@authhero/multi-tenancy 15.2.0 → 15.3.0

package/dist/types/rollouts/advance.d.ts

@@ -0,0 +1,44 @@
+import type { Rollout } from "authhero";
+import type { RolloutDeps } from "./types";
+export type RolloutTickOutcome = "skipped" | "waiting" | "planned-empty" | "paused" | "started" | "running" | "done";
+export interface RolloutTickResult {
+    rolloutId: string;
+    outcome: RolloutTickOutcome;
+    /** Operations started by this tick. */
+    started: number;
+    /** The wave being worked on, when there is one. */
+    wave?: number;
+}
+/**
+ * Advances one rollout by one step. Stateless and idempotent: all state is the
+ * rollout row and its operations, so a tick can run from a cron, after a
+ * request, or twice at once.
+ *
+ *  1. A write-triggered rollout waits out its debounce, then is planned.
+ *  2. The current wave is the lowest one with unfinished operations. Before it
+ *     starts, the previous wave is checked: the canary pauses the rollout on any
+ *     failure, later waves when the failed fraction exceeds the threshold.
+ *  3. Up to `max_concurrent` pending operations of the current wave are started.
+ *  4. When every operation is finished the rollout is `done`.
+ */
+export declare function advanceRollout(deps: RolloutDeps, rolloutOrId: Rollout | string): Promise<RolloutTickResult>;
+export interface AdvanceRolloutsOptions {
+    /** Most rollouts to advance in one call. @default 20 */
+    limit?: number;
+    logger?: Pick<Console, "warn">;
+}
+/**
+ * Advances every open `config-sync` rollout one step. Meant for a host's
+ * scheduled handler (every few minutes). A rollout that throws does not stop
+ * the others.
+ */
+export declare function advanceRollouts(deps: RolloutDeps, options?: AdvanceRolloutsOptions): Promise<RolloutTickResult[]>;
+/** Pauses a rollout; nothing further is started until it is resumed. */
+export declare function pauseRollout(deps: RolloutDeps, rolloutId: string, reason?: string): Promise<Rollout | null>;
+/**
+ * Resumes a paused rollout, accepting the failures that paused it: the waves
+ * finished so far are no longer checked, and the next wave starts on the next
+ * tick. Tenants that failed are picked up again by the next drift reconcile.
+ */
+export declare function resumeRollout(deps: RolloutDeps, rolloutId: string): Promise<Rollout | null>;
+//# sourceMappingURL=advance.d.ts.map

package/dist/types/rollouts/advance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advance.d.ts","sourceRoot":"","sources":["../../../src/rollouts/advance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAmB,MAAM,UAAU,CAAC;AAUzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,SAAS,GACT,eAAe,GACf,QAAQ,GACR,SAAS,GACT,SAAS,GACT,MAAM,CAAC;AAEX,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAiCD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,OAAO,GAAG,MAAM,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CA6G5B;AAED,MAAM,WAAW,sBAAsB;IACrC,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,WAAW,EACjB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAiB9B;AAED,wEAAwE;AACxE,wBAAsB,YAAY,CAChC,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,SAA0B,GAC/B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAOzB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAoBzB"}

package/dist/types/rollouts/config.d.ts

@@ -0,0 +1,54 @@
+import type { Rollout } from "authhero";
+/**
+ * Settings of a `config-sync` rollout, stored in the rollout's `config` column.
+ * Waves are cumulative percentages of the rolled-out tenants; the canary is a
+ * count that goes first. A wave is checked when it finishes: the canary pauses
+ * the rollout on any failure, later waves when the failed fraction exceeds
+ * `failure_threshold`.
+ */
+export interface ConfigSyncRolloutConfig {
+    /** Tenants synced first, on their own. */
+    canary: number;
+    /** Cumulative percentages, ascending, ending at 100. */
+    waves: number[];
+    /** Failed fraction of a wave (0..1) above which the rollout pauses. */
+    failure_threshold: number;
+    /** Operations started per tick. */
+    max_concurrent: number;
+    /** Quiet time after the last write before a write-triggered rollout plans. */
+    debounce_ms: number;
+    /** What started it. */
+    trigger: "write" | "reconcile" | "manual";
+    /** The tenant whose descendants are rolled out to. */
+    root_tenant_id: string;
+    /** The tenant whose write requested it (write trigger). */
+    origin_tenant_id?: string;
+    /** Sync nothing, only report the diff. */
+    dry_run?: boolean;
+    /** Apply even when a tenant's stored hash matches. */
+    force?: boolean;
+    /** False while a write-triggered request waits out its debounce. */
+    planned?: boolean;
+    /** Tenants in the rollout, set when planned. */
+    tenant_count?: number;
+    /** Waves up to and including this one have been accepted by an operator. */
+    accepted_through?: number;
+}
+export declare const DEFAULT_ROLLOUT_WAVES: number[];
+export declare const DEFAULT_ROLLOUT_SETTINGS: {
+    readonly canary: 1;
+    readonly waves: number[];
+    readonly failure_threshold: 0.1;
+    readonly max_concurrent: 25;
+    readonly debounce_ms: 60000;
+};
+/** Reads a rollout's config, filling defaults for anything missing. */
+export declare function readRolloutConfig(rollout: Pick<Rollout, "config">): ConfigSyncRolloutConfig;
+/**
+ * Assigns each of `count` tenants (already in rollout order) to a wave: wave 0
+ * is the canary, then one wave per percentage step. Boundaries are
+ * `ceil(count * pct / 100)`; empty waves are dropped and the last wave always
+ * reaches the end.
+ */
+export declare function assignWaves(count: number, canary: number, waves: number[]): number[];
+//# sourceMappingURL=config.d.ts.map

package/dist/types/rollouts/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/rollouts/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IAEpB,uBAAuB;IACvB,OAAO,EAAE,OAAO,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC1C,sDAAsD;IACtD,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0CAA0C;IAC1C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sDAAsD;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,qBAAqB,UAAgB,CAAC;AAEnD,eAAO,MAAM,wBAAwB;;;;;;CAM3B,CAAC;AAEX,uEAAuE;AACvE,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAC/B,uBAAuB,CAYzB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,GACd,MAAM,EAAE,CA0BV"}

package/dist/types/rollouts/controller.d.ts

@@ -0,0 +1,29 @@
+import type { Rollout } from "authhero";
+import type { RolloutDeps } from "./types";
+export interface CreateRolloutParams {
+    /** Roll out to the synced descendants of this tenant. Defaults to the control plane. */
+    rootTenantId?: string;
+    /** Limit the rollout to these tenants (those that are synced descendants). */
+    tenantIds?: string[];
+    canary?: number;
+    waves?: number[];
+    failureThreshold?: number;
+    /** Operations started per tick. */
+    maxConcurrent?: number;
+    dryRun?: boolean;
+    force?: boolean;
+    initiatedBy?: string;
+}
+export interface RolloutController {
+    /** Plans a manual rollout and starts its canary. */
+    create(params: CreateRolloutParams): Promise<Rollout>;
+    pause(id: string, reason?: string): Promise<Rollout | null>;
+    resume(id: string): Promise<Rollout | null>;
+}
+/**
+ * The operations a management API needs on rollouts that go beyond reading and
+ * updating rows. Wired by `initMultiTenant`, like the tenant operation
+ * executor.
+ */
+export declare function createRolloutController(deps: RolloutDeps): RolloutController;
+//# sourceMappingURL=controller.d.ts.map

package/dist/types/rollouts/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/rollouts/controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAOxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,MAAM,WAAW,mBAAmB;IAClC,wFAAwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,WAAW,GAAG,iBAAiB,CAgC5E"}

package/dist/types/rollouts/enumerate.d.ts

@@ -0,0 +1,25 @@
+import { type DataAdapters } from "authhero";
+export interface FleetTenant {
+    tenantId: string;
+    /** Levels below the root; 1 for a direct child. */
+    depth: number;
+    /** The content hash last applied to the tenant, if any. */
+    appliedHash: string | null;
+}
+export interface EnumerateOptions {
+    /**
+     * The control plane a tenant without a `parent_tenant_id` inherits from, as
+     * `resolveTenantChain` uses it (`undefined` when the tenant opts out).
+     */
+    resolveLegacyParent: (tenantId: string) => Promise<string | undefined>;
+    /** Longest chain to follow before giving up on a tenant (cycle guard). */
+    maxDepth?: number;
+}
+/**
+ * The tenants below `rootId` that receive pushes (`config_sync: "synced"`),
+ * ordered by depth and then id, so a parent is always rolled out before its
+ * children. Parents are resolved like `resolveTenantChain`: `parent_tenant_id`,
+ * else the legacy control plane. Reads every tenant once.
+ */
+export declare function listSyncedDescendants(adapters: Pick<DataAdapters, "tenants">, rootId: string, options: EnumerateOptions): Promise<FleetTenant[]>;
+//# sourceMappingURL=enumerate.d.ts.map

package/dist/types/rollouts/enumerate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enumerate.d.ts","sourceRoot":"","sources":["../../../src/rollouts/enumerate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,YAAY,EAAe,MAAM,UAAU,CAAC;AAEpE,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACvE,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,EACvC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,WAAW,EAAE,CAAC,CA4CxB"}

package/dist/types/rollouts/hashes.d.ts

@@ -0,0 +1,10 @@
+import type { RolloutDeps } from "./types";
+/** The tenant the sync would treat as the implicit parent of `tenantId`. */
+export declare function resolveLegacyParent(deps: Pick<RolloutDeps, "controlPlaneTenantId" | "resolveControlPlane">, tenantId: string): Promise<string | undefined>;
+/**
+ * The hash a sync of `tenantId` would store right now. The hash depends on the
+ * chain and its content, not on the tenant, so tenants that share a chain share
+ * one computation (memoised for the life of the returned function).
+ */
+export declare function createExpectedHash(deps: Pick<RolloutDeps, "adapters" | "controlPlaneTenantId" | "resolveControlPlane" | "maxDepth">): (tenantId: string) => Promise<string>;
+//# sourceMappingURL=hashes.d.ts.map

package/dist/types/rollouts/hashes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashes.d.ts","sourceRoot":"","sources":["../../../src/rollouts/hashes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,4EAA4E;AAC5E,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,sBAAsB,GAAG,qBAAqB,CAAC,EACvE,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAG7B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,IAAI,CACR,WAAW,EACX,UAAU,GAAG,sBAAsB,GAAG,qBAAqB,GAAG,UAAU,CACzE,GACA,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAuBvC"}

package/dist/types/rollouts/index.d.ts

@@ -0,0 +1,19 @@
+export { DEFAULT_ROLLOUT_SETTINGS, DEFAULT_ROLLOUT_WAVES, assignWaves, readRolloutConfig, } from "./config";
+export type { ConfigSyncRolloutConfig } from "./config";
+export { listSyncedDescendants } from "./enumerate";
+export type { EnumerateOptions, FleetTenant } from "./enumerate";
+export { createExpectedHash } from "./hashes";
+export { listRolloutOperations, planRollout } from "./plan";
+export type { PlanResult } from "./plan";
+export { advanceRollout, advanceRollouts, pauseRollout, resumeRollout, } from "./advance";
+export type { AdvanceRolloutsOptions, RolloutTickOutcome, RolloutTickResult, } from "./advance";
+export { getConfigSyncStatus } from "./status";
+export type { ConfigSyncStatus, ConfigSyncStatusDeps } from "./status";
+export { reconcileConfigDrift } from "./reconcile";
+export type { ReconcileConfigDriftOptions, ReconcileConfigDriftResult, } from "./reconcile";
+export { createRolloutWriteHooks, isPublishedRow, requestRollout, } from "./trigger";
+export type { PublishableEntity, RolloutWriteHooks } from "./trigger";
+export { createRolloutController } from "./controller";
+export type { CreateRolloutParams, RolloutController } from "./controller";
+export type { RolloutDeps } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/rollouts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rollouts/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC5D,YAAY,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EACL,cAAc,EACd,eAAe,EACf,YAAY,EACZ,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,YAAY,EACV,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC"}

package/dist/types/rollouts/plan.d.ts

@@ -0,0 +1,29 @@
+import type { Rollout, TenantOperation } from "authhero";
+import type { RolloutDeps } from "./types";
+export declare const OPEN_ROLLOUT_STATUSES: readonly ["pending", "canary", "rolling", "paused"];
+export declare function storesOf(deps: RolloutDeps): {
+    tenantOperations: import("authhero").TenantOperationsAdapter;
+    tenantOperationEvents: import("authhero").TenantOperationEventsAdapter;
+};
+export declare function rolloutsOf(deps: RolloutDeps): import("authhero").RolloutsAdapter;
+export interface PlanResult {
+    /** Tenants that get a sync operation. */
+    planned: number;
+    /** Candidates left out because they are already up to date. */
+    upToDate: number;
+}
+/**
+ * Turns a rollout into per-tenant `sync-defaults` operations: lists the synced
+ * descendants of the rollout's root (parents before children), leaves out the
+ * ones whose stored hash already matches (unless `force`), splits the rest into
+ * a canary and percentage waves, and creates one `pending` operation each. The
+ * rollout's `config` records the result. A rollout with nothing to do ends
+ * `done` (a write-triggered one, which exists only because something was
+ * written, is removed instead of leaving noise).
+ */
+export declare function planRollout(deps: RolloutDeps, rollout: Rollout, options?: {
+    tenantIds?: string[];
+}): Promise<PlanResult>;
+/** Every operation of a rollout, oldest first. */
+export declare function listRolloutOperations(deps: RolloutDeps, rolloutId: string): Promise<TenantOperation[]>;
+//# sourceMappingURL=plan.d.ts.map

package/dist/types/rollouts/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../../src/rollouts/plan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAKzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,eAAO,MAAM,qBAAqB,qDAKxB,CAAC;AAEX,wBAAgB,QAAQ,CAAC,IAAI,EAAE,WAAW;;;EAMzC;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,sCAK3C;AAED,MAAM,WAAW,UAAU;IACzB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GACrC,OAAO,CAAC,UAAU,CAAC,CAyErB;AAED,kDAAkD;AAClD,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,EAAE,CAAC,CAsB5B"}

package/dist/types/rollouts/reconcile.d.ts

@@ -0,0 +1,38 @@
+import type { RolloutDeps } from "./types";
+export interface ReconcileConfigDriftOptions {
+    /** The tenant whose descendants are checked. Defaults to the control plane. */
+    rootTenantId?: string;
+    /** Most tenants to report and roll out in one call. @default 500 */
+    limit?: number;
+    /**
+     * A tenant whose latest sync failed less than this long ago is reported but
+     * not rolled out again, so a tenant that keeps failing does not get a new
+     * rollout on every run. @default 3600000 (one hour)
+     */
+    retryAfterMs?: number;
+    logger?: Pick<Console, "warn">;
+}
+export interface ReconcileConfigDriftResult {
+    /** Synced tenants compared. */
+    checked: number;
+    /** Tenants whose applied hash differs from what their chain publishes. */
+    drifted: number;
+    /** Drifted tenants a running rollout already covers. */
+    alreadyCovered: number;
+    /** Drifted tenants left out because their latest sync failed recently. */
+    recentlyFailed: number;
+    /** The rollout created for the rest, if any. */
+    rolloutId?: string;
+}
+/**
+ * The safety net for lost triggers (design 4.3): compares every synced
+ * tenant's applied hash with the hash its chain would produce now. Drifted
+ * tenants get a `cfgdrift` log (queryable per tenant) and, unless an open
+ * rollout already covers them, one new rollout. Idempotent: running it again
+ * before the rollout finishes creates nothing, and once the tenants are synced
+ * there is nothing left to find.
+ *
+ * Run it from a scheduled handler, followed by `advanceRollouts`.
+ */
+export declare function reconcileConfigDrift(deps: RolloutDeps, options?: ReconcileConfigDriftOptions): Promise<ReconcileConfigDriftResult>;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/types/rollouts/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../../src/rollouts/reconcile.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAG3C,MAAM,WAAW,2BAA2B;IAC1C,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,0BAA0B;IACzC,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,cAAc,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,WAAW,EACjB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,0BAA0B,CAAC,CA0IrC"}

package/dist/types/rollouts/status.d.ts

@@ -0,0 +1,28 @@
+import type { RolloutDeps } from "./types";
+export type ConfigSyncStatusDeps = Pick<RolloutDeps, "adapters" | "controlPlaneTenantId" | "resolveControlPlane" | "maxDepth">;
+export interface ConfigSyncStatus {
+    tenant_id: string;
+    parent_tenant_id: string | null;
+    config_sync: "inherit-on-read" | "synced";
+    config_sync_hash: string | null;
+    config_synced_at: string | null;
+    /** The hash a sync would store now; null for a tenant that is not synced. */
+    expected_hash: string | null;
+    /** A synced tenant whose stored hash differs from `expected_hash`. */
+    drifted: boolean;
+    /** Ancestors the config resolves from, nearest first. */
+    chain: string[];
+    /**
+     * Which ancestor published each inherited row, keyed by the id the row has
+     * in this tenant (`con_sy...`, singletons by `emailProvider`, `branding` and
+     * `promptSettings`). Platform rows are left out: a child never sees them.
+     */
+    inherited: Record<string, string>;
+}
+/**
+ * Sync status of one tenant, for the admin UI: the stored and expected hash,
+ * whether they differ, and where its inherited rows come from. Content and
+ * secrets never leave this function, only ids and tenant names.
+ */
+export declare function getConfigSyncStatus(deps: ConfigSyncStatusDeps, tenantId: string): Promise<ConfigSyncStatus | null>;
+//# sourceMappingURL=status.d.ts.map

package/dist/types/rollouts/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/rollouts/status.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,MAAM,MAAM,oBAAoB,GAAG,IAAI,CACrC,WAAW,EACX,UAAU,GAAG,sBAAsB,GAAG,qBAAqB,GAAG,UAAU,CACzE,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,iBAAiB,GAAG,QAAQ,CAAC;IAC1C,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,6EAA6E;IAC7E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,oBAAoB,EAC1B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAkElC"}

package/dist/types/rollouts/trigger.d.ts

@@ -0,0 +1,52 @@
+import type { Rollout } from "authhero";
+import type { ConfigEntity } from "../inheritance/types";
+import type { RolloutDeps } from "./types";
+/** The entities whose writes can change what descendants should hold. */
+export type PublishableEntity = ConfigEntity | "hookCode";
+/**
+ * Whether a written row is something a parent publishes. A row counts when it
+ * is shared or platform scoped, which for rows nobody has annotated follows
+ * what read-time inheritance does today (system resource servers and actions,
+ * inheritable hooks, connections and the email provider). Hook code always
+ * counts, since it cannot be told from the code of an unpublished hook.
+ */
+export declare function isPublishedRow(entity: PublishableEntity, row: unknown): boolean;
+/**
+ * Records that `originTenantId` published a change (the write trigger). Writes
+ * are coalesced through the rollout row itself: if a write-triggered rollout
+ * for this origin is still waiting out its debounce it is touched (its
+ * `updated_at` moves), otherwise one is created. The tick plans it once writes
+ * have been quiet for `debounce_ms`. Cheap, durable, and safe to call from a
+ * request: nothing is rolled out here.
+ */
+export declare function requestRollout(deps: RolloutDeps, originTenantId: string, initiatedBy?: string): Promise<Rollout>;
+/** The entity hooks that turn a published write into a rollout request. */
+export interface RolloutWriteHooks {
+    actions: EntityWriteHooks;
+    hooks: EntityWriteHooks;
+    hookCode: EntityWriteHooks;
+    connections: EntityWriteHooks;
+    resourceServers: EntityWriteHooks;
+}
+interface EntityWriteHooks {
+    afterCreate: (ctx: {
+        tenantId: string;
+    }, entity: unknown) => Promise<void>;
+    afterUpdate: (ctx: {
+        tenantId: string;
+    }, id: string, entity: unknown) => Promise<void>;
+    afterDelete: (ctx: {
+        tenantId: string;
+    }, id: string) => Promise<void>;
+}
+/**
+ * Entity hooks for the write trigger (design 4.3, trigger 1). After a published
+ * row is created, updated or deleted, `requestRollout` records the change; a
+ * burst of writes becomes one rollout. A failure here never fails the write:
+ * the drift reconcile finds whatever a lost request would have rolled out.
+ */
+export declare function createRolloutWriteHooks(deps: RolloutDeps, options?: {
+    logger?: Pick<Console, "warn">;
+}): RolloutWriteHooks;
+export {};
+//# sourceMappingURL=trigger.d.ts.map

package/dist/types/rollouts/trigger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trigger.d.ts","sourceRoot":"","sources":["../../../src/rollouts/trigger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GACzB,YAAY,GAEZ,UAAU,CAAC;AAEf;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,iBAAiB,EACzB,GAAG,EAAE,OAAO,GACX,OAAO,CAOT;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,WAAW,EACjB,cAAc,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAiClB;AAED,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACnC;AAED,UAAU,gBAAgB;IACxB,WAAW,EAAE,CAAC,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,WAAW,EAAE,CACX,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EACzB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,OAAO,KACZ,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,WAAW,EAAE,CAAC,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAuBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,EACjB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;CAAO,GAC/C,iBAAiB,CAgCnB"}

package/dist/types/rollouts/types.d.ts

@@ -0,0 +1,25 @@
+import type { DataAdapters } from "authhero";
+import type { ControlPlaneResolver } from "../middleware";
+import type { TenantOperationExecutor } from "../operations";
+/** Everything the rollout functions need, wired once by the host. */
+export interface RolloutDeps {
+    /**
+     * Control-plane adapters: tenants, tenant operations and events, rollouts and
+     * logs. Must be the layer that returns secrets as stored (ciphertext).
+     */
+    adapters: DataAdapters;
+    /**
+     * Starts the per-tenant `sync-defaults` operations: the inline executor, or
+     * the Cloudflare Workflows executor.
+     */
+    executor: TenantOperationExecutor;
+    /** The control plane, parent of tenants that have no `parent_tenant_id`. */
+    controlPlaneTenantId: string;
+    /** Per-tenant override of the implicit parent, as for `initMultiTenant`. */
+    resolveControlPlane?: ControlPlaneResolver;
+    /** Longest parent chain, see `resolveTenantChain`. */
+    maxDepth?: number;
+    /** Clock override for tests. */
+    now?: () => number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types/rollouts/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/rollouts/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAE7D,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,QAAQ,EAAE,YAAY,CAAC;IACvB;;;OAGG;IACH,QAAQ,EAAE,uBAAuB,CAAC;IAClC,4EAA4E;IAC5E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAC3C,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB"}

package/dist/types/routes/tenants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenants.d.ts","sourceRoot":"","sources":["../../../src/routes/tenants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAkB,MAAM,mBAAmB,CAAC;AAWhE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,UAAU,CAAC;AA0ClB;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB;cAGZ,oBAAoB;eACnB,qBAAqB;YAujBnC"}
+{"version":3,"file":"tenants.d.ts","sourceRoot":"","sources":["../../../src/routes/tenants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAkB,MAAM,mBAAmB,CAAC;AAYhE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,UAAU,CAAC;AA0DlB;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB;cAGZ,oBAAoB;eACnB,qBAAqB;YAyrBnC"}

package/dist/types/types.d.ts

@@ -1,6 +1,7 @@
 import { CreateTenantParams, DataAdapters, Tenant } from "authhero";
 import { Context } from "hono";
 import type { StepReporter } from "./operations/types";
+import type { ConfigSyncStatus } from "./rollouts/status";
 /**
  * Bindings type from authhero core - simplified version for this package
  */
@@ -207,6 +208,17 @@ export interface MultiTenancyConfig {
      * Subdomain-based tenant routing configuration.
      */
     subdomainRouting?: SubdomainRoutingConfig;
+    /**
+     * Reads a tenant's config sync status for `GET /tenants/{id}/config-sync`.
+     * Supplied by `initMultiTenant`; the route is not mounted without it.
+     */
+    configSyncStatus?: (tenantId: string) => Promise<ConfigSyncStatus | null>;
+    /**
+     * Called after a tenant is created or its `config_sync` mode is changed, so
+     * the sync mode the runtime remembers for it is dropped. Other isolates still
+     * take up to the resolver's TTL (30 s) to notice. Supplied by `initMultiTenant`.
+     */
+    onConfigSyncChange?: (tenantId: string) => void;
 }
 /**
  * Context passed to tenant entity hooks.

package/dist/types/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,YAAY,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC;IACxC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE9B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;OAcG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAEpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEjE;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC;;OAEG;IACH,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IAE5C;;OAEG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CAC3C;AAMD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,QAAQ,EAAE,YAAY,CAAC;IACvB,0EAA0E;IAC1E,GAAG,CAAC,EAAE,mBAAmB,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,YAAY,CAAC,EAAE,CACb,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,kBAAkB,KACrB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEjC,uCAAuC;IACvC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAExE,qEAAqE;IACrE,YAAY,CAAC,EAAE,CACb,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAClB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9B,uCAAuC;IACvC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAExE,wCAAwC;IACxC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E,uCAAuC;IACvC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,CACzB,GAAG,EAAE,mBAAmB,EACxB,cAAc,EAAE,MAAM,KACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAE5B;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;CAC/E;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE;QACb,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,CAAC,CAAC,EAAE,MAAM,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,YAAY,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC;IACxC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE9B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;OAcG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAEpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEjE;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC;;OAEG;IACH,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IAE5C;;OAEG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAE1C;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAE1E;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CACjD;AAMD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,QAAQ,EAAE,YAAY,CAAC;IACvB,0EAA0E;IAC1E,GAAG,CAAC,EAAE,mBAAmB,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,YAAY,CAAC,EAAE,CACb,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,kBAAkB,KACrB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEjC,uCAAuC;IACvC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAExE,qEAAqE;IACrE,YAAY,CAAC,EAAE,CACb,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAClB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9B,uCAAuC;IACvC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAExE,wCAAwC;IACxC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E,uCAAuC;IACvC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,CACzB,GAAG,EAAE,mBAAmB,EACxB,cAAc,EAAE,MAAM,KACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAE5B;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;CAC/E;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE;QACb,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,CAAC,CAAC,EAAE,MAAM,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}

package/dist/types/utils/tenant-tree.d.ts

@@ -12,7 +12,8 @@ export declare const DEFAULT_MAX_TENANT_DEPTH = 2;
  * longer than `maxDepth`.
  *
  * Pure with respect to storage: ancestors are read through `getTenant`.
- * Nothing reads the parent yet; this only keeps the stored tree valid.
+ * The parent decides which config a tenant inherits (see `resolveTenantChain`);
+ * this keeps the stored tree valid.
  */
 export declare function validateTenantParent(params: {
     tenantId: string | undefined;

package/dist/types/utils/tenant-tree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-tree.d.ts","sourceRoot":"","sources":["../../../src/utils/tenant-tree.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC1C,SAAS,EAAE,CACT,EAAE,EAAE,MAAM,KACP,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACtE;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkEhB"}
+{"version":3,"file":"tenant-tree.d.ts","sourceRoot":"","sources":["../../../src/utils/tenant-tree.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC1C,SAAS,EAAE,CACT,EAAE,EAAE,MAAM,KACP,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACtE;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkEhB"}

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/sesamyab/authhero"
   },
-  "version": "15.2.0",
+  "version": "15.3.0",
   "description": "Multi-tenancy support for AuthHero with organization-based access control and per-tenant database isolation",
   "files": [
     "dist"
@@ -36,9 +36,9 @@
     "typescript": "^5.6.0",
     "vite": "^8.0.14",
     "vitest": "^4.1.7",
-    "@authhero/adapter-interfaces": "4.22.0",
-    "@authhero/kysely-adapter": "12.16.0",
-    "authhero": "9.25.0"
+    "@authhero/adapter-interfaces": "4.23.0",
+    "@authhero/kysely-adapter": "12.17.0",
+    "authhero": "9.26.0"
   },
   "dependencies": {
     "zod": "^4.4.3"
@@ -46,7 +46,7 @@
   "peerDependencies": {
     "@authhero/adapter-interfaces": "^14.0.0",
     "@hono/zod-openapi": "^1.4.0",
-    "authhero": "^3.0.0",
+    "authhero": "^9.26.0",
     "hono": "^4.7.0"
   },
   "license": "AGPL-3.0-only",