npm - @authhero/multi-tenancy - Versions diffs - 13.10.0 → 13.11.0 - Mend

@authhero/multi-tenancy 13.10.0 → 13.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/dist/multi-tenancy.cjs +1 -1
package/dist/multi-tenancy.d.ts +17842 -4685
package/dist/multi-tenancy.mjs +654 -916
package/package.json +4 -4

package/dist/multi-tenancy.mjs CHANGED Viewed

@@ -1,23 +1,22 @@
 var K = Object.defineProperty;
-var B = (t, a, i) => a in t ? K(t, a, { enumerable: !0, configurable: !0, writable: !0, value: i }) : t[a] = i;
-var D = (t, a, i) => B(t, typeof a != "symbol" ? a + "" : a, i);
+var E = (e, t, s) => t in e ? K(e, t, { enumerable: !0, configurable: !0, writable: !0, value: s }) : e[t] = s;
+var D = (e, t, s) => E(e, typeof t != "symbol" ? t + "" : t, s);
 import { Hono as U } from "hono";
-import { getTenantAudience as W, MANAGEMENT_API_SCOPES as G, MANAGEMENT_API_AUDIENCE as L, fetchAll as z, init as Q } from "authhero";
-import { MANAGEMENT_API_SCOPES as Pe, fetchAll as ze, seed as Ie } from "authhero";
-import { z as V } from "zod";
-import { auth0QuerySchema as F, tenantInsertSchema as j, tenantSchema as $ } from "@authhero/adapter-interfaces";
-import { OpenAPIHono as Y, createRoute as S, z as C } from "@hono/zod-openapi";
-var w = class extends Error {
+import { getTenantAudience as B, MANAGEMENT_API_SCOPES as W, MANAGEMENT_API_AUDIENCE as G, fetchAll as S, init as L } from "authhero";
+import { MANAGEMENT_API_SCOPES as ve, fetchAll as be, seed as Pe } from "authhero";
+import { OpenAPIHono as Q, createRoute as M, z as P } from "@hono/zod-openapi";
+import { auth0QuerySchema as V, tenantSchema as O, tenantInsertSchema as J } from "@authhero/adapter-interfaces";
+var C = class extends Error {
   /**
    * Creates an instance of `HTTPException`.
    * @param status - HTTP status code for the exception. Defaults to 500.
    * @param options - Additional options for the exception.
    */
-  constructor(a = 500, i) {
-    super(i == null ? void 0 : i.message, { cause: i == null ? void 0 : i.cause });
+  constructor(t = 500, s) {
+    super(s == null ? void 0 : s.message, { cause: s == null ? void 0 : s.cause });
     D(this, "res");
     D(this, "status");
-    this.res = i == null ? void 0 : i.res, this.status = a;
+    this.res = s == null ? void 0 : s.res, this.status = t;
   }
   /**
    * Returns the response object associated with the exception.
@@ -33,160 +32,160 @@ var w = class extends Error {
     });
   }
 };
-function Z(t) {
-  const { controlPlaneTenantId: a, requireOrganizationMatch: i = !0 } = t;
+function X(e) {
+  const { controlPlaneTenantId: t, requireOrganizationMatch: s = !0 } = e;
   return {
-    async onTenantAccessValidation(e, n) {
-      if (n === a)
+    async onTenantAccessValidation(a, i) {
+      if (i === t)
         return !0;
-      if (i) {
-        const r = e.var.org_name, l = e.var.organization_id, o = r || l;
-        return o ? o === n : !1;
+      if (s) {
+        const n = a.var.org_name, u = a.var.organization_id, l = n || u;
+        return l ? l === i : !1;
       }
       return !0;
     }
   };
 }
-function J(t, a, i, e) {
-  if (a === i)
+function Y(e, t, s, a) {
+  if (t === s)
     return !0;
-  const n = e || t;
-  return n ? n === a : !1;
+  const i = a || e;
+  return i ? i === t : !1;
 }
-function X(t) {
+function Z(e) {
   return {
-    async resolveDataAdapters(a) {
+    async resolveDataAdapters(t) {
       try {
-        return await t.getAdapters(a);
-      } catch (i) {
+        return await e.getAdapters(t);
+      } catch (s) {
         console.error(
-          `Failed to resolve data adapters for tenant ${a}:`,
-          i
+          `Failed to resolve data adapters for tenant ${t}:`,
+          s
         );
         return;
       }
     }
   };
 }
-function H(t) {
+function k(e) {
   return {
-    async beforeCreate(a, i) {
-      return !i.audience && i.id ? {
-        ...i,
-        audience: W(i.id)
-      } : i;
+    async beforeCreate(t, s) {
+      return !s.audience && s.id ? {
+        ...s,
+        audience: B(s.id)
+      } : s;
     },
-    async afterCreate(a, i) {
-      const { accessControl: e, databaseIsolation: n, settingsInheritance: r } = t;
-      e && a.ctx && await k(a, i, e), n != null && n.onProvision && await n.onProvision(i.id), (r == null ? void 0 : r.inheritFromControlPlane) !== !1 && a.ctx && await ee(a, i, t);
+    async afterCreate(t, s) {
+      const { accessControl: a, databaseIsolation: i, settingsInheritance: n } = e;
+      a && t.ctx && await H(t, s, a), i != null && i.onProvision && await i.onProvision(s.id), (n == null ? void 0 : n.inheritFromControlPlane) !== !1 && t.ctx && await ee(t, s, e);
     },
-    async beforeDelete(a, i) {
-      const { accessControl: e, databaseIsolation: n } = t;
-      if (e)
+    async beforeDelete(t, s) {
+      const { accessControl: a, databaseIsolation: i } = e;
+      if (a)
         try {
-          const l = (await a.adapters.organizations.list(
-            e.controlPlaneTenantId
-          )).organizations.find((o) => o.name === i);
-          l && await a.adapters.organizations.remove(
-            e.controlPlaneTenantId,
-            l.id
+          const u = (await t.adapters.organizations.list(
+            a.controlPlaneTenantId
+          )).organizations.find((l) => l.name === s);
+          u && await t.adapters.organizations.remove(
+            a.controlPlaneTenantId,
+            u.id
           );
-        } catch (r) {
+        } catch (n) {
           console.warn(
-            `Failed to remove organization for tenant ${i}:`,
-            r
+            `Failed to remove organization for tenant ${s}:`,
+            n
           );
         }
-      if (n != null && n.onDeprovision)
+      if (i != null && i.onDeprovision)
         try {
-          await n.onDeprovision(i);
-        } catch (r) {
+          await i.onDeprovision(s);
+        } catch (n) {
           console.warn(
-            `Failed to deprovision database for tenant ${i}:`,
-            r
+            `Failed to deprovision database for tenant ${s}:`,
+            n
           );
         }
     }
   };
 }
-async function k(t, a, i) {
+async function H(e, t, s) {
   const {
-    controlPlaneTenantId: e,
-    defaultPermissions: n,
-    defaultRoles: r,
-    issuer: l,
-    adminRoleName: o = "Tenant Admin",
+    controlPlaneTenantId: a,
+    defaultPermissions: i,
+    defaultRoles: n,
+    issuer: u,
+    adminRoleName: l = "Tenant Admin",
     adminRoleDescription: c = "Full access to all tenant management operations",
-    addCreatorToOrganization: s = !0
-  } = i, u = await t.adapters.organizations.create(
-    e,
+    addCreatorToOrganization: r = !0
+  } = s, f = await e.adapters.organizations.create(
+    a,
     {
-      name: a.id,
-      display_name: a.friendly_name || a.id
+      name: t.id,
+      display_name: t.friendly_name || t.id
     }
   );
-  let f;
-  if (l && (f = await x(
-    t,
+  let d;
+  if (u && (d = await x(
     e,
-    o,
+    a,
+    l,
     c
-  )), s && t.ctx) {
-    const d = t.ctx.var.user;
-    if (d != null && d.sub)
+  )), r && e.ctx) {
+    const o = e.ctx.var.user;
+    if (o != null && o.sub)
       try {
-        await t.adapters.userOrganizations.create(e, {
-          user_id: d.sub,
-          organization_id: u.id
-        }), f && await t.adapters.userRoles.create(
-          e,
-          d.sub,
-          f,
-          u.id
+        await e.adapters.userOrganizations.create(a, {
+          user_id: o.sub,
+          organization_id: f.id
+        }), d && await e.adapters.userRoles.create(
+          a,
+          o.sub,
+          d,
+          f.id
           // organizationId
         );
       } catch (p) {
         console.warn(
-          `Failed to add creator ${d.sub} to organization ${u.id}:`,
+          `Failed to add creator ${o.sub} to organization ${f.id}:`,
           p
         );
       }
   }
-  r && r.length > 0 && console.log(
-    `Would assign roles ${r.join(", ")} to organization ${u.id}`
-  ), n && n.length > 0 && console.log(
-    `Would grant permissions ${n.join(", ")} to organization ${u.id}`
+  n && n.length > 0 && console.log(
+    `Would assign roles ${n.join(", ")} to organization ${f.id}`
+  ), i && i.length > 0 && console.log(
+    `Would grant permissions ${i.join(", ")} to organization ${f.id}`
   );
 }
-async function x(t, a, i, e) {
-  const r = (await t.adapters.roles.list(a, {})).roles.find((s) => s.name === i);
-  if (r)
-    return r.id;
-  const l = await t.adapters.roles.create(a, {
-    name: i,
-    description: e
-  }), o = L, c = G.map((s) => ({
-    role_id: l.id,
-    resource_server_identifier: o,
-    permission_name: s.value
+async function x(e, t, s, a) {
+  const n = (await e.adapters.roles.list(t, {})).roles.find((r) => r.name === s);
+  if (n)
+    return n.id;
+  const u = await e.adapters.roles.create(t, {
+    name: s,
+    description: a
+  }), l = G, c = W.map((r) => ({
+    role_id: u.id,
+    resource_server_identifier: l,
+    permission_name: r.value
   }));
-  return await t.adapters.rolePermissions.assign(
-    a,
-    l.id,
+  return await e.adapters.rolePermissions.assign(
+    t,
+    u.id,
     c
-  ), l.id;
+  ), u.id;
 }
-async function ee(t, a, i) {
-  const { accessControl: e, settingsInheritance: n } = i;
-  if (!e)
+async function ee(e, t, s) {
+  const { accessControl: a, settingsInheritance: i } = s;
+  if (!a)
     return;
-  const r = await t.adapters.tenants.get(
-    e.controlPlaneTenantId
+  const n = await e.adapters.tenants.get(
+    a.controlPlaneTenantId
   );
-  if (!r)
+  if (!n)
     return;
-  let l = { ...r };
-  const o = [
+  let u = { ...n };
+  const l = [
     "id",
     "created_at",
     "updated_at",
@@ -196,162 +195,162 @@ async function ee(t, a, i) {
     "sender_email",
     "sender_name"
   ];
-  for (const c of o)
-    delete l[c];
-  if (n != null && n.inheritedKeys) {
+  for (const c of l)
+    delete u[c];
+  if (i != null && i.inheritedKeys) {
     const c = {};
-    for (const s of n.inheritedKeys)
-      s in r && !o.includes(s) && (c[s] = r[s]);
-    l = c;
+    for (const r of i.inheritedKeys)
+      r in n && !l.includes(r) && (c[r] = n[r]);
+    u = c;
   }
-  if (n != null && n.excludedKeys)
-    for (const c of n.excludedKeys)
-      delete l[c];
-  n != null && n.transformSettings && (l = n.transformSettings(
-    l,
-    a.id
-  )), Object.keys(l).length > 0 && await t.adapters.tenants.update(a.id, l);
+  if (i != null && i.excludedKeys)
+    for (const c of i.excludedKeys)
+      delete u[c];
+  i != null && i.transformSettings && (u = i.transformSettings(
+    u,
+    t.id
+  )), Object.keys(u).length > 0 && await e.adapters.tenants.update(t.id, u);
 }
-function te(t) {
+function te(e) {
   const {
-    controlPlaneTenantId: a,
-    getChildTenantIds: i,
-    getAdapters: e,
-    shouldSync: n = () => !0,
-    transformForSync: r
-  } = t;
-  async function l(s, u, f) {
-    return (await s.resourceServers.list(u, {
-      q: `identifier:${f}`,
+    controlPlaneTenantId: t,
+    getChildTenantIds: s,
+    getAdapters: a,
+    shouldSync: i = () => !0,
+    transformForSync: n
+  } = e;
+  async function u(r, f, d) {
+    return (await r.resourceServers.list(f, {
+      q: `identifier:${d}`,
       per_page: 1
     })).resource_servers[0] ?? null;
   }
-  async function o(s, u) {
-    const f = await i();
+  async function l(r, f) {
+    const d = await s();
     await Promise.all(
-      f.map(async (d) => {
+      d.map(async (o) => {
         try {
-          const p = await e(d), y = { ...r ? r(s, d) : {
-            name: s.name,
-            identifier: s.identifier,
-            scopes: s.scopes,
-            signing_alg: s.signing_alg,
-            signing_secret: s.signing_secret,
-            token_lifetime: s.token_lifetime,
-            token_lifetime_for_web: s.token_lifetime_for_web,
-            skip_consent_for_verifiable_first_party_clients: s.skip_consent_for_verifiable_first_party_clients,
-            allow_offline_access: s.allow_offline_access,
-            verificationKey: s.verificationKey,
-            options: s.options
+          const p = await a(o), h = { ...n ? n(r, o) : {
+            name: r.name,
+            identifier: r.identifier,
+            scopes: r.scopes,
+            signing_alg: r.signing_alg,
+            signing_secret: r.signing_secret,
+            token_lifetime: r.token_lifetime,
+            token_lifetime_for_web: r.token_lifetime_for_web,
+            skip_consent_for_verifiable_first_party_clients: r.skip_consent_for_verifiable_first_party_clients,
+            allow_offline_access: r.allow_offline_access,
+            verificationKey: r.verificationKey,
+            options: r.options
           }, is_system: !0 };
-          if (u === "create") {
-            const T = await l(
+          if (f === "create") {
+            const T = await u(
               p,
-              d,
-              s.identifier
+              o,
+              r.identifier
             );
             T && T.id ? await p.resourceServers.update(
-              d,
+              o,
               T.id,
-              y
-            ) : await p.resourceServers.create(d, y);
+              h
+            ) : await p.resourceServers.create(o, h);
           } else {
-            const T = await l(
+            const T = await u(
               p,
-              d,
-              s.identifier
+              o,
+              r.identifier
             );
-            T && T.id && await p.resourceServers.update(
-              d,
+            T && T.id ? await p.resourceServers.update(
+              o,
               T.id,
-              y
-            );
+              h
+            ) : await p.resourceServers.create(o, h);
           }
         } catch (p) {
           console.error(
-            `Failed to sync resource server "${s.identifier}" to tenant "${d}":`,
+            `Failed to sync resource server "${r.identifier}" to tenant "${o}":`,
             p
           );
         }
       })
     );
   }
-  async function c(s) {
-    const u = await i();
+  async function c(r) {
+    const f = await s();
     await Promise.all(
-      u.map(async (f) => {
+      f.map(async (d) => {
         try {
-          const d = await e(f), p = await l(
+          const o = await a(d), p = await u(
+            o,
             d,
-            f,
-            s
+            r
           );
-          p && p.id && await d.resourceServers.remove(f, p.id);
-        } catch (d) {
+          p && p.id && await o.resourceServers.remove(d, p.id);
+        } catch (o) {
           console.error(
-            `Failed to delete resource server "${s}" from tenant "${f}":`,
-            d
+            `Failed to delete resource server "${r}" from tenant "${d}":`,
+            o
           );
         }
       })
     );
   }
   return {
-    afterCreate: async (s, u) => {
-      s.tenantId === a && n(u) && await o(u, "create");
+    afterCreate: async (r, f) => {
+      r.tenantId === t && i(f) && await l(f, "create");
     },
-    afterUpdate: async (s, u, f) => {
-      s.tenantId === a && n(f) && await o(f, "update");
+    afterUpdate: async (r, f, d) => {
+      r.tenantId === t && i(d) && await l(d, "update");
     },
-    afterDelete: async (s, u) => {
-      s.tenantId === a && await c(u);
+    afterDelete: async (r, f) => {
+      r.tenantId === t && await c(f);
     }
   };
 }
-function ae(t) {
+function ae(e) {
   const {
-    controlPlaneTenantId: a,
-    getControlPlaneAdapters: i,
-    getAdapters: e,
-    shouldSync: n = () => !0,
-    transformForSync: r
-  } = t;
+    controlPlaneTenantId: t,
+    getControlPlaneAdapters: s,
+    getAdapters: a,
+    shouldSync: i = () => !0,
+    transformForSync: n
+  } = e;
   return {
-    async afterCreate(l, o) {
-      if (o.id !== a)
+    async afterCreate(u, l) {
+      if (l.id !== t)
         try {
-          const c = await i(), s = await e(o.id), u = await z(
-            (f) => c.resourceServers.list(
-              a,
-              f
+          const c = await s(), r = await a(l.id), f = await S(
+            (d) => c.resourceServers.list(
+              t,
+              d
             ),
             "resource_servers",
             { cursorField: "id", pageSize: 100 }
           );
           await Promise.all(
-            u.filter((f) => n(f)).map(async (f) => {
-              const d = f;
+            f.filter((d) => i(d)).map(async (d) => {
+              const o = d;
               try {
-                const p = r ? r(d, o.id) : {
-                  name: d.name,
-                  identifier: d.identifier,
-                  scopes: d.scopes,
-                  signing_alg: d.signing_alg,
-                  signing_secret: d.signing_secret,
-                  token_lifetime: d.token_lifetime,
-                  token_lifetime_for_web: d.token_lifetime_for_web,
-                  skip_consent_for_verifiable_first_party_clients: d.skip_consent_for_verifiable_first_party_clients,
-                  allow_offline_access: d.allow_offline_access,
-                  verificationKey: d.verificationKey,
-                  options: d.options
+                const p = n ? n(o, l.id) : {
+                  name: o.name,
+                  identifier: o.identifier,
+                  scopes: o.scopes,
+                  signing_alg: o.signing_alg,
+                  signing_secret: o.signing_secret,
+                  token_lifetime: o.token_lifetime,
+                  token_lifetime_for_web: o.token_lifetime_for_web,
+                  skip_consent_for_verifiable_first_party_clients: o.skip_consent_for_verifiable_first_party_clients,
+                  allow_offline_access: o.allow_offline_access,
+                  verificationKey: o.verificationKey,
+                  options: o.options
                 };
-                await s.resourceServers.create(o.id, {
+                await r.resourceServers.create(l.id, {
                   ...p,
                   is_system: !0
                 });
               } catch (p) {
                 console.error(
-                  `Failed to sync resource server "${d.identifier}" to new tenant "${o.id}":`,
+                  `Failed to sync resource server "${o.identifier}" to new tenant "${l.id}":`,
                   p
                 );
               }
@@ -359,305 +358,152 @@ function ae(t) {
           );
         } catch (c) {
           console.error(
-            `Failed to sync resource servers to new tenant "${o.id}":`,
+            `Failed to sync resource servers to new tenant "${l.id}":`,
             c
           );
         }
     }
   };
 }
-function ne(t) {
+function ne(e) {
   const {
-    controlPlaneTenantId: a,
-    getChildTenantIds: i,
-    getAdapters: e,
-    shouldSync: n = () => !0,
-    transformForSync: r
-  } = t;
-  async function l(c, s, u) {
-    return (await c.roles.list(s, {
-      q: `name:${u}`,
+    controlPlaneTenantId: t,
+    getChildTenantIds: s,
+    getAdapters: a,
+    shouldSync: i = () => !0,
+    transformForSync: n
+  } = e;
+  async function u(c, r, f) {
+    return (await c.roles.list(r, {
+      q: `name:${f}`,
       per_page: 1
     })).roles[0] ?? null;
   }
-  async function o(c, s) {
-    const u = await i();
+  async function l(c, r) {
+    const f = await s();
     await Promise.all(
-      u.map(async (f) => {
+      f.map(async (d) => {
         try {
-          const d = await e(f), _ = { ...r ? r(c, f) : {
+          const o = await a(d), g = { ...n ? n(c, d) : {
             name: c.name,
             description: c.description
           }, is_system: !0 };
-          if (s === "create") {
-            const y = await l(d, f, c.name);
-            y && y.id ? await d.roles.update(
-              f,
-              y.id,
-              _
-            ) : await d.roles.create(f, _);
+          if (r === "create") {
+            const h = await u(o, d, c.name);
+            h && h.id ? await o.roles.update(
+              d,
+              h.id,
+              g
+            ) : await o.roles.create(d, g);
           } else {
-            const y = await l(d, f, c.name);
-            y && y.id && await d.roles.update(
-              f,
-              y.id,
-              _
-            );
+            const h = await u(o, d, c.name);
+            h && h.id ? await o.roles.update(
+              d,
+              h.id,
+              g
+            ) : await o.roles.create(d, g);
           }
-        } catch (d) {
+        } catch (o) {
           console.error(
-            `Failed to sync role "${c.name}" to tenant "${f}":`,
-            d
+            `Failed to sync role "${c.name}" to tenant "${d}":`,
+            o
           );
         }
       })
     );
   }
   return {
-    afterCreate: async (c, s) => {
-      c.tenantId === a && n(s) && await o(s, "create");
+    afterCreate: async (c, r) => {
+      c.tenantId === t && i(r) && await l(r, "create");
     },
-    afterUpdate: async (c, s, u) => {
-      c.tenantId === a && n(u) && await o(u, "update");
+    afterUpdate: async (c, r, f) => {
+      c.tenantId === t && i(f) && await l(f, "update");
     },
-    afterDelete: async (c, s) => {
-      c.tenantId === a && console.warn(
-        `Role ${s} was deleted from control plane. Child tenant roles with matching names should be deleted manually or implement role name tracking.`
+    afterDelete: async (c, r) => {
+      c.tenantId === t && console.warn(
+        `Role ${r} was deleted from control plane. Child tenant roles with matching names should be deleted manually or implement role name tracking.`
       );
     }
   };
 }
-function se(t) {
+function re(e) {
   const {
-    controlPlaneTenantId: a,
-    getControlPlaneAdapters: i,
-    getAdapters: e,
-    shouldSync: n = () => !0,
-    transformForSync: r,
-    syncPermissions: l = !0
-  } = t;
+    controlPlaneTenantId: t,
+    getControlPlaneAdapters: s,
+    getAdapters: a,
+    shouldSync: i = () => !0,
+    transformForSync: n,
+    syncPermissions: u = !0
+  } = e;
   return {
-    async afterCreate(o, c) {
-      if (c.id !== a)
+    async afterCreate(l, c) {
+      if (c.id !== t)
         try {
-          const s = await i(), u = await e(c.id), f = await z(
-            (p) => s.roles.list(a, p),
+          const r = await s(), f = await a(c.id), d = await S(
+            (p) => r.roles.list(t, p),
             "roles",
             { cursorField: "id", pageSize: 100 }
-          ), d = /* @__PURE__ */ new Map();
+          ), o = /* @__PURE__ */ new Map();
           if (await Promise.all(
-            f.filter((p) => n(p)).map(async (p) => {
-              const _ = p;
+            d.filter((p) => i(p)).map(async (p) => {
+              const g = p;
               try {
-                const y = r ? r(_, c.id) : {
-                  name: _.name,
-                  description: _.description
-                }, T = await u.roles.create(c.id, {
-                  ...y,
+                const h = n ? n(g, c.id) : {
+                  name: g.name,
+                  description: g.description
+                }, T = await f.roles.create(c.id, {
+                  ...h,
                   is_system: !0
                 });
-                d.set(_.id, T.id);
-              } catch (y) {
+                o.set(g.id, T.id);
+              } catch (h) {
                 console.error(
-                  `Failed to sync role "${_.name}" to new tenant "${c.id}":`,
-                  y
+                  `Failed to sync role "${g.name}" to new tenant "${c.id}":`,
+                  h
                 );
               }
             })
-          ), l)
-            for (const [p, _] of d)
+          ), u)
+            for (const [p, g] of o)
               try {
-                const y = await s.rolePermissions.list(
-                  a,
+                const h = await r.rolePermissions.list(
+                  t,
                   p,
                   {}
                 );
-                y.length > 0 && await u.rolePermissions.assign(
+                h.length > 0 && await f.rolePermissions.assign(
                   c.id,
-                  _,
-                  y.map((T) => ({
-                    role_id: _,
+                  g,
+                  h.map((T) => ({
+                    role_id: g,
                     resource_server_identifier: T.resource_server_identifier,
                     permission_name: T.permission_name
                   }))
                 );
-              } catch (y) {
+              } catch (h) {
                 console.error(
                   `Failed to sync permissions for role to new tenant "${c.id}":`,
-                  y
+                  h
                 );
               }
-        } catch (s) {
+        } catch (r) {
           console.error(
             `Failed to sync roles to new tenant "${c.id}":`,
-            s
+            r
           );
         }
     }
   };
 }
-function M(t, a) {
-  const i = new U();
-  return i.get("/", async (e) => {
-    var f, d;
-    const n = F.parse(e.req.query()), { page: r, per_page: l, include_totals: o, q: c } = n, s = e.var.user;
-    if (t.accessControl && (s != null && s.sub)) {
-      const p = t.accessControl.controlPlaneTenantId, y = (await e.env.data.userOrganizations.listUserOrganizations(
-        p,
-        s.sub,
-        {}
-      )).organizations.map((A) => A.name), T = await e.env.data.tenants.list({
-        page: r,
-        per_page: l,
-        include_totals: o,
-        q: c
-      }), P = T.tenants.filter(
-        (A) => y.includes(A.id)
-      );
-      return o ? e.json({
-        tenants: P,
-        start: ((f = T.totals) == null ? void 0 : f.start) ?? 0,
-        limit: ((d = T.totals) == null ? void 0 : d.limit) ?? l,
-        length: P.length
-      }) : e.json(P);
-    }
-    const u = await e.env.data.tenants.list({
-      page: r,
-      per_page: l,
-      include_totals: o,
-      q: c
-    });
-    return o ? e.json(u) : e.json(u.tenants);
-  }), i.get("/:id", async (e) => {
-    const n = e.req.param("id");
-    if (t.accessControl) {
-      const l = e.var.user, o = t.accessControl.controlPlaneTenantId;
-      if (n !== o) {
-        if (!(l != null && l.sub))
-          throw new w(401, {
-            message: "Authentication required"
-          });
-        if (!(await e.env.data.userOrganizations.listUserOrganizations(
-          o,
-          l.sub,
-          {}
-        )).organizations.some((u) => u.name === n))
-          throw new w(403, {
-            message: "Access denied to this tenant"
-          });
-      }
-    }
-    const r = await e.env.data.tenants.get(n);
-    if (!r)
-      throw new w(404, {
-        message: "Tenant not found"
-      });
-    return e.json(r);
-  }), i.post("/", async (e) => {
-    var n, r, l;
-    try {
-      const o = e.var.user;
-      if (!(o != null && o.sub))
-        throw new w(401, {
-          message: "Authentication required to create tenants"
-        });
-      let c = j.parse(
-        await e.req.json()
-      );
-      const s = {
-        adapters: e.env.data,
-        ctx: e
-      };
-      (n = a.tenants) != null && n.beforeCreate && (c = await a.tenants.beforeCreate(s, c));
-      const u = await e.env.data.tenants.create(c);
-      return (r = a.tenants) != null && r.afterCreate && await a.tenants.afterCreate(s, u), e.json(u, 201);
-    } catch (o) {
-      throw o instanceof V.ZodError ? new w(400, {
-        message: "Validation error",
-        cause: o
-      }) : o instanceof Error && ("code" in o && o.code === "SQLITE_CONSTRAINT_PRIMARYKEY" || (l = o.message) != null && l.includes("UNIQUE constraint failed")) ? new w(409, {
-        message: "Tenant with this ID already exists"
-      }) : o;
-    }
-  }), i.patch("/:id", async (e) => {
-    var d, p;
-    const n = e.req.param("id");
-    if (t.accessControl) {
-      const _ = e.var.user;
-      if (!(_ != null && _.sub))
-        throw new w(401, {
-          message: "Authentication required to update tenants"
-        });
-      const y = t.accessControl.controlPlaneTenantId;
-      if (n !== y && !(await e.env.data.userOrganizations.listUserOrganizations(
-        y,
-        _.sub,
-        {}
-      )).organizations.some((A) => A.name === n))
-        throw new w(403, {
-          message: "Access denied to update this tenant"
-        });
-    }
-    const r = j.partial().parse(await e.req.json()), { id: l, ...o } = r;
-    if (!await e.env.data.tenants.get(n))
-      throw new w(404, {
-        message: "Tenant not found"
-      });
-    const s = {
-      adapters: e.env.data,
-      ctx: e
-    };
-    let u = o;
-    (d = a.tenants) != null && d.beforeUpdate && (u = await a.tenants.beforeUpdate(s, n, o)), await e.env.data.tenants.update(n, u);
-    const f = await e.env.data.tenants.get(n);
-    if (!f)
-      throw new w(404, {
-        message: "Tenant not found after update"
-      });
-    return (p = a.tenants) != null && p.afterUpdate && await a.tenants.afterUpdate(s, f), e.json(f);
-  }), i.delete("/:id", async (e) => {
-    var o, c;
-    const n = e.req.param("id");
-    if (t.accessControl && n === t.accessControl.controlPlaneTenantId)
-      throw new w(400, {
-        message: "Cannot delete the control plane"
-      });
-    if (t.accessControl) {
-      const s = e.var.user;
-      if (!(s != null && s.sub))
-        throw new w(401, {
-          message: "Authentication required to delete tenants"
-        });
-      const u = t.accessControl.controlPlaneTenantId;
-      if (!(await e.env.data.userOrganizations.listUserOrganizations(
-        u,
-        s.sub,
-        {}
-      )).organizations.some((p) => p.name === n))
-        throw new w(403, {
-          message: "Access denied to delete this tenant"
-        });
-    }
-    if (!await e.env.data.tenants.get(n))
-      throw new w(404, {
-        message: "Tenant not found"
-      });
-    const l = {
-      adapters: e.env.data,
-      ctx: e
-    };
-    return (o = a.tenants) != null && o.beforeDelete && await a.tenants.beforeDelete(l, n), await e.env.data.tenants.remove(n), (c = a.tenants) != null && c.afterDelete && await a.tenants.afterDelete(l, n), e.body(null, 204);
-  }), i;
-}
-function re(t, a) {
-  const i = new Y();
-  return i.openapi(
-    S({
+function j(e, t) {
+  const s = new Q();
+  return s.openapi(
+    M({
       tags: ["tenants"],
       method: "get",
       path: "/",
       request: {
-        query: F
+        query: V
       },
       security: [
         {
@@ -668,11 +514,11 @@ function re(t, a) {
         200: {
           content: {
             "application/json": {
-              schema: C.object({
-                tenants: C.array($),
-                start: C.number().optional(),
-                limit: C.number().optional(),
-                length: C.number().optional()
+              schema: P.object({
+                tenants: P.array(O),
+                start: P.number().optional(),
+                limit: P.number().optional(),
+                length: P.number().optional()
               })
             }
           },
@@ -680,105 +526,75 @@ function re(t, a) {
         }
       }
     }),
-    async (e) => {
-      var f, d, p, _;
-      const n = e.req.valid("query"), { page: r, per_page: l, include_totals: o, q: c } = n, s = e.var.user;
-      if (t.accessControl && (s != null && s.sub)) {
-        const y = t.accessControl.controlPlaneTenantId, P = (await z(
-          (I) => e.env.data.userOrganizations.listUserOrganizations(
-            y,
-            s.sub,
-            I
+    async (a) => {
+      var p, g, h, T;
+      const i = a.req.valid("query"), { page: n, per_page: u, include_totals: l, q: c } = i, r = a.var.user, f = ((r == null ? void 0 : r.scope) || "").split(" "), d = f.includes("auth:read");
+      if (console.log("User scopes:", f, "hasAuthRead:", d), d) {
+        const b = await a.env.data.tenants.list({
+          page: n,
+          per_page: u,
+          include_totals: l,
+          q: c
+        });
+        return l ? a.json({
+          tenants: b.tenants,
+          start: ((p = b.totals) == null ? void 0 : p.start) ?? 0,
+          limit: ((g = b.totals) == null ? void 0 : g.limit) ?? u,
+          length: b.tenants.length
+        }) : a.json({ tenants: b.tenants });
+      }
+      if (e.accessControl && (r != null && r.sub)) {
+        const b = e.accessControl.controlPlaneTenantId, $ = (await S(
+          (R) => a.env.data.userOrganizations.listUserOrganizations(
+            b,
+            r.sub,
+            R
           ),
           "organizations"
-        )).map((I) => I.name), A = await e.env.data.tenants.list({
-          page: r,
-          per_page: l,
-          include_totals: o,
-          q: c
-        }), O = A.tenants.filter(
-          (I) => P.includes(I.id)
-        );
-        return o ? e.json({
-          tenants: O,
-          start: ((f = A.totals) == null ? void 0 : f.start) ?? 0,
-          limit: ((d = A.totals) == null ? void 0 : d.limit) ?? l,
-          length: O.length
-        }) : e.json({ tenants: O });
+        )).map((R) => R.name);
+        if ($.length === 0)
+          return l ? a.json({
+            tenants: [],
+            start: 0,
+            limit: u ?? 50,
+            length: 0
+          }) : a.json({ tenants: [] });
+        const z = $.length, F = n ?? 0, v = u ?? 50, w = F * v, m = $.slice(w, w + v);
+        if (m.length === 0)
+          return l ? a.json({
+            tenants: [],
+            start: w,
+            limit: v,
+            length: z
+          }) : a.json({ tenants: [] });
+        const y = m.map((R) => `id:${R}`).join(" OR "), _ = c ? `(${y}) AND (${c})` : y, A = await a.env.data.tenants.list({
+          q: _,
+          per_page: v,
+          include_totals: !1
+          // We calculate totals from accessibleTenantIds
+        });
+        return l ? a.json({
+          tenants: A.tenants,
+          start: w,
+          limit: v,
+          length: z
+        }) : a.json({ tenants: A.tenants });
       }
-      const u = await e.env.data.tenants.list({
-        page: r,
-        per_page: l,
-        include_totals: o,
+      const o = await a.env.data.tenants.list({
+        page: n,
+        per_page: u,
+        include_totals: l,
         q: c
       });
-      return o ? e.json({
-        tenants: u.tenants,
-        start: ((p = u.totals) == null ? void 0 : p.start) ?? 0,
-        limit: ((_ = u.totals) == null ? void 0 : _.limit) ?? l,
-        length: u.tenants.length
-      }) : e.json({ tenants: u.tenants });
-    }
-  ), i.openapi(
-    S({
-      tags: ["tenants"],
-      method: "get",
-      path: "/{id}",
-      request: {
-        params: C.object({
-          id: C.string()
-        })
-      },
-      security: [
-        {
-          Bearer: []
-        }
-      ],
-      responses: {
-        200: {
-          content: {
-            "application/json": {
-              schema: $
-            }
-          },
-          description: "Tenant details"
-        },
-        404: {
-          description: "Tenant not found"
-        }
-      }
-    }),
-    async (e) => {
-      const { id: n } = e.req.valid("param");
-      if (t.accessControl) {
-        const l = e.var.user, o = t.accessControl.controlPlaneTenantId;
-        if (n !== o) {
-          if (!(l != null && l.sub))
-            throw new w(401, {
-              message: "Authentication required"
-            });
-          if (!(await z(
-            (u) => e.env.data.userOrganizations.listUserOrganizations(
-              o,
-              l.sub,
-              u
-            ),
-            "organizations"
-          )).some((u) => u.name === n))
-            throw new w(403, {
-              message: "Access denied to this tenant"
-            });
-        }
-      }
-      const r = await e.env.data.tenants.get(n);
-      if (!r)
-        throw new w(404, {
-          message: "Tenant not found"
-        });
-      return e.json(r);
+      return l ? a.json({
+        tenants: o.tenants,
+        start: ((h = o.totals) == null ? void 0 : h.start) ?? 0,
+        limit: ((T = o.totals) == null ? void 0 : T.limit) ?? u,
+        length: o.tenants.length
+      }) : a.json({ tenants: o.tenants });
     }
-  ), i.openapi(
-    S({
+  ), s.openapi(
+    M({
       tags: ["tenants"],
       method: "post",
       path: "/",
@@ -786,7 +602,7 @@ function re(t, a) {
         body: {
           content: {
             "application/json": {
-              schema: j
+              schema: J
             }
           }
         }
@@ -800,121 +616,43 @@ function re(t, a) {
         201: {
           content: {
             "application/json": {
-              schema: $
+              schema: O
             }
           },
           description: "Tenant created"
         },
         400: {
           description: "Validation error"
-        }
-      }
-    }),
-    async (e) => {
-      var c, s;
-      const n = e.var.user;
-      if (!(n != null && n.sub))
-        throw new w(401, {
-          message: "Authentication required to create tenants"
-        });
-      let r = e.req.valid("json");
-      const l = {
-        adapters: e.env.data,
-        ctx: e
-      };
-      (c = a.tenants) != null && c.beforeCreate && (r = await a.tenants.beforeCreate(l, r));
-      const o = await e.env.data.tenants.create(r);
-      return (s = a.tenants) != null && s.afterCreate && await a.tenants.afterCreate(l, o), e.json(o, 201);
-    }
-  ), i.openapi(
-    S({
-      tags: ["tenants"],
-      method: "patch",
-      path: "/{id}",
-      request: {
-        params: C.object({
-          id: C.string()
-        }),
-        body: {
-          content: {
-            "application/json": {
-              schema: C.object(j.shape).partial()
-            }
-          }
-        }
-      },
-      security: [
-        {
-          Bearer: ["update:tenants"]
-        }
-      ],
-      responses: {
-        200: {
-          content: {
-            "application/json": {
-              schema: $
-            }
-          },
-          description: "Tenant updated"
-        },
-        403: {
-          description: "Access denied"
         },
-        404: {
-          description: "Tenant not found"
+        409: {
+          description: "Tenant with this ID already exists"
         }
       }
     }),
-    async (e) => {
-      var u, f;
-      const { id: n } = e.req.valid("param");
-      if (t.accessControl) {
-        const d = e.var.user, p = t.accessControl.controlPlaneTenantId;
-        if (!(d != null && d.sub))
-          throw new w(401, {
-            message: "Authentication required"
-          });
-        if (n !== p && !(await z(
-          (T) => e.env.data.userOrganizations.listUserOrganizations(
-            p,
-            d.sub,
-            T
-          ),
-          "organizations"
-        )).some((T) => T.name === n))
-          throw new w(403, {
-            message: "Access denied to this tenant"
-          });
-      }
-      if (!await e.env.data.tenants.get(n))
-        throw new w(404, {
-          message: "Tenant not found"
+    async (a) => {
+      var c, r;
+      const i = a.var.user;
+      if (!(i != null && i.sub))
+        throw new C(401, {
+          message: "Authentication required to create tenants"
         });
-      const l = e.req.valid("json"), o = {
-        adapters: e.env.data,
-        ctx: e
+      let n = a.req.valid("json");
+      const u = {
+        adapters: a.env.data,
+        ctx: a
       };
-      let c = l;
-      (u = a.tenants) != null && u.beforeUpdate && (c = await a.tenants.beforeUpdate(
-        o,
-        n,
-        l
-      )), await e.env.data.tenants.update(n, c);
-      const s = await e.env.data.tenants.get(n);
-      if (!s)
-        throw new w(500, {
-          message: "Failed to retrieve updated tenant"
-        });
-      return (f = a.tenants) != null && f.afterUpdate && await a.tenants.afterUpdate(o, s), e.json(s);
+      (c = t.tenants) != null && c.beforeCreate && (n = await t.tenants.beforeCreate(u, n));
+      const l = await a.env.data.tenants.create(n);
+      return (r = t.tenants) != null && r.afterCreate && await t.tenants.afterCreate(u, l), a.json(l, 201);
     }
-  ), i.openapi(
-    S({
+  ), s.openapi(
+    M({
       tags: ["tenants"],
       method: "delete",
       path: "/{id}",
       request: {
-        params: C.object({
-          id: C.string()
+        params: P.object({
+          id: P.string()
         })
       },
       security: [
@@ -934,45 +672,45 @@ function re(t, a) {
         }
       }
     }),
-    async (e) => {
-      var o, c;
-      const { id: n } = e.req.valid("param");
-      if (t.accessControl) {
-        const s = e.var.user, u = t.accessControl.controlPlaneTenantId;
-        if (!(s != null && s.sub))
-          throw new w(401, {
+    async (a) => {
+      var l, c;
+      const { id: i } = a.req.valid("param");
+      if (e.accessControl) {
+        const r = a.var.user, f = e.accessControl.controlPlaneTenantId;
+        if (!(r != null && r.sub))
+          throw new C(401, {
             message: "Authentication required"
           });
-        if (n === u)
-          throw new w(403, {
+        if (i === f)
+          throw new C(403, {
             message: "Cannot delete the control plane"
           });
-        if (!(await z(
-          (p) => e.env.data.userOrganizations.listUserOrganizations(
-            u,
-            s.sub,
+        if (!(await S(
+          (p) => a.env.data.userOrganizations.listUserOrganizations(
+            f,
+            r.sub,
             p
           ),
           "organizations"
-        )).some((p) => p.name === n))
-          throw new w(403, {
+        )).some((p) => p.name === i))
+          throw new C(403, {
             message: "Access denied to this tenant"
           });
       }
-      if (!await e.env.data.tenants.get(n))
-        throw new w(404, {
+      if (!await a.env.data.tenants.get(i))
+        throw new C(404, {
           message: "Tenant not found"
         });
-      const l = {
-        adapters: e.env.data,
-        ctx: e
+      const u = {
+        adapters: a.env.data,
+        ctx: a
       };
-      return (o = a.tenants) != null && o.beforeDelete && await a.tenants.beforeDelete(l, n), await e.env.data.tenants.remove(n), (c = a.tenants) != null && c.afterDelete && await a.tenants.afterDelete(l, n), e.body(null, 204);
+      return (l = t.tenants) != null && l.beforeDelete && await t.tenants.beforeDelete(u, i), await a.env.data.tenants.remove(i), (c = t.tenants) != null && c.afterDelete && await t.tenants.afterDelete(u, i), a.body(null, 204);
     }
-  ), i;
+  ), s;
 }
-function ie(t) {
-  const a = [
+function se(e) {
+  const t = [
     {
       pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
       type: "resource_server"
@@ -980,27 +718,27 @@ function ie(t) {
     { pattern: /\/api\/v2\/roles\/([^/]+)$/, type: "role" },
     { pattern: /\/api\/v2\/connections\/([^/]+)$/, type: "connection" }
   ];
-  for (const { pattern: i, type: e } of a) {
-    const n = t.match(i);
-    if (n && n[1])
-      return { type: e, id: n[1] };
+  for (const { pattern: s, type: a } of t) {
+    const i = e.match(s);
+    if (i && i[1])
+      return { type: a, id: i[1] };
   }
   return null;
 }
-async function oe(t, a, i) {
+async function ie(e, t, s) {
   try {
-    switch (i.type) {
+    switch (s.type) {
       case "resource_server": {
-        const e = await t.resourceServers.get(a, i.id);
-        return (e == null ? void 0 : e.is_system) === !0;
+        const a = await e.resourceServers.get(t, s.id);
+        return (a == null ? void 0 : a.is_system) === !0;
       }
       case "role": {
-        const e = await t.roles.get(a, i.id);
-        return (e == null ? void 0 : e.is_system) === !0;
+        const a = await e.roles.get(t, s.id);
+        return (a == null ? void 0 : a.is_system) === !0;
       }
       case "connection": {
-        const e = await t.connections.get(a, i.id);
-        return (e == null ? void 0 : e.is_system) === !0;
+        const a = await e.connections.get(t, s.id);
+        return (a == null ? void 0 : a.is_system) === !0;
       }
       default:
         return !1;
@@ -1009,382 +747,382 @@ async function oe(t, a, i) {
     return !1;
   }
 }
-function ce(t) {
+function oe(e) {
   return {
     resource_server: "resource server",
     role: "role",
     connection: "connection"
-  }[t];
+  }[e];
 }
-function de() {
-  return async (t, a) => {
-    if (!["PATCH", "PUT", "DELETE"].includes(t.req.method))
-      return a();
-    const i = ie(t.req.path);
-    if (!i)
-      return a();
-    const e = t.var.tenant_id || t.req.header("x-tenant-id") || t.req.header("tenant-id");
-    if (!e)
-      return a();
-    if (await oe(t.env.data, e, i))
-      throw new w(403, {
-        message: `This ${ce(i.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
+function ce() {
+  return async (e, t) => {
+    if (!["PATCH", "PUT", "DELETE"].includes(e.req.method))
+      return t();
+    const s = se(e.req.path);
+    if (!s)
+      return t();
+    const a = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
+    if (!a)
+      return t();
+    if (await ie(e.env.data, a, s))
+      throw new C(403, {
+        message: `This ${oe(s.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
       });
-    return a();
+    return t();
   };
 }
-function le(t) {
-  return async (a, i) => {
-    if (!t.accessControl)
-      return i();
-    const e = a.var.tenant_id, n = a.var.organization_id;
-    if (!e)
-      throw new w(400, {
+function le(e) {
+  return async (t, s) => {
+    if (!e.accessControl)
+      return s();
+    const a = t.var.tenant_id, i = t.var.organization_id;
+    if (!a)
+      throw new C(400, {
         message: "Tenant ID not found in request"
       });
-    if (!J(
-      n,
-      e,
-      t.accessControl.controlPlaneTenantId
+    if (!Y(
+      i,
+      a,
+      e.accessControl.controlPlaneTenantId
     ))
-      throw new w(403, {
-        message: `Access denied to tenant ${e}`
+      throw new C(403, {
+        message: `Access denied to tenant ${a}`
       });
-    return i();
+    return s();
   };
 }
-function ue(t) {
-  return async (a, i) => {
-    if (!t.subdomainRouting)
-      return i();
+function de(e) {
+  return async (t, s) => {
+    if (!e.subdomainRouting)
+      return s();
     const {
-      baseDomain: e,
-      reservedSubdomains: n = [],
-      resolveSubdomain: r
-    } = t.subdomainRouting, l = a.req.header("host") || "";
-    let o = null;
-    if (l.endsWith(e)) {
-      const s = l.slice(0, -(e.length + 1));
-      s && !s.includes(".") && (o = s);
+      baseDomain: a,
+      reservedSubdomains: i = [],
+      resolveSubdomain: n
+    } = e.subdomainRouting, u = t.req.header("host") || "";
+    let l = null;
+    if (u.endsWith(a)) {
+      const r = u.slice(0, -(a.length + 1));
+      r && !r.includes(".") && (l = r);
     }
-    if (o && n.includes(o) && (o = null), !o)
-      return t.accessControl && a.set("tenant_id", t.accessControl.controlPlaneTenantId), i();
+    if (l && i.includes(l) && (l = null), !l)
+      return e.accessControl && t.set("tenant_id", e.accessControl.controlPlaneTenantId), s();
     let c = null;
-    if (r)
-      c = await r(o);
-    else if (t.subdomainRouting.useOrganizations !== !1 && t.accessControl)
+    if (n)
+      c = await n(l);
+    else if (e.subdomainRouting.useOrganizations !== !1 && e.accessControl)
       try {
-        const s = await a.env.data.organizations.get(
-          t.accessControl.controlPlaneTenantId,
-          o
+        const r = await t.env.data.organizations.get(
+          e.accessControl.controlPlaneTenantId,
+          l
         );
-        s && (c = s.id);
+        r && (c = r.id);
       } catch {
       }
     if (!c)
-      throw new w(404, {
-        message: `Tenant not found for subdomain: ${o}`
+      throw new C(404, {
+        message: `Tenant not found for subdomain: ${l}`
       });
-    return a.set("tenant_id", c), i();
+    return t.set("tenant_id", c), s();
   };
 }
-function fe(t) {
-  return async (a, i) => {
-    if (!t.databaseIsolation)
-      return i();
-    const e = a.var.tenant_id;
-    if (!e)
-      throw new w(400, {
+function ue(e) {
+  return async (t, s) => {
+    if (!e.databaseIsolation)
+      return s();
+    const a = t.var.tenant_id;
+    if (!a)
+      throw new C(400, {
         message: "Tenant ID not found in request"
       });
     try {
-      const n = await t.databaseIsolation.getAdapters(e);
-      a.env.data = n;
-    } catch (n) {
+      const i = await e.databaseIsolation.getAdapters(a);
+      t.env.data = i;
+    } catch (i) {
       throw console.error(
-        `Failed to resolve database for tenant ${e}:`,
-        n
-      ), new w(500, {
+        `Failed to resolve database for tenant ${a}:`,
+        i
+      ), new C(500, {
         message: "Failed to resolve tenant database"
       });
     }
-    return i();
+    return s();
   };
 }
-function N(t) {
-  const a = ue(t), i = le(t), e = fe(t);
-  return async (n, r) => (await a(n, async () => {
-  }), await i(n, async () => {
-  }), await e(n, async () => {
-  }), r());
+function N(e) {
+  const t = de(e), s = le(e), a = ue(e);
+  return async (i, n) => (await t(i, async () => {
+  }), await s(i, async () => {
+  }), await a(i, async () => {
+  }), n());
 }
-function Te(t) {
-  const a = R(t);
+function ge(e) {
+  const t = I(e);
   return {
     name: "multi-tenancy",
     // Apply multi-tenancy middleware for subdomain routing, database resolution, etc.
-    middleware: N(t),
+    middleware: N(e),
     // Provide lifecycle hooks
-    hooks: a,
+    hooks: t,
     // Mount tenant management routes
     routes: [
       {
         path: "/management",
-        handler: M(t, a)
+        handler: j(e, t)
       }
     ],
     // Called when plugin is registered
     onRegister: async () => {
-      console.log("Multi-tenancy plugin registered"), t.accessControl && console.log(
-        `  - Access control enabled (control plane: ${t.accessControl.controlPlaneTenantId})`
-      ), t.subdomainRouting && console.log(
-        `  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`
-      ), t.databaseIsolation && console.log("  - Database isolation enabled");
+      console.log("Multi-tenancy plugin registered"), e.accessControl && console.log(
+        `  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`
+      ), e.subdomainRouting && console.log(
+        `  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`
+      ), e.databaseIsolation && console.log("  - Database isolation enabled");
     }
   };
 }
-function R(t) {
-  const a = t.accessControl ? Z(t.accessControl) : {}, i = t.databaseIsolation ? X(t.databaseIsolation) : {}, e = H(t);
+function I(e) {
+  const t = e.accessControl ? X(e.accessControl) : {}, s = e.databaseIsolation ? Z(e.databaseIsolation) : {}, a = k(e);
   return {
-    ...a,
-    ...i,
-    tenants: e
+    ...t,
+    ...s,
+    tenants: a
   };
 }
-function pe(t) {
-  const a = new U(), i = R(t);
-  return a.route("/tenants", M(t, i)), a;
+function fe(e) {
+  const t = new U(), s = I(e);
+  return t.route("/tenants", j(e, s)), t;
 }
-function ve(t) {
+function _e(e) {
   return {
-    hooks: R(t),
-    middleware: N(t),
-    app: pe(t),
-    config: t
+    hooks: I(e),
+    middleware: N(e),
+    app: fe(e),
+    config: e
   };
 }
-function be(t) {
+function Te(e) {
   const {
-    controlPlaneTenantId: a = "control_plane",
-    syncResourceServers: i = !0,
-    syncRoles: e = !0,
-    multiTenancy: n,
-    entityHooks: r,
-    ...l
-  } = t, o = {
-    ...n,
+    controlPlaneTenantId: t = "control_plane",
+    syncResourceServers: s = !0,
+    syncRoles: a = !0,
+    multiTenancy: i,
+    entityHooks: n,
+    ...u
+  } = e, l = {
+    ...i,
     accessControl: {
-      controlPlaneTenantId: a,
+      controlPlaneTenantId: t,
       requireOrganizationMatch: !1,
       defaultPermissions: ["tenant:admin"],
-      ...n == null ? void 0 : n.accessControl
+      ...i == null ? void 0 : i.accessControl
     }
-  }, c = R(o);
-  let s, u;
-  i && (s = te({
-    controlPlaneTenantId: a,
-    getChildTenantIds: async () => (await z(
-      (m) => t.dataAdapter.tenants.list(m),
+  }, c = I(l);
+  let r, f;
+  s && (r = te({
+    controlPlaneTenantId: t,
+    getChildTenantIds: async () => (await S(
+      (m) => e.dataAdapter.tenants.list(m),
       "tenants",
       { cursorField: "id", pageSize: 100 }
-    )).filter((m) => m.id !== a).map((m) => m.id),
-    getAdapters: async (g) => t.dataAdapter
-  }), u = ae({
-    controlPlaneTenantId: a,
-    getControlPlaneAdapters: async () => t.dataAdapter,
-    getAdapters: async (g) => t.dataAdapter
+    )).filter((m) => m.id !== t).map((m) => m.id),
+    getAdapters: async (w) => e.dataAdapter
+  }), f = ae({
+    controlPlaneTenantId: t,
+    getControlPlaneAdapters: async () => e.dataAdapter,
+    getAdapters: async (w) => e.dataAdapter
   }));
-  let f, d;
-  e && (f = ne({
-    controlPlaneTenantId: a,
-    getChildTenantIds: async () => (await z(
-      (m) => t.dataAdapter.tenants.list(m),
+  let d, o;
+  a && (d = ne({
+    controlPlaneTenantId: t,
+    getChildTenantIds: async () => (await S(
+      (m) => e.dataAdapter.tenants.list(m),
       "tenants",
       { cursorField: "id", pageSize: 100 }
-    )).filter((m) => m.id !== a).map((m) => m.id),
-    getAdapters: async (g) => t.dataAdapter
-  }), d = se({
-    controlPlaneTenantId: a,
-    getControlPlaneAdapters: async () => t.dataAdapter,
-    getAdapters: async (g) => t.dataAdapter,
+    )).filter((m) => m.id !== t).map((m) => m.id),
+    getAdapters: async (w) => e.dataAdapter
+  }), o = re({
+    controlPlaneTenantId: t,
+    getControlPlaneAdapters: async () => e.dataAdapter,
+    getAdapters: async (w) => e.dataAdapter,
     syncPermissions: !0
   }));
-  const p = async (g, m, ...h) => {
-    const v = [];
-    if (g)
+  const p = async (w, m, ...y) => {
+    const _ = [];
+    if (w)
       try {
-        await g(...h);
-      } catch (b) {
-        v.push(b instanceof Error ? b : new Error(String(b)));
+        await w(...y);
+      } catch (A) {
+        _.push(A instanceof Error ? A : new Error(String(A)));
       }
     if (m)
       try {
-        await m(...h);
-      } catch (b) {
-        v.push(b instanceof Error ? b : new Error(String(b)));
+        await m(...y);
+      } catch (A) {
+        _.push(A instanceof Error ? A : new Error(String(A)));
       }
-    if (v.length === 1)
-      throw v[0];
-    if (v.length > 1)
+    if (_.length === 1)
+      throw _[0];
+    if (_.length > 1)
       throw new AggregateError(
-        v,
-        `Multiple hook errors: ${v.map((b) => b.message).join("; ")}`
+        _,
+        `Multiple hook errors: ${_.map((A) => A.message).join("; ")}`
       );
-  }, _ = async (g, ...m) => {
-    const h = [];
-    for (const v of g)
-      if (v)
+  }, g = async (w, ...m) => {
+    const y = [];
+    for (const _ of w)
+      if (_)
         try {
-          await v(...m);
-        } catch (b) {
-          h.push(
-            b instanceof Error ? b : new Error(String(b))
+          await _(...m);
+        } catch (A) {
+          y.push(
+            A instanceof Error ? A : new Error(String(A))
           );
         }
-    if (h.length === 1)
-      throw h[0];
-    if (h.length > 1)
+    if (y.length === 1)
+      throw y[0];
+    if (y.length > 1)
       throw new AggregateError(
-        h,
-        `Multiple hook errors: ${h.map((v) => v.message).join("; ")}`
+        y,
+        `Multiple hook errors: ${y.map((_) => _.message).join("; ")}`
       );
-  }, y = {
-    ...r,
-    resourceServers: s ? {
-      ...r == null ? void 0 : r.resourceServers,
-      afterCreate: async (g, m) => {
-        var h;
+  }, h = {
+    ...n,
+    resourceServers: r ? {
+      ...n == null ? void 0 : n.resourceServers,
+      afterCreate: async (w, m) => {
+        var y;
         await p(
-          (h = r == null ? void 0 : r.resourceServers) == null ? void 0 : h.afterCreate,
-          s == null ? void 0 : s.afterCreate,
-          g,
+          (y = n == null ? void 0 : n.resourceServers) == null ? void 0 : y.afterCreate,
+          r == null ? void 0 : r.afterCreate,
+          w,
           m
         );
       },
-      afterUpdate: async (g, m, h) => {
-        var v;
+      afterUpdate: async (w, m, y) => {
+        var _;
         await p(
-          (v = r == null ? void 0 : r.resourceServers) == null ? void 0 : v.afterUpdate,
-          s == null ? void 0 : s.afterUpdate,
-          g,
+          (_ = n == null ? void 0 : n.resourceServers) == null ? void 0 : _.afterUpdate,
+          r == null ? void 0 : r.afterUpdate,
+          w,
           m,
-          h
+          y
         );
       },
-      afterDelete: async (g, m) => {
-        var h;
+      afterDelete: async (w, m) => {
+        var y;
         await p(
-          (h = r == null ? void 0 : r.resourceServers) == null ? void 0 : h.afterDelete,
-          s == null ? void 0 : s.afterDelete,
-          g,
+          (y = n == null ? void 0 : n.resourceServers) == null ? void 0 : y.afterDelete,
+          r == null ? void 0 : r.afterDelete,
+          w,
           m
         );
       }
-    } : r == null ? void 0 : r.resourceServers,
-    roles: f ? {
-      ...r == null ? void 0 : r.roles,
-      afterCreate: async (g, m) => {
-        var h;
+    } : n == null ? void 0 : n.resourceServers,
+    roles: d ? {
+      ...n == null ? void 0 : n.roles,
+      afterCreate: async (w, m) => {
+        var y;
         await p(
-          (h = r == null ? void 0 : r.roles) == null ? void 0 : h.afterCreate,
-          f == null ? void 0 : f.afterCreate,
-          g,
+          (y = n == null ? void 0 : n.roles) == null ? void 0 : y.afterCreate,
+          d == null ? void 0 : d.afterCreate,
+          w,
           m
         );
       },
-      afterUpdate: async (g, m, h) => {
-        var v;
+      afterUpdate: async (w, m, y) => {
+        var _;
         await p(
-          (v = r == null ? void 0 : r.roles) == null ? void 0 : v.afterUpdate,
-          f == null ? void 0 : f.afterUpdate,
-          g,
+          (_ = n == null ? void 0 : n.roles) == null ? void 0 : _.afterUpdate,
+          d == null ? void 0 : d.afterUpdate,
+          w,
           m,
-          h
+          y
         );
       },
-      afterDelete: async (g, m) => {
-        var h;
+      afterDelete: async (w, m) => {
+        var y;
         await p(
-          (h = r == null ? void 0 : r.roles) == null ? void 0 : h.afterDelete,
-          f == null ? void 0 : f.afterDelete,
-          g,
+          (y = n == null ? void 0 : n.roles) == null ? void 0 : y.afterDelete,
+          d == null ? void 0 : d.afterDelete,
+          w,
           m
         );
       }
-    } : r == null ? void 0 : r.roles,
-    tenants: u || d ? {
-      ...r == null ? void 0 : r.tenants,
-      afterCreate: async (g, m) => {
-        var h;
-        await _(
+    } : n == null ? void 0 : n.roles,
+    tenants: f || o ? {
+      ...n == null ? void 0 : n.tenants,
+      afterCreate: async (w, m) => {
+        var y;
+        await g(
           [
-            (h = r == null ? void 0 : r.tenants) == null ? void 0 : h.afterCreate,
-            u == null ? void 0 : u.afterCreate,
-            d == null ? void 0 : d.afterCreate
+            (y = n == null ? void 0 : n.tenants) == null ? void 0 : y.afterCreate,
+            f == null ? void 0 : f.afterCreate,
+            o == null ? void 0 : o.afterCreate
           ],
-          g,
+          w,
           m
         );
       }
-    } : r == null ? void 0 : r.tenants
+    } : n == null ? void 0 : n.tenants
   }, T = {
     ...c,
-    tenants: u || d ? {
+    tenants: f || o ? {
       ...c.tenants,
-      afterCreate: async (g, m) => {
-        var h;
-        (h = c.tenants) != null && h.afterCreate && await c.tenants.afterCreate(g, m), await _(
+      afterCreate: async (w, m) => {
+        var y;
+        (y = c.tenants) != null && y.afterCreate && await c.tenants.afterCreate(w, m), await g(
           [
-            u == null ? void 0 : u.afterCreate,
-            d == null ? void 0 : d.afterCreate
+            f == null ? void 0 : f.afterCreate,
+            o == null ? void 0 : o.afterCreate
           ],
-          g,
+          w,
           m
         );
       }
     } : c.tenants
-  }, P = re(
-    o,
+  }, b = j(
+    l,
     T
-  ), A = Q({
-    ...l,
-    entityHooks: y,
+  ), q = L({
+    ...u,
+    entityHooks: h,
     // Register tenant routes via the extension mechanism
     // This ensures they go through the full middleware chain (caching, tenant, auth, entity hooks)
     managementApiExtensions: [
-      ...l.managementApiExtensions || [],
-      { path: "/tenants", router: P }
+      ...u.managementApiExtensions || [],
+      { path: "/tenants", router: b }
     ]
-  }), { app: O, managementApp: I, ...E } = A, q = new U();
-  return q.onError((g, m) => g instanceof w ? g.getResponse() : (console.error(g), m.json({ message: "Internal Server Error" }, 500))), q.use("/api/v2/*", de()), q.route("/", O), {
-    app: q,
-    managementApp: I,
-    ...E,
-    multiTenancyConfig: o,
+  }), { app: $, managementApp: z, ...F } = q, v = new U();
+  return v.onError((w, m) => w instanceof C ? w.getResponse() : (console.error(w), m.json({ message: "Internal Server Error" }, 500))), v.use("/api/v2/*", ce()), v.route("/", $), {
+    app: v,
+    managementApp: z,
+    ...F,
+    multiTenancyConfig: l,
     multiTenancyHooks: c
   };
 }
 export {
-  Pe as MANAGEMENT_API_SCOPES,
-  Z as createAccessControlHooks,
+  ve as MANAGEMENT_API_SCOPES,
+  X as createAccessControlHooks,
   le as createAccessControlMiddleware,
-  X as createDatabaseHooks,
-  fe as createDatabaseMiddleware,
-  pe as createMultiTenancy,
-  R as createMultiTenancyHooks,
+  Z as createDatabaseHooks,
+  ue as createDatabaseMiddleware,
+  fe as createMultiTenancy,
+  I as createMultiTenancyHooks,
   N as createMultiTenancyMiddleware,
-  Te as createMultiTenancyPlugin,
-  de as createProtectSyncedMiddleware,
-  H as createProvisioningHooks,
+  ge as createMultiTenancyPlugin,
+  ce as createProtectSyncedMiddleware,
+  k as createProvisioningHooks,
   te as createResourceServerSyncHooks,
   ne as createRoleSyncHooks,
-  ue as createSubdomainMiddleware,
+  de as createSubdomainMiddleware,
   ae as createTenantResourceServerSyncHooks,
-  se as createTenantRoleSyncHooks,
-  M as createTenantsRouter,
-  ze as fetchAll,
-  be as init,
-  Ie as seed,
-  ve as setupMultiTenancy,
-  J as validateTenantAccess
+  re as createTenantRoleSyncHooks,
+  j as createTenantsOpenAPIRouter,
+  be as fetchAll,
+  Te as init,
+  Pe as seed,
+  _e as setupMultiTenancy,
+  Y as validateTenantAccess
 };