mindoodb 0.0.85 → 0.0.86

package/dist/node/server/TenantManager.d.ts

@@ -1,294 +1,26 @@
 /**
- * TenantManager handles loading, caching, and registration of tenants.
- *
- * Uses a global server identity (one per server, not per tenant) for
- * authenticating with remote servers and opening tenant directories.
- *
- * When a tenant has a $publicinfos key (sent during publishToServer), the
- * manager creates a real BaseMindooTenant for directory reading. User
- * authentication is then validated against the admin-signed directory DB
- * rather than a static JSON config.
- *
- * When no $publicinfos key is available, a SimpleMindooDirectory backed
- * by config.json users[] is used as a fallback (useful for tests).
- *
- * A CompositeMindooDirectory wraps whichever directory source is used and
- * also checks the global trusted-servers list, enabling server-to-server
- * auth without servers being in each tenant's user directory.
+ * Node host of the {@link CoreTenantManager}: tenant state lives in files
+ * below the data directory and every tenant database is an on-disk store in
+ * `<dataDir>/<tenantId>/stores` (see {@link StoreFactory}).
  */
 import { NodeCryptoAdapter } from "../crypto/NodeCryptoAdapter";
-import { AuthenticationService } from "../../core/appendonlystores/network/AuthenticationService";
-import { ServerNetworkContentAddressedStore } from "../../appendonlystores/network/ServerNetworkContentAddressedStore";
-import type { ServerPeerTokenResolver, ServerTrustedWitnessResolver } from "../../appendonlystores/network/ServerNetworkContentAddressedStore";
-import type { WitnessSigner } from "../../core/crypto/WitnessReceipt";
-import type { TimestampProvider } from "../../core/accesscontrol/timestamp/TimestampProvider";
-import type { MindooTenant, MindooTenantDirectory, ContentAddressedStore, DirectoryUserLookup } from "../../core/types";
-import { StoreKind } from "../../core/types";
-import type { PrivateUserId } from "../../core/userid";
+import { TenantManager as CoreTenantManager } from "../../server/TenantManager";
+import type { ServerStoreProvider } from "../../server/ServerDataStore";
+import { FsServerDataStore } from "./FsServerDataStore";
 import { StoreFactory } from "./StoreFactory";
-import type { TenantConfig, TenantContext, RegisterTenantRequest, TrustedServer } from "./types";
-interface LoadedTenant {
-    context: TenantContext;
-    storeFactory: StoreFactory;
-    authService: AuthenticationService;
-    directory: MindooTenantDirectory;
-    mindooTenant?: MindooTenant;
-    serverStores: Map<string, ServerNetworkContentAddressedStore>;
-}
-interface RegisterTenantResult {
-    context: TenantContext;
-    created: boolean;
-}
-export declare class SimpleMindooDirectory implements Pick<MindooTenantDirectory, "getUserPublicKeys" | "isUserRevoked" | "validatePublicSigningKey" | "getUserBySigningPublicKey"> {
-    /** Canonical index: entries are identified by their signing public key. */
-    private usersByKey;
-    /**
-     * Backward-compat index by documentation-only username, populated only for
-     * config entries that carry a `username`. Lets legacy username-based
-     * challenges keep resolving; `username` is never required.
-     */
-    private usersByUsername;
-    private revokedUsers;
-    private adminSigningPublicKey;
-    constructor(config: TenantConfig);
-    getUserPublicKeys(username: string): Promise<{
-        signingPublicKey: string;
-        encryptionPublicKey: string;
-    } | null>;
-    getUserBySigningPublicKey(publicKey: string): Promise<DirectoryUserLookup | null>;
-    private toLookup;
-    isUserRevoked(username: string): Promise<boolean>;
-    validatePublicSigningKey(publicKey: string, _opts?: {
-        forceRefresh?: boolean;
-    }): Promise<boolean>;
+export { SimpleMindooDirectory, type LoadedTenant, type RegisterTenantResult, } from "../../server/TenantManager";
+/** The on-disk stores of every tenant below `<dataDir>/<tenantId>/stores`. */
+export declare class NodeServerStoreProvider implements ServerStoreProvider {
+    private readonly dataDir;
+    private readonly dataStore;
+    constructor(dataDir: string, dataStore: FsServerDataStore);
+    createTenantStores(tenantId: string, config: ConstructorParameters<typeof StoreFactory>[1]): StoreFactory;
+    listDatabases(tenantId: string): string[];
 }
-/**
- * TenantManager is responsible for:
- * - Loading the global server identity and trusted servers
- * - Loading tenant configurations from disk
- * - Caching loaded tenants
- * - Registering new tenants
- * - Managing tenant stores and authentication services
- * - Creating a real MindooDB tenant for directory reading (when keys available)
- * - Runtime management of trusted servers
- */
-export declare class TenantManager {
-    private dataDir;
-    private serverPassword;
-    private cryptoAdapter;
-    private loadedTenants;
-    private serverIdentity;
-    private trustedServers;
-    /** Lazily-built, cached witness signer (server's Ed25519 signing identity). */
-    private witnessSigner;
-    /** Lazily-imported RSA private key for peer replication (see getServerEncryptionPrivateKey). */
-    private serverEncryptionPrivateKey;
-    /** Peer wiring handed down to every server store; see setPeerAccessControl. */
-    private peerAccessControl;
-    /** Per-tenant persistent registry of executed purges (docs/accesscontrol.md §13). */
-    private purgedDocRegistries;
-    /** In-flight purge executions, keyed by normalized tenant id (serializes runs). */
-    private purgeInFlight;
+export declare class TenantManager extends CoreTenantManager {
+    private readonly dataDir;
     constructor(dataDir: string, serverPassword?: string);
-    getServerIdentity(): PrivateUserId | null;
-    getServerPublicInfo(): TrustedServer | null;
     getDataDir(): string;
-    /**
-     * Teach every server store how to recognise a trusted peer.
-     *
-     * `MindooDBServer` calls this once at startup. Two hooks, both required for
-     * peer replication to be correct:
-     *
-     * - `peerTokenResolver` lets a peer's cluster-level JWT through the tenant
-     *   sync routes. A peer holds no per-tenant grant, so without it the mirror
-     *   would need a second replication protocol; with it the peer reuses the
-     *   client one and the store skips the per-user gates that do not apply to a
-     *   full replica.
-     * - `trustedWitnessResolver` decides whose witness receipts may be preserved
-     *   instead of re-stamped (convergence invariant 3). Without it a replicated
-     *   entry would get a fresh `receivedAt` on every hop and "trusted time"
-     *   would mean "time it reached the last server".
-     *
-     * Must be called before the first {@link getServerStore}, since stores are
-     * cached per tenant and database.
-     */
-    setPeerAccessControl(options: {
-        peerTokenResolver?: ServerPeerTokenResolver;
-        trustedWitnessResolver?: ServerTrustedWitnessResolver;
-    }): void;
-    /**
-     * Database ids this server holds for a tenant, read from
-     * `{dataDir}/{tenantId}/stores`. Used by peer replication to mirror every
-     * database rather than a configured subset.
-     */
-    listDatabases(tenantId: string): string[];
-    /**
-     * The server's own RSA private key, imported for decryption.
-     *
-     * Peer replication needs it because the remote wraps transported entries to
-     * this server's `encryptionPublicKey` (the one in its `trusted-servers.json`),
-     * exactly as it would wrap them for a client.
-     */
-    getServerEncryptionPrivateKey(): Promise<CryptoKey | undefined>;
-    /**
-     * Build (and cache) the server's witness identity used to stamp receipts on
-     * accepted entries (docs/accesscontrol.md §5.3). Returns undefined when the
-     * server identity or its unlock password is unavailable, in which case the
-     * server runs in pre-access-control mode (no stamping, no Tier 1 advertised).
-     */
-    getWitnessSigner(): Promise<WitnessSigner | undefined>;
-    /**
-     * Build the trusted-time provider that stamps receipts on accepted entries
-     * (docs/accesscontrol.md §5.3, §13). v1 wraps the server's Ed25519 witness
-     * identity; returns undefined when no witness signer is available, leaving the
-     * server in pre-access-control mode.
-     */
-    getTimestampProvider(): Promise<TimestampProvider | undefined>;
-    listTrustedServers(): TrustedServer[];
-    addTrustedServer(server: TrustedServer): void;
-    /**
-     * Add or replace a trusted server by name.
-     *
-     * Peer CRUD needs an upsert: `addTrustedServer` throws on an existing name,
-     * which is right for `add-to-network` (a silent overwrite of a peer's keys
-     * would be a trust change disguised as a config edit) but wrong for the admin
-     * API, where changing a peer's url or role is the common case.
-     */
-    saveTrustedServer(server: TrustedServer): void;
-    removeTrustedServer(name: string): boolean;
-    private persistTrustedServers;
-    private getServerKeyBagPath;
-    private loadServerKeyBag;
-    private createServerKeyBag;
-    private saveServerKeyBag;
-    private bytesToBase64;
-    private mergeUniqueKeys;
-    private computePublicInfosFingerprint;
-    private resolveTenantDir;
-    private resolveTenantConfigPath;
-    private decryptEncryptedPublicInfosKey;
-    private resolveIncomingPublicInfosKey;
-    private getStoredPublicInfosKeys;
-    private persistTenantPublicInfosKey;
-    /**
-     * All stored `$publicinfos` AES key versions for a tenant from `server.keybag`.
-     * Empty when the tenant was never published or the server keybag is locked.
-     */
-    getPublicInfosKeysForTenant(tenantId: string): Promise<Uint8Array[]>;
-    listTenantPublicInfosFingerprints(tenantId: string): Promise<string[]>;
-    registerTenant(request: RegisterTenantRequest): Promise<RegisterTenantResult>;
-    getTenant(tenantId: string): Promise<LoadedTenant>;
-    tenantExists(tenantId: string): boolean;
-    /**
-     * Read the tenant's registered admin signing key without fully loading the
-     * tenant. Returns `null` if the tenant is missing or the config is unreadable.
-     */
-    getTenantAdminSigningPublicKey(tenantId: string): string | null;
-    /**
-     * True when `publicsignkey` is the registered tenant-admin signing key for
-     * `tenantId` (PEM whitespace-insensitive).
-     */
-    isTenantAdminSigningKeyFor(tenantId: string, publicsignkey: string): boolean;
-    /**
-     * True when `publicsignkey` is the registered admin signing key of any
-     * tenant on this server. Used to issue a system JWT so that admin can
-     * DELETE their own tenant; other `/system/*` routes stay capability-gated.
-     */
-    isRegisteredTenantAdminSigningKey(publicsignkey: string): boolean;
-    listTenants(): string[];
-    /**
-     * Update operator-owned fields of an existing tenant configuration.
-     * Only the fields present in `updates` are overwritten.
-     */
-    updateTenantConfig(tenantId: string, updates: Partial<Pick<TenantConfig, "defaultStoreType">>): void;
-    removeTenant(tenantId: string): Promise<void>;
-    getServerStore(tenantId: string, dbId: string, storeKind: StoreKind): Promise<ServerNetworkContentAddressedStore>;
-    /**
-     * Build a Tier 1 evaluator closure for a server store, or undefined when the
-     * directory cannot evaluate access (e.g. config-based directory without the
-     * access-control state chain). The closure resolves `$author` for non-create
-     * ops by reading the document's `doc_create` entry creator key from the local
-     * store (metadata only, no decryption) and comparing it to the change author.
-     */
-    /**
-     * The witness's Tier 1 gate. The evaluation itself is shared with the peer
-     * listener, which has to run it for entries that never reach a witness at
-     * all — see `core/accesscontrol/tier1Evaluator.ts`.
-     */
-    private buildTier1Evaluator;
-    /**
-     * Builtin `userdirectory` write invariant: admin may create/delete, only the
-     * owning person may change. `username_hash` is read from the decrypted
-     * `doc_create` payload (`$publicinfos`). Personal documents are sealed to
-     * their owner and therefore undecryptable here, so they are owned by whoever
-     * signed their `doc_create` — `resolveCreatorSigningKey` answers that from
-     * the entry chain alone.
-     */
-    private buildUserdirectoryWriteContext;
-    private findCreateEntry;
-    /**
-     * Build a database-open evaluator closure for a server store, or undefined
-     * when the directory cannot evaluate the database-open policy (e.g. a
-     * config-based directory without the access-control state chain). When the
-     * tenant policy is `"directory-restricted"`, this rejects sync for any
-     * database id that is not in the allowlist; `"directory"` is always allowed
-     * and the tenant admin is exempt (resolved from the principal signing key).
-     */
-    private buildDbAccessEvaluator;
-    /**
-     * Build a remote-wipe resolver closure for a server store, or undefined when
-     * the directory does not support wipe directives (docs/accesscontrol.md §6.5).
-     * Maps a wipe-targeted signing key to the admin-signed grant document id so
-     * the server can serve only that document to the targeted device.
-     */
-    private buildWipeGrantDocIdResolver;
-    /**
-     * Build a per-user revoked-key blacklist resolver for a server store, or
-     * undefined when the directory cannot resolve revoked keys (e.g. a
-     * config-based directory). Maps the authenticated principal's signing key to
-     * the set of decryption key ids revoked for them at the directory head
-     * (docs/accesscontrol.md §13).
-     */
-    private buildRevokedKeyResolver;
-    getStore(tenantId: string, dbId: string, storeKind: StoreKind): Promise<ContentAddressedStore>;
-    /**
-     * Documents purged from `dbId` on this server (the persistent purge
-     * registry). Peer pull replication refuses their entries.
-     */
-    getPurgedDocIds(tenantId: string, dbId: string): ReadonlySet<string>;
-    /** The (lazily-loaded, cached) purge registry for a tenant. */
-    private getPurgedDocRegistry;
-    /**
-     * Execute any not-yet-processed document-history purge requests for a tenant
-     * (docs/accesscontrol.md §13). Reads the admin-signed purge requests from the
-     * tenant directory (server-readable `$publicinfos` envelope), physically
-     * purges each requested document's history from the tenant's `docs` and
-     * `attachments` stores, and records the purge in the persistent registry so
-     * (a) it is never executed twice and (b) re-pushes of the purged docs are
-     * rejected at sync time.
-     *
-     * No-op when the server cannot read the directory (config-based fallback, or
-     * the directory does not expose the purge reader). Runs are serialized per
-     * tenant; concurrent callers share the in-flight promise.
-     */
-    executePendingPurges(tenantId: string): Promise<void>;
-    private executePendingPurgesInternal;
-    /**
-     * Purge one document from a database's docs and attachment stores. Attachment
-     * chunks still referenced by another document are kept (see
-     * `purgeDocumentHistory.ts`). Failures are logged, never thrown.
-     */
-    private purgeDocumentFromDatabase;
-    getAuthService(tenantId: string): Promise<AuthenticationService>;
     getCryptoAdapter(): NodeCryptoAdapter;
-    reloadTenant(tenantId: string): Promise<LoadedTenant>;
-    clearCache(): void;
-    private loadTenant;
-    /**
-     * Create a real BaseMindooTenant for directory reading using the global
-     * server identity.
-     */
-    private createDirectoryTenant;
 }
-export {};
 //# sourceMappingURL=TenantManager.d.ts.map

package/dist/node/server/TenantManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TenantManager.d.ts","sourceRoot":"","sources":["../../../src/node/server/TenantManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAaH,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2DAA2D,CAAC;AAClG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mEAAmE,CAAC;AACvH,OAAO,KAAK,EAMV,uBAAuB,EACvB,4BAA4B,EAC7B,MAAM,mEAAmE,CAAC;AAG3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sDAAsD,CAAC;AAO9F,OAAO,KAAK,EACV,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EAMrB,mBAAmB,EAGpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,SAAS,EAEV,MAAM,kBAAkB,CAAC;AAO1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,qBAAqB,EAErB,aAAa,EACd,MAAM,SAAS,CAAC;AAMjB,UAAU,YAAY;IACpB,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,qBAAqB,CAAC;IACnC,SAAS,EAAE,qBAAqB,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;CAC/D;AAED,UAAU,oBAAoB;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;CAClB;AAuBD,qBAAa,qBAAsB,YAAW,IAAI,CAChD,qBAAqB,EACnB,mBAAmB,GACnB,eAAe,GACf,0BAA0B,GAC1B,2BAA2B,CAC9B;IACC,2EAA2E;IAC3E,OAAO,CAAC,UAAU,CAAsC;IACxD;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAsC;IAC7D,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,qBAAqB,CAAS;gBAE1B,MAAM,EAAE,YAAY;IAe1B,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACjD,gBAAgB,EAAE,MAAM,CAAC;QACzB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,GAAG,IAAI,CAAC;IAeH,yBAAyB,CAC7B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAetC,OAAO,CAAC,QAAQ;IAeV,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIjD,wBAAwB,CAC5B,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,OAAO,CAAC;CAgBpB;AAiSD;;;;;;;;;GASG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,aAAa,CAAwC;IAE7D,OAAO,CAAC,cAAc,CAA8B;IACpD,OAAO,CAAC,cAAc,CAAuB;IAC7C,+EAA+E;IAC/E,OAAO,CAAC,aAAa,CAA4B;IACjD,gGAAgG;IAChG,OAAO,CAAC,0BAA0B,CAAwB;IAC1D,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB,CAGlB;IACP,qFAAqF;IACrF,OAAO,CAAC,mBAAmB,CAA6C;IACxE,mFAAmF;IACnF,OAAO,CAAC,aAAa,CAAyC;gBAElD,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM;IAqCpD,iBAAiB,IAAI,aAAa,GAAG,IAAI;IAIzC,mBAAmB,IAAI,aAAa,GAAG,IAAI;IAW3C,UAAU,IAAI,MAAM;IAIpB;;;;;;;;;;;;;;;;;;OAkBG;IACH,oBAAoB,CAAC,OAAO,EAAE;QAC5B,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;QAC5C,sBAAsB,CAAC,EAAE,4BAA4B,CAAC;KACvD,GAAG,IAAI;IAIR;;;;OAIG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;IAqBzC;;;;;;OAMG;IACG,6BAA6B,IAAI,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAsBrE;;;;;OAKG;IACG,gBAAgB,IAAI,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IA0B5D;;;;;OAKG;IACG,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAUpE,kBAAkB,IAAI,aAAa,EAAE;IAIrC,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAY7C;;;;;;;OAOG;IACH,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAa9C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAW1C,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,mBAAmB;YAIb,gBAAgB;YAkBhB,kBAAkB;YAgBlB,gBAAgB;IAQ9B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,eAAe;YAcT,6BAA6B;IAW3C,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,uBAAuB;YAIjB,8BAA8B;YAqC9B,6BAA6B;YAgB7B,wBAAwB;YAiBxB,2BAA2B;IAoBzC;;;OAGG;IACG,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAIpE,iCAAiC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAkBtE,cAAc,CAClB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC;IA6D1B,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAcxD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMvC;;;OAGG;IACH,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAuB/D;;;OAGG;IACH,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO;IAK5E;;;;OAIG;IACH,iCAAiC,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO;IASjE,WAAW,IAAI,MAAM,EAAE;IAoBvB;;;OAGG;IACH,kBAAkB,CAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,GACvD,IAAI;IAiBD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2B7C,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,kCAAkC,CAAC;IAqE9C;;;;;;OAMG;IACH;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;;;;;;OAOG;IACH,OAAO,CAAC,8BAA8B;YA8BxB,eAAe;IAkB7B;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAkB9B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IASnC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAgBzB,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,qBAAqB,CAAC;IAKjC;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAIpE,+DAA+D;IAC/D,OAAO,CAAC,oBAAoB;IAY5B;;;;;;;;;;;;OAYG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAW7C,4BAA4B;IAoF1C;;;;OAIG;YACW,yBAAyB;IAqBjC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAKtE,gBAAgB,IAAI,iBAAiB;IAI/B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAM3D,UAAU,IAAI,IAAI;YASJ,UAAU;IAyFxB;;;OAGG;YACW,qBAAqB;CA6CpC"}
+{"version":3,"file":"TenantManager.d.ts","sourceRoot":"","sources":["../../../src/node/server/TenantManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EACL,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,8EAA8E;AAC9E,qBAAa,uBAAwB,YAAW,mBAAmB;IAE/D,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,iBAAiB;IAG/C,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY;IAIzG,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;CAiB1C;AAUD,qBAAa,aAAc,SAAQ,iBAAiB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM;IAWpD,UAAU,IAAI,MAAM;IAIX,gBAAgB,IAAI,iBAAiB;CAG/C"}