@zudojs/tenancy 1.2.1 → 1.3.1

package/README.md

@@ -45,15 +45,62 @@ const resolver = createResolverChain([
 // (default "verified"), then runs the rest of the request inside the tenant
 // context. acme.example.com reaches t-1001 through its slug.
 const middleware = createResolveTenantMiddleware({
-  resolver: resolver.asResolver(),
+  resolver, // a chain as it is, or a single resolver
   repository,
   storage,
 });
 ```
 
+`resolver` takes a chain directly. Before 1.3.1 it took only a single
+`TenantResolver`, so a chain had to go through `chain.asResolver()`: passing
+the chain itself was a type error, and cast through, every request was
+refused, because a chain's `resolve` returns `{ resolution, candidates,
+conflict }` rather than a resolution. The middleware now recognises a chain by
+its `asResolver` method and adapts it. `resolver.asResolver()` still works.
+
+The chain's context type is inferred from its resolvers — what the JWT,
+domain and subdomain resolvers read, which `HttpResolverContext` provides — so
+the call needs no type argument and no casts. (Before 1.3 it failed with
+TS2322 unless you wrote `createResolverChain<HttpResolverContext>`; that form
+still works.)
+
 The middleware runs inside the real `@zudojs/http` pipeline without
 depending on it: headers are read through `request.getHeader()` when present,
-and otherwise from a plain object or a `Map`, case-insensitively.
+and otherwise from a plain object or a `Map`, case-insensitively. Its
+`HttpMiddleware` type is assignable to `@zudojs/http`'s, so it goes straight
+into a route's `middleware` list:
+
+```typescript
+router.get("/projects", listProjects, { middleware: [middleware] });
+```
+
+`getClaims` reads verified token claims for the JWT resolver (by default they
+come from the `tenancy:claims` state key). It may be typed with
+`@zudojs/http`'s own `HttpMiddlewareContext`, so a helper your auth layer
+already has plugs in without a cast:
+
+```typescript
+import type { HttpMiddlewareContext } from "@zudojs/http";
+import type { TenantClaims } from "@zudojs/tenancy";
+
+const claimsOf = (context: HttpMiddlewareContext) =>
+  context.state.get<TenantClaims>("auth:claims");
+
+createResolveTenantMiddleware({ resolver, repository, storage, getClaims: claimsOf });
+```
+
+The option is generic over the context it reads, bounded by this package's
+structural mirror, which the real context satisfies. A reader for something
+that is not a middleware context, such as a bare request, is still refused.
+
+A refusal — 400, 401, 403, 404 — is a `GuardResponse` (`createGuardResponse`
+from `@zudojs/middleware`), which `@zudojs/http` sends with that status. The
+helpers `createBadRequest`, `createUnauthorized`, `createForbidden`,
+`createNotFound`, `createJsonErrorResponse` and `createJsonResponse` all
+return one. They used to return plain `{ status, body, headers }` objects,
+which `@zudojs/http` did not treat as a response, so a request carrying only
+an `x-tenant-id` header was refused (the handler never ran) but answered
+`200` instead of `403`.
 
 Read the current tenant anywhere downstream:
 

package/dist/http/httpHelpers.d.ts

@@ -1,46 +1,36 @@
 /**
  * HTTP response helpers for tenancy middleware.
  *
+ * Every helper returns a `GuardResponse` from `@zudojs/middleware`, which
+ * `@zudojs/http` sends with its own status. They used to return plain
+ * `{ status, body, headers }` objects, which a route middleware's caller
+ * ignored: a refused request reached the client as `200`.
+ *
  * @module http/httpHelpers
  */
+import { type GuardResponse } from "@zudojs/middleware";
+/**
+ * Create a JSON response with a caller-built body.
+ */
+export declare function createJsonResponse(status: number, body: unknown): GuardResponse;
 /**
- * Create a JSON error response.
+ * Create a JSON error response: `{ "error": message }`.
  */
-export declare function createJsonErrorResponse(status: number, message: string): {
-    readonly status: number;
-    readonly body: unknown;
-    readonly headers: Record<string, string>;
-};
+export declare function createJsonErrorResponse(status: number, message: string): GuardResponse;
 /**
  * Create a 400 Bad Request response.
  */
-export declare function createBadRequest(message: string): {
-    readonly status: number;
-    readonly body: unknown;
-    readonly headers: Record<string, string>;
-};
+export declare function createBadRequest(message: string): GuardResponse;
 /**
  * Create a 401 Unauthorized response.
  */
-export declare function createUnauthorized(message: string): {
-    readonly status: number;
-    readonly body: unknown;
-    readonly headers: Record<string, string>;
-};
+export declare function createUnauthorized(message: string): GuardResponse;
 /**
  * Create a 403 Forbidden response.
  */
-export declare function createForbidden(message: string): {
-    readonly status: number;
-    readonly body: unknown;
-    readonly headers: Record<string, string>;
-};
+export declare function createForbidden(message: string): GuardResponse;
 /**
  * Create a 404 Not Found response.
  */
-export declare function createNotFound(message: string): {
-    readonly status: number;
-    readonly body: unknown;
-    readonly headers: Record<string, string>;
-};
+export declare function createNotFound(message: string): GuardResponse;
 //# sourceMappingURL=httpHelpers.d.ts.map

package/dist/http/httpHelpers.js

@@ -1,17 +1,26 @@
 /**
  * HTTP response helpers for tenancy middleware.
  *
+ * Every helper returns a `GuardResponse` from `@zudojs/middleware`, which
+ * `@zudojs/http` sends with its own status. They used to return plain
+ * `{ status, body, headers }` objects, which a route middleware's caller
+ * ignored: a refused request reached the client as `200`.
+ *
  * @module http/httpHelpers
  */
+import { createGuardResponse } from "@zudojs/middleware";
+const JSON_HEADERS = { "content-type": "application/json" };
+/**
+ * Create a JSON response with a caller-built body.
+ */
+export function createJsonResponse(status, body) {
+    return createGuardResponse({ status, body, headers: JSON_HEADERS });
+}
 /**
- * Create a JSON error response.
+ * Create a JSON error response: `{ "error": message }`.
  */
 export function createJsonErrorResponse(status, message) {
-    return Object.freeze({
-        status,
-        body: { error: message },
-        headers: { "content-type": "application/json" },
-    });
+    return createJsonResponse(status, { error: message });
 }
 /**
  * Create a 400 Bad Request response.

package/dist/http/httpResolverContext.d.ts

@@ -20,6 +20,16 @@ export interface HttpResolverContext {
     getPath(): string | undefined;
     getClaims(): TenantClaims | undefined;
 }
+/**
+ * Reads verified token claims for a request.
+ *
+ * Generic over the middleware context it reads, so a helper written against
+ * `@zudojs/http`'s own `HttpMiddlewareContext` is accepted as it is. The
+ * constraint is this package's structural mirror, which the real context
+ * satisfies; tenancy cannot depend on http (a higher tier), so the mirror is
+ * the only shape it can name.
+ */
+export type TenantClaimsReader<Context extends HttpMiddlewareContext = HttpMiddlewareContext> = (context: Context) => TenantClaims | undefined;
 /** State key under which upstream auth middleware publishes token claims. */
 export declare const TENANT_CLAIMS_STATE_KEY = "tenancy:claims";
 /**
@@ -31,5 +41,5 @@ export declare const TENANT_CLAIMS_STATE_KEY = "tenancy:claims";
  *   an authentication middleware is expected to publish them.
  * @returns An accessor object every shipped resolver understands.
  */
-export declare function createHttpResolverContext(context: HttpMiddlewareContext, getClaims?: (context: HttpMiddlewareContext) => TenantClaims | undefined): HttpResolverContext;
+export declare function createHttpResolverContext<Context extends HttpMiddlewareContext = HttpMiddlewareContext>(context: Context, getClaims?: TenantClaimsReader<Context>): HttpResolverContext;
 //# sourceMappingURL=httpResolverContext.d.ts.map

package/dist/http/httpSupport/index.d.ts

@@ -1,9 +1,11 @@
 /**
- * Support for the tenancy HTTP middleware: portable header reads, and loading
- * the tenant a resolution names (by id, then by slug).
+ * Support for the tenancy HTTP middleware: portable header reads, loading
+ * the tenant a resolution names (by id, then by slug), and adapting a
+ * resolver chain passed where a resolver is expected.
  *
  * @module http/httpSupport
  */
 export { readRequestHeader } from "./httpRequest.helper.js";
 export { loadResolvedTenant } from "./tenancyMiddleware.lookup.js";
+export { toTenantResolver, type TenantResolverSource, } from "./tenancyMiddleware.resolver.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/http/httpSupport/index.js

@@ -1,9 +1,11 @@
 /**
- * Support for the tenancy HTTP middleware: portable header reads, and loading
- * the tenant a resolution names (by id, then by slug).
+ * Support for the tenancy HTTP middleware: portable header reads, loading
+ * the tenant a resolution names (by id, then by slug), and adapting a
+ * resolver chain passed where a resolver is expected.
  *
  * @module http/httpSupport
  */
 export { readRequestHeader } from "./httpRequest.helper.js";
 export { loadResolvedTenant } from "./tenancyMiddleware.lookup.js";
+export { toTenantResolver, } from "./tenancyMiddleware.resolver.js";
 //# sourceMappingURL=index.js.map

package/dist/http/httpSupport/tenancyMiddleware.resolver.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Normalises what `createResolveTenantMiddleware` accepts as its resolver.
+ *
+ * @module http/httpSupport/tenancyMiddleware.resolver
+ */
+import type { TenantResolver } from "../../tenancyTypes/resolverTypes.js";
+import type { TenantResolverChain } from "../../resolver/resolverChain.core.js";
+/**
+ * A single resolver, or a resolver chain passed as it is.
+ *
+ * A chain's `resolve` returns the full `TenantResolutionResult`
+ * (`{ resolution, candidates, conflict }`), not a `TenantResolution`, so it
+ * is not itself a `TenantResolver`. The middleware used to take only the
+ * resolver form: passing a chain was a type error, and cast through at
+ * runtime every request was refused because the result object carries no
+ * `trust`. Both forms are accepted now.
+ */
+export type TenantResolverSource<Context> = TenantResolver<Context> | TenantResolverChain<Context>;
+/**
+ * Turn a resolver or a resolver chain into a `TenantResolver`.
+ *
+ * A chain is recognised structurally, by its `asResolver` method, so a chain
+ * built by another copy of this package is adapted too. Anything else is
+ * used as it is.
+ *
+ * @param source - A resolver, or a chain from `createResolverChain`.
+ * @returns A resolver that yields the winning `TenantResolution`.
+ */
+export declare function toTenantResolver<Context>(source: TenantResolverSource<Context>): TenantResolver<Context>;
+//# sourceMappingURL=tenancyMiddleware.resolver.d.ts.map

package/dist/http/httpSupport/tenancyMiddleware.resolver.js

@@ -0,0 +1,25 @@
+/**
+ * Normalises what `createResolveTenantMiddleware` accepts as its resolver.
+ *
+ * @module http/httpSupport/tenancyMiddleware.resolver
+ */
+/**
+ * Turn a resolver or a resolver chain into a `TenantResolver`.
+ *
+ * A chain is recognised structurally, by its `asResolver` method, so a chain
+ * built by another copy of this package is adapted too. Anything else is
+ * used as it is.
+ *
+ * @param source - A resolver, or a chain from `createResolverChain`.
+ * @returns A resolver that yields the winning `TenantResolution`.
+ */
+export function toTenantResolver(source) {
+    if (isResolverChain(source))
+        return source.asResolver();
+    return source;
+}
+function isResolverChain(source) {
+    return (typeof source.asResolver ===
+        "function");
+}
+//# sourceMappingURL=tenancyMiddleware.resolver.js.map

package/dist/http/httpTypes.d.ts

@@ -7,8 +7,23 @@
  *
  * @module http/httpTypes
  */
-/** HTTP middleware signature from @zudojs/http. */
-export type HttpMiddleware = (context: HttpMiddlewareContext, next: () => Promise<HttpResponseContext>) => void | Response | HttpResponseContext | Promise<void | Response | HttpResponseContext>;
+import type { GuardResponse } from "@zudojs/middleware";
+/**
+ * What a tenancy middleware returns: nothing, a web `Response`, a
+ * `GuardResponse` refusing the request, or whatever `next()` produced.
+ */
+export type HttpMiddlewareOutcome<Downstream> = void | Response | GuardResponse | Downstream;
+/**
+ * HTTP middleware signature, structurally assignable to `@zudojs/http`'s
+ * `HttpMiddleware` without a cast.
+ *
+ * Generic over what `next()` resolves to, so a middleware hands back the
+ * real pipeline's response unchanged. A refusal is a `GuardResponse`
+ * (`createGuardResponse` from `@zudojs/middleware`), which `@zudojs/http`
+ * sends with its own status; a plain `{ status, body, headers }` object is
+ * not a response.
+ */
+export type HttpMiddleware = <Downstream extends HttpResponseContext>(context: HttpMiddlewareContext, next: () => Promise<Downstream>) => HttpMiddlewareOutcome<Downstream> | Promise<HttpMiddlewareOutcome<Downstream>>;
 /** HTTP middleware context from @zudojs/http. */
 export interface HttpMiddlewareContext {
     readonly request: HttpRequestContext;

package/dist/http/index.d.ts

@@ -6,8 +6,9 @@ export type { RequireTenantMiddlewareOptions, ResolveTenantMiddlewareOptions, }
 export { createTenantGuardMiddleware, createTenantPropagationMiddleware, } from "./tenancyMiddleware.guard.js";
 export type { TenantGuardMiddlewareOptions } from "./tenancyMiddleware.guard.js";
 export { TENANT_CLAIMS_STATE_KEY, createHttpResolverContext, } from "./httpResolverContext.js";
-export type { HttpResolverContext, TenantClaims, } from "./httpResolverContext.js";
+export type { HttpResolverContext, TenantClaims, TenantClaimsReader, } from "./httpResolverContext.js";
 export { readRequestHeader } from "./httpSupport/index.js";
-export { createBadRequest, createForbidden, createJsonErrorResponse, createNotFound, createUnauthorized, } from "./httpHelpers.js";
+export type { TenantResolverSource } from "./httpSupport/index.js";
+export { createBadRequest, createForbidden, createJsonErrorResponse, createJsonResponse, createNotFound, createUnauthorized, } from "./httpHelpers.js";
 export type * from "./httpTypes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/http/index.js

@@ -5,5 +5,5 @@ export { TENANT_CONTEXT_STATE_KEY, TENANT_STATE_KEY, createRequireTenantMiddlewa
 export { createTenantGuardMiddleware, createTenantPropagationMiddleware, } from "./tenancyMiddleware.guard.js";
 export { TENANT_CLAIMS_STATE_KEY, createHttpResolverContext, } from "./httpResolverContext.js";
 export { readRequestHeader } from "./httpSupport/index.js";
-export { createBadRequest, createForbidden, createJsonErrorResponse, createNotFound, createUnauthorized, } from "./httpHelpers.js";
+export { createBadRequest, createForbidden, createJsonErrorResponse, createJsonResponse, createNotFound, createUnauthorized, } from "./httpHelpers.js";
 //# sourceMappingURL=index.js.map

package/dist/http/tenancyMiddleware.core.d.ts

@@ -8,19 +8,30 @@
  * Composes with the @zudojs/http pipeline structurally; no dependency on it.
  */
 import type { Tenant, TenantRequirement, TenantTrustLevel } from "../tenancyTypes/tenantInterface.js";
-import type { TenantResolver, TenantResolution } from "../tenancyTypes/resolverTypes.js";
+import type { TenantResolution } from "../tenancyTypes/resolverTypes.js";
 import type { TenantRepository } from "../tenancyTypes/repositoryTypes.js";
 import type { TenantContextStorage } from "../context/contextStorage.core.js";
 import type { HttpMiddleware, HttpMiddlewareContext } from "./httpTypes.js";
-import type { HttpResolverContext, TenantClaims } from "./httpResolverContext.js";
+import type { HttpResolverContext, TenantClaimsReader } from "./httpResolverContext.js";
+import { type TenantResolverSource } from "./httpSupport/index.js";
 /** State key for the resolved tenant. */
 export declare const TENANT_STATE_KEY = "tenancy:tenant";
 /** State key for the tenant context. */
 export declare const TENANT_CONTEXT_STATE_KEY = "tenancy:context";
-/** Options for the resolve tenant middleware. */
-export interface ResolveTenantMiddlewareOptions {
-    /** Resolver chain or single resolver to determine tenant. */
-    readonly resolver: TenantResolver<HttpResolverContext>;
+/**
+ * Options for the resolve tenant middleware.
+ *
+ * `Context` is the middleware context `getClaims` reads. It defaults to this
+ * package's mirror; a `getClaims` typed with `@zudojs/http`'s
+ * `HttpMiddlewareContext` sets it to that, with no cast.
+ */
+export interface ResolveTenantMiddlewareOptions<Context extends HttpMiddlewareContext = HttpMiddlewareContext> {
+    /**
+     * A single resolver, or a resolver chain from `createResolverChain` passed
+     * as it is. A chain is adapted with its `asResolver()`, so calling that
+     * yourself is no longer needed (it still works).
+     */
+    readonly resolver: TenantResolverSource<HttpResolverContext>;
     /** Repository to load the full tenant after resolution. */
     readonly repository: TenantRepository;
     /** Tenant context storage for propagation. */
@@ -58,8 +69,11 @@ export interface ResolveTenantMiddlewareOptions {
      * suspended tenant is refused whether or not this is set.
      */
     readonly optional?: boolean;
-    /** Reads verified token claims for the JWT resolver. */
-    readonly getClaims?: (context: HttpMiddlewareContext) => TenantClaims | undefined;
+    /**
+     * Reads verified token claims for the JWT resolver. Defaults to the
+     * `tenancy:claims` state key. May be typed with `@zudojs/http`'s context.
+     */
+    readonly getClaims?: TenantClaimsReader<Context>;
     /** Custom error response for missing tenant. */
     readonly notFoundResponse?: (resolution: TenantResolution | undefined) => unknown;
 }
@@ -77,7 +91,7 @@ export interface RequireTenantMiddlewareOptions {
  * Enforces trust and tenant status itself rather than relying on a second
  * middleware being installed: the safe behaviour has to be the default.
  */
-export declare function createResolveTenantMiddleware(options: ResolveTenantMiddlewareOptions): HttpMiddleware;
+export declare function createResolveTenantMiddleware<Context extends HttpMiddlewareContext = HttpMiddlewareContext>(options: ResolveTenantMiddlewareOptions<Context>): HttpMiddleware;
 /**
  * Create middleware that enforces tenant presence.
  *

package/dist/http/tenancyMiddleware.core.js

@@ -8,9 +8,9 @@
  * Composes with the @zudojs/http pipeline structurally; no dependency on it.
  */
 import { createHttpResolverContext } from "./httpResolverContext.js";
-import { createBadRequest, createForbidden, createNotFound, createUnauthorized, } from "./httpHelpers.js";
+import { createBadRequest, createForbidden, createJsonResponse, createNotFound, createUnauthorized, } from "./httpHelpers.js";
 import { meetsTrustLevel } from "../security/guard.core.js";
-import { loadResolvedTenant } from "./httpSupport/index.js";
+import { loadResolvedTenant, toTenantResolver, } from "./httpSupport/index.js";
 import { TenantResolutionConflictError, TenantResolutionError, } from "../tenancyErrors/tenancyError.types.js";
 // ─── State Keys ───────────────────────────────────────────────────────────
 /** State key for the resolved tenant. */
@@ -26,21 +26,18 @@ export const TENANT_CONTEXT_STATE_KEY = "tenancy:context";
  * middleware being installed: the safe behaviour has to be the default.
  */
 export function createResolveTenantMiddleware(options) {
+    const resolver = toTenantResolver(options.resolver);
     const minimumTrust = options.minimumTrust ?? "verified";
     const slugLookup = options.slugLookup !== false;
     // Unknown and unavailable tenants get the same answer, so a caller cannot
     // learn which tenant ids exist or which of them are suspended.
     const notFound = (resolution) => options.notFoundResponse
-        ? {
-            status: 404,
-            body: options.notFoundResponse(resolution),
-            headers: { "content-type": "application/json" },
-        }
+        ? createJsonResponse(404, options.notFoundResponse(resolution))
         : createNotFound("Tenant not found");
     return async (context, next) => {
         let resolution;
         try {
-            resolution = await options.resolver.resolve(createHttpResolverContext(context, options.getClaims));
+            resolution = await resolver.resolve(createHttpResolverContext(context, options.getClaims));
         }
         catch (error) {
             // A resolver chain throws when a credential was rejected or when two
@@ -98,11 +95,7 @@ export function createRequireTenantMiddleware(options) {
             return next();
         if (!tenant) {
             return options?.deniedResponse
-                ? {
-                    status: 401,
-                    body: options.deniedResponse(undefined),
-                    headers: { "content-type": "application/json" },
-                }
+                ? createJsonResponse(401, options.deniedResponse(undefined))
                 : createUnauthorized("Tenant context is required");
         }
         return next();

package/dist/resolver/index.d.ts

@@ -4,6 +4,6 @@
  * @module resolver
  */
 export { createResolverChain } from "./resolverChain.core.js";
-export type { TenantResolverChain } from "./resolverChain.core.js";
+export type { ResolverChainContext, TenantResolverChain, } from "./resolverChain.core.js";
 export * from "./resolvers/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/resolver/resolverChain.core.d.ts

@@ -18,14 +18,32 @@ export interface TenantResolverChain<Context = unknown> {
     resolveTenant(context: Context): Promise<TenantResolution | undefined>;
     asResolver(): TenantResolver<Context>;
 }
+/** The context type one resolver reads. */
+type ResolverContextOf<Resolver> = Resolver extends TenantResolver<infer Context> ? Context : never;
+type UnionToIntersection<Union> = (Union extends unknown ? (value: Union) => void : never) extends (value: infer Intersection) => void ? Intersection : never;
+/**
+ * The context a chain of these resolvers needs: everything each of them
+ * reads. For the JWT, domain and subdomain resolvers that is
+ * `JwtContext & DomainContext & SubdomainContext`, which
+ * `HttpResolverContext` satisfies.
+ */
+export type ResolverChainContext<Resolvers extends readonly TenantResolver<never>[]> = UnionToIntersection<ResolverContextOf<Resolvers[number]>>;
 /**
  * Create a resolver chain that tries resolvers in priority order.
  *
+ * The chain's context is inferred from the resolvers — each reads a
+ * different part of the request, so it is the intersection of what they
+ * read — and `createResolverChain([createJwtResolver(), createDomainResolver(
+ * { repository })])` needs no type argument. Passing one explicitly
+ * (`createResolverChain<HttpResolverContext>([...])`) still works.
+ *
  * A resolver that returns `undefined` found nothing, and the chain moves on.
  * A resolver that *throws* rejected a credential — an expired JWT, a bad
  * signature — and the chain stops there. Continuing would let a lower-trust
  * source such as a client-supplied header decide the tenant for a request
  * whose credential was just refused.
  */
+export declare function createResolverChain<const Resolvers extends readonly TenantResolver<never>[]>(resolvers: Resolvers, options?: ResolverChainOptions): TenantResolverChain<ResolverChainContext<Resolvers>>;
 export declare function createResolverChain<Context = unknown>(resolvers: readonly TenantResolver<Context>[], options?: ResolverChainOptions): TenantResolverChain<Context>;
+export {};
 //# sourceMappingURL=resolverChain.core.d.ts.map

package/dist/resolver/resolverChain.core.js

@@ -4,15 +4,6 @@
  * @module resolver/resolverChain
  */
 import { TenantResolutionConflictError, TenantResolutionError, } from "../tenancyErrors/tenancyError.types.js";
-/**
- * Create a resolver chain that tries resolvers in priority order.
- *
- * A resolver that returns `undefined` found nothing, and the chain moves on.
- * A resolver that *throws* rejected a credential — an expired JWT, a bad
- * signature — and the chain stops there. Continuing would let a lower-trust
- * source such as a client-supplied header decide the tenant for a request
- * whose credential was just refused.
- */
 export function createResolverChain(resolvers, options) {
     // Sort by priority descending (higher priority first)
     const sorted = [...resolvers].sort((a, b) => b.priority - a.priority);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/tenancy",
-  "version": "1.2.1",
+  "version": "1.3.1",
   "description": "Multi-tenant context and isolation with tenant resolution, AsyncLocalStorage propagation, resolver chains, trust levels, and guard middleware.",
   "license": "MIT",
   "author": {
@@ -25,15 +25,16 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/errors": "1.2.0",
-    "@zudojs/constants": "1.1.1"
+    "@zudojs/errors": "1.3.0",
+    "@zudojs/constants": "1.1.2",
+    "@zudojs/middleware": "1.1.0"
   },
   "engines": {
     "node": ">=24.0.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.1"
   },
   "publishConfig": {
     "access": "public"
@@ -44,7 +45,7 @@
     "multi-tenant",
     "saas"
   ],
-  "homepage": "https://github.com/oyinlola-tech/zudo#readme",
+  "homepage": "https://zudojs.oyinlola.site/docs/packages-tenancy",
   "bugs": {
     "url": "https://github.com/oyinlola-tech/zudo/issues"
   },