@bevel-software/platform-core-backend 0.20.0 → 0.22.0

package/dist/shared/pending-proposals.js

@@ -1,5 +1,3 @@
-import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
-import { workspaceIdForBranch } from './workspace-id.js';
 import { canonicalEmail, hashEmail } from './email-identity.js';
 import { printable } from './printable.js';
 import { logger } from './logging.js';
@@ -30,7 +28,8 @@ export async function visibleProposedFiles(sources, userEmail, matches) {
         // access tree that decides who may review — so a request targeting some
         // other branch is not a proposal these surfaces can speak about: merging it
         // puts nothing in the catalog, and the card would never resolve.
-        crs = (await sources.workflow.listChangeRequests()).filter((c) => c.state === 'open' && c.base === DEFAULT_BRANCH);
+        const defaultBranch = sources.kb.defaultBranch;
+        crs = (await sources.workflow.listChangeRequests()).filter((c) => c.state === 'open' && c.base === defaultBranch);
     }
     catch {
         return [];
@@ -40,7 +39,7 @@ export async function visibleProposedFiles(sources, userEmail, matches) {
     const candidates = crs.flatMap((cr) => cr.touchedNodePaths.filter(matches).map((path) => ({ cr, path })));
     if (candidates.length === 0)
         return [];
-    const wsId = workspaceIdForBranch(DEFAULT_BRANCH);
+    const wsId = sources.kb.defaultWorkspaceId();
     const authorHash = hashEmail(email);
     // One access load for every candidate, resolved on the DEFAULT branch — see
     // the note on {@link ProposalSources}.

package/dist/shared/pending-proposals.js.map

@@ -1 +1 @@
-{"version":3,"file":"pending-proposals.js","sourceRoot":"","sources":["../../src/shared/pending-proposals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAA6C,MAAM,iCAAiC,CAAC;AAE5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;AA0CxC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAwB,EACxB,SAAiB,EACjB,OAAyC;IAEzC,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,IAAI,GAAoB,CAAC;IACzB,IAAI,CAAC;QACH,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,4EAA4E;QAC5E,iEAAiE;QACjE,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,CACvD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpC,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAClE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,IAAI,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEpC,4EAA4E;IAC5E,uCAAuC;IACvC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa;SACzC,aAAa,CACZ,IAAI,EACJ,KAAK,EACL,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC9B;SACA,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAmB,CAAC,CAAC;IAE3C,mEAAmE;IACnE,2EAA2E;IAC3E,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,OAAO,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEjF,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,KAAK,UAAU,CAAC;QAC7D,sEAAsE;QACtE,4EAA4E;QAC5E,sCAAsC;QACtC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAEvD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9E,4EAA4E;QAC5E,uEAAuE;QACvE,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,gBAAyD,EACzD,IAAY,EACZ,MAAc,EACd,WAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,GAAG,CAAC,IAAI,CACN,kBAAkB,SAAS,CAAC,WAAW,CAAC,cAAc,SAAS,CAAC,MAAM,CAAC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI;YAC/F,sCAAsC,SAAS,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CACtG,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"pending-proposals.js","sourceRoot":"","sources":["../../src/shared/pending-proposals.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;AA4CxC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAwB,EACxB,SAAiB,EACjB,OAAyC;IAEzC,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,IAAI,GAAoB,CAAC;IACzB,IAAI,CAAC;QACH,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,aAAa,GAAG,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC;QAC/C,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CACtD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpC,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAClE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEpC,4EAA4E;IAC5E,uCAAuC;IACvC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa;SACzC,aAAa,CACZ,IAAI,EACJ,KAAK,EACL,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC9B;SACA,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAmB,CAAC,CAAC;IAE3C,mEAAmE;IACnE,2EAA2E;IAC3E,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,OAAO,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEjF,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,KAAK,UAAU,CAAC;QAC7D,sEAAsE;QACtE,4EAA4E;QAC5E,sCAAsC;QACtC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAEvD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9E,4EAA4E;QAC5E,uEAAuE;QACvE,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,gBAAyD,EACzD,IAAY,EACZ,MAAc,EACd,WAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,GAAG,CAAC,IAAI,CACN,kBAAkB,SAAS,CAAC,WAAW,CAAC,cAAc,SAAS,CAAC,MAAM,CAAC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI;YAC/F,sCAAsC,SAAS,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CACtG,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/shared/redact-secret.d.ts

@@ -6,11 +6,11 @@
  * presigned remote keeps its credential.
  *
  * "The token in effect" is every place one can come from: each environment
- * spelling `CoreConfig` accepts (it normalises them onto `GITHUB_TOKEN` at
- * boot, but a later write to one of them is not normalised), plus whatever the
- * caller knows about — the settings-stored token, a token a request brought
- * along, or a remote's query values ({@link urlQuerySecrets}). Longest first,
- * so a secret that contains another is not half-scrubbed.
+ * spelling `CoreConfig` accepts (the operator's, process-wide), plus whatever
+ * the caller knows about — the knowledge base's own token as its git runner
+ * carries it, a token a request brought along, or a remote's query values
+ * ({@link urlQuerySecrets}). Longest first, so a secret that contains another
+ * is not half-scrubbed.
  *
  * Shared, not a module's own: the KB startup phase and the setup routes both
  * log git's words, and one scrub is the only way they cannot disagree about

package/dist/shared/redact-secret.js

@@ -6,11 +6,11 @@
  * presigned remote keeps its credential.
  *
  * "The token in effect" is every place one can come from: each environment
- * spelling `CoreConfig` accepts (it normalises them onto `GITHUB_TOKEN` at
- * boot, but a later write to one of them is not normalised), plus whatever the
- * caller knows about — the settings-stored token, a token a request brought
- * along, or a remote's query values ({@link urlQuerySecrets}). Longest first,
- * so a secret that contains another is not half-scrubbed.
+ * spelling `CoreConfig` accepts (the operator's, process-wide), plus whatever
+ * the caller knows about — the knowledge base's own token as its git runner
+ * carries it, a token a request brought along, or a remote's query values
+ * ({@link urlQuerySecrets}). Longest first, so a secret that contains another
+ * is not half-scrubbed.
  *
  * Shared, not a module's own: the KB startup phase and the setup routes both
  * log git's words, and one scrub is the only way they cannot disagree about

package/dist/tenancy/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Serving several knowledge bases from one process — see
+ * `docs/multi-tenant.md` and `openspec/changes/multi-tenant-runtime`.
+ *
+ * The contract (`TenantSource`) and the mechanism (runtime, host) are core's;
+ * where tenants come from is the caller's. Core ships a file-based source.
+ */
+export { assertTenantSlug, normalizeHost, TENANT_SLUG_PATTERN, type TenantDescriptor, type TenantSource, } from './tenant-source.contract.js';
+export { deriveTenantSecrets, type TenantSecrets } from './tenant-secrets.js';
+export { StaticTenantSource, tenantConfigFrom, tenantHostEnv, type TenantHostEnv, type TenantHostSettings, type TenantRecord, type TenantsFile, } from './static-tenant-source.js';
+export { TenantRuntime, type TenantGraph, type TenantRuntimeDeps, type TenantState } from './tenant-runtime.js';
+export { createTenantHost, isLoopbackAddress, loopbackTenantBaseUrl, selectTenant, LOOPBACK_TENANT_PREFIX, type TenantHost, type TenantHostOptions, type TenantSelector, } from './tenant-host.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/tenancy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tenancy/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,YAAY,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAChH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,YAAY,EACZ,sBAAsB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC"}

package/dist/tenancy/index.js

@@ -0,0 +1,13 @@
+/**
+ * Serving several knowledge bases from one process — see
+ * `docs/multi-tenant.md` and `openspec/changes/multi-tenant-runtime`.
+ *
+ * The contract (`TenantSource`) and the mechanism (runtime, host) are core's;
+ * where tenants come from is the caller's. Core ships a file-based source.
+ */
+export { assertTenantSlug, normalizeHost, TENANT_SLUG_PATTERN, } from './tenant-source.contract.js';
+export { deriveTenantSecrets } from './tenant-secrets.js';
+export { StaticTenantSource, tenantConfigFrom, tenantHostEnv, } from './static-tenant-source.js';
+export { TenantRuntime } from './tenant-runtime.js';
+export { createTenantHost, isLoopbackAddress, loopbackTenantBaseUrl, selectTenant, LOOPBACK_TENANT_PREFIX, } from './tenant-host.js';
+//# sourceMappingURL=index.js.map

package/dist/tenancy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tenancy/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,mBAAmB,GAGpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAsB,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,GAKd,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAA8D,MAAM,qBAAqB,CAAC;AAChH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,YAAY,EACZ,sBAAsB,GAIvB,MAAM,kBAAkB,CAAC"}

package/dist/tenancy/static-tenant-source.d.ts

@@ -0,0 +1,98 @@
+import { type TenantConfig } from '../core-config.js';
+import { type TenantDescriptor, type TenantSource } from './tenant-source.contract.js';
+/**
+ * What every tenant of one process shares: the process's own facts, the one
+ * database, the roots its folders hang off, and the master key its secrets
+ * derive from. A tenant's own record ({@link TenantRecord}) adds what differs.
+ */
+export interface TenantHostSettings {
+    readonly databaseUrl: string;
+    readonly port: number;
+    readonly nodeEnv: string;
+    readonly trustProxy: string;
+    /** Each tenant's workspaces live under `<workspacesRoot>/<slug>`; its backups, spills and caches beside them. */
+    readonly workspacesRoot: string;
+    readonly kbTemplateDir: string;
+    readonly gitTimeoutMs: number;
+    readonly ontologySessionBlock: boolean;
+    readonly updateCheckEnabled: boolean;
+    /** See `tenant-secrets.ts`. */
+    readonly masterKey: string;
+}
+/** One entry of the tenants file. Everything optional has the single-tenant default. */
+export interface TenantRecord {
+    slug: string;
+    /** Host names (a port is tolerated and ignored) that reach this tenant. At least one. */
+    hosts: string[];
+    adminEmail: string;
+    /** The bootstrap password; omitted, password login is off for this tenant. */
+    adminPassword?: string;
+    /** Force password login on or off; default: on exactly when `adminPassword` is set. */
+    loginPassword?: boolean;
+    kbRepoUrl?: string;
+    gitToken?: string;
+    gitUsername?: string;
+    kbDirName?: string;
+    /** The branch model; absent, the tenant's admin enters it on the setup screen. */
+    defaultBranch?: string;
+    protectedBranches?: string | string[];
+    /** The bearer a git host's webhook presents to `POST /api/sync`. */
+    kbSyncSecret?: string;
+    /** Default `t_<slug>` with hyphens as underscores. */
+    dbSchema?: string;
+    /** The credential-prefix brand; default: the slug without hyphens. */
+    tenantId?: string;
+    /** Default `https://<first host>`. */
+    publicBackendUrl?: string;
+    /** Default: the backend URL (the backend serves the SPA). */
+    publicFrontendUrl?: string;
+    allowedEmailDomains?: string[];
+    oidc?: {
+        issuerUrl: string;
+        clientId: string;
+        clientSecret: string;
+        scopes?: string;
+        providerLabel?: string;
+    };
+}
+/** The file's shape: a list of records. */
+export interface TenantsFile {
+    tenants: TenantRecord[];
+}
+/**
+ * A tenant's {@link TenantConfig} from its record and the host's settings:
+ * the same values `CoreConfig` reads from the environment, resolved the same
+ * way, with the folders and the schema named after the slug so two tenants
+ * can never share a path or a table.
+ */
+export declare function tenantConfigFrom(record: TenantRecord, settings: TenantHostSettings): TenantConfig;
+/**
+ * The reference {@link TenantSource}: every tenant known up front, from a
+ * JSON file (`TENANTS_FILE`). Enough for development, tests and a small
+ * self-hosted fleet; the cloud app brings its own source over its registry.
+ */
+export declare class StaticTenantSource implements TenantSource {
+    private readonly bySlug;
+    private readonly byHost;
+    constructor(records: readonly TenantRecord[], settings: TenantHostSettings);
+    static fromFile(file: string, settings: TenantHostSettings): Promise<StaticTenantSource>;
+    get slugs(): readonly string[];
+    resolveByHost(host: string): Promise<TenantDescriptor | null>;
+    describe(slug: string): Promise<TenantDescriptor | null>;
+}
+/** The process facts a tenant host reads from its environment — see `docs/multi-tenant.md`. */
+export interface TenantHostEnv extends TenantHostSettings {
+    /** The tenants file, when the process runs as a host at all. */
+    readonly tenantsFile: string | null;
+    /** Minutes without a request after which a tenant's graph is stopped. */
+    readonly idleMinutes: number;
+}
+/**
+ * The host's settings from the environment: the same variables a
+ * single-tenant deployment reads for these facts (`DATABASE_URL` and the
+ * `POSTGRES_*` parts, `PORT`, `TRUST_PROXY`, `WORKSPACES_ROOT`,
+ * `KB_TEMPLATE_DIR`, `GIT_TIMEOUT_MS`, …), plus the three that only a host
+ * has: `TENANTS_FILE`, `TENANT_MASTER_KEY` and `TENANT_IDLE_MINUTES`.
+ */
+export declare function tenantHostEnv(env?: NodeJS.ProcessEnv): TenantHostEnv;
+//# sourceMappingURL=static-tenant-source.d.ts.map

package/dist/tenancy/static-tenant-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-tenant-source.d.ts","sourceRoot":"","sources":["../../src/tenancy/static-tenant-source.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAO1E,OAAO,EAAmC,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAExH;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iHAAiH;IACjH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,+BAA+B;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,IAAI,CAAC,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAKD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,GAAG,YAAY,CAiHjG;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;gBAElD,OAAO,EAAE,SAAS,YAAY,EAAE,EAAE,QAAQ,EAAE,kBAAkB;WAkB7D,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAa9F,IAAI,KAAK,IAAI,SAAS,MAAM,EAAE,CAE7B;IAEK,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAI7D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAG/D;AAED,+FAA+F;AAC/F,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAID;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CA4BjF"}

package/dist/tenancy/static-tenant-source.js

@@ -0,0 +1,220 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { resolveDatabaseUrl } from '../core-config.js';
+import { DEFAULT_DB_SCHEMA, assertSchemaName } from '../modules/database/connection.js';
+import { DEFAULT_GIT_TIMEOUT_MS } from '../modules/workflow/git/node-git-runner.js';
+import { defaultKbTemplateDir } from '../assets.js';
+import { DEFAULT_GIT_USERNAME } from '../shared/git.contract.js';
+import { deriveTenantSecrets } from './tenant-secrets.js';
+import { loopbackTenantBaseUrl } from './tenant-host.js';
+import { assertTenantSlug, normalizeHost } from './tenant-source.contract.js';
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const USERNAME_PATTERN = /^[A-Za-z0-9._-]+$/;
+/**
+ * A tenant's {@link TenantConfig} from its record and the host's settings:
+ * the same values `CoreConfig` reads from the environment, resolved the same
+ * way, with the folders and the schema named after the slug so two tenants
+ * can never share a path or a table.
+ */
+export function tenantConfigFrom(record, settings) {
+    const slug = assertTenantSlug(record.slug);
+    if (!Array.isArray(record.hosts) || record.hosts.length === 0) {
+        throw new Error(`Tenant "${slug}" names no host`);
+    }
+    const hosts = record.hosts.map(normalizeHost);
+    const adminEmail = (record.adminEmail ?? '').trim().toLowerCase();
+    if (!EMAIL_PATTERN.test(adminEmail)) {
+        throw new Error(`Tenant "${slug}": adminEmail is not a valid email: "${record.adminEmail ?? ''}"`);
+    }
+    const gitUsername = (record.gitUsername ?? DEFAULT_GIT_USERNAME).trim();
+    if (!USERNAME_PATTERN.test(gitUsername)) {
+        throw new Error(`Tenant "${slug}": gitUsername must match [A-Za-z0-9._-]+; got "${gitUsername}"`);
+    }
+    const tenantId = (record.tenantId ?? slug.replace(/-/g, '')).trim().toLowerCase();
+    if (!/^[a-z0-9]+$/.test(tenantId)) {
+        throw new Error(`Tenant "${slug}": tenantId must be lowercase alphanumeric; got "${tenantId}"`);
+    }
+    const dbSchema = assertSchemaName(record.dbSchema ?? `t_${slug.replace(/-/g, '_')}`);
+    // The default schema is where a single-tenant deployment on the same
+    // database keeps its tables and, in drizzle's own schema beside it, its
+    // migration ledger; a tenant there would be no tenant at all.
+    if (dbSchema === DEFAULT_DB_SCHEMA) {
+        throw new Error(`Tenant "${slug}": dbSchema must not be "${DEFAULT_DB_SCHEMA}"; a tenant needs a schema of its own`);
+    }
+    const adminPassword = record.adminPassword ?? '';
+    const loginPasswordEnabled = record.loginPassword ?? adminPassword !== '';
+    if (loginPasswordEnabled && !adminPassword) {
+        throw new Error(`Tenant "${slug}": loginPassword is on but no adminPassword is set`);
+    }
+    const publicBackendUrl = (record.publicBackendUrl ?? `https://${hosts[0]}`).trim().replace(/\/+$/, '');
+    const publicFrontendUrl = (record.publicFrontendUrl ?? publicBackendUrl).trim().replace(/\/+$/, '');
+    for (const [name, value] of [
+        ['publicBackendUrl', publicBackendUrl],
+        ['publicFrontendUrl', publicFrontendUrl],
+    ]) {
+        try {
+            new URL(value);
+        }
+        catch {
+            throw new Error(`Tenant "${slug}": ${name} is not a valid URL: "${value}"`);
+        }
+    }
+    const secrets = deriveTenantSecrets(settings.masterKey, slug);
+    const besideWorkspaces = (name) => path.resolve(settings.workspacesRoot, '..', name, slug);
+    const allowedEmailDomains = (record.allowedEmailDomains ?? [])
+        .map((d) => d.trim().toLowerCase().replace(/^[@.]+/, ''))
+        .filter((d) => d.length > 0);
+    const protectedBranches = Array.isArray(record.protectedBranches)
+        ? record.protectedBranches.join(',')
+        : (record.protectedBranches ?? '');
+    // The record's settings, as the environment a single-tenant deployment
+    // would pin them in: only what the record names, so the setup screen
+    // still collects the rest. Nothing of the host process's environment.
+    const settingsEnv = {};
+    for (const [name, value] of [
+        ['KB_REPO_URL', record.kbRepoUrl],
+        ['GIT_TOKEN', record.gitToken],
+        ['GIT_USERNAME', record.gitUsername],
+        ['KB_DIR_NAME', record.kbDirName],
+        ['DEFAULT_BRANCH', record.defaultBranch],
+        ['PROTECTED_BRANCHES', protectedBranches],
+        ['KB_SYNC_SECRET', record.kbSyncSecret],
+        ['OIDC_ISSUER_URL', record.oidc?.issuerUrl],
+        ['OIDC_CLIENT_ID', record.oidc?.clientId],
+        ['OIDC_CLIENT_SECRET', record.oidc?.clientSecret],
+        ['OIDC_SCOPES', record.oidc?.scopes],
+        ['OIDC_PROVIDER_LABEL', record.oidc?.providerLabel],
+        ['ALLOWED_EMAIL_DOMAINS', allowedEmailDomains.join(',')],
+    ]) {
+        const trimmed = (value ?? '').trim();
+        if (trimmed)
+            settingsEnv[name] = trimmed;
+    }
+    return {
+        port: settings.port,
+        databaseUrl: settings.databaseUrl,
+        dbSchema,
+        nodeEnv: settings.nodeEnv,
+        tenantId,
+        externalApiKeyPrefix: `${tenantId}_`,
+        internalTokenPrefix: `${tenantId}-int_`,
+        uploadTokenPrefix: `${tenantId}-up_`,
+        mcpOAuthTokenPrefix: `${tenantId}-mcp_`,
+        workspacesRoot: path.resolve(settings.workspacesRoot, slug),
+        backupsRoot: besideWorkspaces('backups'),
+        spillRoot: besideWorkspaces('tool-chain-spills'),
+        docExtractCacheRoot: besideWorkspaces('doc-extract-cache'),
+        jwtSecret: secrets.jwtSecret,
+        secretsEncKey: secrets.secretsEncKey,
+        internalTokenSecret: secrets.internalTokenSecret,
+        adminEmail,
+        adminPassword,
+        loginPasswordEnabled,
+        oidcIssuerUrl: (record.oidc?.issuerUrl ?? '').trim().replace(/\/+$/, ''),
+        oidcClientId: (record.oidc?.clientId ?? '').trim(),
+        oidcClientSecret: (record.oidc?.clientSecret ?? '').trim(),
+        oidcScopes: (record.oidc?.scopes ?? 'openid profile email').trim(),
+        oidcProviderLabel: (record.oidc?.providerLabel ?? 'Single sign-on').trim(),
+        kbRepoUrl: (record.kbRepoUrl ?? '').trim(),
+        kbDirName: (record.kbDirName ?? '').trim(),
+        gitUsername,
+        gitToken: (record.gitToken ?? '').trim(),
+        kbTemplateDir: settings.kbTemplateDir,
+        ontologySessionBlock: settings.ontologySessionBlock,
+        updateCheckEnabled: settings.updateCheckEnabled,
+        allowedEmailDomains,
+        trustProxy: settings.trustProxy,
+        gitTimeoutMs: settings.gitTimeoutMs,
+        publicBackendUrl,
+        publicFrontendUrl,
+        configuredPublicFrontendUrl: publicFrontendUrl,
+        loopbackBaseUrl: loopbackTenantBaseUrl(settings.port, slug),
+        settingsEnv,
+    };
+}
+/**
+ * The reference {@link TenantSource}: every tenant known up front, from a
+ * JSON file (`TENANTS_FILE`). Enough for development, tests and a small
+ * self-hosted fleet; the cloud app brings its own source over its registry.
+ */
+export class StaticTenantSource {
+    bySlug = new Map();
+    byHost = new Map();
+    constructor(records, settings) {
+        for (const record of records) {
+            const config = tenantConfigFrom(record, settings);
+            const descriptor = {
+                slug: record.slug,
+                hosts: record.hosts.map(normalizeHost),
+                config,
+            };
+            if (this.bySlug.has(descriptor.slug))
+                throw new Error(`Tenant "${descriptor.slug}" is listed twice`);
+            this.bySlug.set(descriptor.slug, descriptor);
+            for (const host of descriptor.hosts) {
+                const taken = this.byHost.get(host);
+                if (taken)
+                    throw new Error(`Host "${host}" is claimed by both "${taken.slug}" and "${descriptor.slug}"`);
+                this.byHost.set(host, descriptor);
+            }
+        }
+    }
+    static async fromFile(file, settings) {
+        const text = await fs.readFile(file, 'utf8');
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch (err) {
+            throw new Error(`${file} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        const tenants = parsed?.tenants;
+        if (!Array.isArray(tenants))
+            throw new Error(`${file} must be an object with a "tenants" array`);
+        return new StaticTenantSource(tenants, settings);
+    }
+    get slugs() {
+        return [...this.bySlug.keys()];
+    }
+    async resolveByHost(host) {
+        return this.byHost.get(normalizeHost(host)) ?? null;
+    }
+    async describe(slug) {
+        return this.bySlug.get(slug) ?? null;
+    }
+}
+const MAX_TIMER_MS = 2_147_483_647;
+/**
+ * The host's settings from the environment: the same variables a
+ * single-tenant deployment reads for these facts (`DATABASE_URL` and the
+ * `POSTGRES_*` parts, `PORT`, `TRUST_PROXY`, `WORKSPACES_ROOT`,
+ * `KB_TEMPLATE_DIR`, `GIT_TIMEOUT_MS`, …), plus the three that only a host
+ * has: `TENANTS_FILE`, `TENANT_MASTER_KEY` and `TENANT_IDLE_MINUTES`.
+ */
+export function tenantHostEnv(env = process.env) {
+    const tenantsFile = (env.TENANTS_FILE || '').trim() || null;
+    const masterKey = (env.TENANT_MASTER_KEY || '').trim();
+    if (tenantsFile && !masterKey) {
+        throw new Error('TENANT_MASTER_KEY is required with TENANTS_FILE — every tenant\'s secrets derive from it. Generate one with: ' +
+            `node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"`);
+    }
+    const gitTimeout = Number(env.GIT_TIMEOUT_MS);
+    const idle = Number(env.TENANT_IDLE_MINUTES);
+    const domain = (env.DOMAIN || '').trim();
+    const workspacesRoot = env.WORKSPACES_ROOT || path.resolve(process.cwd(), 'workspaces');
+    return {
+        tenantsFile,
+        masterKey,
+        databaseUrl: resolveDatabaseUrl(env),
+        port: parseInt(env.PORT || '3001', 10),
+        nodeEnv: env.NODE_ENV || 'development',
+        trustProxy: (env.TRUST_PROXY || (domain ? '1' : '')).trim(),
+        workspacesRoot,
+        kbTemplateDir: env.KB_TEMPLATE_DIR || defaultKbTemplateDir(),
+        gitTimeoutMs: Number.isFinite(gitTimeout) && gitTimeout > 0 && gitTimeout <= MAX_TIMER_MS ? gitTimeout : DEFAULT_GIT_TIMEOUT_MS,
+        ontologySessionBlock: (env.ONTOLOGY_SESSION_BLOCK ?? 'true').trim().toLowerCase() !== 'false',
+        updateCheckEnabled: (env.UPDATE_CHECK ?? 'true').trim().toLowerCase() !== 'false',
+        idleMinutes: Number.isFinite(idle) && idle > 0 ? idle : 30,
+    };
+}
+//# sourceMappingURL=static-tenant-source.js.map

package/dist/tenancy/static-tenant-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-tenant-source.js","sourceRoot":"","sources":["../../src/tenancy/static-tenant-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAqB,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAA4C,MAAM,6BAA6B,CAAC;AAgExH,MAAM,aAAa,GAAG,4BAA4B,CAAC;AACnD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAoB,EAAE,QAA4B;IACjF,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,iBAAiB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,wCAAwC,MAAM,CAAC,UAAU,IAAI,EAAE,GAAG,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,mDAAmD,WAAW,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,oDAAoD,QAAQ,GAAG,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,qEAAqE;IACrE,wEAAwE;IACxE,8DAA8D;IAC9D,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,4BAA4B,iBAAiB,uCAAuC,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;IACjD,MAAM,oBAAoB,GAAG,MAAM,CAAC,aAAa,IAAI,aAAa,KAAK,EAAE,CAAC;IAC1E,IAAI,oBAAoB,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,oDAAoD,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,WAAW,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvG,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpG,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QACtC,CAAC,mBAAmB,EAAE,iBAAiB,CAAC;KAChC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,MAAM,IAAI,yBAAyB,KAAK,GAAG,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnG,MAAM,mBAAmB,GAAG,CAAC,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC;SAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SACxD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC/D,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QACpC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACrC,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC;QACjC,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC9B,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC;QACpC,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC;QACjC,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC;QACxC,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;QACzC,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,CAAC;QACvC,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC;QAC3C,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzC,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC;QACjD,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QACpC,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC;QACnD,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KAChD,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IAC3C,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ;QACR,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ;QACR,oBAAoB,EAAE,GAAG,QAAQ,GAAG;QACpC,mBAAmB,EAAE,GAAG,QAAQ,OAAO;QACvC,iBAAiB,EAAE,GAAG,QAAQ,MAAM;QACpC,mBAAmB,EAAE,GAAG,QAAQ,OAAO;QACvC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC;QAC3D,WAAW,EAAE,gBAAgB,CAAC,SAAS,CAAC;QACxC,SAAS,EAAE,gBAAgB,CAAC,mBAAmB,CAAC;QAChD,mBAAmB,EAAE,gBAAgB,CAAC,mBAAmB,CAAC;QAC1D,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,UAAU;QACV,aAAa;QACb,oBAAoB;QACpB,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACxE,YAAY,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAClD,gBAAgB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC1D,UAAU,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,sBAAsB,CAAC,CAAC,IAAI,EAAE;QAClE,iBAAiB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE;QAC1E,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC1C,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC1C,WAAW;QACX,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACxC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;QACnD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,mBAAmB;QACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,gBAAgB;QAChB,iBAAiB;QACjB,2BAA2B,EAAE,iBAAiB;QAC9C,eAAe,EAAE,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAC3D,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IACZ,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC7C,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE9D,YAAY,OAAgC,EAAE,QAA4B;QACxE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClD,MAAM,UAAU,GAAqB;gBACnC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;gBACtC,MAAM;aACP,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,UAAU,CAAC,IAAI,mBAAmB,CAAC,CAAC;YACrG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC7C,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,yBAAyB,KAAK,CAAC,IAAI,UAAU,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;gBACzG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,QAA4B;QAC9D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,OAAO,GAAI,MAAsC,EAAE,OAAO,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2CAA2C,CAAC,CAAC;QACjG,OAAO,IAAI,kBAAkB,CAAC,OAAyB,EAAE,QAAQ,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,KAAK;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACvC,CAAC;CACF;AAUD,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC5D,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,+GAA+G;YAC7G,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;IACxF,OAAO;QACL,WAAW;QACX,SAAS;QACT,WAAW,EAAE,kBAAkB,CAAC,GAAG,CAAC;QACpC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC;QACtC,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,aAAa;QACtC,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAC3D,cAAc;QACd,aAAa,EAAE,GAAG,CAAC,eAAe,IAAI,oBAAoB,EAAE;QAC5D,YAAY,EACV,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,sBAAsB;QACnH,oBAAoB,EAAE,CAAC,GAAG,CAAC,sBAAsB,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;QAC7F,kBAAkB,EAAE,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;QACjF,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;KAC3D,CAAC;AACJ,CAAC"}

package/dist/tenancy/tenant-host.d.ts

@@ -0,0 +1,80 @@
+import { type Express } from 'express';
+import type { ProcessConfig } from '../core-config.js';
+import { TenantRuntime, type TenantRuntimeDeps } from './tenant-runtime.js';
+import { type TenantSource } from './tenant-source.contract.js';
+/**
+ * The path prefix under which a process reaches ONE of its own tenants over
+ * loopback: `http://127.0.0.1:<port>/_tenant/<slug>/api/...`. The MCP proxy
+ * and the UTCP manuals it seeds dial the tenant's own REST surface this way,
+ * because a loopback request carries no tenant host name and a header cannot
+ * ride a UTCP call (the proxy is a passthrough; it reshapes nothing).
+ *
+ * The host honours the prefix only for a request that came from this
+ * machine AND was forwarded by nobody: the socket peer is loopback and there
+ * is no `X-Forwarded-For`. A reverse proxy on the same host (nginx, a
+ * Coolify proxy) delivers every public request from a loopback socket, and
+ * every such proxy adds that header; the process's own dial never does.
+ * What the prefix could grant anyone who got past this is only what the
+ * tenant's host name grants already — sessions, keys and tokens are per
+ * tenant — but the addressing rule is stated so it can be relied on.
+ */
+export declare const LOOPBACK_TENANT_PREFIX = "/_tenant";
+/** The base URL a tenant's graph dials itself at — see {@link LOOPBACK_TENANT_PREFIX}. */
+export declare function loopbackTenantBaseUrl(port: number, slug: string): string;
+/** Whether `address` is this machine talking to itself. */
+export declare function isLoopbackAddress(address: string | undefined): boolean;
+/** How a request names its tenant: by the loopback prefix, or by its host. */
+export type TenantSelector = {
+    kind: 'slug';
+    slug: string;
+    rest: string;
+} | {
+    kind: 'host';
+    host: string;
+};
+/**
+ * Which tenant a request is for. The loopback prefix wins, but only from a
+ * loopback peer that no proxy forwarded (no `X-Forwarded-For`); everything
+ * else is decided by the host name (the `X-Forwarded-Host` a trusted proxy
+ * set, else `Host`), lowercase and without its port.
+ */
+export declare function selectTenant(req: {
+    hostname: string;
+    url: string;
+    peer: string | undefined;
+    forwardedFor?: string | string[] | undefined;
+}): TenantSelector;
+export interface TenantHostOptions {
+    source: TenantSource;
+    process: ProcessConfig;
+    /** The built SPA, served once for every resolved tenant. */
+    staticDir?: string;
+    /** Minutes without a request after which a tenant's graph is stopped. Default 30; 0 never evicts. */
+    idleMinutes?: number;
+    /** How long a request waits for an activation in flight before answering 503. Default 60s. */
+    activationWaitMs?: number;
+    /** Seams for the runtimes the host builds — a suite's fake graphs. */
+    runtime?: TenantRuntimeDeps;
+    /** How often idle tenants are looked for. Default: once a minute. */
+    sweepIntervalMs?: number;
+}
+export interface TenantHost {
+    /** The app the process listens on. */
+    app: Express;
+    /** The runtimes built so far, by slug. */
+    runtimes(): ReadonlyMap<string, TenantRuntime>;
+    /** Stop every active tenant; the host keeps serving and reactivates on demand. */
+    evictAll(): Promise<void>;
+    /** Stop the idle sweep and every tenant: the process's shutdown. */
+    stop(): Promise<void>;
+}
+/**
+ * One Express app in front of many tenants' apps. It answers process health
+ * itself, resolves each request to a tenant (see {@link selectTenant}),
+ * activates that tenant's graph on first use, hands the request to the
+ * tenant's app, and serves the SPA for whatever the tenant's app leaves
+ * unhandled. Nothing below it knows there are other tenants: each graph was
+ * built by the same composition root a single-tenant deployment uses.
+ */
+export declare function createTenantHost(opts: TenantHostOptions): TenantHost;
+//# sourceMappingURL=tenant-host.d.ts.map

package/dist/tenancy/tenant-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-host.d.ts","sourceRoot":"","sources":["../../src/tenancy/tenant-host.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,KAAK,OAAO,EAAgB,MAAM,SAAS,CAAC;AAG9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,OAAO,EAAE,aAAa,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAA6D,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAI3H;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD,0FAA0F;AAC1F,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAKtE;AAED,8EAA8E;AAC9E,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3G;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;CAC9C,GAAG,cAAc,CAYjB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,aAAa,CAAC;IACvB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,GAAG,EAAE,OAAO,CAAC;IACb,0CAA0C;IAC1C,QAAQ,IAAI,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C,kFAAkF;IAClF,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,oEAAoE;IACpE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAeD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,UAAU,CA+IpE"}