@authhero/multi-tenancy 13.17.0 → 13.19.0

package/dist/multi-tenancy.mjs

@@ -1,96 +1,96 @@
 var V = Object.defineProperty;
-var W = (t, e, n) => e in t ? V(t, e, { enumerable: !0, configurable: !0, writable: !0, value: n }) : t[e] = n;
-var O = (t, e, n) => W(t, typeof e != "symbol" ? e + "" : e, n);
+var W = (n, e, t) => e in n ? V(n, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : n[e] = t;
+var O = (n, e, t) => W(n, typeof e != "symbol" ? e + "" : e, t);
 import { Hono as Q } from "hono";
-import { getTenantAudience as J, MANAGEMENT_API_SCOPES as X, MANAGEMENT_API_AUDIENCE as Y, fetchAll as z } from "authhero";
-import { OpenAPIHono as Z, createRoute as R, z as I } from "@hono/zod-openapi";
-import { auth0QuerySchema as x, tenantSchema as j, tenantInsertSchema as ee, connectionSchema as k, connectionOptionsSchema as D } from "@authhero/adapter-interfaces";
-function te(t) {
-  const { controlPlaneTenantId: e, requireOrganizationMatch: n = !0 } = t;
+import { getTenantAudience as J, MANAGEMENT_API_SCOPES as X, MANAGEMENT_API_AUDIENCE as Y, fetchAll as $, init as Z } from "authhero";
+import { OpenAPIHono as x, createRoute as R, z as I } from "@hono/zod-openapi";
+import { auth0QuerySchema as ee, tenantSchema as N, tenantInsertSchema as te, connectionSchema as D, connectionOptionsSchema as F } from "@authhero/adapter-interfaces";
+function ne(n) {
+  const { controlPlaneTenantId: e, requireOrganizationMatch: t = !0 } = n;
   return {
-    async onTenantAccessValidation(s, a) {
-      if (a === e)
+    async onTenantAccessValidation(s, r) {
+      if (r === e)
         return !0;
-      if (n) {
-        const o = s.var.org_name, r = s.var.organization_id, i = o || r;
-        return i ? i === a : !1;
+      if (t) {
+        const i = s.var.org_name, o = s.var.organization_id, a = i || o;
+        return a ? a === r : !1;
       }
       return !0;
     }
   };
 }
-function ne(t, e, n, s) {
-  if (e === n)
+function se(n, e, t, s) {
+  if (e === t)
     return !0;
-  const a = s || t;
-  return a ? a === e : !1;
+  const r = s || n;
+  return r ? r === e : !1;
 }
-function se(t) {
+function re(n) {
   return {
     async resolveDataAdapters(e) {
       try {
-        return await t.getAdapters(e);
-      } catch (n) {
+        return await n.getAdapters(e);
+      } catch (t) {
         console.error(
           `Failed to resolve data adapters for tenant ${e}:`,
-          n
+          t
         );
         return;
       }
     }
   };
 }
-function ae(t) {
+function ae(n) {
   return {
-    async beforeCreate(e, n) {
-      return !n.audience && n.id ? {
-        ...n,
-        audience: J(n.id)
-      } : n;
+    async beforeCreate(e, t) {
+      return !t.audience && t.id ? {
+        ...t,
+        audience: J(t.id)
+      } : t;
     },
-    async afterCreate(e, n) {
-      const { accessControl: s, databaseIsolation: a } = t;
-      s && e.ctx && await re(e, n, s), a != null && a.onProvision && await a.onProvision(n.id);
+    async afterCreate(e, t) {
+      const { accessControl: s, databaseIsolation: r } = n;
+      s && e.ctx && await oe(e, t, s), r != null && r.onProvision && await r.onProvision(t.id);
     },
-    async beforeDelete(e, n) {
-      const { accessControl: s, databaseIsolation: a } = t;
+    async beforeDelete(e, t) {
+      const { accessControl: s, databaseIsolation: r } = n;
       if (s)
         try {
-          const r = (await e.adapters.organizations.list(
+          const o = (await e.adapters.organizations.list(
             s.controlPlaneTenantId
-          )).organizations.find((i) => i.name === n);
-          r && await e.adapters.organizations.remove(
+          )).organizations.find((a) => a.name === t);
+          o && await e.adapters.organizations.remove(
             s.controlPlaneTenantId,
-            r.id
+            o.id
           );
-        } catch (o) {
+        } catch (i) {
           console.warn(
-            `Failed to remove organization for tenant ${n}:`,
-            o
+            `Failed to remove organization for tenant ${t}:`,
+            i
           );
         }
-      if (a != null && a.onDeprovision)
+      if (r != null && r.onDeprovision)
         try {
-          await a.onDeprovision(n);
-        } catch (o) {
+          await r.onDeprovision(t);
+        } catch (i) {
           console.warn(
-            `Failed to deprovision database for tenant ${n}:`,
-            o
+            `Failed to deprovision database for tenant ${t}:`,
+            i
           );
         }
     }
   };
 }
-async function re(t, e, n) {
+async function oe(n, e, t) {
   const {
     controlPlaneTenantId: s,
-    defaultPermissions: a,
-    defaultRoles: o,
-    issuer: r,
-    adminRoleName: i = "Tenant Admin",
+    defaultPermissions: r,
+    defaultRoles: i,
+    issuer: o,
+    adminRoleName: a = "Tenant Admin",
     adminRoleDescription: m = "Full access to all tenant management operations",
     addCreatorToOrganization: d = !0
-  } = n, c = await t.adapters.organizations.create(
+  } = t, c = await n.adapters.organizations.create(
     s,
     {
       name: e.id,
@@ -98,80 +98,80 @@ async function re(t, e, n) {
     }
   );
   let p;
-  if (r && (p = await ie(
-    t,
+  if (o && (p = await ce(
+    n,
     s,
-    i,
+    a,
     m
-  )), d && t.ctx) {
-    const l = t.ctx.var.user;
-    if (l != null && l.sub && !await oe(
-      t,
+  )), d && n.ctx) {
+    const l = n.ctx.var.user;
+    if (l != null && l.sub && !await ie(
+      n,
       s,
       l.sub
     ))
       try {
-        await t.adapters.userOrganizations.create(s, {
+        await n.adapters.userOrganizations.create(s, {
           user_id: l.sub,
           organization_id: c.id
-        }), p && await t.adapters.userRoles.create(
+        }), p && await n.adapters.userRoles.create(
           s,
           l.sub,
           p,
           c.id
           // organizationId
         );
-      } catch (f) {
+      } catch (w) {
         console.warn(
           `Failed to add creator ${l.sub} to organization ${c.id}:`,
-          f
+          w
         );
       }
   }
-  o && o.length > 0 && console.log(
-    `Would assign roles ${o.join(", ")} to organization ${c.id}`
-  ), a && a.length > 0 && console.log(
-    `Would grant permissions ${a.join(", ")} to organization ${c.id}`
+  i && i.length > 0 && console.log(
+    `Would assign roles ${i.join(", ")} to organization ${c.id}`
+  ), r && r.length > 0 && console.log(
+    `Would grant permissions ${r.join(", ")} to organization ${c.id}`
   );
 }
-async function oe(t, e, n) {
-  const s = await t.adapters.userRoles.list(
+async function ie(n, e, t) {
+  const s = await n.adapters.userRoles.list(
     e,
-    n,
+    t,
     void 0,
     ""
     // Empty string for global roles
   );
-  for (const a of s)
-    if ((await t.adapters.rolePermissions.list(
+  for (const r of s)
+    if ((await n.adapters.rolePermissions.list(
       e,
-      a.id,
+      r.id,
       { per_page: 1e3 }
     )).some(
-      (i) => i.permission_name === "admin:organizations"
+      (a) => a.permission_name === "admin:organizations"
     ))
       return !0;
   return !1;
 }
-async function ie(t, e, n, s) {
-  const o = (await t.adapters.roles.list(e, {})).roles.find((d) => d.name === n);
-  if (o)
-    return o.id;
-  const r = await t.adapters.roles.create(e, {
-    name: n,
+async function ce(n, e, t, s) {
+  const i = (await n.adapters.roles.list(e, {})).roles.find((d) => d.name === t);
+  if (i)
+    return i.id;
+  const o = await n.adapters.roles.create(e, {
+    name: t,
     description: s
-  }), i = Y, m = X.map((d) => ({
-    role_id: r.id,
-    resource_server_identifier: i,
+  }), a = Y, m = X.map((d) => ({
+    role_id: o.id,
+    resource_server_identifier: a,
     permission_name: d.value
   }));
-  return await t.adapters.rolePermissions.assign(
+  return await n.adapters.rolePermissions.assign(
     e,
-    r.id,
+    o.id,
     m
-  ), r.id;
+  ), o.id;
 }
-const ce = [
+const le = [
   "client_id",
   "client_secret",
   "app_secret",
@@ -180,44 +180,44 @@ const ce = [
   "twilio_sid",
   "twilio_token"
 ];
-function E(t, e, n = () => !0) {
-  const { controlPlaneTenantId: s, getChildTenantIds: a, getAdapters: o } = t, r = /* @__PURE__ */ new Map();
-  async function i(c, p, l) {
+function q(n, e, t = () => !0) {
+  const { controlPlaneTenantId: s, getChildTenantIds: r, getAdapters: i } = n, o = /* @__PURE__ */ new Map();
+  async function a(c, p, l) {
     return (await e(c).list(p, {
       q: `name:${l}`,
       per_page: 1
     }))[0] ?? null;
   }
   async function m(c) {
-    const p = await a(), l = e(await o(s));
+    const p = await r(), l = e(await i(s));
     await Promise.all(
       p.map(async (u) => {
         try {
-          const f = await o(u), g = e(f), h = {
+          const w = await i(u), g = e(w), h = {
             ...l.transform(c),
             is_system: !0
-          }, y = await i(f, u, c.name), v = y ? g.getId(y) : void 0;
+          }, y = await a(w, u, c.name), v = y ? g.getId(y) : void 0;
           if (y && v) {
-            const A = g.preserveOnUpdate ? g.preserveOnUpdate(y, h) : h;
-            await g.update(u, v, A);
+            const b = g.preserveOnUpdate ? g.preserveOnUpdate(y, h) : h;
+            await g.update(u, v, b);
           } else
             await g.create(u, h);
-        } catch (f) {
+        } catch (w) {
           console.error(
             `Failed to sync ${l.listKey} "${c.name}" to tenant "${u}":`,
-            f
+            w
           );
         }
       })
     );
   }
   async function d(c) {
-    const p = await a();
+    const p = await r();
     await Promise.all(
       p.map(async (l) => {
         try {
-          const u = await o(l), f = e(u), g = await i(u, l, c), w = g ? f.getId(g) : void 0;
-          g && w && await f.remove(l, w);
+          const u = await i(l), w = e(u), g = await a(u, l, c), f = g ? w.getId(g) : void 0;
+          g && f && await w.remove(l, f);
         } catch (u) {
           console.error(
             `Failed to delete entity "${c}" from tenant "${l}":`,
@@ -229,66 +229,66 @@ function E(t, e, n = () => !0) {
   }
   return {
     afterCreate: async (c, p) => {
-      c.tenantId === s && n(p) && await m(p);
+      c.tenantId === s && t(p) && await m(p);
     },
     afterUpdate: async (c, p, l) => {
-      c.tenantId === s && n(l) && await m(l);
+      c.tenantId === s && t(l) && await m(l);
     },
     beforeDelete: async (c, p) => {
       if (c.tenantId !== s) return;
       const u = await e(c.adapters).get(c.tenantId, p);
-      u && n(u) && r.set(p, u);
+      u && t(u) && o.set(p, u);
     },
     afterDelete: async (c, p) => {
       if (c.tenantId !== s) return;
-      const l = r.get(p);
-      l && (r.delete(p), await d(l.name));
+      const l = o.get(p);
+      l && (o.delete(p), await d(l.name));
     }
   };
 }
-function F(t, e, n = () => !0) {
-  const { controlPlaneTenantId: s, getControlPlaneAdapters: a, getAdapters: o } = t;
+function M(n, e, t = () => !0) {
+  const { controlPlaneTenantId: s, getControlPlaneAdapters: r, getAdapters: i } = n;
   return {
-    async afterCreate(r, i) {
-      if (i.id !== s)
+    async afterCreate(o, a) {
+      if (a.id !== s)
         try {
-          const m = await a(), d = await o(i.id), c = e(m), p = e(d), l = await z(
+          const m = await r(), d = await i(a.id), c = e(m), p = e(d), l = await $(
             (u) => c.listPaginated(s, u),
             c.listKey,
             { cursorField: "id", pageSize: 100 }
           );
           await Promise.all(
-            l.filter((u) => n(u)).map(async (u) => {
+            l.filter((u) => t(u)).map(async (u) => {
               try {
-                const f = c.transform(u);
-                await p.create(i.id, {
-                  ...f,
+                const w = c.transform(u);
+                await p.create(a.id, {
+                  ...w,
                   is_system: !0
                 });
-              } catch (f) {
+              } catch (w) {
                 console.error(
-                  `Failed to sync entity to new tenant "${i.id}":`,
-                  f
+                  `Failed to sync entity to new tenant "${a.id}":`,
+                  w
                 );
               }
             })
           );
         } catch (m) {
           console.error(
-            `Failed to sync entities to new tenant "${i.id}":`,
+            `Failed to sync entities to new tenant "${a.id}":`,
             m
           );
         }
     }
   };
 }
-const N = (t) => ({
-  list: async (e, n) => (await t.resourceServers.list(e, n)).resource_servers,
-  listPaginated: (e, n) => t.resourceServers.list(e, n),
-  get: (e, n) => t.resourceServers.get(e, n),
-  create: (e, n) => t.resourceServers.create(e, n),
-  update: (e, n, s) => t.resourceServers.update(e, n, s),
-  remove: (e, n) => t.resourceServers.remove(e, n),
+const H = (n) => ({
+  list: async (e, t) => (await n.resourceServers.list(e, t)).resource_servers,
+  listPaginated: (e, t) => n.resourceServers.list(e, t),
+  get: (e, t) => n.resourceServers.get(e, t),
+  create: (e, t) => n.resourceServers.create(e, t),
+  update: (e, t, s) => n.resourceServers.update(e, t, s),
+  remove: (e, t) => n.resourceServers.remove(e, t),
   listKey: "resource_servers",
   getId: (e) => e.id,
   transform: (e) => ({
@@ -300,13 +300,13 @@ const N = (t) => ({
     token_lifetime: e.token_lifetime,
     token_lifetime_for_web: e.token_lifetime_for_web
   })
-}), H = (t) => ({
-  list: async (e, n) => (await t.roles.list(e, n)).roles,
-  listPaginated: (e, n) => t.roles.list(e, n),
-  get: (e, n) => t.roles.get(e, n),
-  create: (e, n) => t.roles.create(e, n),
-  update: (e, n, s) => t.roles.update(e, n, s),
-  remove: (e, n) => t.roles.remove(e, n),
+}), G = (n) => ({
+  list: async (e, t) => (await n.roles.list(e, t)).roles,
+  listPaginated: (e, t) => n.roles.list(e, t),
+  get: (e, t) => n.roles.get(e, t),
+  create: (e, t) => n.roles.create(e, t),
+  update: (e, t, s) => n.roles.update(e, t, s),
+  remove: (e, t) => n.roles.remove(e, t),
   listKey: "roles",
   getId: (e) => e.id,
   transform: (e) => ({
@@ -314,25 +314,25 @@ const N = (t) => ({
     name: e.name,
     description: e.description
   })
-}), U = (t) => ({
-  list: async (e, n) => (await t.connections.list(e, n)).connections,
-  listPaginated: (e, n) => t.connections.list(e, n),
-  get: (e, n) => t.connections.get(e, n),
-  create: (e, n) => t.connections.create(e, n),
-  update: (e, n, s) => t.connections.update(e, n, s),
-  remove: (e, n) => t.connections.remove(e, n),
+}), U = (n) => ({
+  list: async (e, t) => (await n.connections.list(e, t)).connections,
+  listPaginated: (e, t) => n.connections.list(e, t),
+  get: (e, t) => n.connections.get(e, t),
+  create: (e, t) => n.connections.create(e, t),
+  update: (e, t, s) => n.connections.update(e, t, s),
+  remove: (e, t) => n.connections.remove(e, t),
   listKey: "connections",
   getId: (e) => e.id,
   transform: (e) => {
-    const n = e.options ? { ...e.options } : {};
-    for (const s of ce)
-      delete n[s];
+    const t = e.options ? { ...e.options } : {};
+    for (const s of le)
+      delete t[s];
     return {
       id: e.id,
       name: e.name,
       display_name: e.display_name,
       strategy: e.strategy,
-      options: n,
+      options: t,
       response_type: e.response_type,
       response_mode: e.response_mode,
       is_domain_connection: e.is_domain_connection,
@@ -340,12 +340,12 @@ const N = (t) => ({
       metadata: e.metadata
     };
   },
-  preserveOnUpdate: (e, n) => {
+  preserveOnUpdate: (e, t) => {
     const s = e.options || {};
     return {
-      ...n,
+      ...t,
       options: {
-        ...n.options,
+        ...t.options,
         client_id: s.client_id,
         client_secret: s.client_secret,
         app_secret: s.app_secret,
@@ -357,111 +357,111 @@ const N = (t) => ({
     };
   }
 });
-function Te(t) {
-  const { sync: e = {}, filters: n = {} } = t, s = e.resourceServers ?? !0, a = e.roles ?? !0, o = e.connections ?? !0, r = s ? E(
-    t,
-    N,
-    n.resourceServers
-  ) : void 0, i = a ? E(
-    t,
+function de(n) {
+  const { sync: e = {}, filters: t = {} } = n, s = e.resourceServers ?? !0, r = e.roles ?? !0, i = e.connections ?? !0, o = s ? q(
+    n,
     H,
-    n.roles
-  ) : void 0, m = o ? E(
-    t,
+    t.resourceServers
+  ) : void 0, a = r ? q(
+    n,
+    G,
+    t.roles
+  ) : void 0, m = i ? q(
+    n,
     U,
-    n.connections
-  ) : void 0, d = s ? F(
-    t,
-    N,
-    n.resourceServers
-  ) : void 0, c = a ? F(
-    t,
+    t.connections
+  ) : void 0, d = s ? M(
+    n,
     H,
-    n.roles
-  ) : void 0, p = o ? F(
-    t,
+    t.resourceServers
+  ) : void 0, c = r ? M(
+    n,
+    G,
+    t.roles
+  ) : void 0, p = i ? M(
+    n,
     U,
-    n.connections
-  ) : void 0, l = a ? {
-    async afterCreate(g, w) {
+    t.connections
+  ) : void 0, l = r ? {
+    async afterCreate(g, f) {
       var h;
-      if (w.id !== t.controlPlaneTenantId) {
-        await ((h = c == null ? void 0 : c.afterCreate) == null ? void 0 : h.call(c, g, w));
+      if (f.id !== n.controlPlaneTenantId) {
+        await ((h = c == null ? void 0 : c.afterCreate) == null ? void 0 : h.call(c, g, f));
         try {
-          const y = await t.getControlPlaneAdapters(), v = await t.getAdapters(w.id), A = await z(
-            (b) => y.roles.list(
-              t.controlPlaneTenantId,
-              b
+          const y = await n.getControlPlaneAdapters(), v = await n.getAdapters(f.id), b = await $(
+            (_) => y.roles.list(
+              n.controlPlaneTenantId,
+              _
             ),
             "roles",
             { cursorField: "id", pageSize: 100 }
-          ), $ = /* @__PURE__ */ new Map();
-          for (const b of A.filter(
-            (_) => {
-              var T;
-              return ((T = n.roles) == null ? void 0 : T.call(n, _)) ?? !0;
+          ), S = /* @__PURE__ */ new Map();
+          for (const _ of b.filter(
+            (T) => {
+              var A;
+              return ((A = t.roles) == null ? void 0 : A.call(t, T)) ?? !0;
             }
           )) {
-            const _ = await u(
+            const T = await u(
               v,
-              w.id,
-              b.name
+              f.id,
+              _.name
             );
-            _ && $.set(b.name, _.id);
+            T && S.set(_.name, T.id);
           }
-          for (const b of A.filter(
-            (_) => {
-              var T;
-              return ((T = n.roles) == null ? void 0 : T.call(n, _)) ?? !0;
+          for (const _ of b.filter(
+            (T) => {
+              var A;
+              return ((A = t.roles) == null ? void 0 : A.call(t, T)) ?? !0;
             }
           )) {
-            const _ = $.get(b.name);
-            if (_)
+            const T = S.get(_.name);
+            if (T)
               try {
-                const T = await y.rolePermissions.list(
-                  t.controlPlaneTenantId,
-                  b.id,
+                const A = await y.rolePermissions.list(
+                  n.controlPlaneTenantId,
+                  _.id,
                   {}
                 );
-                T.length > 0 && await v.rolePermissions.assign(
-                  w.id,
-                  _,
-                  T.map((P) => ({
-                    role_id: _,
+                A.length > 0 && await v.rolePermissions.assign(
+                  f.id,
+                  T,
+                  A.map((P) => ({
+                    role_id: T,
                     resource_server_identifier: P.resource_server_identifier,
                     permission_name: P.permission_name
                   }))
                 );
-              } catch (T) {
+              } catch (A) {
                 console.error(
-                  `Failed to sync permissions for role "${b.name}" to tenant "${w.id}":`,
-                  T
+                  `Failed to sync permissions for role "${_.name}" to tenant "${f.id}":`,
+                  A
                 );
               }
           }
         } catch (y) {
           console.error(
-            `Failed to sync role permissions to tenant "${w.id}":`,
+            `Failed to sync role permissions to tenant "${f.id}":`,
             y
           );
         }
       }
     }
   } : void 0;
-  async function u(g, w, h) {
-    return (await g.roles.list(w, {
+  async function u(g, f, h) {
+    return (await g.roles.list(f, {
       q: `name:${h}`,
       per_page: 1
     })).roles[0] ?? null;
   }
   return {
     entityHooks: {
-      resourceServers: r,
-      roles: i,
+      resourceServers: o,
+      roles: a,
       connections: m
     },
     tenantHooks: {
-      async afterCreate(g, w) {
+      async afterCreate(g, f) {
         const h = [
           d == null ? void 0 : d.afterCreate,
           (l == null ? void 0 : l.afterCreate) ?? (c == null ? void 0 : c.afterCreate),
@@ -470,9 +470,9 @@ function Te(t) {
         for (const v of h)
           if (v)
             try {
-              await v(g, w);
-            } catch (A) {
-              y.push(A instanceof Error ? A : new Error(String(A)));
+              await v(g, f);
+            } catch (b) {
+              y.push(b instanceof Error ? b : new Error(String(b)));
             }
         if (y.length === 1) throw y[0];
         if (y.length > 1)
@@ -490,11 +490,11 @@ var C = class extends Error {
    * @param status - HTTP status code for the exception. Defaults to 500.
    * @param options - Additional options for the exception.
    */
-  constructor(e = 500, n) {
-    super(n == null ? void 0 : n.message, { cause: n == null ? void 0 : n.cause });
+  constructor(e = 500, t) {
+    super(t == null ? void 0 : t.message, { cause: t == null ? void 0 : t.cause });
     O(this, "res");
     O(this, "status");
-    this.res = n == null ? void 0 : n.res, this.status = e;
+    this.res = t == null ? void 0 : t.res, this.status = e;
   }
   /**
    * Returns the response object associated with the exception.
@@ -510,15 +510,15 @@ var C = class extends Error {
     });
   }
 };
-function B(t, e) {
-  const n = new Z();
-  return n.openapi(
+function k(n, e) {
+  const t = new x();
+  return t.openapi(
     R({
       tags: ["tenants"],
       method: "get",
       path: "/",
       request: {
-        query: x
+        query: ee
       },
       security: [
         {
@@ -530,7 +530,7 @@ function B(t, e) {
           content: {
             "application/json": {
               schema: I.object({
-                tenants: I.array(j),
+                tenants: I.array(N),
                 start: I.number().optional(),
                 limit: I.number().optional(),
                 length: I.number().optional()
@@ -542,73 +542,73 @@ function B(t, e) {
       }
     }),
     async (s) => {
-      var u, f, g, w;
-      const a = s.req.valid("query"), { page: o, per_page: r, include_totals: i, q: m } = a, d = s.var.user, c = (d == null ? void 0 : d.permissions) || [];
+      var u, w, g, f;
+      const r = s.req.valid("query"), { page: i, per_page: o, include_totals: a, q: m } = r, d = s.var.user, c = (d == null ? void 0 : d.permissions) || [];
       if (c.includes("auth:read") || c.includes("admin:organizations")) {
         const h = await s.env.data.tenants.list({
-          page: o,
-          per_page: r,
-          include_totals: i,
+          page: i,
+          per_page: o,
+          include_totals: a,
           q: m
         });
-        return i ? s.json({
+        return a ? s.json({
           tenants: h.tenants,
           start: ((u = h.totals) == null ? void 0 : u.start) ?? 0,
-          limit: ((f = h.totals) == null ? void 0 : f.limit) ?? r,
+          limit: ((w = h.totals) == null ? void 0 : w.limit) ?? o,
           length: h.tenants.length
         }) : s.json({ tenants: h.tenants });
       }
-      if (t.accessControl && (d != null && d.sub)) {
-        const h = t.accessControl.controlPlaneTenantId, v = (await z(
-          (S) => s.env.data.userOrganizations.listUserOrganizations(
+      if (n.accessControl && (d != null && d.sub)) {
+        const h = n.accessControl.controlPlaneTenantId, v = (await $(
+          (z) => s.env.data.userOrganizations.listUserOrganizations(
             h,
             d.sub,
-            S
+            z
           ),
           "organizations"
-        )).map((S) => S.name);
+        )).map((z) => z.name);
         if (v.length === 0)
-          return i ? s.json({
+          return a ? s.json({
             tenants: [],
             start: 0,
-            limit: r ?? 50,
+            limit: o ?? 50,
             length: 0
           }) : s.json({ tenants: [] });
-        const A = v.length, $ = o ?? 0, b = r ?? 50, _ = $ * b, T = v.slice(_, _ + b);
-        if (T.length === 0)
-          return i ? s.json({
+        const b = v.length, S = i ?? 0, _ = o ?? 50, T = S * _, A = v.slice(T, T + _);
+        if (A.length === 0)
+          return a ? s.json({
             tenants: [],
-            start: _,
-            limit: b,
-            length: A
+            start: T,
+            limit: _,
+            length: b
           }) : s.json({ tenants: [] });
-        const P = T.map((S) => `id:${S}`).join(" OR "), L = m ? `(${P}) AND (${m})` : P, M = await s.env.data.tenants.list({
+        const P = A.map((z) => `id:${z}`).join(" OR "), L = m ? `(${P}) AND (${m})` : P, E = await s.env.data.tenants.list({
           q: L,
-          per_page: b,
+          per_page: _,
           include_totals: !1
           // We calculate totals from accessibleTenantIds
         });
-        return i ? s.json({
-          tenants: M.tenants,
-          start: _,
-          limit: b,
-          length: A
-        }) : s.json({ tenants: M.tenants });
+        return a ? s.json({
+          tenants: E.tenants,
+          start: T,
+          limit: _,
+          length: b
+        }) : s.json({ tenants: E.tenants });
       }
       const l = await s.env.data.tenants.list({
-        page: o,
-        per_page: r,
-        include_totals: i,
+        page: i,
+        per_page: o,
+        include_totals: a,
         q: m
       });
-      return i ? s.json({
+      return a ? s.json({
         tenants: l.tenants,
         start: ((g = l.totals) == null ? void 0 : g.start) ?? 0,
-        limit: ((w = l.totals) == null ? void 0 : w.limit) ?? r,
+        limit: ((f = l.totals) == null ? void 0 : f.limit) ?? o,
         length: l.tenants.length
       }) : s.json({ tenants: l.tenants });
     }
-  ), n.openapi(
+  ), t.openapi(
     R({
       tags: ["tenants"],
       method: "post",
@@ -617,7 +617,7 @@ function B(t, e) {
         body: {
           content: {
             "application/json": {
-              schema: ee
+              schema: te
             }
           }
         }
@@ -631,7 +631,7 @@ function B(t, e) {
         201: {
           content: {
             "application/json": {
-              schema: j
+              schema: N
             }
           },
           description: "Tenant created"
@@ -646,21 +646,21 @@ function B(t, e) {
     }),
     async (s) => {
       var m, d;
-      const a = s.var.user;
-      if (!(a != null && a.sub))
+      const r = s.var.user;
+      if (!(r != null && r.sub))
         throw new C(401, {
           message: "Authentication required to create tenants"
         });
-      let o = s.req.valid("json");
-      const r = {
+      let i = s.req.valid("json");
+      const o = {
         adapters: s.env.data,
         ctx: s
       };
-      (m = e.tenants) != null && m.beforeCreate && (o = await e.tenants.beforeCreate(r, o));
-      const i = await s.env.data.tenants.create(o);
-      return (d = e.tenants) != null && d.afterCreate && await e.tenants.afterCreate(r, i), s.json(i, 201);
+      (m = e.tenants) != null && m.beforeCreate && (i = await e.tenants.beforeCreate(o, i));
+      const a = await s.env.data.tenants.create(i);
+      return (d = e.tenants) != null && d.afterCreate && await e.tenants.afterCreate(o, a), s.json(a, 201);
     }
-  ), n.openapi(
+  ), t.openapi(
     R({
       tags: ["tenants"],
       method: "delete",
@@ -688,43 +688,43 @@ function B(t, e) {
       }
     }),
     async (s) => {
-      var i, m;
-      const { id: a } = s.req.valid("param");
-      if (t.accessControl) {
-        const d = s.var.user, c = t.accessControl.controlPlaneTenantId;
+      var a, m;
+      const { id: r } = s.req.valid("param");
+      if (n.accessControl) {
+        const d = s.var.user, c = n.accessControl.controlPlaneTenantId;
         if (!(d != null && d.sub))
           throw new C(401, {
             message: "Authentication required"
           });
-        if (a === c)
+        if (r === c)
           throw new C(403, {
             message: "Cannot delete the control plane"
           });
-        if (!(await z(
+        if (!(await $(
           (u) => s.env.data.userOrganizations.listUserOrganizations(
             c,
             d.sub,
             u
           ),
           "organizations"
-        )).some((u) => u.name === a))
+        )).some((u) => u.name === r))
           throw new C(403, {
             message: "Access denied to this tenant"
           });
       }
-      if (!await s.env.data.tenants.get(a))
+      if (!await s.env.data.tenants.get(r))
         throw new C(404, {
           message: "Tenant not found"
         });
-      const r = {
+      const o = {
         adapters: s.env.data,
         ctx: s
       };
-      return (i = e.tenants) != null && i.beforeDelete && await e.tenants.beforeDelete(r, a), await s.env.data.tenants.remove(a), (m = e.tenants) != null && m.afterDelete && await e.tenants.afterDelete(r, a), s.body(null, 204);
+      return (a = e.tenants) != null && a.beforeDelete && await e.tenants.beforeDelete(o, r), await s.env.data.tenants.remove(r), (m = e.tenants) != null && m.afterDelete && await e.tenants.afterDelete(o, r), s.body(null, 204);
     }
-  ), n;
+  ), t;
 }
-function le(t) {
+function ue(n) {
   const e = [
     {
       pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
@@ -733,26 +733,26 @@ function le(t) {
     { pattern: /\/api\/v2\/roles\/([^/]+)$/, type: "role" },
     { pattern: /\/api\/v2\/connections\/([^/]+)$/, type: "connection" }
   ];
-  for (const { pattern: n, type: s } of e) {
-    const a = t.match(n);
-    if (a && a[1])
-      return { type: s, id: a[1] };
+  for (const { pattern: t, type: s } of e) {
+    const r = n.match(t);
+    if (r && r[1])
+      return { type: s, id: r[1] };
   }
   return null;
 }
-async function de(t, e, n) {
+async function me(n, e, t) {
   try {
-    switch (n.type) {
+    switch (t.type) {
       case "resource_server": {
-        const s = await t.resourceServers.get(e, n.id);
+        const s = await n.resourceServers.get(e, t.id);
         return (s == null ? void 0 : s.is_system) === !0;
       }
       case "role": {
-        const s = await t.roles.get(e, n.id);
+        const s = await n.roles.get(e, t.id);
         return (s == null ? void 0 : s.is_system) === !0;
       }
       case "connection": {
-        const s = await t.connections.get(e, n.id);
+        const s = await n.connections.get(e, t.id);
         return (s == null ? void 0 : s.is_system) === !0;
       }
       default:
@@ -762,75 +762,75 @@ async function de(t, e, n) {
     return !1;
   }
 }
-function ue(t) {
+function pe(n) {
   return {
     resource_server: "resource server",
     role: "role",
     connection: "connection"
-  }[t];
+  }[n];
 }
-function Ae() {
-  return async (t, e) => {
-    if (!["PATCH", "PUT", "DELETE"].includes(t.req.method))
+function fe() {
+  return async (n, e) => {
+    if (!["PATCH", "PUT", "DELETE"].includes(n.req.method))
       return e();
-    const n = le(t.req.path);
-    if (!n)
+    const t = ue(n.req.path);
+    if (!t)
       return e();
-    const s = t.var.tenant_id || t.req.header("x-tenant-id") || t.req.header("tenant-id");
+    const s = n.var.tenant_id || n.req.header("x-tenant-id") || n.req.header("tenant-id");
     if (!s)
       return e();
-    if (await de(t.env.data, s, n))
+    if (await me(n.env.data, s, t))
       throw new C(403, {
-        message: `This ${ue(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
+        message: `This ${pe(t.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
       });
     return e();
   };
 }
-function G(t, e) {
-  const { controlPlaneTenantId: n, controlPlaneClientId: s } = e;
+function B(n, e) {
+  const { controlPlaneTenantId: t, controlPlaneClientId: s } = e;
   return {
-    ...t,
+    ...n,
     legacyClients: {
-      ...t.legacyClients,
-      get: async (a) => {
+      ...n.legacyClients,
+      get: async (r) => {
         var p;
-        const o = await t.legacyClients.get(a);
-        if (!o)
+        const i = await n.legacyClients.get(r);
+        if (!i)
           return null;
-        const r = s ? await t.legacyClients.get(s) : void 0, i = await t.connections.list(
-          o.tenant.id
-        ), m = n ? await t.connections.list(n) : { connections: [] }, d = i.connections.map((l) => {
+        const o = s ? await n.legacyClients.get(s) : void 0, a = await n.connections.list(
+          i.tenant.id
+        ), m = t ? await n.connections.list(t) : { connections: [] }, d = a.connections.map((l) => {
           var g;
           const u = (g = m.connections) == null ? void 0 : g.find(
-            (w) => w.name === l.name
+            (f) => f.name === l.name
           );
           if (!(u != null && u.options))
             return l;
-          const f = k.parse({
+          const w = D.parse({
             ...u || {},
             ...l
           });
-          return f.options = D.parse({
+          return w.options = F.parse({
             ...u.options || {},
             ...l.options
-          }), f;
+          }), w;
         }).filter((l) => l), c = {
-          ...(r == null ? void 0 : r.tenant) || {},
-          ...o.tenant
+          ...(o == null ? void 0 : o.tenant) || {},
+          ...i.tenant
         };
-        return !o.tenant.audience && ((p = r == null ? void 0 : r.tenant) != null && p.audience) && (c.audience = r.tenant.audience), {
-          ...o,
+        return !i.tenant.audience && ((p = o == null ? void 0 : o.tenant) != null && p.audience) && (c.audience = o.tenant.audience), {
+          ...i,
           web_origins: [
-            ...(r == null ? void 0 : r.web_origins) || [],
-            ...o.web_origins || []
+            ...(o == null ? void 0 : o.web_origins) || [],
+            ...i.web_origins || []
           ],
           allowed_logout_urls: [
-            ...(r == null ? void 0 : r.allowed_logout_urls) || [],
-            ...o.allowed_logout_urls || []
+            ...(o == null ? void 0 : o.allowed_logout_urls) || [],
+            ...i.allowed_logout_urls || []
           ],
           callbacks: [
-            ...(r == null ? void 0 : r.callbacks) || [],
-            ...o.callbacks || []
+            ...(o == null ? void 0 : o.callbacks) || [],
+            ...i.callbacks || []
           ],
           connections: d,
           tenant: c
@@ -838,51 +838,51 @@ function G(t, e) {
       }
     },
     connections: {
-      ...t.connections,
-      get: async (a, o) => {
-        const r = await t.connections.get(
-          a,
-          o
+      ...n.connections,
+      get: async (r, i) => {
+        const o = await n.connections.get(
+          r,
+          i
         );
-        if (!r || !n)
-          return r;
-        const i = await t.connections.get(
-          n,
-          o
+        if (!o || !t)
+          return o;
+        const a = await n.connections.get(
+          t,
+          i
         );
-        if (!i)
-          return r;
-        const m = k.parse({
-          ...i,
-          ...r
+        if (!a)
+          return o;
+        const m = D.parse({
+          ...a,
+          ...o
         });
-        return m.options = D.parse({
-          ...i.options || {},
-          ...r.options
+        return m.options = F.parse({
+          ...a.options || {},
+          ...o.options
         }), m;
       },
-      list: async (a, o) => {
-        const r = await t.connections.list(a, o);
-        if (!n || a === n)
-          return r;
-        const i = await t.connections.list(n), m = r.connections.map((d) => {
+      list: async (r, i) => {
+        const o = await n.connections.list(r, i);
+        if (!t || r === t)
+          return o;
+        const a = await n.connections.list(t), m = o.connections.map((d) => {
           var l;
-          const c = (l = i.connections) == null ? void 0 : l.find(
+          const c = (l = a.connections) == null ? void 0 : l.find(
             (u) => u.name === d.name
           );
           if (!(c != null && c.options))
             return d;
-          const p = k.parse({
+          const p = D.parse({
             ...c,
             ...d
           });
-          return p.options = D.parse({
+          return p.options = F.parse({
             ...c.options || {},
             ...d.options
           }), p;
         });
         return {
-          ...r,
+          ...o,
           connections: m
         };
       }
@@ -896,158 +896,217 @@ function G(t, e) {
     // They remain part of ...baseAdapters and can be properly wrapped by caching.
   };
 }
-function me(t, e) {
-  return G(t, e);
+function ge(n, e) {
+  return B(n, e);
 }
-const Ce = G, Ie = me;
-function pe(t) {
-  return async (e, n) => {
-    if (!t.accessControl)
-      return n();
-    const s = e.var.tenant_id, a = e.var.organization_id;
+const Ie = B, Se = ge;
+function we(n) {
+  return async (e, t) => {
+    if (!n.accessControl)
+      return t();
+    const s = e.var.tenant_id, r = e.var.organization_id;
     if (!s)
       throw new C(400, {
         message: "Tenant ID not found in request"
       });
-    if (!ne(
-      a,
+    if (!se(
+      r,
       s,
-      t.accessControl.controlPlaneTenantId
+      n.accessControl.controlPlaneTenantId
     ))
       throw new C(403, {
         message: `Access denied to tenant ${s}`
       });
-    return n();
+    return t();
   };
 }
-function fe(t) {
-  return async (e, n) => {
-    if (!t.subdomainRouting)
-      return n();
+function he(n) {
+  return async (e, t) => {
+    if (!n.subdomainRouting)
+      return t();
     const {
       baseDomain: s,
-      reservedSubdomains: a = [],
-      resolveSubdomain: o
-    } = t.subdomainRouting, r = e.req.header("host") || "";
-    let i = null;
-    if (r.endsWith(s)) {
-      const d = r.slice(0, -(s.length + 1));
-      d && !d.includes(".") && (i = d);
+      reservedSubdomains: r = [],
+      resolveSubdomain: i
+    } = n.subdomainRouting, o = e.req.header("host") || "";
+    let a = null;
+    if (o.endsWith(s)) {
+      const d = o.slice(0, -(s.length + 1));
+      d && !d.includes(".") && (a = d);
     }
-    if (i && a.includes(i) && (i = null), !i)
-      return t.accessControl && e.set("tenant_id", t.accessControl.controlPlaneTenantId), n();
+    if (a && r.includes(a) && (a = null), !a)
+      return n.accessControl && e.set("tenant_id", n.accessControl.controlPlaneTenantId), t();
     let m = null;
-    if (o)
-      m = await o(i);
-    else if (t.subdomainRouting.useOrganizations !== !1 && t.accessControl)
+    if (i)
+      m = await i(a);
+    else if (n.subdomainRouting.useOrganizations !== !1 && n.accessControl)
       try {
         const d = await e.env.data.organizations.get(
-          t.accessControl.controlPlaneTenantId,
-          i
+          n.accessControl.controlPlaneTenantId,
+          a
         );
         d && (m = d.id);
       } catch {
       }
     if (!m)
       throw new C(404, {
-        message: `Tenant not found for subdomain: ${i}`
+        message: `Tenant not found for subdomain: ${a}`
       });
-    return e.set("tenant_id", m), n();
+    return e.set("tenant_id", m), t();
   };
 }
-function ge(t) {
-  return async (e, n) => {
-    if (!t.databaseIsolation)
-      return n();
+function ye(n) {
+  return async (e, t) => {
+    if (!n.databaseIsolation)
+      return t();
     const s = e.var.tenant_id;
     if (!s)
       throw new C(400, {
         message: "Tenant ID not found in request"
       });
     try {
-      const a = await t.databaseIsolation.getAdapters(s);
-      e.env.data = a;
-    } catch (a) {
+      const r = await n.databaseIsolation.getAdapters(s);
+      e.env.data = r;
+    } catch (r) {
       throw console.error(
         `Failed to resolve database for tenant ${s}:`,
-        a
+        r
       ), new C(500, {
         message: "Failed to resolve tenant database"
       });
     }
-    return n();
+    return t();
   };
 }
-function K(t) {
-  const e = fe(t), n = pe(t), s = ge(t);
-  return async (a, o) => (await e(a, async () => {
-  }), await n(a, async () => {
-  }), await s(a, async () => {
-  }), o());
+function K(n) {
+  const e = he(n), t = we(n), s = ye(n);
+  return async (r, i) => (await e(r, async () => {
+  }), await t(r, async () => {
+  }), await s(r, async () => {
+  }), i());
 }
-function Pe(t) {
-  const e = q(t);
+function Pe(n) {
+  const {
+    dataAdapter: e,
+    controlPlaneTenantId: t = "control_plane",
+    sync: s = { resourceServers: !0, roles: !0, connections: !0 },
+    defaultPermissions: r = ["tenant:admin"],
+    requireOrganizationMatch: i = !1,
+    managementApiExtensions: o = [],
+    entityHooks: a,
+    getChildTenantIds: m,
+    getAdapters: d,
+    ...c
+  } = n, p = s !== !1, l = p ? {
+    resourceServers: s.resourceServers ?? !0,
+    roles: s.roles ?? !0,
+    connections: s.connections ?? !0
+  } : { resourceServers: !1, roles: !1, connections: !1 }, g = {
+    controlPlaneTenantId: t,
+    getChildTenantIds: m ?? (async () => (await $(
+      (_) => e.tenants.list(_),
+      "tenants",
+      { cursorField: "id", pageSize: 100 }
+    )).filter((_) => _.id !== t).map((_) => _.id)),
+    getAdapters: d ?? (async () => e),
+    getControlPlaneAdapters: async () => e,
+    sync: l
+  }, { entityHooks: f, tenantHooks: h } = de(g), y = {
+    resourceServers: [
+      f.resourceServers,
+      ...(a == null ? void 0 : a.resourceServers) ?? []
+    ],
+    roles: [f.roles, ...(a == null ? void 0 : a.roles) ?? []],
+    connections: [
+      f.connections,
+      ...(a == null ? void 0 : a.connections) ?? []
+    ],
+    tenants: (a == null ? void 0 : a.tenants) ?? [],
+    rolePermissions: (a == null ? void 0 : a.rolePermissions) ?? []
+  }, v = k(
+    {
+      accessControl: {
+        controlPlaneTenantId: t,
+        requireOrganizationMatch: i,
+        defaultPermissions: r
+      }
+    },
+    { tenants: h }
+  ), { app: b } = Z({
+    dataAdapter: e,
+    ...c,
+    entityHooks: y,
+    managementApiExtensions: [
+      ...o,
+      { path: "/tenants", router: v }
+    ]
+  });
+  return p && b.use("/api/v2/*", fe()), { app: b, controlPlaneTenantId: t };
+}
+function ze(n) {
+  const e = j(n);
   return {
     name: "multi-tenancy",
     // Apply multi-tenancy middleware for subdomain routing, database resolution, etc.
-    middleware: K(t),
+    middleware: K(n),
     // Provide lifecycle hooks
     hooks: e,
     // Mount tenant management routes
     routes: [
       {
         path: "/management",
-        handler: B(t, e)
+        handler: k(n, e)
       }
     ],
     // Called when plugin is registered
     onRegister: async () => {
-      console.log("Multi-tenancy plugin registered"), t.accessControl && console.log(
-        `  - Access control enabled (control plane: ${t.accessControl.controlPlaneTenantId})`
-      ), t.subdomainRouting && console.log(
-        `  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`
-      ), t.databaseIsolation && console.log("  - Database isolation enabled");
+      console.log("Multi-tenancy plugin registered"), n.accessControl && console.log(
+        `  - Access control enabled (control plane: ${n.accessControl.controlPlaneTenantId})`
+      ), n.subdomainRouting && console.log(
+        `  - Subdomain routing enabled (base domain: ${n.subdomainRouting.baseDomain})`
+      ), n.databaseIsolation && console.log("  - Database isolation enabled");
     }
   };
 }
-function q(t) {
-  const e = t.accessControl ? te(t.accessControl) : {}, n = t.databaseIsolation ? se(t.databaseIsolation) : {}, s = ae(t);
+function j(n) {
+  const e = n.accessControl ? ne(n.accessControl) : {}, t = n.databaseIsolation ? re(n.databaseIsolation) : {}, s = ae(n);
   return {
     ...e,
-    ...n,
+    ...t,
     tenants: s
   };
 }
-function we(t) {
-  const e = new Q(), n = q(t);
-  return e.route("/tenants", B(t, n)), e;
+function _e(n) {
+  const e = new Q(), t = j(n);
+  return e.route("/tenants", k(n, t)), e;
 }
-function Se(t) {
+function $e(n) {
   return {
-    hooks: q(t),
-    middleware: K(t),
-    app: we(t),
-    config: t
+    hooks: j(n),
+    middleware: K(n),
+    app: _e(n),
+    config: n
   };
 }
 export {
-  te as createAccessControlHooks,
-  pe as createAccessControlMiddleware,
-  se as createDatabaseHooks,
-  ge as createDatabaseMiddleware,
-  we as createMultiTenancy,
-  q as createMultiTenancyHooks,
+  ne as createAccessControlHooks,
+  we as createAccessControlMiddleware,
+  re as createDatabaseHooks,
+  ye as createDatabaseMiddleware,
+  _e as createMultiTenancy,
+  j as createMultiTenancyHooks,
   K as createMultiTenancyMiddleware,
-  Pe as createMultiTenancyPlugin,
-  Ae as createProtectSyncedMiddleware,
+  ze as createMultiTenancyPlugin,
+  fe as createProtectSyncedMiddleware,
   ae as createProvisioningHooks,
-  G as createRuntimeFallbackAdapter,
-  Ce as createSettingsInheritanceAdapter,
-  fe as createSubdomainMiddleware,
-  Te as createSyncHooks,
-  B as createTenantsOpenAPIRouter,
-  Se as setupMultiTenancy,
-  ne as validateTenantAccess,
-  me as withRuntimeFallback,
-  Ie as withSettingsInheritance
+  B as createRuntimeFallbackAdapter,
+  Ie as createSettingsInheritanceAdapter,
+  he as createSubdomainMiddleware,
+  de as createSyncHooks,
+  k as createTenantsOpenAPIRouter,
+  Pe as initMultiTenant,
+  $e as setupMultiTenancy,
+  se as validateTenantAccess,
+  ge as withRuntimeFallback,
+  Se as withSettingsInheritance
 };