@authhero/multi-tenancy 13.14.0 → 13.15.0

package/dist/multi-tenancy.mjs

@@ -1,22 +1,22 @@
-var ne = Object.defineProperty;
-var re = (r, e, t) => e in r ? ne(r, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : r[e] = t;
-var U = (r, e, t) => re(r, typeof e != "symbol" ? e + "" : e, t);
-import { Hono as x } from "hono";
-import { getTenantAudience as ae, MANAGEMENT_API_SCOPES as se, MANAGEMENT_API_AUDIENCE as oe, fetchAll as F, init as ie } from "authhero";
+var se = Object.defineProperty;
+var oe = (t, e, n) => e in t ? se(t, e, { enumerable: !0, configurable: !0, writable: !0, value: n }) : t[e] = n;
+var U = (t, e, n) => oe(t, typeof e != "symbol" ? e + "" : e, n);
+import { Hono as te } from "hono";
+import { getTenantAudience as ie, MANAGEMENT_API_SCOPES as ce, MANAGEMENT_API_AUDIENCE as le, fetchAll as F, init as de } from "authhero";
 export * from "authhero";
-import { OpenAPIHono as ce, createRoute as K, z } from "@hono/zod-openapi";
-import { auth0QuerySchema as le, tenantSchema as Z, tenantInsertSchema as de } from "@authhero/adapter-interfaces";
+import { OpenAPIHono as ue, createRoute as B, z } from "@hono/zod-openapi";
+import { auth0QuerySchema as me, tenantSchema as k, tenantInsertSchema as pe, connectionSchema as G, connectionOptionsSchema as K } from "@authhero/adapter-interfaces";
 var S = class extends Error {
   /**
    * Creates an instance of `HTTPException`.
    * @param status - HTTP status code for the exception. Defaults to 500.
    * @param options - Additional options for the exception.
    */
-  constructor(e = 500, t) {
-    super(t == null ? void 0 : t.message, { cause: t == null ? void 0 : t.cause });
+  constructor(e = 500, n) {
+    super(n == null ? void 0 : n.message, { cause: n == null ? void 0 : n.cause });
     U(this, "res");
     U(this, "status");
-    this.res = t == null ? void 0 : t.res, this.status = e;
+    this.res = n == null ? void 0 : n.res, this.status = e;
   }
   /**
    * Returns the response object associated with the exception.
@@ -32,209 +32,173 @@ var S = class extends Error {
     });
   }
 };
-function ue(r) {
-  const { controlPlaneTenantId: e, requireOrganizationMatch: t = !0 } = r;
+function fe(t) {
+  const { controlPlaneTenantId: e, requireOrganizationMatch: n = !0 } = t;
   return {
-    async onTenantAccessValidation(a, n) {
-      if (n === e)
+    async onTenantAccessValidation(a, r) {
+      if (r === e)
         return !0;
-      if (t) {
-        const i = a.var.org_name, l = a.var.organization_id, o = i || l;
-        return o ? o === n : !1;
+      if (n) {
+        const l = a.var.org_name, s = a.var.organization_id, i = l || s;
+        return i ? i === r : !1;
       }
       return !0;
     }
   };
 }
-function me(r, e, t, a) {
-  if (e === t)
+function we(t, e, n, a) {
+  if (e === n)
     return !0;
-  const n = a || r;
-  return n ? n === e : !1;
+  const r = a || t;
+  return r ? r === e : !1;
 }
-function pe(r) {
+function ge(t) {
   return {
     async resolveDataAdapters(e) {
       try {
-        return await r.getAdapters(e);
-      } catch (t) {
+        return await t.getAdapters(e);
+      } catch (n) {
         console.error(
           `Failed to resolve data adapters for tenant ${e}:`,
-          t
+          n
         );
         return;
       }
     }
   };
 }
-function fe(r) {
+function he(t) {
   return {
-    async beforeCreate(e, t) {
-      return !t.audience && t.id ? {
-        ...t,
-        audience: ae(t.id)
-      } : t;
+    async beforeCreate(e, n) {
+      return !n.audience && n.id ? {
+        ...n,
+        audience: ie(n.id)
+      } : n;
     },
-    async afterCreate(e, t) {
-      const { accessControl: a, databaseIsolation: n, settingsInheritance: i } = r;
-      a && e.ctx && await we(e, t, a), n != null && n.onProvision && await n.onProvision(t.id), (i == null ? void 0 : i.inheritFromControlPlane) !== !1 && e.ctx && await ve(e, t, r);
+    async afterCreate(e, n) {
+      const { accessControl: a, databaseIsolation: r } = t;
+      a && e.ctx && await ve(e, n, a), r != null && r.onProvision && await r.onProvision(n.id);
     },
-    async beforeDelete(e, t) {
-      const { accessControl: a, databaseIsolation: n } = r;
+    async beforeDelete(e, n) {
+      const { accessControl: a, databaseIsolation: r } = t;
       if (a)
         try {
-          const l = (await e.adapters.organizations.list(
+          const s = (await e.adapters.organizations.list(
             a.controlPlaneTenantId
-          )).organizations.find((o) => o.name === t);
-          l && await e.adapters.organizations.remove(
+          )).organizations.find((i) => i.name === n);
+          s && await e.adapters.organizations.remove(
             a.controlPlaneTenantId,
-            l.id
+            s.id
           );
-        } catch (i) {
+        } catch (l) {
           console.warn(
-            `Failed to remove organization for tenant ${t}:`,
-            i
+            `Failed to remove organization for tenant ${n}:`,
+            l
           );
         }
-      if (n != null && n.onDeprovision)
+      if (r != null && r.onDeprovision)
         try {
-          await n.onDeprovision(t);
-        } catch (i) {
+          await r.onDeprovision(n);
+        } catch (l) {
           console.warn(
-            `Failed to deprovision database for tenant ${t}:`,
-            i
+            `Failed to deprovision database for tenant ${n}:`,
+            l
           );
         }
     }
   };
 }
-async function we(r, e, t) {
+async function ve(t, e, n) {
   const {
     controlPlaneTenantId: a,
-    defaultPermissions: n,
-    defaultRoles: i,
-    issuer: l,
-    adminRoleName: o = "Tenant Admin",
-    adminRoleDescription: m = "Full access to all tenant management operations",
-    addCreatorToOrganization: s = !0
-  } = t, c = await r.adapters.organizations.create(
+    defaultPermissions: r,
+    defaultRoles: l,
+    issuer: s,
+    adminRoleName: i = "Tenant Admin",
+    adminRoleDescription: p = "Full access to all tenant management operations",
+    addCreatorToOrganization: o = !0
+  } = n, c = await t.adapters.organizations.create(
     a,
     {
       name: e.id,
       display_name: e.friendly_name || e.id
     }
   );
-  let d;
-  if (l && (d = await ge(
-    r,
+  let u;
+  if (s && (u = await ye(
+    t,
     a,
-    o,
-    m
-  )), s && r.ctx) {
-    const u = r.ctx.var.user;
-    if (u != null && u.sub && !await he(
-      r,
+    i,
+    p
+  )), o && t.ctx) {
+    const d = t.ctx.var.user;
+    if (d != null && d.sub && !await _e(
+      t,
       a,
-      u.sub
+      d.sub
     ))
       try {
-        await r.adapters.userOrganizations.create(a, {
-          user_id: u.sub,
+        await t.adapters.userOrganizations.create(a, {
+          user_id: d.sub,
           organization_id: c.id
-        }), d && await r.adapters.userRoles.create(
+        }), u && await t.adapters.userRoles.create(
           a,
-          u.sub,
-          d,
+          d.sub,
+          u,
           c.id
           // organizationId
         );
       } catch (f) {
         console.warn(
-          `Failed to add creator ${u.sub} to organization ${c.id}:`,
+          `Failed to add creator ${d.sub} to organization ${c.id}:`,
           f
         );
       }
   }
-  i && i.length > 0 && console.log(
-    `Would assign roles ${i.join(", ")} to organization ${c.id}`
-  ), n && n.length > 0 && console.log(
-    `Would grant permissions ${n.join(", ")} to organization ${c.id}`
+  l && l.length > 0 && console.log(
+    `Would assign roles ${l.join(", ")} to organization ${c.id}`
+  ), r && r.length > 0 && console.log(
+    `Would grant permissions ${r.join(", ")} to organization ${c.id}`
   );
 }
-async function he(r, e, t) {
-  const a = await r.adapters.userRoles.list(
+async function _e(t, e, n) {
+  const a = await t.adapters.userRoles.list(
     e,
-    t,
+    n,
     void 0,
     ""
     // Empty string for global roles
   );
-  for (const n of a)
-    if ((await r.adapters.rolePermissions.list(
+  for (const r of a)
+    if ((await t.adapters.rolePermissions.list(
       e,
-      n.id,
+      r.id,
       { per_page: 1e3 }
     )).some(
-      (o) => o.permission_name === "admin:organizations"
+      (i) => i.permission_name === "admin:organizations"
     ))
       return !0;
   return !1;
 }
-async function ge(r, e, t, a) {
-  const i = (await r.adapters.roles.list(e, {})).roles.find((s) => s.name === t);
-  if (i)
-    return i.id;
-  const l = await r.adapters.roles.create(e, {
-    name: t,
+async function ye(t, e, n, a) {
+  const l = (await t.adapters.roles.list(e, {})).roles.find((o) => o.name === n);
+  if (l)
+    return l.id;
+  const s = await t.adapters.roles.create(e, {
+    name: n,
     description: a
-  }), o = oe, m = se.map((s) => ({
-    role_id: l.id,
-    resource_server_identifier: o,
-    permission_name: s.value
+  }), i = le, p = ce.map((o) => ({
+    role_id: s.id,
+    resource_server_identifier: i,
+    permission_name: o.value
   }));
-  return await r.adapters.rolePermissions.assign(
+  return await t.adapters.rolePermissions.assign(
     e,
-    l.id,
-    m
-  ), l.id;
-}
-async function ve(r, e, t) {
-  const { accessControl: a, settingsInheritance: n } = t;
-  if (!a)
-    return;
-  const i = await r.adapters.tenants.get(
-    a.controlPlaneTenantId
-  );
-  if (!i)
-    return;
-  let l = { ...i };
-  const o = [
-    "id",
-    "created_at",
-    "updated_at",
-    // Tenant-specific required fields that should not be inherited
-    "friendly_name",
-    "audience",
-    "sender_email",
-    "sender_name"
-  ];
-  for (const m of o)
-    delete l[m];
-  if (n != null && n.inheritedKeys) {
-    const m = {};
-    for (const s of n.inheritedKeys)
-      s in i && !o.includes(s) && (m[s] = i[s]);
-    l = m;
-  }
-  if (n != null && n.excludedKeys)
-    for (const m of n.excludedKeys)
-      delete l[m];
-  n != null && n.transformSettings && (l = n.transformSettings(
-    l,
-    e.id
-  )), Object.keys(l).length > 0 && await r.adapters.tenants.update(e.id, l);
+    s.id,
+    p
+  ), s.id;
 }
-const _e = [
+const be = [
   "client_id",
   "client_secret",
   "app_secret",
@@ -243,115 +207,115 @@ const _e = [
   "twilio_sid",
   "twilio_token"
 ];
-function B(r, e, t = () => !0) {
-  const { controlPlaneTenantId: a, getChildTenantIds: n, getAdapters: i } = r, l = /* @__PURE__ */ new Map();
-  async function o(c, d, u) {
-    return (await e(c).list(d, {
-      q: `name:${u}`,
+function L(t, e, n = () => !0) {
+  const { controlPlaneTenantId: a, getChildTenantIds: r, getAdapters: l } = t, s = /* @__PURE__ */ new Map();
+  async function i(c, u, d) {
+    return (await e(c).list(u, {
+      q: `name:${d}`,
       per_page: 1
     }))[0] ?? null;
   }
-  async function m(c) {
-    const d = await n(), u = e(await i(a));
+  async function p(c) {
+    const u = await r(), d = e(await l(a));
     await Promise.all(
-      d.map(async (p) => {
+      u.map(async (m) => {
         try {
-          const f = await i(p), w = e(f), g = {
-            ...u.transform(c),
+          const f = await l(m), w = e(f), h = {
+            ...d.transform(c),
             is_system: !0
-          }, v = await o(f, p, c.name), _ = v ? w.getId(v) : void 0;
+          }, v = await i(f, m, c.name), _ = v ? w.getId(v) : void 0;
           if (v && _) {
-            const C = w.preserveOnUpdate ? w.preserveOnUpdate(v, g) : g;
-            await w.update(p, _, C);
+            const A = w.preserveOnUpdate ? w.preserveOnUpdate(v, h) : h;
+            await w.update(m, _, A);
           } else
-            await w.create(p, g);
+            await w.create(m, h);
         } catch (f) {
           console.error(
-            `Failed to sync ${u.listKey} "${c.name}" to tenant "${p}":`,
+            `Failed to sync ${d.listKey} "${c.name}" to tenant "${m}":`,
             f
           );
         }
       })
     );
   }
-  async function s(c) {
-    const d = await n();
+  async function o(c) {
+    const u = await r();
     await Promise.all(
-      d.map(async (u) => {
+      u.map(async (d) => {
         try {
-          const p = await i(u), f = e(p), w = await o(p, u, c), h = w ? f.getId(w) : void 0;
-          w && h && await f.remove(u, h);
-        } catch (p) {
+          const m = await l(d), f = e(m), w = await i(m, d, c), g = w ? f.getId(w) : void 0;
+          w && g && await f.remove(d, g);
+        } catch (m) {
           console.error(
-            `Failed to delete entity "${c}" from tenant "${u}":`,
-            p
+            `Failed to delete entity "${c}" from tenant "${d}":`,
+            m
           );
         }
       })
     );
   }
   return {
-    afterCreate: async (c, d) => {
-      c.tenantId === a && t(d) && await m(d);
+    afterCreate: async (c, u) => {
+      c.tenantId === a && n(u) && await p(u);
     },
-    afterUpdate: async (c, d, u) => {
-      c.tenantId === a && t(u) && await m(u);
+    afterUpdate: async (c, u, d) => {
+      c.tenantId === a && n(d) && await p(d);
     },
-    beforeDelete: async (c, d) => {
+    beforeDelete: async (c, u) => {
       if (c.tenantId !== a) return;
-      const p = await e(c.adapters).get(c.tenantId, d);
-      p && t(p) && l.set(d, p);
+      const m = await e(c.adapters).get(c.tenantId, u);
+      m && n(m) && s.set(u, m);
     },
-    afterDelete: async (c, d) => {
+    afterDelete: async (c, u) => {
       if (c.tenantId !== a) return;
-      const u = l.get(d);
-      u && (l.delete(d), await s(u.name));
+      const d = s.get(u);
+      d && (s.delete(u), await o(d.name));
     }
   };
 }
-function G(r, e, t = () => !0) {
-  const { controlPlaneTenantId: a, getControlPlaneAdapters: n, getAdapters: i } = r;
+function V(t, e, n = () => !0) {
+  const { controlPlaneTenantId: a, getControlPlaneAdapters: r, getAdapters: l } = t;
   return {
-    async afterCreate(l, o) {
-      if (o.id !== a)
+    async afterCreate(s, i) {
+      if (i.id !== a)
         try {
-          const m = await n(), s = await i(o.id), c = e(m), d = e(s), u = await F(
-            (p) => c.listPaginated(a, p),
+          const p = await r(), o = await l(i.id), c = e(p), u = e(o), d = await F(
+            (m) => c.listPaginated(a, m),
             c.listKey,
             { cursorField: "id", pageSize: 100 }
           );
           await Promise.all(
-            u.filter((p) => t(p)).map(async (p) => {
+            d.filter((m) => n(m)).map(async (m) => {
               try {
-                const f = c.transform(p);
-                await d.create(o.id, {
+                const f = c.transform(m);
+                await u.create(i.id, {
                   ...f,
                   is_system: !0
                 });
               } catch (f) {
                 console.error(
-                  `Failed to sync entity to new tenant "${o.id}":`,
+                  `Failed to sync entity to new tenant "${i.id}":`,
                   f
                 );
               }
             })
           );
-        } catch (m) {
+        } catch (p) {
           console.error(
-            `Failed to sync entities to new tenant "${o.id}":`,
-            m
+            `Failed to sync entities to new tenant "${i.id}":`,
+            p
           );
         }
     }
   };
 }
-const E = (r) => ({
-  list: async (e, t) => (await r.resourceServers.list(e, t)).resource_servers,
-  listPaginated: (e, t) => r.resourceServers.list(e, t),
-  get: (e, t) => r.resourceServers.get(e, t),
-  create: (e, t) => r.resourceServers.create(e, t),
-  update: (e, t, a) => r.resourceServers.update(e, t, a),
-  remove: (e, t) => r.resourceServers.remove(e, t),
+const H = (t) => ({
+  list: async (e, n) => (await t.resourceServers.list(e, n)).resource_servers,
+  listPaginated: (e, n) => t.resourceServers.list(e, n),
+  get: (e, n) => t.resourceServers.get(e, n),
+  create: (e, n) => t.resourceServers.create(e, n),
+  update: (e, n, a) => t.resourceServers.update(e, n, a),
+  remove: (e, n) => t.resourceServers.remove(e, n),
   listKey: "resource_servers",
   getId: (e) => e.id,
   transform: (e) => ({
@@ -362,37 +326,37 @@ const E = (r) => ({
     token_lifetime: e.token_lifetime,
     token_lifetime_for_web: e.token_lifetime_for_web
   })
-}), k = (r) => ({
-  list: async (e, t) => (await r.roles.list(e, t)).roles,
-  listPaginated: (e, t) => r.roles.list(e, t),
-  get: (e, t) => r.roles.get(e, t),
-  create: (e, t) => r.roles.create(e, t),
-  update: (e, t, a) => r.roles.update(e, t, a),
-  remove: (e, t) => r.roles.remove(e, t),
+}), x = (t) => ({
+  list: async (e, n) => (await t.roles.list(e, n)).roles,
+  listPaginated: (e, n) => t.roles.list(e, n),
+  get: (e, n) => t.roles.get(e, n),
+  create: (e, n) => t.roles.create(e, n),
+  update: (e, n, a) => t.roles.update(e, n, a),
+  remove: (e, n) => t.roles.remove(e, n),
   listKey: "roles",
   getId: (e) => e.id,
   transform: (e) => ({
     name: e.name,
     description: e.description
   })
-}), H = (r) => ({
-  list: async (e, t) => (await r.connections.list(e, t)).connections,
-  listPaginated: (e, t) => r.connections.list(e, t),
-  get: (e, t) => r.connections.get(e, t),
-  create: (e, t) => r.connections.create(e, t),
-  update: (e, t, a) => r.connections.update(e, t, a),
-  remove: (e, t) => r.connections.remove(e, t),
+}), ee = (t) => ({
+  list: async (e, n) => (await t.connections.list(e, n)).connections,
+  listPaginated: (e, n) => t.connections.list(e, n),
+  get: (e, n) => t.connections.get(e, n),
+  create: (e, n) => t.connections.create(e, n),
+  update: (e, n, a) => t.connections.update(e, n, a),
+  remove: (e, n) => t.connections.remove(e, n),
   listKey: "connections",
   getId: (e) => e.id,
   transform: (e) => {
-    const t = e.options ? { ...e.options } : {};
-    for (const a of _e)
-      delete t[a];
+    const n = e.options ? { ...e.options } : {};
+    for (const a of be)
+      delete n[a];
     return {
       name: e.name,
       display_name: e.display_name,
       strategy: e.strategy,
-      options: t,
+      options: n,
       response_type: e.response_type,
       response_mode: e.response_mode,
       is_domain_connection: e.is_domain_connection,
@@ -400,12 +364,12 @@ const E = (r) => ({
       metadata: e.metadata
     };
   },
-  preserveOnUpdate: (e, t) => {
+  preserveOnUpdate: (e, n) => {
     const a = e.options || {};
     return {
-      ...t,
+      ...n,
       options: {
-        ...t.options,
+        ...n.options,
         client_id: a.client_id,
         client_secret: a.client_secret,
         app_secret: a.app_secret,
@@ -417,122 +381,122 @@ const E = (r) => ({
     };
   }
 });
-function ye(r) {
-  const { sync: e = {}, filters: t = {} } = r, a = e.resourceServers ?? !0, n = e.roles ?? !0, i = e.connections ?? !0, l = a ? B(
-    r,
-    E,
-    t.resourceServers
-  ) : void 0, o = n ? B(
-    r,
-    k,
-    t.roles
-  ) : void 0, m = i ? B(
-    r,
+function Ce(t) {
+  const { sync: e = {}, filters: n = {} } = t, a = e.resourceServers ?? !0, r = e.roles ?? !0, l = e.connections ?? !0, s = a ? L(
+    t,
     H,
-    t.connections
-  ) : void 0, s = a ? G(
-    r,
-    E,
-    t.resourceServers
-  ) : void 0, c = n ? G(
-    r,
-    k,
-    t.roles
-  ) : void 0, d = i ? G(
-    r,
+    n.resourceServers
+  ) : void 0, i = r ? L(
+    t,
+    x,
+    n.roles
+  ) : void 0, p = l ? L(
+    t,
+    ee,
+    n.connections
+  ) : void 0, o = a ? V(
+    t,
     H,
-    t.connections
-  ) : void 0, u = n ? {
-    async afterCreate(w, h) {
-      var g;
-      if (h.id !== r.controlPlaneTenantId) {
-        await ((g = c == null ? void 0 : c.afterCreate) == null ? void 0 : g.call(c, w, h));
+    n.resourceServers
+  ) : void 0, c = r ? V(
+    t,
+    x,
+    n.roles
+  ) : void 0, u = l ? V(
+    t,
+    ee,
+    n.connections
+  ) : void 0, d = r ? {
+    async afterCreate(w, g) {
+      var h;
+      if (g.id !== t.controlPlaneTenantId) {
+        await ((h = c == null ? void 0 : c.afterCreate) == null ? void 0 : h.call(c, w, g));
         try {
-          const v = await r.getControlPlaneAdapters(), _ = await r.getAdapters(h.id), C = await F(
+          const v = await t.getControlPlaneAdapters(), _ = await t.getAdapters(g.id), A = await F(
             (b) => v.roles.list(
-              r.controlPlaneTenantId,
+              t.controlPlaneTenantId,
               b
             ),
             "roles",
             { cursorField: "id", pageSize: 100 }
           ), $ = /* @__PURE__ */ new Map();
-          for (const b of C.filter(
+          for (const b of A.filter(
             (y) => {
-              var A;
-              return ((A = t.roles) == null ? void 0 : A.call(t, y)) ?? !0;
+              var C;
+              return ((C = n.roles) == null ? void 0 : C.call(n, y)) ?? !0;
             }
           )) {
-            const y = await p(
+            const y = await m(
               _,
-              h.id,
+              g.id,
               b.name
             );
             y && $.set(b.name, y.id);
           }
-          for (const b of C.filter(
+          for (const b of A.filter(
             (y) => {
-              var A;
-              return ((A = t.roles) == null ? void 0 : A.call(t, y)) ?? !0;
+              var C;
+              return ((C = n.roles) == null ? void 0 : C.call(n, y)) ?? !0;
             }
           )) {
             const y = $.get(b.name);
             if (y)
               try {
-                const A = await v.rolePermissions.list(
-                  r.controlPlaneTenantId,
+                const C = await v.rolePermissions.list(
+                  t.controlPlaneTenantId,
                   b.id,
                   {}
                 );
-                A.length > 0 && await _.rolePermissions.assign(
-                  h.id,
+                C.length > 0 && await _.rolePermissions.assign(
+                  g.id,
                   y,
-                  A.map((I) => ({
+                  C.map((P) => ({
                     role_id: y,
-                    resource_server_identifier: I.resource_server_identifier,
-                    permission_name: I.permission_name
+                    resource_server_identifier: P.resource_server_identifier,
+                    permission_name: P.permission_name
                   }))
                 );
-              } catch (A) {
+              } catch (C) {
                 console.error(
-                  `Failed to sync permissions for role "${b.name}" to tenant "${h.id}":`,
-                  A
+                  `Failed to sync permissions for role "${b.name}" to tenant "${g.id}":`,
+                  C
                 );
               }
           }
         } catch (v) {
           console.error(
-            `Failed to sync role permissions to tenant "${h.id}":`,
+            `Failed to sync role permissions to tenant "${g.id}":`,
             v
           );
         }
       }
     }
   } : void 0;
-  async function p(w, h, g) {
-    return (await w.roles.list(h, {
-      q: `name:${g}`,
+  async function m(w, g, h) {
+    return (await w.roles.list(g, {
+      q: `name:${h}`,
       per_page: 1
     })).roles[0] ?? null;
   }
   return {
     entityHooks: {
-      resourceServers: l,
-      roles: o,
-      connections: m
+      resourceServers: s,
+      roles: i,
+      connections: p
     },
     tenantHooks: {
-      async afterCreate(w, h) {
-        const g = [
-          s == null ? void 0 : s.afterCreate,
-          (u == null ? void 0 : u.afterCreate) ?? (c == null ? void 0 : c.afterCreate),
-          d == null ? void 0 : d.afterCreate
+      async afterCreate(w, g) {
+        const h = [
+          o == null ? void 0 : o.afterCreate,
+          (d == null ? void 0 : d.afterCreate) ?? (c == null ? void 0 : c.afterCreate),
+          u == null ? void 0 : u.afterCreate
         ], v = [];
-        for (const _ of g)
+        for (const _ of h)
           if (_)
             try {
-              await _(w, h);
-            } catch (C) {
-              v.push(C instanceof Error ? C : new Error(String(C)));
+              await _(w, g);
+            } catch (A) {
+              v.push(A instanceof Error ? A : new Error(String(A)));
             }
         if (v.length === 1) throw v[0];
         if (v.length > 1)
@@ -544,15 +508,15 @@ function ye(r) {
     }
   };
 }
-function L(r, e) {
-  const t = new ce();
-  return t.openapi(
-    K({
+function W(t, e) {
+  const n = new ue();
+  return n.openapi(
+    B({
       tags: ["tenants"],
       method: "get",
       path: "/",
       request: {
-        query: le
+        query: me
       },
       security: [
         {
@@ -564,7 +528,7 @@ function L(r, e) {
           content: {
             "application/json": {
               schema: z.object({
-                tenants: z.array(Z),
+                tenants: z.array(k),
                 start: z.number().optional(),
                 limit: z.number().optional(),
                 length: z.number().optional()
@@ -576,74 +540,74 @@ function L(r, e) {
       }
     }),
     async (a) => {
-      var p, f, w, h;
-      const n = a.req.valid("query"), { page: i, per_page: l, include_totals: o, q: m } = n, s = a.var.user, c = (s == null ? void 0 : s.permissions) || [];
+      var m, f, w, g;
+      const r = a.req.valid("query"), { page: l, per_page: s, include_totals: i, q: p } = r, o = a.var.user, c = (o == null ? void 0 : o.permissions) || [];
       if (c.includes("auth:read") || c.includes("admin:organizations")) {
-        const g = await a.env.data.tenants.list({
-          page: i,
-          per_page: l,
-          include_totals: o,
-          q: m
+        const h = await a.env.data.tenants.list({
+          page: l,
+          per_page: s,
+          include_totals: i,
+          q: p
         });
-        return o ? a.json({
-          tenants: g.tenants,
-          start: ((p = g.totals) == null ? void 0 : p.start) ?? 0,
-          limit: ((f = g.totals) == null ? void 0 : f.limit) ?? l,
-          length: g.tenants.length
-        }) : a.json({ tenants: g.tenants });
+        return i ? a.json({
+          tenants: h.tenants,
+          start: ((m = h.totals) == null ? void 0 : m.start) ?? 0,
+          limit: ((f = h.totals) == null ? void 0 : f.limit) ?? s,
+          length: h.tenants.length
+        }) : a.json({ tenants: h.tenants });
       }
-      if (r.accessControl && (s != null && s.sub)) {
-        const g = r.accessControl.controlPlaneTenantId, _ = (await F(
+      if (t.accessControl && (o != null && o.sub)) {
+        const h = t.accessControl.controlPlaneTenantId, _ = (await F(
           (D) => a.env.data.userOrganizations.listUserOrganizations(
-            g,
-            s.sub,
+            h,
+            o.sub,
             D
           ),
           "organizations"
         )).map((D) => D.name);
         if (_.length === 0)
-          return o ? a.json({
+          return i ? a.json({
             tenants: [],
             start: 0,
-            limit: l ?? 50,
+            limit: s ?? 50,
             length: 0
           }) : a.json({ tenants: [] });
-        const C = _.length, $ = i ?? 0, b = l ?? 50, y = $ * b, A = _.slice(y, y + b);
-        if (A.length === 0)
-          return o ? a.json({
+        const A = _.length, $ = l ?? 0, b = s ?? 50, y = $ * b, C = _.slice(y, y + b);
+        if (C.length === 0)
+          return i ? a.json({
             tenants: [],
             start: y,
             limit: b,
-            length: C
+            length: A
           }) : a.json({ tenants: [] });
-        const I = A.map((D) => `id:${D}`).join(" OR "), j = m ? `(${I}) AND (${m})` : I, R = await a.env.data.tenants.list({
-          q: j,
+        const P = C.map((D) => `id:${D}`).join(" OR "), q = p ? `(${P}) AND (${p})` : P, R = await a.env.data.tenants.list({
+          q,
           per_page: b,
           include_totals: !1
           // We calculate totals from accessibleTenantIds
         });
-        return o ? a.json({
+        return i ? a.json({
           tenants: R.tenants,
           start: y,
           limit: b,
-          length: C
+          length: A
         }) : a.json({ tenants: R.tenants });
       }
-      const u = await a.env.data.tenants.list({
-        page: i,
-        per_page: l,
-        include_totals: o,
-        q: m
+      const d = await a.env.data.tenants.list({
+        page: l,
+        per_page: s,
+        include_totals: i,
+        q: p
       });
-      return o ? a.json({
-        tenants: u.tenants,
-        start: ((w = u.totals) == null ? void 0 : w.start) ?? 0,
-        limit: ((h = u.totals) == null ? void 0 : h.limit) ?? l,
-        length: u.tenants.length
-      }) : a.json({ tenants: u.tenants });
+      return i ? a.json({
+        tenants: d.tenants,
+        start: ((w = d.totals) == null ? void 0 : w.start) ?? 0,
+        limit: ((g = d.totals) == null ? void 0 : g.limit) ?? s,
+        length: d.tenants.length
+      }) : a.json({ tenants: d.tenants });
     }
-  ), t.openapi(
-    K({
+  ), n.openapi(
+    B({
       tags: ["tenants"],
       method: "post",
       path: "/",
@@ -651,7 +615,7 @@ function L(r, e) {
         body: {
           content: {
             "application/json": {
-              schema: de
+              schema: pe
             }
           }
         }
@@ -665,7 +629,7 @@ function L(r, e) {
         201: {
           content: {
             "application/json": {
-              schema: Z
+              schema: k
             }
           },
           description: "Tenant created"
@@ -679,23 +643,23 @@ function L(r, e) {
       }
     }),
     async (a) => {
-      var m, s;
-      const n = a.var.user;
-      if (!(n != null && n.sub))
+      var p, o;
+      const r = a.var.user;
+      if (!(r != null && r.sub))
         throw new S(401, {
           message: "Authentication required to create tenants"
         });
-      let i = a.req.valid("json");
-      const l = {
+      let l = a.req.valid("json");
+      const s = {
         adapters: a.env.data,
         ctx: a
       };
-      (m = e.tenants) != null && m.beforeCreate && (i = await e.tenants.beforeCreate(l, i));
-      const o = await a.env.data.tenants.create(i);
-      return (s = e.tenants) != null && s.afterCreate && await e.tenants.afterCreate(l, o), a.json(o, 201);
+      (p = e.tenants) != null && p.beforeCreate && (l = await e.tenants.beforeCreate(s, l));
+      const i = await a.env.data.tenants.create(l);
+      return (o = e.tenants) != null && o.afterCreate && await e.tenants.afterCreate(s, i), a.json(i, 201);
     }
-  ), t.openapi(
-    K({
+  ), n.openapi(
+    B({
       tags: ["tenants"],
       method: "delete",
       path: "/{id}",
@@ -722,43 +686,43 @@ function L(r, e) {
       }
     }),
     async (a) => {
-      var o, m;
-      const { id: n } = a.req.valid("param");
-      if (r.accessControl) {
-        const s = a.var.user, c = r.accessControl.controlPlaneTenantId;
-        if (!(s != null && s.sub))
+      var i, p;
+      const { id: r } = a.req.valid("param");
+      if (t.accessControl) {
+        const o = a.var.user, c = t.accessControl.controlPlaneTenantId;
+        if (!(o != null && o.sub))
           throw new S(401, {
             message: "Authentication required"
           });
-        if (n === c)
+        if (r === c)
           throw new S(403, {
             message: "Cannot delete the control plane"
           });
         if (!(await F(
-          (p) => a.env.data.userOrganizations.listUserOrganizations(
+          (m) => a.env.data.userOrganizations.listUserOrganizations(
             c,
-            s.sub,
-            p
+            o.sub,
+            m
           ),
           "organizations"
-        )).some((p) => p.name === n))
+        )).some((m) => m.name === r))
           throw new S(403, {
             message: "Access denied to this tenant"
           });
       }
-      if (!await a.env.data.tenants.get(n))
+      if (!await a.env.data.tenants.get(r))
         throw new S(404, {
           message: "Tenant not found"
         });
-      const l = {
+      const s = {
         adapters: a.env.data,
         ctx: a
       };
-      return (o = e.tenants) != null && o.beforeDelete && await e.tenants.beforeDelete(l, n), await a.env.data.tenants.remove(n), (m = e.tenants) != null && m.afterDelete && await e.tenants.afterDelete(l, n), a.body(null, 204);
+      return (i = e.tenants) != null && i.beforeDelete && await e.tenants.beforeDelete(s, r), await a.env.data.tenants.remove(r), (p = e.tenants) != null && p.afterDelete && await e.tenants.afterDelete(s, r), a.body(null, 204);
     }
-  ), t;
+  ), n;
 }
-function be(r) {
+function Ae(t) {
   const e = [
     {
       pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
@@ -767,26 +731,26 @@ function be(r) {
     { pattern: /\/api\/v2\/roles\/([^/]+)$/, type: "role" },
     { pattern: /\/api\/v2\/connections\/([^/]+)$/, type: "connection" }
   ];
-  for (const { pattern: t, type: a } of e) {
-    const n = r.match(t);
-    if (n && n[1])
-      return { type: a, id: n[1] };
+  for (const { pattern: n, type: a } of e) {
+    const r = t.match(n);
+    if (r && r[1])
+      return { type: a, id: r[1] };
   }
   return null;
 }
-async function Ae(r, e, t) {
+async function Te(t, e, n) {
   try {
-    switch (t.type) {
+    switch (n.type) {
       case "resource_server": {
-        const a = await r.resourceServers.get(e, t.id);
+        const a = await t.resourceServers.get(e, n.id);
         return (a == null ? void 0 : a.is_system) === !0;
       }
       case "role": {
-        const a = await r.roles.get(e, t.id);
+        const a = await t.roles.get(e, n.id);
         return (a == null ? void 0 : a.is_system) === !0;
       }
       case "connection": {
-        const a = await r.connections.get(e, t.id);
+        const a = await t.connections.get(e, n.id);
         return (a == null ? void 0 : a.is_system) === !0;
       }
       default:
@@ -796,169 +760,283 @@ async function Ae(r, e, t) {
     return !1;
   }
 }
-function Ce(r) {
+function Se(t) {
   return {
     resource_server: "resource server",
     role: "role",
     connection: "connection"
-  }[r];
+  }[t];
 }
-function Te() {
-  return async (r, e) => {
-    if (!["PATCH", "PUT", "DELETE"].includes(r.req.method))
+function Ie() {
+  return async (t, e) => {
+    if (!["PATCH", "PUT", "DELETE"].includes(t.req.method))
       return e();
-    const t = be(r.req.path);
-    if (!t)
+    const n = Ae(t.req.path);
+    if (!n)
       return e();
-    const a = r.var.tenant_id || r.req.header("x-tenant-id") || r.req.header("tenant-id");
+    const a = t.var.tenant_id || t.req.header("x-tenant-id") || t.req.header("tenant-id");
     if (!a)
       return e();
-    if (await Ae(r.env.data, a, t))
+    if (await Te(t.env.data, a, n))
       throw new S(403, {
-        message: `This ${Ce(t.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
+        message: `This ${Se(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
       });
     return e();
   };
 }
-function Se(r) {
-  return async (e, t) => {
-    if (!r.accessControl)
-      return t();
-    const a = e.var.tenant_id, n = e.var.organization_id;
+function ne(t, e) {
+  const { controlPlaneTenantId: n, controlPlaneClientId: a } = e;
+  return {
+    ...t,
+    legacyClients: {
+      ...t.legacyClients,
+      get: async (r) => {
+        var u;
+        const l = await t.legacyClients.get(r);
+        if (!l)
+          return null;
+        const s = a ? await t.legacyClients.get(a) : void 0, i = await t.connections.list(
+          l.tenant.id
+        ), p = n ? await t.connections.list(n) : { connections: [] }, o = i.connections.map((d) => {
+          var w;
+          const m = (w = p.connections) == null ? void 0 : w.find(
+            (g) => g.name === d.name
+          );
+          if (!(m != null && m.options))
+            return d;
+          const f = G.parse({
+            ...m || {},
+            ...d
+          });
+          return f.options = K.parse({
+            ...m.options || {},
+            ...d.options
+          }), f;
+        }).filter((d) => d), c = {
+          ...(s == null ? void 0 : s.tenant) || {},
+          ...l.tenant
+        };
+        return !l.tenant.audience && ((u = s == null ? void 0 : s.tenant) != null && u.audience) && (c.audience = s.tenant.audience), {
+          ...l,
+          web_origins: [
+            ...(s == null ? void 0 : s.web_origins) || [],
+            ...l.web_origins || []
+          ],
+          allowed_logout_urls: [
+            ...(s == null ? void 0 : s.allowed_logout_urls) || [],
+            ...l.allowed_logout_urls || []
+          ],
+          callbacks: [
+            ...(s == null ? void 0 : s.callbacks) || [],
+            ...l.callbacks || []
+          ],
+          connections: o,
+          tenant: c
+        };
+      }
+    },
+    connections: {
+      ...t.connections,
+      get: async (r, l) => {
+        const s = await t.connections.get(
+          r,
+          l
+        );
+        if (!s || !n)
+          return s;
+        const i = await t.connections.get(
+          n,
+          l
+        );
+        if (!i)
+          return s;
+        const p = G.parse({
+          ...i,
+          ...s
+        });
+        return p.options = K.parse({
+          ...i.options || {},
+          ...s.options
+        }), p;
+      },
+      list: async (r, l) => {
+        const s = await t.connections.list(r, l);
+        if (!n || r === n)
+          return s;
+        const i = await t.connections.list(n), p = s.connections.map((o) => {
+          var d;
+          const c = (d = i.connections) == null ? void 0 : d.find(
+            (m) => m.name === o.name
+          );
+          if (!(c != null && c.options))
+            return o;
+          const u = G.parse({
+            ...c,
+            ...o
+          });
+          return u.options = K.parse({
+            ...c.options || {},
+            ...o.options
+          }), u;
+        });
+        return {
+          ...s,
+          connections: p
+        };
+      }
+    }
+    // Note: Additional adapters can be extended here for runtime fallback:
+    // - promptSettings: Fall back to control plane prompts
+    // - branding: Fall back to control plane branding/themes
+    // - emailProviders: Fall back to control plane SMTP settings
+    //
+    // For now, we pass through other adapters unchanged.
+    // They remain part of ...baseAdapters and can be properly wrapped by caching.
+  };
+}
+function Pe(t, e) {
+  return ne(t, e);
+}
+const Ne = ne, Ue = Pe;
+function De(t) {
+  return async (e, n) => {
+    if (!t.accessControl)
+      return n();
+    const a = e.var.tenant_id, r = e.var.organization_id;
     if (!a)
       throw new S(400, {
         message: "Tenant ID not found in request"
       });
-    if (!me(
-      n,
+    if (!we(
+      r,
       a,
-      r.accessControl.controlPlaneTenantId
+      t.accessControl.controlPlaneTenantId
     ))
       throw new S(403, {
         message: `Access denied to tenant ${a}`
       });
-    return t();
+    return n();
   };
 }
-function Pe(r) {
-  return async (e, t) => {
-    if (!r.subdomainRouting)
-      return t();
+function $e(t) {
+  return async (e, n) => {
+    if (!t.subdomainRouting)
+      return n();
     const {
       baseDomain: a,
-      reservedSubdomains: n = [],
-      resolveSubdomain: i
-    } = r.subdomainRouting, l = e.req.header("host") || "";
-    let o = null;
-    if (l.endsWith(a)) {
-      const s = l.slice(0, -(a.length + 1));
-      s && !s.includes(".") && (o = s);
+      reservedSubdomains: r = [],
+      resolveSubdomain: l
+    } = t.subdomainRouting, s = e.req.header("host") || "";
+    let i = null;
+    if (s.endsWith(a)) {
+      const o = s.slice(0, -(a.length + 1));
+      o && !o.includes(".") && (i = o);
     }
-    if (o && n.includes(o) && (o = null), !o)
-      return r.accessControl && e.set("tenant_id", r.accessControl.controlPlaneTenantId), t();
-    let m = null;
-    if (i)
-      m = await i(o);
-    else if (r.subdomainRouting.useOrganizations !== !1 && r.accessControl)
+    if (i && r.includes(i) && (i = null), !i)
+      return t.accessControl && e.set("tenant_id", t.accessControl.controlPlaneTenantId), n();
+    let p = null;
+    if (l)
+      p = await l(i);
+    else if (t.subdomainRouting.useOrganizations !== !1 && t.accessControl)
       try {
-        const s = await e.env.data.organizations.get(
-          r.accessControl.controlPlaneTenantId,
-          o
+        const o = await e.env.data.organizations.get(
+          t.accessControl.controlPlaneTenantId,
+          i
         );
-        s && (m = s.id);
+        o && (p = o.id);
       } catch {
       }
-    if (!m)
+    if (!p)
       throw new S(404, {
-        message: `Tenant not found for subdomain: ${o}`
+        message: `Tenant not found for subdomain: ${i}`
       });
-    return e.set("tenant_id", m), t();
+    return e.set("tenant_id", p), n();
   };
 }
-function Ie(r) {
-  return async (e, t) => {
-    if (!r.databaseIsolation)
-      return t();
+function ze(t) {
+  return async (e, n) => {
+    if (!t.databaseIsolation)
+      return n();
     const a = e.var.tenant_id;
     if (!a)
       throw new S(400, {
         message: "Tenant ID not found in request"
       });
     try {
-      const n = await r.databaseIsolation.getAdapters(a);
-      e.env.data = n;
-    } catch (n) {
+      const r = await t.databaseIsolation.getAdapters(a);
+      e.env.data = r;
+    } catch (r) {
       throw console.error(
         `Failed to resolve database for tenant ${a}:`,
-        n
+        r
       ), new S(500, {
         message: "Failed to resolve tenant database"
       });
     }
-    return t();
+    return n();
   };
 }
-function ee(r) {
-  const e = Pe(r), t = Se(r), a = Ie(r);
-  return async (n, i) => (await e(n, async () => {
-  }), await t(n, async () => {
-  }), await a(n, async () => {
-  }), i());
+function re(t) {
+  const e = $e(t), n = De(t), a = ze(t);
+  return async (r, l) => (await e(r, async () => {
+  }), await n(r, async () => {
+  }), await a(r, async () => {
+  }), l());
 }
-function je(r) {
-  const e = q(r);
+function Be(t) {
+  const e = j(t);
   return {
     name: "multi-tenancy",
     // Apply multi-tenancy middleware for subdomain routing, database resolution, etc.
-    middleware: ee(r),
+    middleware: re(t),
     // Provide lifecycle hooks
     hooks: e,
     // Mount tenant management routes
     routes: [
       {
         path: "/management",
-        handler: L(r, e)
+        handler: W(t, e)
       }
     ],
     // Called when plugin is registered
     onRegister: async () => {
-      console.log("Multi-tenancy plugin registered"), r.accessControl && console.log(
-        `  - Access control enabled (control plane: ${r.accessControl.controlPlaneTenantId})`
-      ), r.subdomainRouting && console.log(
-        `  - Subdomain routing enabled (base domain: ${r.subdomainRouting.baseDomain})`
-      ), r.databaseIsolation && console.log("  - Database isolation enabled");
+      console.log("Multi-tenancy plugin registered"), t.accessControl && console.log(
+        `  - Access control enabled (control plane: ${t.accessControl.controlPlaneTenantId})`
+      ), t.subdomainRouting && console.log(
+        `  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`
+      ), t.databaseIsolation && console.log("  - Database isolation enabled");
     }
   };
 }
-function q(r) {
-  const e = r.accessControl ? ue(r.accessControl) : {}, t = r.databaseIsolation ? pe(r.databaseIsolation) : {}, a = fe(r);
+function j(t) {
+  const e = t.accessControl ? fe(t.accessControl) : {}, n = t.databaseIsolation ? ge(t.databaseIsolation) : {}, a = he(t);
   return {
     ...e,
-    ...t,
+    ...n,
     tenants: a
   };
 }
-function De(r) {
-  const e = new x(), t = q(r);
-  return e.route("/tenants", L(r, t)), e;
+function Oe(t) {
+  const e = new te(), n = j(t);
+  return e.route("/tenants", W(t, n)), e;
 }
-function qe(r) {
+function Ge(t) {
   return {
-    hooks: q(r),
-    middleware: ee(r),
-    app: De(r),
-    config: r
+    hooks: j(t),
+    middleware: re(t),
+    app: Oe(t),
+    config: t
   };
 }
-function Me(r) {
-  var C, $, b, y, A, I, j, R, D, V, W, Q, J, X, Y;
+function Ke(t) {
+  var A, $, b, y, C, P, q, R, D, Q, J, X, Y, Z, E;
   const {
     controlPlaneTenantId: e = "control_plane",
-    sync: t,
+    sync: n,
     multiTenancy: a,
-    entityHooks: n,
-    ...i
-  } = r, l = {
+    entityHooks: r,
+    ...l
+  } = t, s = {
     ...a,
     accessControl: {
       controlPlaneTenantId: e,
@@ -966,24 +1044,24 @@ function Me(r) {
       defaultPermissions: ["tenant:admin"],
       ...a == null ? void 0 : a.accessControl
     }
-  }, o = q(l), m = ((C = a == null ? void 0 : a.databaseIsolation) == null ? void 0 : C.getAdapters) ?? (async () => r.dataAdapter), { entityHooks: s, tenantHooks: c } = ye({
+  }, i = j(s), p = ((A = a == null ? void 0 : a.databaseIsolation) == null ? void 0 : A.getAdapters) ?? (async () => t.dataAdapter), { entityHooks: o, tenantHooks: c } = Ce({
     controlPlaneTenantId: e,
     getChildTenantIds: async () => (await F(
-      (T) => r.dataAdapter.tenants.list(T),
+      (T) => t.dataAdapter.tenants.list(T),
       "tenants",
       { cursorField: "id", pageSize: 100 }
     )).filter((T) => T.id !== e).map((T) => T.id),
-    getAdapters: m,
-    getControlPlaneAdapters: async () => m(e),
-    sync: t
+    getAdapters: p,
+    getControlPlaneAdapters: async () => p(e),
+    sync: n
   });
-  function d(P, T) {
-    if (!(!P && !T))
-      return P ? T ? async (...te) => {
+  function u(I, T) {
+    if (!(!I && !T))
+      return I ? T ? async (...ae) => {
         const O = [];
-        for (const M of [P, T])
+        for (const M of [I, T])
           try {
-            await M(...te);
+            await M(...ae);
           } catch (N) {
             O.push(N instanceof Error ? N : new Error(String(N)));
           }
@@ -993,117 +1071,121 @@ function Me(r) {
             O,
             O.map((M) => M.message).join("; ")
           );
-      } : P : T;
+      } : I : T;
   }
-  const u = {
-    ...n,
-    resourceServers: s != null && s.resourceServers ? {
-      ...n == null ? void 0 : n.resourceServers,
-      afterCreate: d(
-        ($ = n == null ? void 0 : n.resourceServers) == null ? void 0 : $.afterCreate,
-        s.resourceServers.afterCreate
+  const d = {
+    ...r,
+    resourceServers: o != null && o.resourceServers ? {
+      ...r == null ? void 0 : r.resourceServers,
+      afterCreate: u(
+        ($ = r == null ? void 0 : r.resourceServers) == null ? void 0 : $.afterCreate,
+        o.resourceServers.afterCreate
       ),
-      afterUpdate: d(
-        (b = n == null ? void 0 : n.resourceServers) == null ? void 0 : b.afterUpdate,
-        s.resourceServers.afterUpdate
+      afterUpdate: u(
+        (b = r == null ? void 0 : r.resourceServers) == null ? void 0 : b.afterUpdate,
+        o.resourceServers.afterUpdate
       ),
-      beforeDelete: d(
-        (y = n == null ? void 0 : n.resourceServers) == null ? void 0 : y.beforeDelete,
-        s.resourceServers.beforeDelete
+      beforeDelete: u(
+        (y = r == null ? void 0 : r.resourceServers) == null ? void 0 : y.beforeDelete,
+        o.resourceServers.beforeDelete
       ),
-      afterDelete: d(
-        (A = n == null ? void 0 : n.resourceServers) == null ? void 0 : A.afterDelete,
-        s.resourceServers.afterDelete
+      afterDelete: u(
+        (C = r == null ? void 0 : r.resourceServers) == null ? void 0 : C.afterDelete,
+        o.resourceServers.afterDelete
       )
-    } : n == null ? void 0 : n.resourceServers,
-    roles: s != null && s.roles ? {
-      ...n == null ? void 0 : n.roles,
-      afterCreate: d(
-        (I = n == null ? void 0 : n.roles) == null ? void 0 : I.afterCreate,
-        s.roles.afterCreate
+    } : r == null ? void 0 : r.resourceServers,
+    roles: o != null && o.roles ? {
+      ...r == null ? void 0 : r.roles,
+      afterCreate: u(
+        (P = r == null ? void 0 : r.roles) == null ? void 0 : P.afterCreate,
+        o.roles.afterCreate
       ),
-      afterUpdate: d(
-        (j = n == null ? void 0 : n.roles) == null ? void 0 : j.afterUpdate,
-        s.roles.afterUpdate
+      afterUpdate: u(
+        (q = r == null ? void 0 : r.roles) == null ? void 0 : q.afterUpdate,
+        o.roles.afterUpdate
       ),
-      beforeDelete: d(
-        (R = n == null ? void 0 : n.roles) == null ? void 0 : R.beforeDelete,
-        s.roles.beforeDelete
+      beforeDelete: u(
+        (R = r == null ? void 0 : r.roles) == null ? void 0 : R.beforeDelete,
+        o.roles.beforeDelete
       ),
-      afterDelete: d(
-        (D = n == null ? void 0 : n.roles) == null ? void 0 : D.afterDelete,
-        s.roles.afterDelete
+      afterDelete: u(
+        (D = r == null ? void 0 : r.roles) == null ? void 0 : D.afterDelete,
+        o.roles.afterDelete
       )
-    } : n == null ? void 0 : n.roles,
-    connections: s != null && s.connections ? {
-      ...n == null ? void 0 : n.connections,
-      afterCreate: d(
-        (V = n == null ? void 0 : n.connections) == null ? void 0 : V.afterCreate,
-        s.connections.afterCreate
+    } : r == null ? void 0 : r.roles,
+    connections: o != null && o.connections ? {
+      ...r == null ? void 0 : r.connections,
+      afterCreate: u(
+        (Q = r == null ? void 0 : r.connections) == null ? void 0 : Q.afterCreate,
+        o.connections.afterCreate
       ),
-      afterUpdate: d(
-        (W = n == null ? void 0 : n.connections) == null ? void 0 : W.afterUpdate,
-        s.connections.afterUpdate
+      afterUpdate: u(
+        (J = r == null ? void 0 : r.connections) == null ? void 0 : J.afterUpdate,
+        o.connections.afterUpdate
       ),
-      beforeDelete: d(
-        (Q = n == null ? void 0 : n.connections) == null ? void 0 : Q.beforeDelete,
-        s.connections.beforeDelete
+      beforeDelete: u(
+        (X = r == null ? void 0 : r.connections) == null ? void 0 : X.beforeDelete,
+        o.connections.beforeDelete
       ),
-      afterDelete: d(
-        (J = n == null ? void 0 : n.connections) == null ? void 0 : J.afterDelete,
-        s.connections.afterDelete
+      afterDelete: u(
+        (Y = r == null ? void 0 : r.connections) == null ? void 0 : Y.afterDelete,
+        o.connections.afterDelete
       )
-    } : n == null ? void 0 : n.connections,
+    } : r == null ? void 0 : r.connections,
     tenants: c ? {
-      ...n == null ? void 0 : n.tenants,
-      afterCreate: d(
-        (X = n == null ? void 0 : n.tenants) == null ? void 0 : X.afterCreate,
+      ...r == null ? void 0 : r.tenants,
+      afterCreate: u(
+        (Z = r == null ? void 0 : r.tenants) == null ? void 0 : Z.afterCreate,
         c.afterCreate
       )
-    } : n == null ? void 0 : n.tenants
-  }, p = {
-    ...o,
+    } : r == null ? void 0 : r.tenants
+  }, m = {
+    ...i,
     tenants: c ? {
-      ...o.tenants,
-      afterCreate: d(
-        (Y = o.tenants) == null ? void 0 : Y.afterCreate,
+      ...i.tenants,
+      afterCreate: u(
+        (E = i.tenants) == null ? void 0 : E.afterCreate,
         c.afterCreate
       )
-    } : o.tenants
-  }, f = L(
-    l,
-    p
-  ), w = ie({
-    ...i,
-    entityHooks: u,
+    } : i.tenants
+  }, f = W(
+    s,
+    m
+  ), w = de({
+    ...l,
+    entityHooks: d,
     managementApiExtensions: [
-      ...i.managementApiExtensions || [],
+      ...l.managementApiExtensions || [],
       { path: "/tenants", router: f }
     ]
-  }), { app: h, managementApp: g, ...v } = w, _ = new x();
-  return _.onError((P, T) => P instanceof S ? P.getResponse() : (console.error(P), T.json({ message: "Internal Server Error" }, 500))), _.use("/api/v2/*", Te()), _.route("/", h), {
+  }), { app: g, managementApp: h, ...v } = w, _ = new te();
+  return _.onError((I, T) => I instanceof S ? I.getResponse() : (console.error(I), T.json({ message: "Internal Server Error" }, 500))), _.use("/api/v2/*", Ie()), _.route("/", g), {
     app: _,
-    managementApp: g,
+    managementApp: h,
     ...v,
-    multiTenancyConfig: l,
-    multiTenancyHooks: o
+    multiTenancyConfig: s,
+    multiTenancyHooks: i
   };
 }
 export {
-  ue as createAccessControlHooks,
-  Se as createAccessControlMiddleware,
-  pe as createDatabaseHooks,
-  Ie as createDatabaseMiddleware,
-  De as createMultiTenancy,
-  q as createMultiTenancyHooks,
-  ee as createMultiTenancyMiddleware,
-  je as createMultiTenancyPlugin,
-  Te as createProtectSyncedMiddleware,
-  fe as createProvisioningHooks,
-  Pe as createSubdomainMiddleware,
-  ye as createSyncHooks,
-  L as createTenantsOpenAPIRouter,
-  Me as init,
-  qe as setupMultiTenancy,
-  me as validateTenantAccess
+  fe as createAccessControlHooks,
+  De as createAccessControlMiddleware,
+  ge as createDatabaseHooks,
+  ze as createDatabaseMiddleware,
+  Oe as createMultiTenancy,
+  j as createMultiTenancyHooks,
+  re as createMultiTenancyMiddleware,
+  Be as createMultiTenancyPlugin,
+  Ie as createProtectSyncedMiddleware,
+  he as createProvisioningHooks,
+  ne as createRuntimeFallbackAdapter,
+  Ne as createSettingsInheritanceAdapter,
+  $e as createSubdomainMiddleware,
+  Ce as createSyncHooks,
+  W as createTenantsOpenAPIRouter,
+  Ke as init,
+  Ge as setupMultiTenancy,
+  we as validateTenantAccess,
+  Pe as withRuntimeFallback,
+  Ue as withSettingsInheritance
 };