@authhero/multi-tenancy 13.3.0 → 13.4.0

package/dist/multi-tenancy.mjs

@@ -1,27 +1,29 @@
-var h = Object.defineProperty;
-var v = (a, e, s) => e in a ? h(a, e, { enumerable: !0, configurable: !0, writable: !0, value: s }) : a[e] = s;
-var _ = (a, e, s) => v(a, typeof e != "symbol" ? e + "" : e, s);
-import { Hono as b } from "hono";
-import { z as $ } from "zod";
-import { auth0QuerySchema as R, tenantInsertSchema as T } from "@authhero/adapter-interfaces";
-function D(a) {
+var R = Object.defineProperty;
+var F = (a, e, s) => e in a ? R(a, e, { enumerable: !0, configurable: !0, writable: !0, value: s }) : a[e] = s;
+var C = (a, e, s) => F(a, typeof e != "symbol" ? e + "" : e, s);
+import { Hono as $ } from "hono";
+import { init as z } from "authhero";
+import { seed as ce } from "authhero";
+import { z as P } from "zod";
+import { auth0QuerySchema as j, tenantInsertSchema as M } from "@authhero/adapter-interfaces";
+function U(a) {
   const { mainTenantId: e, requireOrganizationMatch: s = !0 } = a;
   return {
-    async onTenantAccessValidation(t, n) {
-      if (n === e)
+    async onTenantAccessValidation(n, t) {
+      if (t === e)
         return !0;
       if (s) {
-        const r = t.var.organization_id;
-        return r ? r === n : !1;
+        const o = n.var.organization_id;
+        return o ? o === t : !1;
       }
       return !0;
     }
   };
 }
-function M(a, e, s) {
+function K(a, e, s) {
   return e === s ? !0 : a ? a === e : !1;
 }
-function I(a) {
+function V(a) {
   return {
     async resolveDataAdapters(e) {
       try {
@@ -36,61 +38,61 @@ function I(a) {
     }
   };
 }
-function z(a) {
+function O(a) {
   return {
     async afterCreate(e, s) {
-      const { accessControl: t, databaseIsolation: n, settingsInheritance: r } = a;
-      t && e.ctx && await F(e, s, t), n != null && n.onProvision && await n.onProvision(s.id), (r == null ? void 0 : r.inheritFromMain) !== !1 && e.ctx && await q(e, s, a);
+      const { accessControl: n, databaseIsolation: t, settingsInheritance: o } = a;
+      n && e.ctx && await N(e, s, n), t != null && t.onProvision && await t.onProvision(s.id), (o == null ? void 0 : o.inheritFromMain) !== !1 && e.ctx && await E(e, s, a);
     },
     async beforeDelete(e, s) {
-      const { accessControl: t, databaseIsolation: n } = a;
-      if (t)
+      const { accessControl: n, databaseIsolation: t } = a;
+      if (n)
         try {
-          const l = (await e.adapters.organizations.list(
-            t.mainTenantId
+          const d = (await e.adapters.organizations.list(
+            n.mainTenantId
           )).organizations.find((c) => c.name === s);
-          l && await e.adapters.organizations.remove(
-            t.mainTenantId,
-            l.id
+          d && await e.adapters.organizations.remove(
+            n.mainTenantId,
+            d.id
           );
-        } catch (r) {
+        } catch (o) {
           console.warn(
             `Failed to remove organization for tenant ${s}:`,
-            r
+            o
           );
         }
-      if (n != null && n.onDeprovision)
+      if (t != null && t.onDeprovision)
         try {
-          await n.onDeprovision(s);
-        } catch (r) {
+          await t.onDeprovision(s);
+        } catch (o) {
           console.warn(
             `Failed to deprovision database for tenant ${s}:`,
-            r
+            o
           );
         }
     }
   };
 }
-async function F(a, e, s) {
-  const { mainTenantId: t, defaultPermissions: n, defaultRoles: r } = s;
-  await a.adapters.organizations.create(t, {
+async function N(a, e, s) {
+  const { mainTenantId: n, defaultPermissions: t, defaultRoles: o } = s;
+  await a.adapters.organizations.create(n, {
     id: e.id,
     name: e.id,
     display_name: e.friendly_name || e.id
-  }), r && r.length > 0 && console.log(
-    `Would assign roles ${r.join(", ")} to organization ${e.id}`
-  ), n && n.length > 0 && console.log(
-    `Would grant permissions ${n.join(", ")} to organization ${e.id}`
+  }), o && o.length > 0 && console.log(
+    `Would assign roles ${o.join(", ")} to organization ${e.id}`
+  ), t && t.length > 0 && console.log(
+    `Would grant permissions ${t.join(", ")} to organization ${e.id}`
   );
 }
-async function q(a, e, s) {
-  const { accessControl: t, settingsInheritance: n } = s;
-  if (!t)
+async function E(a, e, s) {
+  const { accessControl: n, settingsInheritance: t } = s;
+  if (!n)
     return;
-  const r = await a.adapters.tenants.get(t.mainTenantId);
-  if (!r)
+  const o = await a.adapters.tenants.get(n.mainTenantId);
+  if (!o)
     return;
-  let l = { ...r };
+  let d = { ...o };
   const c = [
     "id",
     "created_at",
@@ -101,115 +103,156 @@ async function q(a, e, s) {
     "sender_email",
     "sender_name"
   ];
-  for (const o of c)
-    delete l[o];
-  if (n != null && n.inheritedKeys) {
-    const o = {};
-    for (const i of n.inheritedKeys)
-      i in r && !c.includes(i) && (o[i] = r[i]);
-    l = o;
+  for (const i of c)
+    delete d[i];
+  if (t != null && t.inheritedKeys) {
+    const i = {};
+    for (const r of t.inheritedKeys)
+      r in o && !c.includes(r) && (i[r] = o[r]);
+    d = i;
   }
-  if (n != null && n.excludedKeys)
-    for (const o of n.excludedKeys)
-      delete l[o];
-  n != null && n.transformSettings && (l = n.transformSettings(
-    l,
+  if (t != null && t.excludedKeys)
+    for (const i of t.excludedKeys)
+      delete d[i];
+  t != null && t.transformSettings && (d = t.transformSettings(
+    d,
     e.id
-  )), Object.keys(l).length > 0 && await a.adapters.tenants.update(e.id, l);
+  )), Object.keys(d).length > 0 && await a.adapters.tenants.update(e.id, d);
+}
+async function q(a, e, s = {}) {
+  const {
+    cursorField: n = "id",
+    sortOrder: t = "asc",
+    pageSize: o = 100,
+    maxItems: d = 1e4,
+    q: c
+  } = s, i = [];
+  let r, u = !0;
+  for (; u; ) {
+    let f = c || "";
+    if (r) {
+      const w = `${n}:${t === "asc" ? ">" : "<"}${r}`;
+      f = f ? `(${f}) AND ${w}` : w;
+    }
+    const l = {
+      per_page: o,
+      page: 0,
+      // Always use page 0 since we're doing cursor-based pagination
+      sort: {
+        sort_by: n,
+        sort_order: t
+      },
+      ...f && { q: f }
+    }, T = (await a(l))[e] || [];
+    if (T.length === 0)
+      u = !1;
+    else {
+      i.push(...T);
+      const _ = T[T.length - 1];
+      if (_ && typeof _ == "object") {
+        const w = _[n];
+        w != null && (r = String(w));
+      }
+      T.length < o && (u = !1), d !== -1 && i.length >= d && (console.warn(
+        `fetchAll: Reached maxItems limit (${d}). There may be more items.`
+      ), u = !1);
+    }
+  }
+  return i;
 }
-function N(a) {
+function W(a) {
   const {
     mainTenantId: e,
     getChildTenantIds: s,
-    getAdapters: t,
-    shouldSync: n = () => !0,
-    transformForSync: r
+    getAdapters: n,
+    shouldSync: t = () => !0,
+    transformForSync: o
   } = a;
-  async function l(i, f, d) {
-    return (await i.resourceServers.list(f, {
-      q: `identifier:${d}`,
+  async function d(r, u, f) {
+    return (await r.resourceServers.list(u, {
+      q: `identifier:${f}`,
       per_page: 1
     })).resource_servers[0] ?? null;
   }
-  async function c(i, f) {
-    const d = await s();
+  async function c(r, u) {
+    const f = await s();
     await Promise.all(
-      d.map(async (u) => {
+      f.map(async (l) => {
         try {
-          const m = await t(u), p = r ? r(i, u) : {
-            name: i.name,
-            identifier: i.identifier,
-            scopes: i.scopes,
-            signing_alg: i.signing_alg,
-            signing_secret: i.signing_secret,
-            token_lifetime: i.token_lifetime,
-            token_lifetime_for_web: i.token_lifetime_for_web,
-            skip_consent_for_verifiable_first_party_clients: i.skip_consent_for_verifiable_first_party_clients,
-            allow_offline_access: i.allow_offline_access,
-            verificationKey: i.verificationKey,
-            options: i.options
-          };
-          if (f === "create") {
-            const y = await l(
+          const m = await n(l), _ = { ...o ? o(r, l) : {
+            name: r.name,
+            identifier: r.identifier,
+            scopes: r.scopes,
+            signing_alg: r.signing_alg,
+            signing_secret: r.signing_secret,
+            token_lifetime: r.token_lifetime,
+            token_lifetime_for_web: r.token_lifetime_for_web,
+            skip_consent_for_verifiable_first_party_clients: r.skip_consent_for_verifiable_first_party_clients,
+            allow_offline_access: r.allow_offline_access,
+            verificationKey: r.verificationKey,
+            options: r.options
+          }, is_system: !0 };
+          if (u === "create") {
+            const w = await d(
               m,
-              u,
-              i.identifier
+              l,
+              r.identifier
             );
-            y && y.id ? await m.resourceServers.update(
-              u,
-              y.id,
-              p
-            ) : await m.resourceServers.create(u, p);
+            w && w.id ? await m.resourceServers.update(
+              l,
+              w.id,
+              _
+            ) : await m.resourceServers.create(l, _);
           } else {
-            const y = await l(
+            const w = await d(
               m,
-              u,
-              i.identifier
+              l,
+              r.identifier
             );
-            y && y.id && await m.resourceServers.update(
-              u,
-              y.id,
-              p
+            w && w.id && await m.resourceServers.update(
+              l,
+              w.id,
+              _
             );
           }
         } catch (m) {
           console.error(
-            `Failed to sync resource server "${i.identifier}" to tenant "${u}":`,
+            `Failed to sync resource server "${r.identifier}" to tenant "${l}":`,
             m
           );
         }
       })
     );
   }
-  async function o(i) {
-    const f = await s();
+  async function i(r) {
+    const u = await s();
     await Promise.all(
-      f.map(async (d) => {
+      u.map(async (f) => {
         try {
-          const u = await t(d), m = await l(
-            u,
-            d,
-            i
+          const l = await n(f), m = await d(
+            l,
+            f,
+            r
           );
-          m && m.id && await u.resourceServers.remove(d, m.id);
-        } catch (u) {
+          m && m.id && await l.resourceServers.remove(f, m.id);
+        } catch (l) {
           console.error(
-            `Failed to delete resource server "${i}" from tenant "${d}":`,
-            u
+            `Failed to delete resource server "${r}" from tenant "${f}":`,
+            l
           );
         }
       })
     );
   }
   return {
-    afterCreate: async (i, f) => {
-      i.tenantId === e && n(f) && await c(f, "create");
+    afterCreate: async (r, u) => {
+      r.tenantId === e && t(u) && await c(u, "create");
     },
-    afterUpdate: async (i, f, d) => {
-      i.tenantId === e && n(d) && await c(d, "update");
+    afterUpdate: async (r, u, f) => {
+      r.tenantId === e && t(f) && await c(f, "update");
     },
-    afterDelete: async (i, f) => {
-      i.tenantId === e && await o(f);
+    afterDelete: async (r, u) => {
+      r.tenantId === e && await i(u);
     }
   };
 }
@@ -217,56 +260,58 @@ function Q(a) {
   const {
     mainTenantId: e,
     getMainTenantAdapters: s,
-    getAdapters: t,
-    shouldSync: n = () => !0,
-    transformForSync: r
+    getAdapters: n,
+    shouldSync: t = () => !0,
+    transformForSync: o
   } = a;
   return {
-    async afterCreate(l, c) {
+    async afterCreate(d, c) {
       if (c.id !== e)
         try {
-          const o = await s(), i = await t(c.id), f = await o.resourceServers.list(e, {
-            per_page: 100
-            // Adjust if you expect more resource servers
-          });
+          const i = await s(), r = await n(c.id), u = await q(
+            (f) => i.resourceServers.list(e, f),
+            "resource_servers",
+            { cursorField: "id", pageSize: 100 }
+          );
           await Promise.all(
-            f.resource_servers.filter((d) => n(d)).map(async (d) => {
+            u.filter((f) => t(f)).map(async (f) => {
+              const l = f;
               try {
-                const u = r ? r(d, c.id) : {
-                  name: d.name,
-                  identifier: d.identifier,
-                  scopes: d.scopes,
-                  signing_alg: d.signing_alg,
-                  signing_secret: d.signing_secret,
-                  token_lifetime: d.token_lifetime,
-                  token_lifetime_for_web: d.token_lifetime_for_web,
-                  skip_consent_for_verifiable_first_party_clients: d.skip_consent_for_verifiable_first_party_clients,
-                  allow_offline_access: d.allow_offline_access,
-                  verificationKey: d.verificationKey,
-                  options: d.options
+                const m = o ? o(l, c.id) : {
+                  name: l.name,
+                  identifier: l.identifier,
+                  scopes: l.scopes,
+                  signing_alg: l.signing_alg,
+                  signing_secret: l.signing_secret,
+                  token_lifetime: l.token_lifetime,
+                  token_lifetime_for_web: l.token_lifetime_for_web,
+                  skip_consent_for_verifiable_first_party_clients: l.skip_consent_for_verifiable_first_party_clients,
+                  allow_offline_access: l.allow_offline_access,
+                  verificationKey: l.verificationKey,
+                  options: l.options
                 };
-                await i.resourceServers.create(
-                  c.id,
-                  u
-                );
-              } catch (u) {
+                await r.resourceServers.create(c.id, {
+                  ...m,
+                  is_system: !0
+                });
+              } catch (m) {
                 console.error(
-                  `Failed to sync resource server "${d.identifier}" to new tenant "${c.id}":`,
-                  u
+                  `Failed to sync resource server "${l.identifier}" to new tenant "${c.id}":`,
+                  m
                 );
               }
             })
           );
-        } catch (o) {
+        } catch (i) {
           console.error(
             `Failed to sync resource servers to new tenant "${c.id}":`,
-            o
+            i
           );
         }
     }
   };
 }
-var w = class extends Error {
+var p = class extends Error {
   /**
    * Creates an instance of `HTTPException`.
    * @param status - HTTP status code for the exception. Defaults to 500.
@@ -274,8 +319,8 @@ var w = class extends Error {
    */
   constructor(e = 500, s) {
     super(s == null ? void 0 : s.message, { cause: s == null ? void 0 : s.cause });
-    _(this, "res");
-    _(this, "status");
+    C(this, "res");
+    C(this, "status");
     this.res = s == null ? void 0 : s.res, this.status = e;
   }
   /**
@@ -292,215 +337,277 @@ var w = class extends Error {
     });
   }
 };
-function C(a, e) {
-  const s = new b();
-  return s.get("/", async (t) => {
-    var f;
-    if (a.accessControl && await ((f = e.onTenantAccessValidation) == null ? void 0 : f.call(
+function S(a, e) {
+  const s = new $();
+  return s.get("/", async (n) => {
+    var u;
+    if (a.accessControl && await ((u = e.onTenantAccessValidation) == null ? void 0 : u.call(
       e,
-      t,
+      n,
       a.accessControl.mainTenantId
     )) === !1)
-      throw new w(403, {
+      throw new p(403, {
         message: "Access denied to tenant management"
       });
-    const n = R.parse(t.req.query()), { page: r, per_page: l, include_totals: c, q: o } = n, i = await t.env.data.tenants.list({
-      page: r,
-      per_page: l,
+    const t = j.parse(n.req.query()), { page: o, per_page: d, include_totals: c, q: i } = t, r = await n.env.data.tenants.list({
+      page: o,
+      per_page: d,
       include_totals: c,
-      q: o
+      q: i
     });
-    return c ? t.json(i) : t.json(i.tenants);
-  }), s.get("/:id", async (t) => {
+    return c ? n.json(r) : n.json(r.tenants);
+  }), s.get("/:id", async (n) => {
     var c;
-    const n = t.req.param("id");
-    if (await ((c = e.onTenantAccessValidation) == null ? void 0 : c.call(e, t, n)) === !1)
-      throw new w(403, {
+    const t = n.req.param("id");
+    if (await ((c = e.onTenantAccessValidation) == null ? void 0 : c.call(e, n, t)) === !1)
+      throw new p(403, {
         message: "Access denied to this tenant"
       });
-    const l = await t.env.data.tenants.get(n);
-    if (!l)
-      throw new w(404, {
+    const d = await n.env.data.tenants.get(t);
+    if (!d)
+      throw new p(404, {
         message: "Tenant not found"
       });
-    return t.json(l);
-  }), s.post("/", async (t) => {
-    var n, r, l, c;
+    return n.json(d);
+  }), s.post("/", async (n) => {
+    var t, o, d, c;
     try {
-      if (a.accessControl && await ((n = e.onTenantAccessValidation) == null ? void 0 : n.call(
+      if (a.accessControl && await ((t = e.onTenantAccessValidation) == null ? void 0 : t.call(
         e,
-        t,
+        n,
         a.accessControl.mainTenantId
       )) === !1)
-        throw new w(403, {
+        throw new p(403, {
           message: "Access denied to create tenants"
         });
-      let o = T.parse(
-        await t.req.json()
+      let i = M.parse(
+        await n.req.json()
       );
-      const i = {
-        adapters: t.env.data,
-        ctx: t
+      const r = {
+        adapters: n.env.data,
+        ctx: n
       };
-      (r = e.tenants) != null && r.beforeCreate && (o = await e.tenants.beforeCreate(i, o));
-      const f = await t.env.data.tenants.create(o);
-      return (l = e.tenants) != null && l.afterCreate && await e.tenants.afterCreate(i, f), t.json(f, 201);
-    } catch (o) {
-      throw o instanceof $.ZodError ? new w(400, {
+      (o = e.tenants) != null && o.beforeCreate && (i = await e.tenants.beforeCreate(r, i));
+      const u = await n.env.data.tenants.create(i);
+      return (d = e.tenants) != null && d.afterCreate && await e.tenants.afterCreate(r, u), n.json(u, 201);
+    } catch (i) {
+      throw i instanceof P.ZodError ? new p(400, {
         message: "Validation error",
-        cause: o
-      }) : o instanceof Error && ("code" in o && o.code === "SQLITE_CONSTRAINT_PRIMARYKEY" || (c = o.message) != null && c.includes("UNIQUE constraint failed")) ? new w(409, {
+        cause: i
+      }) : i instanceof Error && ("code" in i && i.code === "SQLITE_CONSTRAINT_PRIMARYKEY" || (c = i.message) != null && c.includes("UNIQUE constraint failed")) ? new p(409, {
         message: "Tenant with this ID already exists"
-      }) : o;
+      }) : i;
     }
-  }), s.patch("/:id", async (t) => {
-    var m, p, y;
-    const n = t.req.param("id");
-    if (await ((m = e.onTenantAccessValidation) == null ? void 0 : m.call(e, t, n)) === !1)
-      throw new w(403, {
+  }), s.patch("/:id", async (n) => {
+    var m, T, _;
+    const t = n.req.param("id");
+    if (await ((m = e.onTenantAccessValidation) == null ? void 0 : m.call(e, n, t)) === !1)
+      throw new p(403, {
         message: "Access denied to update this tenant"
       });
-    const l = T.partial().parse(await t.req.json()), { id: c, ...o } = l;
-    if (!await t.env.data.tenants.get(n))
-      throw new w(404, {
+    const d = M.partial().parse(await n.req.json()), { id: c, ...i } = d;
+    if (!await n.env.data.tenants.get(t))
+      throw new p(404, {
         message: "Tenant not found"
       });
-    const f = {
-      adapters: t.env.data,
-      ctx: t
+    const u = {
+      adapters: n.env.data,
+      ctx: n
     };
-    let d = o;
-    (p = e.tenants) != null && p.beforeUpdate && (d = await e.tenants.beforeUpdate(f, n, o)), await t.env.data.tenants.update(n, d);
-    const u = await t.env.data.tenants.get(n);
-    if (!u)
-      throw new w(404, {
+    let f = i;
+    (T = e.tenants) != null && T.beforeUpdate && (f = await e.tenants.beforeUpdate(u, t, i)), await n.env.data.tenants.update(t, f);
+    const l = await n.env.data.tenants.get(t);
+    if (!l)
+      throw new p(404, {
         message: "Tenant not found after update"
       });
-    return (y = e.tenants) != null && y.afterUpdate && await e.tenants.afterUpdate(f, u), t.json(u);
-  }), s.delete("/:id", async (t) => {
-    var c, o, i;
-    const n = t.req.param("id");
-    if (a.accessControl && n === a.accessControl.mainTenantId)
-      throw new w(400, {
+    return (_ = e.tenants) != null && _.afterUpdate && await e.tenants.afterUpdate(u, l), n.json(l);
+  }), s.delete("/:id", async (n) => {
+    var c, i, r;
+    const t = n.req.param("id");
+    if (a.accessControl && t === a.accessControl.mainTenantId)
+      throw new p(400, {
         message: "Cannot delete the main tenant"
       });
     if (a.accessControl && await ((c = e.onTenantAccessValidation) == null ? void 0 : c.call(
       e,
-      t,
+      n,
       a.accessControl.mainTenantId
     )) === !1)
-      throw new w(403, {
+      throw new p(403, {
         message: "Access denied to delete tenants"
       });
-    if (!await t.env.data.tenants.get(n))
-      throw new w(404, {
+    if (!await n.env.data.tenants.get(t))
+      throw new p(404, {
         message: "Tenant not found"
       });
-    const l = {
-      adapters: t.env.data,
-      ctx: t
+    const d = {
+      adapters: n.env.data,
+      ctx: n
     };
-    return (o = e.tenants) != null && o.beforeDelete && await e.tenants.beforeDelete(l, n), await t.env.data.tenants.remove(n), (i = e.tenants) != null && i.afterDelete && await e.tenants.afterDelete(l, n), t.body(null, 204);
+    return (i = e.tenants) != null && i.beforeDelete && await e.tenants.beforeDelete(d, t), await n.env.data.tenants.remove(t), (r = e.tenants) != null && r.afterDelete && await e.tenants.afterDelete(d, t), n.body(null, 204);
   }), s;
 }
-function H(a) {
+function L(a) {
+  const e = [
+    {
+      pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
+      type: "resource_server"
+    },
+    { pattern: /\/api\/v2\/roles\/([^/]+)$/, type: "role" },
+    { pattern: /\/api\/v2\/connections\/([^/]+)$/, type: "connection" }
+  ];
+  for (const { pattern: s, type: n } of e) {
+    const t = a.match(s);
+    if (t && t[1])
+      return { type: n, id: t[1] };
+  }
+  return null;
+}
+async function Y(a, e, s) {
+  try {
+    switch (s.type) {
+      case "resource_server": {
+        const n = await a.resourceServers.get(e, s.id);
+        return (n == null ? void 0 : n.is_system) === !0;
+      }
+      case "role": {
+        const n = await a.roles.get(e, s.id);
+        return (n == null ? void 0 : n.is_system) === !0;
+      }
+      case "connection": {
+        const n = await a.connections.get(e, s.id);
+        return (n == null ? void 0 : n.is_system) === !0;
+      }
+      default:
+        return !1;
+    }
+  } catch {
+    return !1;
+  }
+}
+function B(a) {
+  return {
+    resource_server: "resource server",
+    role: "role",
+    connection: "connection"
+  }[a];
+}
+function Z() {
+  return async (a, e) => {
+    if (!["PATCH", "PUT", "DELETE"].includes(a.req.method))
+      return e();
+    const s = L(a.req.path);
+    if (!s)
+      return e();
+    const n = a.var.tenant_id || a.req.header("x-tenant-id") || a.req.header("tenant-id");
+    if (!n)
+      return e();
+    if (await Y(a.env.data, n, s))
+      throw new p(403, {
+        message: `This ${B(s.type)} is a system resource and cannot be modified. Make changes in the main tenant instead.`
+      });
+    return e();
+  };
+}
+function G(a) {
   return async (e, s) => {
     if (!a.accessControl)
       return s();
-    const t = e.var.tenant_id, n = e.var.organization_id;
-    if (!t)
-      throw new w(400, {
+    const n = e.var.tenant_id, t = e.var.organization_id;
+    if (!n)
+      throw new p(400, {
         message: "Tenant ID not found in request"
       });
-    if (!M(
-      n,
+    if (!K(
       t,
+      n,
       a.accessControl.mainTenantId
     ))
-      throw new w(403, {
-        message: `Access denied to tenant ${t}`
+      throw new p(403, {
+        message: `Access denied to tenant ${n}`
       });
     return s();
   };
 }
-function j(a) {
+function J(a) {
   return async (e, s) => {
     if (!a.subdomainRouting)
       return s();
     const {
-      baseDomain: t,
-      reservedSubdomains: n = [],
-      resolveSubdomain: r
-    } = a.subdomainRouting, l = e.req.header("host") || "";
+      baseDomain: n,
+      reservedSubdomains: t = [],
+      resolveSubdomain: o
+    } = a.subdomainRouting, d = e.req.header("host") || "";
     let c = null;
-    if (l.endsWith(t)) {
-      const i = l.slice(0, -(t.length + 1));
-      i && !i.includes(".") && (c = i);
+    if (d.endsWith(n)) {
+      const r = d.slice(0, -(n.length + 1));
+      r && !r.includes(".") && (c = r);
     }
-    if (c && n.includes(c) && (c = null), !c)
+    if (c && t.includes(c) && (c = null), !c)
       return a.accessControl && e.set("tenant_id", a.accessControl.mainTenantId), s();
-    let o = null;
-    if (r)
-      o = await r(c);
+    let i = null;
+    if (o)
+      i = await o(c);
     else if (a.subdomainRouting.useOrganizations !== !1 && a.accessControl)
       try {
-        const i = await e.env.data.organizations.get(
+        const r = await e.env.data.organizations.get(
           a.accessControl.mainTenantId,
           c
         );
-        i && (o = i.id);
+        r && (i = r.id);
       } catch {
       }
-    if (!o)
-      throw new w(404, {
+    if (!i)
+      throw new p(404, {
         message: `Tenant not found for subdomain: ${c}`
       });
-    return e.set("tenant_id", o), s();
+    return e.set("tenant_id", i), s();
   };
 }
-function P(a) {
+function X(a) {
   return async (e, s) => {
     if (!a.databaseIsolation)
       return s();
-    const t = e.var.tenant_id;
-    if (!t)
-      throw new w(400, {
+    const n = e.var.tenant_id;
+    if (!n)
+      throw new p(400, {
         message: "Tenant ID not found in request"
       });
     try {
-      const n = await a.databaseIsolation.getAdapters(t);
-      e.env.data = n;
-    } catch (n) {
+      const t = await a.databaseIsolation.getAdapters(n);
+      e.env.data = t;
+    } catch (t) {
       throw console.error(
-        `Failed to resolve database for tenant ${t}:`,
-        n
-      ), new w(500, {
+        `Failed to resolve database for tenant ${n}:`,
+        t
+      ), new p(500, {
         message: "Failed to resolve tenant database"
       });
     }
     return s();
   };
 }
-function A(a) {
-  const e = j(a), s = H(a), t = P(a);
-  return async (n, r) => (await e(n, async () => {
-  }), await s(n, async () => {
-  }), await t(n, async () => {
-  }), r());
+function D(a) {
+  const e = J(a), s = G(a), n = X(a);
+  return async (t, o) => (await e(t, async () => {
+  }), await s(t, async () => {
+  }), await n(t, async () => {
+  }), o());
 }
-function W(a) {
-  const e = g(a);
+function ne(a) {
+  const e = A(a);
   return {
     name: "multi-tenancy",
     // Apply multi-tenancy middleware for subdomain routing, database resolution, etc.
-    middleware: A(a),
+    middleware: D(a),
     // Provide lifecycle hooks
     hooks: e,
     // Mount tenant management routes
     routes: [
       {
         path: "/management",
-        handler: C(a, e)
+        handler: S(a, e)
       }
     ],
     // Called when plugin is registered
@@ -513,40 +620,157 @@ function W(a) {
     }
   };
 }
-function g(a) {
-  const e = a.accessControl ? D(a.accessControl) : {}, s = a.databaseIsolation ? I(a.databaseIsolation) : {}, t = z(a);
+function A(a) {
+  const e = a.accessControl ? U(a.accessControl) : {}, s = a.databaseIsolation ? V(a.databaseIsolation) : {}, n = O(a);
   return {
     ...e,
     ...s,
-    tenants: t
+    tenants: n
   };
 }
-function K(a) {
-  const e = new b(), s = g(a);
-  return e.route("/tenants", C(a, s)), e;
+function H(a) {
+  const e = new $(), s = A(a);
+  return e.route("/tenants", S(a, s)), e;
 }
-function Y(a) {
+function se(a) {
   return {
-    hooks: g(a),
-    middleware: A(a),
-    app: K(a),
+    hooks: A(a),
+    middleware: D(a),
+    app: H(a),
     config: a
   };
 }
+function re(a) {
+  const {
+    mainTenantId: e = "main",
+    syncResourceServers: s = !0,
+    multiTenancy: n,
+    entityHooks: t,
+    ...o
+  } = a, d = {
+    ...n,
+    accessControl: {
+      mainTenantId: e,
+      requireOrganizationMatch: !1,
+      defaultPermissions: ["tenant:admin"],
+      ...n == null ? void 0 : n.accessControl
+    }
+  }, c = A(d);
+  let i, r;
+  s && (i = W({
+    mainTenantId: e,
+    getChildTenantIds: async () => (await q(
+      (y) => a.dataAdapter.tenants.list(y),
+      "tenants",
+      { cursorField: "id", pageSize: 100 }
+    )).filter((y) => y.id !== e).map((y) => y.id),
+    getAdapters: async (g) => a.dataAdapter
+  }), r = Q({
+    mainTenantId: e,
+    getMainTenantAdapters: async () => a.dataAdapter,
+    getAdapters: async (g) => a.dataAdapter
+  }));
+  const u = async (g, y, ...h) => {
+    const v = [];
+    if (g)
+      try {
+        await g(...h);
+      } catch (b) {
+        v.push(b instanceof Error ? b : new Error(String(b)));
+      }
+    if (y)
+      try {
+        await y(...h);
+      } catch (b) {
+        v.push(b instanceof Error ? b : new Error(String(b)));
+      }
+    if (v.length === 1)
+      throw v[0];
+    if (v.length > 1)
+      throw new AggregateError(
+        v,
+        `Multiple hook errors: ${v.map((b) => b.message).join("; ")}`
+      );
+  }, f = {
+    ...t,
+    resourceServers: i ? {
+      ...t == null ? void 0 : t.resourceServers,
+      afterCreate: async (g, y) => {
+        var h;
+        await u(
+          (h = t == null ? void 0 : t.resourceServers) == null ? void 0 : h.afterCreate,
+          i == null ? void 0 : i.afterCreate,
+          g,
+          y
+        );
+      },
+      afterUpdate: async (g, y, h) => {
+        var v;
+        await u(
+          (v = t == null ? void 0 : t.resourceServers) == null ? void 0 : v.afterUpdate,
+          i == null ? void 0 : i.afterUpdate,
+          g,
+          y,
+          h
+        );
+      },
+      afterDelete: async (g, y) => {
+        var h;
+        await u(
+          (h = t == null ? void 0 : t.resourceServers) == null ? void 0 : h.afterDelete,
+          i == null ? void 0 : i.afterDelete,
+          g,
+          y
+        );
+      }
+    } : t == null ? void 0 : t.resourceServers,
+    tenants: r ? {
+      ...t == null ? void 0 : t.tenants,
+      afterCreate: async (g, y) => {
+        var h;
+        await u(
+          (h = t == null ? void 0 : t.tenants) == null ? void 0 : h.afterCreate,
+          r == null ? void 0 : r.afterCreate,
+          g,
+          y
+        );
+      }
+    } : t == null ? void 0 : t.tenants
+  }, l = z({
+    ...o,
+    entityHooks: f
+  }), { app: m, managementApp: T, ..._ } = l, w = new $();
+  w.use("/api/v2/*", Z()), w.route("/", m);
+  const I = S(
+    d,
+    c
+  );
+  return w.route("/api/v2/tenants", I), {
+    app: w,
+    managementApp: T,
+    ..._,
+    multiTenancyConfig: d,
+    multiTenancyHooks: c
+  };
+}
 export {
-  D as createAccessControlHooks,
-  H as createAccessControlMiddleware,
-  I as createDatabaseHooks,
-  P as createDatabaseMiddleware,
-  K as createMultiTenancy,
-  g as createMultiTenancyHooks,
-  A as createMultiTenancyMiddleware,
-  W as createMultiTenancyPlugin,
-  z as createProvisioningHooks,
-  N as createResourceServerSyncHooks,
-  j as createSubdomainMiddleware,
+  U as createAccessControlHooks,
+  G as createAccessControlMiddleware,
+  V as createDatabaseHooks,
+  X as createDatabaseMiddleware,
+  H as createMultiTenancy,
+  A as createMultiTenancyHooks,
+  D as createMultiTenancyMiddleware,
+  ne as createMultiTenancyPlugin,
+  Z as createProtectSyncedMiddleware,
+  O as createProvisioningHooks,
+  W as createResourceServerSyncHooks,
+  J as createSubdomainMiddleware,
   Q as createTenantResourceServerSyncHooks,
-  C as createTenantsRouter,
-  Y as setupMultiTenancy,
-  M as validateTenantAccess
+  S as createTenantsRouter,
+  q as fetchAll,
+  re as init,
+  ce as seed,
+  se as setupMultiTenancy,
+  K as validateTenantAccess
 };