@authhero/multi-tenancy 14.2.0 → 14.4.0

package/dist/multi-tenancy.mjs

@@ -1,31 +1,30 @@
-var W = Object.defineProperty;
-var Q = (t, e, n) => e in t ? W(t, e, { enumerable: !0, configurable: !0, writable: !0, value: n }) : t[e] = n;
-var $ = (t, e, n) => Q(t, typeof e != "symbol" ? e + "" : e, n);
-import { Hono as V } from "hono";
-import { MANAGEMENT_API_SCOPES as J, MANAGEMENT_API_AUDIENCE as L, fetchAll as I, init as X } from "authhero";
-import { OpenAPIHono as Y, createRoute as z, z as C } from "@hono/zod-openapi";
-import { auth0QuerySchema as Z, tenantSchema as k, tenantInsertSchema as x, connectionSchema as R, connectionOptionsSchema as O } from "@authhero/adapter-interfaces";
-function ee(t) {
+var Q = Object.defineProperty;
+var V = (t, e, n) => e in t ? Q(t, e, { enumerable: !0, configurable: !0, writable: !0, value: n }) : t[e] = n;
+var z = (t, e, n) => V(t, typeof e != "symbol" ? e + "" : e, n);
+import { Hono as J } from "hono";
+import { MANAGEMENT_API_SCOPES as X, MANAGEMENT_API_AUDIENCE as U, fetchAll as $, auth0QuerySchema as Y, tenantSchema as k, tenantInsertSchema as Z, connectionSchema as R, connectionOptionsSchema as F, init as x } from "authhero";
+import { OpenAPIHono as ee, createRoute as O, z as S } from "@hono/zod-openapi";
+function te(t) {
   const { controlPlaneTenantId: e, requireOrganizationMatch: n = !0 } = t;
   return {
-    async onTenantAccessValidation(s, a) {
-      if (a === e)
+    async onTenantAccessValidation(s, r) {
+      if (r === e)
         return !0;
       if (n) {
-        const i = s.var.org_name, o = s.var.organization_id, r = i || o;
-        return r ? r.toLowerCase() === a.toLowerCase() : !1;
+        const c = s.var.org_name, o = s.var.organization_id, a = c || o;
+        return a ? a.toLowerCase() === r.toLowerCase() : !1;
       }
       return !0;
     }
   };
 }
-function te(t, e, n, s) {
+function ne(t, e, n, s) {
   if (e === n)
     return !0;
-  const a = s || t;
-  return a ? a.toLowerCase() === e.toLowerCase() : !1;
+  const r = s || t;
+  return r ? r.toLowerCase() === e.toLowerCase() : !1;
 }
-function ne(t) {
+function se(t) {
   return {
     async resolveDataAdapters(e) {
       try {
@@ -40,60 +39,60 @@ function ne(t) {
     }
   };
 }
-function se(t) {
+function re(t) {
   return `urn:authhero:tenant:${t.toLowerCase()}`;
 }
-function re(t) {
+function ae(t) {
   return {
     async beforeCreate(e, n) {
       return !n.audience && n.id ? {
         ...n,
-        audience: se(n.id)
+        audience: re(n.id)
       } : n;
     },
     async afterCreate(e, n) {
-      const { accessControl: s, databaseIsolation: a } = t;
-      s && e.ctx && await ae(e, n, s), a != null && a.onProvision && await a.onProvision(n.id);
+      const { accessControl: s, databaseIsolation: r } = t;
+      s && e.ctx && await oe(e, n, s), r != null && r.onProvision && await r.onProvision(n.id);
     },
     async beforeDelete(e, n) {
-      const { accessControl: s, databaseIsolation: a } = t;
+      const { accessControl: s, databaseIsolation: r } = t;
       if (s)
         try {
           const o = (await e.adapters.organizations.list(
             s.controlPlaneTenantId
-          )).organizations.find((r) => r.name === n);
+          )).organizations.find((a) => a.name === n);
           o && await e.adapters.organizations.remove(
             s.controlPlaneTenantId,
             o.id
           );
-        } catch (i) {
+        } catch (c) {
           console.warn(
             `Failed to remove organization for tenant ${n}:`,
-            i
+            c
           );
         }
-      if (a != null && a.onDeprovision)
+      if (r != null && r.onDeprovision)
         try {
-          await a.onDeprovision(n);
-        } catch (i) {
+          await r.onDeprovision(n);
+        } catch (c) {
           console.warn(
             `Failed to deprovision database for tenant ${n}:`,
-            i
+            c
           );
         }
     }
   };
 }
-async function ae(t, e, n) {
+async function oe(t, e, n) {
   const {
     controlPlaneTenantId: s,
-    defaultPermissions: a,
-    defaultRoles: i,
+    defaultPermissions: r,
+    defaultRoles: c,
     issuer: o,
-    adminRoleName: r = "Tenant Admin",
-    adminRoleDescription: c = "Full access to all tenant management operations",
-    addCreatorToOrganization: m = !0
-  } = n, l = await t.adapters.organizations.create(
+    adminRoleName: a = "Tenant Admin",
+    adminRoleDescription: d = "Full access to all tenant management operations",
+    addCreatorToOrganization: l = !0
+  } = n, i = await t.adapters.organizations.create(
     s,
     {
       name: e.id,
@@ -101,43 +100,43 @@ async function ae(t, e, n) {
     }
   );
   let f;
-  if (o && (f = await ie(
+  if (o && (f = await ce(
     t,
     s,
-    r,
-    c
-  )), m && t.ctx) {
-    const d = t.ctx.var.user;
-    if (d != null && d.sub && !await oe(
+    a,
+    d
+  )), l && t.ctx) {
+    const u = t.ctx.var.user;
+    if (u != null && u.sub && !await ie(
       t,
       s,
-      d.sub
+      u.sub
     ))
       try {
         await t.adapters.userOrganizations.create(s, {
-          user_id: d.sub,
-          organization_id: l.id
+          user_id: u.sub,
+          organization_id: i.id
         }), f && await t.adapters.userRoles.create(
           s,
-          d.sub,
+          u.sub,
           f,
-          l.id
+          i.id
           // organizationId
         );
-      } catch (p) {
+      } catch (g) {
         console.warn(
-          `Failed to add creator ${d.sub} to organization ${l.id}:`,
-          p
+          `Failed to add creator ${u.sub} to organization ${i.id}:`,
+          g
         );
       }
   }
-  i && i.length > 0 && console.log(
-    `Would assign roles ${i.join(", ")} to organization ${l.id}`
-  ), a && a.length > 0 && console.log(
-    `Would grant permissions ${a.join(", ")} to organization ${l.id}`
+  c && c.length > 0 && console.log(
+    `Would assign roles ${c.join(", ")} to organization ${i.id}`
+  ), r && r.length > 0 && console.log(
+    `Would grant permissions ${r.join(", ")} to organization ${i.id}`
   );
 }
-async function oe(t, e, n) {
+async function ie(t, e, n) {
   const s = await t.adapters.userRoles.list(
     e,
     n,
@@ -145,132 +144,132 @@ async function oe(t, e, n) {
     ""
     // Empty string for global roles
   );
-  for (const a of s)
+  for (const r of s)
     if ((await t.adapters.rolePermissions.list(
       e,
-      a.id,
+      r.id,
       { per_page: 1e3 }
     )).some(
-      (r) => r.permission_name === "admin:organizations"
+      (a) => a.permission_name === "admin:organizations"
     ))
       return !0;
   return !1;
 }
-async function ie(t, e, n, s) {
-  const i = (await t.adapters.roles.list(e, {})).roles.find((m) => m.name === n);
-  if (i)
-    return i.id;
+async function ce(t, e, n, s) {
+  const c = (await t.adapters.roles.list(e, {})).roles.find((l) => l.name === n);
+  if (c)
+    return c.id;
   const o = await t.adapters.roles.create(e, {
     name: n,
     description: s
-  }), r = L, c = J.map((m) => ({
+  }), a = U, d = X.map((l) => ({
     role_id: o.id,
-    resource_server_identifier: r,
-    permission_name: m.value
+    resource_server_identifier: a,
+    permission_name: l.value
   }));
   return await t.adapters.rolePermissions.assign(
     e,
     o.id,
-    c
+    d
   ), o.id;
 }
 function E(t, e, n = () => !0) {
-  const { controlPlaneTenantId: s, getChildTenantIds: a, getAdapters: i } = t, o = /* @__PURE__ */ new Map();
-  async function r(l, f, d) {
-    return (await e(l).list(f, {
-      q: `name:${d}`,
+  const { controlPlaneTenantId: s, getChildTenantIds: r, getAdapters: c } = t, o = /* @__PURE__ */ new Map();
+  async function a(i, f, u) {
+    return (await e(i).list(f, {
+      q: `name:${u}`,
       per_page: 1
     }))[0] ?? null;
   }
-  async function c(l) {
-    const f = await a(), d = e(await i(s));
+  async function d(i) {
+    const f = await r(), u = e(await c(s));
     await Promise.all(
-      f.map(async (u) => {
+      f.map(async (m) => {
         try {
-          const p = await i(u), g = e(p), w = {
-            ...d.transform(l),
+          const g = await c(m), p = e(g), w = {
+            ...u.transform(i),
             is_system: !0
-          }, A = await r(p, u, l.name), v = A ? g.getId(A) : void 0;
-          if (A && v) {
-            const h = g.preserveOnUpdate ? g.preserveOnUpdate(A, w) : w;
-            await g.update(u, v, h);
+          }, v = await a(g, m, i.name), _ = v ? p.getId(v) : void 0;
+          if (v && _) {
+            const b = p.preserveOnUpdate ? p.preserveOnUpdate(v, w) : w;
+            await p.update(m, _, b);
           } else
-            await g.create(u, w);
-        } catch (p) {
+            await p.create(m, w);
+        } catch (g) {
           console.error(
-            `Failed to sync ${d.listKey} "${l.name}" to tenant "${u}":`,
-            p
+            `Failed to sync ${u.listKey} "${i.name}" to tenant "${m}":`,
+            g
           );
         }
       })
     );
   }
-  async function m(l) {
-    const f = await a();
+  async function l(i) {
+    const f = await r();
     await Promise.all(
-      f.map(async (d) => {
+      f.map(async (u) => {
         try {
-          const u = await i(d), p = e(u), g = await r(u, d, l), y = g ? p.getId(g) : void 0;
-          g && y && await p.remove(d, y);
-        } catch (u) {
+          const m = await c(u), g = e(m), p = await a(m, u, i), h = p ? g.getId(p) : void 0;
+          p && h && await g.remove(u, h);
+        } catch (m) {
           console.error(
-            `Failed to delete entity "${l}" from tenant "${d}":`,
-            u
+            `Failed to delete entity "${i}" from tenant "${u}":`,
+            m
           );
         }
       })
     );
   }
   return {
-    afterCreate: async (l, f) => {
-      l.tenantId === s && n(f) && await c(f);
+    afterCreate: async (i, f) => {
+      i.tenantId === s && n(f) && await d(f);
     },
-    afterUpdate: async (l, f, d) => {
-      l.tenantId === s && n(d) && await c(d);
+    afterUpdate: async (i, f, u) => {
+      i.tenantId === s && n(u) && await d(u);
     },
-    beforeDelete: async (l, f) => {
-      if (l.tenantId !== s) return;
-      const u = await e(l.adapters).get(l.tenantId, f);
-      u && n(u) && o.set(f, u);
+    beforeDelete: async (i, f) => {
+      if (i.tenantId !== s) return;
+      const m = await e(i.adapters).get(i.tenantId, f);
+      m && n(m) && o.set(f, m);
     },
-    afterDelete: async (l, f) => {
-      if (l.tenantId !== s) return;
-      const d = o.get(f);
-      d && (o.delete(f), await m(d.name));
+    afterDelete: async (i, f) => {
+      if (i.tenantId !== s) return;
+      const u = o.get(f);
+      u && (o.delete(f), await l(u.name));
     }
   };
 }
 function N(t, e, n = () => !0) {
-  const { controlPlaneTenantId: s, getControlPlaneAdapters: a, getAdapters: i } = t;
+  const { controlPlaneTenantId: s, getControlPlaneAdapters: r, getAdapters: c } = t;
   return {
-    async afterCreate(o, r) {
-      if (r.id !== s)
+    async afterCreate(o, a) {
+      if (a.id !== s)
         try {
-          const c = await a(), m = await i(r.id), l = e(c), f = e(m), d = await I(
-            (u) => l.listPaginated(s, u),
-            l.listKey,
+          const d = await r(), l = await c(a.id), i = e(d), f = e(l), u = await $(
+            (m) => i.listPaginated(s, m),
+            i.listKey,
             { cursorField: "id", pageSize: 100 }
           );
           await Promise.all(
-            d.filter((u) => n(u)).map(async (u) => {
+            u.filter((m) => n(m)).map(async (m) => {
               try {
-                const p = l.transform(u);
-                await f.create(r.id, {
-                  ...p,
+                const g = i.transform(m);
+                await f.create(a.id, {
+                  ...g,
                   is_system: !0
                 });
-              } catch (p) {
+              } catch (g) {
                 console.error(
-                  `Failed to sync entity to new tenant "${r.id}":`,
-                  p
+                  `Failed to sync entity to new tenant "${a.id}":`,
+                  g
                 );
               }
             })
           );
-        } catch (c) {
+        } catch (d) {
           console.error(
-            `Failed to sync entities to new tenant "${r.id}":`,
-            c
+            `Failed to sync entities to new tenant "${a.id}":`,
+            d
           );
         }
     }
@@ -309,124 +308,128 @@ const H = (t) => ({
     description: e.description
   })
 });
-function ce(t) {
-  const { sync: e = {}, filters: n = {} } = t, s = e.resourceServers ?? !0, a = e.roles ?? !0, i = s ? E(
+function L(t) {
+  var e;
+  return ((e = t.metadata) == null ? void 0 : e.sync) !== !1;
+}
+function le(t) {
+  const { sync: e = {}, filters: n = {} } = t, s = e.resourceServers ?? !0, r = e.roles ?? !0, c = (g) => L(g) ? n.resourceServers ? n.resourceServers(g) : !0 : !1, o = (g) => L(g) ? n.roles ? n.roles(g) : !0 : !1, a = s ? E(
     t,
     H,
-    n.resourceServers
-  ) : void 0, o = a ? E(
+    c
+  ) : void 0, d = r ? E(
     t,
     G,
-    n.roles
-  ) : void 0, r = s ? N(
+    o
+  ) : void 0, l = s ? N(
     t,
     H,
-    n.resourceServers
-  ) : void 0, c = a ? N(
+    c
+  ) : void 0, i = r ? N(
     t,
     G,
-    n.roles
-  ) : void 0, m = a ? {
-    async afterCreate(d, u) {
-      var p;
-      if (u.id !== t.controlPlaneTenantId) {
-        await ((p = c == null ? void 0 : c.afterCreate) == null ? void 0 : p.call(c, d, u));
+    o
+  ) : void 0, f = r ? {
+    async afterCreate(g, p) {
+      var h;
+      if (p.id !== t.controlPlaneTenantId) {
+        await ((h = i == null ? void 0 : i.afterCreate) == null ? void 0 : h.call(i, g, p));
         try {
-          const g = await t.getControlPlaneAdapters(), y = await t.getAdapters(u.id), w = await I(
-            (v) => g.roles.list(
+          const w = await t.getControlPlaneAdapters(), v = await t.getAdapters(p.id), _ = await $(
+            (A) => w.roles.list(
               t.controlPlaneTenantId,
-              v
+              A
             ),
             "roles",
             { cursorField: "id", pageSize: 100 }
-          ), A = /* @__PURE__ */ new Map();
-          for (const v of w.filter(
-            (h) => {
+          ), b = /* @__PURE__ */ new Map();
+          for (const A of _.filter(
+            (y) => {
               var T;
-              return ((T = n.roles) == null ? void 0 : T.call(n, h)) ?? !0;
+              return ((T = n.roles) == null ? void 0 : T.call(n, y)) ?? !0;
             }
           )) {
-            const h = await l(
-              y,
-              u.id,
-              v.name
+            const y = await u(
+              v,
+              p.id,
+              A.name
             );
-            h && A.set(v.name, h.id);
+            y && b.set(A.name, y.id);
           }
-          for (const v of w.filter(
-            (h) => {
+          for (const A of _.filter(
+            (y) => {
               var T;
-              return ((T = n.roles) == null ? void 0 : T.call(n, h)) ?? !0;
+              return ((T = n.roles) == null ? void 0 : T.call(n, y)) ?? !0;
             }
           )) {
-            const h = A.get(v.name);
-            if (h)
+            const y = b.get(A.name);
+            if (y)
               try {
-                const T = await g.rolePermissions.list(
+                const T = await w.rolePermissions.list(
                   t.controlPlaneTenantId,
-                  v.id,
+                  A.id,
                   {}
                 );
-                T.length > 0 && await y.rolePermissions.assign(
-                  u.id,
-                  h,
-                  T.map((_) => ({
-                    role_id: h,
-                    resource_server_identifier: _.resource_server_identifier,
-                    permission_name: _.permission_name
+                T.length > 0 && await v.rolePermissions.assign(
+                  p.id,
+                  y,
+                  T.map((P) => ({
+                    role_id: y,
+                    resource_server_identifier: P.resource_server_identifier,
+                    permission_name: P.permission_name
                   }))
                 );
               } catch (T) {
                 console.error(
-                  `Failed to sync permissions for role "${v.name}" to tenant "${u.id}":`,
+                  `Failed to sync permissions for role "${A.name}" to tenant "${p.id}":`,
                   T
                 );
               }
           }
-        } catch (g) {
+        } catch (w) {
           console.error(
-            `Failed to sync role permissions to tenant "${u.id}":`,
-            g
+            `Failed to sync role permissions to tenant "${p.id}":`,
+            w
           );
         }
       }
     }
   } : void 0;
-  async function l(d, u, p) {
-    return (await d.roles.list(u, {
-      q: `name:${p}`,
+  async function u(g, p, h) {
+    return (await g.roles.list(p, {
+      q: `name:${h}`,
       per_page: 1
     })).roles[0] ?? null;
   }
   return {
     entityHooks: {
-      resourceServers: i,
-      roles: o
+      resourceServers: a,
+      roles: d
     },
     tenantHooks: {
-      async afterCreate(d, u) {
-        const p = [
-          r == null ? void 0 : r.afterCreate,
-          (m == null ? void 0 : m.afterCreate) ?? (c == null ? void 0 : c.afterCreate)
-        ], g = [];
-        for (const y of p)
-          if (y)
+      async afterCreate(g, p) {
+        const h = [
+          l == null ? void 0 : l.afterCreate,
+          (f == null ? void 0 : f.afterCreate) ?? (i == null ? void 0 : i.afterCreate)
+        ], w = [];
+        for (const v of h)
+          if (v)
             try {
-              await y(d, u);
-            } catch (w) {
-              g.push(w instanceof Error ? w : new Error(String(w)));
+              await v(g, p);
+            } catch (_) {
+              w.push(_ instanceof Error ? _ : new Error(String(_)));
             }
-        if (g.length === 1) throw g[0];
-        if (g.length > 1)
+        if (w.length === 1) throw w[0];
+        if (w.length > 1)
           throw new AggregateError(
-            g,
-            g.map((y) => y.message).join("; ")
+            w,
+            w.map((v) => v.message).join("; ")
           );
       }
     }
   };
 }
-var b = class extends Error {
+var C = class extends Error {
   /**
    * Creates an instance of `HTTPException`.
    * @param status - HTTP status code for the exception. Defaults to 500.
@@ -434,8 +437,8 @@ var b = class extends Error {
    */
   constructor(e = 500, n) {
     super(n == null ? void 0 : n.message, { cause: n == null ? void 0 : n.cause });
-    $(this, "res");
-    $(this, "status");
+    z(this, "res");
+    z(this, "status");
     this.res = n == null ? void 0 : n.res, this.status = e;
   }
   /**
@@ -453,14 +456,14 @@ var b = class extends Error {
   }
 };
 function M(t, e) {
-  const n = new Y();
+  const n = new ee();
   return n.openapi(
-    z({
+    O({
       tags: ["tenants"],
       method: "get",
       path: "/",
       request: {
-        query: Z
+        query: Y
       },
       security: [
         {
@@ -471,11 +474,11 @@ function M(t, e) {
         200: {
           content: {
             "application/json": {
-              schema: C.object({
-                tenants: C.array(k),
-                start: C.number().optional(),
-                limit: C.number().optional(),
-                length: C.number().optional()
+              schema: S.object({
+                tenants: S.array(k),
+                start: S.number().optional(),
+                limit: S.number().optional(),
+                length: S.number().optional()
               })
             }
           },
@@ -484,74 +487,74 @@ function M(t, e) {
       }
     }),
     async (s) => {
-      var u, p, g, y;
-      const a = s.req.valid("query"), { page: i, per_page: o, include_totals: r, q: c } = a, m = s.var.user, l = (m == null ? void 0 : m.permissions) || [];
-      if (l.includes("auth:read") || l.includes("admin:organizations")) {
+      var m, g, p, h;
+      const r = s.req.valid("query"), { page: c, per_page: o, include_totals: a, q: d } = r, l = s.var.user, i = (l == null ? void 0 : l.permissions) || [];
+      if (i.includes("auth:read") || i.includes("admin:organizations")) {
         const w = await s.env.data.tenants.list({
-          page: i,
+          page: c,
           per_page: o,
-          include_totals: r,
-          q: c
+          include_totals: a,
+          q: d
         });
-        return r ? s.json({
+        return a ? s.json({
           tenants: w.tenants,
-          start: ((u = w.totals) == null ? void 0 : u.start) ?? 0,
-          limit: ((p = w.totals) == null ? void 0 : p.limit) ?? o,
+          start: ((m = w.totals) == null ? void 0 : m.start) ?? 0,
+          limit: ((g = w.totals) == null ? void 0 : g.limit) ?? o,
           length: w.tenants.length
         }) : s.json({ tenants: w.tenants });
       }
-      if (t.accessControl && (m != null && m.sub)) {
-        const w = t.accessControl.controlPlaneTenantId, v = (await I(
-          (P) => s.env.data.userOrganizations.listUserOrganizations(
+      if (t.accessControl && (l != null && l.sub)) {
+        const w = t.accessControl.controlPlaneTenantId, _ = (await $(
+          (I) => s.env.data.userOrganizations.listUserOrganizations(
             w,
-            m.sub,
-            P
+            l.sub,
+            I
           ),
           "organizations"
-        )).map((P) => P.name);
-        if (v.length === 0)
-          return r ? s.json({
+        )).map((I) => I.name);
+        if (_.length === 0)
+          return a ? s.json({
             tenants: [],
             start: 0,
             limit: o ?? 50,
             length: 0
           }) : s.json({ tenants: [] });
-        const h = v.length, T = i ?? 0, _ = o ?? 50, S = T * _, D = v.slice(S, S + _);
-        if (D.length === 0)
-          return r ? s.json({
+        const b = _.length, A = c ?? 0, y = o ?? 50, T = A * y, P = _.slice(T, T + y);
+        if (P.length === 0)
+          return a ? s.json({
             tenants: [],
-            start: S,
-            limit: _,
-            length: h
+            start: T,
+            limit: y,
+            length: b
           }) : s.json({ tenants: [] });
-        const F = D.map((P) => `id:${P}`).join(" OR "), K = c ? `(${F}) AND (${c})` : F, j = await s.env.data.tenants.list({
-          q: K,
-          per_page: _,
+        const D = P.map((I) => `id:${I}`).join(" OR "), W = d ? `(${D}) AND (${d})` : D, j = await s.env.data.tenants.list({
+          q: W,
+          per_page: y,
           include_totals: !1
           // We calculate totals from accessibleTenantIds
         });
-        return r ? s.json({
+        return a ? s.json({
           tenants: j.tenants,
-          start: S,
-          limit: _,
-          length: h
+          start: T,
+          limit: y,
+          length: b
         }) : s.json({ tenants: j.tenants });
       }
-      const d = await s.env.data.tenants.list({
-        page: i,
+      const u = await s.env.data.tenants.list({
+        page: c,
         per_page: o,
-        include_totals: r,
-        q: c
+        include_totals: a,
+        q: d
       });
-      return r ? s.json({
-        tenants: d.tenants,
-        start: ((g = d.totals) == null ? void 0 : g.start) ?? 0,
-        limit: ((y = d.totals) == null ? void 0 : y.limit) ?? o,
-        length: d.tenants.length
-      }) : s.json({ tenants: d.tenants });
+      return a ? s.json({
+        tenants: u.tenants,
+        start: ((p = u.totals) == null ? void 0 : p.start) ?? 0,
+        limit: ((h = u.totals) == null ? void 0 : h.limit) ?? o,
+        length: u.tenants.length
+      }) : s.json({ tenants: u.tenants });
     }
   ), n.openapi(
-    z({
+    O({
       tags: ["tenants"],
       method: "post",
       path: "/",
@@ -559,7 +562,7 @@ function M(t, e) {
         body: {
           content: {
             "application/json": {
-              schema: x
+              schema: Z
             }
           }
         }
@@ -587,29 +590,29 @@ function M(t, e) {
       }
     }),
     async (s) => {
-      var c, m;
-      const a = s.var.user;
-      if (!(a != null && a.sub))
-        throw new b(401, {
+      var d, l;
+      const r = s.var.user;
+      if (!(r != null && r.sub))
+        throw new C(401, {
           message: "Authentication required to create tenants"
         });
-      let i = s.req.valid("json");
+      let c = s.req.valid("json");
       const o = {
         adapters: s.env.data,
         ctx: s
       };
-      (c = e.tenants) != null && c.beforeCreate && (i = await e.tenants.beforeCreate(o, i));
-      const r = await s.env.data.tenants.create(i);
-      return (m = e.tenants) != null && m.afterCreate && await e.tenants.afterCreate(o, r), s.json(r, 201);
+      (d = e.tenants) != null && d.beforeCreate && (c = await e.tenants.beforeCreate(o, c));
+      const a = await s.env.data.tenants.create(c);
+      return (l = e.tenants) != null && l.afterCreate && await e.tenants.afterCreate(o, a), s.json(a, 201);
     }
   ), n.openapi(
-    z({
+    O({
       tags: ["tenants"],
       method: "delete",
       path: "/{id}",
       request: {
-        params: C.object({
-          id: C.string()
+        params: S.object({
+          id: S.string()
         })
       },
       security: [
@@ -630,43 +633,43 @@ function M(t, e) {
       }
     }),
     async (s) => {
-      var r, c;
-      const { id: a } = s.req.valid("param");
+      var a, d;
+      const { id: r } = s.req.valid("param");
       if (t.accessControl) {
-        const m = s.var.user, l = t.accessControl.controlPlaneTenantId;
-        if (!(m != null && m.sub))
-          throw new b(401, {
+        const l = s.var.user, i = t.accessControl.controlPlaneTenantId;
+        if (!(l != null && l.sub))
+          throw new C(401, {
             message: "Authentication required"
           });
-        if (a === l)
-          throw new b(403, {
+        if (r === i)
+          throw new C(403, {
             message: "Cannot delete the control plane"
           });
-        if (!(await I(
-          (u) => s.env.data.userOrganizations.listUserOrganizations(
-            l,
-            m.sub,
-            u
+        if (!(await $(
+          (m) => s.env.data.userOrganizations.listUserOrganizations(
+            i,
+            l.sub,
+            m
           ),
           "organizations"
-        )).some((u) => u.name === a))
-          throw new b(403, {
+        )).some((m) => m.name === r))
+          throw new C(403, {
             message: "Access denied to this tenant"
           });
       }
-      if (!await s.env.data.tenants.get(a))
-        throw new b(404, {
+      if (!await s.env.data.tenants.get(r))
+        throw new C(404, {
           message: "Tenant not found"
         });
       const o = {
         adapters: s.env.data,
         ctx: s
       };
-      return (r = e.tenants) != null && r.beforeDelete && await e.tenants.beforeDelete(o, a), await s.env.data.tenants.remove(a), (c = e.tenants) != null && c.afterDelete && await e.tenants.afterDelete(o, a), s.body(null, 204);
+      return (a = e.tenants) != null && a.beforeDelete && await e.tenants.beforeDelete(o, r), await s.env.data.tenants.remove(r), (d = e.tenants) != null && d.afterDelete && await e.tenants.afterDelete(o, r), s.body(null, 204);
     }
   ), n;
 }
-function le(t) {
+function de(t) {
   const e = [
     {
       pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
@@ -676,13 +679,13 @@ function le(t) {
     { pattern: /\/api\/v2\/connections\/([^/]+)$/, type: "connection" }
   ];
   for (const { pattern: n, type: s } of e) {
-    const a = t.match(n);
-    if (a && a[1])
-      return { type: s, id: a[1] };
+    const r = t.match(n);
+    if (r && r[1])
+      return { type: s, id: r[1] };
   }
   return null;
 }
-async function de(t, e, n) {
+async function ue(t, e, n) {
   try {
     switch (n.type) {
       case "resource_server": {
@@ -704,7 +707,7 @@ async function de(t, e, n) {
     return !1;
   }
 }
-function ue(t) {
+function fe(t) {
   return {
     resource_server: "resource server",
     role: "role",
@@ -715,117 +718,117 @@ function me() {
   return async (t, e) => {
     if (!["PATCH", "PUT", "DELETE"].includes(t.req.method))
       return e();
-    const n = le(t.req.path);
+    const n = de(t.req.path);
     if (!n)
       return e();
     const s = t.var.tenant_id || t.req.header("x-tenant-id") || t.req.header("tenant-id");
     if (!s)
       return e();
-    if (await de(t.env.data, s, n))
-      throw new b(403, {
-        message: `This ${ue(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
+    if (await ue(t.env.data, s, n))
+      throw new C(403, {
+        message: `This ${fe(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
       });
     return e();
   };
 }
-function U(t, e) {
+function B(t, e) {
   const { controlPlaneTenantId: n, controlPlaneClientId: s } = e;
   return {
     ...t,
     legacyClients: {
       ...t.legacyClients,
-      get: async (a) => {
+      get: async (r) => {
         var f;
-        const i = await t.legacyClients.get(a);
-        if (!i)
+        const c = await t.legacyClients.get(r);
+        if (!c)
           return null;
-        const o = s ? await t.legacyClients.get(s) : void 0, r = await t.connections.list(
-          i.tenant.id
-        ), c = n ? await t.connections.list(n) : { connections: [] }, m = r.connections.map((d) => {
-          var g;
-          const u = (g = c.connections) == null ? void 0 : g.find(
-            (y) => y.strategy === d.strategy
+        const o = s ? await t.legacyClients.get(s) : void 0, a = await t.connections.list(
+          c.tenant.id
+        ), d = n ? await t.connections.list(n) : { connections: [] }, l = a.connections.map((u) => {
+          var p;
+          const m = (p = d.connections) == null ? void 0 : p.find(
+            (h) => h.strategy === u.strategy
           );
-          if (!(u != null && u.options))
-            return d;
-          const p = R.parse({
-            ...u || {},
-            ...d
+          if (!(m != null && m.options))
+            return u;
+          const g = R.parse({
+            ...m || {},
+            ...u
           });
-          return p.options = O.parse({
-            ...u.options || {},
-            ...d.options
-          }), p;
-        }).filter((d) => d), l = {
+          return g.options = F.parse({
+            ...m.options || {},
+            ...u.options
+          }), g;
+        }).filter((u) => u), i = {
           ...(o == null ? void 0 : o.tenant) || {},
-          ...i.tenant
+          ...c.tenant
         };
-        return !i.tenant.audience && ((f = o == null ? void 0 : o.tenant) != null && f.audience) && (l.audience = o.tenant.audience), {
-          ...i,
+        return !c.tenant.audience && ((f = o == null ? void 0 : o.tenant) != null && f.audience) && (i.audience = o.tenant.audience), {
+          ...c,
           web_origins: [
             ...(o == null ? void 0 : o.web_origins) || [],
-            ...i.web_origins || []
+            ...c.web_origins || []
           ],
           allowed_logout_urls: [
             ...(o == null ? void 0 : o.allowed_logout_urls) || [],
-            ...i.allowed_logout_urls || []
+            ...c.allowed_logout_urls || []
           ],
           callbacks: [
             ...(o == null ? void 0 : o.callbacks) || [],
-            ...i.callbacks || []
+            ...c.callbacks || []
           ],
-          connections: m,
-          tenant: l
+          connections: l,
+          tenant: i
         };
       }
     },
     connections: {
       ...t.connections,
-      get: async (a, i) => {
-        var l;
+      get: async (r, c) => {
+        var i;
         const o = await t.connections.get(
-          a,
-          i
+          r,
+          c
         );
-        if (!o || !n || a === n)
+        if (!o || !n || r === n)
           return o;
-        const c = (l = (await t.connections.list(n)).connections) == null ? void 0 : l.find(
+        const d = (i = (await t.connections.list(n)).connections) == null ? void 0 : i.find(
           (f) => f.strategy === o.strategy
         );
-        if (!(c != null && c.options))
+        if (!(d != null && d.options))
           return o;
-        const m = R.parse({
-          ...c,
+        const l = R.parse({
+          ...d,
           ...o
         });
-        return m.options = O.parse({
-          ...c.options || {},
+        return l.options = F.parse({
+          ...d.options || {},
           ...o.options
-        }), m;
+        }), l;
       },
-      list: async (a, i) => {
-        const o = await t.connections.list(a, i);
-        if (!n || a === n)
+      list: async (r, c) => {
+        const o = await t.connections.list(r, c);
+        if (!n || r === n)
           return o;
-        const r = await t.connections.list(n), c = o.connections.map((m) => {
-          var d;
-          const l = (d = r.connections) == null ? void 0 : d.find(
-            (u) => u.strategy === m.strategy
+        const a = await t.connections.list(n), d = o.connections.map((l) => {
+          var u;
+          const i = (u = a.connections) == null ? void 0 : u.find(
+            (m) => m.strategy === l.strategy
           );
-          if (!(l != null && l.options))
-            return m;
+          if (!(i != null && i.options))
+            return l;
           const f = R.parse({
-            ...l,
-            ...m
+            ...i,
+            ...l
           });
-          return f.options = O.parse({
-            ...l.options || {},
-            ...m.options
+          return f.options = F.parse({
+            ...i.options || {},
+            ...l.options
           }), f;
         });
         return {
           ...o,
-          connections: c
+          connections: d
         };
       }
     }
@@ -838,164 +841,164 @@ function U(t, e) {
     // They remain part of ...baseAdapters and can be properly wrapped by caching.
   };
 }
-function fe(t, e) {
-  return U(t, e);
+function ge(t, e) {
+  return B(t, e);
 }
-const Ce = U, Pe = fe;
-function ge(t) {
+const Ce = B, Se = ge;
+function pe(t) {
   return async (e, n) => {
     const s = e.var.user;
     return (s == null ? void 0 : s.tenant_id) === t && s.org_name && e.set("tenant_id", s.org_name), n();
   };
 }
-function pe(t) {
+function we(t) {
   return async (e, n) => {
     if (!t.accessControl)
       return n();
-    const { controlPlaneTenantId: s } = t.accessControl, a = e.var.org_name, i = e.var.organization_id, o = a || i;
-    let r = e.var.tenant_id;
-    const c = e.var.user, l = (c != null && c.aud ? Array.isArray(c.aud) ? c.aud : [c.aud] : []).includes(L);
-    if (!r && o && l && (e.set("tenant_id", o), r = o), !r)
-      throw new b(400, {
+    const { controlPlaneTenantId: s } = t.accessControl, r = e.var.org_name, c = e.var.organization_id, o = r || c;
+    let a = e.var.tenant_id;
+    const d = e.var.user, i = (d != null && d.aud ? Array.isArray(d.aud) ? d.aud : [d.aud] : []).includes(U);
+    if (!a && o && i && (e.set("tenant_id", o), a = o), !a)
+      throw new C(400, {
         message: "Tenant ID not found in request"
       });
-    if (!te(
-      i,
-      r,
+    if (!ne(
+      c,
+      a,
       s,
-      a
+      r
     ))
-      throw new b(403, {
-        message: `Access denied to tenant ${r}`
+      throw new C(403, {
+        message: `Access denied to tenant ${a}`
       });
     return n();
   };
 }
-function we(t) {
+function ye(t) {
   return async (e, n) => {
     if (!t.subdomainRouting)
       return n();
     const {
       baseDomain: s,
-      reservedSubdomains: a = [],
-      resolveSubdomain: i
+      reservedSubdomains: r = [],
+      resolveSubdomain: c
     } = t.subdomainRouting, o = e.req.header("host") || "";
-    let r = null;
+    let a = null;
     if (o.endsWith(s)) {
-      const m = o.slice(0, -(s.length + 1));
-      m && !m.includes(".") && (r = m);
+      const l = o.slice(0, -(s.length + 1));
+      l && !l.includes(".") && (a = l);
     }
-    if (r && a.includes(r) && (r = null), !r)
+    if (a && r.includes(a) && (a = null), !a)
       return t.accessControl && e.set("tenant_id", t.accessControl.controlPlaneTenantId), n();
-    let c = null;
-    if (i)
-      c = await i(r);
+    let d = null;
+    if (c)
+      d = await c(a);
     else if (t.subdomainRouting.useOrganizations !== !1 && t.accessControl)
       try {
-        const m = await e.env.data.organizations.get(
+        const l = await e.env.data.organizations.get(
           t.accessControl.controlPlaneTenantId,
-          r
+          a
         );
-        m && (c = m.id);
+        l && (d = l.id);
       } catch {
       }
-    if (!c)
-      throw new b(404, {
-        message: `Tenant not found for subdomain: ${r}`
+    if (!d)
+      throw new C(404, {
+        message: `Tenant not found for subdomain: ${a}`
       });
-    return e.set("tenant_id", c), n();
+    return e.set("tenant_id", d), n();
   };
 }
-function ye(t) {
+function he(t) {
   return async (e, n) => {
     if (!t.databaseIsolation)
       return n();
     const s = e.var.tenant_id;
     if (!s)
-      throw new b(400, {
+      throw new C(400, {
         message: "Tenant ID not found in request"
       });
     try {
-      const a = await t.databaseIsolation.getAdapters(s);
-      e.env.data = a;
-    } catch (a) {
+      const r = await t.databaseIsolation.getAdapters(s);
+      e.env.data = r;
+    } catch (r) {
       throw console.error(
         `Failed to resolve database for tenant ${s}:`,
-        a
-      ), new b(500, {
+        r
+      ), new C(500, {
         message: "Failed to resolve tenant database"
       });
     }
     return n();
   };
 }
-function B(t) {
-  const e = we(t), n = pe(t), s = ye(t);
-  return async (a, i) => (await e(a, async () => {
-  }), await n(a, async () => {
-  }), await s(a, async () => {
-  }), i());
+function K(t) {
+  const e = ye(t), n = we(t), s = he(t);
+  return async (r, c) => (await e(r, async () => {
+  }), await n(r, async () => {
+  }), await s(r, async () => {
+  }), c());
 }
-function Ie(t) {
+function Pe(t) {
   const {
     dataAdapter: e,
     controlPlaneTenantId: n = "control_plane",
     sync: s = { resourceServers: !0, roles: !0 },
-    defaultPermissions: a = ["tenant:admin"],
-    requireOrganizationMatch: i = !1,
+    defaultPermissions: r = ["tenant:admin"],
+    requireOrganizationMatch: c = !1,
     managementApiExtensions: o = [],
-    entityHooks: r,
-    getChildTenantIds: c,
-    getAdapters: m,
-    ...l
-  } = t, f = s !== !1, d = f ? {
+    entityHooks: a,
+    getChildTenantIds: d,
+    getAdapters: l,
+    ...i
+  } = t, f = s !== !1, u = f ? {
     resourceServers: s.resourceServers ?? !0,
     roles: s.roles ?? !0
-  } : { resourceServers: !1, roles: !1 }, g = {
+  } : { resourceServers: !1, roles: !1 }, p = {
     controlPlaneTenantId: n,
-    getChildTenantIds: c ?? (async () => (await I(
-      (_) => e.tenants.list(_),
+    getChildTenantIds: d ?? (async () => (await $(
+      (y) => e.tenants.list(y),
       "tenants",
       { cursorField: "id", pageSize: 100 }
-    )).filter((_) => _.id !== n).map((_) => _.id)),
-    getAdapters: m ?? (async () => e),
+    )).filter((y) => y.id !== n).map((y) => y.id)),
+    getAdapters: l ?? (async () => e),
     getControlPlaneAdapters: async () => e,
-    sync: d
-  }, { entityHooks: y, tenantHooks: w } = ce(g), A = {
+    sync: u
+  }, { entityHooks: h, tenantHooks: w } = le(p), v = {
     resourceServers: [
-      y.resourceServers,
-      ...(r == null ? void 0 : r.resourceServers) ?? []
+      h.resourceServers,
+      ...(a == null ? void 0 : a.resourceServers) ?? []
     ],
-    roles: [y.roles, ...(r == null ? void 0 : r.roles) ?? []],
-    connections: (r == null ? void 0 : r.connections) ?? [],
-    tenants: (r == null ? void 0 : r.tenants) ?? [],
-    rolePermissions: (r == null ? void 0 : r.rolePermissions) ?? []
-  }, v = M(
+    roles: [h.roles, ...(a == null ? void 0 : a.roles) ?? []],
+    connections: (a == null ? void 0 : a.connections) ?? [],
+    tenants: (a == null ? void 0 : a.tenants) ?? [],
+    rolePermissions: (a == null ? void 0 : a.rolePermissions) ?? []
+  }, _ = M(
     {
       accessControl: {
         controlPlaneTenantId: n,
-        requireOrganizationMatch: i,
-        defaultPermissions: a
+        requireOrganizationMatch: c,
+        defaultPermissions: r
       }
     },
     { tenants: w }
-  ), { app: h } = X({
+  ), { app: b } = x({
     dataAdapter: e,
-    ...l,
-    entityHooks: A,
+    ...i,
+    entityHooks: v,
     managementApiExtensions: [
       ...o,
-      { path: "/tenants", router: v }
+      { path: "/tenants", router: _ }
     ]
   });
-  return h.use("/api/v2/*", ge(n)), f && h.use("/api/v2/*", me()), { app: h, controlPlaneTenantId: n };
+  return b.use("/api/v2/*", pe(n)), f && b.use("/api/v2/*", me()), { app: b, controlPlaneTenantId: n };
 }
-function Se(t) {
+function Ie(t) {
   const e = q(t);
   return {
     name: "multi-tenancy",
     // Apply multi-tenancy middleware for subdomain routing, database resolution, etc.
-    middleware: B(t),
+    middleware: K(t),
     // Provide lifecycle hooks
     hooks: e,
     // Mount tenant management routes
@@ -1016,45 +1019,45 @@ function Se(t) {
   };
 }
 function q(t) {
-  const e = t.accessControl ? ee(t.accessControl) : {}, n = t.databaseIsolation ? ne(t.databaseIsolation) : {}, s = re(t);
+  const e = t.accessControl ? te(t.accessControl) : {}, n = t.databaseIsolation ? se(t.databaseIsolation) : {}, s = ae(t);
   return {
     ...e,
     ...n,
     tenants: s
   };
 }
-function he(t) {
-  const e = new V(), n = q(t);
+function ve(t) {
+  const e = new J(), n = q(t);
   return e.route("/tenants", M(t, n)), e;
 }
 function $e(t) {
   return {
     hooks: q(t),
-    middleware: B(t),
-    app: he(t),
+    middleware: K(t),
+    app: ve(t),
     config: t
   };
 }
 export {
-  ee as createAccessControlHooks,
-  pe as createAccessControlMiddleware,
-  ge as createControlPlaneTenantMiddleware,
-  ne as createDatabaseHooks,
-  ye as createDatabaseMiddleware,
-  he as createMultiTenancy,
+  te as createAccessControlHooks,
+  we as createAccessControlMiddleware,
+  pe as createControlPlaneTenantMiddleware,
+  se as createDatabaseHooks,
+  he as createDatabaseMiddleware,
+  ve as createMultiTenancy,
   q as createMultiTenancyHooks,
-  B as createMultiTenancyMiddleware,
-  Se as createMultiTenancyPlugin,
+  K as createMultiTenancyMiddleware,
+  Ie as createMultiTenancyPlugin,
   me as createProtectSyncedMiddleware,
-  re as createProvisioningHooks,
-  U as createRuntimeFallbackAdapter,
+  ae as createProvisioningHooks,
+  B as createRuntimeFallbackAdapter,
   Ce as createSettingsInheritanceAdapter,
-  we as createSubdomainMiddleware,
-  ce as createSyncHooks,
+  ye as createSubdomainMiddleware,
+  le as createSyncHooks,
   M as createTenantsOpenAPIRouter,
-  Ie as initMultiTenant,
+  Pe as initMultiTenant,
   $e as setupMultiTenancy,
-  te as validateTenantAccess,
-  fe as withRuntimeFallback,
-  Pe as withSettingsInheritance
+  ne as validateTenantAccess,
+  ge as withRuntimeFallback,
+  Se as withSettingsInheritance
 };