@bevel-software/platform-core-backend 0.20.0 → 0.21.0

package/dist/tenancy/static-tenant-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-tenant-source.d.ts","sourceRoot":"","sources":["../../src/tenancy/static-tenant-source.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAO1E,OAAO,EAAmC,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAExH;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iHAAiH;IACjH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,+BAA+B;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,IAAI,CAAC,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAKD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,GAAG,YAAY,CAiHjG;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;gBAElD,OAAO,EAAE,SAAS,YAAY,EAAE,EAAE,QAAQ,EAAE,kBAAkB;WAkB7D,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAa9F,IAAI,KAAK,IAAI,SAAS,MAAM,EAAE,CAE7B;IAEK,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAI7D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAG/D;AAED,+FAA+F;AAC/F,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAID;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CA4BjF"}

package/dist/tenancy/static-tenant-source.js

@@ -0,0 +1,220 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { resolveDatabaseUrl } from '../core-config.js';
+import { DEFAULT_DB_SCHEMA, assertSchemaName } from '../modules/database/connection.js';
+import { DEFAULT_GIT_TIMEOUT_MS } from '../modules/workflow/git/node-git-runner.js';
+import { defaultKbTemplateDir } from '../assets.js';
+import { DEFAULT_GIT_USERNAME } from '../shared/git.contract.js';
+import { deriveTenantSecrets } from './tenant-secrets.js';
+import { loopbackTenantBaseUrl } from './tenant-host.js';
+import { assertTenantSlug, normalizeHost } from './tenant-source.contract.js';
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const USERNAME_PATTERN = /^[A-Za-z0-9._-]+$/;
+/**
+ * A tenant's {@link TenantConfig} from its record and the host's settings:
+ * the same values `CoreConfig` reads from the environment, resolved the same
+ * way, with the folders and the schema named after the slug so two tenants
+ * can never share a path or a table.
+ */
+export function tenantConfigFrom(record, settings) {
+    const slug = assertTenantSlug(record.slug);
+    if (!Array.isArray(record.hosts) || record.hosts.length === 0) {
+        throw new Error(`Tenant "${slug}" names no host`);
+    }
+    const hosts = record.hosts.map(normalizeHost);
+    const adminEmail = (record.adminEmail ?? '').trim().toLowerCase();
+    if (!EMAIL_PATTERN.test(adminEmail)) {
+        throw new Error(`Tenant "${slug}": adminEmail is not a valid email: "${record.adminEmail ?? ''}"`);
+    }
+    const gitUsername = (record.gitUsername ?? DEFAULT_GIT_USERNAME).trim();
+    if (!USERNAME_PATTERN.test(gitUsername)) {
+        throw new Error(`Tenant "${slug}": gitUsername must match [A-Za-z0-9._-]+; got "${gitUsername}"`);
+    }
+    const tenantId = (record.tenantId ?? slug.replace(/-/g, '')).trim().toLowerCase();
+    if (!/^[a-z0-9]+$/.test(tenantId)) {
+        throw new Error(`Tenant "${slug}": tenantId must be lowercase alphanumeric; got "${tenantId}"`);
+    }
+    const dbSchema = assertSchemaName(record.dbSchema ?? `t_${slug.replace(/-/g, '_')}`);
+    // The default schema is where a single-tenant deployment on the same
+    // database keeps its tables and, in drizzle's own schema beside it, its
+    // migration ledger; a tenant there would be no tenant at all.
+    if (dbSchema === DEFAULT_DB_SCHEMA) {
+        throw new Error(`Tenant "${slug}": dbSchema must not be "${DEFAULT_DB_SCHEMA}"; a tenant needs a schema of its own`);
+    }
+    const adminPassword = record.adminPassword ?? '';
+    const loginPasswordEnabled = record.loginPassword ?? adminPassword !== '';
+    if (loginPasswordEnabled && !adminPassword) {
+        throw new Error(`Tenant "${slug}": loginPassword is on but no adminPassword is set`);
+    }
+    const publicBackendUrl = (record.publicBackendUrl ?? `https://${hosts[0]}`).trim().replace(/\/+$/, '');
+    const publicFrontendUrl = (record.publicFrontendUrl ?? publicBackendUrl).trim().replace(/\/+$/, '');
+    for (const [name, value] of [
+        ['publicBackendUrl', publicBackendUrl],
+        ['publicFrontendUrl', publicFrontendUrl],
+    ]) {
+        try {
+            new URL(value);
+        }
+        catch {
+            throw new Error(`Tenant "${slug}": ${name} is not a valid URL: "${value}"`);
+        }
+    }
+    const secrets = deriveTenantSecrets(settings.masterKey, slug);
+    const besideWorkspaces = (name) => path.resolve(settings.workspacesRoot, '..', name, slug);
+    const allowedEmailDomains = (record.allowedEmailDomains ?? [])
+        .map((d) => d.trim().toLowerCase().replace(/^[@.]+/, ''))
+        .filter((d) => d.length > 0);
+    const protectedBranches = Array.isArray(record.protectedBranches)
+        ? record.protectedBranches.join(',')
+        : (record.protectedBranches ?? '');
+    // The record's settings, as the environment a single-tenant deployment
+    // would pin them in: only what the record names, so the setup screen
+    // still collects the rest. Nothing of the host process's environment.
+    const settingsEnv = {};
+    for (const [name, value] of [
+        ['KB_REPO_URL', record.kbRepoUrl],
+        ['GIT_TOKEN', record.gitToken],
+        ['GIT_USERNAME', record.gitUsername],
+        ['KB_DIR_NAME', record.kbDirName],
+        ['DEFAULT_BRANCH', record.defaultBranch],
+        ['PROTECTED_BRANCHES', protectedBranches],
+        ['KB_SYNC_SECRET', record.kbSyncSecret],
+        ['OIDC_ISSUER_URL', record.oidc?.issuerUrl],
+        ['OIDC_CLIENT_ID', record.oidc?.clientId],
+        ['OIDC_CLIENT_SECRET', record.oidc?.clientSecret],
+        ['OIDC_SCOPES', record.oidc?.scopes],
+        ['OIDC_PROVIDER_LABEL', record.oidc?.providerLabel],
+        ['ALLOWED_EMAIL_DOMAINS', allowedEmailDomains.join(',')],
+    ]) {
+        const trimmed = (value ?? '').trim();
+        if (trimmed)
+            settingsEnv[name] = trimmed;
+    }
+    return {
+        port: settings.port,
+        databaseUrl: settings.databaseUrl,
+        dbSchema,
+        nodeEnv: settings.nodeEnv,
+        tenantId,
+        externalApiKeyPrefix: `${tenantId}_`,
+        internalTokenPrefix: `${tenantId}-int_`,
+        uploadTokenPrefix: `${tenantId}-up_`,
+        mcpOAuthTokenPrefix: `${tenantId}-mcp_`,
+        workspacesRoot: path.resolve(settings.workspacesRoot, slug),
+        backupsRoot: besideWorkspaces('backups'),
+        spillRoot: besideWorkspaces('tool-chain-spills'),
+        docExtractCacheRoot: besideWorkspaces('doc-extract-cache'),
+        jwtSecret: secrets.jwtSecret,
+        secretsEncKey: secrets.secretsEncKey,
+        internalTokenSecret: secrets.internalTokenSecret,
+        adminEmail,
+        adminPassword,
+        loginPasswordEnabled,
+        oidcIssuerUrl: (record.oidc?.issuerUrl ?? '').trim().replace(/\/+$/, ''),
+        oidcClientId: (record.oidc?.clientId ?? '').trim(),
+        oidcClientSecret: (record.oidc?.clientSecret ?? '').trim(),
+        oidcScopes: (record.oidc?.scopes ?? 'openid profile email').trim(),
+        oidcProviderLabel: (record.oidc?.providerLabel ?? 'Single sign-on').trim(),
+        kbRepoUrl: (record.kbRepoUrl ?? '').trim(),
+        kbDirName: (record.kbDirName ?? '').trim(),
+        gitUsername,
+        gitToken: (record.gitToken ?? '').trim(),
+        kbTemplateDir: settings.kbTemplateDir,
+        ontologySessionBlock: settings.ontologySessionBlock,
+        updateCheckEnabled: settings.updateCheckEnabled,
+        allowedEmailDomains,
+        trustProxy: settings.trustProxy,
+        gitTimeoutMs: settings.gitTimeoutMs,
+        publicBackendUrl,
+        publicFrontendUrl,
+        configuredPublicFrontendUrl: publicFrontendUrl,
+        loopbackBaseUrl: loopbackTenantBaseUrl(settings.port, slug),
+        settingsEnv,
+    };
+}
+/**
+ * The reference {@link TenantSource}: every tenant known up front, from a
+ * JSON file (`TENANTS_FILE`). Enough for development, tests and a small
+ * self-hosted fleet; the cloud app brings its own source over its registry.
+ */
+export class StaticTenantSource {
+    bySlug = new Map();
+    byHost = new Map();
+    constructor(records, settings) {
+        for (const record of records) {
+            const config = tenantConfigFrom(record, settings);
+            const descriptor = {
+                slug: record.slug,
+                hosts: record.hosts.map(normalizeHost),
+                config,
+            };
+            if (this.bySlug.has(descriptor.slug))
+                throw new Error(`Tenant "${descriptor.slug}" is listed twice`);
+            this.bySlug.set(descriptor.slug, descriptor);
+            for (const host of descriptor.hosts) {
+                const taken = this.byHost.get(host);
+                if (taken)
+                    throw new Error(`Host "${host}" is claimed by both "${taken.slug}" and "${descriptor.slug}"`);
+                this.byHost.set(host, descriptor);
+            }
+        }
+    }
+    static async fromFile(file, settings) {
+        const text = await fs.readFile(file, 'utf8');
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch (err) {
+            throw new Error(`${file} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        const tenants = parsed?.tenants;
+        if (!Array.isArray(tenants))
+            throw new Error(`${file} must be an object with a "tenants" array`);
+        return new StaticTenantSource(tenants, settings);
+    }
+    get slugs() {
+        return [...this.bySlug.keys()];
+    }
+    async resolveByHost(host) {
+        return this.byHost.get(normalizeHost(host)) ?? null;
+    }
+    async describe(slug) {
+        return this.bySlug.get(slug) ?? null;
+    }
+}
+const MAX_TIMER_MS = 2_147_483_647;
+/**
+ * The host's settings from the environment: the same variables a
+ * single-tenant deployment reads for these facts (`DATABASE_URL` and the
+ * `POSTGRES_*` parts, `PORT`, `TRUST_PROXY`, `WORKSPACES_ROOT`,
+ * `KB_TEMPLATE_DIR`, `GIT_TIMEOUT_MS`, …), plus the three that only a host
+ * has: `TENANTS_FILE`, `TENANT_MASTER_KEY` and `TENANT_IDLE_MINUTES`.
+ */
+export function tenantHostEnv(env = process.env) {
+    const tenantsFile = (env.TENANTS_FILE || '').trim() || null;
+    const masterKey = (env.TENANT_MASTER_KEY || '').trim();
+    if (tenantsFile && !masterKey) {
+        throw new Error('TENANT_MASTER_KEY is required with TENANTS_FILE — every tenant\'s secrets derive from it. Generate one with: ' +
+            `node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"`);
+    }
+    const gitTimeout = Number(env.GIT_TIMEOUT_MS);
+    const idle = Number(env.TENANT_IDLE_MINUTES);
+    const domain = (env.DOMAIN || '').trim();
+    const workspacesRoot = env.WORKSPACES_ROOT || path.resolve(process.cwd(), 'workspaces');
+    return {
+        tenantsFile,
+        masterKey,
+        databaseUrl: resolveDatabaseUrl(env),
+        port: parseInt(env.PORT || '3001', 10),
+        nodeEnv: env.NODE_ENV || 'development',
+        trustProxy: (env.TRUST_PROXY || (domain ? '1' : '')).trim(),
+        workspacesRoot,
+        kbTemplateDir: env.KB_TEMPLATE_DIR || defaultKbTemplateDir(),
+        gitTimeoutMs: Number.isFinite(gitTimeout) && gitTimeout > 0 && gitTimeout <= MAX_TIMER_MS ? gitTimeout : DEFAULT_GIT_TIMEOUT_MS,
+        ontologySessionBlock: (env.ONTOLOGY_SESSION_BLOCK ?? 'true').trim().toLowerCase() !== 'false',
+        updateCheckEnabled: (env.UPDATE_CHECK ?? 'true').trim().toLowerCase() !== 'false',
+        idleMinutes: Number.isFinite(idle) && idle > 0 ? idle : 30,
+    };
+}
+//# sourceMappingURL=static-tenant-source.js.map

package/dist/tenancy/static-tenant-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-tenant-source.js","sourceRoot":"","sources":["../../src/tenancy/static-tenant-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAqB,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAA4C,MAAM,6BAA6B,CAAC;AAgExH,MAAM,aAAa,GAAG,4BAA4B,CAAC;AACnD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAoB,EAAE,QAA4B;IACjF,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,iBAAiB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,wCAAwC,MAAM,CAAC,UAAU,IAAI,EAAE,GAAG,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,mDAAmD,WAAW,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,oDAAoD,QAAQ,GAAG,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,qEAAqE;IACrE,wEAAwE;IACxE,8DAA8D;IAC9D,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,4BAA4B,iBAAiB,uCAAuC,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;IACjD,MAAM,oBAAoB,GAAG,MAAM,CAAC,aAAa,IAAI,aAAa,KAAK,EAAE,CAAC;IAC1E,IAAI,oBAAoB,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,oDAAoD,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,WAAW,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvG,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpG,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QACtC,CAAC,mBAAmB,EAAE,iBAAiB,CAAC;KAChC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,MAAM,IAAI,yBAAyB,KAAK,GAAG,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnG,MAAM,mBAAmB,GAAG,CAAC,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC;SAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SACxD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC/D,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QACpC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACrC,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC;QACjC,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC9B,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC;QACpC,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC;QACjC,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC;QACxC,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;QACzC,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,CAAC;QACvC,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC;QAC3C,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzC,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC;QACjD,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QACpC,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC;QACnD,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KAChD,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IAC3C,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ;QACR,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ;QACR,oBAAoB,EAAE,GAAG,QAAQ,GAAG;QACpC,mBAAmB,EAAE,GAAG,QAAQ,OAAO;QACvC,iBAAiB,EAAE,GAAG,QAAQ,MAAM;QACpC,mBAAmB,EAAE,GAAG,QAAQ,OAAO;QACvC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC;QAC3D,WAAW,EAAE,gBAAgB,CAAC,SAAS,CAAC;QACxC,SAAS,EAAE,gBAAgB,CAAC,mBAAmB,CAAC;QAChD,mBAAmB,EAAE,gBAAgB,CAAC,mBAAmB,CAAC;QAC1D,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,UAAU;QACV,aAAa;QACb,oBAAoB;QACpB,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACxE,YAAY,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAClD,gBAAgB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC1D,UAAU,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,sBAAsB,CAAC,CAAC,IAAI,EAAE;QAClE,iBAAiB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE;QAC1E,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC1C,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC1C,WAAW;QACX,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACxC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;QACnD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,mBAAmB;QACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,gBAAgB;QAChB,iBAAiB;QACjB,2BAA2B,EAAE,iBAAiB;QAC9C,eAAe,EAAE,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAC3D,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IACZ,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC7C,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE9D,YAAY,OAAgC,EAAE,QAA4B;QACxE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClD,MAAM,UAAU,GAAqB;gBACnC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;gBACtC,MAAM;aACP,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,UAAU,CAAC,IAAI,mBAAmB,CAAC,CAAC;YACrG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC7C,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,yBAAyB,KAAK,CAAC,IAAI,UAAU,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;gBACzG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,QAA4B;QAC9D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,OAAO,GAAI,MAAsC,EAAE,OAAO,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2CAA2C,CAAC,CAAC;QACjG,OAAO,IAAI,kBAAkB,CAAC,OAAyB,EAAE,QAAQ,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,KAAK;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACvC,CAAC;CACF;AAUD,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC5D,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,+GAA+G;YAC7G,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;IACxF,OAAO;QACL,WAAW;QACX,SAAS;QACT,WAAW,EAAE,kBAAkB,CAAC,GAAG,CAAC;QACpC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC;QACtC,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,aAAa;QACtC,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAC3D,cAAc;QACd,aAAa,EAAE,GAAG,CAAC,eAAe,IAAI,oBAAoB,EAAE;QAC5D,YAAY,EACV,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,sBAAsB;QACnH,oBAAoB,EAAE,CAAC,GAAG,CAAC,sBAAsB,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;QAC7F,kBAAkB,EAAE,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;QACjF,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;KAC3D,CAAC;AACJ,CAAC"}

package/dist/tenancy/tenant-host.d.ts

@@ -0,0 +1,80 @@
+import { type Express } from 'express';
+import type { ProcessConfig } from '../core-config.js';
+import { TenantRuntime, type TenantRuntimeDeps } from './tenant-runtime.js';
+import { type TenantSource } from './tenant-source.contract.js';
+/**
+ * The path prefix under which a process reaches ONE of its own tenants over
+ * loopback: `http://127.0.0.1:<port>/_tenant/<slug>/api/...`. The MCP proxy
+ * and the UTCP manuals it seeds dial the tenant's own REST surface this way,
+ * because a loopback request carries no tenant host name and a header cannot
+ * ride a UTCP call (the proxy is a passthrough; it reshapes nothing).
+ *
+ * The host honours the prefix only for a request that came from this
+ * machine AND was forwarded by nobody: the socket peer is loopback and there
+ * is no `X-Forwarded-For`. A reverse proxy on the same host (nginx, a
+ * Coolify proxy) delivers every public request from a loopback socket, and
+ * every such proxy adds that header; the process's own dial never does.
+ * What the prefix could grant anyone who got past this is only what the
+ * tenant's host name grants already — sessions, keys and tokens are per
+ * tenant — but the addressing rule is stated so it can be relied on.
+ */
+export declare const LOOPBACK_TENANT_PREFIX = "/_tenant";
+/** The base URL a tenant's graph dials itself at — see {@link LOOPBACK_TENANT_PREFIX}. */
+export declare function loopbackTenantBaseUrl(port: number, slug: string): string;
+/** Whether `address` is this machine talking to itself. */
+export declare function isLoopbackAddress(address: string | undefined): boolean;
+/** How a request names its tenant: by the loopback prefix, or by its host. */
+export type TenantSelector = {
+    kind: 'slug';
+    slug: string;
+    rest: string;
+} | {
+    kind: 'host';
+    host: string;
+};
+/**
+ * Which tenant a request is for. The loopback prefix wins, but only from a
+ * loopback peer that no proxy forwarded (no `X-Forwarded-For`); everything
+ * else is decided by the host name (the `X-Forwarded-Host` a trusted proxy
+ * set, else `Host`), lowercase and without its port.
+ */
+export declare function selectTenant(req: {
+    hostname: string;
+    url: string;
+    peer: string | undefined;
+    forwardedFor?: string | string[] | undefined;
+}): TenantSelector;
+export interface TenantHostOptions {
+    source: TenantSource;
+    process: ProcessConfig;
+    /** The built SPA, served once for every resolved tenant. */
+    staticDir?: string;
+    /** Minutes without a request after which a tenant's graph is stopped. Default 30; 0 never evicts. */
+    idleMinutes?: number;
+    /** How long a request waits for an activation in flight before answering 503. Default 60s. */
+    activationWaitMs?: number;
+    /** Seams for the runtimes the host builds — a suite's fake graphs. */
+    runtime?: TenantRuntimeDeps;
+    /** How often idle tenants are looked for. Default: once a minute. */
+    sweepIntervalMs?: number;
+}
+export interface TenantHost {
+    /** The app the process listens on. */
+    app: Express;
+    /** The runtimes built so far, by slug. */
+    runtimes(): ReadonlyMap<string, TenantRuntime>;
+    /** Stop every active tenant; the host keeps serving and reactivates on demand. */
+    evictAll(): Promise<void>;
+    /** Stop the idle sweep and every tenant: the process's shutdown. */
+    stop(): Promise<void>;
+}
+/**
+ * One Express app in front of many tenants' apps. It answers process health
+ * itself, resolves each request to a tenant (see {@link selectTenant}),
+ * activates that tenant's graph on first use, hands the request to the
+ * tenant's app, and serves the SPA for whatever the tenant's app leaves
+ * unhandled. Nothing below it knows there are other tenants: each graph was
+ * built by the same composition root a single-tenant deployment uses.
+ */
+export declare function createTenantHost(opts: TenantHostOptions): TenantHost;
+//# sourceMappingURL=tenant-host.d.ts.map

package/dist/tenancy/tenant-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-host.d.ts","sourceRoot":"","sources":["../../src/tenancy/tenant-host.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,KAAK,OAAO,EAAgB,MAAM,SAAS,CAAC;AAG9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,OAAO,EAAE,aAAa,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAA6D,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAI3H;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD,0FAA0F;AAC1F,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAKtE;AAED,8EAA8E;AAC9E,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3G;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;CAC9C,GAAG,cAAc,CAYjB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,aAAa,CAAC;IACvB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,GAAG,EAAE,OAAO,CAAC;IACb,0CAA0C;IAC1C,QAAQ,IAAI,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C,kFAAkF;IAClF,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,oEAAoE;IACpE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAeD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,UAAU,CA+IpE"}

package/dist/tenancy/tenant-host.js

@@ -0,0 +1,217 @@
+import express from 'express';
+import path from 'node:path';
+import { isIP } from 'node:net';
+import { GIT_SHA } from '../version.js';
+import { logger } from '../shared/logging.js';
+import { TenantRuntime } from './tenant-runtime.js';
+import { TENANT_SLUG_PATTERN, normalizeHost } from './tenant-source.contract.js';
+const log = logger('tenancy');
+/**
+ * The path prefix under which a process reaches ONE of its own tenants over
+ * loopback: `http://127.0.0.1:<port>/_tenant/<slug>/api/...`. The MCP proxy
+ * and the UTCP manuals it seeds dial the tenant's own REST surface this way,
+ * because a loopback request carries no tenant host name and a header cannot
+ * ride a UTCP call (the proxy is a passthrough; it reshapes nothing).
+ *
+ * The host honours the prefix only for a request that came from this
+ * machine AND was forwarded by nobody: the socket peer is loopback and there
+ * is no `X-Forwarded-For`. A reverse proxy on the same host (nginx, a
+ * Coolify proxy) delivers every public request from a loopback socket, and
+ * every such proxy adds that header; the process's own dial never does.
+ * What the prefix could grant anyone who got past this is only what the
+ * tenant's host name grants already — sessions, keys and tokens are per
+ * tenant — but the addressing rule is stated so it can be relied on.
+ */
+export const LOOPBACK_TENANT_PREFIX = '/_tenant';
+/** The base URL a tenant's graph dials itself at — see {@link LOOPBACK_TENANT_PREFIX}. */
+export function loopbackTenantBaseUrl(port, slug) {
+    return `http://127.0.0.1:${port}${LOOPBACK_TENANT_PREFIX}/${slug}`;
+}
+/** Whether `address` is this machine talking to itself. */
+export function isLoopbackAddress(address) {
+    if (!address)
+        return false;
+    const bare = address.startsWith('::ffff:') ? address.slice('::ffff:'.length) : address;
+    if (bare === '::1')
+        return true;
+    return isIP(bare) === 4 && bare.startsWith('127.');
+}
+/**
+ * Which tenant a request is for. The loopback prefix wins, but only from a
+ * loopback peer that no proxy forwarded (no `X-Forwarded-For`); everything
+ * else is decided by the host name (the `X-Forwarded-Host` a trusted proxy
+ * set, else `Host`), lowercase and without its port.
+ */
+export function selectTenant(req) {
+    const forwarded = Array.isArray(req.forwardedFor) ? req.forwardedFor.length > 0 : Boolean(req.forwardedFor);
+    if (isLoopbackAddress(req.peer) && !forwarded && req.url.startsWith(`${LOOPBACK_TENANT_PREFIX}/`)) {
+        const afterPrefix = req.url.slice(LOOPBACK_TENANT_PREFIX.length + 1);
+        const end = afterPrefix.search(/[/?#]/);
+        const slug = end === -1 ? afterPrefix : afterPrefix.slice(0, end);
+        if (TENANT_SLUG_PATTERN.test(slug)) {
+            const rest = end === -1 ? '/' : afterPrefix.slice(end).replace(/^(?=[?#])/, '/');
+            return { kind: 'slug', slug, rest };
+        }
+    }
+    return { kind: 'host', host: normalizeHost(req.hostname || '') };
+}
+const DEFAULT_ACTIVATION_WAIT_MS = 60_000;
+const DEFAULT_IDLE_MINUTES = 30;
+const DEFAULT_SWEEP_INTERVAL_MS = 60_000;
+/** `promise`, or `null` once `ms` have passed. */
+function within(promise, ms) {
+    let timer;
+    const late = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(null), ms);
+    });
+    return Promise.race([promise, late]).finally(() => clearTimeout(timer));
+}
+/**
+ * One Express app in front of many tenants' apps. It answers process health
+ * itself, resolves each request to a tenant (see {@link selectTenant}),
+ * activates that tenant's graph on first use, hands the request to the
+ * tenant's app, and serves the SPA for whatever the tenant's app leaves
+ * unhandled. Nothing below it knows there are other tenants: each graph was
+ * built by the same composition root a single-tenant deployment uses.
+ */
+export function createTenantHost(opts) {
+    const runtimes = new Map();
+    const activationWaitMs = opts.activationWaitMs ?? DEFAULT_ACTIVATION_WAIT_MS;
+    const idleMs = (opts.idleMinutes ?? DEFAULT_IDLE_MINUTES) * 60_000;
+    const runtimeFor = (descriptor) => {
+        let runtime = runtimes.get(descriptor.slug);
+        if (!runtime) {
+            runtime = new TenantRuntime(descriptor, opts.runtime);
+            runtimes.set(descriptor.slug, runtime);
+        }
+        return runtime;
+    };
+    const app = express();
+    // Forwarded headers are honoured exactly as a single-tenant deployment
+    // honours them, and for the same reason: `req.hostname` is what picks the
+    // tenant, and behind a proxy it lives in `X-Forwarded-Host`.
+    if (opts.process.trustProxy) {
+        const raw = opts.process.trustProxy;
+        app.set('trust proxy', /^\d+$/.test(raw) ? Number(raw) : raw);
+    }
+    // The process's own health, before any tenant is involved: a load balancer
+    // asks with whatever host name it likes, and a process with no active
+    // tenant is still a healthy process.
+    app.get('/api/health', (_req, res) => {
+        res.json({ status: 'ok', sha: GIT_SHA, timestamp: Date.now(), tenants: runtimes.size });
+    });
+    app.use(async (req, res, next) => {
+        const selector = selectTenant({
+            hostname: req.hostname,
+            url: req.url,
+            peer: req.socket.remoteAddress,
+            forwardedFor: req.headers['x-forwarded-for'],
+        });
+        let descriptor;
+        try {
+            descriptor =
+                selector.kind === 'slug'
+                    ? await opts.source.describe(selector.slug)
+                    : await opts.source.resolveByHost(selector.host);
+        }
+        catch (err) {
+            log.error('tenant lookup failed:', { err });
+            res.status(503).set('Retry-After', '5').json({ error: 'Tenant lookup failed' });
+            return;
+        }
+        if (!descriptor) {
+            if (req.path.startsWith('/api/') || req.path.startsWith(LOOPBACK_TENANT_PREFIX)) {
+                res.status(404).json({ error: 'No workspace at this address' });
+            }
+            else {
+                res.status(404).type('text/plain').send('No workspace at this address.');
+            }
+            return;
+        }
+        if (selector.kind === 'slug')
+            req.url = selector.rest;
+        const runtime = runtimeFor(descriptor);
+        // Counted from here, before the graph is even asked for, until the
+        // response closes however it ends — a 503 below included. An open
+        // response is what keeps a tenant from being evicted from under it.
+        // Left exactly once: a client that dropped during the tenant lookup
+        // above has had its `close` already, and that event will not come
+        // again, so the socket is asked directly; a socket destroyed but not
+        // yet closed would otherwise be left twice, once here and once by the
+        // listener, taking another request's count with it.
+        runtime.enter();
+        let left = false;
+        const leave = () => {
+            if (left)
+                return;
+            left = true;
+            runtime.leave();
+        };
+        res.on('close', leave);
+        if (req.socket.destroyed) {
+            leave();
+            return;
+        }
+        let graph;
+        try {
+            graph = await within(runtime.handle(), activationWaitMs);
+        }
+        catch {
+            // Logged by the runtime; the caller learns only that it may try again.
+            res.status(503).set('Retry-After', '5').json({ error: 'This workspace could not be started; try again shortly' });
+            return;
+        }
+        if (!graph) {
+            res.status(503).set('Retry-After', '5').json({ error: 'This workspace is starting; try again shortly' });
+            return;
+        }
+        graph.app(req, res, next);
+    });
+    // Whatever a tenant's app left unhandled: the SPA, with the same rule a
+    // single-tenant deployment applies to the namespaces that must never
+    // resolve to `index.html` (see `createCoreServer`).
+    if (opts.staticDir) {
+        const frontendDist = opts.staticDir;
+        app.use(express.static(frontendDist));
+        app.get('{*path}', (req, res) => {
+            if (req.path.startsWith('/.well-known/') ||
+                req.path.startsWith('/api/') ||
+                req.path.startsWith('/login/oauth/')) {
+                res.status(404).json({ error: 'Not found' });
+                return;
+            }
+            res.sendFile(path.join(frontendDist, 'index.html'));
+        });
+    }
+    // Idle tenants are stopped on a timer, never on the request that would
+    // have been their last: a graph whose last response closed `idleMs` ago,
+    // with none still open and no queued commit, is not worth its pool and
+    // its lease. `busy()` is what keeps an event stream's tenant alive.
+    const sweep = async () => {
+        for (const runtime of runtimes.values()) {
+            if (runtime.state !== 'active' || runtime.idleFor() < idleMs)
+                continue;
+            if (await runtime.busy())
+                continue;
+            await runtime.evict().catch((err) => log.warn(`evicting tenant "${runtime.slug}" failed:`, { err }));
+        }
+    };
+    const sweeper = idleMs > 0
+        ? setInterval(() => void sweep(), Math.min(opts.sweepIntervalMs ?? DEFAULT_SWEEP_INTERVAL_MS, idleMs))
+        : null;
+    sweeper?.unref();
+    const evictAll = async () => {
+        await Promise.all([...runtimes.values()].map((runtime) => runtime.evict().catch(() => undefined)));
+    };
+    return {
+        app,
+        runtimes: () => runtimes,
+        evictAll,
+        async stop() {
+            if (sweeper)
+                clearInterval(sweeper);
+            await evictAll();
+        },
+    };
+}
+//# sourceMappingURL=tenant-host.js.map

package/dist/tenancy/tenant-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-host.js","sourceRoot":"","sources":["../../src/tenancy/tenant-host.ts"],"names":[],"mappings":"AAAA,OAAO,OAAuC,MAAM,SAAS,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAA0B,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAA4C,MAAM,6BAA6B,CAAC;AAE3H,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;AAE9B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAEjD,0FAA0F;AAC1F,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,IAAY;IAC9D,OAAO,oBAAoB,IAAI,GAAG,sBAAsB,IAAI,IAAI,EAAE,CAAC;AACrE,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACvF,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrD,CAAC;AAKD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAK5B;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5G,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,sBAAsB,GAAG,CAAC,EAAE,CAAC;QAClG,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACjF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;AACnE,CAAC;AA4BD,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC,kDAAkD;AAClD,SAAS,MAAM,CAAI,OAAmB,EAAE,EAAU;IAChD,IAAI,KAAiC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACzC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAClD,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAC7E,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,GAAG,MAAM,CAAC;IAEnE,MAAM,UAAU,GAAG,CAAC,UAA4B,EAAiB,EAAE;QACjE,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACtD,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,uEAAuE;IACvE,0EAA0E;IAC1E,6DAA6D;IAC7D,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,2EAA2E;IAC3E,sEAAsE;IACtE,qCAAqC;IACrC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa;YAC9B,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,UAAmC,CAAC;QACxC,IAAI,CAAC;YACH,UAAU;gBACR,QAAQ,CAAC,IAAI,KAAK,MAAM;oBACtB,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC3C,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBAChF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;YAAE,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC;QAEtD,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACvC,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,sEAAsE;QACtE,oDAAoD;QACpD,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACzB,KAAK,EAAE,CAAC;YACR,OAAO;QACT,CAAC;QACD,IAAI,KAA0D,CAAC;QAC/D,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC,CAAC;YAClH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;YACzG,OAAO;QACT,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,qEAAqE;IACrE,oDAAoD;IACpD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC9B,IACE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBACpC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC5B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EACpC,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,MAAM;gBAAE,SAAS;YACvE,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE;gBAAE,SAAS;YACnC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,IAAI,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAChH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,GACX,MAAM,GAAG,CAAC;QACR,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,yBAAyB,EAAE,MAAM,CAAC,CAAC;QACtG,CAAC,CAAC,IAAI,CAAC;IACX,OAAO,EAAE,KAAK,EAAE,CAAC;IAEjB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC,CAAC;IAEF,OAAO;QACL,GAAG;QACH,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ;QACxB,QAAQ;QACR,KAAK,CAAC,IAAI;YACR,IAAI,OAAO;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,QAAQ,EAAE,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tenancy/tenant-runtime.d.ts

@@ -0,0 +1,91 @@
+import type { Express } from 'express';
+import { type CoreServices } from '../core/create-core-services.js';
+import type { TenantDescriptor } from './tenant-source.contract.js';
+/** A tenant's running graph: its services and the Express app that serves them. */
+export interface TenantGraph {
+    core: CoreServices;
+    app: Express;
+}
+export type TenantState = 'idle' | 'activating' | 'active' | 'evicting';
+/** The lifecycle seams, so a suite can drive a runtime without a database. */
+export interface TenantRuntimeDeps {
+    /** Build and start the graph. Default: `createCoreServices` + `createCoreServer`. */
+    activate?: (descriptor: TenantDescriptor) => Promise<TenantGraph>;
+    /** Stop a graph. Default: `stopCore`. */
+    stop?: (graph: TenantGraph) => Promise<void>;
+    /** Whether the graph has work in flight that an eviction would strand. Default: queued commits. */
+    busy?: (graph: TenantGraph) => Promise<boolean>;
+    now?: () => number;
+    /**
+     * How long a failed activation is remembered before the next request tries
+     * again: `initialMs` after the first failure, doubling per consecutive
+     * failure up to `maxMs`. Defaults: 5 s to 60 s.
+     */
+    retry?: {
+        initialMs?: number;
+        maxMs?: number;
+    };
+}
+/**
+ * One tenant's graph, brought up on first use and stopped when the host
+ * says so: `idle → activating → active → evicting → idle`.
+ *
+ * ACTIVATE ONCE. Requests arriving while the graph is being built all await
+ * the one activation in flight. A failed activation is remembered for a
+ * short, growing window and answered from memory inside it, so a tenant
+ * whose remote is down or whose token is wrong costs one clone attempt per
+ * window rather than one per request; past the window the next request
+ * tries again, since the remote may be back or the token fixed. An eviction
+ * that lands mid-activation waits for the activation and then stops what it
+ * produced, so a graph is never left running behind an evicted runtime.
+ *
+ * IN USE MEANS A RESPONSE IS OPEN. The host tells the runtime when it hands
+ * a request over and when that response closes, so idleness counts from the
+ * last response that ENDED, and a tenant with any response still open — an
+ * event stream a browser holds, a clone in flight — is busy and never
+ * evicted from under it.
+ */
+export declare class TenantRuntime {
+    readonly descriptor: TenantDescriptor;
+    private graph;
+    private activation;
+    private eviction;
+    private failure;
+    private openResponses;
+    private lastUsedAt;
+    private readonly activate;
+    private readonly stopGraph;
+    private readonly isBusy;
+    private readonly now;
+    private readonly retryInitialMs;
+    private readonly retryMaxMs;
+    constructor(descriptor: TenantDescriptor, deps?: TenantRuntimeDeps);
+    /** A request was handed to this tenant; paired with {@link leave} when its response closes. */
+    enter(): void;
+    /** A response to this tenant closed, however it ended. */
+    leave(): void;
+    /** Responses handed over and not yet closed. */
+    get open(): number;
+    get slug(): string;
+    get state(): TenantState;
+    /** Milliseconds since a request last touched this tenant. */
+    idleFor(): number;
+    /**
+     * The graph, built if it is not running. Every caller of a concurrent
+     * first burst gets the same promise; a caller that arrives during an
+     * eviction waits for it, then starts the graph afresh.
+     */
+    handle(): Promise<TenantGraph>;
+    /**
+     * Whether an eviction would strand something: a response still open, or
+     * work the graph reports (queued commits). False when nothing runs.
+     */
+    busy(): Promise<boolean>;
+    /**
+     * Stop the graph, if one runs or is being built. Idempotent: a second call
+     * joins the eviction under way. Afterwards the runtime is idle and the
+     * next {@link handle} builds a fresh graph.
+     */
+    evict(): Promise<void>;
+}
+//# sourceMappingURL=tenant-runtime.d.ts.map