@authhero/multi-tenancy 15.2.0 → 15.4.0

package/dist/types/rollouts/status.d.ts

@@ -0,0 +1,28 @@
+import type { RolloutDeps } from "./types";
+export type ConfigSyncStatusDeps = Pick<RolloutDeps, "adapters" | "controlPlaneTenantId" | "resolveControlPlane" | "maxDepth">;
+export interface ConfigSyncStatus {
+    tenant_id: string;
+    parent_tenant_id: string | null;
+    config_sync: "inherit-on-read" | "synced" | "detached";
+    config_sync_hash: string | null;
+    config_synced_at: string | null;
+    /** The hash a sync would store now; null for a tenant that is not synced. */
+    expected_hash: string | null;
+    /** A synced tenant whose stored hash differs from `expected_hash`. */
+    drifted: boolean;
+    /** Ancestors the config resolves from, nearest first. */
+    chain: string[];
+    /**
+     * Which ancestor published each inherited row, keyed by the id the row has
+     * in this tenant (`con_sy...`, singletons by `emailProvider`, `branding` and
+     * `promptSettings`). Platform rows are left out: a child never sees them.
+     */
+    inherited: Record<string, string>;
+}
+/**
+ * Sync status of one tenant, for the admin UI: the stored and expected hash,
+ * whether they differ, and where its inherited rows come from. Content and
+ * secrets never leave this function, only ids and tenant names.
+ */
+export declare function getConfigSyncStatus(deps: ConfigSyncStatusDeps, tenantId: string): Promise<ConfigSyncStatus | null>;
+//# sourceMappingURL=status.d.ts.map

package/dist/types/rollouts/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/rollouts/status.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,MAAM,MAAM,oBAAoB,GAAG,IAAI,CACrC,WAAW,EACX,UAAU,GAAG,sBAAsB,GAAG,qBAAqB,GAAG,UAAU,CACzE,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,iBAAiB,GAAG,QAAQ,GAAG,UAAU,CAAC;IACvD,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,6EAA6E;IAC7E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,oBAAoB,EAC1B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmFlC"}

package/dist/types/rollouts/trigger.d.ts

@@ -0,0 +1,52 @@
+import type { Rollout } from "authhero";
+import type { ConfigEntity } from "../inheritance/types";
+import type { RolloutDeps } from "./types";
+/** The entities whose writes can change what descendants should hold. */
+export type PublishableEntity = ConfigEntity | "hookCode";
+/**
+ * Whether a written row is something a parent publishes. A row counts when it
+ * is shared or platform scoped, which for rows nobody has annotated follows
+ * what read-time inheritance does today (system resource servers and actions,
+ * inheritable hooks, connections and the email provider). Hook code always
+ * counts, since it cannot be told from the code of an unpublished hook.
+ */
+export declare function isPublishedRow(entity: PublishableEntity, row: unknown): boolean;
+/**
+ * Records that `originTenantId` published a change (the write trigger). Writes
+ * are coalesced through the rollout row itself: if a write-triggered rollout
+ * for this origin is still waiting out its debounce it is touched (its
+ * `updated_at` moves), otherwise one is created. The tick plans it once writes
+ * have been quiet for `debounce_ms`. Cheap, durable, and safe to call from a
+ * request: nothing is rolled out here.
+ */
+export declare function requestRollout(deps: RolloutDeps, originTenantId: string, initiatedBy?: string): Promise<Rollout>;
+/** The entity hooks that turn a published write into a rollout request. */
+export interface RolloutWriteHooks {
+    actions: EntityWriteHooks;
+    hooks: EntityWriteHooks;
+    hookCode: EntityWriteHooks;
+    connections: EntityWriteHooks;
+    resourceServers: EntityWriteHooks;
+}
+interface EntityWriteHooks {
+    afterCreate: (ctx: {
+        tenantId: string;
+    }, entity: unknown) => Promise<void>;
+    afterUpdate: (ctx: {
+        tenantId: string;
+    }, id: string, entity: unknown) => Promise<void>;
+    afterDelete: (ctx: {
+        tenantId: string;
+    }, id: string) => Promise<void>;
+}
+/**
+ * Entity hooks for the write trigger (design 4.3, trigger 1). After a published
+ * row is created, updated or deleted, `requestRollout` records the change; a
+ * burst of writes becomes one rollout. A failure here never fails the write:
+ * the drift reconcile finds whatever a lost request would have rolled out.
+ */
+export declare function createRolloutWriteHooks(deps: RolloutDeps, options?: {
+    logger?: Pick<Console, "warn">;
+}): RolloutWriteHooks;
+export {};
+//# sourceMappingURL=trigger.d.ts.map

package/dist/types/rollouts/trigger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trigger.d.ts","sourceRoot":"","sources":["../../../src/rollouts/trigger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GACzB,YAAY,GAEZ,UAAU,CAAC;AAEf;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,iBAAiB,EACzB,GAAG,EAAE,OAAO,GACX,OAAO,CAOT;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,WAAW,EACjB,cAAc,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAiClB;AAED,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACnC;AAED,UAAU,gBAAgB;IACxB,WAAW,EAAE,CAAC,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,WAAW,EAAE,CACX,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EACzB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,OAAO,KACZ,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,WAAW,EAAE,CAAC,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAuBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,EACjB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;CAAO,GAC/C,iBAAiB,CAgCnB"}

package/dist/types/rollouts/types.d.ts

@@ -0,0 +1,25 @@
+import type { DataAdapters } from "authhero";
+import type { ControlPlaneResolver } from "../middleware";
+import type { TenantOperationExecutor } from "../operations";
+/** Everything the rollout functions need, wired once by the host. */
+export interface RolloutDeps {
+    /**
+     * Control-plane adapters: tenants, tenant operations and events, rollouts and
+     * logs. Must be the layer that returns secrets as stored (ciphertext).
+     */
+    adapters: DataAdapters;
+    /**
+     * Starts the per-tenant `sync-defaults` operations: the inline executor, or
+     * the Cloudflare Workflows executor.
+     */
+    executor: TenantOperationExecutor;
+    /** The control plane, parent of tenants that have no `parent_tenant_id`. */
+    controlPlaneTenantId: string;
+    /** Per-tenant override of the implicit parent, as for `initMultiTenant`. */
+    resolveControlPlane?: ControlPlaneResolver;
+    /** Longest parent chain, see `resolveTenantChain`. */
+    maxDepth?: number;
+    /** Clock override for tests. */
+    now?: () => number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types/rollouts/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/rollouts/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAE7D,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,QAAQ,EAAE,YAAY,CAAC;IACvB;;;OAGG;IACH,QAAQ,EAAE,uBAAuB,CAAC;IAClC,4EAA4E;IAC5E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAC3C,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB"}

package/dist/types/rollouts/verify.d.ts

@@ -0,0 +1,50 @@
+import type { SyncConfigFn } from "../operations/sync-defaults";
+import type { ConfigSyncStatusDeps } from "./status";
+export interface ConfigSyncDifference {
+    entity: string;
+    key: string;
+    /**
+     * `missing`: the tenant lacks a row it should have. `extra`: it has a row it
+     * should not. `changed`: the row differs, `fields` names the fields. `stale`:
+     * a synced copy the parents no longer publish.
+     */
+    kind: "missing" | "extra" | "changed" | "stale";
+    fields?: string[];
+}
+export interface ConfigSyncVerification {
+    tenant_id: string;
+    config_sync: "inherit-on-read" | "synced" | "detached";
+    /**
+     * How it was checked. `read-time`: what read-time inheritance gives against
+     * what the parent chain resolves to. `sync-dry-run`: the tenant's own rows
+     * against what a sync would write, which is how a synced tenant, including
+     * one with its own database, is checked. `not-applicable`: a detached tenant
+     * has no parent to compare with.
+     */
+    method: "read-time" | "sync-dry-run" | "not-applicable";
+    /** True when there is no difference and no error: the hard pass criterion. */
+    ok: boolean;
+    /** Ids and field names only, never content or secrets. */
+    differences: ConfigSyncDifference[];
+    errors: string[];
+}
+export interface VerifyConfigSyncDeps extends ConfigSyncStatusDeps {
+    /**
+     * Runs a sync as a dry run, which is the read-only check of a synced tenant.
+     * A tenant with its own database needs the dispatch transport, as for
+     * `sync-defaults`.
+     */
+    syncConfig: SyncConfigFn;
+}
+/**
+ * Compares one tenant's config with what its parents publish, on demand and
+ * read-only (no write, no log). The pass criterion is `ok`: an empty
+ * `differences` and no `errors`. Returns null for an unknown tenant.
+ *
+ * A tenant that inherits on read is compared the way shadow mode does, without
+ * the rows only the sync model copies (`expected`). A synced tenant is checked
+ * with a sync dry run, which sees the tenant's own rows: a copy someone deleted
+ * or edited shows up here although the stored hash still matches.
+ */
+export declare function verifyTenantConfig(deps: VerifyConfigSyncDeps, tenantId: string): Promise<ConfigSyncVerification | null>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/types/rollouts/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/rollouts/verify.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAErD,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;IAChD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,iBAAiB,GAAG,QAAQ,GAAG,UAAU,CAAC;IACvD;;;;;;OAMG;IACH,MAAM,EAAE,WAAW,GAAG,cAAc,GAAG,gBAAgB,CAAC;IACxD,8EAA8E;IAC9E,EAAE,EAAE,OAAO,CAAC;IACZ,0DAA0D;IAC1D,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE;;;;OAIG;IACH,UAAU,EAAE,YAAY,CAAC;CAC1B;AAiCD;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,oBAAoB,EAC1B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CA8DxC"}

package/dist/types/routes/tenants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenants.d.ts","sourceRoot":"","sources":["../../../src/routes/tenants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAkB,MAAM,mBAAmB,CAAC;AAWhE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,UAAU,CAAC;AA0ClB;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB;cAGZ,oBAAoB;eACnB,qBAAqB;YAujBnC"}
+{"version":3,"file":"tenants.d.ts","sourceRoot":"","sources":["../../../src/routes/tenants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAkB,MAAM,mBAAmB,CAAC;AAYhE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,UAAU,CAAC;AA2DlB;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB;cAGZ,oBAAoB;eACnB,qBAAqB;YA8xBnC"}

package/dist/types/types.d.ts

@@ -1,6 +1,8 @@
 import { CreateTenantParams, DataAdapters, Tenant } from "authhero";
 import { Context } from "hono";
 import type { StepReporter } from "./operations/types";
+import type { ConfigSyncStatus } from "./rollouts/status";
+import type { ConfigSyncVerification } from "./rollouts/verify";
 /**
  * Bindings type from authhero core - simplified version for this package
  */
@@ -207,6 +209,24 @@ export interface MultiTenancyConfig {
      * Subdomain-based tenant routing configuration.
      */
     subdomainRouting?: SubdomainRoutingConfig;
+    /**
+     * Reads a tenant's config sync status for `GET /tenants/{id}/config-sync`.
+     * Supplied by `initMultiTenant`; the route is not mounted without it.
+     */
+    configSyncStatus?: (tenantId: string) => Promise<ConfigSyncStatus | null>;
+    /**
+     * Compares a tenant's config with what its parents publish, for
+     * `GET /tenants/{id}/config-sync/verify`. Supplied by `initMultiTenant`; the
+     * route is not mounted without it.
+     */
+    verifyConfigSync?: (tenantId: string) => Promise<ConfigSyncVerification | null>;
+    /**
+     * Called after a tenant is created or its `config_sync` mode is changed, so
+     * the sync mode the runtime remembers for it is dropped. Other isolates still
+     * take up to the resolver's TTL (`configSyncCacheTtlMs`, 10 s by default) to
+     * notice. Supplied by `initMultiTenant`.
+     */
+    onConfigSyncChange?: (tenantId: string) => void;
 }
 /**
  * Context passed to tenant entity hooks.

package/dist/types/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,YAAY,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC;IACxC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE9B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;OAcG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAEpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEjE;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC;;OAEG;IACH,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IAE5C;;OAEG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CAC3C;AAMD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,QAAQ,EAAE,YAAY,CAAC;IACvB,0EAA0E;IAC1E,GAAG,CAAC,EAAE,mBAAmB,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,YAAY,CAAC,EAAE,CACb,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,kBAAkB,KACrB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEjC,uCAAuC;IACvC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAExE,qEAAqE;IACrE,YAAY,CAAC,EAAE,CACb,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAClB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9B,uCAAuC;IACvC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAExE,wCAAwC;IACxC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E,uCAAuC;IACvC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,CACzB,GAAG,EAAE,mBAAmB,EACxB,cAAc,EAAE,MAAM,KACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAE5B;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;CAC/E;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE;QACb,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,CAAC,CAAC,EAAE,MAAM,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,YAAY,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC;IACxC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE9B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;OAcG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAEpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEjE;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC;;OAEG;IACH,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IAE5C;;OAEG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAE1C;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAE1E;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CACjB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAE5C;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CACjD;AAMD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,QAAQ,EAAE,YAAY,CAAC;IACvB,0EAA0E;IAC1E,GAAG,CAAC,EAAE,mBAAmB,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,YAAY,CAAC,EAAE,CACb,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,kBAAkB,KACrB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEjC,uCAAuC;IACvC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAExE,qEAAqE;IACrE,YAAY,CAAC,EAAE,CACb,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAClB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9B,uCAAuC;IACvC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAExE,wCAAwC;IACxC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E,uCAAuC;IACvC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,CACzB,GAAG,EAAE,mBAAmB,EACxB,cAAc,EAAE,MAAM,KACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAE5B;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;CAC/E;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE;QACb,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,CAAC,CAAC,EAAE,MAAM,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}

package/dist/types/utils/tenant-settings.d.ts

@@ -0,0 +1,13 @@
+import { TenantsDataAdapter } from "@authhero/adapter-interfaces";
+/**
+ * The computed fields the settings routes add to the tenant (not persisted):
+ * `is_control_plane`, and `has_children`, true when another tenant inherits
+ * from it. Every other tenant sits below the control plane (a tenant without a
+ * parent inherits from it), so the control plane has children as soon as it is
+ * not alone; any other tenant needs a tenant that names it as its parent.
+ */
+export declare function computedTenantFields(tenants: TenantsDataAdapter, tenantId: string, controlPlaneTenantId: string | undefined): Promise<{
+    is_control_plane: boolean;
+    has_children: boolean;
+}>;
+//# sourceMappingURL=tenant-settings.d.ts.map

package/dist/types/utils/tenant-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-settings.d.ts","sourceRoot":"","sources":["../../../src/utils/tenant-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAEnB,MAAM,8BAA8B,CAAC;AAEtC;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,EAChB,oBAAoB,EAAE,MAAM,GAAG,SAAS,GACvC,OAAO,CAAC;IAAE,gBAAgB,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAE,CAAC,CAc/D"}

package/dist/types/utils/tenant-tree.d.ts

@@ -12,7 +12,8 @@ export declare const DEFAULT_MAX_TENANT_DEPTH = 2;
  * longer than `maxDepth`.
  *
  * Pure with respect to storage: ancestors are read through `getTenant`.
- * Nothing reads the parent yet; this only keeps the stored tree valid.
+ * The parent decides which config a tenant inherits (see `resolveTenantChain`);
+ * this keeps the stored tree valid.
  */
 export declare function validateTenantParent(params: {
     tenantId: string | undefined;

package/dist/types/utils/tenant-tree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-tree.d.ts","sourceRoot":"","sources":["../../../src/utils/tenant-tree.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC1C,SAAS,EAAE,CACT,EAAE,EAAE,MAAM,KACP,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACtE;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkEhB"}
+{"version":3,"file":"tenant-tree.d.ts","sourceRoot":"","sources":["../../../src/utils/tenant-tree.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC1C,SAAS,EAAE,CACT,EAAE,EAAE,MAAM,KACP,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACtE;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkEhB"}

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/sesamyab/authhero"
   },
-  "version": "15.2.0",
+  "version": "15.4.0",
   "description": "Multi-tenancy support for AuthHero with organization-based access control and per-tenant database isolation",
   "files": [
     "dist"
@@ -36,9 +36,9 @@
     "typescript": "^5.6.0",
     "vite": "^8.0.14",
     "vitest": "^4.1.7",
-    "@authhero/adapter-interfaces": "4.22.0",
-    "@authhero/kysely-adapter": "12.16.0",
-    "authhero": "9.25.0"
+    "@authhero/adapter-interfaces": "4.24.0",
+    "@authhero/kysely-adapter": "12.18.0",
+    "authhero": "9.27.0"
   },
   "dependencies": {
     "zod": "^4.4.3"
@@ -46,7 +46,7 @@
   "peerDependencies": {
     "@authhero/adapter-interfaces": "^14.0.0",
     "@hono/zod-openapi": "^1.4.0",
-    "authhero": "^3.0.0",
+    "authhero": "^9.27.0",
     "hono": "^4.7.0"
   },
   "license": "AGPL-3.0-only",