload, applyControlPlaneDefaultsPayload, } from "./payload";
+export type { ApplyResolvedBlockOptions, ApplyResolvedBlockResult, BuildResolvedBlockOptions, ResolvedConfigBlock, SyncEntity, SyncEntityOutcome, } from "./resolved-sync";
+export { applyResolvedConfigBlock, buildResolvedConfigBlock, findUndecryptableKeyIds, syncedRowId, } from "./resolved-sync";
 /**
  * A control plane rollout applies the control plane's state to one or more
  * tenant databases. `syncDefaults` is the only operation today; schema

package/dist/types/rollout/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rollout/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE,YAAY,EACV,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,WAAW,CAAC;AAEnB;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAExE;;;OAGG;IACH,qBAAqB,CACnB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,wBAAwB,GAC/B,0BAA0B,CAa5B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rollout/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE,YAAY,EACV,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,UAAU,EACV,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAExE;;;OAGG;IACH,qBAAqB,CACnB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,wBAAwB,GAC/B,0BAA0B,CAa5B"}

package/dist/types/rollout/payload.d.ts

@@ -1,5 +1,6 @@
 import { DataAdapters, SigningKey } from "authhero";
 import { DefaultsProjectionEntities, DefaultsProjectionResult, EntityProjectionOutcome, ProjectableDefaults } from "./defaults-projection";
+import { ApplyResolvedBlockOptions, ApplyResolvedBlockResult, ResolvedConfigBlock } from "./resolved-sync";
 /**
  * Entity flags for the wire payload — the six default entities plus signing
  * keys and tenant rows, which only flow through the payload (build + apply),
@@ -56,11 +57,18 @@ export interface ControlPlaneDefaultsPayload extends ProjectableDefaults {
      * {@link ControlPlaneTenantSeed}.
      */
     tenants: ControlPlaneTenantSeed[];
+    /**
+     * The tenant's resolved parent-chain config, materialised under the tenant's
+     * own id. Optional and opt-in on apply; see {@link ResolvedConfigBlock}.
+     */
+    resolved?: ResolvedConfigBlock;
 }
 /** Result of applying a payload — the projection result plus the key/tenant outcomes. */
 export interface ControlPlaneDefaultsApplyResult extends DefaultsProjectionResult {
     signingKeys: EntityProjectionOutcome;
     tenants: EntityProjectionOutcome;
+    /** Present when a `resolved` block was applied (or dry-run). */
+    resolved?: ApplyResolvedBlockResult;
 }
 /**
  * Reads the control plane's defaults + public signing keys off a control-plane
@@ -87,5 +95,12 @@ export declare function buildControlPlaneDefaultsPayload(controlPlaneAdapters: D
 export declare function applyControlPlaneDefaultsPayload(payload: ControlPlaneDefaultsPayload, targetAdapters: DataAdapters, controlPlaneTenantId: string, options?: {
     continueOnError?: boolean;
     entities?: DefaultsPayloadEntities;
+    /**
+     * Also apply the payload's `resolved` block to `tenantId`. Without this the
+     * block is ignored, so existing callers are unaffected.
+     */
+    resolved?: ApplyResolvedBlockOptions & {
+        tenantId: string;
+    };
 }): Promise<ControlPlaneDefaultsApplyResult>;
 //# sourceMappingURL=payload.d.ts.map

package/dist/types/rollout/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../src/rollout/payload.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,UAAU,EAKX,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EAQpB,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,0BAA0B,GAAG;IACjE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE;;;;;OAKG;IACH,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B;;;;OAIG;IACH,OAAO,EAAE,sBAAsB,EAAE,CAAC;CACnC;AAED,yFAAyF;AACzF,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAC/E,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAkBD;;;;;;;;GAQG;AACH,wBAAsB,gCAAgC,CACpD,oBAAoB,EAAE,YAAY,EAClC,oBAAoB,EAAE,MAAM,EAC5B,QAAQ,GAAE,uBAA4B,EACtC,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,2BAA2B,CAAC,CAqCtC;AA0FD;;;;;;;;;;;GAWG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,2BAA2B,EACpC,cAAc,EAAE,YAAY,EAC5B,oBAAoB,EAAE,MAAM,EAC5B,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CAC/B,GACL,OAAO,CAAC,+BAA+B,CAAC,CAoD1C"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../src/rollout/payload.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,UAAU,EAKX,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EAQpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,mBAAmB,EAEpB,MAAM,iBAAiB,CAAC;AAEzB;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,0BAA0B,GAAG;IACjE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE;;;;;OAKG;IACH,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B;;;;OAIG;IACH,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC;AAED,yFAAyF;AACzF,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAC/E,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;IACjC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,wBAAwB,CAAC;CACrC;AAkBD;;;;;;;;GAQG;AACH,wBAAsB,gCAAgC,CACpD,oBAAoB,EAAE,YAAY,EAClC,oBAAoB,EAAE,MAAM,EAC5B,QAAQ,GAAE,uBAA4B,EACtC,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,2BAA2B,CAAC,CAqCtC;AA0FD;;;;;;;;;;;GAWG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,2BAA2B,EACpC,cAAc,EAAE,YAAY,EAC5B,oBAAoB,EAAE,MAAM,EAC5B,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,uBAAuB,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,EAAE,yBAAyB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACxD,GACL,OAAO,CAAC,+BAA+B,CAAC,CA+D1C"}

package/dist/types/rollout/resolved-sync.d.ts

@@ -0,0 +1,91 @@
+import { Action, Branding, Connection, DataAdapters, EmailProvider, Hook, HookCode, KeyRing, PromptSetting, ResourceServer } from "authhero";
+/**
+ * Sync of a tenant's resolved config (docs/design/tenant-config-inheritance.md,
+ * section 4.1). The block is the tenant's parent chain merged with
+ * `mergeConfig` and materialised under the **tenant's own id**. It carries only
+ * what is inherited, never the tenant's own rows.
+ *
+ * Rows get deterministic ids derived from the target tenant, the entity and
+ * the stable key, so a re-sync finds its rows by id and never touches a row the
+ * tenant owns. Secrets are copied as stored (ciphertext).
+ */
+export type SyncEntity = "connection" | "resourceServer" | "hook" | "hookCode" | "action";
+export declare const SYNC_ENTITIES: readonly ["connection", "resourceServer", "hookCode", "action", "hook"];
+export interface ResolvedConfigBlock {
+    version: 1;
+    /** Ancestors the block was resolved from, nearest first. */
+    chain: string[];
+    connections: Connection[];
+    resourceServers: ResourceServer[];
+    hookCode: HookCode[];
+    actions: Action[];
+    hooks: Hook[];
+    emailProvider: EmailProvider | null;
+    branding: Branding | null;
+    promptSettings: PromptSetting | null;
+    /** `<entity>:<key>` of rows from `platform`-scoped ancestor rows. */
+    hidden: string[];
+    /** Explicit deletes. Only executed when the apply asks for `deletes`. */
+    deletes: Array<{
+        entity: SyncEntity;
+        key: string;
+    }>;
+    /** Content hash of everything above; equal hash means nothing to apply. */
+    hash: string;
+}
+export interface BuildResolvedBlockOptions {
+    /** Control plane used as implicit parent for tenants without `parent_tenant_id`. */
+    legacyControlPlane?: string;
+    maxDepth?: number;
+    deletes?: ResolvedConfigBlock["deletes"];
+}
+/**
+ * Deterministic id of a synced row: the type prefix, a `sy` marker and 15 hex
+ * characters of a hash of (tenant, entity, key). 17 characters after the
+ * prefix, the same shape as the ids each adapter generates.
+ */
+export declare function syncedRowId(entity: SyncEntity, tenantId: string, key: string): Promise<string>;
+/** The stable key a row is synced by (matches `mergeConfig`). */
+export declare function keyOf(entity: SyncEntity, row: unknown): string;
+/**
+ * Resolves `tenantId`'s parent chain into the block to push. Reads from
+ * `adapters`, which should be the layer that returns secrets as stored
+ * (ciphertext), so they are copied without being decrypted.
+ */
+export declare function buildResolvedConfigBlock(adapters: DataAdapters, tenantId: string, options?: BuildResolvedBlockOptions): Promise<ResolvedConfigBlock>;
+/**
+ * Checks that `ring` can decrypt every ciphertext in the block. Returns the
+ * key ids it cannot (never the values).
+ */
+export declare function findUndecryptableKeyIds(block: ResolvedConfigBlock, ring: KeyRing): Promise<string[]>;
+export interface ApplyResolvedBlockOptions {
+    /** Compute the diff and report it; write nothing. */
+    dryRun?: boolean;
+    /** Execute the block's explicit `deletes`. @default false */
+    deletes?: boolean;
+    /** Apply even when the stored hash equals the block hash. */
+    force?: boolean;
+    /**
+     * The tenant's key ring. When given, the apply is refused before any write if
+     * it cannot decrypt a key id the block carries.
+     */
+    keyRing?: KeyRing;
+    /** Keep going after a failed row instead of throwing. @default true */
+    continueOnError?: boolean;
+}
+export interface SyncEntityOutcome {
+    added: number;
+    changed: number;
+    unchanged: number;
+    deleted: number;
+    errors: string[];
+}
+export interface ApplyResolvedBlockResult {
+    status: "applied" | "up-to-date" | "dry-run";
+    hash: string;
+    entities: Record<SyncEntity | "emailProvider" | "branding" | "promptSettings", SyncEntityOutcome>;
+    /** `<entity>:<key>` of rows that would be/were added, changed or deleted. */
+    changes: string[];
+}
+export declare function applyResolvedConfigBlock(block: ResolvedConfigBlock, target: DataAdapters, tenantId: string, options?: ApplyResolvedBlockOptions): Promise<ApplyResolvedBlockResult>;
+//# sourceMappingURL=resolved-sync.d.ts.map

package/dist/types/rollout/resolved-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolved-sync.d.ts","sourceRoot":"","sources":["../../../src/rollout/resolved-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,aAAa,EACb,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,aAAa,EACb,cAAc,EASf,MAAM,UAAU,CAAC;AAMlB;;;;;;;;;GASG;AAEH,MAAM,MAAM,UAAU,GAClB,YAAY,GACZ,gBAAgB,GAChB,MAAM,GACN,UAAU,GACV,QAAQ,CAAC;AAEb,eAAO,MAAM,aAAa,yEAMgB,CAAC;AAE3C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,CAAC,CAAC;IACX,4DAA4D;IAC5D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,qEAAqE;IACrE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yEAAyE;IACzE,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,yBAAyB;IACxC,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;CAC1C;AAoCD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,iEAAiE;AACjE,wBAAgB,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,CAc9D;AAMD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,mBAAmB,CAAC,CA6B9B;AAuBD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CAQnB;AAMD,MAAM,WAAW,yBAAyB;IACxC,qDAAqD;IACrD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CACd,UAAU,GAAG,eAAe,GAAG,UAAU,GAAG,gBAAgB,EAC5D,iBAAiB,CAClB,CAAC;IACF,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAYD,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,mBAAmB,EAC1B,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAsPnC"}