@zudojs/tenancy 1.1.0 → 1.2.1

package/README.md

@@ -2,6 +2,12 @@
 
 Multi-tenant context and isolation: tenant resolution, context propagation, resolver chains, and guard middleware.
 
+<!-- zudo-docs:start -->
+
+**Documentation:** [zudojs.oyinlola.site/docs/packages-tenancy](https://zudojs.oyinlola.site/docs/packages-tenancy) · **For AI agents:** [Markdown version](https://zudojs.oyinlola.site/docs/packages-tenancy.md), [llms.txt](https://zudojs.oyinlola.site/llms.txt)
+
+<!-- zudo-docs:end -->
+
 ## Installation
 
 ```bash
@@ -12,32 +18,43 @@ npm install @zudojs/tenancy
 
 ```typescript
 import {
+  createDomainResolver,
   createJwtResolver,
   createMemoryTenantRepository,
   createResolveTenantMiddleware,
   createResolverChain,
   createSubdomainResolver,
   createTenantContextStorage,
+  createTenantId,
 } from "@zudojs/tenancy";
 
 const storage = createTenantContextStorage();
 const repository = createMemoryTenantRepository();
+repository.add(
+  { id: createTenantId("t-1001"), name: "Acme", slug: "acme", status: "active", metadata: {} },
+  ["acme.io"], // custom domain
+);
 
 const resolver = createResolverChain([
   createJwtResolver(), // priority 100, trusted
+  createDomainResolver({ repository }), // priority 75: acme.io → t-1001
   createSubdomainResolver({ baseDomain: "example.com" }), // priority 70
 ]);
 
-// Resolves the tenant, enforces its status and the route's trust floor,
-// then runs the rest of the request inside the tenant context.
+// Resolves the tenant, enforces its status and the route's trust floor
+// (default "verified"), then runs the rest of the request inside the tenant
+// context. acme.example.com reaches t-1001 through its slug.
 const middleware = createResolveTenantMiddleware({
   resolver: resolver.asResolver(),
   repository,
   storage,
-  minimumTrust: "verified",
 });
 ```
 
+The middleware runs inside the real `@zudojs/http` pipeline without
+depending on it: headers are read through `request.getHeader()` when present,
+and otherwise from a plain object or a `Map`, case-insensitively.
+
 Read the current tenant anywhere downstream:
 
 ```typescript
@@ -55,13 +72,17 @@ const tenant = context.requireCurrentTenant();
 | `subdomain`, `domain` | `verified`    | host-derived                |
 | `header`, `path`      | `untrusted`   | client-supplied on the wire |
 
-`x-tenant-id` is untrusted by default. Raise it with
-`createHeaderResolver({ trust: "verified" })` only where a trusted proxy
-strips and re-sets the header at the edge.
+`createResolveTenantMiddleware` requires `verified` trust by default, so a
+tenant named only by `x-tenant-id` or a URL path is refused (403) — otherwise
+an unauthenticated client picks the tenant its request runs in. Raise the
+header with `createHeaderResolver({ trust: "verified" })` only where a trusted
+proxy strips and re-sets it at the edge, or pass `minimumTrust: "untrusted"`
+explicitly on routes where something else ties the tenant to the principal.
 
 ## Features
 
-- Tenant resolution from JWT claims, subdomain, custom domain, header, or path
+- Tenant resolution from JWT claims, subdomain (by id or slug), custom domain
+  (`createDomainResolver`), header, or path
 - Resolver chains with trust grading and conflict detection
 - AsyncLocalStorage context propagation
 - Tenant repository with slug and custom-domain indexes
@@ -73,12 +94,22 @@ strips and re-sets the header at the edge.
   returning `undefined` means "found nothing" and advances to the next
   resolver — so a failed JWT verification can never fall through to a
   client-supplied header.
-- Resolvers disagreeing about the tenant throws by default.
+- Conflict detection is **opt-in**: by default a chain stops at the first
+  resolver that finds a tenant (highest priority wins) and does not look at
+  the others. Pass `createResolverChain(resolvers, { detectConflicts: true })`
+  to run them all and throw `TenantResolutionConflictError` when they
+  disagree; the middleware answers that with 403.
 - Tenant ids are normalized (NFKC, trimmed, lowercased) and constrained to
   `^[a-z0-9][a-z0-9_-]*$`, so an id cannot forge a separator in a cache key,
   a schema name, or a path. `tenantKey` escapes its segments as well.
 - Non-active tenants are refused during resolution. Pass `allowInactive` on
   routes that exist to serve suspended tenants.
+- An unknown tenant and a non-active one get the same `404 Tenant not found`,
+  and the guard middleware answers `403 Tenant is not available` without the
+  id or status, so a caller cannot enumerate tenants or learn which are
+  suspended.
+- A subdomain or path value is looked up by id first, then by slug
+  (`repository.findBySlug`); pass `slugLookup: false` to turn that off.
 - A request that resolves to no tenant at all is answered `404`. Pass
   `optional: true` to `createResolveTenantMiddleware` on routes where a tenant
   may be absent; a tenant that _was_ named but is unknown, untrusted or

package/dist/http/httpResolverContext.js

@@ -8,6 +8,7 @@
  *
  * @module http/httpResolverContext
  */
+import { readRequestHeader } from "./httpSupport/index.js";
 /** State key under which upstream auth middleware publishes token claims. */
 export const TENANT_CLAIMS_STATE_KEY = "tenancy:claims";
 /**
@@ -22,10 +23,10 @@ export const TENANT_CLAIMS_STATE_KEY = "tenancy:claims";
 export function createHttpResolverContext(context, getClaims) {
     return {
         getHeader(name) {
-            return context.request.headers.get(name.toLowerCase());
+            return readRequestHeader(context.request, name);
         },
         getHost() {
-            return context.request.headers.get("host");
+            return readRequestHeader(context.request, "host");
         },
         getPath() {
             return context.request.path;

package/dist/http/httpSupport/httpRequest.helper.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Portable reads from an HTTP request's headers.
+ *
+ * @module http/httpRequest.helper
+ */
+import type { HttpRequestContext } from "../httpTypes.js";
+/**
+ * Read a request header, whatever shape the request carries.
+ *
+ * The real `@zudojs/http` request exposes `headers` as a frozen plain object
+ * and a `getHeader(name)` accessor; the local mirror used to type `headers`
+ * as a `ReadonlyMap` and call `.get()`, which threw on every real request.
+ * `getHeader` is preferred when present, then a `Map`/`Headers`-like `get`,
+ * then a plain object — each case-insensitive.
+ */
+export declare function readRequestHeader(request: HttpRequestContext, name: string): string | undefined;
+//# sourceMappingURL=httpRequest.helper.d.ts.map

package/dist/http/httpSupport/httpRequest.helper.js

@@ -0,0 +1,48 @@
+/**
+ * Portable reads from an HTTP request's headers.
+ *
+ * @module http/httpRequest.helper
+ */
+/** Read one entry from a map-shaped or record-shaped bag, case-insensitively. */
+function readBag(bag, name) {
+    if (!bag)
+        return undefined;
+    const lower = name.toLowerCase();
+    if (typeof bag.get === "function") {
+        const map = bag;
+        const direct = map.get(lower) ?? map.get(name);
+        if (direct !== undefined)
+            return direct;
+        for (const [key, value] of map) {
+            if (key.toLowerCase() === lower)
+                return value;
+        }
+        return undefined;
+    }
+    const record = bag;
+    if (Object.hasOwn(record, lower))
+        return record[lower];
+    for (const key of Object.keys(record)) {
+        if (key.toLowerCase() === lower)
+            return record[key];
+    }
+    return undefined;
+}
+/**
+ * Read a request header, whatever shape the request carries.
+ *
+ * The real `@zudojs/http` request exposes `headers` as a frozen plain object
+ * and a `getHeader(name)` accessor; the local mirror used to type `headers`
+ * as a `ReadonlyMap` and call `.get()`, which threw on every real request.
+ * `getHeader` is preferred when present, then a `Map`/`Headers`-like `get`,
+ * then a plain object — each case-insensitive.
+ */
+export function readRequestHeader(request, name) {
+    if (typeof request.getHeader === "function") {
+        const value = request.getHeader(name);
+        if (value !== undefined)
+            return value;
+    }
+    return readBag(request.headers, name);
+}
+//# sourceMappingURL=httpRequest.helper.js.map

package/dist/http/httpSupport/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Support for the tenancy HTTP middleware: portable header reads, and loading
+ * the tenant a resolution names (by id, then by slug).
+ *
+ * @module http/httpSupport
+ */
+export { readRequestHeader } from "./httpRequest.helper.js";
+export { loadResolvedTenant } from "./tenancyMiddleware.lookup.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/http/httpSupport/index.js

@@ -0,0 +1,9 @@
+/**
+ * Support for the tenancy HTTP middleware: portable header reads, and loading
+ * the tenant a resolution names (by id, then by slug).
+ *
+ * @module http/httpSupport
+ */
+export { readRequestHeader } from "./httpRequest.helper.js";
+export { loadResolvedTenant } from "./tenancyMiddleware.lookup.js";
+//# sourceMappingURL=index.js.map

package/dist/http/httpSupport/tenancyMiddleware.lookup.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Loading the tenant a resolution names.
+ *
+ * @module http/tenancyMiddleware.lookup
+ */
+import type { Tenant } from "../../tenancyTypes/tenantInterface.js";
+import type { TenantResolution } from "../../tenancyTypes/resolverTypes.js";
+import type { TenantRepository } from "../../tenancyTypes/repositoryTypes.js";
+/**
+ * Load the tenant for a resolution.
+ *
+ * A subdomain or path segment names a tenant by its slug as often as by its
+ * id — `acme.example.com` for the tenant whose id is `t-1001`. The id is
+ * tried first; for those two sources the repository's `findBySlug` is the
+ * fallback, when it has one and `slugLookup` is not `false`. Without it,
+ * every tenant whose id differs from its slug was unreachable.
+ */
+export declare function loadResolvedTenant(repository: TenantRepository, resolution: TenantResolution, slugLookup: boolean): Promise<Tenant | undefined>;
+//# sourceMappingURL=tenancyMiddleware.lookup.d.ts.map

package/dist/http/httpSupport/tenancyMiddleware.lookup.js

@@ -0,0 +1,25 @@
+/**
+ * Loading the tenant a resolution names.
+ *
+ * @module http/tenancyMiddleware.lookup
+ */
+/** Sources whose value is a human-facing name, not necessarily the id. */
+const SLUG_SOURCES = new Set(["subdomain", "path"]);
+/**
+ * Load the tenant for a resolution.
+ *
+ * A subdomain or path segment names a tenant by its slug as often as by its
+ * id — `acme.example.com` for the tenant whose id is `t-1001`. The id is
+ * tried first; for those two sources the repository's `findBySlug` is the
+ * fallback, when it has one and `slugLookup` is not `false`. Without it,
+ * every tenant whose id differs from its slug was unreachable.
+ */
+export async function loadResolvedTenant(repository, resolution, slugLookup) {
+    const byId = await repository.findById(resolution.tenantId);
+    if (byId)
+        return byId;
+    if (!slugLookup || !SLUG_SOURCES.has(resolution.source))
+        return undefined;
+    return repository.findBySlug?.(resolution.tenantId);
+}
+//# sourceMappingURL=tenancyMiddleware.lookup.js.map

package/dist/http/httpTypes.d.ts

@@ -1,7 +1,9 @@
 /**
  * Local HTTP type definitions for the middleware adapter.
  *
- * Mirrors @zudojs/http types to avoid hard dependency.
+ * Mirrors @zudojs/http types structurally. http sits in a higher architecture
+ * tier, so tenancy may not depend on it, even as a peer. A test runs the
+ * middleware inside the real `HttpMiddlewarePipeline` to keep the two in step.
  *
  * @module http/httpTypes
  */
@@ -15,20 +17,32 @@ export interface HttpMiddlewareContext {
     readonly signal: AbortSignal;
     readonly metadata: Readonly<Record<string, unknown>>;
 }
+/**
+ * A request's headers, params or query in either shape a caller may hold.
+ *
+ * The real `@zudojs/http` request exposes plain frozen objects
+ * (`Readonly<Record<…>>`). This mirror used to say `ReadonlyMap`, so the
+ * middleware called `.get()` on an object that has none and threw on every
+ * real request. Both shapes are accepted; read headers through
+ * `readRequestHeader`.
+ */
+export type HttpRequestBag<V> = ReadonlyMap<string, V> | Readonly<Record<string, V | undefined>>;
 /** HTTP request context from @zudojs/http. */
 export interface HttpRequestContext {
-    readonly id: string;
-    readonly method: string;
-    readonly url: string;
+    readonly id?: string;
+    readonly method?: string;
+    readonly url?: string;
     readonly path: string;
-    readonly headers: ReadonlyMap<string, string>;
-    readonly params: ReadonlyMap<string, string>;
-    readonly query: ReadonlyMap<string, string | readonly string[] | undefined>;
+    readonly headers: HttpRequestBag<string>;
+    readonly params?: HttpRequestBag<string>;
+    readonly query?: HttpRequestBag<string | readonly string[]>;
+    /** Case-insensitive header lookup, as `@zudojs/http` provides it. */
+    getHeader?(name: string): string | undefined;
 }
 /** HTTP response context from @zudojs/http. */
 export interface HttpResponseContext {
     readonly status: number;
-    readonly headers: Headers | Record<string, string>;
+    readonly headers: Headers | Readonly<Record<string, string | readonly string[] | undefined>>;
     readonly body?: unknown;
 }
 /** HTTP middleware state from @zudojs/http. */

package/dist/http/httpTypes.js

@@ -1,7 +1,9 @@
 /**
  * Local HTTP type definitions for the middleware adapter.
  *
- * Mirrors @zudojs/http types to avoid hard dependency.
+ * Mirrors @zudojs/http types structurally. http sits in a higher architecture
+ * tier, so tenancy may not depend on it, even as a peer. A test runs the
+ * middleware inside the real `HttpMiddlewarePipeline` to keep the two in step.
  *
  * @module http/httpTypes
  */

package/dist/http/index.d.ts

@@ -7,6 +7,7 @@ export { createTenantGuardMiddleware, createTenantPropagationMiddleware, } from
 export type { TenantGuardMiddlewareOptions } from "./tenancyMiddleware.guard.js";
 export { TENANT_CLAIMS_STATE_KEY, createHttpResolverContext, } from "./httpResolverContext.js";
 export type { HttpResolverContext, TenantClaims, } from "./httpResolverContext.js";
+export { readRequestHeader } from "./httpSupport/index.js";
 export { createBadRequest, createForbidden, createJsonErrorResponse, createNotFound, createUnauthorized, } from "./httpHelpers.js";
 export type * from "./httpTypes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/http/index.js

@@ -4,5 +4,6 @@
 export { TENANT_CONTEXT_STATE_KEY, TENANT_STATE_KEY, createRequireTenantMiddleware, createResolveTenantMiddleware, } from "./tenancyMiddleware.core.js";
 export { createTenantGuardMiddleware, createTenantPropagationMiddleware, } from "./tenancyMiddleware.guard.js";
 export { TENANT_CLAIMS_STATE_KEY, createHttpResolverContext, } from "./httpResolverContext.js";
+export { readRequestHeader } from "./httpSupport/index.js";
 export { createBadRequest, createForbidden, createJsonErrorResponse, createNotFound, createUnauthorized, } from "./httpHelpers.js";
 //# sourceMappingURL=index.js.map

package/dist/http/tenancyMiddleware.core.d.ts

@@ -5,7 +5,7 @@
  *
  * @module http/tenancyMiddleware
  *
- * Requires @zudojs/http as a peer dependency.
+ * Composes with the @zudojs/http pipeline structurally; no dependency on it.
  */
 import type { Tenant, TenantRequirement, TenantTrustLevel } from "../tenancyTypes/tenantInterface.js";
 import type { TenantResolver, TenantResolution } from "../tenancyTypes/resolverTypes.js";
@@ -26,12 +26,20 @@ export interface ResolveTenantMiddlewareOptions {
     /** Tenant context storage for propagation. */
     readonly storage: TenantContextStorage;
     /**
-     * Minimum trust the resolution must carry. Defaults to `untrusted`.
+     * Minimum trust the resolution must carry. Defaults to `verified`.
      *
-     * Set this on any route where a tenant resolved from a URL path or an
-     * unverified header must not be honoured.
+     * A tenant resolved from a client-supplied header or a URL path is
+     * `untrusted`, so by default it is refused (403): the client would be
+     * choosing which tenant's context its request runs in. Pass
+     * `minimumTrust: "untrusted"` to opt down explicitly, only on routes where
+     * something else ties the tenant to the principal.
      */
     readonly minimumTrust?: TenantTrustLevel;
+    /**
+     * Fall back to `repository.findBySlug` when a subdomain or path resolution
+     * names no tenant by id. Default: `true`.
+     */
+    readonly slugLookup?: boolean;
     /**
      * Whether a non-active tenant may proceed. Defaults to false.
      *

package/dist/http/tenancyMiddleware.core.js

@@ -5,11 +5,12 @@
  *
  * @module http/tenancyMiddleware
  *
- * Requires @zudojs/http as a peer dependency.
+ * Composes with the @zudojs/http pipeline structurally; no dependency on it.
  */
 import { createHttpResolverContext } from "./httpResolverContext.js";
 import { createBadRequest, createForbidden, createNotFound, createUnauthorized, } from "./httpHelpers.js";
 import { meetsTrustLevel } from "../security/guard.core.js";
+import { loadResolvedTenant } from "./httpSupport/index.js";
 import { TenantResolutionConflictError, TenantResolutionError, } from "../tenancyErrors/tenancyError.types.js";
 // ─── State Keys ───────────────────────────────────────────────────────────
 /** State key for the resolved tenant. */
@@ -25,7 +26,17 @@ export const TENANT_CONTEXT_STATE_KEY = "tenancy:context";
  * middleware being installed: the safe behaviour has to be the default.
  */
 export function createResolveTenantMiddleware(options) {
-    const minimumTrust = options.minimumTrust ?? "untrusted";
+    const minimumTrust = options.minimumTrust ?? "verified";
+    const slugLookup = options.slugLookup !== false;
+    // Unknown and unavailable tenants get the same answer, so a caller cannot
+    // learn which tenant ids exist or which of them are suspended.
+    const notFound = (resolution) => options.notFoundResponse
+        ? {
+            status: 404,
+            body: options.notFoundResponse(resolution),
+            headers: { "content-type": "application/json" },
+        }
+        : createNotFound("Tenant not found");
     return async (context, next) => {
         let resolution;
         try {
@@ -47,29 +58,14 @@ export function createResolveTenantMiddleware(options) {
         if (!resolution) {
             if (options.optional)
                 return next();
-            return options.notFoundResponse
-                ? {
-                    status: 404,
-                    body: options.notFoundResponse(resolution),
-                    headers: { "content-type": "application/json" },
-                }
-                : createNotFound("Tenant not found");
+            return notFound(resolution);
         }
         if (!meetsTrustLevel(resolution.trust, minimumTrust)) {
             return createForbidden("Tenant could not be established for this route");
         }
-        const tenant = await options.repository.findById(resolution.tenantId);
-        if (!tenant) {
-            return options.notFoundResponse
-                ? {
-                    status: 404,
-                    body: options.notFoundResponse(resolution),
-                    headers: { "content-type": "application/json" },
-                }
-                : createNotFound("Tenant not found");
-        }
-        if (!options.allowInactive && tenant.status !== "active") {
-            return createForbidden("Tenant is not available");
+        const tenant = await loadResolvedTenant(options.repository, resolution, slugLookup);
+        if (!tenant || (!options.allowInactive && tenant.status !== "active")) {
+            return notFound(resolution);
         }
         const tenantContext = {
             tenantId: tenant.id,

package/dist/http/tenancyMiddleware.guard.js

@@ -21,11 +21,10 @@ export function createTenantGuardMiddleware(options = {}) {
         const current = options.repository
             ? await options.repository.findById(tenant.id)
             : tenant;
-        if (!current) {
-            return createForbidden(`Tenant "${tenant.id}" is no longer available`);
-        }
-        if (current.status !== "active") {
-            return createForbidden(`Tenant "${current.id}" is not available (status: ${current.status})`);
+        // One answer for "gone" and "not active", naming neither the tenant nor
+        // its status: the body goes to the client, which must not learn either.
+        if (!current || current.status !== "active") {
+            return createForbidden("Tenant is not available");
         }
         return next();
     };

package/dist/resolver/resolvers/domainResolver.core.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Custom-domain tenant resolver.
+ *
+ * @module resolvers/domainResolver
+ */
+import type { TenantResolver } from "../../tenancyTypes/resolverTypes.js";
+import type { TenantId } from "../../tenancyTypes/tenantIdentity.js";
+import type { Tenant } from "../../tenancyTypes/tenantInterface.js";
+/** Context type with a getHost method. */
+export interface DomainContext {
+    getHost(): string | undefined;
+}
+/** Where a domain is looked up. Supply one of the two. */
+export interface DomainResolverOptions {
+    /** A registry from `createDomainRegistry()`, or anything shaped like it. */
+    readonly registry?: {
+        resolve(domain: string): TenantId | undefined;
+    };
+    /** A repository with `findByDomain`, e.g. `createMemoryTenantRepository()`. */
+    readonly repository?: {
+        findByDomain?(domain: string): Promise<Tenant | undefined>;
+    };
+    /** Defaults to 75, between the header (80) and subdomain (70) resolvers. */
+    readonly priority?: number;
+}
+/**
+ * Create a tenant resolver that maps the request's host to a tenant through
+ * a registered custom domain.
+ *
+ * Example: `acme.io` registered to tenant `t-1001` → tenant `t-1001`, source
+ * `domain`, trust `verified`. A host nobody registered resolves to nothing,
+ * so the chain moves on.
+ */
+export declare function createDomainResolver(options: DomainResolverOptions): TenantResolver<DomainContext>;
+//# sourceMappingURL=domainResolver.core.d.ts.map

package/dist/resolver/resolvers/domainResolver.core.js

@@ -0,0 +1,33 @@
+/**
+ * Custom-domain tenant resolver.
+ *
+ * @module resolvers/domainResolver
+ */
+import { hostnameOf } from "./subdomainResolver.core.js";
+/**
+ * Create a tenant resolver that maps the request's host to a tenant through
+ * a registered custom domain.
+ *
+ * Example: `acme.io` registered to tenant `t-1001` → tenant `t-1001`, source
+ * `domain`, trust `verified`. A host nobody registered resolves to nothing,
+ * so the chain moves on.
+ */
+export function createDomainResolver(options) {
+    const priority = options.priority ?? 75;
+    return {
+        name: "domain",
+        priority,
+        async resolve(context) {
+            const host = context.getHost();
+            const hostname = host ? hostnameOf(host)?.toLowerCase() : undefined;
+            if (!hostname)
+                return undefined;
+            const tenantId = options.registry?.resolve(hostname) ??
+                (await options.repository?.findByDomain?.(hostname))?.id;
+            if (!tenantId)
+                return undefined;
+            return { tenantId, source: "domain", trust: "verified" };
+        },
+    };
+}
+//# sourceMappingURL=domainResolver.core.js.map

package/dist/resolver/resolvers/index.d.ts

@@ -7,6 +7,8 @@ export { createHeaderResolver } from "./headerResolver.core.js";
 export type { HeaderContext, HeaderResolverOptions, } from "./headerResolver.core.js";
 export { createSubdomainResolver } from "./subdomainResolver.core.js";
 export type { SubdomainContext, SubdomainResolverOptions, } from "./subdomainResolver.core.js";
+export { createDomainResolver } from "./domainResolver.core.js";
+export type { DomainContext, DomainResolverOptions, } from "./domainResolver.core.js";
 export { createPathResolver } from "./pathResolver.core.js";
 export type { PathContext, PathResolverOptions } from "./pathResolver.core.js";
 export { createJwtResolver } from "./jwtResolver.core.js";

package/dist/resolver/resolvers/index.js

@@ -5,6 +5,7 @@
  */
 export { createHeaderResolver } from "./headerResolver.core.js";
 export { createSubdomainResolver } from "./subdomainResolver.core.js";
+export { createDomainResolver } from "./domainResolver.core.js";
 export { createPathResolver } from "./pathResolver.core.js";
 export { createJwtResolver } from "./jwtResolver.core.js";
 //# sourceMappingURL=index.js.map

package/dist/resolver/resolvers/subdomainResolver.core.d.ts

@@ -24,6 +24,12 @@ export interface SubdomainResolverOptions {
      */
     readonly allowMultiLabel?: boolean;
 }
+/**
+ * Strip the port from an authority, handling bracketed IPv6 literals.
+ *
+ * Shared with the domain resolver; not part of the public API.
+ */
+export declare function hostnameOf(host: string): string | undefined;
 /**
  * Create a tenant resolver that extracts tenant from subdomain.
  *

package/dist/resolver/resolvers/subdomainResolver.core.js

@@ -6,8 +6,10 @@
 import { tryCreateTenantId } from "../../tenancyTypes/tenantIdentity.js";
 /**
  * Strip the port from an authority, handling bracketed IPv6 literals.
+ *
+ * Shared with the domain resolver; not part of the public API.
  */
-function hostnameOf(host) {
+export function hostnameOf(host) {
     const trimmed = host.trim();
     if (trimmed.length === 0)
         return undefined;

package/dist/tenancyTypes/index.d.ts

@@ -3,7 +3,7 @@
  *
  * @module tenancyTypes
  */
-export { type TenantId, MAX_TENANT_ID_LENGTH, createTenantId, tryCreateTenantId, isValidTenantId, type TenantStatus, } from "./tenantIdentity.js";
+export { type TenantId, MAX_TENANT_ID_LENGTH, TENANT_ID_PATTERN, createTenantId, tryCreateTenantId, isValidTenantId, type TenantStatus, } from "./tenantIdentity.js";
 export { type Tenant, type TenantResolutionSource, type TenantTrustLevel, type TenantContext, type SystemContext, type TenantExecutionContext, type ExecutionTenantContext, type TenantRequirement, type TenantResource, } from "./tenantInterface.js";
 export { type TenantResolution, type TenantResolutionResult, type TenantResolver, type ResolverChainOptions, } from "./resolverTypes.js";
 export { type TenantRepository, type TenantCache, } from "./repositoryTypes.js";

package/dist/tenancyTypes/index.js

@@ -3,7 +3,7 @@
  *
  * @module tenancyTypes
  */
-export { MAX_TENANT_ID_LENGTH, createTenantId, tryCreateTenantId, isValidTenantId, } from "./tenantIdentity.js";
+export { MAX_TENANT_ID_LENGTH, TENANT_ID_PATTERN, createTenantId, tryCreateTenantId, isValidTenantId, } from "./tenantIdentity.js";
 export {} from "./tenantInterface.js";
 export {} from "./resolverTypes.js";
 export {} from "./repositoryTypes.js";

package/dist/tenancyTypes/tenantIdentity.d.ts

@@ -3,19 +3,31 @@
  *
  * @module tenancyTypes/tenantIdentity
  */
-/** Branded tenant ID type. */
-declare const TenantIdBrand: unique symbol;
-/** A unique, validated tenant identifier. */
-export type TenantId = string & {
-    readonly [TenantIdBrand]: true;
-};
-/** Maximum accepted tenant id length. */
-export declare const MAX_TENANT_ID_LENGTH = 64;
+import { MAX_TENANT_ID_LENGTH, TENANT_ID_PATTERN, type TenantId } from "@zudojs/constants";
+/**
+ * A tenant identifier.
+ *
+ * Owned by `@zudojs/constants` and re-exported here, so the monorepo has one
+ * branded `TenantId`: a value typed by either package is accepted by both.
+ * Tenancy used to declare its own, incompatible brand.
+ */
+export type { TenantId };
+/**
+ * Maximum accepted tenant id length, and the allowed character pattern.
+ *
+ * Both are owned by `@zudojs/constants` and re-exported, so tenancy and
+ * constants apply one rule. A tenant id is concatenated into cache keys, log
+ * lines, schema names and file paths, so anything that could act as a
+ * separator or a path segment is rejected rather than escaped at every use.
+ */
+export { MAX_TENANT_ID_LENGTH, TENANT_ID_PATTERN };
 /**
  * Create a validated TenantId.
  *
- * Input is trimmed, Unicode-normalized and lowercased before validation, so
- * two spellings of the same identifier cannot become two tenants.
+ * Delegates to `createTenantId` in `@zudojs/constants` (NFKC-normalize,
+ * trim, lowercase, then {@link TENANT_ID_PATTERN} and
+ * {@link MAX_TENANT_ID_LENGTH}), so the two packages cannot disagree, and
+ * rethrows its rejection as this package's {@link InvalidTenantIdError}.
  *
  * @param value - The candidate identifier.
  * @returns The normalized, validated tenant id.
@@ -36,5 +48,4 @@ export declare function tryCreateTenantId(value: unknown): TenantId | undefined;
 export declare function isValidTenantId(value: unknown): value is TenantId;
 /** Tenant lifecycle status. */
 export type TenantStatus = "provisioning" | "active" | "inactive" | "suspended" | "deleting" | "deleted";
-export {};
 //# sourceMappingURL=tenantIdentity.d.ts.map

package/dist/tenancyTypes/tenantIdentity.js

@@ -3,23 +3,24 @@
  *
  * @module tenancyTypes/tenantIdentity
  */
+import { createTenantId as createConstantsTenantId, MAX_TENANT_ID_LENGTH, TENANT_ID_PATTERN, } from "@zudojs/constants";
 import { InvalidTenantIdError } from "../tenancyErrors/tenancyError.types.js";
 /**
- * Characters a tenant id may contain.
+ * Maximum accepted tenant id length, and the allowed character pattern.
  *
- * Deliberately narrow. A tenant id is concatenated into cache keys, log lines,
- * schema names and file paths, so anything that could act as a separator or a
- * path segment in one of those contexts is rejected here rather than escaped
- * at every use site.
+ * Both are owned by `@zudojs/constants` and re-exported, so tenancy and
+ * constants apply one rule. A tenant id is concatenated into cache keys, log
+ * lines, schema names and file paths, so anything that could act as a
+ * separator or a path segment is rejected rather than escaped at every use.
  */
-const TENANT_ID_PATTERN = /^[a-z0-9][a-z0-9_-]*$/u;
-/** Maximum accepted tenant id length. */
-export const MAX_TENANT_ID_LENGTH = 64;
+export { MAX_TENANT_ID_LENGTH, TENANT_ID_PATTERN };
 /**
  * Create a validated TenantId.
  *
- * Input is trimmed, Unicode-normalized and lowercased before validation, so
- * two spellings of the same identifier cannot become two tenants.
+ * Delegates to `createTenantId` in `@zudojs/constants` (NFKC-normalize,
+ * trim, lowercase, then {@link TENANT_ID_PATTERN} and
+ * {@link MAX_TENANT_ID_LENGTH}), so the two packages cannot disagree, and
+ * rethrows its rejection as this package's {@link InvalidTenantIdError}.
  *
  * @param value - The candidate identifier.
  * @returns The normalized, validated tenant id.
@@ -28,14 +29,12 @@ export const MAX_TENANT_ID_LENGTH = 64;
 export function createTenantId(value) {
     if (typeof value !== "string")
         throw new InvalidTenantIdError(String(value));
-    const normalized = value.normalize("NFKC").trim().toLowerCase();
-    if (normalized.length === 0 || normalized.length > MAX_TENANT_ID_LENGTH) {
-        throw new InvalidTenantIdError(value);
+    try {
+        return createConstantsTenantId(value);
     }
-    if (!TENANT_ID_PATTERN.test(normalized)) {
+    catch {
         throw new InvalidTenantIdError(value);
     }
-    return normalized;
 }
 /**
  * Create a validated TenantId, or undefined when the value is unusable.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/tenancy",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "description": "Multi-tenant context and isolation with tenant resolution, AsyncLocalStorage propagation, resolver chains, trust levels, and guard middleware.",
   "license": "MIT",
   "author": {
@@ -25,16 +25,8 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/errors": "1.0.1",
-    "@zudojs/constants": "1.0.1"
-  },
-  "peerDependencies": {
-    "@zudojs/http": "1.1.0"
-  },
-  "peerDependenciesMeta": {
-    "@zudojs/http": {
-      "optional": true
-    }
+    "@zudojs/errors": "1.2.0",
+    "@zudojs/constants": "1.1.1"
   },
   "engines": {
     "node": ">=24.0.0"