@authyon/server 0.2.0-beta.20 → 0.2.0-beta.22

package/dist/index.cjs

@@ -33,10 +33,16 @@ __export(index_exports, {
   AuthyonError: () => AuthyonError,
   AuthyonServerClient: () => AuthyonServerClient,
   AuthyonServerClientBuilder: () => AuthyonServerClientBuilder,
+  CLIENT_IP_HEADER: () => CLIENT_IP_HEADER,
   ErrorCodes: () => ErrorCodes,
   FetchHttpAdapter: () => FetchHttpAdapter,
   JwksTokenVerifier: () => JwksTokenVerifier,
   LoggingHttpAdapter: () => LoggingHttpAdapter,
+  SubtenantPermissions: () => SubtenantPermissions,
+  TENANT_FILTER_MAX_DEPTH: () => TENANT_FILTER_MAX_DEPTH,
+  TENANT_FILTER_MAX_VALUES: () => TENANT_FILTER_MAX_VALUES,
+  TENANT_FILTER_MAX_VALUE_LENGTH: () => TENANT_FILTER_MAX_VALUE_LENGTH,
+  TenantPermissions: () => TenantPermissions,
   TenantScopedClient: () => TenantScopedClient,
   TokenVerificationError: () => TokenVerificationError,
   UserScopedClient: () => UserScopedClient,
@@ -49,7 +55,8 @@ __export(index_exports, {
   createExpressAuthorizationMiddleware: () => createExpressAuthorizationMiddleware,
   hasPermission: () => hasPermission,
   hasPermissionGroup: () => hasPermissionGroup,
-  normalizeClientIp: () => normalizeClientIp
+  normalizeClientIp: () => normalizeClientIp,
+  tenantFilter: () => tenantFilter
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -436,7 +443,14 @@ function appendQuery(path2, params) {
   if (!params) return path2;
   const query = new URLSearchParams();
   for (const [key, value2] of Object.entries(params)) {
-    if (value2 !== void 0) query.set(key, String(value2));
+    if (value2 === void 0) continue;
+    if (Array.isArray(value2)) {
+      for (const item of value2) {
+        if (item !== void 0) query.append(key, String(item));
+      }
+      continue;
+    }
+    query.set(key, String(value2));
   }
   const value = query.toString();
   return value ? `${path2}${path2.includes("?") ? "&" : "?"}${value}` : path2;
@@ -634,9 +648,11 @@ var JsonHttpClient = class {
 };
 
 // ../../internal/core/http/clientIp.ts
+var CLIENT_IP_HEADER = "X-Authyon-Client-Ip";
 function clientIpHeaders(context) {
   if (!context?.clientIp) return {};
-  return { "X-Forwarded-For": normalizeClientIp(context.clientIp) };
+  const ip = normalizeClientIp(context.clientIp);
+  return { "X-Forwarded-For": ip, [CLIENT_IP_HEADER]: ip };
 }
 function normalizeClientIp(value) {
   let ip = value.trim();
@@ -791,6 +807,11 @@ function isRecord(value) {
 }
 
 // src/client/authyonServerClient.ts
+var ROOT_PARENT_ID = "00000000-0000-0000-0000-000000000000";
+function tenantListQuery({ parentId, ...rest }) {
+  if (parentId === void 0) return rest;
+  return { ...rest, parentId: parentId === null ? ROOT_PARENT_ID : parentId };
+}
 var _clientSecret;
 var AuthyonServerClient = class {
   constructor(options = {}) {
@@ -1016,13 +1037,64 @@ var AuthyonServerClient = class {
          * is found by the number, and `cnpj` alone finds every tenant carrying
          * that key. `take` defaults to 25 and is capped at 100.
          *
+         * `filter` is the structured half, and the one to reach for when more
+         * than one condition has to hold: each entry is a condition on a JSON
+         * document, they are ANDed with each other and with `search`, and they
+         * run inside the statement — so the envelope keeps describing the
+         * filtered set and you can page through it. Build them with
+         * `tenantFilter`:
+         *
+         * ```ts
+         * const page = await authyon.environment.tenants.list({
+         *   filter: [
+         *     tenantFilter.in("public.kind", ["reseller", "partner"]),
+         *     tenantFilter.in("custom.cnpj", [a, b]),
+         *   ],
+         *   take: 100,
+         * });
+         * ```
+         *
+         * `parentId` narrows the page to one level of the tree — `children()`
+         * and `roots()` below are the same call with that one option set.
+         *
          * Against an Authyon API older than 2026-10-21 this route ignored
-         * skip/take/search and answered with a bare array.
+         * skip/take/search and answered with a bare array; one older than
+         * 2026-10-22 ignores `filter` and one older than 2026-10-31 ignores
+         * `parentId`, which read as a page that is too wide rather than an error.
+         */
+        list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: tenantListQuery(params) }),
+        /**
+         * One page of a tenant's direct sub-tenants — `list()` with `parentId`.
+         *
+         * Only one level: a node's own children carry `childCount`, so a tree
+         * view asks again where that is above zero instead of reading the whole
+         * subtree to draw the first level of it.
+         */
+        children: (parentTenantId, params = {}) => this.environment.tenants.list({ ...params, parentId: parentTenantId }),
+        /**
+         * One page of the environment's root tenants — `list()` with no parent.
+         *
+         * This is the first level of the tree, and the difference from `list()`
+         * is worth keeping straight: `list()` returns every tenant at every
+         * depth, which is what a flat picker wants and what a tree view must not
+         * start from.
+         */
+        roots: (params = {}) => this.environment.tenants.list({ ...params, parentId: null }),
+        /**
+         * POST /env/tenants — create a tenant in the environment.
+         *
+         * `parentTenantId` nests it under an existing tenant. The environment's
+         * `maxTenantDepth` has to allow the level — it ships as `1`, roots only,
+         * so this answers `tenant.depth.not_allowed` until an operator raises it
+         * in the console.
          */
-        list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: params }),
-        /** POST /env/tenants — create a tenant in the environment. */
         create: (input) => this.request("/env/tenants", { method: "POST", envBearer: true, body: input }),
-        /** GET /env/tenants/{tenantId} — fetch a tenant by id. */
+        /**
+         * GET /env/tenants/{tenantId} — fetch a tenant by id.
+         *
+         * Returns `ancestors` as well, the chain above it root first, so a
+         * breadcrumb costs this one call rather than one per level.
+         */
         get: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, { envBearer: true }),
         /** PUT /env/tenants/{tenantId} — update a tenant. */
         update: (tenantId, input) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, {
@@ -1036,12 +1108,23 @@ var AuthyonServerClient = class {
           envBearer: true,
           body: input
         }),
-        /** POST /env/tenants/{tenantId}/disable — disable without removing tenant data. */
+        /**
+         * POST /env/tenants/{tenantId}/disable — disable without removing tenant
+         * data.
+         *
+         * Disables the branch below it too. A sub-tenant left live under a
+         * disabled parent would go on authenticating its users, which is the one
+         * thing switching a tenant off is there to stop — so check `childCount`
+         * before calling this on a node with children.
+         */
         disable: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/disable`, {
           method: "POST",
           envBearer: true
         }),
-        /** DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant. */
+        /**
+         * DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant,
+         * and the branch below it. Same handler as `disable()`.
+         */
         delete: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, {
           method: "DELETE",
           envBearer: true
@@ -1539,6 +1622,86 @@ var AuthyonServerClientBuilder = class {
 };
 _options = new WeakMap();
 
+// src/client/tenantFilters.ts
+var TENANT_FILTER_MAX_VALUES = 25;
+var TENANT_FILTER_MAX_VALUE_LENGTH = 200;
+var TENANT_FILTER_MAX_DEPTH = 3;
+var SCOPES = ["public", "private", "custom"];
+var KEY_SEGMENT = /^[A-Za-z0-9_-]{1,64}$/;
+function assertPath(path2) {
+  if (typeof path2 !== "string" || path2.length === 0) {
+    throw new RangeError("Authyon: a filter path is required, e.g. public.kind.");
+  }
+  const [scope, ...keys] = path2.split(".");
+  if (!SCOPES.includes(scope)) {
+    throw new RangeError(
+      `Authyon: unknown filter scope "${scope}" \u2014 use ${SCOPES.join(", ")} (e.g. public.kind).`
+    );
+  }
+  if (keys.length === 0) {
+    throw new RangeError(`Authyon: filter path "${path2}" needs a key after the scope.`);
+  }
+  if (keys.length > TENANT_FILTER_MAX_DEPTH) {
+    throw new RangeError(
+      `Authyon: filter path "${path2}" goes deeper than ${TENANT_FILTER_MAX_DEPTH} levels.`
+    );
+  }
+  for (const key of keys) {
+    if (!KEY_SEGMENT.test(key)) {
+      throw new RangeError(
+        `Authyon: invalid filter key "${key}" \u2014 letters, digits, "_" and "-", up to 64 characters.`
+      );
+    }
+  }
+  return path2;
+}
+function assertValue(value, forIn) {
+  if (value === void 0 || value === null) {
+    throw new RangeError("Authyon: a filter value is required.");
+  }
+  const text = String(value);
+  if (text.length === 0) {
+    throw new RangeError("Authyon: a filter value may not be empty.");
+  }
+  if (text.length > TENANT_FILTER_MAX_VALUE_LENGTH) {
+    throw new RangeError(
+      `Authyon: a filter value may hold at most ${TENANT_FILTER_MAX_VALUE_LENGTH} characters.`
+    );
+  }
+  if (text.includes(",")) {
+    throw new RangeError(
+      forIn ? "Authyon: an `in` value may not contain a comma \u2014 pass separate values instead." : "Authyon: a filter value may not contain a comma."
+    );
+  }
+  return text;
+}
+var tenantFilter = {
+  /** `public.kind:eq:reseller` — the key equals this value. */
+  eq(path2, value) {
+    return `${assertPath(path2)}:eq:${assertValue(value, false)}`;
+  },
+  /** `public.kind:in:reseller,partner` — the key equals any of these (SQL IN). */
+  in(path2, values) {
+    if (!Array.isArray(values) || values.length === 0) {
+      throw new RangeError("Authyon: `in` needs at least one value.");
+    }
+    if (values.length > TENANT_FILTER_MAX_VALUES) {
+      throw new RangeError(`Authyon: \`in\` takes at most ${TENANT_FILTER_MAX_VALUES} values.`);
+    }
+    const unique = [...new Set(values.map((value) => assertValue(value, true)))];
+    return `${assertPath(path2)}:in:${unique.join(",")}`;
+  },
+  /** `public.notes:like:nacional` — the key contains this text, case-insensitive.
+   *  The server escapes the LIKE metacharacters, so `100%` means `100%`. */
+  like(path2, text) {
+    return `${assertPath(path2)}:like:${assertValue(text, false)}`;
+  },
+  /** `custom.cnpj:exists` — the key is present, whatever its value. */
+  exists(path2) {
+    return `${assertPath(path2)}:exists`;
+  }
+};
+
 // ../../internal/core/authorization/ability.ts
 var AuthyonAbility = class {
   constructor(rules = [], detectSubjectType = defaultSubjectType) {
@@ -1602,12 +1765,29 @@ function createAuthyonAbility(source = {}, options = {}) {
   return new AuthyonAbility(createAuthyonRules(source, options), options.detectSubjectType);
 }
 function hasPermission(source, requiredPermission) {
-  const requirement = permissionToRule(requiredPermission);
-  if (!requirement || typeof requirement.action !== "string" || typeof requirement.subject !== "string") {
-    return false;
-  }
+  const required = requiredPermission?.trim() ?? "";
+  if (!isWellFormedPermission(required)) return false;
   const permissionSource = isPermissionList(source) ? { permissions: source } : source;
-  return createAuthyonAbility(permissionSource).can(requirement.action, requirement.subject);
+  const granted = [
+    ...permissionSource.permissions ?? [],
+    ...permissionSource.scope?.split(/\s+/).filter(Boolean) ?? []
+  ];
+  return granted.some((permission) => grants(permission.trim(), required));
+}
+function grants(granted, required) {
+  if (!isWellFormedPermission(granted)) return false;
+  if (isFullWildcard(granted)) return true;
+  const grantedSegments = granted.split(":");
+  const requiredSegments = required.split(":");
+  if (grantedSegments.length !== requiredSegments.length) return false;
+  return grantedSegments.every(
+    (segment2, index) => segment2 === "*" || segment2 === requiredSegments[index]
+  );
+}
+function isWellFormedPermission(permission) {
+  if (!permission) return false;
+  const segments = permission.split(":");
+  return segments.length >= 2 && segments.every((segment2) => segment2.length > 0);
 }
 function hasPermissionGroup(source, group) {
   const hasAll = (group.allOf ?? []).every((permission) => hasPermission(source, permission));
@@ -1622,13 +1802,23 @@ function createAuthyonRules(source = {}, options = {}) {
     ...source.permissions ?? [],
     ...source.scope?.split(/\s+/).filter(Boolean) ?? []
   ]);
-  const rules = [...permissions].map(permissionToRule).filter(isAbilityRule);
+  const rules = [...permissions].map(grantToRule).filter(isAbilityRule);
   for (const role of /* @__PURE__ */ new Set([...source.roles ?? [], ...options.roles ?? []])) {
     rules.push(...(options.roleRules?.[role] ?? []).map(cloneRule));
   }
   rules.push(...(options.rules ?? []).map(cloneRule));
   return rules;
 }
+function grantToRule(permission) {
+  const normalized = permission.trim();
+  if (normalized && isFullWildcard(normalized)) {
+    return { action: "manage", subject: "all" };
+  }
+  return permissionToRule(normalized);
+}
+function isFullWildcard(permission) {
+  return permission.split(":").every((segment2) => segment2 === "*");
+}
 function permissionToRule(permission) {
   const normalized = permission.trim();
   if (!normalized) return null;
@@ -1845,6 +2035,32 @@ function unauthenticated() {
     "A valid bearer token is required"
   );
 }
+
+// ../../internal/core/authorization/tenantPermissions.ts
+var TenantPermissions = {
+  /** Rename the tenant and change its settings. */
+  SettingsManage: "tenants:settings:manage",
+  /** Invite an address to the tenant. */
+  MembersInvite: "tenants:members:invite",
+  /** Remove a member from the tenant. */
+  MembersRemove: "tenants:members:remove"
+};
+var SubtenantPermissions = {
+  /** Read any tenant below one you belong to. */
+  TreeRead: "subtenants:tree:read",
+  /** Rename a tenant below yours, and add or remove its members. */
+  TreeManage: "subtenants:tree:manage",
+  /** Create a tenant underneath one you belong to. */
+  TreeCreate: "subtenants:tree:create",
+  /**
+   * Make a tenant below yours the ACTIVE tenant of the session — acting inside
+   * it rather than on it from outside. Deliberately not the same permission as
+   * {@link SubtenantPermissions.TreeManage}: administering a sub-tenant through
+   * the management endpoints and operating as that sub-tenant are different
+   * powers, and granting the first should not hand over the second.
+   */
+  TreeSwitch: "subtenants:tree:switch"
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthorizationError,
@@ -1853,10 +2069,16 @@ function unauthenticated() {
   AuthyonError,
   AuthyonServerClient,
   AuthyonServerClientBuilder,
+  CLIENT_IP_HEADER,
   ErrorCodes,
   FetchHttpAdapter,
   JwksTokenVerifier,
   LoggingHttpAdapter,
+  SubtenantPermissions,
+  TENANT_FILTER_MAX_DEPTH,
+  TENANT_FILTER_MAX_VALUES,
+  TENANT_FILTER_MAX_VALUE_LENGTH,
+  TenantPermissions,
   TenantScopedClient,
   TokenVerificationError,
   UserScopedClient,
@@ -1869,5 +2091,6 @@ function unauthenticated() {
   createExpressAuthorizationMiddleware,
   hasPermission,
   hasPermissionGroup,
-  normalizeClientIp
+  normalizeClientIp,
+  tenantFilter
 });

package/dist/index.d.cts

@@ -1,6 +1,6 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-UA7HdjtD.cjs';
-export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as IssuePasswordResetInput, K as JsonWebKeySet, L as JwksTokenVerifier, M as JwksTokenVerifierOptions, N as LoggingHttpAdapter, O as LoginActivity, P as OpenIdConfiguration, Q as Organization, R as OtpCheckResult, S as Paged, T as PaginationOptions, U as PasswordResetCompleted, V as PasswordResetIssued, W as PasswordResetPreview, X as Permission, Y as PermissionsByRole, Z as ReservedPermissions, _ as Role, $ as RoleGrant, a0 as RoleInput, a1 as RoleList, a2 as RolePermissions, a3 as SafeJwtAlgorithm, a4 as SecurityMethods, a5 as SubjectApprovals, a6 as SubjectSecurity, a7 as TenantClientValidationResult, a8 as TenantCredentialIssued, a9 as TenantCredentialSummary, aa as TenantInvite, ab as TenantInviteAccepted, ac as TenantInviteInput, ad as TenantInviteIssued, ae as TenantInvitePreview, af as TenantInviteStatus, ag as TenantMember, ah as TenantMemberPage, ai as TenantMembership, aj as TenantScopedClient, ak as TokenResult, al as TokenVerificationError, am as TokenVerificationErrorCode, an as UpdateOrganizationInput, ao as User, ap as UserScopedClient, aq as ValidateResult, ar as VerifiedAccessToken, as as createClient, at as normalizeClientIp } from './authyonServerClient-UA7HdjtD.cjs';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-DcA5oKZT.cjs';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-CW46xIRD.cjs';
+export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, m as AuthyonTenantClaim, C as CLIENT_IP_HEADER, n as ClientCredentials, o as ClientRequestContext, p as ConfirmApprovalInput, q as ConsumedApproval, r as CreateApprovalInput, s as CreateCredentialInput, t as CreateOrganizationInput, u as CreatePermissionInput, v as CreateTenantCredentialInput, w as CreateUserInput, x as CredentialCreator, y as CredentialDetail, z as CredentialListOptions, B as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, D as HttpAdapterRequest, G as HttpLogEvent, I as HttpLogger, K as IntrospectResult, L as InviteTenantMemberInput, M as IssuePasswordResetInput, N as JsonWebKeySet, J as JwksTokenVerifier, O as JwksTokenVerifierOptions, P as LoggingHttpAdapter, Q as LoginActivity, R as OpenIdConfiguration, S as Organization, T as OtpCheckResult, U as Paged, V as PaginationOptions, W as PasswordResetCompleted, X as PasswordResetIssued, Y as PasswordResetPreview, Z as Permission, _ as PermissionsByRole, $ as ReservedPermissions, a0 as Role, a1 as RoleGrant, a2 as RoleInput, a3 as RoleList, a4 as RolePermissions, a5 as SafeJwtAlgorithm, a6 as SecurityMethods, a7 as SubjectApprovals, a8 as SubjectSecurity, a9 as TENANT_FILTER_MAX_DEPTH, aa as TENANT_FILTER_MAX_VALUES, ab as TENANT_FILTER_MAX_VALUE_LENGTH, ac as TenantAncestor, ad as TenantClientValidationResult, ae as TenantCredentialIssued, af as TenantCredentialSummary, ag as TenantFilterExpression, ah as TenantFilterValue, ai as TenantInvite, aj as TenantInviteAccepted, ak as TenantInviteInput, al as TenantInviteIssued, am as TenantInvitePreview, an as TenantInviteStatus, ao as TenantListOptions, ap as TenantMember, aq as TenantMemberPage, ar as TenantMembership, as as TenantScopedClient, at as TokenResult, au as TokenVerificationError, av as TokenVerificationErrorCode, aw as UpdateOrganizationInput, ax as User, ay as UserScopedClient, az as ValidateResult, aA as VerifiedAccessToken, aB as createClient, aC as normalizeClientIp, aD as tenantFilter } from './authyonServerClient-CW46xIRD.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-BLENxur8.cjs';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -94,4 +94,54 @@ declare class AuthyonServerClientBuilder {
     build(): AuthyonServerClient;
 }
 
-export { AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, AuthyonServerClient, AuthyonServerClientBuilder, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode };
+/**
+ * The permission values the tenant surface checks, as constants.
+ *
+ * They are strings on the wire and nothing forces you through here — the point
+ * is that a rename shows up as a type error instead of as a 403 nobody can
+ * explain. `tenants:settings:manage` is exactly that case: it used to be
+ * written `tenants:manage`, a two-segment value the API could not even store,
+ * so the endpoint requiring it refused every caller.
+ */
+declare const TenantPermissions: {
+    /** Rename the tenant and change its settings. */
+    readonly SettingsManage: "tenants:settings:manage";
+    /** Invite an address to the tenant. */
+    readonly MembersInvite: "tenants:members:invite";
+    /** Remove a member from the tenant. */
+    readonly MembersRemove: "tenants:members:remove";
+};
+/**
+ * What lets a member of one tenant reach the tenants beneath it.
+ *
+ * A separate domain, not a suffix on `tenants:…`, and the reason is worth
+ * knowing before you grant one: permissions match per segment, so naming these
+ * `tenants:tree:manage` would have handed every role already holding
+ * `tenants:*:*` power over the whole subtree the day the hierarchy shipped — a
+ * widening that appears in no diff. `subtenants:…` is only covered by `*:*:*`,
+ * which is explicit superuser.
+ *
+ * Reaching down is opt-in at every level: holding `tenants:settings:manage` on
+ * a parent grants nothing below it, and each of these is granted at the node
+ * the caller belongs to, never at the target.
+ */
+declare const SubtenantPermissions: {
+    /** Read any tenant below one you belong to. */
+    readonly TreeRead: "subtenants:tree:read";
+    /** Rename a tenant below yours, and add or remove its members. */
+    readonly TreeManage: "subtenants:tree:manage";
+    /** Create a tenant underneath one you belong to. */
+    readonly TreeCreate: "subtenants:tree:create";
+    /**
+     * Make a tenant below yours the ACTIVE tenant of the session — acting inside
+     * it rather than on it from outside. Deliberately not the same permission as
+     * {@link SubtenantPermissions.TreeManage}: administering a sub-tenant through
+     * the management endpoints and operating as that sub-tenant are different
+     * powers, and granting the first should not hand over the second.
+     */
+    readonly TreeSwitch: "subtenants:tree:switch";
+};
+type TenantPermission = (typeof TenantPermissions)[keyof typeof TenantPermissions];
+type SubtenantPermission = (typeof SubtenantPermissions)[keyof typeof SubtenantPermissions];
+
+export { AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, AuthyonServerClient, AuthyonServerClientBuilder, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, type SubtenantPermission, SubtenantPermissions, type TenantPermission, TenantPermissions };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-UA7HdjtD.js';
-export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as IssuePasswordResetInput, K as JsonWebKeySet, L as JwksTokenVerifier, M as JwksTokenVerifierOptions, N as LoggingHttpAdapter, O as LoginActivity, P as OpenIdConfiguration, Q as Organization, R as OtpCheckResult, S as Paged, T as PaginationOptions, U as PasswordResetCompleted, V as PasswordResetIssued, W as PasswordResetPreview, X as Permission, Y as PermissionsByRole, Z as ReservedPermissions, _ as Role, $ as RoleGrant, a0 as RoleInput, a1 as RoleList, a2 as RolePermissions, a3 as SafeJwtAlgorithm, a4 as SecurityMethods, a5 as SubjectApprovals, a6 as SubjectSecurity, a7 as TenantClientValidationResult, a8 as TenantCredentialIssued, a9 as TenantCredentialSummary, aa as TenantInvite, ab as TenantInviteAccepted, ac as TenantInviteInput, ad as TenantInviteIssued, ae as TenantInvitePreview, af as TenantInviteStatus, ag as TenantMember, ah as TenantMemberPage, ai as TenantMembership, aj as TenantScopedClient, ak as TokenResult, al as TokenVerificationError, am as TokenVerificationErrorCode, an as UpdateOrganizationInput, ao as User, ap as UserScopedClient, aq as ValidateResult, ar as VerifiedAccessToken, as as createClient, at as normalizeClientIp } from './authyonServerClient-UA7HdjtD.js';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-DfFCoDQ6.js';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-CW46xIRD.js';
+export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, m as AuthyonTenantClaim, C as CLIENT_IP_HEADER, n as ClientCredentials, o as ClientRequestContext, p as ConfirmApprovalInput, q as ConsumedApproval, r as CreateApprovalInput, s as CreateCredentialInput, t as CreateOrganizationInput, u as CreatePermissionInput, v as CreateTenantCredentialInput, w as CreateUserInput, x as CredentialCreator, y as CredentialDetail, z as CredentialListOptions, B as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, D as HttpAdapterRequest, G as HttpLogEvent, I as HttpLogger, K as IntrospectResult, L as InviteTenantMemberInput, M as IssuePasswordResetInput, N as JsonWebKeySet, J as JwksTokenVerifier, O as JwksTokenVerifierOptions, P as LoggingHttpAdapter, Q as LoginActivity, R as OpenIdConfiguration, S as Organization, T as OtpCheckResult, U as Paged, V as PaginationOptions, W as PasswordResetCompleted, X as PasswordResetIssued, Y as PasswordResetPreview, Z as Permission, _ as PermissionsByRole, $ as ReservedPermissions, a0 as Role, a1 as RoleGrant, a2 as RoleInput, a3 as RoleList, a4 as RolePermissions, a5 as SafeJwtAlgorithm, a6 as SecurityMethods, a7 as SubjectApprovals, a8 as SubjectSecurity, a9 as TENANT_FILTER_MAX_DEPTH, aa as TENANT_FILTER_MAX_VALUES, ab as TENANT_FILTER_MAX_VALUE_LENGTH, ac as TenantAncestor, ad as TenantClientValidationResult, ae as TenantCredentialIssued, af as TenantCredentialSummary, ag as TenantFilterExpression, ah as TenantFilterValue, ai as TenantInvite, aj as TenantInviteAccepted, ak as TenantInviteInput, al as TenantInviteIssued, am as TenantInvitePreview, an as TenantInviteStatus, ao as TenantListOptions, ap as TenantMember, aq as TenantMemberPage, ar as TenantMembership, as as TenantScopedClient, at as TokenResult, au as TokenVerificationError, av as TokenVerificationErrorCode, aw as UpdateOrganizationInput, ax as User, ay as UserScopedClient, az as ValidateResult, aA as VerifiedAccessToken, aB as createClient, aC as normalizeClientIp, aD as tenantFilter } from './authyonServerClient-CW46xIRD.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-Clf0Jx-U.js';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -94,4 +94,54 @@ declare class AuthyonServerClientBuilder {
     build(): AuthyonServerClient;
 }
 
-export { AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, AuthyonServerClient, AuthyonServerClientBuilder, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode };
+/**
+ * The permission values the tenant surface checks, as constants.
+ *
+ * They are strings on the wire and nothing forces you through here — the point
+ * is that a rename shows up as a type error instead of as a 403 nobody can
+ * explain. `tenants:settings:manage` is exactly that case: it used to be
+ * written `tenants:manage`, a two-segment value the API could not even store,
+ * so the endpoint requiring it refused every caller.
+ */
+declare const TenantPermissions: {
+    /** Rename the tenant and change its settings. */
+    readonly SettingsManage: "tenants:settings:manage";
+    /** Invite an address to the tenant. */
+    readonly MembersInvite: "tenants:members:invite";
+    /** Remove a member from the tenant. */
+    readonly MembersRemove: "tenants:members:remove";
+};
+/**
+ * What lets a member of one tenant reach the tenants beneath it.
+ *
+ * A separate domain, not a suffix on `tenants:…`, and the reason is worth
+ * knowing before you grant one: permissions match per segment, so naming these
+ * `tenants:tree:manage` would have handed every role already holding
+ * `tenants:*:*` power over the whole subtree the day the hierarchy shipped — a
+ * widening that appears in no diff. `subtenants:…` is only covered by `*:*:*`,
+ * which is explicit superuser.
+ *
+ * Reaching down is opt-in at every level: holding `tenants:settings:manage` on
+ * a parent grants nothing below it, and each of these is granted at the node
+ * the caller belongs to, never at the target.
+ */
+declare const SubtenantPermissions: {
+    /** Read any tenant below one you belong to. */
+    readonly TreeRead: "subtenants:tree:read";
+    /** Rename a tenant below yours, and add or remove its members. */
+    readonly TreeManage: "subtenants:tree:manage";
+    /** Create a tenant underneath one you belong to. */
+    readonly TreeCreate: "subtenants:tree:create";
+    /**
+     * Make a tenant below yours the ACTIVE tenant of the session — acting inside
+     * it rather than on it from outside. Deliberately not the same permission as
+     * {@link SubtenantPermissions.TreeManage}: administering a sub-tenant through
+     * the management endpoints and operating as that sub-tenant are different
+     * powers, and granting the first should not hand over the second.
+     */
+    readonly TreeSwitch: "subtenants:tree:switch";
+};
+type TenantPermission = (typeof TenantPermissions)[keyof typeof TenantPermissions];
+type SubtenantPermission = (typeof SubtenantPermissions)[keyof typeof SubtenantPermissions];
+
+export { AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, AuthyonServerClient, AuthyonServerClientBuilder, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, type SubtenantPermission, SubtenantPermissions, type TenantPermission, TenantPermissions };