@fungi.computer/oyster 0.0.0-stage → 0.1.0

package/dist/tenancy/auth0.d.ts

@@ -0,0 +1,64 @@
+import type { TenantId } from "../tenant.js";
+import type { AuthAdapter, Identity, ReadonlyTenantRegistry, ReadonlyTenancy } from "./contracts.js";
+/** One short-lived, single-use browser authorization transaction. */
+export type Auth0Transaction = Readonly<{
+    /** Tenant selected at login by the host resolver. */
+    tenantId: TenantId;
+    /** Exact canonical callback URI supplied to the provider. */
+    redirectUri: string;
+    /** State bound to the browser transaction cookie. */
+    state: string;
+    /** Secret verifier held server-side until the one-use exchange. */
+    codeVerifier: string;
+    /** Absolute expiration time in milliseconds. */
+    expiresAt: number;
+}>;
+/** Server-owned verified identity session; browsers receive only its random handle. */
+export type Auth0Session = Readonly<{
+    /** Tenant for which this identity was admitted at callback time. */
+    tenantId: TenantId;
+    /** Verified issuer/subject; live registry membership still applies per request. */
+    identity: Identity;
+    /** Absolute expiration, no later than the verified access token's expiry. */
+    expiresAt: number;
+}>;
+/** Host ports for optional browser login; stored state must be shared across host instances. */
+export type Auth0BrowserOptions = Readonly<{
+    /** Full callback pathname, including the prefix used to mount routes. */
+    callbackPath: string;
+    /** Use the kit's resolver; never accept a tenant from callback query/body data. */
+    resolveTenant: ReadonlyTenancy["resolve"];
+    /** Current tenant and membership authority, checked before issuing a session. */
+    registry: Pick<ReadonlyTenantRegistry, "get" | "membershipOf">;
+    /** Host-owned transaction storage with atomic one-use consumption. */
+    transactions: Readonly<{
+        /** Store until expiresAt; reject duplicate handles. */
+        put(id: string, transaction: Auth0Transaction): Promise<void>;
+        /** Atomically remove and return the transaction, or null if missing/consumed. */
+        take(id: string): Promise<Auth0Transaction | null>;
+    }>;
+    /** Host-owned session storage; expire and prune records at expiresAt. */
+    sessions: Readonly<{
+        /** Store a fresh opaque handle and verified identity until expiry. */
+        put(id: string, session: Auth0Session): Promise<void>;
+        /** Read a session by its opaque handle, or null after expiry/removal. */
+        get(id: string): Promise<Auth0Session | null>;
+    }>;
+}>;
+/** Auth0 issuer and audience configuration; browser login is opt-in. */
+export type Auth0Options = Readonly<{
+    /** Auth0 issuer hostname, including a configured custom hostname. */
+    domain: string;
+    /** Registered application's client identifier. */
+    clientId: string;
+    /** Identifier of the API for which access tokens are issued. */
+    audience: string;
+    /** Optional confidential-client secret; omit for a registered public PKCE client. */
+    clientSecret?: string;
+    /** Optional host-owned transport for issuer discovery, keys and token exchange. */
+    fetch?: typeof globalThis.fetch;
+    /** Browser routes and durable host-owned transaction/session storage. */
+    browser?: Auth0BrowserOptions;
+}>;
+/** Verify Auth0 identities; the registry alone supplies canonical membership and role. */
+export declare function auth0(options: Auth0Options): AuthAdapter;

package/dist/tenancy/auth0.js

@@ -0,0 +1,198 @@
+import { createRemoteJWKSet, customFetch, errors, jwtVerify } from "jose";
+import * as oauth from "oauth4webapi";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import { Hono } from "hono";
+import { parse, serialize } from "hono/utils/cookie";
+const subject = Schema.decodeUnknownOption(Schema.NonEmptyString);
+const maxTokenLength = 16 * 1024;
+const flowCookie = "__Host-tenancy-auth0-flow";
+const sessionCookie = "__Host-tenancy-auth0";
+function invalidCredential(cause) {
+    return (cause instanceof errors.JWTInvalid ||
+        cause instanceof errors.JWTExpired ||
+        cause instanceof errors.JWTClaimValidationFailed ||
+        cause instanceof errors.JWSInvalid ||
+        cause instanceof errors.JWSSignatureVerificationFailed ||
+        cause instanceof errors.JOSEAlgNotAllowed ||
+        cause instanceof errors.JWKSNoMatchingKey);
+}
+function invalidOAuth(cause) {
+    return (cause instanceof oauth.AuthorizationResponseError ||
+        cause instanceof oauth.ResponseBodyError ||
+        cause instanceof oauth.OperationProcessingError ||
+        cause instanceof oauth.WWWAuthenticateChallengeError);
+}
+function cookie(name, value, maxAge) {
+    return serialize(name, value, {
+        secure: true,
+        httpOnly: true,
+        sameSite: "Lax",
+        path: "/",
+        maxAge,
+    });
+}
+/** Verify Auth0 identities; the registry alone supplies canonical membership and role. */
+export function auth0(options) {
+    const issuer = new URL(`https://${options.domain}/`);
+    if (issuer.host !== options.domain.toLowerCase() ||
+        issuer.pathname !== "/" ||
+        issuer.username ||
+        issuer.password ||
+        issuer.search ||
+        issuer.hash ||
+        options.clientId.length === 0 ||
+        options.audience.length === 0)
+        throw new TypeError("Configure an Auth0 hostname, client ID and API audience");
+    const transport = options.fetch === undefined ? {} : { [customFetch]: options.fetch };
+    const oauthTransport = options.fetch === undefined
+        ? {}
+        : {
+            [oauth.customFetch]: (url, init) => {
+                const { body, ...rest } = init;
+                return (options.fetch ?? globalThis.fetch)(url, body === undefined ? rest : { ...rest, body });
+            },
+        };
+    const jwks = createRemoteJWKSet(new URL(".well-known/jwks.json", issuer), transport);
+    const verify = async (token) => {
+        if (token.length === 0 || token.length > maxTokenLength)
+            return null;
+        try {
+            const { payload } = await jwtVerify(token, jwks, {
+                issuer: issuer.href,
+                audience: options.audience,
+                algorithms: ["RS256"],
+                requiredClaims: ["sub", "exp", "iat"],
+            });
+            const decoded = subject(payload.sub);
+            if (Option.isNone(decoded) || payload.exp === undefined)
+                return null;
+            return {
+                identity: { provider: issuer.href, subject: decoded.value },
+                expiresAt: payload.exp * 1000,
+            };
+        }
+        catch (cause) {
+            if (invalidCredential(cause))
+                return null;
+            throw cause;
+        }
+    };
+    const browser = options.browser;
+    const routes = new Hono();
+    if (browser !== undefined) {
+        const callback = new URL(browser.callbackPath, "https://callback.invalid");
+        if (!browser.callbackPath.startsWith("/") ||
+            callback.origin !== "https://callback.invalid" ||
+            callback.pathname !== browser.callbackPath ||
+            callback.search ||
+            callback.hash)
+            throw new TypeError("Configure a canonical absolute callback pathname");
+        const client = { client_id: options.clientId };
+        const clientAuth = options.clientSecret === undefined
+            ? oauth.None()
+            : oauth.ClientSecretPost(options.clientSecret);
+        const discover = () => oauth
+            .discoveryRequest(issuer, oauthTransport)
+            .then((response) => oauth.processDiscoveryResponse(issuer, response));
+        routes.get("/login", async (context) => {
+            const tenant = await browser.resolveTenant(context.req.raw);
+            if (tenant === null)
+                return context.json({ error: "not_found" }, 404);
+            if (tenant.status !== "active")
+                return context.json({ error: "forbidden" }, 403);
+            const server = await discover();
+            if (server.authorization_endpoint === undefined)
+                throw new Error("Auth0 issuer has no authorization endpoint");
+            const state = oauth.generateRandomState();
+            const codeVerifier = oauth.generateRandomCodeVerifier();
+            const redirectUri = new URL(browser.callbackPath, tenant.origin).href;
+            const authorization = new URL(server.authorization_endpoint);
+            authorization.searchParams.set("client_id", client.client_id);
+            authorization.searchParams.set("redirect_uri", redirectUri);
+            authorization.searchParams.set("response_type", "code");
+            authorization.searchParams.set("scope", "openid");
+            authorization.searchParams.set("audience", options.audience);
+            authorization.searchParams.set("state", state);
+            authorization.searchParams.set("code_challenge_method", "S256");
+            authorization.searchParams.set("code_challenge", await oauth.calculatePKCECodeChallenge(codeVerifier));
+            await browser.transactions.put(state, {
+                tenantId: tenant.id,
+                state,
+                codeVerifier,
+                redirectUri,
+                expiresAt: Date.now() + 300_000,
+            });
+            context.header("Set-Cookie", cookie(flowCookie, state, 300));
+            context.header("Cache-Control", "no-store");
+            return context.redirect(authorization.href, 302);
+        });
+        routes.get("/callback", async (context) => {
+            context.header("Cache-Control", "no-store");
+            context.header("Set-Cookie", cookie(flowCookie, "", 0));
+            const flow = parse(context.req.header("Cookie") ?? "")[flowCookie];
+            if (flow === undefined || flow.length > 128)
+                return context.json({ error: "unauthorized" }, 401);
+            const transaction = await browser.transactions.take(flow);
+            const tenant = await browser.resolveTenant(context.req.raw);
+            const actual = new URL(context.req.url);
+            if (transaction === null ||
+                transaction.expiresAt <= Date.now() ||
+                tenant?.id !== transaction.tenantId ||
+                tenant.status !== "active" ||
+                `${actual.origin}${actual.pathname}` !== transaction.redirectUri)
+                return context.json({ error: "unauthorized" }, 401);
+            try {
+                const server = await discover();
+                const params = oauth.validateAuthResponse(server, client, actual, transaction.state);
+                const response = await oauth.authorizationCodeGrantRequest(server, client, clientAuth, params, transaction.redirectUri, transaction.codeVerifier, oauthTransport);
+                const result = await oauth.processAuthorizationCodeResponse(server, client, response);
+                const verified = await verify(result.access_token);
+                if (verified === null)
+                    return context.json({ error: "unauthorized" }, 401);
+                const current = await browser.registry.get(tenant.id);
+                if (current?.status !== "active" ||
+                    (await browser.registry.membershipOf(tenant.id, verified.identity)) === null)
+                    return context.json({ error: "forbidden" }, 403);
+                const id = oauth.generateRandomState();
+                const expiresAt = Math.min(verified.expiresAt, Date.now() + 3_600_000);
+                await browser.sessions.put(id, {
+                    tenantId: tenant.id,
+                    identity: verified.identity,
+                    expiresAt,
+                });
+                context.header("Set-Cookie", cookie(sessionCookie, id, Math.floor((expiresAt - Date.now()) / 1000)), { append: true });
+                return context.redirect(tenant.origin, 303);
+            }
+            catch (cause) {
+                if (invalidOAuth(cause))
+                    return context.json({ error: "unauthorized" }, 401);
+                throw cause;
+            }
+        });
+    }
+    const adapter = {
+        id: "auth0",
+        async authenticate(request, tenant) {
+            const authorization = request.headers.get("Authorization");
+            if (authorization?.startsWith("Bearer ") === true) {
+                const verified = await verify(authorization.slice(7));
+                return verified === null
+                    ? { kind: "refused", status: 401 }
+                    : { kind: "identity", identity: verified.identity };
+            }
+            if (browser !== undefined) {
+                const id = parse(request.headers.get("Cookie") ?? "")[sessionCookie];
+                if (id !== undefined) {
+                    const session = id.length > 128 ? null : await browser.sessions.get(id);
+                    if (session?.tenantId !== tenant.id ||
+                        session.expiresAt <= Date.now())
+                        return { kind: "refused", status: 401 };
+                    return { kind: "identity", identity: session.identity };
+                }
+            }
+            return { kind: "pass" };
+        },
+    };
+    return browser === undefined ? adapter : { ...adapter, routes };
+}

package/dist/tenancy/cloudflare/rate-limit.d.ts

@@ -0,0 +1,8 @@
+import type { TenancyPolicy } from "../contracts.js";
+/** Retry-After is an advisory response delay, not a configured quota or reset time. */
+export type RateLimitOptions = Readonly<{
+    /** Positive whole seconds returned on a native refusal. */
+    retryAfterSeconds: number;
+}>;
+/** Delegate abuse admission to the configured native binding, using only its key API. */
+export declare function rateLimit(binding: Pick<RateLimit, "limit">, options: RateLimitOptions): TenancyPolicy;

package/dist/tenancy/cloudflare/rate-limit.js

@@ -0,0 +1,19 @@
+import * as Schema from "effect/Schema";
+/** Delegate abuse admission to the configured native binding, using only its key API. */
+export function rateLimit(binding, options) {
+    const retryAfter = Schema.decodeUnknownSync(Schema.Int.check(Schema.isGreaterThan(0)))(options.retryAfterSeconds);
+    return async ({ tenant, principal }) => {
+        const actor = principal.actor;
+        const id = actor.kind === "member"
+            ? actor.memberId
+            : actor.kind === "agent"
+                ? actor.agentId
+                : actor.keyId;
+        const { success } = await binding.limit({
+            key: JSON.stringify([tenant.id, actor.kind, id]),
+        });
+        return success
+            ? { kind: "allow" }
+            : { kind: "refuse", status: 429, retryAfter };
+    };
+}

package/dist/tenancy/cloudflare/registry.d.ts

@@ -0,0 +1,50 @@
+import type { Brand } from "effect/Brand";
+import type { Identity, ManagedTenantRegistry, Membership, ReadonlyTenantRegistry, Tenant } from "../contracts.js";
+/** The registry owner's atomic read of one host and one identity. */
+export type RegistryAdmission = Readonly<{
+    /** The tenant registered at the requested host. */
+    tenant: Tenant;
+    /** The identity's live membership in that tenant, or null. */
+    membership: Membership | null;
+}>;
+/** One request's atomic registry read, with the host and identity it named. */
+export type AdmissionRecord = RegistryAdmission & Readonly<{
+    /** The canonical URL host the request named. */
+    host: string;
+    /** The external identity whose membership was read. */
+    identity: Identity;
+}>;
+/**
+ * One atomic registry read for one request. Only {@link durableObjectRegistry}
+ * constructs it, so lower layers cannot mint authority.
+ */
+export type TenantAdmission = AdmissionRecord & Brand<"TenantAdmission">;
+/** Native registry instance; its public shape exposes no runtime-private state. */
+export type TenancyRegistryDO = ManagedTenantRegistry & Required<Pick<ReadonlyTenantRegistry, "byDomain">> & Readonly<{
+    /** One atomic read of the tenant at a host and one identity's membership. */
+    admission(host: string, identity: Identity): Promise<RegistryAdmission | null>;
+}> & Rpc.DurableObjectBranded;
+/** Re-export from a host Worker and bind a SQLite-backed Durable Object namespace. */
+export declare const TenancyRegistryDO: new (ctx: DurableObjectState) => TenancyRegistryDO;
+/** A read-only registry that includes the provisioned-domain index. */
+export type DomainRegistry = ReadonlyTenantRegistry & Required<Pick<ReadonlyTenantRegistry, "byDomain">>;
+/** Read-only native registry, with one-read request admission. */
+export type DurableReadonlyRegistry = DomainRegistry & Readonly<{
+    /** Read the tenant at `host` and `identity`'s membership atomically, once. */
+    admission(host: string, identity: Identity): Promise<TenantAdmission | null>;
+}>;
+/** Managed native registry includes the provisioned-domain index. */
+export type DurableRegistry = ManagedTenantRegistry & DurableReadonlyRegistry;
+/** Explicitly expose only read methods when the host requests a read-only facade. */
+export declare function durableObjectRegistry(binding: Pick<DurableObjectNamespace<TenancyRegistryDO>, "getByName">, options: {
+    readonly: true;
+}): DurableReadonlyRegistry;
+/** Use one namespace's registry object as the tenant and owner mapping authority. */
+export declare function durableObjectRegistry(binding: Pick<DurableObjectNamespace<TenancyRegistryDO>, "getByName">, options?: {
+    readonly?: false;
+}): DurableRegistry;
+/**
+ * Answer registry reads only from one request's admission. Any other tenant,
+ * host, identity or member reads as absent, so every refusal stays closed.
+ */
+export declare function admittedRegistry(admission: TenantAdmission): DomainRegistry;

package/dist/tenancy/cloudflare/registry.js

@@ -0,0 +1,301 @@
+import { DurableObject } from "cloudflare:workers";
+import * as Schema from "effect/Schema";
+import { tenantIdSchema } from "../../tenant.js";
+import { checkedOrigin, immutable, createMemberId, membershipVersionSchema, } from "../registry-record.js";
+const statusSchema = Schema.Literals(["active", "suspended", "deleting"]);
+const tenantRow = Schema.Struct({
+    id: tenantIdSchema,
+    handle: tenantIdSchema,
+    origin: Schema.String,
+    status: statusSchema,
+});
+const membershipRow = Schema.Struct({
+    member_id: Schema.NonEmptyString,
+    role: Schema.Literals(["owner", "member"]),
+    membership_version: membershipVersionSchema,
+});
+const memberRow = Schema.Struct({ member_id: Schema.NonEmptyString });
+const domainRow = Schema.Struct({ host: Schema.String });
+const identitySchema = Schema.Struct({
+    provider: Schema.NonEmptyString,
+    subject: Schema.NonEmptyString,
+});
+const tenantAdmissionSchema = Schema.Struct({
+    host: Schema.String,
+    identity: identitySchema,
+    tenant: Schema.Struct({
+        id: tenantIdSchema,
+        handle: tenantIdSchema,
+        origin: Schema.String,
+        status: statusSchema,
+        owners: Schema.Array(Schema.NonEmptyString),
+        domains: Schema.Array(Schema.String),
+    }),
+    membership: Schema.NullOr(Schema.Struct({
+        memberId: Schema.NonEmptyString,
+        role: Schema.Literals(["owner", "member"]),
+        membershipVersion: membershipVersionSchema,
+    })),
+}).pipe(Schema.brand("TenantAdmission"));
+const createSchema = Schema.Struct({
+    handle: tenantIdSchema,
+    origin: Schema.String,
+    domains: Schema.Array(Schema.String),
+    owner: identitySchema,
+});
+class RegistryObject extends DurableObject {
+    constructor(ctx) {
+        super(ctx, {});
+        // Pre-launch registries require a fresh store; CREATE IF NOT EXISTS does not
+        // upgrade an old memberships table. No incremental migration is supported.
+        // DEFAULT 1 is only an insert placeholder: the AFTER INSERT trigger replaces
+        // it with the durable clock revision in the same atomic statement. Lookups
+        // decode the stored revision and never supply a default.
+        ctx.storage.sql.exec(`
+      CREATE TABLE IF NOT EXISTS tenants (id TEXT PRIMARY KEY, handle TEXT UNIQUE NOT NULL, origin TEXT NOT NULL, status TEXT NOT NULL CHECK (status IN ('active','suspended','deleting')));
+      CREATE TABLE IF NOT EXISTS domains (host TEXT PRIMARY KEY, tenant_id TEXT NOT NULL, ordinal INTEGER NOT NULL);
+      CREATE INDEX IF NOT EXISTS domains_tenant ON domains(tenant_id);
+      CREATE TABLE IF NOT EXISTS identities (provider TEXT NOT NULL, subject TEXT NOT NULL, member_id TEXT UNIQUE NOT NULL, PRIMARY KEY(provider,subject));
+      CREATE TABLE IF NOT EXISTS memberships (tenant_id TEXT NOT NULL, member_id TEXT NOT NULL, role TEXT NOT NULL CHECK (role IN ('owner','member')), membership_version INTEGER NOT NULL DEFAULT 1 CHECK(membership_version BETWEEN 1 AND 9007199254740991), PRIMARY KEY(tenant_id,member_id));
+      CREATE TABLE IF NOT EXISTS membership_clock (id INTEGER PRIMARY KEY CHECK(id=1), revision INTEGER NOT NULL CHECK(revision BETWEEN 0 AND 9007199254740991));
+      INSERT OR IGNORE INTO membership_clock VALUES(1,0);
+      CREATE TRIGGER IF NOT EXISTS membership_insert_revision AFTER INSERT ON memberships BEGIN
+        UPDATE membership_clock SET revision=revision+1 WHERE id=1;
+        UPDATE memberships SET membership_version=(SELECT revision FROM membership_clock WHERE id=1) WHERE tenant_id=NEW.tenant_id AND member_id=NEW.member_id;
+      END;
+      CREATE TRIGGER IF NOT EXISTS membership_role_revision AFTER UPDATE OF role ON memberships WHEN OLD.role!=NEW.role BEGIN
+        UPDATE membership_clock SET revision=revision+1 WHERE id=1;
+        UPDATE memberships SET membership_version=(SELECT revision FROM membership_clock WHERE id=1) WHERE tenant_id=NEW.tenant_id AND member_id=NEW.member_id;
+      END;
+      CREATE TRIGGER IF NOT EXISTS membership_delete_revision AFTER DELETE ON memberships BEGIN
+        UPDATE membership_clock SET revision=revision+1 WHERE id=1;
+      END;
+      CREATE TRIGGER IF NOT EXISTS tenant_status_membership_revision AFTER UPDATE OF status ON tenants WHEN OLD.status!=NEW.status BEGIN
+        UPDATE membership_clock SET revision=revision+1 WHERE id=1;
+        UPDATE memberships SET membership_version=(SELECT revision FROM membership_clock WHERE id=1) WHERE tenant_id=NEW.id;
+      END;
+    `);
+    }
+    #get(id) {
+        const raw = this.ctx.storage.sql
+            .exec("SELECT id,handle,origin,status FROM tenants WHERE id = ?", id)
+            .toArray()[0];
+        if (raw === undefined)
+            return null;
+        const row = Schema.decodeUnknownSync(tenantRow)(raw);
+        const domains = this.ctx.storage.sql
+            .exec("SELECT host FROM domains WHERE tenant_id = ? ORDER BY ordinal", id)
+            .toArray()
+            .map((value) => Schema.decodeUnknownSync(domainRow)(value).host);
+        const owners = this.ctx.storage.sql
+            .exec("SELECT member_id FROM memberships WHERE tenant_id = ? AND role = 'owner' ORDER BY member_id", id)
+            .toArray()
+            .map((value) => Schema.decodeUnknownSync(memberRow)(value).member_id);
+        return immutable({
+            ...row,
+            domains,
+            owners,
+            origin: checkedOrigin(row.origin, domains),
+        });
+    }
+    get(id) {
+        return Promise.resolve(this.#get(Schema.decodeUnknownSync(tenantIdSchema)(id)));
+    }
+    byHandle(handle) {
+        const row = this.ctx.storage.sql
+            .exec("SELECT id FROM tenants WHERE handle = ?", handle)
+            .toArray()[0];
+        return Promise.resolve(row === undefined
+            ? null
+            : this.#get(Schema.decodeUnknownSync(Schema.Struct({ id: tenantIdSchema }))(row)
+                .id));
+    }
+    byDomain(host) {
+        const row = this.ctx.storage.sql
+            .exec("SELECT tenant_id FROM domains WHERE host = ?", host)
+            .toArray()[0];
+        return Promise.resolve(row === undefined
+            ? null
+            : this.#get(Schema.decodeUnknownSync(Schema.Struct({ tenant_id: tenantIdSchema }))(row).tenant_id));
+    }
+    status(id) {
+        return Promise.resolve(this.#get(id)?.status ?? null);
+    }
+    memberById(id, memberId) {
+        const tenantId = Schema.decodeUnknownSync(tenantIdSchema)(id);
+        const canonicalId = Schema.decodeUnknownSync(Schema.NonEmptyString)(memberId);
+        const row = this.ctx.storage.sql
+            .exec("SELECT member_id,role,membership_version FROM memberships WHERE tenant_id=? AND member_id=?", tenantId, canonicalId)
+            .toArray()[0];
+        if (row === undefined)
+            return Promise.resolve(null);
+        const stored = Schema.decodeUnknownSync(membershipRow)(row);
+        return Promise.resolve({
+            memberId: stored.member_id,
+            role: stored.role,
+            membershipVersion: stored.membership_version,
+        });
+    }
+    membershipOf(id, identity) {
+        return Promise.resolve(this.#membershipOf(id, Schema.decodeUnknownSync(identitySchema)(identity)));
+    }
+    /** One atomic read of the tenant at `host` and `identity`'s live membership. */
+    admission(host, identity) {
+        const domain = Schema.decodeUnknownSync(Schema.String)(host);
+        const member = Schema.decodeUnknownSync(identitySchema)(identity);
+        return Promise.resolve(this.ctx.storage.transactionSync(() => {
+            const row = this.ctx.storage.sql
+                .exec("SELECT tenant_id FROM domains WHERE host = ?", domain)
+                .toArray()[0];
+            if (row === undefined)
+                return null;
+            const tenant = this.#get(Schema.decodeUnknownSync(Schema.Struct({ tenant_id: tenantIdSchema }))(row).tenant_id);
+            return tenant === null
+                ? null
+                : { tenant, membership: this.#membershipOf(tenant.id, member) };
+        }));
+    }
+    #membershipOf(id, owner) {
+        const row = this.ctx.storage.sql
+            .exec(`SELECT m.member_id,m.role,m.membership_version FROM memberships m JOIN identities i ON m.member_id=i.member_id WHERE m.tenant_id=? AND i.provider=? AND i.subject=?`, id, owner.provider, owner.subject)
+            .toArray()[0];
+        if (row === undefined)
+            return null;
+        const stored = Schema.decodeUnknownSync(membershipRow)(row);
+        return {
+            memberId: stored.member_id,
+            role: stored.role,
+            membershipVersion: stored.membership_version,
+        };
+    }
+    create(input) {
+        return Promise.resolve().then(() => {
+            const parsed = Schema.decodeUnknownSync(createSchema)(input);
+            const origin = checkedOrigin(parsed.origin, parsed.domains);
+            return this.ctx.storage.transactionSync(() => {
+                const raw = this.ctx.storage.sql
+                    .exec("SELECT member_id FROM identities WHERE provider=? AND subject=?", parsed.owner.provider, parsed.owner.subject)
+                    .toArray()[0];
+                const memberId = raw === undefined
+                    ? createMemberId()
+                    : Schema.decodeUnknownSync(memberRow)(raw).member_id;
+                if (raw === undefined)
+                    this.ctx.storage.sql.exec("INSERT INTO identities (provider,subject,member_id) VALUES (?,?,?)", parsed.owner.provider, parsed.owner.subject, memberId);
+                this.ctx.storage.sql.exec("INSERT INTO tenants (id,handle,origin,status) VALUES (?,?,?,'active')", parsed.handle, parsed.handle, origin);
+                for (const [ordinal, host] of parsed.domains.entries())
+                    this.ctx.storage.sql.exec("INSERT INTO domains (host,tenant_id,ordinal) VALUES (?,?,?)", host, parsed.handle, ordinal);
+                this.ctx.storage.sql.exec("INSERT INTO memberships (tenant_id,member_id,role) VALUES (?,?,'owner')", parsed.handle, memberId);
+                return immutable({
+                    id: parsed.handle,
+                    handle: parsed.handle,
+                    origin,
+                    status: "active",
+                    domains: parsed.domains,
+                    owners: [memberId],
+                });
+            });
+        });
+    }
+    setStatus(id, status) {
+        const parsed = Schema.decodeUnknownSync(statusSchema)(status);
+        if (this.#get(id) === null)
+            throw new Error("Tenant does not exist");
+        this.ctx.storage.sql.exec("UPDATE tenants SET status=? WHERE id=?", parsed, id);
+        return Promise.resolve();
+    }
+    delete(id) {
+        this.ctx.storage.transactionSync(() => {
+            this.ctx.storage.sql.exec("DELETE FROM memberships WHERE tenant_id=?", id);
+            this.ctx.storage.sql.exec("DELETE FROM domains WHERE tenant_id=?", id);
+            this.ctx.storage.sql.exec("DELETE FROM tenants WHERE id=?", id);
+        });
+        return Promise.resolve();
+    }
+}
+/** Re-export from a host Worker and bind a SQLite-backed Durable Object namespace. */
+export const TenancyRegistryDO = RegistryObject;
+export function durableObjectRegistry(binding, options = {}) {
+    const stub = () => binding.getByName("registry");
+    const read = {
+        get: async (id) => {
+            const result = await stub().get(id);
+            return result === null ? null : immutable(result);
+        },
+        byHandle: async (handle) => {
+            const result = await stub().byHandle(handle);
+            return result === null ? null : immutable(result);
+        },
+        byDomain: async (host) => {
+            const result = await stub().byDomain(host);
+            return result === null ? null : immutable(result);
+        },
+        status: async (id) => await stub().status(id),
+        memberById: async (id, memberId) => {
+            const result = await stub().memberById(id, memberId);
+            return result === null
+                ? null
+                : {
+                    memberId: result.memberId,
+                    role: result.role,
+                    membershipVersion: result.membershipVersion,
+                };
+        },
+        membershipOf: async (id, identity) => {
+            const result = await stub().membershipOf(id, identity);
+            return result === null
+                ? null
+                : {
+                    memberId: result.memberId,
+                    role: result.role,
+                    membershipVersion: result.membershipVersion,
+                };
+        },
+        admission: async (host, identity) => {
+            const result = await stub().admission(host, identity);
+            return result === null
+                ? null
+                : Schema.decodeUnknownSync(tenantAdmissionSchema)({
+                    host,
+                    identity,
+                    tenant: result.tenant,
+                    membership: result.membership,
+                });
+        },
+    };
+    return options.readonly === true
+        ? read
+        : {
+            ...read,
+            create: async (input) => {
+                const result = await stub().create(input);
+                return immutable(result);
+            },
+            setStatus: async (id, status) => {
+                await stub().setStatus(id, status);
+            },
+            delete: async (id) => {
+                await stub().delete(id);
+            },
+        };
+}
+/**
+ * Answer registry reads only from one request's admission. Any other tenant,
+ * host, identity or member reads as absent, so every refusal stays closed.
+ */
+export function admittedRegistry(admission) {
+    const { host, identity, membership } = admission;
+    const tenant = immutable(admission.tenant);
+    const selected = (id) => (id === tenant.id ? tenant : null);
+    const member = (id) => id === tenant.id && membership !== null ? { ...membership } : null;
+    return {
+        get: (id) => Promise.resolve(selected(id)),
+        byHandle: (handle) => Promise.resolve(handle === tenant.handle ? tenant : null),
+        byDomain: (requested) => Promise.resolve(requested === host ? tenant : null),
+        status: (id) => Promise.resolve(selected(id)?.status ?? null),
+        membershipOf: (id, requested) => Promise.resolve(requested.provider === identity.provider &&
+            requested.subject === identity.subject
+            ? member(id)
+            : null),
+        memberById: (id, memberId) => Promise.resolve(member(id)?.memberId === memberId ? member(id) : null),
+    };
+}

package/dist/tenancy/cloudflare.d.ts

@@ -0,0 +1,2 @@
+export { rateLimit, type RateLimitOptions } from "./cloudflare/rate-limit.js";
+export { TenancyRegistryDO, admittedRegistry, durableObjectRegistry, type DomainRegistry, type DurableReadonlyRegistry, type AdmissionRecord, type RegistryAdmission, type TenantAdmission, type DurableRegistry, } from "./cloudflare/registry.js";

package/dist/tenancy/cloudflare.js

@@ -0,0 +1,2 @@
+export { rateLimit } from "./cloudflare/rate-limit.js";
+export { TenancyRegistryDO, admittedRegistry, durableObjectRegistry, } from "./cloudflare/registry.js";

package/dist/tenancy/cold-directory.d.ts

@@ -0,0 +1,13 @@
+import type { ResolvedTenant, TenantScope } from "../tenant.js";
+import type { ReadonlyTenantRegistry } from "./contracts.js";
+/** Live directory admission for a host-persisted tenant during background work. */
+export type ColdTenantDirectory = Readonly<{
+    /** Select only the current active tenant at its stored canonical origin. */
+    resolve(scope: TenantScope): Promise<ResolvedTenant | null>;
+}>;
+/**
+ * Reconstruct background admission from the same host-owned tenant registry.
+ * Every selection and member lookup reads current authority. This adapter has
+ * no credential authority: its authenticate method always refuses requests.
+ */
+export declare function coldTenantDirectory(registry: Pick<ReadonlyTenantRegistry, "get" | "status" | "memberById">): ColdTenantDirectory;