@fungi.computer/oyster 0.0.1 → 0.2.0

package/dist/tenancy/contracts.d.ts

@@ -0,0 +1,195 @@
+import type { OysterTenancy } from "../tenant.js";
+import type { TenantId, TenantPrincipal, TenantScope } from "../tenant.js";
+import type { Hono, MiddlewareHandler } from "hono";
+/** An external identity; the registry owns its canonical member mapping. */
+export type Identity = Readonly<{
+    /** Verified issuer/provider namespace, kept separate from the subject. */
+    provider: string;
+    /** Stable verified subject within that provider. */
+    subject: string;
+    /** Optional display metadata, never a membership lookup key. */
+    email?: string;
+}>;
+/** One provisioned tenant and its registry-owned canonical public origin. */
+export type Tenant = Readonly<{
+    /** Host-selected tenant identity used by scope naming. */
+    id: TenantId;
+    /** Provisioned label used by hostname and path resolution. */
+    handle: string;
+    /** Canonical HTTPS origin matching one declared domain. */
+    origin: string;
+    /** Suspended tenants refuse admission; deleting tenants do not resolve. */
+    status: "active" | "suspended" | "deleting";
+    /** Stored canonical identities of this tenant's owners. */
+    owners: readonly string[];
+    /** Registered canonical URL hosts, including any configured port. */
+    domains: readonly string[];
+}>;
+/** A live membership, carrying a stored host-owned member identity. */
+export type Membership = Readonly<{
+    /** Canonical member ID minted or supplied by the registry owner. */
+    memberId: string;
+    /** Authority granted by this tenant's membership record. */
+    role: "owner" | "member";
+    /** Positive safe revision owned by the registry; changes never reuse a deleted membership's revision. */
+    membershipVersion: number;
+}>;
+/** Reads existing authority; this port cannot mutate tenants or members. */
+export type ReadonlyTenantRegistry = Readonly<{
+    /** Read a provisioned record, or null after removal. */
+    get(id: TenantId): Promise<Tenant | null>;
+    /** Resolve a provisioned handle; unknown handles never fall back. */
+    byHandle(handle: string): Promise<Tenant | null>;
+    /** Optional index for custom-domain resolution. */
+    byDomain?(host: string): Promise<Tenant | null>;
+    /** Read live admission status, or null for a removed tenant. */
+    status(id: TenantId): Promise<Tenant["status"] | null>;
+    /** Look up the separate provider/subject pair and its canonical membership. */
+    membershipOf(id: TenantId, identity: Identity): Promise<Membership | null>;
+    /** Read the stored membership for a canonical member ID; null means absent. */
+    memberById(id: TenantId, memberId: string): Promise<Membership | null>;
+}>;
+/** A single create transition records tenant and owner membership together. */
+export type TenantCreateInput = Readonly<{
+    /** New provisioned tenant handle. */
+    handle: string;
+    /** HTTPS origin validated against domains before storage. */
+    origin: string;
+    /** Canonical hosts owned by this tenant. */
+    domains: readonly string[];
+    /** External identity whose canonical owner membership is recorded atomically. */
+    owner: Identity;
+}>;
+/** Mutable registry owner; remove is called only after teardown succeeds. */
+export type ManagedTenantRegistry = ReadonlyTenantRegistry & Readonly<{
+    /** Atomically store a tenant and mint/reuse its canonical owner membership. */
+    create(input: TenantCreateInput): Promise<Tenant>;
+    /** Change admission status without discarding the tenant's scope record. */
+    setStatus(id: TenantId, status: Tenant["status"]): Promise<void>;
+    /** Remove the record and its memberships after successful teardown. */
+    delete(id: TenantId): Promise<void>;
+}>;
+/** Request URL resolution, with an explicit origin/path distinction. */
+export type TenantResolverAdapter<Kind extends "origin" | "path" = "origin" | "path"> = Readonly<{
+    /** Origin resolvers can host Oyster; path resolvers serve APIs only. */
+    kind: Kind;
+    /** Resolve only from the parsed request URL and provisioned registry. */
+    resolve(url: URL, registry: ReadonlyTenantRegistry): Promise<TenantId | null>;
+}>;
+/** Adapter output: pass only when the presented credential is not this adapter's. */
+export type AuthResult = Readonly<{
+    /** A verified external identity requiring registry membership admission. */
+    kind: "identity";
+    /** Verified provider and subject, not a caller-selected member ID. */
+    identity: Identity;
+}> | Readonly<{
+    /** A canonical principal already attested for the selected tenant. */
+    kind: "principal";
+    /** Host-attested actor, with a role only for a member. */
+    principal: TenantPrincipal;
+}> | Readonly<{
+    /** This adapter does not recognize the presented credential. */
+    kind: "pass";
+}> | Readonly<{
+    /** Recognized but invalid credential; stop the chain. */
+    kind: "refused";
+    /** Authentication or authorization refusal. */
+    status: 401 | 403;
+}>;
+/** Authentication proves an identity, or attests a principal for this tenant. */
+export type AuthAdapter = Readonly<{
+    /** Stable adapter name for host composition. */
+    id: string;
+    /** Optional relative login/callback routes, mounted explicitly by the host. */
+    routes?: Hono;
+    /** Verify the credential for the host-selected tenant; pass advances the chain. */
+    authenticate(request: Request, tenant: Tenant): Promise<AuthResult>;
+}>;
+/** Abuse-only admission policy; it does not meter or bill usage. */
+export type TenancyPolicy = (context: Readonly<{
+    /** Provisioned tenant selected before authentication. */
+    tenant: Tenant;
+    /** Admitted canonical actor and member role, if applicable. */
+    principal: TenantPrincipal;
+    /** Original request, for trusted host abuse-policy inputs. */
+    request: Request;
+}>) => Promise<Readonly<{
+    /** Continue admission. */
+    kind: "allow";
+}> | Readonly<{
+    /** Refuse for abuse limiting. */
+    kind: "refuse";
+    /** The policy's rate-limiting HTTP status. */
+    status: 429;
+    /** Retry delay in seconds for the HTTP Retry-After header. */
+    retryAfter: number;
+}>>;
+/** Lifecycle callbacks run after create and before physical deletion. */
+export type TenancyHooks = Readonly<{
+    /** Notification after the atomic registry create has committed. */
+    "tenant.created"?: (context: Readonly<{
+        /** Newly committed tenant, including its canonical owner membership. */
+        tenant: Tenant;
+    }>) => Promise<void>;
+    /** Idempotent cleanup before removal; failures retain the deleting record. */
+    "tenant.deleting"?: (context: Readonly<{
+        /** Registry-owned record marked deleting. */
+        tenant: Tenant;
+        /** Scope built from the record's canonical origin, never a request. */
+        scope: TenantScope;
+    }>) => Promise<void>;
+}>;
+/** Typed result of tenant authentication and abuse-policy admission. */
+export type TenancyAdmission = Readonly<{
+    /** Successful request admission. */
+    kind: "admitted";
+    /** Provisioned tenant whose live status permits admission. */
+    tenant: Tenant;
+    /** Canonical actor admitted within that tenant. */
+    principal: TenantPrincipal;
+}> | Readonly<{
+    /** No principal or tenant is exposed on refusal. */
+    kind: "refused";
+    /** Safe authentication, authorization, absence or abuse outcome. */
+    status: 401 | 403 | 404 | 429;
+    /** Optional retry delay in seconds for an abuse refusal. */
+    retryAfter?: number;
+}>;
+/** Typed Hono context fields populated only after admission. */
+export type TenancyVariables = {
+    /** The admitted provisioned tenant. */
+    tenant: Tenant;
+    /** The admitted canonical principal. */
+    principal: TenantPrincipal;
+};
+/** Read-only host API; no create/delete methods are exposed. */
+export type ReadonlyTenancy<Kind extends "origin" | "path" = "origin" | "path"> = Readonly<{
+    /** Resolve the provisioned tenant from the request URL. */
+    resolve(request: Request): Promise<Tenant | null>;
+    /** Re-resolve the request and authenticate within the selected tenant. */
+    authenticate(request: Request, tenant: Tenant): Promise<TenancyAdmission>;
+    /** Read canonical membership without deriving IDs from external identity data. */
+    member(tenantId: TenantId, identity: Identity): Promise<TenantPrincipal | null>;
+    /** Resolve current active-tenant membership by stored member ID, without credentials. */
+    memberById(tenantId: TenantId, memberId: string): Promise<(TenantPrincipal & Readonly<{
+        membershipVersion: number;
+    }>) | null>;
+    /** Admit requests and populate Hono context before reaching protected handlers. */
+    middleware(options?: Readonly<{
+        /** Require a member role; owners satisfy member, keys/Agents satisfy neither. */
+        role?: "owner" | "member";
+    }>): MiddlewareHandler<{
+        /** Context fields supplied only after successful tenant admission. */
+        Variables: TenancyVariables;
+    }>;
+}> & (Kind extends "origin" ? Readonly<{
+    /** Bind canonical tenant scope and authentication to the Oyster host port. */
+    oyster(): OysterTenancy;
+}> : Record<never, never>);
+/** Managed hosts can provision tenants and run teardown through the kit. */
+export type ManagedTenancy<Kind extends "origin" | "path" = "origin" | "path"> = ReadonlyTenancy<Kind> & Readonly<{
+    /** Delegate atomic provisioning, then invoke the created hook. */
+    create(input: TenantCreateInput): Promise<Tenant>;
+    /** Hold deleting status until all configured cleanup succeeds. */
+    delete(id: TenantId): Promise<void>;
+}>;

package/dist/tenancy/contracts.js

@@ -0,0 +1 @@
+export {};

package/dist/tenancy/index.d.ts

@@ -0,0 +1,19 @@
+import type { AuthAdapter, ManagedTenantRegistry, ManagedTenancy, ReadonlyTenantRegistry, ReadonlyTenancy, TenancyHooks, TenancyPolicy, TenantResolverAdapter } from "./contracts.js";
+/** Configuration composes resolution, live registry authority and auth adapters. */
+export type TenancyConfig<Registry extends ReadonlyTenantRegistry = ReadonlyTenantRegistry, Kind extends "origin" | "path" = "origin" | "path"> = Readonly<{
+    /** Select tenants only from the parsed request URL. */
+    resolve: TenantResolverAdapter<Kind>;
+    /** The tenant and canonical membership authority. */
+    registry: Registry;
+    /** Ordered authentication adapters; pass alone advances the chain. */
+    auth: readonly AuthAdapter[];
+    /** Optional abuse-only policy applied after authentication. */
+    policy?: TenancyPolicy;
+    /** Lifecycle notifications for managed registry hosts. */
+    on?: TenancyHooks;
+}>;
+/** Managed registries expose provisioning and cleanup; readonly registries do not. */
+export declare function createTenancy<Kind extends "origin" | "path">(config: TenancyConfig<ManagedTenantRegistry, Kind>): ManagedTenancy<Kind>;
+/** Resolve and authenticate requests without exposing registry mutations. */
+export declare function createTenancy<Kind extends "origin" | "path">(config: TenancyConfig<ReadonlyTenantRegistry, Kind>): ReadonlyTenancy<Kind>;
+export type { AuthAdapter, AuthResult, Identity, ManagedTenantRegistry, ManagedTenancy, Membership, ReadonlyTenantRegistry, ReadonlyTenancy, Tenant, TenantCreateInput, TenancyAdmission, TenancyHooks, TenancyPolicy, TenancyVariables, TenantResolverAdapter, } from "./contracts.js";

package/dist/tenancy/index.js

@@ -0,0 +1,156 @@
+import { createOysterTenancy } from "./oyster.js";
+import { tenantScope } from "../tenant.js";
+function managed(registry) {
+    return ("create" in registry &&
+        typeof registry.create === "function" &&
+        "setStatus" in registry &&
+        typeof registry.setStatus === "function" &&
+        "delete" in registry &&
+        typeof registry.delete === "function");
+}
+export function createTenancy(config) {
+    const registry = config.registry;
+    const adapters = [...config.auth];
+    const policy = config.policy;
+    const resolve = async (request) => {
+        const url = new URL(request.url);
+        const id = await config.resolve.resolve(url, registry);
+        if (id === null)
+            return null;
+        const tenant = await registry.get(id);
+        if (tenant === null || tenant.status === "deleting")
+            return null;
+        if (config.resolve.kind === "origin" &&
+            (url.protocol !== "https:" || !tenant.domains.includes(url.host)))
+            return null;
+        return tenant;
+    };
+    const member = async (tenantId, identity) => {
+        const status = await registry.status(tenantId);
+        if (status === null || status === "deleting")
+            return null;
+        const membership = await registry.membershipOf(tenantId, identity);
+        return membership === null
+            ? null
+            : {
+                actor: { kind: "member", memberId: membership.memberId },
+                role: membership.role,
+            };
+    };
+    const memberById = async (tenantId, memberId) => {
+        if ((await registry.status(tenantId)) !== "active")
+            return null;
+        const membership = await registry.memberById(tenantId, memberId);
+        if (membership?.memberId !== memberId ||
+            (await registry.status(tenantId)) !== "active")
+            return null;
+        return {
+            actor: { kind: "member", memberId: membership.memberId },
+            role: membership.role,
+            membershipVersion: membership.membershipVersion,
+        };
+    };
+    const admit = async (request, tenant) => {
+        if (tenant.status !== "active")
+            return { kind: "refused", status: 403 };
+        for (const adapter of adapters) {
+            const result = await adapter.authenticate(request, tenant);
+            if (result.kind === "pass")
+                continue;
+            if (result.kind === "refused")
+                return result;
+            const principal = result.kind === "identity"
+                ? await member(tenant.id, result.identity)
+                : result.principal;
+            if (principal === null)
+                return { kind: "refused", status: 403 };
+            const outcome = await policy?.({ tenant, principal, request });
+            if (outcome?.kind === "refuse")
+                return { kind: "refused", status: 429, retryAfter: outcome.retryAfter };
+            const status = await registry.status(tenant.id);
+            if (status === null || status === "deleting")
+                return { kind: "refused", status: 404 };
+            if (status !== "active")
+                return { kind: "refused", status: 403 };
+            return { kind: "admitted", tenant, principal };
+        }
+        return { kind: "refused", status: 401 };
+    };
+    const authenticate = async (request, selected) => {
+        const tenant = await resolve(request);
+        return tenant?.id === selected.id
+            ? admit(request, tenant)
+            : { kind: "refused", status: 404 };
+    };
+    const middleware = (options = {}) => async (context, next) => {
+        const request = context.req.raw;
+        const tenant = await resolve(request);
+        const admission = tenant === null
+            ? { kind: "refused", status: 404 }
+            : await admit(request, tenant);
+        if (admission.kind === "refused") {
+            if (admission.retryAfter !== undefined)
+                context.header("Retry-After", String(admission.retryAfter));
+            const messages = {
+                401: "unauthorized",
+                403: "forbidden",
+                404: "not_found",
+                429: "rate_limited",
+            };
+            return context.json({ error: messages[admission.status] }, admission.status);
+        }
+        const { principal } = admission;
+        if (options.role !== undefined &&
+            (principal.actor.kind !== "member" ||
+                !("role" in principal) ||
+                (options.role === "owner" && principal.role !== "owner")))
+            return context.json({ error: "forbidden" }, 403);
+        context.set("tenant", admission.tenant);
+        context.set("principal", principal);
+        return next();
+    };
+    const readonly = {
+        resolve,
+        member,
+        memberById,
+        authenticate,
+        middleware,
+    };
+    const api = config.resolve.kind === "origin"
+        ? { ...readonly, oyster: () => createOysterTenancy(readonly) }
+        : readonly;
+    if (!managed(registry))
+        return api;
+    const hooks = { ...config.on };
+    const deleting = new Map();
+    return {
+        ...api,
+        async create(input) {
+            const tenant = await registry.create(input);
+            await hooks["tenant.created"]?.({ tenant });
+            return tenant;
+        },
+        delete(id) {
+            const existing = deleting.get(id);
+            if (existing !== undefined)
+                return existing;
+            const pending = Promise.resolve()
+                .then(async () => {
+                const tenant = await registry.get(id);
+                if (tenant === null)
+                    return;
+                await registry.setStatus(id, "deleting");
+                await hooks["tenant.deleting"]?.({
+                    tenant: { ...tenant, status: "deleting" },
+                    scope: tenantScope(tenant.id, tenant.origin),
+                });
+                await registry.delete(id);
+            })
+                .finally(() => {
+                deleting.delete(id);
+            });
+            deleting.set(id, pending);
+            return pending;
+        },
+    };
+}

package/dist/tenancy/owner-key.d.ts

@@ -0,0 +1,26 @@
+import type { TenantId } from "../tenant.js";
+import type { AuthAdapter, ReadonlyTenantRegistry, ReadonlyTenancy } from "./contracts.js";
+/** Stored owner verification material for one selected tenant. */
+export type OwnerKeyRecord = Readonly<{
+    /** The host-held owner secret, verified only by Oyster's auth helper. */
+    key: string;
+    /** Explicit canonical member identity stored by the host. */
+    memberId: string;
+}>;
+/** Live owner authority and host-held verification material. */
+export type OwnerKeyOptions = Readonly<{
+    /** Current tenant owner authority, re-read after credential verification. */
+    registry: Pick<ReadonlyTenantRegistry, "get">;
+    /** Host-owned tenant key lookup; never Oyster's named Agent-key store. */
+    keys: Readonly<{
+        /** Current verification material, or null when no owner key is configured. */
+        get(tenantId: TenantId): Promise<OwnerKeyRecord | null>;
+    }>;
+    /** Optional relative POST /login route, explicitly mounted by the host. */
+    login?: Readonly<{
+        /** Resolve the tenant through the kit, not from form/body data. */
+        resolveTenant: ReadonlyTenancy["resolve"];
+    }>;
+}>;
+/** Reuse Oyster verification and admit only a current, explicitly stored owner. */
+export declare function ownerKey(options: OwnerKeyOptions): AuthAdapter;

package/dist/tenancy/owner-key.js

@@ -0,0 +1,63 @@
+import { ownerKeyAuth, ownerKeyCookieName } from "../auth.js";
+import { Hono } from "hono";
+import { parse } from "hono/utils/cookie";
+/** Reuse Oyster verification and admit only a current, explicitly stored owner. */
+export function ownerKey(options) {
+    const currentOwner = async (tenant, memberId) => {
+        const current = await options.registry.get(tenant.id);
+        return (current !== null &&
+            current.status === "active" &&
+            current.owners.includes(memberId));
+    };
+    const routes = new Hono();
+    const login = options.login;
+    if (login !== undefined)
+        routes.post("/login", async (context) => {
+            const tenant = await login.resolveTenant(context.req.raw);
+            if (tenant === null)
+                return context.json({ error: "not_found" }, 404);
+            const record = await options.keys.get(tenant.id);
+            if (record === null)
+                return context.json({ error: "unauthorized" }, 401);
+            const helper = ownerKeyAuth(record.key, record.memberId);
+            if (helper.login === undefined)
+                throw new Error("Oyster owner authentication has no login handler");
+            const response = await helper.login(context.req.raw);
+            if (response.status !== 303)
+                return response;
+            if (!(await currentOwner(tenant, record.memberId)))
+                return context.json({ error: "forbidden" }, 403);
+            response.headers.set("Cache-Control", "no-store");
+            return response;
+        });
+    const adapter = {
+        id: "owner-key",
+        async authenticate(request, tenant) {
+            const cookies = parse(request.headers.get("Cookie") ?? "");
+            const recognizedCookie = Object.hasOwn(cookies, ownerKeyCookieName);
+            const bearer = request.headers.get("Authorization")?.startsWith("Bearer ") === true;
+            if (!recognizedCookie && !bearer)
+                return { kind: "pass" };
+            const record = await options.keys.get(tenant.id);
+            if (record === null)
+                return recognizedCookie
+                    ? { kind: "refused", status: 401 }
+                    : { kind: "pass" };
+            const result = await ownerKeyAuth(record.key, record.memberId).authenticate(request);
+            if (result.kind === "refused")
+                return recognizedCookie
+                    ? { kind: "refused", status: 401 }
+                    : { kind: "pass" };
+            if (!(await currentOwner(tenant, record.memberId)))
+                return { kind: "refused", status: 403 };
+            return {
+                kind: "principal",
+                principal: {
+                    actor: { kind: "member", memberId: record.memberId },
+                    role: "owner",
+                },
+            };
+        },
+    };
+    return login === undefined ? adapter : { ...adapter, routes };
+}

package/dist/tenancy/oyster.d.ts

@@ -0,0 +1,4 @@
+import { type OysterTenancy } from "../tenant.js";
+import type { ReadonlyTenancy } from "./contracts.js";
+/** Bind the kit's live registry/auth admission to the canonical Oyster port. */
+export declare function createOysterTenancy(tenancy: Pick<ReadonlyTenancy, "resolve" | "authenticate" | "memberById">): OysterTenancy;

package/dist/tenancy/oyster.js

@@ -0,0 +1,25 @@
+import { tenantScope } from "../tenant.js";
+/** Bind the kit's live registry/auth admission to the canonical Oyster port. */
+export function createOysterTenancy(tenancy) {
+    return {
+        async resolve(request) {
+            const tenant = await tenancy.resolve(request);
+            if (tenant === null)
+                return null;
+            return {
+                scope: tenantScope(tenant.id, tenant.origin),
+                auth: {
+                    resolve: (actor) => actor.kind === "member"
+                        ? tenancy.memberById(tenant.id, actor.memberId)
+                        : Promise.resolve(null),
+                    authenticate: async (incoming) => {
+                        const result = await tenancy.authenticate(incoming, tenant);
+                        return result.kind === "admitted"
+                            ? { kind: "admitted", principal: result.principal }
+                            : result;
+                    },
+                },
+            };
+        },
+    };
+}

package/dist/tenancy/registry-record.d.ts

@@ -0,0 +1,7 @@
+import * as Schema from "effect/Schema";
+import type { Tenant } from "./contracts.js";
+export declare function checkedOrigin(origin: string, domains: readonly string[]): string;
+export declare function immutable(tenant: Tenant): Tenant;
+export declare function createMemberId(): string;
+/** Stored membership authority revisions are positive safe integers. */
+export declare const membershipVersionSchema: Schema.Number;

package/dist/tenancy/registry-record.js

@@ -0,0 +1,44 @@
+import * as Schema from "effect/Schema";
+import { defineIdFamily } from "@fungi.computer/cairn/id";
+const identityIds = defineIdFamily({
+    family: "tenancy-member",
+    version: 1,
+    kinds: { member: { prefix: "tenant_member" } },
+});
+export function checkedOrigin(origin, domains) {
+    const url = new URL(origin);
+    if (url.protocol !== "https:" ||
+        url.username ||
+        url.password ||
+        url.pathname !== "/" ||
+        url.search ||
+        url.hash ||
+        !domains.includes(url.host))
+        throw new TypeError("Tenant origin must be HTTPS and match a declared domain, without credentials or a path");
+    for (const domain of domains) {
+        const parsed = new URL(`https://${domain}`);
+        if (parsed.host !== domain ||
+            parsed.pathname !== "/" ||
+            parsed.search ||
+            parsed.hash ||
+            parsed.username ||
+            parsed.password)
+            throw new TypeError("Tenant domains must be canonical hostnames");
+    }
+    return url.origin;
+}
+export function immutable(tenant) {
+    return Object.freeze({
+        id: tenant.id,
+        handle: tenant.handle,
+        origin: tenant.origin,
+        status: tenant.status,
+        owners: Object.freeze([...tenant.owners]),
+        domains: Object.freeze([...tenant.domains]),
+    });
+}
+export function createMemberId() {
+    return identityIds.member.generate();
+}
+/** Stored membership authority revisions are positive safe integers. */
+export const membershipVersionSchema = Schema.Number.check(Schema.isInt(), Schema.isBetween({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }));

package/dist/tenancy/registry.d.ts

@@ -0,0 +1,27 @@
+import { type TenantId } from "../tenant.js";
+import type { Identity, ManagedTenantRegistry, Membership, Tenant } from "./contracts.js";
+/** Initial live membership records for a disposable in-memory registry. */
+export type MemoryMembership = Readonly<{
+    /** Provisioned tenant whose membership is seeded. */
+    tenantId: TenantId;
+    /** External identity tuple mapped to the canonical member ID. */
+    identity: Identity;
+    /** Canonical member identity supplied by the host. */
+    memberId: string;
+    /** Live tenant role for this canonical member. */
+    role: Membership["role"];
+}>;
+/** Provisioned records and canonical member mappings owned by the host. */
+export type MemoryRegistryOptions = Readonly<{
+    /** Initial validated provisioned records. */
+    tenants?: readonly Tenant[];
+    /** Initial identity-to-member mappings and roles. */
+    memberships?: readonly MemoryMembership[];
+}>;
+/** The memory adapter always supplies the optional custom-domain index. */
+export type MemoryRegistry = ManagedTenantRegistry & Readonly<{
+    /** Look up a registered canonical host. */
+    byDomain(host: string): Promise<Tenant | null>;
+}>;
+/** In-memory tenant and member owner; create updates both atomically. */
+export declare function memoryRegistry(options?: MemoryRegistryOptions): MemoryRegistry;