@authyon/server 0.2.0-beta.21 → 0.2.0-beta.22

package/dist/{chunk-NKWQMYB3.js → chunk-WF26WYSX.js}

@@ -1,7 +1,9 @@
 // ../../internal/core/http/clientIp.ts
+var CLIENT_IP_HEADER = "X-Authyon-Client-Ip";
 function clientIpHeaders(context) {
   if (!context?.clientIp) return {};
-  return { "X-Forwarded-For": normalizeClientIp(context.clientIp) };
+  const ip = normalizeClientIp(context.clientIp);
+  return { "X-Forwarded-For": ip, [CLIENT_IP_HEADER]: ip };
 }
 function normalizeClientIp(value) {
   let ip = value.trim();
@@ -222,12 +224,29 @@ function createAuthyonAbility(source = {}, options = {}) {
   return new AuthyonAbility(createAuthyonRules(source, options), options.detectSubjectType);
 }
 function hasPermission(source, requiredPermission) {
-  const requirement = permissionToRule(requiredPermission);
-  if (!requirement || typeof requirement.action !== "string" || typeof requirement.subject !== "string") {
-    return false;
-  }
+  const required = requiredPermission?.trim() ?? "";
+  if (!isWellFormedPermission(required)) return false;
   const permissionSource = isPermissionList(source) ? { permissions: source } : source;
-  return createAuthyonAbility(permissionSource).can(requirement.action, requirement.subject);
+  const granted = [
+    ...permissionSource.permissions ?? [],
+    ...permissionSource.scope?.split(/\s+/).filter(Boolean) ?? []
+  ];
+  return granted.some((permission) => grants(permission.trim(), required));
+}
+function grants(granted, required) {
+  if (!isWellFormedPermission(granted)) return false;
+  if (isFullWildcard(granted)) return true;
+  const grantedSegments = granted.split(":");
+  const requiredSegments = required.split(":");
+  if (grantedSegments.length !== requiredSegments.length) return false;
+  return grantedSegments.every(
+    (segment, index) => segment === "*" || segment === requiredSegments[index]
+  );
+}
+function isWellFormedPermission(permission) {
+  if (!permission) return false;
+  const segments = permission.split(":");
+  return segments.length >= 2 && segments.every((segment) => segment.length > 0);
 }
 function hasPermissionGroup(source, group) {
   const hasAll = (group.allOf ?? []).every((permission) => hasPermission(source, permission));
@@ -242,13 +261,23 @@ function createAuthyonRules(source = {}, options = {}) {
     ...source.permissions ?? [],
     ...source.scope?.split(/\s+/).filter(Boolean) ?? []
   ]);
-  const rules = [...permissions].map(permissionToRule).filter(isAbilityRule);
+  const rules = [...permissions].map(grantToRule).filter(isAbilityRule);
   for (const role of /* @__PURE__ */ new Set([...source.roles ?? [], ...options.roles ?? []])) {
     rules.push(...(options.roleRules?.[role] ?? []).map(cloneRule));
   }
   rules.push(...(options.rules ?? []).map(cloneRule));
   return rules;
 }
+function grantToRule(permission) {
+  const normalized = permission.trim();
+  if (normalized && isFullWildcard(normalized)) {
+    return { action: "manage", subject: "all" };
+  }
+  return permissionToRule(normalized);
+}
+function isFullWildcard(permission) {
+  return permission.split(":").every((segment) => segment === "*");
+}
 function permissionToRule(permission) {
   const normalized = permission.trim();
   if (!normalized) return null;
@@ -467,6 +496,7 @@ function unauthenticated() {
 }
 
 export {
+  CLIENT_IP_HEADER,
   clientIpHeaders,
   normalizeClientIp,
   TokenVerificationError,

package/dist/index.cjs

@@ -33,13 +33,16 @@ __export(index_exports, {
   AuthyonError: () => AuthyonError,
   AuthyonServerClient: () => AuthyonServerClient,
   AuthyonServerClientBuilder: () => AuthyonServerClientBuilder,
+  CLIENT_IP_HEADER: () => CLIENT_IP_HEADER,
   ErrorCodes: () => ErrorCodes,
   FetchHttpAdapter: () => FetchHttpAdapter,
   JwksTokenVerifier: () => JwksTokenVerifier,
   LoggingHttpAdapter: () => LoggingHttpAdapter,
+  SubtenantPermissions: () => SubtenantPermissions,
   TENANT_FILTER_MAX_DEPTH: () => TENANT_FILTER_MAX_DEPTH,
   TENANT_FILTER_MAX_VALUES: () => TENANT_FILTER_MAX_VALUES,
   TENANT_FILTER_MAX_VALUE_LENGTH: () => TENANT_FILTER_MAX_VALUE_LENGTH,
+  TenantPermissions: () => TenantPermissions,
   TenantScopedClient: () => TenantScopedClient,
   TokenVerificationError: () => TokenVerificationError,
   UserScopedClient: () => UserScopedClient,
@@ -645,9 +648,11 @@ var JsonHttpClient = class {
 };
 
 // ../../internal/core/http/clientIp.ts
+var CLIENT_IP_HEADER = "X-Authyon-Client-Ip";
 function clientIpHeaders(context) {
   if (!context?.clientIp) return {};
-  return { "X-Forwarded-For": normalizeClientIp(context.clientIp) };
+  const ip = normalizeClientIp(context.clientIp);
+  return { "X-Forwarded-For": ip, [CLIENT_IP_HEADER]: ip };
 }
 function normalizeClientIp(value) {
   let ip = value.trim();
@@ -802,6 +807,11 @@ function isRecord(value) {
 }
 
 // src/client/authyonServerClient.ts
+var ROOT_PARENT_ID = "00000000-0000-0000-0000-000000000000";
+function tenantListQuery({ parentId, ...rest }) {
+  if (parentId === void 0) return rest;
+  return { ...rest, parentId: parentId === null ? ROOT_PARENT_ID : parentId };
+}
 var _clientSecret;
 var AuthyonServerClient = class {
   constructor(options = {}) {
@@ -1044,15 +1054,47 @@ var AuthyonServerClient = class {
          * });
          * ```
          *
+         * `parentId` narrows the page to one level of the tree — `children()`
+         * and `roots()` below are the same call with that one option set.
+         *
          * Against an Authyon API older than 2026-10-21 this route ignored
          * skip/take/search and answered with a bare array; one older than
-         * 2026-10-22 ignores `filter`, which reads as a page that is too wide
-         * rather than an error.
+         * 2026-10-22 ignores `filter` and one older than 2026-10-31 ignores
+         * `parentId`, which read as a page that is too wide rather than an error.
+         */
+        list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: tenantListQuery(params) }),
+        /**
+         * One page of a tenant's direct sub-tenants — `list()` with `parentId`.
+         *
+         * Only one level: a node's own children carry `childCount`, so a tree
+         * view asks again where that is above zero instead of reading the whole
+         * subtree to draw the first level of it.
+         */
+        children: (parentTenantId, params = {}) => this.environment.tenants.list({ ...params, parentId: parentTenantId }),
+        /**
+         * One page of the environment's root tenants — `list()` with no parent.
+         *
+         * This is the first level of the tree, and the difference from `list()`
+         * is worth keeping straight: `list()` returns every tenant at every
+         * depth, which is what a flat picker wants and what a tree view must not
+         * start from.
+         */
+        roots: (params = {}) => this.environment.tenants.list({ ...params, parentId: null }),
+        /**
+         * POST /env/tenants — create a tenant in the environment.
+         *
+         * `parentTenantId` nests it under an existing tenant. The environment's
+         * `maxTenantDepth` has to allow the level — it ships as `1`, roots only,
+         * so this answers `tenant.depth.not_allowed` until an operator raises it
+         * in the console.
          */
-        list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: params }),
-        /** POST /env/tenants — create a tenant in the environment. */
         create: (input) => this.request("/env/tenants", { method: "POST", envBearer: true, body: input }),
-        /** GET /env/tenants/{tenantId} — fetch a tenant by id. */
+        /**
+         * GET /env/tenants/{tenantId} — fetch a tenant by id.
+         *
+         * Returns `ancestors` as well, the chain above it root first, so a
+         * breadcrumb costs this one call rather than one per level.
+         */
         get: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, { envBearer: true }),
         /** PUT /env/tenants/{tenantId} — update a tenant. */
         update: (tenantId, input) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, {
@@ -1066,12 +1108,23 @@ var AuthyonServerClient = class {
           envBearer: true,
           body: input
         }),
-        /** POST /env/tenants/{tenantId}/disable — disable without removing tenant data. */
+        /**
+         * POST /env/tenants/{tenantId}/disable — disable without removing tenant
+         * data.
+         *
+         * Disables the branch below it too. A sub-tenant left live under a
+         * disabled parent would go on authenticating its users, which is the one
+         * thing switching a tenant off is there to stop — so check `childCount`
+         * before calling this on a node with children.
+         */
         disable: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/disable`, {
           method: "POST",
           envBearer: true
         }),
-        /** DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant. */
+        /**
+         * DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant,
+         * and the branch below it. Same handler as `disable()`.
+         */
         delete: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, {
           method: "DELETE",
           envBearer: true
@@ -1712,12 +1765,29 @@ function createAuthyonAbility(source = {}, options = {}) {
   return new AuthyonAbility(createAuthyonRules(source, options), options.detectSubjectType);
 }
 function hasPermission(source, requiredPermission) {
-  const requirement = permissionToRule(requiredPermission);
-  if (!requirement || typeof requirement.action !== "string" || typeof requirement.subject !== "string") {
-    return false;
-  }
+  const required = requiredPermission?.trim() ?? "";
+  if (!isWellFormedPermission(required)) return false;
   const permissionSource = isPermissionList(source) ? { permissions: source } : source;
-  return createAuthyonAbility(permissionSource).can(requirement.action, requirement.subject);
+  const granted = [
+    ...permissionSource.permissions ?? [],
+    ...permissionSource.scope?.split(/\s+/).filter(Boolean) ?? []
+  ];
+  return granted.some((permission) => grants(permission.trim(), required));
+}
+function grants(granted, required) {
+  if (!isWellFormedPermission(granted)) return false;
+  if (isFullWildcard(granted)) return true;
+  const grantedSegments = granted.split(":");
+  const requiredSegments = required.split(":");
+  if (grantedSegments.length !== requiredSegments.length) return false;
+  return grantedSegments.every(
+    (segment2, index) => segment2 === "*" || segment2 === requiredSegments[index]
+  );
+}
+function isWellFormedPermission(permission) {
+  if (!permission) return false;
+  const segments = permission.split(":");
+  return segments.length >= 2 && segments.every((segment2) => segment2.length > 0);
 }
 function hasPermissionGroup(source, group) {
   const hasAll = (group.allOf ?? []).every((permission) => hasPermission(source, permission));
@@ -1732,13 +1802,23 @@ function createAuthyonRules(source = {}, options = {}) {
     ...source.permissions ?? [],
     ...source.scope?.split(/\s+/).filter(Boolean) ?? []
   ]);
-  const rules = [...permissions].map(permissionToRule).filter(isAbilityRule);
+  const rules = [...permissions].map(grantToRule).filter(isAbilityRule);
   for (const role of /* @__PURE__ */ new Set([...source.roles ?? [], ...options.roles ?? []])) {
     rules.push(...(options.roleRules?.[role] ?? []).map(cloneRule));
   }
   rules.push(...(options.rules ?? []).map(cloneRule));
   return rules;
 }
+function grantToRule(permission) {
+  const normalized = permission.trim();
+  if (normalized && isFullWildcard(normalized)) {
+    return { action: "manage", subject: "all" };
+  }
+  return permissionToRule(normalized);
+}
+function isFullWildcard(permission) {
+  return permission.split(":").every((segment2) => segment2 === "*");
+}
 function permissionToRule(permission) {
   const normalized = permission.trim();
   if (!normalized) return null;
@@ -1955,6 +2035,32 @@ function unauthenticated() {
     "A valid bearer token is required"
   );
 }
+
+// ../../internal/core/authorization/tenantPermissions.ts
+var TenantPermissions = {
+  /** Rename the tenant and change its settings. */
+  SettingsManage: "tenants:settings:manage",
+  /** Invite an address to the tenant. */
+  MembersInvite: "tenants:members:invite",
+  /** Remove a member from the tenant. */
+  MembersRemove: "tenants:members:remove"
+};
+var SubtenantPermissions = {
+  /** Read any tenant below one you belong to. */
+  TreeRead: "subtenants:tree:read",
+  /** Rename a tenant below yours, and add or remove its members. */
+  TreeManage: "subtenants:tree:manage",
+  /** Create a tenant underneath one you belong to. */
+  TreeCreate: "subtenants:tree:create",
+  /**
+   * Make a tenant below yours the ACTIVE tenant of the session — acting inside
+   * it rather than on it from outside. Deliberately not the same permission as
+   * {@link SubtenantPermissions.TreeManage}: administering a sub-tenant through
+   * the management endpoints and operating as that sub-tenant are different
+   * powers, and granting the first should not hand over the second.
+   */
+  TreeSwitch: "subtenants:tree:switch"
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthorizationError,
@@ -1963,13 +2069,16 @@ function unauthenticated() {
   AuthyonError,
   AuthyonServerClient,
   AuthyonServerClientBuilder,
+  CLIENT_IP_HEADER,
   ErrorCodes,
   FetchHttpAdapter,
   JwksTokenVerifier,
   LoggingHttpAdapter,
+  SubtenantPermissions,
   TENANT_FILTER_MAX_DEPTH,
   TENANT_FILTER_MAX_VALUES,
   TENANT_FILTER_MAX_VALUE_LENGTH,
+  TenantPermissions,
   TenantScopedClient,
   TokenVerificationError,
   UserScopedClient,

package/dist/index.d.cts

@@ -1,6 +1,6 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-COrfN4o_.cjs';
-export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as IssuePasswordResetInput, K as JsonWebKeySet, L as JwksTokenVerifier, M as JwksTokenVerifierOptions, N as LoggingHttpAdapter, O as LoginActivity, P as OpenIdConfiguration, Q as Organization, R as OtpCheckResult, S as Paged, T as PaginationOptions, U as PasswordResetCompleted, V as PasswordResetIssued, W as PasswordResetPreview, X as Permission, Y as PermissionsByRole, Z as ReservedPermissions, _ as Role, $ as RoleGrant, a0 as RoleInput, a1 as RoleList, a2 as RolePermissions, a3 as SafeJwtAlgorithm, a4 as SecurityMethods, a5 as SubjectApprovals, a6 as SubjectSecurity, a7 as TENANT_FILTER_MAX_DEPTH, a8 as TENANT_FILTER_MAX_VALUES, a9 as TENANT_FILTER_MAX_VALUE_LENGTH, aa as TenantClientValidationResult, ab as TenantCredentialIssued, ac as TenantCredentialSummary, ad as TenantFilterExpression, ae as TenantFilterValue, af as TenantInvite, ag as TenantInviteAccepted, ah as TenantInviteInput, ai as TenantInviteIssued, aj as TenantInvitePreview, ak as TenantInviteStatus, al as TenantListOptions, am as TenantMember, an as TenantMemberPage, ao as TenantMembership, ap as TenantScopedClient, aq as TokenResult, ar as TokenVerificationError, as as TokenVerificationErrorCode, at as UpdateOrganizationInput, au as User, av as UserScopedClient, aw as ValidateResult, ax as VerifiedAccessToken, ay as createClient, az as normalizeClientIp, aA as tenantFilter } from './authyonServerClient-COrfN4o_.cjs';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-Soblu-A5.cjs';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-CW46xIRD.cjs';
+export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, m as AuthyonTenantClaim, C as CLIENT_IP_HEADER, n as ClientCredentials, o as ClientRequestContext, p as ConfirmApprovalInput, q as ConsumedApproval, r as CreateApprovalInput, s as CreateCredentialInput, t as CreateOrganizationInput, u as CreatePermissionInput, v as CreateTenantCredentialInput, w as CreateUserInput, x as CredentialCreator, y as CredentialDetail, z as CredentialListOptions, B as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, D as HttpAdapterRequest, G as HttpLogEvent, I as HttpLogger, K as IntrospectResult, L as InviteTenantMemberInput, M as IssuePasswordResetInput, N as JsonWebKeySet, J as JwksTokenVerifier, O as JwksTokenVerifierOptions, P as LoggingHttpAdapter, Q as LoginActivity, R as OpenIdConfiguration, S as Organization, T as OtpCheckResult, U as Paged, V as PaginationOptions, W as PasswordResetCompleted, X as PasswordResetIssued, Y as PasswordResetPreview, Z as Permission, _ as PermissionsByRole, $ as ReservedPermissions, a0 as Role, a1 as RoleGrant, a2 as RoleInput, a3 as RoleList, a4 as RolePermissions, a5 as SafeJwtAlgorithm, a6 as SecurityMethods, a7 as SubjectApprovals, a8 as SubjectSecurity, a9 as TENANT_FILTER_MAX_DEPTH, aa as TENANT_FILTER_MAX_VALUES, ab as TENANT_FILTER_MAX_VALUE_LENGTH, ac as TenantAncestor, ad as TenantClientValidationResult, ae as TenantCredentialIssued, af as TenantCredentialSummary, ag as TenantFilterExpression, ah as TenantFilterValue, ai as TenantInvite, aj as TenantInviteAccepted, ak as TenantInviteInput, al as TenantInviteIssued, am as TenantInvitePreview, an as TenantInviteStatus, ao as TenantListOptions, ap as TenantMember, aq as TenantMemberPage, ar as TenantMembership, as as TenantScopedClient, at as TokenResult, au as TokenVerificationError, av as TokenVerificationErrorCode, aw as UpdateOrganizationInput, ax as User, ay as UserScopedClient, az as ValidateResult, aA as VerifiedAccessToken, aB as createClient, aC as normalizeClientIp, aD as tenantFilter } from './authyonServerClient-CW46xIRD.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-BLENxur8.cjs';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -94,4 +94,54 @@ declare class AuthyonServerClientBuilder {
     build(): AuthyonServerClient;
 }
 
-export { AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, AuthyonServerClient, AuthyonServerClientBuilder, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode };
+/**
+ * The permission values the tenant surface checks, as constants.
+ *
+ * They are strings on the wire and nothing forces you through here — the point
+ * is that a rename shows up as a type error instead of as a 403 nobody can
+ * explain. `tenants:settings:manage` is exactly that case: it used to be
+ * written `tenants:manage`, a two-segment value the API could not even store,
+ * so the endpoint requiring it refused every caller.
+ */
+declare const TenantPermissions: {
+    /** Rename the tenant and change its settings. */
+    readonly SettingsManage: "tenants:settings:manage";
+    /** Invite an address to the tenant. */
+    readonly MembersInvite: "tenants:members:invite";
+    /** Remove a member from the tenant. */
+    readonly MembersRemove: "tenants:members:remove";
+};
+/**
+ * What lets a member of one tenant reach the tenants beneath it.
+ *
+ * A separate domain, not a suffix on `tenants:…`, and the reason is worth
+ * knowing before you grant one: permissions match per segment, so naming these
+ * `tenants:tree:manage` would have handed every role already holding
+ * `tenants:*:*` power over the whole subtree the day the hierarchy shipped — a
+ * widening that appears in no diff. `subtenants:…` is only covered by `*:*:*`,
+ * which is explicit superuser.
+ *
+ * Reaching down is opt-in at every level: holding `tenants:settings:manage` on
+ * a parent grants nothing below it, and each of these is granted at the node
+ * the caller belongs to, never at the target.
+ */
+declare const SubtenantPermissions: {
+    /** Read any tenant below one you belong to. */
+    readonly TreeRead: "subtenants:tree:read";
+    /** Rename a tenant below yours, and add or remove its members. */
+    readonly TreeManage: "subtenants:tree:manage";
+    /** Create a tenant underneath one you belong to. */
+    readonly TreeCreate: "subtenants:tree:create";
+    /**
+     * Make a tenant below yours the ACTIVE tenant of the session — acting inside
+     * it rather than on it from outside. Deliberately not the same permission as
+     * {@link SubtenantPermissions.TreeManage}: administering a sub-tenant through
+     * the management endpoints and operating as that sub-tenant are different
+     * powers, and granting the first should not hand over the second.
+     */
+    readonly TreeSwitch: "subtenants:tree:switch";
+};
+type TenantPermission = (typeof TenantPermissions)[keyof typeof TenantPermissions];
+type SubtenantPermission = (typeof SubtenantPermissions)[keyof typeof SubtenantPermissions];
+
+export { AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, AuthyonServerClient, AuthyonServerClientBuilder, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, type SubtenantPermission, SubtenantPermissions, type TenantPermission, TenantPermissions };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-COrfN4o_.js';
-export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as IssuePasswordResetInput, K as JsonWebKeySet, L as JwksTokenVerifier, M as JwksTokenVerifierOptions, N as LoggingHttpAdapter, O as LoginActivity, P as OpenIdConfiguration, Q as Organization, R as OtpCheckResult, S as Paged, T as PaginationOptions, U as PasswordResetCompleted, V as PasswordResetIssued, W as PasswordResetPreview, X as Permission, Y as PermissionsByRole, Z as ReservedPermissions, _ as Role, $ as RoleGrant, a0 as RoleInput, a1 as RoleList, a2 as RolePermissions, a3 as SafeJwtAlgorithm, a4 as SecurityMethods, a5 as SubjectApprovals, a6 as SubjectSecurity, a7 as TENANT_FILTER_MAX_DEPTH, a8 as TENANT_FILTER_MAX_VALUES, a9 as TENANT_FILTER_MAX_VALUE_LENGTH, aa as TenantClientValidationResult, ab as TenantCredentialIssued, ac as TenantCredentialSummary, ad as TenantFilterExpression, ae as TenantFilterValue, af as TenantInvite, ag as TenantInviteAccepted, ah as TenantInviteInput, ai as TenantInviteIssued, aj as TenantInvitePreview, ak as TenantInviteStatus, al as TenantListOptions, am as TenantMember, an as TenantMemberPage, ao as TenantMembership, ap as TenantScopedClient, aq as TokenResult, ar as TokenVerificationError, as as TokenVerificationErrorCode, at as UpdateOrganizationInput, au as User, av as UserScopedClient, aw as ValidateResult, ax as VerifiedAccessToken, ay as createClient, az as normalizeClientIp, aA as tenantFilter } from './authyonServerClient-COrfN4o_.js';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-D8tznR96.js';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-CW46xIRD.js';
+export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, m as AuthyonTenantClaim, C as CLIENT_IP_HEADER, n as ClientCredentials, o as ClientRequestContext, p as ConfirmApprovalInput, q as ConsumedApproval, r as CreateApprovalInput, s as CreateCredentialInput, t as CreateOrganizationInput, u as CreatePermissionInput, v as CreateTenantCredentialInput, w as CreateUserInput, x as CredentialCreator, y as CredentialDetail, z as CredentialListOptions, B as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, D as HttpAdapterRequest, G as HttpLogEvent, I as HttpLogger, K as IntrospectResult, L as InviteTenantMemberInput, M as IssuePasswordResetInput, N as JsonWebKeySet, J as JwksTokenVerifier, O as JwksTokenVerifierOptions, P as LoggingHttpAdapter, Q as LoginActivity, R as OpenIdConfiguration, S as Organization, T as OtpCheckResult, U as Paged, V as PaginationOptions, W as PasswordResetCompleted, X as PasswordResetIssued, Y as PasswordResetPreview, Z as Permission, _ as PermissionsByRole, $ as ReservedPermissions, a0 as Role, a1 as RoleGrant, a2 as RoleInput, a3 as RoleList, a4 as RolePermissions, a5 as SafeJwtAlgorithm, a6 as SecurityMethods, a7 as SubjectApprovals, a8 as SubjectSecurity, a9 as TENANT_FILTER_MAX_DEPTH, aa as TENANT_FILTER_MAX_VALUES, ab as TENANT_FILTER_MAX_VALUE_LENGTH, ac as TenantAncestor, ad as TenantClientValidationResult, ae as TenantCredentialIssued, af as TenantCredentialSummary, ag as TenantFilterExpression, ah as TenantFilterValue, ai as TenantInvite, aj as TenantInviteAccepted, ak as TenantInviteInput, al as TenantInviteIssued, am as TenantInvitePreview, an as TenantInviteStatus, ao as TenantListOptions, ap as TenantMember, aq as TenantMemberPage, ar as TenantMembership, as as TenantScopedClient, at as TokenResult, au as TokenVerificationError, av as TokenVerificationErrorCode, aw as UpdateOrganizationInput, ax as User, ay as UserScopedClient, az as ValidateResult, aA as VerifiedAccessToken, aB as createClient, aC as normalizeClientIp, aD as tenantFilter } from './authyonServerClient-CW46xIRD.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-Clf0Jx-U.js';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -94,4 +94,54 @@ declare class AuthyonServerClientBuilder {
     build(): AuthyonServerClient;
 }
 
-export { AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, AuthyonServerClient, AuthyonServerClientBuilder, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode };
+/**
+ * The permission values the tenant surface checks, as constants.
+ *
+ * They are strings on the wire and nothing forces you through here — the point
+ * is that a rename shows up as a type error instead of as a 403 nobody can
+ * explain. `tenants:settings:manage` is exactly that case: it used to be
+ * written `tenants:manage`, a two-segment value the API could not even store,
+ * so the endpoint requiring it refused every caller.
+ */
+declare const TenantPermissions: {
+    /** Rename the tenant and change its settings. */
+    readonly SettingsManage: "tenants:settings:manage";
+    /** Invite an address to the tenant. */
+    readonly MembersInvite: "tenants:members:invite";
+    /** Remove a member from the tenant. */
+    readonly MembersRemove: "tenants:members:remove";
+};
+/**
+ * What lets a member of one tenant reach the tenants beneath it.
+ *
+ * A separate domain, not a suffix on `tenants:…`, and the reason is worth
+ * knowing before you grant one: permissions match per segment, so naming these
+ * `tenants:tree:manage` would have handed every role already holding
+ * `tenants:*:*` power over the whole subtree the day the hierarchy shipped — a
+ * widening that appears in no diff. `subtenants:…` is only covered by `*:*:*`,
+ * which is explicit superuser.
+ *
+ * Reaching down is opt-in at every level: holding `tenants:settings:manage` on
+ * a parent grants nothing below it, and each of these is granted at the node
+ * the caller belongs to, never at the target.
+ */
+declare const SubtenantPermissions: {
+    /** Read any tenant below one you belong to. */
+    readonly TreeRead: "subtenants:tree:read";
+    /** Rename a tenant below yours, and add or remove its members. */
+    readonly TreeManage: "subtenants:tree:manage";
+    /** Create a tenant underneath one you belong to. */
+    readonly TreeCreate: "subtenants:tree:create";
+    /**
+     * Make a tenant below yours the ACTIVE tenant of the session — acting inside
+     * it rather than on it from outside. Deliberately not the same permission as
+     * {@link SubtenantPermissions.TreeManage}: administering a sub-tenant through
+     * the management endpoints and operating as that sub-tenant are different
+     * powers, and granting the first should not hand over the second.
+     */
+    readonly TreeSwitch: "subtenants:tree:switch";
+};
+type TenantPermission = (typeof TenantPermissions)[keyof typeof TenantPermissions];
+type SubtenantPermission = (typeof SubtenantPermissions)[keyof typeof SubtenantPermissions];
+
+export { AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, AuthyonServerClient, AuthyonServerClientBuilder, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, type SubtenantPermission, SubtenantPermissions, type TenantPermission, TenantPermissions };

package/dist/index.js

@@ -12,6 +12,7 @@ import {
   AuthorizationError,
   AuthyonAbility,
   AuthyonAbilityBuilder,
+  CLIENT_IP_HEADER,
   JwksTokenVerifier,
   TokenVerificationError,
   authorizeRequest,
@@ -24,7 +25,7 @@ import {
   hasPermission,
   hasPermissionGroup,
   normalizeClientIp
-} from "./chunk-NKWQMYB3.js";
+} from "./chunk-WF26WYSX.js";
 import {
   __privateAdd,
   __privateGet,
@@ -268,6 +269,11 @@ _token = new WeakMap();
 _inFlight = new WeakMap();
 
 // src/client/authyonServerClient.ts
+var ROOT_PARENT_ID = "00000000-0000-0000-0000-000000000000";
+function tenantListQuery({ parentId, ...rest }) {
+  if (parentId === void 0) return rest;
+  return { ...rest, parentId: parentId === null ? ROOT_PARENT_ID : parentId };
+}
 var _clientSecret;
 var AuthyonServerClient = class {
   constructor(options = {}) {
@@ -510,15 +516,47 @@ var AuthyonServerClient = class {
          * });
          * ```
          *
+         * `parentId` narrows the page to one level of the tree — `children()`
+         * and `roots()` below are the same call with that one option set.
+         *
          * Against an Authyon API older than 2026-10-21 this route ignored
          * skip/take/search and answered with a bare array; one older than
-         * 2026-10-22 ignores `filter`, which reads as a page that is too wide
-         * rather than an error.
+         * 2026-10-22 ignores `filter` and one older than 2026-10-31 ignores
+         * `parentId`, which read as a page that is too wide rather than an error.
+         */
+        list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: tenantListQuery(params) }),
+        /**
+         * One page of a tenant's direct sub-tenants — `list()` with `parentId`.
+         *
+         * Only one level: a node's own children carry `childCount`, so a tree
+         * view asks again where that is above zero instead of reading the whole
+         * subtree to draw the first level of it.
+         */
+        children: (parentTenantId, params = {}) => this.environment.tenants.list({ ...params, parentId: parentTenantId }),
+        /**
+         * One page of the environment's root tenants — `list()` with no parent.
+         *
+         * This is the first level of the tree, and the difference from `list()`
+         * is worth keeping straight: `list()` returns every tenant at every
+         * depth, which is what a flat picker wants and what a tree view must not
+         * start from.
+         */
+        roots: (params = {}) => this.environment.tenants.list({ ...params, parentId: null }),
+        /**
+         * POST /env/tenants — create a tenant in the environment.
+         *
+         * `parentTenantId` nests it under an existing tenant. The environment's
+         * `maxTenantDepth` has to allow the level — it ships as `1`, roots only,
+         * so this answers `tenant.depth.not_allowed` until an operator raises it
+         * in the console.
          */
-        list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: params }),
-        /** POST /env/tenants — create a tenant in the environment. */
         create: (input) => this.request("/env/tenants", { method: "POST", envBearer: true, body: input }),
-        /** GET /env/tenants/{tenantId} — fetch a tenant by id. */
+        /**
+         * GET /env/tenants/{tenantId} — fetch a tenant by id.
+         *
+         * Returns `ancestors` as well, the chain above it root first, so a
+         * breadcrumb costs this one call rather than one per level.
+         */
         get: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, { envBearer: true }),
         /** PUT /env/tenants/{tenantId} — update a tenant. */
         update: (tenantId, input) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, {
@@ -532,12 +570,23 @@ var AuthyonServerClient = class {
           envBearer: true,
           body: input
         }),
-        /** POST /env/tenants/{tenantId}/disable — disable without removing tenant data. */
+        /**
+         * POST /env/tenants/{tenantId}/disable — disable without removing tenant
+         * data.
+         *
+         * Disables the branch below it too. A sub-tenant left live under a
+         * disabled parent would go on authenticating its users, which is the one
+         * thing switching a tenant off is there to stop — so check `childCount`
+         * before calling this on a node with children.
+         */
         disable: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/disable`, {
           method: "POST",
           envBearer: true
         }),
-        /** DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant. */
+        /**
+         * DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant,
+         * and the branch below it. Same handler as `disable()`.
+         */
         delete: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, {
           method: "DELETE",
           envBearer: true
@@ -1114,6 +1163,32 @@ var tenantFilter = {
     return `${assertPath(path2)}:exists`;
   }
 };
+
+// ../../internal/core/authorization/tenantPermissions.ts
+var TenantPermissions = {
+  /** Rename the tenant and change its settings. */
+  SettingsManage: "tenants:settings:manage",
+  /** Invite an address to the tenant. */
+  MembersInvite: "tenants:members:invite",
+  /** Remove a member from the tenant. */
+  MembersRemove: "tenants:members:remove"
+};
+var SubtenantPermissions = {
+  /** Read any tenant below one you belong to. */
+  TreeRead: "subtenants:tree:read",
+  /** Rename a tenant below yours, and add or remove its members. */
+  TreeManage: "subtenants:tree:manage",
+  /** Create a tenant underneath one you belong to. */
+  TreeCreate: "subtenants:tree:create",
+  /**
+   * Make a tenant below yours the ACTIVE tenant of the session — acting inside
+   * it rather than on it from outside. Deliberately not the same permission as
+   * {@link SubtenantPermissions.TreeManage}: administering a sub-tenant through
+   * the management endpoints and operating as that sub-tenant are different
+   * powers, and granting the first should not hand over the second.
+   */
+  TreeSwitch: "subtenants:tree:switch"
+};
 export {
   AuthorizationError,
   AuthyonAbility,
@@ -1121,13 +1196,16 @@ export {
   AuthyonError,
   AuthyonServerClient,
   AuthyonServerClientBuilder,
+  CLIENT_IP_HEADER,
   ErrorCodes,
   FetchHttpAdapter,
   JwksTokenVerifier,
   LoggingHttpAdapter,
+  SubtenantPermissions,
   TENANT_FILTER_MAX_DEPTH,
   TENANT_FILTER_MAX_VALUES,
   TENANT_FILTER_MAX_VALUE_LENGTH,
+  TenantPermissions,
   TenantScopedClient,
   TokenVerificationError,
   UserScopedClient,

package/dist/next.cjs

@@ -75,13 +75,23 @@ function createAuthyonRules(source = {}, options = {}) {
     ...source.permissions ?? [],
     ...source.scope?.split(/\s+/).filter(Boolean) ?? []
   ]);
-  const rules = [...permissions].map(permissionToRule).filter(isAbilityRule);
+  const rules = [...permissions].map(grantToRule).filter(isAbilityRule);
   for (const role of /* @__PURE__ */ new Set([...source.roles ?? [], ...options.roles ?? []])) {
     rules.push(...(options.roleRules?.[role] ?? []).map(cloneRule));
   }
   rules.push(...(options.rules ?? []).map(cloneRule));
   return rules;
 }
+function grantToRule(permission) {
+  const normalized = permission.trim();
+  if (normalized && isFullWildcard(normalized)) {
+    return { action: "manage", subject: "all" };
+  }
+  return permissionToRule(normalized);
+}
+function isFullWildcard(permission) {
+  return permission.split(":").every((segment) => segment === "*");
+}
 function permissionToRule(permission) {
   const normalized = permission.trim();
   if (!normalized) return null;

package/dist/next.d.cts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-Soblu-A5.cjs';
-import { A as AuthyonServerClient } from './authyonServerClient-COrfN4o_.cjs';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-BLENxur8.cjs';
+import { A as AuthyonServerClient } from './authyonServerClient-CW46xIRD.cjs';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {