@authhero/multi-tenancy 13.6.0 → 13.8.0

package/dist/multi-tenancy.cjs

@@ -1 +1 @@
-"use strict";var W=Object.defineProperty;var G=(e,n,s)=>n in e?W(e,n,{enumerable:!0,configurable:!0,writable:!0,value:s}):e[n]=s;var z=(e,n,s)=>G(e,typeof n!="symbol"?n+"":n,s);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const I=require("hono"),S=require("authhero"),Q=require("zod"),$=require("@authhero/adapter-interfaces");function q(e){const{mainTenantId:n,requireOrganizationMatch:s=!0}=e;return{async onTenantAccessValidation(t,a){if(a===n)return!0;if(s){const o=t.var.organization_id;return o?o===a:!1}return!0}}}function P(e,n,s){return n===s?!0:e?e===n:!1}function D(e){return{async resolveDataAdapters(n){try{return await e.getAdapters(n)}catch(s){console.error(`Failed to resolve data adapters for tenant ${n}:`,s);return}}}}function F(e){return{async afterCreate(n,s){const{accessControl:t,databaseIsolation:a,settingsInheritance:o}=e;t&&n.ctx&&await V(n,s,t),a!=null&&a.onProvision&&await a.onProvision(s.id),(o==null?void 0:o.inheritFromMain)!==!1&&n.ctx&&await Y(n,s,e)},async beforeDelete(n,s){const{accessControl:t,databaseIsolation:a}=e;if(t)try{const d=(await n.adapters.organizations.list(t.mainTenantId)).organizations.find(i=>i.name===s);d&&await n.adapters.organizations.remove(t.mainTenantId,d.id)}catch(o){console.warn(`Failed to remove organization for tenant ${s}:`,o)}if(a!=null&&a.onDeprovision)try{await a.onDeprovision(s)}catch(o){console.warn(`Failed to deprovision database for tenant ${s}:`,o)}}}}async function V(e,n,s){const{mainTenantId:t,defaultPermissions:a,defaultRoles:o,issuer:d,adminRoleName:i="Tenant Admin",adminRoleDescription:c="Full access to all tenant management operations",addCreatorToOrganization:r=!0}=s;await e.adapters.organizations.create(t,{id:n.id,name:n.id,display_name:n.friendly_name||n.id});let l=null;if(d&&(l=await L(e,t,d,i,c)),r&&e.ctx){const f=e.ctx.var.user;if(f!=null&&f.sub)try{await e.adapters.userOrganizations.create(t,{user_id:f.sub,organization_id:n.id}),l&&await e.adapters.userRoles.create(t,f.sub,l,n.id)}catch(u){console.warn(`Failed to add creator ${f.sub} to organization ${n.id}:`,u)}}o&&o.length>0&&console.log(`Would assign roles ${o.join(", ")} to organization ${n.id}`),a&&a.length>0&&console.log(`Would grant permissions ${a.join(", ")} to organization ${n.id}`)}async function L(e,n,s,t,a){const d=(await e.adapters.roles.list(n,{})).roles.find(l=>l.name===t);if(d)return d.id;const i=await e.adapters.roles.create(n,{name:t,description:a}),c=`${s}api/v2/`,r=S.MANAGEMENT_API_SCOPES.map(l=>({role_id:i.id,resource_server_identifier:c,permission_name:l.value}));return await e.adapters.rolePermissions.assign(n,i.id,r),i.id}async function Y(e,n,s){const{accessControl:t,settingsInheritance:a}=s;if(!t)return;const o=await e.adapters.tenants.get(t.mainTenantId);if(!o)return;let d={...o};const i=["id","created_at","updated_at","friendly_name","audience","sender_email","sender_name"];for(const c of i)delete d[c];if(a!=null&&a.inheritedKeys){const c={};for(const r of a.inheritedKeys)r in o&&!i.includes(r)&&(c[r]=o[r]);d=c}if(a!=null&&a.excludedKeys)for(const c of a.excludedKeys)delete d[c];a!=null&&a.transformSettings&&(d=a.transformSettings(d,n.id)),Object.keys(d).length>0&&await e.adapters.tenants.update(n.id,d)}async function R(e,n,s={}){const{cursorField:t="id",sortOrder:a="asc",pageSize:o=100,maxItems:d=1e4,q:i}=s,c=[];let r,l=!0;for(;l;){let f=i||"";if(r){const w=`${t}:${a==="asc"?">":"<"}${r}`;f=f?`(${f}) AND ${w}`:w}const u={per_page:o,page:0,sort:{sort_by:t,sort_order:a},...f&&{q:f}},_=(await e(u))[n]||[];if(_.length===0)l=!1;else{c.push(..._);const g=_[_.length-1];if(g&&typeof g=="object"){const w=g[t];w!=null&&(r=String(w))}_.length<o&&(l=!1),d!==-1&&c.length>=d&&(console.warn(`fetchAll: Reached maxItems limit (${d}). There may be more items.`),l=!1)}}return c}function j(e){const{mainTenantId:n,getChildTenantIds:s,getAdapters:t,shouldSync:a=()=>!0,transformForSync:o}=e;async function d(r,l,f){return(await r.resourceServers.list(l,{q:`identifier:${f}`,per_page:1})).resource_servers[0]??null}async function i(r,l){const f=await s();await Promise.all(f.map(async u=>{try{const m=await t(u),g={...o?o(r,u):{name:r.name,identifier:r.identifier,scopes:r.scopes,signing_alg:r.signing_alg,signing_secret:r.signing_secret,token_lifetime:r.token_lifetime,token_lifetime_for_web:r.token_lifetime_for_web,skip_consent_for_verifiable_first_party_clients:r.skip_consent_for_verifiable_first_party_clients,allow_offline_access:r.allow_offline_access,verificationKey:r.verificationKey,options:r.options},is_system:!0};if(l==="create"){const w=await d(m,u,r.identifier);w&&w.id?await m.resourceServers.update(u,w.id,g):await m.resourceServers.create(u,g)}else{const w=await d(m,u,r.identifier);w&&w.id&&await m.resourceServers.update(u,w.id,g)}}catch(m){console.error(`Failed to sync resource server "${r.identifier}" to tenant "${u}":`,m)}}))}async function c(r){const l=await s();await Promise.all(l.map(async f=>{try{const u=await t(f),m=await d(u,f,r);m&&m.id&&await u.resourceServers.remove(f,m.id)}catch(u){console.error(`Failed to delete resource server "${r}" from tenant "${f}":`,u)}}))}return{afterCreate:async(r,l)=>{r.tenantId===n&&a(l)&&await i(l,"create")},afterUpdate:async(r,l,f)=>{r.tenantId===n&&a(f)&&await i(f,"update")},afterDelete:async(r,l)=>{r.tenantId===n&&await c(l)}}}function U(e){const{mainTenantId:n,getMainTenantAdapters:s,getAdapters:t,shouldSync:a=()=>!0,transformForSync:o}=e;return{async afterCreate(d,i){if(i.id!==n)try{const c=await s(),r=await t(i.id),l=await R(f=>c.resourceServers.list(n,f),"resource_servers",{cursorField:"id",pageSize:100});await Promise.all(l.filter(f=>a(f)).map(async f=>{const u=f;try{const m=o?o(u,i.id):{name:u.name,identifier:u.identifier,scopes:u.scopes,signing_alg:u.signing_alg,signing_secret:u.signing_secret,token_lifetime:u.token_lifetime,token_lifetime_for_web:u.token_lifetime_for_web,skip_consent_for_verifiable_first_party_clients:u.skip_consent_for_verifiable_first_party_clients,allow_offline_access:u.allow_offline_access,verificationKey:u.verificationKey,options:u.options};await r.resourceServers.create(i.id,{...m,is_system:!0})}catch(m){console.error(`Failed to sync resource server "${u.identifier}" to new tenant "${i.id}":`,m)}}))}catch(c){console.error(`Failed to sync resource servers to new tenant "${i.id}":`,c)}}}}var p=class extends Error{constructor(n=500,s){super(s==null?void 0:s.message,{cause:s==null?void 0:s.cause});z(this,"res");z(this,"status");this.res=s==null?void 0:s.res,this.status=n}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function M(e,n){const s=new I.Hono;return s.get("/",async t=>{var f,u;const a=$.auth0QuerySchema.parse(t.req.query()),{page:o,per_page:d,include_totals:i,q:c}=a,r=t.var.user;if(e.accessControl&&(r!=null&&r.sub)){const m=e.accessControl.mainTenantId,g=(await t.env.data.userOrganizations.listUserOrganizations(m,r.sub,{})).organizations.map(y=>y.id);g.includes(m)||g.push(m);const w=await t.env.data.tenants.list({page:o,per_page:d,include_totals:i,q:c}),A=w.tenants.filter(y=>g.includes(y.id));return i?t.json({tenants:A,start:((f=w.totals)==null?void 0:f.start)??0,limit:((u=w.totals)==null?void 0:u.limit)??d,length:A.length}):t.json(A)}const l=await t.env.data.tenants.list({page:o,per_page:d,include_totals:i,q:c});return i?t.json(l):t.json(l.tenants)}),s.get("/:id",async t=>{const a=t.req.param("id");if(e.accessControl){const d=t.var.user,i=e.accessControl.mainTenantId;if(a!==i){if(!(d!=null&&d.sub))throw new p(401,{message:"Authentication required"});if(!(await t.env.data.userOrganizations.listUserOrganizations(i,d.sub,{})).organizations.some(l=>l.id===a))throw new p(403,{message:"Access denied to this tenant"})}}const o=await t.env.data.tenants.get(a);if(!o)throw new p(404,{message:"Tenant not found"});return t.json(o)}),s.post("/",async t=>{var a,o,d;try{const i=t.var.user;if(!(i!=null&&i.sub))throw new p(401,{message:"Authentication required to create tenants"});let c=$.tenantInsertSchema.parse(await t.req.json());const r={adapters:t.env.data,ctx:t};(a=n.tenants)!=null&&a.beforeCreate&&(c=await n.tenants.beforeCreate(r,c));const l=await t.env.data.tenants.create(c);return(o=n.tenants)!=null&&o.afterCreate&&await n.tenants.afterCreate(r,l),t.json(l,201)}catch(i){throw i instanceof Q.z.ZodError?new p(400,{message:"Validation error",cause:i}):i instanceof Error&&("code"in i&&i.code==="SQLITE_CONSTRAINT_PRIMARYKEY"||(d=i.message)!=null&&d.includes("UNIQUE constraint failed"))?new p(409,{message:"Tenant with this ID already exists"}):i}}),s.patch("/:id",async t=>{var u,m;const a=t.req.param("id");if(e.accessControl){const _=t.var.user;if(!(_!=null&&_.sub))throw new p(401,{message:"Authentication required to update tenants"});const g=e.accessControl.mainTenantId;if(a!==g&&!(await t.env.data.userOrganizations.listUserOrganizations(g,_.sub,{})).organizations.some(y=>y.id===a))throw new p(403,{message:"Access denied to update this tenant"})}const o=$.tenantInsertSchema.partial().parse(await t.req.json()),{id:d,...i}=o;if(!await t.env.data.tenants.get(a))throw new p(404,{message:"Tenant not found"});const r={adapters:t.env.data,ctx:t};let l=i;(u=n.tenants)!=null&&u.beforeUpdate&&(l=await n.tenants.beforeUpdate(r,a,i)),await t.env.data.tenants.update(a,l);const f=await t.env.data.tenants.get(a);if(!f)throw new p(404,{message:"Tenant not found after update"});return(m=n.tenants)!=null&&m.afterUpdate&&await n.tenants.afterUpdate(r,f),t.json(f)}),s.delete("/:id",async t=>{var i,c;const a=t.req.param("id");if(e.accessControl&&a===e.accessControl.mainTenantId)throw new p(400,{message:"Cannot delete the main tenant"});if(e.accessControl){const r=t.var.user;if(!(r!=null&&r.sub))throw new p(401,{message:"Authentication required to delete tenants"});const l=e.accessControl.mainTenantId;if(!(await t.env.data.userOrganizations.listUserOrganizations(l,r.sub,{})).organizations.some(m=>m.id===a))throw new p(403,{message:"Access denied to delete this tenant"})}if(!await t.env.data.tenants.get(a))throw new p(404,{message:"Tenant not found"});const d={adapters:t.env.data,ctx:t};return(i=n.tenants)!=null&&i.beforeDelete&&await n.tenants.beforeDelete(d,a),await t.env.data.tenants.remove(a),(c=n.tenants)!=null&&c.afterDelete&&await n.tenants.afterDelete(d,a),t.body(null,204)}),s}function B(e){const n=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:s,type:t}of n){const a=e.match(s);if(a&&a[1])return{type:t,id:a[1]}}return null}async function Z(e,n,s){try{switch(s.type){case"resource_server":{const t=await e.resourceServers.get(n,s.id);return(t==null?void 0:t.is_system)===!0}case"role":{const t=await e.roles.get(n,s.id);return(t==null?void 0:t.is_system)===!0}case"connection":{const t=await e.connections.get(n,s.id);return(t==null?void 0:t.is_system)===!0}default:return!1}}catch{return!1}}function J(e){return{resource_server:"resource server",role:"role",connection:"connection"}[e]}function E(){return async(e,n)=>{if(!["PATCH","PUT","DELETE"].includes(e.req.method))return n();const s=B(e.req.path);if(!s)return n();const t=e.var.tenant_id||e.req.header("x-tenant-id")||e.req.header("tenant-id");if(!t)return n();if(await Z(e.env.data,t,s))throw new p(403,{message:`This ${J(s.type)} is a system resource and cannot be modified. Make changes in the main tenant instead.`});return n()}}function N(e){return async(n,s)=>{if(!e.accessControl)return s();const t=n.var.tenant_id,a=n.var.organization_id;if(!t)throw new p(400,{message:"Tenant ID not found in request"});if(!P(a,t,e.accessControl.mainTenantId))throw new p(403,{message:`Access denied to tenant ${t}`});return s()}}function k(e){return async(n,s)=>{if(!e.subdomainRouting)return s();const{baseDomain:t,reservedSubdomains:a=[],resolveSubdomain:o}=e.subdomainRouting,d=n.req.header("host")||"";let i=null;if(d.endsWith(t)){const r=d.slice(0,-(t.length+1));r&&!r.includes(".")&&(i=r)}if(i&&a.includes(i)&&(i=null),!i)return e.accessControl&&n.set("tenant_id",e.accessControl.mainTenantId),s();let c=null;if(o)c=await o(i);else if(e.subdomainRouting.useOrganizations!==!1&&e.accessControl)try{const r=await n.env.data.organizations.get(e.accessControl.mainTenantId,i);r&&(c=r.id)}catch{}if(!c)throw new p(404,{message:`Tenant not found for subdomain: ${i}`});return n.set("tenant_id",c),s()}}function K(e){return async(n,s)=>{if(!e.databaseIsolation)return s();const t=n.var.tenant_id;if(!t)throw new p(400,{message:"Tenant ID not found in request"});try{const a=await e.databaseIsolation.getAdapters(t);n.env.data=a}catch(a){throw console.error(`Failed to resolve database for tenant ${t}:`,a),new p(500,{message:"Failed to resolve tenant database"})}return s()}}function O(e){const n=k(e),s=N(e),t=K(e);return async(a,o)=>(await n(a,async()=>{}),await s(a,async()=>{}),await t(a,async()=>{}),o())}function X(e){const n=C(e);return{name:"multi-tenancy",middleware:O(e),hooks:n,routes:[{path:"/management",handler:M(e,n)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),e.accessControl&&console.log(`  - Access control enabled (main tenant: ${e.accessControl.mainTenantId})`),e.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`),e.databaseIsolation&&console.log("  - Database isolation enabled")}}}function C(e){const n=e.accessControl?q(e.accessControl):{},s=e.databaseIsolation?D(e.databaseIsolation):{},t=F(e);return{...n,...s,tenants:t}}function H(e){const n=new I.Hono,s=C(e);return n.route("/tenants",M(e,s)),n}function x(e){return{hooks:C(e),middleware:O(e),app:H(e),config:e}}function ee(e){const{mainTenantId:n="main",syncResourceServers:s=!0,multiTenancy:t,entityHooks:a,...o}=e,d={...t,accessControl:{mainTenantId:n,requireOrganizationMatch:!1,defaultPermissions:["tenant:admin"],...t==null?void 0:t.accessControl}},i=C(d);let c,r;s&&(c=j({mainTenantId:n,getChildTenantIds:async()=>(await R(h=>e.dataAdapter.tenants.list(h),"tenants",{cursorField:"id",pageSize:100})).filter(h=>h.id!==n).map(h=>h.id),getAdapters:async y=>e.dataAdapter}),r=U({mainTenantId:n,getMainTenantAdapters:async()=>e.dataAdapter,getAdapters:async y=>e.dataAdapter}));const l=async(y,h,...T)=>{const v=[];if(y)try{await y(...T)}catch(b){v.push(b instanceof Error?b:new Error(String(b)))}if(h)try{await h(...T)}catch(b){v.push(b instanceof Error?b:new Error(String(b)))}if(v.length===1)throw v[0];if(v.length>1)throw new AggregateError(v,`Multiple hook errors: ${v.map(b=>b.message).join("; ")}`)},f={...a,resourceServers:c?{...a==null?void 0:a.resourceServers,afterCreate:async(y,h)=>{var T;await l((T=a==null?void 0:a.resourceServers)==null?void 0:T.afterCreate,c==null?void 0:c.afterCreate,y,h)},afterUpdate:async(y,h,T)=>{var v;await l((v=a==null?void 0:a.resourceServers)==null?void 0:v.afterUpdate,c==null?void 0:c.afterUpdate,y,h,T)},afterDelete:async(y,h)=>{var T;await l((T=a==null?void 0:a.resourceServers)==null?void 0:T.afterDelete,c==null?void 0:c.afterDelete,y,h)}}:a==null?void 0:a.resourceServers,tenants:r?{...a==null?void 0:a.tenants,afterCreate:async(y,h)=>{var T;await l((T=a==null?void 0:a.tenants)==null?void 0:T.afterCreate,r==null?void 0:r.afterCreate,y,h)}}:a==null?void 0:a.tenants},u=S.init({...o,entityHooks:f}),{app:m,managementApp:_,...g}=u,w=new I.Hono;w.use("/api/v2/*",E()),w.route("/",m);const A=M(d,i);return w.route("/api/v2/tenants",A),{app:w,managementApp:_,...g,multiTenancyConfig:d,multiTenancyHooks:i}}Object.defineProperty(exports,"MANAGEMENT_API_SCOPES",{enumerable:!0,get:()=>S.MANAGEMENT_API_SCOPES});Object.defineProperty(exports,"seed",{enumerable:!0,get:()=>S.seed});exports.createAccessControlHooks=q;exports.createAccessControlMiddleware=N;exports.createDatabaseHooks=D;exports.createDatabaseMiddleware=K;exports.createMultiTenancy=H;exports.createMultiTenancyHooks=C;exports.createMultiTenancyMiddleware=O;exports.createMultiTenancyPlugin=X;exports.createProtectSyncedMiddleware=E;exports.createProvisioningHooks=F;exports.createResourceServerSyncHooks=j;exports.createSubdomainMiddleware=k;exports.createTenantResourceServerSyncHooks=U;exports.createTenantsRouter=M;exports.fetchAll=R;exports.init=ee;exports.setupMultiTenancy=x;exports.validateTenantAccess=P;
+"use strict";var H=Object.defineProperty;var k=(t,a,i)=>a in t?H(t,a,{enumerable:!0,configurable:!0,writable:!0,value:i}):t[a]=i;var M=(t,a,i)=>k(t,typeof a!="symbol"?a+"":a,i);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const j=require("hono"),O=require("authhero"),x=require("zod"),z=require("@authhero/adapter-interfaces"),b=require("@hono/zod-openapi");function U(t){const{controlPlaneTenantId:a,requireOrganizationMatch:i=!0}=t;return{async onTenantAccessValidation(e,n){if(n===a)return!0;if(i){const r=e.var.org_name,u=e.var.organization_id,o=r||u;return o?o===n:!1}return!0}}}function N(t,a,i,e){if(a===i)return!0;const n=e||t;return n?n===a:!1}function K(t){return{async resolveDataAdapters(a){try{return await t.getAdapters(a)}catch(i){console.error(`Failed to resolve data adapters for tenant ${a}:`,i);return}}}}function E(t){return{async beforeCreate(a,i){return!i.audience&&i.id?{...i,audience:O.getTenantAudience(i.id)}:i},async afterCreate(a,i){const{accessControl:e,databaseIsolation:n,settingsInheritance:r}=t;e&&a.ctx&&await ee(a,i,e),n!=null&&n.onProvision&&await n.onProvision(i.id),(r==null?void 0:r.inheritFromControlPlane)!==!1&&a.ctx&&await ae(a,i,t)},async beforeDelete(a,i){const{accessControl:e,databaseIsolation:n}=t;if(e)try{const u=(await a.adapters.organizations.list(e.controlPlaneTenantId)).organizations.find(o=>o.name===i);u&&await a.adapters.organizations.remove(e.controlPlaneTenantId,u.id)}catch(r){console.warn(`Failed to remove organization for tenant ${i}:`,r)}if(n!=null&&n.onDeprovision)try{await n.onDeprovision(i)}catch(r){console.warn(`Failed to deprovision database for tenant ${i}:`,r)}}}}async function ee(t,a,i){const{controlPlaneTenantId:e,defaultPermissions:n,defaultRoles:r,issuer:u,adminRoleName:o="Tenant Admin",adminRoleDescription:c="Full access to all tenant management operations",addCreatorToOrganization:s=!0}=i,l=await t.adapters.organizations.create(e,{name:a.id,display_name:a.friendly_name||a.id});let f=null;if(u&&(f=await te(t,e,u,o,c)),s&&t.ctx){const d=t.ctx.var.user;if(d!=null&&d.sub)try{await t.adapters.userOrganizations.create(e,{user_id:d.sub,organization_id:l.id}),f&&await t.adapters.userRoles.create(e,d.sub,f,l.id)}catch(p){console.warn(`Failed to add creator ${d.sub} to organization ${l.id}:`,p)}}r&&r.length>0&&console.log(`Would assign roles ${r.join(", ")} to organization ${l.id}`),n&&n.length>0&&console.log(`Would grant permissions ${n.join(", ")} to organization ${l.id}`)}async function te(t,a,i,e,n){const u=(await t.adapters.roles.list(a,{})).roles.find(l=>l.name===e);if(u)return u.id;const o=await t.adapters.roles.create(a,{name:e,description:n}),c=`${i}api/v2/`,s=O.MANAGEMENT_API_SCOPES.map(l=>({role_id:o.id,resource_server_identifier:c,permission_name:l.value}));return await t.adapters.rolePermissions.assign(a,o.id,s),o.id}async function ae(t,a,i){const{accessControl:e,settingsInheritance:n}=i;if(!e)return;const r=await t.adapters.tenants.get(e.controlPlaneTenantId);if(!r)return;let u={...r};const o=["id","created_at","updated_at","friendly_name","audience","sender_email","sender_name"];for(const c of o)delete u[c];if(n!=null&&n.inheritedKeys){const c={};for(const s of n.inheritedKeys)s in r&&!o.includes(s)&&(c[s]=r[s]);u=c}if(n!=null&&n.excludedKeys)for(const c of n.excludedKeys)delete u[c];n!=null&&n.transformSettings&&(u=n.transformSettings(u,a.id)),Object.keys(u).length>0&&await t.adapters.tenants.update(a.id,u)}async function S(t,a,i={}){const{cursorField:e="id",sortOrder:n="asc",pageSize:r=100,maxItems:u=1e4,q:o}=i,c=[];let s,l=!0;for(;l;){let f=o||"";if(s){const y=`${e}:${n==="asc"?">":"<"}${s}`;f=f?`(${f}) AND ${y}`:y}const d={per_page:r,page:0,sort:{sort_by:e,sort_order:n},...f&&{q:f}},h=(await t(d))[a]||[];if(h.length===0)l=!1;else{c.push(...h);const m=h[h.length-1];if(m&&typeof m=="object"){const y=m[e];y!=null&&(s=String(y))}h.length<r&&(l=!1),u!==-1&&c.length>=u&&(console.warn(`fetchAll: Reached maxItems limit (${u}). There may be more items.`),l=!1)}}return c}function B(t){const{controlPlaneTenantId:a,getChildTenantIds:i,getAdapters:e,shouldSync:n=()=>!0,transformForSync:r}=t;async function u(s,l,f){return(await s.resourceServers.list(l,{q:`identifier:${f}`,per_page:1})).resource_servers[0]??null}async function o(s,l){const f=await i();await Promise.all(f.map(async d=>{try{const p=await e(d),m={...r?r(s,d):{name:s.name,identifier:s.identifier,scopes:s.scopes,signing_alg:s.signing_alg,signing_secret:s.signing_secret,token_lifetime:s.token_lifetime,token_lifetime_for_web:s.token_lifetime_for_web,skip_consent_for_verifiable_first_party_clients:s.skip_consent_for_verifiable_first_party_clients,allow_offline_access:s.allow_offline_access,verificationKey:s.verificationKey,options:s.options},is_system:!0};if(l==="create"){const y=await u(p,d,s.identifier);y&&y.id?await p.resourceServers.update(d,y.id,m):await p.resourceServers.create(d,m)}else{const y=await u(p,d,s.identifier);y&&y.id&&await p.resourceServers.update(d,y.id,m)}}catch(p){console.error(`Failed to sync resource server "${s.identifier}" to tenant "${d}":`,p)}}))}async function c(s){const l=await i();await Promise.all(l.map(async f=>{try{const d=await e(f),p=await u(d,f,s);p&&p.id&&await d.resourceServers.remove(f,p.id)}catch(d){console.error(`Failed to delete resource server "${s}" from tenant "${f}":`,d)}}))}return{afterCreate:async(s,l)=>{s.tenantId===a&&n(l)&&await o(l,"create")},afterUpdate:async(s,l,f)=>{s.tenantId===a&&n(f)&&await o(f,"update")},afterDelete:async(s,l)=>{s.tenantId===a&&await c(l)}}}function W(t){const{controlPlaneTenantId:a,getControlPlaneAdapters:i,getAdapters:e,shouldSync:n=()=>!0,transformForSync:r}=t;return{async afterCreate(u,o){if(o.id!==a)try{const c=await i(),s=await e(o.id),l=await S(f=>c.resourceServers.list(a,f),"resource_servers",{cursorField:"id",pageSize:100});await Promise.all(l.filter(f=>n(f)).map(async f=>{const d=f;try{const p=r?r(d,o.id):{name:d.name,identifier:d.identifier,scopes:d.scopes,signing_alg:d.signing_alg,signing_secret:d.signing_secret,token_lifetime:d.token_lifetime,token_lifetime_for_web:d.token_lifetime_for_web,skip_consent_for_verifiable_first_party_clients:d.skip_consent_for_verifiable_first_party_clients,allow_offline_access:d.allow_offline_access,verificationKey:d.verificationKey,options:d.options};await s.resourceServers.create(o.id,{...p,is_system:!0})}catch(p){console.error(`Failed to sync resource server "${d.identifier}" to new tenant "${o.id}":`,p)}}))}catch(c){console.error(`Failed to sync resource servers to new tenant "${o.id}":`,c)}}}}function Q(t){const{controlPlaneTenantId:a,getChildTenantIds:i,getAdapters:e,shouldSync:n=()=>!0,transformForSync:r}=t;async function u(c,s,l){return(await c.roles.list(s,{q:`name:${l}`,per_page:1})).roles[0]??null}async function o(c,s){const l=await i();await Promise.all(l.map(async f=>{try{const d=await e(f),h={...r?r(c,f):{name:c.name,description:c.description},is_system:!0};if(s==="create"){const m=await u(d,f,c.name);m&&m.id?await d.roles.update(f,m.id,h):await d.roles.create(f,h)}else{const m=await u(d,f,c.name);m&&m.id&&await d.roles.update(f,m.id,h)}}catch(d){console.error(`Failed to sync role "${c.name}" to tenant "${f}":`,d)}}))}return{afterCreate:async(c,s)=>{c.tenantId===a&&n(s)&&await o(s,"create")},afterUpdate:async(c,s,l)=>{c.tenantId===a&&n(l)&&await o(l,"update")},afterDelete:async(c,s)=>{c.tenantId===a&&console.warn(`Role ${s} was deleted from control plane. Child tenant roles with matching names should be deleted manually or implement role name tracking.`)}}}function V(t){const{controlPlaneTenantId:a,getControlPlaneAdapters:i,getAdapters:e,shouldSync:n=()=>!0,transformForSync:r,syncPermissions:u=!0}=t;return{async afterCreate(o,c){if(c.id!==a)try{const s=await i(),l=await e(c.id),f=await S(p=>s.roles.list(a,p),"roles",{cursorField:"id",pageSize:100}),d=new Map;if(await Promise.all(f.filter(p=>n(p)).map(async p=>{const h=p;try{const m=r?r(h,c.id):{name:h.name,description:h.description},y=await l.roles.create(c.id,{...m,is_system:!0});d.set(h.id,y.id)}catch(m){console.error(`Failed to sync role "${h.name}" to new tenant "${c.id}":`,m)}})),u)for(const[p,h]of d)try{const m=await s.rolePermissions.list(a,p,{});m.length>0&&await l.rolePermissions.assign(c.id,h,m.map(y=>({role_id:h,resource_server_identifier:y.resource_server_identifier,permission_name:y.permission_name})))}catch(m){console.error(`Failed to sync permissions for role to new tenant "${c.id}":`,m)}}catch(s){console.error(`Failed to sync roles to new tenant "${c.id}":`,s)}}}}var g=class extends Error{constructor(a=500,i){super(i==null?void 0:i.message,{cause:i==null?void 0:i.cause});M(this,"res");M(this,"status");this.res=i==null?void 0:i.res,this.status=a}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function D(t,a){const i=new j.Hono;return i.get("/",async e=>{var f,d;const n=z.auth0QuerySchema.parse(e.req.query()),{page:r,per_page:u,include_totals:o,q:c}=n,s=e.var.user;if(t.accessControl&&(s!=null&&s.sub)){const p=t.accessControl.controlPlaneTenantId,m=(await e.env.data.userOrganizations.listUserOrganizations(p,s.sub,{})).organizations.map(A=>A.name);m.includes(p)||m.push(p);const y=await e.env.data.tenants.list({page:r,per_page:u,include_totals:o,q:c}),P=y.tenants.filter(A=>m.includes(A.id));return o?e.json({tenants:P,start:((f=y.totals)==null?void 0:f.start)??0,limit:((d=y.totals)==null?void 0:d.limit)??u,length:P.length}):e.json(P)}const l=await e.env.data.tenants.list({page:r,per_page:u,include_totals:o,q:c});return o?e.json(l):e.json(l.tenants)}),i.get("/:id",async e=>{const n=e.req.param("id");if(t.accessControl){const u=e.var.user,o=t.accessControl.controlPlaneTenantId;if(n!==o){if(!(u!=null&&u.sub))throw new g(401,{message:"Authentication required"});if(!(await e.env.data.userOrganizations.listUserOrganizations(o,u.sub,{})).organizations.some(l=>l.name===n))throw new g(403,{message:"Access denied to this tenant"})}}const r=await e.env.data.tenants.get(n);if(!r)throw new g(404,{message:"Tenant not found"});return e.json(r)}),i.post("/",async e=>{var n,r,u;try{const o=e.var.user;if(!(o!=null&&o.sub))throw new g(401,{message:"Authentication required to create tenants"});let c=z.tenantInsertSchema.parse(await e.req.json());const s={adapters:e.env.data,ctx:e};(n=a.tenants)!=null&&n.beforeCreate&&(c=await a.tenants.beforeCreate(s,c));const l=await e.env.data.tenants.create(c);return(r=a.tenants)!=null&&r.afterCreate&&await a.tenants.afterCreate(s,l),e.json(l,201)}catch(o){throw o instanceof x.z.ZodError?new g(400,{message:"Validation error",cause:o}):o instanceof Error&&("code"in o&&o.code==="SQLITE_CONSTRAINT_PRIMARYKEY"||(u=o.message)!=null&&u.includes("UNIQUE constraint failed"))?new g(409,{message:"Tenant with this ID already exists"}):o}}),i.patch("/:id",async e=>{var d,p;const n=e.req.param("id");if(t.accessControl){const h=e.var.user;if(!(h!=null&&h.sub))throw new g(401,{message:"Authentication required to update tenants"});const m=t.accessControl.controlPlaneTenantId;if(n!==m&&!(await e.env.data.userOrganizations.listUserOrganizations(m,h.sub,{})).organizations.some(A=>A.name===n))throw new g(403,{message:"Access denied to update this tenant"})}const r=z.tenantInsertSchema.partial().parse(await e.req.json()),{id:u,...o}=r;if(!await e.env.data.tenants.get(n))throw new g(404,{message:"Tenant not found"});const s={adapters:e.env.data,ctx:e};let l=o;(d=a.tenants)!=null&&d.beforeUpdate&&(l=await a.tenants.beforeUpdate(s,n,o)),await e.env.data.tenants.update(n,l);const f=await e.env.data.tenants.get(n);if(!f)throw new g(404,{message:"Tenant not found after update"});return(p=a.tenants)!=null&&p.afterUpdate&&await a.tenants.afterUpdate(s,f),e.json(f)}),i.delete("/:id",async e=>{var o,c;const n=e.req.param("id");if(t.accessControl&&n===t.accessControl.controlPlaneTenantId)throw new g(400,{message:"Cannot delete the control plane"});if(t.accessControl){const s=e.var.user;if(!(s!=null&&s.sub))throw new g(401,{message:"Authentication required to delete tenants"});const l=t.accessControl.controlPlaneTenantId;if(!(await e.env.data.userOrganizations.listUserOrganizations(l,s.sub,{})).organizations.some(p=>p.name===n))throw new g(403,{message:"Access denied to delete this tenant"})}if(!await e.env.data.tenants.get(n))throw new g(404,{message:"Tenant not found"});const u={adapters:e.env.data,ctx:e};return(o=a.tenants)!=null&&o.beforeDelete&&await a.tenants.beforeDelete(u,n),await e.env.data.tenants.remove(n),(c=a.tenants)!=null&&c.afterDelete&&await a.tenants.afterDelete(u,n),e.body(null,204)}),i}function ne(t,a){const i=new b.OpenAPIHono;return i.openapi(b.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:z.auth0QuerySchema},security:[{Bearer:["auth:read"]}],responses:{200:{content:{"application/json":{schema:b.z.object({tenants:b.z.array(z.tenantSchema),start:b.z.number().optional(),limit:b.z.number().optional(),length:b.z.number().optional()})}},description:"List of tenants"}}}),async e=>{var f,d,p,h;const n=e.req.valid("query"),{page:r,per_page:u,include_totals:o,q:c}=n,s=e.var.user;if(t.accessControl&&(s!=null&&s.sub)){const m=t.accessControl.controlPlaneTenantId,P=(await S(I=>e.env.data.userOrganizations.listUserOrganizations(m,s.sub,I),"organizations")).map(I=>I.name);P.includes(m)||P.push(m);const A=await e.env.data.tenants.list({page:r,per_page:u,include_totals:o,q:c}),q=A.tenants.filter(I=>P.includes(I.id));return o?e.json({tenants:q,start:((f=A.totals)==null?void 0:f.start)??0,limit:((d=A.totals)==null?void 0:d.limit)??u,length:q.length}):e.json({tenants:q})}const l=await e.env.data.tenants.list({page:r,per_page:u,include_totals:o,q:c});return o?e.json({tenants:l.tenants,start:((p=l.totals)==null?void 0:p.start)??0,limit:((h=l.totals)==null?void 0:h.limit)??u,length:l.tenants.length}):e.json({tenants:l.tenants})}),i.openapi(b.createRoute({tags:["tenants"],method:"get",path:"/{id}",request:{params:b.z.object({id:b.z.string()})},security:[{Bearer:["auth:read"]}],responses:{200:{content:{"application/json":{schema:z.tenantSchema}},description:"Tenant details"},404:{description:"Tenant not found"}}}),async e=>{const{id:n}=e.req.valid("param");if(t.accessControl){const u=e.var.user,o=t.accessControl.controlPlaneTenantId;if(n!==o){if(!(u!=null&&u.sub))throw new g(401,{message:"Authentication required"});if(!(await S(l=>e.env.data.userOrganizations.listUserOrganizations(o,u.sub,l),"organizations")).some(l=>l.name===n))throw new g(403,{message:"Access denied to this tenant"})}}const r=await e.env.data.tenants.get(n);if(!r)throw new g(404,{message:"Tenant not found"});return e.json(r)}),i.openapi(b.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:z.tenantInsertSchema}}}},security:[{Bearer:["auth:write"]}],responses:{201:{content:{"application/json":{schema:z.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"}}}),async e=>{var c,s;const n=e.var.user;if(!(n!=null&&n.sub))throw new g(401,{message:"Authentication required to create tenants"});let r=e.req.valid("json");const u={adapters:e.env.data,ctx:e};(c=a.tenants)!=null&&c.beforeCreate&&(r=await a.tenants.beforeCreate(u,r));const o=await e.env.data.tenants.create(r);return(s=a.tenants)!=null&&s.afterCreate&&await a.tenants.afterCreate(u,o),e.json(o,201)}),i.openapi(b.createRoute({tags:["tenants"],method:"patch",path:"/{id}",request:{params:b.z.object({id:b.z.string()}),body:{content:{"application/json":{schema:b.z.object(z.tenantInsertSchema.shape).partial()}}}},security:[{Bearer:["auth:write"]}],responses:{200:{content:{"application/json":{schema:z.tenantSchema}},description:"Tenant updated"},403:{description:"Access denied"},404:{description:"Tenant not found"}}}),async e=>{var l,f;const{id:n}=e.req.valid("param");if(t.accessControl){const d=e.var.user,p=t.accessControl.controlPlaneTenantId;if(!(d!=null&&d.sub))throw new g(401,{message:"Authentication required"});if(n!==p&&!(await S(y=>e.env.data.userOrganizations.listUserOrganizations(p,d.sub,y),"organizations")).some(y=>y.name===n))throw new g(403,{message:"Access denied to this tenant"})}if(!await e.env.data.tenants.get(n))throw new g(404,{message:"Tenant not found"});const u=e.req.valid("json"),o={adapters:e.env.data,ctx:e};let c=u;(l=a.tenants)!=null&&l.beforeUpdate&&(c=await a.tenants.beforeUpdate(o,n,u)),await e.env.data.tenants.update(n,c);const s=await e.env.data.tenants.get(n);if(!s)throw new g(500,{message:"Failed to retrieve updated tenant"});return(f=a.tenants)!=null&&f.afterUpdate&&await a.tenants.afterUpdate(o,s),e.json(s)}),i.openapi(b.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:b.z.object({id:b.z.string()})},security:[{Bearer:["auth:write"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async e=>{var o,c;const{id:n}=e.req.valid("param");if(t.accessControl){const s=e.var.user,l=t.accessControl.controlPlaneTenantId;if(!(s!=null&&s.sub))throw new g(401,{message:"Authentication required"});if(n===l)throw new g(403,{message:"Cannot delete the control plane"});if(!(await S(p=>e.env.data.userOrganizations.listUserOrganizations(l,s.sub,p),"organizations")).some(p=>p.name===n))throw new g(403,{message:"Access denied to this tenant"})}if(!await e.env.data.tenants.get(n))throw new g(404,{message:"Tenant not found"});const u={adapters:e.env.data,ctx:e};return(o=a.tenants)!=null&&o.beforeDelete&&await a.tenants.beforeDelete(u,n),await e.env.data.tenants.remove(n),(c=a.tenants)!=null&&c.afterDelete&&await a.tenants.afterDelete(u,n),e.body(null,204)}),i}function se(t){const a=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:i,type:e}of a){const n=t.match(i);if(n&&n[1])return{type:e,id:n[1]}}return null}async function re(t,a,i){try{switch(i.type){case"resource_server":{const e=await t.resourceServers.get(a,i.id);return(e==null?void 0:e.is_system)===!0}case"role":{const e=await t.roles.get(a,i.id);return(e==null?void 0:e.is_system)===!0}case"connection":{const e=await t.connections.get(a,i.id);return(e==null?void 0:e.is_system)===!0}default:return!1}}catch{return!1}}function ie(t){return{resource_server:"resource server",role:"role",connection:"connection"}[t]}function G(){return async(t,a)=>{if(!["PATCH","PUT","DELETE"].includes(t.req.method))return a();const i=se(t.req.path);if(!i)return a();const e=t.var.tenant_id||t.req.header("x-tenant-id")||t.req.header("tenant-id");if(!e)return a();if(await re(t.env.data,e,i))throw new g(403,{message:`This ${ie(i.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return a()}}function L(t){return async(a,i)=>{if(!t.accessControl)return i();const e=a.var.tenant_id,n=a.var.organization_id;if(!e)throw new g(400,{message:"Tenant ID not found in request"});if(!N(n,e,t.accessControl.controlPlaneTenantId))throw new g(403,{message:`Access denied to tenant ${e}`});return i()}}function Y(t){return async(a,i)=>{if(!t.subdomainRouting)return i();const{baseDomain:e,reservedSubdomains:n=[],resolveSubdomain:r}=t.subdomainRouting,u=a.req.header("host")||"";let o=null;if(u.endsWith(e)){const s=u.slice(0,-(e.length+1));s&&!s.includes(".")&&(o=s)}if(o&&n.includes(o)&&(o=null),!o)return t.accessControl&&a.set("tenant_id",t.accessControl.controlPlaneTenantId),i();let c=null;if(r)c=await r(o);else if(t.subdomainRouting.useOrganizations!==!1&&t.accessControl)try{const s=await a.env.data.organizations.get(t.accessControl.controlPlaneTenantId,o);s&&(c=s.id)}catch{}if(!c)throw new g(404,{message:`Tenant not found for subdomain: ${o}`});return a.set("tenant_id",c),i()}}function Z(t){return async(a,i)=>{if(!t.databaseIsolation)return i();const e=a.var.tenant_id;if(!e)throw new g(400,{message:"Tenant ID not found in request"});try{const n=await t.databaseIsolation.getAdapters(e);a.env.data=n}catch(n){throw console.error(`Failed to resolve database for tenant ${e}:`,n),new g(500,{message:"Failed to resolve tenant database"})}return i()}}function F(t){const a=Y(t),i=L(t),e=Z(t);return async(n,r)=>(await a(n,async()=>{}),await i(n,async()=>{}),await e(n,async()=>{}),r())}function oe(t){const a=R(t);return{name:"multi-tenancy",middleware:F(t),hooks:a,routes:[{path:"/management",handler:D(t,a)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),t.accessControl&&console.log(`  - Access control enabled (control plane: ${t.accessControl.controlPlaneTenantId})`),t.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`),t.databaseIsolation&&console.log("  - Database isolation enabled")}}}function R(t){const a=t.accessControl?U(t.accessControl):{},i=t.databaseIsolation?K(t.databaseIsolation):{},e=E(t);return{...a,...i,tenants:e}}function J(t){const a=new j.Hono,i=R(t);return a.route("/tenants",D(t,i)),a}function ce(t){return{hooks:R(t),middleware:F(t),app:J(t),config:t}}function le(t){const{controlPlaneTenantId:a="main",syncResourceServers:i=!0,syncRoles:e=!0,multiTenancy:n,entityHooks:r,...u}=t,o={...n,accessControl:{controlPlaneTenantId:a,requireOrganizationMatch:!1,defaultPermissions:["tenant:admin"],...n==null?void 0:n.accessControl}},c=R(o);let s,l;i&&(s=B({controlPlaneTenantId:a,getChildTenantIds:async()=>(await S(w=>t.dataAdapter.tenants.list(w),"tenants",{cursorField:"id",pageSize:100})).filter(w=>w.id!==a).map(w=>w.id),getAdapters:async T=>t.dataAdapter}),l=W({controlPlaneTenantId:a,getControlPlaneAdapters:async()=>t.dataAdapter,getAdapters:async T=>t.dataAdapter}));let f,d;e&&(f=Q({controlPlaneTenantId:a,getChildTenantIds:async()=>(await S(w=>t.dataAdapter.tenants.list(w),"tenants",{cursorField:"id",pageSize:100})).filter(w=>w.id!==a).map(w=>w.id),getAdapters:async T=>t.dataAdapter}),d=V({controlPlaneTenantId:a,getControlPlaneAdapters:async()=>t.dataAdapter,getAdapters:async T=>t.dataAdapter,syncPermissions:!0}));const p=async(T,w,..._)=>{const v=[];if(T)try{await T(..._)}catch(C){v.push(C instanceof Error?C:new Error(String(C)))}if(w)try{await w(..._)}catch(C){v.push(C instanceof Error?C:new Error(String(C)))}if(v.length===1)throw v[0];if(v.length>1)throw new AggregateError(v,`Multiple hook errors: ${v.map(C=>C.message).join("; ")}`)},h=async(T,...w)=>{const _=[];for(const v of T)if(v)try{await v(...w)}catch(C){_.push(C instanceof Error?C:new Error(String(C)))}if(_.length===1)throw _[0];if(_.length>1)throw new AggregateError(_,`Multiple hook errors: ${_.map(v=>v.message).join("; ")}`)},m={...r,resourceServers:s?{...r==null?void 0:r.resourceServers,afterCreate:async(T,w)=>{var _;await p((_=r==null?void 0:r.resourceServers)==null?void 0:_.afterCreate,s==null?void 0:s.afterCreate,T,w)},afterUpdate:async(T,w,_)=>{var v;await p((v=r==null?void 0:r.resourceServers)==null?void 0:v.afterUpdate,s==null?void 0:s.afterUpdate,T,w,_)},afterDelete:async(T,w)=>{var _;await p((_=r==null?void 0:r.resourceServers)==null?void 0:_.afterDelete,s==null?void 0:s.afterDelete,T,w)}}:r==null?void 0:r.resourceServers,roles:f?{...r==null?void 0:r.roles,afterCreate:async(T,w)=>{var _;await p((_=r==null?void 0:r.roles)==null?void 0:_.afterCreate,f==null?void 0:f.afterCreate,T,w)},afterUpdate:async(T,w,_)=>{var v;await p((v=r==null?void 0:r.roles)==null?void 0:v.afterUpdate,f==null?void 0:f.afterUpdate,T,w,_)},afterDelete:async(T,w)=>{var _;await p((_=r==null?void 0:r.roles)==null?void 0:_.afterDelete,f==null?void 0:f.afterDelete,T,w)}}:r==null?void 0:r.roles,tenants:l||d?{...r==null?void 0:r.tenants,afterCreate:async(T,w)=>{var _;await h([(_=r==null?void 0:r.tenants)==null?void 0:_.afterCreate,l==null?void 0:l.afterCreate,d==null?void 0:d.afterCreate],T,w)}}:r==null?void 0:r.tenants},y={...c,tenants:l||d?{...c.tenants,afterCreate:async(T,w)=>{var _;(_=c.tenants)!=null&&_.afterCreate&&await c.tenants.afterCreate(T,w),await h([l==null?void 0:l.afterCreate,d==null?void 0:d.afterCreate],T,w)}}:c.tenants},P=ne(o,y),A=O.init({...u,entityHooks:m,managementApiExtensions:[...u.managementApiExtensions||[],{path:"/tenants",router:P}]}),{app:q,managementApp:I,...X}=A,$=new j.Hono;return $.use("/api/v2/*",G()),$.route("/",q),{app:$,managementApp:I,...X,multiTenancyConfig:o,multiTenancyHooks:c}}Object.defineProperty(exports,"MANAGEMENT_API_SCOPES",{enumerable:!0,get:()=>O.MANAGEMENT_API_SCOPES});Object.defineProperty(exports,"seed",{enumerable:!0,get:()=>O.seed});exports.createAccessControlHooks=U;exports.createAccessControlMiddleware=L;exports.createDatabaseHooks=K;exports.createDatabaseMiddleware=Z;exports.createMultiTenancy=J;exports.createMultiTenancyHooks=R;exports.createMultiTenancyMiddleware=F;exports.createMultiTenancyPlugin=oe;exports.createProtectSyncedMiddleware=G;exports.createProvisioningHooks=E;exports.createResourceServerSyncHooks=B;exports.createRoleSyncHooks=Q;exports.createSubdomainMiddleware=Y;exports.createTenantResourceServerSyncHooks=W;exports.createTenantRoleSyncHooks=V;exports.createTenantsRouter=D;exports.fetchAll=S;exports.init=le;exports.setupMultiTenancy=ce;exports.validateTenantAccess=N;