@authhero/multi-tenancy 13.8.1 → 13.10.0

package/dist/multi-tenancy.mjs

@@ -1,33 +1,59 @@
-var B = Object.defineProperty;
-var E = (t, a, i) => a in t ? B(t, a, { enumerable: !0, configurable: !0, writable: !0, value: i }) : t[a] = i;
-var D = (t, a, i) => E(t, typeof a != "symbol" ? a + "" : a, i);
-import { Hono as F } from "hono";
-import { getTenantAudience as W, MANAGEMENT_API_SCOPES as V, init as L } from "authhero";
-import { MANAGEMENT_API_SCOPES as Ae, seed as Pe } from "authhero";
-import { z as Q } from "zod";
-import { auth0QuerySchema as U, tenantInsertSchema as $, tenantSchema as S } from "@authhero/adapter-interfaces";
-import { OpenAPIHono as G, createRoute as O, z as C } from "@hono/zod-openapi";
-function Y(t) {
+var K = Object.defineProperty;
+var B = (t, a, i) => a in t ? K(t, a, { enumerable: !0, configurable: !0, writable: !0, value: i }) : t[a] = i;
+var D = (t, a, i) => B(t, typeof a != "symbol" ? a + "" : a, i);
+import { Hono as U } from "hono";
+import { getTenantAudience as W, MANAGEMENT_API_SCOPES as G, MANAGEMENT_API_AUDIENCE as L, fetchAll as z, init as Q } from "authhero";
+import { MANAGEMENT_API_SCOPES as Pe, fetchAll as ze, seed as Ie } from "authhero";
+import { z as V } from "zod";
+import { auth0QuerySchema as F, tenantInsertSchema as j, tenantSchema as $ } from "@authhero/adapter-interfaces";
+import { OpenAPIHono as Y, createRoute as S, z as C } from "@hono/zod-openapi";
+var w = class extends Error {
+  /**
+   * Creates an instance of `HTTPException`.
+   * @param status - HTTP status code for the exception. Defaults to 500.
+   * @param options - Additional options for the exception.
+   */
+  constructor(a = 500, i) {
+    super(i == null ? void 0 : i.message, { cause: i == null ? void 0 : i.cause });
+    D(this, "res");
+    D(this, "status");
+    this.res = i == null ? void 0 : i.res, this.status = a;
+  }
+  /**
+   * Returns the response object associated with the exception.
+   * If a response object is not provided, a new response is created with the error message and status code.
+   * @returns The response object.
+   */
+  getResponse() {
+    return this.res ? new Response(this.res.body, {
+      status: this.status,
+      headers: this.res.headers
+    }) : new Response(this.message, {
+      status: this.status
+    });
+  }
+};
+function Z(t) {
   const { controlPlaneTenantId: a, requireOrganizationMatch: i = !0 } = t;
   return {
     async onTenantAccessValidation(e, n) {
       if (n === a)
         return !0;
       if (i) {
-        const r = e.var.org_name, u = e.var.organization_id, o = r || u;
+        const r = e.var.org_name, l = e.var.organization_id, o = r || l;
         return o ? o === n : !1;
       }
       return !0;
     }
   };
 }
-function Z(t, a, i, e) {
+function J(t, a, i, e) {
   if (a === i)
     return !0;
   const n = e || t;
   return n ? n === a : !1;
 }
-function J(t) {
+function X(t) {
   return {
     async resolveDataAdapters(a) {
       try {
@@ -42,7 +68,7 @@ function J(t) {
     }
   };
 }
-function X(t) {
+function H(t) {
   return {
     async beforeCreate(a, i) {
       return !i.audience && i.id ? {
@@ -52,18 +78,18 @@ function X(t) {
     },
     async afterCreate(a, i) {
       const { accessControl: e, databaseIsolation: n, settingsInheritance: r } = t;
-      e && a.ctx && await H(a, i, e), n != null && n.onProvision && await n.onProvision(i.id), (r == null ? void 0 : r.inheritFromControlPlane) !== !1 && a.ctx && await x(a, i, t);
+      e && a.ctx && await k(a, i, e), n != null && n.onProvision && await n.onProvision(i.id), (r == null ? void 0 : r.inheritFromControlPlane) !== !1 && a.ctx && await ee(a, i, t);
     },
     async beforeDelete(a, i) {
       const { accessControl: e, databaseIsolation: n } = t;
       if (e)
         try {
-          const u = (await a.adapters.organizations.list(
+          const l = (await a.adapters.organizations.list(
             e.controlPlaneTenantId
           )).organizations.find((o) => o.name === i);
-          u && await a.adapters.organizations.remove(
+          l && await a.adapters.organizations.remove(
             e.controlPlaneTenantId,
-            u.id
+            l.id
           );
         } catch (r) {
           console.warn(
@@ -83,27 +109,26 @@ function X(t) {
     }
   };
 }
-async function H(t, a, i) {
+async function k(t, a, i) {
   const {
     controlPlaneTenantId: e,
     defaultPermissions: n,
     defaultRoles: r,
-    issuer: u,
+    issuer: l,
     adminRoleName: o = "Tenant Admin",
     adminRoleDescription: c = "Full access to all tenant management operations",
     addCreatorToOrganization: s = !0
-  } = i, l = await t.adapters.organizations.create(
+  } = i, u = await t.adapters.organizations.create(
     e,
     {
       name: a.id,
       display_name: a.friendly_name || a.id
     }
   );
-  let f = null;
-  if (u && (f = await k(
+  let f;
+  if (l && (f = await x(
     t,
     e,
-    u,
     o,
     c
   )), s && t.ctx) {
@@ -112,46 +137,46 @@ async function H(t, a, i) {
       try {
         await t.adapters.userOrganizations.create(e, {
           user_id: d.sub,
-          organization_id: l.id
+          organization_id: u.id
         }), f && await t.adapters.userRoles.create(
           e,
           d.sub,
           f,
-          l.id
+          u.id
           // organizationId
         );
       } catch (p) {
         console.warn(
-          `Failed to add creator ${d.sub} to organization ${l.id}:`,
+          `Failed to add creator ${d.sub} to organization ${u.id}:`,
           p
         );
       }
   }
   r && r.length > 0 && console.log(
-    `Would assign roles ${r.join(", ")} to organization ${l.id}`
+    `Would assign roles ${r.join(", ")} to organization ${u.id}`
   ), n && n.length > 0 && console.log(
-    `Would grant permissions ${n.join(", ")} to organization ${l.id}`
+    `Would grant permissions ${n.join(", ")} to organization ${u.id}`
   );
 }
-async function k(t, a, i, e, n) {
-  const u = (await t.adapters.roles.list(a, {})).roles.find((l) => l.name === e);
-  if (u)
-    return u.id;
-  const o = await t.adapters.roles.create(a, {
-    name: e,
-    description: n
-  }), c = `${i}api/v2/`, s = V.map((l) => ({
-    role_id: o.id,
-    resource_server_identifier: c,
-    permission_name: l.value
+async function x(t, a, i, e) {
+  const r = (await t.adapters.roles.list(a, {})).roles.find((s) => s.name === i);
+  if (r)
+    return r.id;
+  const l = await t.adapters.roles.create(a, {
+    name: i,
+    description: e
+  }), o = L, c = G.map((s) => ({
+    role_id: l.id,
+    resource_server_identifier: o,
+    permission_name: s.value
   }));
   return await t.adapters.rolePermissions.assign(
     a,
-    o.id,
-    s
-  ), o.id;
+    l.id,
+    c
+  ), l.id;
 }
-async function x(t, a, i) {
+async function ee(t, a, i) {
   const { accessControl: e, settingsInheritance: n } = i;
   if (!e)
     return;
@@ -160,7 +185,7 @@ async function x(t, a, i) {
   );
   if (!r)
     return;
-  let u = { ...r };
+  let l = { ...r };
   const o = [
     "id",
     "created_at",
@@ -172,63 +197,22 @@ async function x(t, a, i) {
     "sender_name"
   ];
   for (const c of o)
-    delete u[c];
+    delete l[c];
   if (n != null && n.inheritedKeys) {
     const c = {};
     for (const s of n.inheritedKeys)
       s in r && !o.includes(s) && (c[s] = r[s]);
-    u = c;
+    l = c;
   }
   if (n != null && n.excludedKeys)
     for (const c of n.excludedKeys)
-      delete u[c];
-  n != null && n.transformSettings && (u = n.transformSettings(
-    u,
+      delete l[c];
+  n != null && n.transformSettings && (l = n.transformSettings(
+    l,
     a.id
-  )), Object.keys(u).length > 0 && await t.adapters.tenants.update(a.id, u);
+  )), Object.keys(l).length > 0 && await t.adapters.tenants.update(a.id, l);
 }
-async function z(t, a, i = {}) {
-  const {
-    cursorField: e = "id",
-    sortOrder: n = "asc",
-    pageSize: r = 100,
-    maxItems: u = 1e4,
-    q: o
-  } = i, c = [];
-  let s, l = !0;
-  for (; l; ) {
-    let f = o || "";
-    if (s) {
-      const y = `${e}:${n === "asc" ? ">" : "<"}${s}`;
-      f = f ? `(${f}) AND ${y}` : y;
-    }
-    const d = {
-      per_page: r,
-      page: 0,
-      // Always use page 0 since we're doing cursor-based pagination
-      sort: {
-        sort_by: e,
-        sort_order: n
-      },
-      ...f && { q: f }
-    }, h = (await t(d))[a] || [];
-    if (h.length === 0)
-      l = !1;
-    else {
-      c.push(...h);
-      const m = h[h.length - 1];
-      if (m && typeof m == "object") {
-        const y = m[e];
-        y != null && (s = String(y));
-      }
-      h.length < r && (l = !1), u !== -1 && c.length >= u && (console.warn(
-        `fetchAll: Reached maxItems limit (${u}). There may be more items.`
-      ), l = !1);
-    }
-  }
-  return c;
-}
-function ee(t) {
+function te(t) {
   const {
     controlPlaneTenantId: a,
     getChildTenantIds: i,
@@ -236,18 +220,18 @@ function ee(t) {
     shouldSync: n = () => !0,
     transformForSync: r
   } = t;
-  async function u(s, l, f) {
-    return (await s.resourceServers.list(l, {
+  async function l(s, u, f) {
+    return (await s.resourceServers.list(u, {
       q: `identifier:${f}`,
       per_page: 1
     })).resource_servers[0] ?? null;
   }
-  async function o(s, l) {
+  async function o(s, u) {
     const f = await i();
     await Promise.all(
       f.map(async (d) => {
         try {
-          const p = await e(d), m = { ...r ? r(s, d) : {
+          const p = await e(d), y = { ...r ? r(s, d) : {
             name: s.name,
             identifier: s.identifier,
             scopes: s.scopes,
@@ -260,27 +244,27 @@ function ee(t) {
             verificationKey: s.verificationKey,
             options: s.options
           }, is_system: !0 };
-          if (l === "create") {
-            const y = await u(
+          if (u === "create") {
+            const T = await l(
               p,
               d,
               s.identifier
             );
-            y && y.id ? await p.resourceServers.update(
+            T && T.id ? await p.resourceServers.update(
               d,
-              y.id,
-              m
-            ) : await p.resourceServers.create(d, m);
+              T.id,
+              y
+            ) : await p.resourceServers.create(d, y);
           } else {
-            const y = await u(
+            const T = await l(
               p,
               d,
               s.identifier
             );
-            y && y.id && await p.resourceServers.update(
+            T && T.id && await p.resourceServers.update(
               d,
-              y.id,
-              m
+              T.id,
+              y
             );
           }
         } catch (p) {
@@ -293,11 +277,11 @@ function ee(t) {
     );
   }
   async function c(s) {
-    const l = await i();
+    const u = await i();
     await Promise.all(
-      l.map(async (f) => {
+      u.map(async (f) => {
         try {
-          const d = await e(f), p = await u(
+          const d = await e(f), p = await l(
             d,
             f,
             s
@@ -313,18 +297,18 @@ function ee(t) {
     );
   }
   return {
-    afterCreate: async (s, l) => {
-      s.tenantId === a && n(l) && await o(l, "create");
+    afterCreate: async (s, u) => {
+      s.tenantId === a && n(u) && await o(u, "create");
     },
-    afterUpdate: async (s, l, f) => {
+    afterUpdate: async (s, u, f) => {
       s.tenantId === a && n(f) && await o(f, "update");
     },
-    afterDelete: async (s, l) => {
-      s.tenantId === a && await c(l);
+    afterDelete: async (s, u) => {
+      s.tenantId === a && await c(u);
     }
   };
 }
-function te(t) {
+function ae(t) {
   const {
     controlPlaneTenantId: a,
     getControlPlaneAdapters: i,
@@ -333,10 +317,10 @@ function te(t) {
     transformForSync: r
   } = t;
   return {
-    async afterCreate(u, o) {
+    async afterCreate(l, o) {
       if (o.id !== a)
         try {
-          const c = await i(), s = await e(o.id), l = await z(
+          const c = await i(), s = await e(o.id), u = await z(
             (f) => c.resourceServers.list(
               a,
               f
@@ -345,7 +329,7 @@ function te(t) {
             { cursorField: "id", pageSize: 100 }
           );
           await Promise.all(
-            l.filter((f) => n(f)).map(async (f) => {
+            u.filter((f) => n(f)).map(async (f) => {
               const d = f;
               try {
                 const p = r ? r(d, o.id) : {
@@ -382,7 +366,7 @@ function te(t) {
     }
   };
 }
-function ae(t) {
+function ne(t) {
   const {
     controlPlaneTenantId: a,
     getChildTenantIds: i,
@@ -390,34 +374,34 @@ function ae(t) {
     shouldSync: n = () => !0,
     transformForSync: r
   } = t;
-  async function u(c, s, l) {
+  async function l(c, s, u) {
     return (await c.roles.list(s, {
-      q: `name:${l}`,
+      q: `name:${u}`,
       per_page: 1
     })).roles[0] ?? null;
   }
   async function o(c, s) {
-    const l = await i();
+    const u = await i();
     await Promise.all(
-      l.map(async (f) => {
+      u.map(async (f) => {
         try {
-          const d = await e(f), h = { ...r ? r(c, f) : {
+          const d = await e(f), _ = { ...r ? r(c, f) : {
             name: c.name,
             description: c.description
           }, is_system: !0 };
           if (s === "create") {
-            const m = await u(d, f, c.name);
-            m && m.id ? await d.roles.update(
+            const y = await l(d, f, c.name);
+            y && y.id ? await d.roles.update(
               f,
-              m.id,
-              h
-            ) : await d.roles.create(f, h);
+              y.id,
+              _
+            ) : await d.roles.create(f, _);
           } else {
-            const m = await u(d, f, c.name);
-            m && m.id && await d.roles.update(
+            const y = await l(d, f, c.name);
+            y && y.id && await d.roles.update(
               f,
-              m.id,
-              h
+              y.id,
+              _
             );
           }
         } catch (d) {
@@ -433,8 +417,8 @@ function ae(t) {
     afterCreate: async (c, s) => {
       c.tenantId === a && n(s) && await o(s, "create");
     },
-    afterUpdate: async (c, s, l) => {
-      c.tenantId === a && n(l) && await o(l, "update");
+    afterUpdate: async (c, s, u) => {
+      c.tenantId === a && n(u) && await o(u, "update");
     },
     afterDelete: async (c, s) => {
       c.tenantId === a && console.warn(
@@ -443,64 +427,64 @@ function ae(t) {
     }
   };
 }
-function ne(t) {
+function se(t) {
   const {
     controlPlaneTenantId: a,
     getControlPlaneAdapters: i,
     getAdapters: e,
     shouldSync: n = () => !0,
     transformForSync: r,
-    syncPermissions: u = !0
+    syncPermissions: l = !0
   } = t;
   return {
     async afterCreate(o, c) {
       if (c.id !== a)
         try {
-          const s = await i(), l = await e(c.id), f = await z(
+          const s = await i(), u = await e(c.id), f = await z(
             (p) => s.roles.list(a, p),
             "roles",
             { cursorField: "id", pageSize: 100 }
           ), d = /* @__PURE__ */ new Map();
           if (await Promise.all(
             f.filter((p) => n(p)).map(async (p) => {
-              const h = p;
+              const _ = p;
               try {
-                const m = r ? r(h, c.id) : {
-                  name: h.name,
-                  description: h.description
-                }, y = await l.roles.create(c.id, {
-                  ...m,
+                const y = r ? r(_, c.id) : {
+                  name: _.name,
+                  description: _.description
+                }, T = await u.roles.create(c.id, {
+                  ...y,
                   is_system: !0
                 });
-                d.set(h.id, y.id);
-              } catch (m) {
+                d.set(_.id, T.id);
+              } catch (y) {
                 console.error(
-                  `Failed to sync role "${h.name}" to new tenant "${c.id}":`,
-                  m
+                  `Failed to sync role "${_.name}" to new tenant "${c.id}":`,
+                  y
                 );
               }
             })
-          ), u)
-            for (const [p, h] of d)
+          ), l)
+            for (const [p, _] of d)
               try {
-                const m = await s.rolePermissions.list(
+                const y = await s.rolePermissions.list(
                   a,
                   p,
                   {}
                 );
-                m.length > 0 && await l.rolePermissions.assign(
+                y.length > 0 && await u.rolePermissions.assign(
                   c.id,
-                  h,
-                  m.map((y) => ({
-                    role_id: h,
-                    resource_server_identifier: y.resource_server_identifier,
-                    permission_name: y.permission_name
+                  _,
+                  y.map((T) => ({
+                    role_id: _,
+                    resource_server_identifier: T.resource_server_identifier,
+                    permission_name: T.permission_name
                   }))
                 );
-              } catch (m) {
+              } catch (y) {
                 console.error(
                   `Failed to sync permissions for role to new tenant "${c.id}":`,
-                  m
+                  y
                 );
               }
         } catch (s) {
@@ -512,100 +496,72 @@ function ne(t) {
     }
   };
 }
-var g = class extends Error {
-  /**
-   * Creates an instance of `HTTPException`.
-   * @param status - HTTP status code for the exception. Defaults to 500.
-   * @param options - Additional options for the exception.
-   */
-  constructor(a = 500, i) {
-    super(i == null ? void 0 : i.message, { cause: i == null ? void 0 : i.cause });
-    D(this, "res");
-    D(this, "status");
-    this.res = i == null ? void 0 : i.res, this.status = a;
-  }
-  /**
-   * Returns the response object associated with the exception.
-   * If a response object is not provided, a new response is created with the error message and status code.
-   * @returns The response object.
-   */
-  getResponse() {
-    return this.res ? new Response(this.res.body, {
-      status: this.status,
-      headers: this.res.headers
-    }) : new Response(this.message, {
-      status: this.status
-    });
-  }
-};
 function M(t, a) {
-  const i = new F();
+  const i = new U();
   return i.get("/", async (e) => {
     var f, d;
-    const n = U.parse(e.req.query()), { page: r, per_page: u, include_totals: o, q: c } = n, s = e.var.user;
+    const n = F.parse(e.req.query()), { page: r, per_page: l, include_totals: o, q: c } = n, s = e.var.user;
     if (t.accessControl && (s != null && s.sub)) {
-      const p = t.accessControl.controlPlaneTenantId, m = (await e.env.data.userOrganizations.listUserOrganizations(
+      const p = t.accessControl.controlPlaneTenantId, y = (await e.env.data.userOrganizations.listUserOrganizations(
         p,
         s.sub,
         {}
-      )).organizations.map((A) => A.name);
-      m.includes(p) || m.push(p);
-      const y = await e.env.data.tenants.list({
+      )).organizations.map((A) => A.name), T = await e.env.data.tenants.list({
         page: r,
-        per_page: u,
+        per_page: l,
         include_totals: o,
         q: c
-      }), P = y.tenants.filter(
-        (A) => m.includes(A.id)
+      }), P = T.tenants.filter(
+        (A) => y.includes(A.id)
       );
       return o ? e.json({
         tenants: P,
-        start: ((f = y.totals) == null ? void 0 : f.start) ?? 0,
-        limit: ((d = y.totals) == null ? void 0 : d.limit) ?? u,
+        start: ((f = T.totals) == null ? void 0 : f.start) ?? 0,
+        limit: ((d = T.totals) == null ? void 0 : d.limit) ?? l,
         length: P.length
       }) : e.json(P);
     }
-    const l = await e.env.data.tenants.list({
+    const u = await e.env.data.tenants.list({
       page: r,
-      per_page: u,
+      per_page: l,
       include_totals: o,
       q: c
     });
-    return o ? e.json(l) : e.json(l.tenants);
+    return o ? e.json(u) : e.json(u.tenants);
   }), i.get("/:id", async (e) => {
     const n = e.req.param("id");
     if (t.accessControl) {
-      const u = e.var.user, o = t.accessControl.controlPlaneTenantId;
+      const l = e.var.user, o = t.accessControl.controlPlaneTenantId;
       if (n !== o) {
-        if (!(u != null && u.sub))
-          throw new g(401, {
+        if (!(l != null && l.sub))
+          throw new w(401, {
             message: "Authentication required"
           });
         if (!(await e.env.data.userOrganizations.listUserOrganizations(
           o,
-          u.sub,
+          l.sub,
           {}
-        )).organizations.some((l) => l.name === n))
-          throw new g(403, {
+        )).organizations.some((u) => u.name === n))
+          throw new w(403, {
             message: "Access denied to this tenant"
           });
       }
     }
     const r = await e.env.data.tenants.get(n);
     if (!r)
-      throw new g(404, {
+      throw new w(404, {
         message: "Tenant not found"
       });
     return e.json(r);
   }), i.post("/", async (e) => {
-    var n, r, u;
+    var n, r, l;
     try {
       const o = e.var.user;
       if (!(o != null && o.sub))
-        throw new g(401, {
+        throw new w(401, {
           message: "Authentication required to create tenants"
         });
-      let c = $.parse(
+      let c = j.parse(
         await e.req.json()
       );
       const s = {
@@ -613,13 +569,13 @@ function M(t, a) {
         ctx: e
       };
       (n = a.tenants) != null && n.beforeCreate && (c = await a.tenants.beforeCreate(s, c));
-      const l = await e.env.data.tenants.create(c);
-      return (r = a.tenants) != null && r.afterCreate && await a.tenants.afterCreate(s, l), e.json(l, 201);
+      const u = await e.env.data.tenants.create(c);
+      return (r = a.tenants) != null && r.afterCreate && await a.tenants.afterCreate(s, u), e.json(u, 201);
     } catch (o) {
-      throw o instanceof Q.ZodError ? new g(400, {
+      throw o instanceof V.ZodError ? new w(400, {
         message: "Validation error",
         cause: o
-      }) : o instanceof Error && ("code" in o && o.code === "SQLITE_CONSTRAINT_PRIMARYKEY" || (u = o.message) != null && u.includes("UNIQUE constraint failed")) ? new g(409, {
+      }) : o instanceof Error && ("code" in o && o.code === "SQLITE_CONSTRAINT_PRIMARYKEY" || (l = o.message) != null && l.includes("UNIQUE constraint failed")) ? new w(409, {
         message: "Tenant with this ID already exists"
       }) : o;
     }
@@ -627,35 +583,35 @@ function M(t, a) {
     var d, p;
     const n = e.req.param("id");
     if (t.accessControl) {
-      const h = e.var.user;
-      if (!(h != null && h.sub))
-        throw new g(401, {
+      const _ = e.var.user;
+      if (!(_ != null && _.sub))
+        throw new w(401, {
           message: "Authentication required to update tenants"
         });
-      const m = t.accessControl.controlPlaneTenantId;
-      if (n !== m && !(await e.env.data.userOrganizations.listUserOrganizations(
-        m,
-        h.sub,
+      const y = t.accessControl.controlPlaneTenantId;
+      if (n !== y && !(await e.env.data.userOrganizations.listUserOrganizations(
+        y,
+        _.sub,
         {}
       )).organizations.some((A) => A.name === n))
-        throw new g(403, {
+        throw new w(403, {
           message: "Access denied to update this tenant"
         });
     }
-    const r = $.partial().parse(await e.req.json()), { id: u, ...o } = r;
+    const r = j.partial().parse(await e.req.json()), { id: l, ...o } = r;
     if (!await e.env.data.tenants.get(n))
-      throw new g(404, {
+      throw new w(404, {
         message: "Tenant not found"
       });
     const s = {
       adapters: e.env.data,
       ctx: e
     };
-    let l = o;
-    (d = a.tenants) != null && d.beforeUpdate && (l = await a.tenants.beforeUpdate(s, n, o)), await e.env.data.tenants.update(n, l);
+    let u = o;
+    (d = a.tenants) != null && d.beforeUpdate && (u = await a.tenants.beforeUpdate(s, n, o)), await e.env.data.tenants.update(n, u);
     const f = await e.env.data.tenants.get(n);
     if (!f)
-      throw new g(404, {
+      throw new w(404, {
         message: "Tenant not found after update"
       });
     return (p = a.tenants) != null && p.afterUpdate && await a.tenants.afterUpdate(s, f), e.json(f);
@@ -663,49 +619,49 @@ function M(t, a) {
     var o, c;
     const n = e.req.param("id");
     if (t.accessControl && n === t.accessControl.controlPlaneTenantId)
-      throw new g(400, {
+      throw new w(400, {
         message: "Cannot delete the control plane"
       });
     if (t.accessControl) {
       const s = e.var.user;
       if (!(s != null && s.sub))
-        throw new g(401, {
+        throw new w(401, {
           message: "Authentication required to delete tenants"
         });
-      const l = t.accessControl.controlPlaneTenantId;
+      const u = t.accessControl.controlPlaneTenantId;
       if (!(await e.env.data.userOrganizations.listUserOrganizations(
-        l,
+        u,
         s.sub,
         {}
       )).organizations.some((p) => p.name === n))
-        throw new g(403, {
+        throw new w(403, {
           message: "Access denied to delete this tenant"
         });
     }
     if (!await e.env.data.tenants.get(n))
-      throw new g(404, {
+      throw new w(404, {
         message: "Tenant not found"
       });
-    const u = {
+    const l = {
       adapters: e.env.data,
       ctx: e
     };
-    return (o = a.tenants) != null && o.beforeDelete && await a.tenants.beforeDelete(u, n), await e.env.data.tenants.remove(n), (c = a.tenants) != null && c.afterDelete && await a.tenants.afterDelete(u, n), e.body(null, 204);
+    return (o = a.tenants) != null && o.beforeDelete && await a.tenants.beforeDelete(l, n), await e.env.data.tenants.remove(n), (c = a.tenants) != null && c.afterDelete && await a.tenants.afterDelete(l, n), e.body(null, 204);
   }), i;
 }
-function se(t, a) {
-  const i = new G();
+function re(t, a) {
+  const i = new Y();
   return i.openapi(
-    O({
+    S({
       tags: ["tenants"],
       method: "get",
       path: "/",
       request: {
-        query: U
+        query: F
       },
       security: [
         {
-          Bearer: ["auth:read"]
+          Bearer: []
         }
       ],
       responses: {
@@ -713,7 +669,7 @@ function se(t, a) {
           content: {
             "application/json": {
               schema: C.object({
-                tenants: C.array(S),
+                tenants: C.array($),
                 start: C.number().optional(),
                 limit: C.number().optional(),
                 length: C.number().optional()
@@ -725,48 +681,46 @@ function se(t, a) {
       }
     }),
     async (e) => {
-      var f, d, p, h;
-      const n = e.req.valid("query"), { page: r, per_page: u, include_totals: o, q: c } = n, s = e.var.user;
+      var f, d, p, _;
+      const n = e.req.valid("query"), { page: r, per_page: l, include_totals: o, q: c } = n, s = e.var.user;
       if (t.accessControl && (s != null && s.sub)) {
-        const m = t.accessControl.controlPlaneTenantId, P = (await z(
+        const y = t.accessControl.controlPlaneTenantId, P = (await z(
           (I) => e.env.data.userOrganizations.listUserOrganizations(
-            m,
+            y,
             s.sub,
             I
           ),
           "organizations"
-        )).map((I) => I.name);
-        P.includes(m) || P.push(m);
-        const A = await e.env.data.tenants.list({
+        )).map((I) => I.name), A = await e.env.data.tenants.list({
           page: r,
-          per_page: u,
+          per_page: l,
           include_totals: o,
           q: c
-        }), q = A.tenants.filter(
+        }), O = A.tenants.filter(
           (I) => P.includes(I.id)
         );
         return o ? e.json({
-          tenants: q,
+          tenants: O,
           start: ((f = A.totals) == null ? void 0 : f.start) ?? 0,
-          limit: ((d = A.totals) == null ? void 0 : d.limit) ?? u,
-          length: q.length
-        }) : e.json({ tenants: q });
+          limit: ((d = A.totals) == null ? void 0 : d.limit) ?? l,
+          length: O.length
+        }) : e.json({ tenants: O });
       }
-      const l = await e.env.data.tenants.list({
+      const u = await e.env.data.tenants.list({
         page: r,
-        per_page: u,
+        per_page: l,
         include_totals: o,
         q: c
       });
       return o ? e.json({
-        tenants: l.tenants,
-        start: ((p = l.totals) == null ? void 0 : p.start) ?? 0,
-        limit: ((h = l.totals) == null ? void 0 : h.limit) ?? u,
-        length: l.tenants.length
-      }) : e.json({ tenants: l.tenants });
+        tenants: u.tenants,
+        start: ((p = u.totals) == null ? void 0 : p.start) ?? 0,
+        limit: ((_ = u.totals) == null ? void 0 : _.limit) ?? l,
+        length: u.tenants.length
+      }) : e.json({ tenants: u.tenants });
     }
   ), i.openapi(
-    O({
+    S({
       tags: ["tenants"],
       method: "get",
       path: "/{id}",
@@ -777,14 +731,14 @@ function se(t, a) {
       },
       security: [
         {
-          Bearer: ["auth:read"]
+          Bearer: []
         }
       ],
       responses: {
         200: {
           content: {
             "application/json": {
-              schema: S
+              schema: $
             }
           },
           description: "Tenant details"
@@ -797,34 +751,34 @@ function se(t, a) {
     async (e) => {
       const { id: n } = e.req.valid("param");
       if (t.accessControl) {
-        const u = e.var.user, o = t.accessControl.controlPlaneTenantId;
+        const l = e.var.user, o = t.accessControl.controlPlaneTenantId;
         if (n !== o) {
-          if (!(u != null && u.sub))
-            throw new g(401, {
+          if (!(l != null && l.sub))
+            throw new w(401, {
               message: "Authentication required"
             });
           if (!(await z(
-            (l) => e.env.data.userOrganizations.listUserOrganizations(
+            (u) => e.env.data.userOrganizations.listUserOrganizations(
               o,
-              u.sub,
-              l
+              l.sub,
+              u
             ),
             "organizations"
-          )).some((l) => l.name === n))
-            throw new g(403, {
+          )).some((u) => u.name === n))
+            throw new w(403, {
               message: "Access denied to this tenant"
             });
         }
       }
       const r = await e.env.data.tenants.get(n);
       if (!r)
-        throw new g(404, {
+        throw new w(404, {
           message: "Tenant not found"
         });
       return e.json(r);
     }
   ), i.openapi(
-    O({
+    S({
       tags: ["tenants"],
       method: "post",
       path: "/",
@@ -832,21 +786,21 @@ function se(t, a) {
         body: {
           content: {
             "application/json": {
-              schema: $
+              schema: j
             }
           }
         }
       },
       security: [
         {
-          Bearer: ["auth:write"]
+          Bearer: []
         }
       ],
       responses: {
         201: {
           content: {
             "application/json": {
-              schema: S
+              schema: $
             }
           },
           description: "Tenant created"
@@ -860,20 +814,20 @@ function se(t, a) {
       var c, s;
       const n = e.var.user;
       if (!(n != null && n.sub))
-        throw new g(401, {
+        throw new w(401, {
           message: "Authentication required to create tenants"
         });
       let r = e.req.valid("json");
-      const u = {
+      const l = {
         adapters: e.env.data,
         ctx: e
       };
-      (c = a.tenants) != null && c.beforeCreate && (r = await a.tenants.beforeCreate(u, r));
+      (c = a.tenants) != null && c.beforeCreate && (r = await a.tenants.beforeCreate(l, r));
       const o = await e.env.data.tenants.create(r);
-      return (s = a.tenants) != null && s.afterCreate && await a.tenants.afterCreate(u, o), e.json(o, 201);
+      return (s = a.tenants) != null && s.afterCreate && await a.tenants.afterCreate(l, o), e.json(o, 201);
     }
   ), i.openapi(
-    O({
+    S({
       tags: ["tenants"],
       method: "patch",
       path: "/{id}",
@@ -884,21 +838,21 @@ function se(t, a) {
         body: {
           content: {
             "application/json": {
-              schema: C.object($.shape).partial()
+              schema: C.object(j.shape).partial()
             }
           }
         }
       },
       security: [
         {
-          Bearer: ["auth:write"]
+          Bearer: ["update:tenants"]
         }
       ],
       responses: {
         200: {
           content: {
             "application/json": {
-              schema: S
+              schema: $
             }
           },
           description: "Tenant updated"
@@ -912,49 +866,49 @@ function se(t, a) {
       }
     }),
     async (e) => {
-      var l, f;
+      var u, f;
       const { id: n } = e.req.valid("param");
       if (t.accessControl) {
         const d = e.var.user, p = t.accessControl.controlPlaneTenantId;
         if (!(d != null && d.sub))
-          throw new g(401, {
+          throw new w(401, {
             message: "Authentication required"
           });
         if (n !== p && !(await z(
-          (y) => e.env.data.userOrganizations.listUserOrganizations(
+          (T) => e.env.data.userOrganizations.listUserOrganizations(
             p,
             d.sub,
-            y
+            T
           ),
           "organizations"
-        )).some((y) => y.name === n))
-          throw new g(403, {
+        )).some((T) => T.name === n))
+          throw new w(403, {
             message: "Access denied to this tenant"
           });
       }
       if (!await e.env.data.tenants.get(n))
-        throw new g(404, {
+        throw new w(404, {
           message: "Tenant not found"
         });
-      const u = e.req.valid("json"), o = {
+      const l = e.req.valid("json"), o = {
         adapters: e.env.data,
         ctx: e
       };
-      let c = u;
-      (l = a.tenants) != null && l.beforeUpdate && (c = await a.tenants.beforeUpdate(
+      let c = l;
+      (u = a.tenants) != null && u.beforeUpdate && (c = await a.tenants.beforeUpdate(
         o,
         n,
-        u
+        l
       )), await e.env.data.tenants.update(n, c);
       const s = await e.env.data.tenants.get(n);
       if (!s)
-        throw new g(500, {
+        throw new w(500, {
           message: "Failed to retrieve updated tenant"
         });
       return (f = a.tenants) != null && f.afterUpdate && await a.tenants.afterUpdate(o, s), e.json(s);
     }
   ), i.openapi(
-    O({
+    S({
       tags: ["tenants"],
       method: "delete",
       path: "/{id}",
@@ -965,7 +919,7 @@ function se(t, a) {
       },
       security: [
         {
-          Bearer: ["auth:write"]
+          Bearer: ["delete:tenants"]
         }
       ],
       responses: {
@@ -984,40 +938,40 @@ function se(t, a) {
       var o, c;
       const { id: n } = e.req.valid("param");
       if (t.accessControl) {
-        const s = e.var.user, l = t.accessControl.controlPlaneTenantId;
+        const s = e.var.user, u = t.accessControl.controlPlaneTenantId;
         if (!(s != null && s.sub))
-          throw new g(401, {
+          throw new w(401, {
             message: "Authentication required"
           });
-        if (n === l)
-          throw new g(403, {
+        if (n === u)
+          throw new w(403, {
             message: "Cannot delete the control plane"
           });
         if (!(await z(
           (p) => e.env.data.userOrganizations.listUserOrganizations(
-            l,
+            u,
             s.sub,
             p
           ),
           "organizations"
         )).some((p) => p.name === n))
-          throw new g(403, {
+          throw new w(403, {
             message: "Access denied to this tenant"
           });
       }
       if (!await e.env.data.tenants.get(n))
-        throw new g(404, {
+        throw new w(404, {
           message: "Tenant not found"
         });
-      const u = {
+      const l = {
         adapters: e.env.data,
         ctx: e
       };
-      return (o = a.tenants) != null && o.beforeDelete && await a.tenants.beforeDelete(u, n), await e.env.data.tenants.remove(n), (c = a.tenants) != null && c.afterDelete && await a.tenants.afterDelete(u, n), e.body(null, 204);
+      return (o = a.tenants) != null && o.beforeDelete && await a.tenants.beforeDelete(l, n), await e.env.data.tenants.remove(n), (c = a.tenants) != null && c.afterDelete && await a.tenants.afterDelete(l, n), e.body(null, 204);
     }
   ), i;
 }
-function re(t) {
+function ie(t) {
   const a = [
     {
       pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
@@ -1033,7 +987,7 @@ function re(t) {
   }
   return null;
 }
-async function ie(t, a, i) {
+async function oe(t, a, i) {
   try {
     switch (i.type) {
       case "resource_server": {
@@ -1055,26 +1009,26 @@ async function ie(t, a, i) {
     return !1;
   }
 }
-function oe(t) {
+function ce(t) {
   return {
     resource_server: "resource server",
     role: "role",
     connection: "connection"
   }[t];
 }
-function ce() {
+function de() {
   return async (t, a) => {
     if (!["PATCH", "PUT", "DELETE"].includes(t.req.method))
       return a();
-    const i = re(t.req.path);
+    const i = ie(t.req.path);
     if (!i)
       return a();
     const e = t.var.tenant_id || t.req.header("x-tenant-id") || t.req.header("tenant-id");
     if (!e)
       return a();
-    if (await ie(t.env.data, e, i))
-      throw new g(403, {
-        message: `This ${oe(i.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
+    if (await oe(t.env.data, e, i))
+      throw new w(403, {
+        message: `This ${ce(i.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
       });
     return a();
   };
@@ -1085,21 +1039,21 @@ function le(t) {
       return i();
     const e = a.var.tenant_id, n = a.var.organization_id;
     if (!e)
-      throw new g(400, {
+      throw new w(400, {
         message: "Tenant ID not found in request"
       });
-    if (!Z(
+    if (!J(
       n,
       e,
       t.accessControl.controlPlaneTenantId
     ))
-      throw new g(403, {
+      throw new w(403, {
         message: `Access denied to tenant ${e}`
       });
     return i();
   };
 }
-function de(t) {
+function ue(t) {
   return async (a, i) => {
     if (!t.subdomainRouting)
       return i();
@@ -1107,10 +1061,10 @@ function de(t) {
       baseDomain: e,
       reservedSubdomains: n = [],
       resolveSubdomain: r
-    } = t.subdomainRouting, u = a.req.header("host") || "";
+    } = t.subdomainRouting, l = a.req.header("host") || "";
     let o = null;
-    if (u.endsWith(e)) {
-      const s = u.slice(0, -(e.length + 1));
+    if (l.endsWith(e)) {
+      const s = l.slice(0, -(e.length + 1));
       s && !s.includes(".") && (o = s);
     }
     if (o && n.includes(o) && (o = null), !o)
@@ -1128,19 +1082,19 @@ function de(t) {
       } catch {
       }
     if (!c)
-      throw new g(404, {
+      throw new w(404, {
         message: `Tenant not found for subdomain: ${o}`
       });
     return a.set("tenant_id", c), i();
   };
 }
-function ue(t) {
+function fe(t) {
   return async (a, i) => {
     if (!t.databaseIsolation)
       return i();
     const e = a.var.tenant_id;
     if (!e)
-      throw new g(400, {
+      throw new w(400, {
         message: "Tenant ID not found in request"
       });
     try {
@@ -1150,7 +1104,7 @@ function ue(t) {
       throw console.error(
         `Failed to resolve database for tenant ${e}:`,
         n
-      ), new g(500, {
+      ), new w(500, {
         message: "Failed to resolve tenant database"
       });
     }
@@ -1158,14 +1112,14 @@ function ue(t) {
   };
 }
 function N(t) {
-  const a = de(t), i = le(t), e = ue(t);
+  const a = ue(t), i = le(t), e = fe(t);
   return async (n, r) => (await a(n, async () => {
   }), await i(n, async () => {
   }), await e(n, async () => {
   }), r());
 }
-function _e(t) {
-  const a = j(t);
+function Te(t) {
+  const a = R(t);
   return {
     name: "multi-tenancy",
     // Apply multi-tenancy middleware for subdomain routing, database resolution, etc.
@@ -1189,34 +1143,34 @@ function _e(t) {
     }
   };
 }
-function j(t) {
-  const a = t.accessControl ? Y(t.accessControl) : {}, i = t.databaseIsolation ? J(t.databaseIsolation) : {}, e = X(t);
+function R(t) {
+  const a = t.accessControl ? Z(t.accessControl) : {}, i = t.databaseIsolation ? X(t.databaseIsolation) : {}, e = H(t);
   return {
     ...a,
     ...i,
     tenants: e
   };
 }
-function fe(t) {
-  const a = new F(), i = j(t);
+function pe(t) {
+  const a = new U(), i = R(t);
   return a.route("/tenants", M(t, i)), a;
 }
-function Te(t) {
+function ve(t) {
   return {
-    hooks: j(t),
+    hooks: R(t),
     middleware: N(t),
-    app: fe(t),
+    app: pe(t),
     config: t
   };
 }
-function ve(t) {
+function be(t) {
   const {
-    controlPlaneTenantId: a = "main",
+    controlPlaneTenantId: a = "control_plane",
     syncResourceServers: i = !0,
     syncRoles: e = !0,
     multiTenancy: n,
     entityHooks: r,
-    ...u
+    ...l
   } = t, o = {
     ...n,
     accessControl: {
@@ -1225,47 +1179,47 @@ function ve(t) {
       defaultPermissions: ["tenant:admin"],
       ...n == null ? void 0 : n.accessControl
     }
-  }, c = j(o);
-  let s, l;
-  i && (s = ee({
+  }, c = R(o);
+  let s, u;
+  i && (s = te({
     controlPlaneTenantId: a,
     getChildTenantIds: async () => (await z(
-      (w) => t.dataAdapter.tenants.list(w),
+      (m) => t.dataAdapter.tenants.list(m),
       "tenants",
       { cursorField: "id", pageSize: 100 }
-    )).filter((w) => w.id !== a).map((w) => w.id),
-    getAdapters: async (T) => t.dataAdapter
-  }), l = te({
+    )).filter((m) => m.id !== a).map((m) => m.id),
+    getAdapters: async (g) => t.dataAdapter
+  }), u = ae({
     controlPlaneTenantId: a,
     getControlPlaneAdapters: async () => t.dataAdapter,
-    getAdapters: async (T) => t.dataAdapter
+    getAdapters: async (g) => t.dataAdapter
   }));
   let f, d;
-  e && (f = ae({
+  e && (f = ne({
     controlPlaneTenantId: a,
     getChildTenantIds: async () => (await z(
-      (w) => t.dataAdapter.tenants.list(w),
+      (m) => t.dataAdapter.tenants.list(m),
       "tenants",
       { cursorField: "id", pageSize: 100 }
-    )).filter((w) => w.id !== a).map((w) => w.id),
-    getAdapters: async (T) => t.dataAdapter
-  }), d = ne({
+    )).filter((m) => m.id !== a).map((m) => m.id),
+    getAdapters: async (g) => t.dataAdapter
+  }), d = se({
     controlPlaneTenantId: a,
     getControlPlaneAdapters: async () => t.dataAdapter,
-    getAdapters: async (T) => t.dataAdapter,
+    getAdapters: async (g) => t.dataAdapter,
     syncPermissions: !0
   }));
-  const p = async (T, w, ..._) => {
+  const p = async (g, m, ...h) => {
     const v = [];
-    if (T)
+    if (g)
       try {
-        await T(..._);
+        await g(...h);
       } catch (b) {
         v.push(b instanceof Error ? b : new Error(String(b)));
       }
-    if (w)
+    if (m)
       try {
-        await w(..._);
+        await m(...h);
       } catch (b) {
         v.push(b instanceof Error ? b : new Error(String(b)));
       }
@@ -1276,161 +1230,161 @@ function ve(t) {
         v,
         `Multiple hook errors: ${v.map((b) => b.message).join("; ")}`
       );
-  }, h = async (T, ...w) => {
-    const _ = [];
-    for (const v of T)
+  }, _ = async (g, ...m) => {
+    const h = [];
+    for (const v of g)
       if (v)
         try {
-          await v(...w);
+          await v(...m);
         } catch (b) {
-          _.push(
+          h.push(
             b instanceof Error ? b : new Error(String(b))
           );
         }
-    if (_.length === 1)
-      throw _[0];
-    if (_.length > 1)
+    if (h.length === 1)
+      throw h[0];
+    if (h.length > 1)
       throw new AggregateError(
-        _,
-        `Multiple hook errors: ${_.map((v) => v.message).join("; ")}`
+        h,
+        `Multiple hook errors: ${h.map((v) => v.message).join("; ")}`
       );
-  }, m = {
+  }, y = {
     ...r,
     resourceServers: s ? {
       ...r == null ? void 0 : r.resourceServers,
-      afterCreate: async (T, w) => {
-        var _;
+      afterCreate: async (g, m) => {
+        var h;
         await p(
-          (_ = r == null ? void 0 : r.resourceServers) == null ? void 0 : _.afterCreate,
+          (h = r == null ? void 0 : r.resourceServers) == null ? void 0 : h.afterCreate,
           s == null ? void 0 : s.afterCreate,
-          T,
-          w
+          g,
+          m
         );
       },
-      afterUpdate: async (T, w, _) => {
+      afterUpdate: async (g, m, h) => {
         var v;
         await p(
           (v = r == null ? void 0 : r.resourceServers) == null ? void 0 : v.afterUpdate,
           s == null ? void 0 : s.afterUpdate,
-          T,
-          w,
-          _
+          g,
+          m,
+          h
         );
       },
-      afterDelete: async (T, w) => {
-        var _;
+      afterDelete: async (g, m) => {
+        var h;
         await p(
-          (_ = r == null ? void 0 : r.resourceServers) == null ? void 0 : _.afterDelete,
+          (h = r == null ? void 0 : r.resourceServers) == null ? void 0 : h.afterDelete,
           s == null ? void 0 : s.afterDelete,
-          T,
-          w
+          g,
+          m
         );
       }
     } : r == null ? void 0 : r.resourceServers,
     roles: f ? {
       ...r == null ? void 0 : r.roles,
-      afterCreate: async (T, w) => {
-        var _;
+      afterCreate: async (g, m) => {
+        var h;
         await p(
-          (_ = r == null ? void 0 : r.roles) == null ? void 0 : _.afterCreate,
+          (h = r == null ? void 0 : r.roles) == null ? void 0 : h.afterCreate,
           f == null ? void 0 : f.afterCreate,
-          T,
-          w
+          g,
+          m
         );
       },
-      afterUpdate: async (T, w, _) => {
+      afterUpdate: async (g, m, h) => {
         var v;
         await p(
           (v = r == null ? void 0 : r.roles) == null ? void 0 : v.afterUpdate,
           f == null ? void 0 : f.afterUpdate,
-          T,
-          w,
-          _
+          g,
+          m,
+          h
         );
       },
-      afterDelete: async (T, w) => {
-        var _;
+      afterDelete: async (g, m) => {
+        var h;
         await p(
-          (_ = r == null ? void 0 : r.roles) == null ? void 0 : _.afterDelete,
+          (h = r == null ? void 0 : r.roles) == null ? void 0 : h.afterDelete,
           f == null ? void 0 : f.afterDelete,
-          T,
-          w
+          g,
+          m
         );
       }
     } : r == null ? void 0 : r.roles,
-    tenants: l || d ? {
+    tenants: u || d ? {
       ...r == null ? void 0 : r.tenants,
-      afterCreate: async (T, w) => {
-        var _;
-        await h(
+      afterCreate: async (g, m) => {
+        var h;
+        await _(
           [
-            (_ = r == null ? void 0 : r.tenants) == null ? void 0 : _.afterCreate,
-            l == null ? void 0 : l.afterCreate,
+            (h = r == null ? void 0 : r.tenants) == null ? void 0 : h.afterCreate,
+            u == null ? void 0 : u.afterCreate,
             d == null ? void 0 : d.afterCreate
           ],
-          T,
-          w
+          g,
+          m
         );
       }
     } : r == null ? void 0 : r.tenants
-  }, y = {
+  }, T = {
     ...c,
-    tenants: l || d ? {
+    tenants: u || d ? {
       ...c.tenants,
-      afterCreate: async (T, w) => {
-        var _;
-        (_ = c.tenants) != null && _.afterCreate && await c.tenants.afterCreate(T, w), await h(
+      afterCreate: async (g, m) => {
+        var h;
+        (h = c.tenants) != null && h.afterCreate && await c.tenants.afterCreate(g, m), await _(
           [
-            l == null ? void 0 : l.afterCreate,
+            u == null ? void 0 : u.afterCreate,
             d == null ? void 0 : d.afterCreate
           ],
-          T,
-          w
+          g,
+          m
         );
       }
     } : c.tenants
-  }, P = se(
+  }, P = re(
     o,
-    y
-  ), A = L({
-    ...u,
-    entityHooks: m,
+    T
+  ), A = Q({
+    ...l,
+    entityHooks: y,
     // Register tenant routes via the extension mechanism
     // This ensures they go through the full middleware chain (caching, tenant, auth, entity hooks)
     managementApiExtensions: [
-      ...u.managementApiExtensions || [],
+      ...l.managementApiExtensions || [],
       { path: "/tenants", router: P }
     ]
-  }), { app: q, managementApp: I, ...K } = A, R = new F();
-  return R.use("/api/v2/*", ce()), R.route("/", q), {
-    app: R,
+  }), { app: O, managementApp: I, ...E } = A, q = new U();
+  return q.onError((g, m) => g instanceof w ? g.getResponse() : (console.error(g), m.json({ message: "Internal Server Error" }, 500))), q.use("/api/v2/*", de()), q.route("/", O), {
+    app: q,
     managementApp: I,
-    ...K,
+    ...E,
     multiTenancyConfig: o,
     multiTenancyHooks: c
   };
 }
 export {
-  Ae as MANAGEMENT_API_SCOPES,
-  Y as createAccessControlHooks,
+  Pe as MANAGEMENT_API_SCOPES,
+  Z as createAccessControlHooks,
   le as createAccessControlMiddleware,
-  J as createDatabaseHooks,
-  ue as createDatabaseMiddleware,
-  fe as createMultiTenancy,
-  j as createMultiTenancyHooks,
+  X as createDatabaseHooks,
+  fe as createDatabaseMiddleware,
+  pe as createMultiTenancy,
+  R as createMultiTenancyHooks,
   N as createMultiTenancyMiddleware,
-  _e as createMultiTenancyPlugin,
-  ce as createProtectSyncedMiddleware,
-  X as createProvisioningHooks,
-  ee as createResourceServerSyncHooks,
-  ae as createRoleSyncHooks,
-  de as createSubdomainMiddleware,
-  te as createTenantResourceServerSyncHooks,
-  ne as createTenantRoleSyncHooks,
+  Te as createMultiTenancyPlugin,
+  de as createProtectSyncedMiddleware,
+  H as createProvisioningHooks,
+  te as createResourceServerSyncHooks,
+  ne as createRoleSyncHooks,
+  ue as createSubdomainMiddleware,
+  ae as createTenantResourceServerSyncHooks,
+  se as createTenantRoleSyncHooks,
   M as createTenantsRouter,
-  z as fetchAll,
-  ve as init,
-  Pe as seed,
-  Te as setupMultiTenancy,
-  Z as validateTenantAccess
+  ze as fetchAll,
+  be as init,
+  Ie as seed,
+  ve as setupMultiTenancy,
+  J as validateTenantAccess
 };