@authhero/multi-tenancy 14.20.2 → 14.20.3

package/dist/multi-tenancy.mjs

@@ -1,18 +1,18 @@
 var ne = Object.defineProperty;
 var re = (e, t, n) => t in e ? ne(e, t, { enumerable: !0, configurable: !0, writable: !0, value: n }) : e[t] = n;
 var E = (e, t, n) => re(e, typeof t != "symbol" ? t + "" : t, n);
-import { Hono as ae } from "hono";
-import { MANAGEMENT_API_SCOPES as se, MANAGEMENT_API_AUDIENCE as Y, fetchAll as D, auth0QuerySchema as oe, tenantSchema as O, tenantInsertSchema as G, deepMergePatch as ie, connectionSchema as ce, connectionOptionsSchema as le, init as ue } from "authhero";
-import { OpenAPIHono as de, createRoute as k, z as A } from "@hono/zod-openapi";
+import { Hono as se } from "hono";
+import { MANAGEMENT_API_SCOPES as ae, MANAGEMENT_API_AUDIENCE as Y, fetchAll as D, auth0QuerySchema as oe, tenantSchema as O, tenantInsertSchema as G, deepMergePatch as ie, connectionSchema as ce, connectionOptionsSchema as le, init as ue } from "authhero";
+import { OpenAPIHono as de, createRoute as M, z as S } from "@hono/zod-openapi";
 function fe(e) {
   const { controlPlaneTenantId: t, requireOrganizationMatch: n = !0 } = e;
   return {
-    async onTenantAccessValidation(r, a) {
-      if (a === t)
+    async onTenantAccessValidation(r, s) {
+      if (s === t)
         return !0;
       if (n) {
-        const s = r.var.org_name, i = r.var.organization_id, c = s || i;
-        return c ? c.toLowerCase() === a.toLowerCase() : !1;
+        const o = r.var.org_name, i = r.var.organization_id, c = o || i;
+        return c ? c.toLowerCase() === s.toLowerCase() : !1;
       }
       return !0;
     }
@@ -21,8 +21,8 @@ function fe(e) {
 function me(e, t, n, r) {
   if (t === n)
     return !0;
-  const a = r || e;
-  return a ? a.toLowerCase() === t.toLowerCase() : !1;
+  const s = r || e;
+  return s ? s.toLowerCase() === t.toLowerCase() : !1;
 }
 function ge(e) {
   return {
@@ -51,11 +51,11 @@ function Z(e) {
       } : n;
     },
     async afterCreate(t, n) {
-      const { accessControl: r, databaseIsolation: a } = e;
-      r && t.ctx && await he(t, n, r), a != null && a.onProvision && await a.onProvision(n.id);
+      const { accessControl: r, databaseIsolation: s } = e;
+      r && t.ctx && await he(t, n, r), s != null && s.onProvision && await s.onProvision(n.id);
     },
     async beforeDelete(t, n) {
-      const { accessControl: r, databaseIsolation: a } = e;
+      const { accessControl: r, databaseIsolation: s } = e;
       if (r)
         try {
           const i = (await t.adapters.organizations.list(
@@ -65,19 +65,19 @@ function Z(e) {
             r.controlPlaneTenantId,
             i.id
           );
-        } catch (s) {
+        } catch (o) {
           console.warn(
             `Failed to remove organization for tenant ${n}:`,
-            s
+            o
           );
         }
-      if (a != null && a.onDeprovision)
+      if (s != null && s.onDeprovision)
         try {
-          await a.onDeprovision(n);
-        } catch (s) {
+          await s.onDeprovision(n);
+        } catch (o) {
           console.warn(
             `Failed to deprovision database for tenant ${n}:`,
-            s
+            o
           );
         }
     }
@@ -86,13 +86,13 @@ function Z(e) {
 async function he(e, t, n) {
   const {
     controlPlaneTenantId: r,
-    defaultPermissions: a,
-    defaultRoles: s,
+    defaultPermissions: s,
+    defaultRoles: o,
     issuer: i,
     adminRoleName: c = "Tenant Admin",
-    adminRoleDescription: u = "Full access to all tenant management operations",
-    addCreatorToOrganization: o = !0
-  } = n, l = await e.adapters.organizations.create(
+    adminRoleDescription: l = "Full access to all tenant management operations",
+    addCreatorToOrganization: a = !0
+  } = n, u = await e.adapters.organizations.create(
     r,
     {
       name: t.id,
@@ -104,8 +104,8 @@ async function he(e, t, n) {
     e,
     r,
     c,
-    u
-  )), o && e.ctx) {
+    l
+  )), a && e.ctx) {
     const d = e.ctx.var.user;
     if (d != null && d.sub && !await pe(
       e,
@@ -115,25 +115,25 @@ async function he(e, t, n) {
       try {
         await e.adapters.userOrganizations.create(r, {
           user_id: d.sub,
-          organization_id: l.id
+          organization_id: u.id
         }), g && await e.adapters.userRoles.create(
           r,
           d.sub,
           g,
-          l.id
+          u.id
           // organizationId
         );
       } catch (f) {
         console.warn(
-          `Failed to add creator ${d.sub} to organization ${l.id}:`,
+          `Failed to add creator ${d.sub} to organization ${u.id}:`,
           f
         );
       }
   }
-  s && s.length > 0 && console.log(
-    `Would assign roles ${s.join(", ")} to organization ${l.id}`
-  ), a && a.length > 0 && console.log(
-    `Would grant permissions ${a.join(", ")} to organization ${l.id}`
+  o && o.length > 0 && console.log(
+    `Would assign roles ${o.join(", ")} to organization ${u.id}`
+  ), s && s.length > 0 && console.log(
+    `Would grant permissions ${s.join(", ")} to organization ${u.id}`
   );
 }
 async function pe(e, t, n) {
@@ -144,10 +144,10 @@ async function pe(e, t, n) {
     ""
     // Empty string for global roles
   );
-  for (const a of r)
+  for (const s of r)
     if ((await e.adapters.rolePermissions.list(
       t,
-      a.id,
+      s.id,
       { per_page: 1e3 }
     )).some(
       (c) => c.permission_name === "admin:organizations"
@@ -156,64 +156,64 @@ async function pe(e, t, n) {
   return !1;
 }
 async function ye(e, t, n, r) {
-  const s = (await e.adapters.roles.list(t, {})).roles.find((o) => o.name === n);
-  if (s)
-    return s.id;
+  const o = (await e.adapters.roles.list(t, {})).roles.find((a) => a.name === n);
+  if (o)
+    return o.id;
   const i = await e.adapters.roles.create(t, {
     name: n,
     description: r
-  }), c = Y, u = se.map((o) => ({
+  }), c = Y, l = ae.map((a) => ({
     role_id: i.id,
     resource_server_identifier: c,
-    permission_name: o.value
+    permission_name: a.value
   }));
   return await e.adapters.rolePermissions.assign(
     t,
     i.id,
-    u
+    l
   ), i.id;
 }
 function H(e, t, n = () => !0) {
-  const { controlPlaneTenantId: r, getChildTenantIds: a, getAdapters: s } = e, i = /* @__PURE__ */ new Map();
-  async function c(l, g, d) {
-    return (await t(l).list(g, {
+  const { controlPlaneTenantId: r, getChildTenantIds: s, getAdapters: o } = e, i = /* @__PURE__ */ new Map();
+  async function c(u, g, d) {
+    return (await t(u).list(g, {
       q: `name:${d}`,
       per_page: 1
     }))[0] ?? null;
   }
-  async function u(l) {
-    const g = await a(), d = t(await s(r));
+  async function l(u) {
+    const g = await s(), d = t(await o(r));
     await Promise.all(
       g.map(async (m) => {
         try {
-          const f = await s(m), w = t(f), y = {
-            ...d.transform(l),
+          const f = await o(m), w = t(f), y = {
+            ...d.transform(u),
             is_system: !0
-          }, _ = await c(f, m, l.name), b = _ ? w.getId(_) : void 0;
-          if (_ && b) {
+          }, _ = await c(f, m, u.name), P = _ ? w.getId(_) : void 0;
+          if (_ && P) {
             const I = w.preserveOnUpdate ? w.preserveOnUpdate(_, y) : y;
-            await w.update(m, b, I);
+            await w.update(m, P, I);
           } else
             await w.create(m, y);
         } catch (f) {
           console.error(
-            `Failed to sync ${d.listKey} "${l.name}" to tenant "${m}":`,
+            `Failed to sync ${d.listKey} "${u.name}" to tenant "${m}":`,
             f
           );
         }
       })
     );
   }
-  async function o(l) {
-    const g = await a();
+  async function a(u) {
+    const g = await s();
     await Promise.all(
       g.map(async (d) => {
         try {
-          const m = await s(d), f = t(m), w = await c(m, d, l), T = w ? f.getId(w) : void 0;
+          const m = await o(d), f = t(m), w = await c(m, d, u), T = w ? f.getId(w) : void 0;
           w && T && await f.remove(d, T);
         } catch (m) {
           console.error(
-            `Failed to delete entity "${l}" from tenant "${d}":`,
+            `Failed to delete entity "${u}" from tenant "${d}":`,
             m
           );
         }
@@ -221,39 +221,39 @@ function H(e, t, n = () => !0) {
     );
   }
   return {
-    afterCreate: async (l, g) => {
-      l.tenantId === r && n(g) && await u(g);
+    afterCreate: async (u, g) => {
+      u.tenantId === r && n(g) && await l(g);
     },
-    afterUpdate: async (l, g, d) => {
-      l.tenantId === r && n(d) && await u(d);
+    afterUpdate: async (u, g, d) => {
+      u.tenantId === r && n(d) && await l(d);
     },
-    beforeDelete: async (l, g) => {
-      if (l.tenantId !== r) return;
-      const m = await t(l.adapters).get(l.tenantId, g);
+    beforeDelete: async (u, g) => {
+      if (u.tenantId !== r) return;
+      const m = await t(u.adapters).get(u.tenantId, g);
       m && n(m) && i.set(g, m);
     },
-    afterDelete: async (l, g) => {
-      if (l.tenantId !== r) return;
+    afterDelete: async (u, g) => {
+      if (u.tenantId !== r) return;
       const d = i.get(g);
-      d && (i.delete(g), await o(d.name));
+      d && (i.delete(g), await a(d.name));
     }
   };
 }
 function W(e, t, n = () => !0) {
-  const { controlPlaneTenantId: r, getControlPlaneAdapters: a, getAdapters: s } = e;
+  const { controlPlaneTenantId: r, getControlPlaneAdapters: s, getAdapters: o } = e;
   return {
     async afterCreate(i, c) {
       if (c.id !== r)
         try {
-          const u = await a(), o = await s(c.id), l = t(u), g = t(o), d = await D(
-            (m) => l.listPaginated(r, m),
-            l.listKey,
+          const l = await s(), a = await o(c.id), u = t(l), g = t(a), d = await D(
+            (m) => u.listPaginated(r, m),
+            u.listKey,
             { cursorField: "id", pageSize: 100 }
           );
           await Promise.all(
             d.filter((m) => n(m)).map(async (m) => {
               try {
-                const f = l.transform(m);
+                const f = u.transform(m);
                 await g.create(c.id, {
                   ...f,
                   is_system: !0
@@ -266,10 +266,10 @@ function W(e, t, n = () => !0) {
               }
             })
           );
-        } catch (u) {
+        } catch (l) {
           console.error(
             `Failed to sync entities to new tenant "${c.id}":`,
-            u
+            l
           );
         }
     }
@@ -313,25 +313,25 @@ function Q(e) {
   return ((t = e.metadata) == null ? void 0 : t.sync) !== !1;
 }
 function ve(e) {
-  const { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, a = t.roles ?? !0, s = (f) => Q(f) ? n.resourceServers ? n.resourceServers(f) : !0 : !1, i = (f) => Q(f) ? n.roles ? n.roles(f) : !0 : !1, c = r ? H(
+  const { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, s = t.roles ?? !0, o = (f) => Q(f) ? n.resourceServers ? n.resourceServers(f) : !0 : !1, i = (f) => Q(f) ? n.roles ? n.roles(f) : !0 : !1, c = r ? H(
     e,
     L,
-    s
-  ) : void 0, u = a ? H(e, K, i) : void 0, o = r ? W(
+    o
+  ) : void 0, l = s ? H(e, K, i) : void 0, a = r ? W(
     e,
     L,
-    s
-  ) : void 0, l = a ? W(
+    o
+  ) : void 0, u = s ? W(
     e,
     K,
     i
-  ) : void 0, g = a ? {
+  ) : void 0, g = s ? {
     async afterCreate(f, w) {
       var T;
       if (w.id !== e.controlPlaneTenantId) {
-        await ((T = l == null ? void 0 : l.afterCreate) == null ? void 0 : T.call(l, f, w));
+        await ((T = u == null ? void 0 : u.afterCreate) == null ? void 0 : T.call(u, f, w));
         try {
-          const y = await e.getControlPlaneAdapters(), _ = await e.getAdapters(w.id), b = await D(
+          const y = await e.getControlPlaneAdapters(), _ = await e.getAdapters(w.id), P = await D(
             (h) => y.roles.list(
               e.controlPlaneTenantId,
               h
@@ -339,7 +339,7 @@ function ve(e) {
             "roles",
             { cursorField: "id", pageSize: 100 }
           ), I = /* @__PURE__ */ new Map();
-          for (const h of b.filter(
+          for (const h of P.filter(
             (C) => {
               var p;
               return ((p = n.roles) == null ? void 0 : p.call(n, C)) ?? !0;
@@ -352,7 +352,7 @@ function ve(e) {
             );
             C && I.set(h.name, C.id);
           }
-          for (const h of b.filter(
+          for (const h of P.filter(
             (C) => {
               var p;
               return ((p = n.roles) == null ? void 0 : p.call(n, C)) ?? !0;
@@ -400,20 +400,20 @@ function ve(e) {
   return {
     entityHooks: {
       resourceServers: c,
-      roles: u
+      roles: l
     },
     tenantHooks: {
       async afterCreate(f, w) {
         const T = [
-          o == null ? void 0 : o.afterCreate,
-          (g == null ? void 0 : g.afterCreate) ?? (l == null ? void 0 : l.afterCreate)
+          a == null ? void 0 : a.afterCreate,
+          (g == null ? void 0 : g.afterCreate) ?? (u == null ? void 0 : u.afterCreate)
         ], y = [];
         for (const _ of T)
           if (_)
             try {
               await _(f, w);
-            } catch (b) {
-              y.push(b instanceof Error ? b : new Error(String(b)));
+            } catch (P) {
+              y.push(P instanceof Error ? P : new Error(String(P)));
             }
         if (y.length === 1) throw y[0];
         if (y.length > 1)
@@ -425,7 +425,7 @@ function ve(e) {
     }
   };
 }
-var P = class extends Error {
+var b = class extends Error {
   /**
    * Creates an instance of `HTTPException`.
    * @param status - HTTP status code for the exception. Defaults to 500.
@@ -454,7 +454,7 @@ var P = class extends Error {
 function N(e, t) {
   const n = new de();
   return n.openapi(
-    k({
+    M({
       tags: ["tenants"],
       method: "get",
       path: "/",
@@ -463,18 +463,18 @@ function N(e, t) {
       },
       security: [
         {
-          Bearer: ["read:tenants", "auth:read"]
+          Bearer: []
         }
       ],
       responses: {
         200: {
           content: {
             "application/json": {
-              schema: A.object({
-                tenants: A.array(O),
-                start: A.number().optional(),
-                limit: A.number().optional(),
-                length: A.number().optional()
+              schema: S.object({
+                tenants: S.array(O),
+                start: S.number().optional(),
+                limit: S.number().optional(),
+                length: S.number().optional()
               })
             }
           },
@@ -483,14 +483,14 @@ function N(e, t) {
       }
     }),
     async (r) => {
-      var w, T, y, _, b, I;
-      const a = r.req.valid("query"), { page: s, per_page: i, include_totals: c, q: u } = a, o = r.var.user, l = (o == null ? void 0 : o.permissions) || [];
-      if (!!!((o == null ? void 0 : o.org_id) ?? r.var.organization_id) && (l.includes("auth:read") || l.includes("admin:organizations"))) {
+      var w, T, y, _, P, I;
+      const s = r.req.valid("query"), { page: o, per_page: i, include_totals: c, q: l } = s, a = r.var.user, u = (a == null ? void 0 : a.permissions) || [];
+      if (!!!((a == null ? void 0 : a.org_id) ?? r.var.organization_id) && u.includes("admin:organizations")) {
         const h = await r.env.data.tenants.list({
-          page: s,
+          page: o,
           per_page: i,
           include_totals: c,
-          q: u
+          q: l
         });
         return c ? r.json({
           tenants: h.tenants,
@@ -500,15 +500,19 @@ function N(e, t) {
         }) : r.json({ tenants: h.tenants });
       }
       const m = ((y = e.accessControl) == null ? void 0 : y.controlPlaneTenantId) ?? ((_ = r.env.data.multiTenancyConfig) == null ? void 0 : _.controlPlaneTenantId);
-      if (m && (o != null && o.sub)) {
+      if (m && !(a != null && a.sub))
+        throw new b(403, {
+          message: "Access denied: token has no subject"
+        });
+      if (m && (a != null && a.sub)) {
         const C = (await D(
-          (M) => r.env.data.userOrganizations.listUserOrganizations(
+          (k) => r.env.data.userOrganizations.listUserOrganizations(
             m,
-            o.sub,
-            M
+            a.sub,
+            k
           ),
           "organizations"
-        )).map((M) => M.name);
+        )).map((k) => k.name);
         if (C.length === 0)
           return c ? r.json({
             tenants: [],
@@ -516,15 +520,15 @@ function N(e, t) {
             limit: i ?? 50,
             length: 0
           }) : r.json({ tenants: [] });
-        const p = C.length, F = s ?? 0, $ = i ?? 50, R = F * $, S = C.slice(R, R + $);
-        if (S.length === 0)
+        const p = C.length, F = o ?? 0, $ = i ?? 50, R = F * $, A = C.slice(R, R + $);
+        if (A.length === 0)
           return c ? r.json({
             tenants: [],
             start: R,
             limit: $,
             length: p
           }) : r.json({ tenants: [] });
-        const v = S.map((M) => `id:${M}`).join(" OR "), j = u ? `(${v}) AND (${u})` : v, z = await r.env.data.tenants.list({
+        const v = A.map((k) => `id:${k}`).join(" OR "), j = l ? `(${v}) AND (${l})` : v, z = await r.env.data.tenants.list({
           q: j,
           per_page: $,
           include_totals: !1
@@ -538,20 +542,20 @@ function N(e, t) {
         }) : r.json({ tenants: z.tenants });
       }
       const f = await r.env.data.tenants.list({
-        page: s,
+        page: o,
         per_page: i,
         include_totals: c,
-        q: u
+        q: l
       });
       return c ? r.json({
         tenants: f.tenants,
-        start: ((b = f.totals) == null ? void 0 : b.start) ?? 0,
+        start: ((P = f.totals) == null ? void 0 : P.start) ?? 0,
         limit: ((I = f.totals) == null ? void 0 : I.limit) ?? i,
         length: f.tenants.length
       }) : r.json({ tenants: f.tenants });
     }
   ), n.openapi(
-    k({
+    M({
       tags: ["tenants"],
       method: "post",
       path: "/",
@@ -587,29 +591,29 @@ function N(e, t) {
       }
     }),
     async (r) => {
-      var u, o;
-      const a = r.var.user;
-      if (!(a != null && a.sub))
-        throw new P(401, {
+      var l, a;
+      const s = r.var.user;
+      if (!(s != null && s.sub))
+        throw new b(401, {
           message: "Authentication required to create tenants"
         });
-      let s = r.req.valid("json");
+      let o = r.req.valid("json");
       const i = {
         adapters: r.env.data,
         ctx: r
       };
-      (u = t.tenants) != null && u.beforeCreate && (s = await t.tenants.beforeCreate(i, s));
-      const c = await r.env.data.tenants.create(s);
-      return (o = t.tenants) != null && o.afterCreate && await t.tenants.afterCreate(i, c), r.json(c, 201);
+      (l = t.tenants) != null && l.beforeCreate && (o = await t.tenants.beforeCreate(i, o));
+      const c = await r.env.data.tenants.create(o);
+      return (a = t.tenants) != null && a.afterCreate && await t.tenants.afterCreate(i, c), r.json(c, 201);
     }
   ), n.openapi(
-    k({
+    M({
       tags: ["tenants"],
       method: "delete",
       path: "/{id}",
       request: {
-        params: A.object({
-          id: A.string()
+        params: S.object({
+          id: S.string()
         })
       },
       security: [
@@ -630,48 +634,48 @@ function N(e, t) {
       }
     }),
     async (r) => {
-      var u, o, l, g;
-      const { id: a } = r.req.valid("param"), s = ((u = e.accessControl) == null ? void 0 : u.controlPlaneTenantId) ?? ((o = r.env.data.multiTenancyConfig) == null ? void 0 : o.controlPlaneTenantId);
-      if (s) {
+      var l, a, u, g;
+      const { id: s } = r.req.valid("param"), o = ((l = e.accessControl) == null ? void 0 : l.controlPlaneTenantId) ?? ((a = r.env.data.multiTenancyConfig) == null ? void 0 : a.controlPlaneTenantId);
+      if (o) {
         const d = r.var.user;
         if (!(d != null && d.sub))
-          throw new P(401, {
+          throw new b(401, {
             message: "Authentication required"
           });
-        if (a === s)
-          throw new P(403, {
+        if (s === o)
+          throw new b(403, {
             message: "Cannot delete the control plane"
           });
         if (!(await D(
           (w) => r.env.data.userOrganizations.listUserOrganizations(
-            s,
+            o,
             d.sub,
             w
           ),
           "organizations"
-        )).some((w) => w.name === a))
-          throw new P(403, {
+        )).some((w) => w.name === s))
+          throw new b(403, {
             message: "Access denied to this tenant"
           });
       }
-      if (!await r.env.data.tenants.get(a))
-        throw new P(404, {
+      if (!await r.env.data.tenants.get(s))
+        throw new b(404, {
           message: "Tenant not found"
         });
       const c = {
         adapters: r.env.data,
         ctx: r
       };
-      return (l = t.tenants) != null && l.beforeDelete && await t.tenants.beforeDelete(c, a), await r.env.data.tenants.remove(a), (g = t.tenants) != null && g.afterDelete && await t.tenants.afterDelete(c, a), r.body(null, 204);
+      return (u = t.tenants) != null && u.beforeDelete && await t.tenants.beforeDelete(c, s), await r.env.data.tenants.remove(s), (g = t.tenants) != null && g.afterDelete && await t.tenants.afterDelete(c, s), r.body(null, 204);
     }
   ), n.openapi(
-    k({
+    M({
       tags: ["tenants", "settings"],
       method: "get",
       path: "/settings",
       request: {
-        headers: A.object({
-          "tenant-id": A.string().optional()
+        headers: S.object({
+          "tenant-id": S.string().optional()
         })
       },
       security: [
@@ -691,26 +695,26 @@ function N(e, t) {
       }
     }),
     async (r) => {
-      const a = await r.env.data.tenants.get(r.var.tenant_id);
-      if (!a)
-        throw new P(404, {
+      const s = await r.env.data.tenants.get(r.var.tenant_id);
+      if (!s)
+        throw new b(404, {
           message: "Tenant not found"
         });
-      return r.json(a);
+      return r.json(s);
     }
   ), n.openapi(
-    k({
+    M({
       tags: ["tenants", "settings"],
       method: "patch",
       path: "/settings",
       request: {
-        headers: A.object({
-          "tenant-id": A.string().optional()
+        headers: S.object({
+          "tenant-id": S.string().optional()
         }),
         body: {
           content: {
             "application/json": {
-              schema: A.object(G.shape).partial()
+              schema: S.object(G.shape).partial()
             }
           }
         }
@@ -732,19 +736,19 @@ function N(e, t) {
       }
     }),
     async (r) => {
-      const a = r.req.valid("json"), { id: s, ...i } = a, c = await r.env.data.tenants.get(r.var.tenant_id);
+      const s = r.req.valid("json"), { id: o, ...i } = s, c = await r.env.data.tenants.get(r.var.tenant_id);
       if (!c)
-        throw new P(404, {
+        throw new b(404, {
           message: "Tenant not found"
         });
-      const u = ie(c, i);
-      await r.env.data.tenants.update(r.var.tenant_id, u);
-      const o = await r.env.data.tenants.get(r.var.tenant_id);
-      if (!o)
-        throw new P(500, {
+      const l = ie(c, i);
+      await r.env.data.tenants.update(r.var.tenant_id, l);
+      const a = await r.env.data.tenants.get(r.var.tenant_id);
+      if (!a)
+        throw new b(500, {
           message: "Failed to retrieve updated tenant"
         });
-      return r.json(o);
+      return r.json(a);
     }
   ), n;
 }
@@ -758,9 +762,9 @@ function _e(e) {
     { pattern: /\/api\/v2\/connections\/([^/]+)$/, type: "connection" }
   ];
   for (const { pattern: n, type: r } of t) {
-    const a = e.match(n);
-    if (a && a[1])
-      return { type: r, id: a[1] };
+    const s = e.match(n);
+    if (s && s[1])
+      return { type: r, id: s[1] };
   }
   return null;
 }
@@ -804,7 +808,7 @@ function be() {
     if (!r)
       return t();
     if (await Ce(e.env.data, r, n))
-      throw new P(403, {
+      throw new b(403, {
         message: `This ${Te(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
       });
     return t();
@@ -812,7 +816,7 @@ function be() {
 }
 function B(e, t) {
   const n = t.find(
-    (a) => a.strategy === e.strategy
+    (s) => s.strategy === e.strategy
   );
   if (!(n != null && n.options))
     return e;
@@ -872,51 +876,51 @@ function x(e, t) {
   return {
     ...e.resourceServers,
     get: async (n, r) => {
-      const a = await e.resourceServers.get(
+      const s = await e.resourceServers.get(
         n,
         r
       );
-      if (!a || !t || n === t || !a.is_system)
-        return a;
-      const s = await e.resourceServers.get(
+      if (!s || !t || n === t || !s.is_system)
+        return s;
+      const o = await e.resourceServers.get(
         t,
         r
       );
       return V(
-        a,
-        s
+        s,
+        o
       );
     },
     list: async (n, r) => {
-      const a = await e.resourceServers.list(n, r);
+      const s = await e.resourceServers.list(n, r);
       if (!t || n === t)
-        return a;
-      const s = t, i = a.resource_servers.filter(
-        (o) => !!(o.is_system && o.id)
-      ).map((o) => o.id);
+        return s;
+      const o = t, i = s.resource_servers.filter(
+        (a) => !!(a.is_system && a.id)
+      ).map((a) => a.id);
       if (i.length === 0)
-        return a;
+        return s;
       const c = /* @__PURE__ */ new Map();
       await Promise.all(
-        i.map(async (o) => {
-          const l = await e.resourceServers.get(s, o);
-          l && c.set(o, l);
+        i.map(async (a) => {
+          const u = await e.resourceServers.get(o, a);
+          u && c.set(a, u);
         })
       );
-      const u = a.resource_servers.map(
-        (o) => o.is_system && o.id ? V(
-          o,
-          c.get(o.id) ?? null
-        ) : o
+      const l = s.resource_servers.map(
+        (a) => a.is_system && a.id ? V(
+          a,
+          c.get(a.id) ?? null
+        ) : a
       );
       return {
-        ...a,
-        resource_servers: u
+        ...s,
+        resource_servers: l
       };
     }
   };
 }
-function Se(e, t) {
+function Ae(e, t) {
   return {
     ...e,
     resourceServers: x(
@@ -925,7 +929,7 @@ function Se(e, t) {
     )
   };
 }
-function Ae(e, t) {
+function Se(e, t) {
   const { controlPlaneTenantId: n, controlPlaneClientId: r } = t;
   return {
     ...e,
@@ -936,12 +940,12 @@ function Ae(e, t) {
     },
     connections: {
       ...e.connections,
-      get: async (a, s) => {
+      get: async (s, o) => {
         const i = await e.connections.get(
-          a,
-          s
+          s,
+          o
         );
-        if (!i || !n || a === n)
+        if (!i || !n || s === n)
           return i;
         const c = await e.connections.list(n);
         return B(
@@ -949,35 +953,35 @@ function Ae(e, t) {
           c.connections || []
         );
       },
-      list: async (a, s) => {
-        const i = await e.connections.list(a, s);
-        if (!n || a === n)
+      list: async (s, o) => {
+        const i = await e.connections.list(s, o);
+        if (!n || s === n)
           return i;
-        const c = await e.connections.list(n), u = i.connections.map(
-          (o) => B(
-            o,
+        const c = await e.connections.list(n), l = i.connections.map(
+          (a) => B(
+            a,
             c.connections || []
           )
         );
         return {
           ...i,
-          connections: u
+          connections: l
         };
       }
     },
     clientConnections: {
       ...e.clientConnections,
-      listByClient: async (a, s) => {
+      listByClient: async (s, o) => {
         let i = await e.clientConnections.listByClient(
-          a,
-          s
+          s,
+          o
         );
-        if (i.length === 0 && (i = (await e.connections.list(a)).connections || []), !n || a === n)
+        if (i.length === 0 && (i = (await e.connections.list(s)).connections || []), !n || s === n)
           return i;
         const c = await e.connections.list(n);
         return i.map(
-          (u) => B(
-            u,
+          (l) => B(
+            l,
             c.connections || []
           )
         );
@@ -985,11 +989,11 @@ function Ae(e, t) {
     },
     clients: {
       ...e.clients,
-      get: async (a, s) => {
-        const i = await e.clients.get(a, s);
+      get: async (s, o) => {
+        const i = await e.clients.get(s, o);
         if (!i)
           return null;
-        if (!n || !r || a === n && s === r)
+        if (!n || !r || s === n && o === r)
           return i;
         const c = await e.clients.get(
           n,
@@ -997,27 +1001,27 @@ function Ae(e, t) {
         );
         return J(i, c);
       },
-      getByClientId: async (a) => {
-        const s = await e.clients.getByClientId(a);
-        if (!s)
+      getByClientId: async (s) => {
+        const o = await e.clients.getByClientId(s);
+        if (!o)
           return null;
-        if (!n || !r || s.tenant_id === n && s.client_id === r)
-          return s;
+        if (!n || !r || o.tenant_id === n && o.client_id === r)
+          return o;
         const i = await e.clients.get(
           n,
           r
         );
         return {
-          ...J(s, i),
-          tenant_id: s.tenant_id
+          ...J(o, i),
+          tenant_id: o.tenant_id
         };
       }
     },
     emailProviders: {
       ...e.emailProviders,
-      get: async (a) => {
-        const s = await e.emailProviders.get(a);
-        return s || (!n || a === n ? null : e.emailProviders.get(n));
+      get: async (s) => {
+        const o = await e.emailProviders.get(s);
+        return o || (!n || s === n ? null : e.emailProviders.get(n));
       }
     },
     resourceServers: x(
@@ -1039,9 +1043,9 @@ function Ie(e, t) {
   return {
     ...e.hooks,
     list: async (n, r) => {
-      const a = await e.hooks.list(n, r);
+      const s = await e.hooks.list(n, r);
       if (!t || n === t)
-        return a;
+        return s;
       const i = ((await e.hooks.list(
         t,
         r
@@ -1049,28 +1053,28 @@ function Ie(e, t) {
         X
       );
       if (i.length === 0)
-        return a;
-      const c = new Set((a.hooks || []).map((o) => o.hook_id)), u = i.filter((o) => !c.has(o.hook_id));
+        return s;
+      const c = new Set((s.hooks || []).map((a) => a.hook_id)), l = i.filter((a) => !c.has(a.hook_id));
       return {
-        ...a,
-        hooks: [...a.hooks || [], ...u],
-        length: typeof a.length == "number" ? a.length + u.length : a.length
+        ...s,
+        hooks: [...s.hooks || [], ...l],
+        length: typeof s.length == "number" ? s.length + l.length : s.length
       };
     },
     get: async (n, r) => {
-      const a = await e.hooks.get(n, r);
-      if (a || !t || n === t)
-        return a;
-      const s = await e.hooks.get(
+      const s = await e.hooks.get(n, r);
+      if (s || !t || n === t)
+        return s;
+      const o = await e.hooks.get(
         t,
         r
       );
-      return s && X(s) ? s : null;
+      return o && X(o) ? o : null;
     }
   };
 }
 function ee(e, t) {
-  return Ae(e, t);
+  return Se(e, t);
 }
 function Re(e) {
   return async (t, n) => {
@@ -1082,20 +1086,20 @@ function ze(e) {
   return async (t, n) => {
     if (!e.accessControl)
       return n();
-    const { controlPlaneTenantId: r } = e.accessControl, a = t.var.org_name, s = t.var.organization_id, i = a || s;
+    const { controlPlaneTenantId: r } = e.accessControl, s = t.var.org_name, o = t.var.organization_id, i = s || o;
     let c = t.var.tenant_id;
-    const u = t.var.user, l = (u != null && u.aud ? Array.isArray(u.aud) ? u.aud : [u.aud] : []).includes(Y);
-    if (!c && i && l && (t.set("tenant_id", i), c = i), !c)
-      throw new P(400, {
+    const l = t.var.user, u = (l != null && l.aud ? Array.isArray(l.aud) ? l.aud : [l.aud] : []).includes(Y);
+    if (!c && i && u && (t.set("tenant_id", i), c = i), !c)
+      throw new b(400, {
         message: "Tenant ID not found in request"
       });
     if (!me(
-      s,
+      o,
       c,
       r,
-      a
+      s
     ))
-      throw new P(403, {
+      throw new b(403, {
         message: `Access denied to tenant ${c}`
       });
     return n();
@@ -1107,33 +1111,33 @@ function $e(e) {
       return n();
     const {
       baseDomain: r,
-      reservedSubdomains: a = [],
-      resolveSubdomain: s
+      reservedSubdomains: s = [],
+      resolveSubdomain: o
     } = e.subdomainRouting, i = t.req.header("x-forwarded-host") || t.req.header("host") || "";
     let c = null;
     if (i.endsWith(r)) {
-      const o = i.slice(0, -(r.length + 1));
-      o && !o.includes(".") && (c = o);
+      const a = i.slice(0, -(r.length + 1));
+      a && !a.includes(".") && (c = a);
     }
-    if (c && a.includes(c) && (c = null), !c)
+    if (c && s.includes(c) && (c = null), !c)
       return e.accessControl && t.set("tenant_id", e.accessControl.controlPlaneTenantId), n();
-    let u = null;
-    if (s)
-      u = await s(c);
+    let l = null;
+    if (o)
+      l = await o(c);
     else if (e.subdomainRouting.useOrganizations !== !1 && e.accessControl)
       try {
-        const o = await t.env.data.organizations.get(
+        const a = await t.env.data.organizations.get(
           e.accessControl.controlPlaneTenantId,
           c
         );
-        o && (u = o.id);
+        a && (l = a.id);
       } catch {
       }
-    if (!u)
-      throw new P(404, {
+    if (!l)
+      throw new b(404, {
         message: `Tenant not found for subdomain: ${c}`
       });
-    return t.set("tenant_id", u), n();
+    return t.set("tenant_id", l), n();
   };
 }
 function je(e) {
@@ -1142,17 +1146,17 @@ function je(e) {
       return n();
     const r = t.var.tenant_id;
     if (!r)
-      throw new P(400, {
+      throw new b(400, {
         message: "Tenant ID not found in request"
       });
     try {
-      const a = await e.databaseIsolation.getAdapters(r);
-      t.env.data = a;
-    } catch (a) {
+      const s = await e.databaseIsolation.getAdapters(r);
+      t.env.data = s;
+    } catch (s) {
       throw console.error(
         `Failed to resolve database for tenant ${r}:`,
-        a
-      ), new P(500, {
+        s
+      ), new b(500, {
         message: "Failed to resolve tenant database"
       });
     }
@@ -1161,10 +1165,10 @@ function je(e) {
 }
 function te(e) {
   const t = $e(e), n = ze(e), r = je(e);
-  return async (a, s) => (await t(a, async () => {
-  }), await n(a, async () => {
-  }), await r(a, async () => {
-  }), s());
+  return async (s, o) => (await t(s, async () => {
+  }), await n(s, async () => {
+  }), await r(s, async () => {
+  }), o());
 }
 function qe(e) {
   const {
@@ -1172,36 +1176,36 @@ function qe(e) {
     controlPlane: n,
     controlPlane: {
       tenantId: r = "control_plane",
-      clientId: a
+      clientId: s
     } = {},
-    sync: s = { resourceServers: !0, roles: !0 },
+    sync: o = { resourceServers: !0, roles: !0 },
     defaultPermissions: i = ["tenant:admin"],
     requireOrganizationMatch: c = !1,
-    managementApiExtensions: u = [],
-    entityHooks: o,
-    getChildTenantIds: l,
+    managementApiExtensions: l = [],
+    entityHooks: a,
+    getChildTenantIds: u,
     getAdapters: g,
     ...d
   } = e;
   let m = t, f = t;
   n && (m = ee(t, {
     controlPlaneTenantId: r,
-    controlPlaneClientId: a
+    controlPlaneClientId: s
   }), f = {
-    ...Se(t, {
+    ...Ae(t, {
       controlPlaneTenantId: r
     }),
     multiTenancyConfig: {
       controlPlaneTenantId: r,
-      controlPlaneClientId: a
+      controlPlaneClientId: s
     }
   });
-  const w = s !== !1, T = w ? {
-    resourceServers: s.resourceServers ?? !0,
-    roles: s.roles ?? !0
-  } : { resourceServers: !1, roles: !1 }, b = {
+  const w = o !== !1, T = w ? {
+    resourceServers: o.resourceServers ?? !0,
+    roles: o.roles ?? !0
+  } : { resourceServers: !1, roles: !1 }, P = {
     controlPlaneTenantId: r,
-    getChildTenantIds: l ?? (async () => (await D(
+    getChildTenantIds: u ?? (async () => (await D(
       (v) => m.tenants.list(v),
       "tenants",
       { cursorField: "id", pageSize: 100 }
@@ -1209,15 +1213,15 @@ function qe(e) {
     getAdapters: g ?? (async () => m),
     getControlPlaneAdapters: async () => m,
     sync: T
-  }, { entityHooks: I, tenantHooks: h } = ve(b), C = {
+  }, { entityHooks: I, tenantHooks: h } = ve(P), C = {
     resourceServers: [
       I.resourceServers,
-      ...(o == null ? void 0 : o.resourceServers) ?? []
+      ...(a == null ? void 0 : a.resourceServers) ?? []
     ],
-    roles: [I.roles, ...(o == null ? void 0 : o.roles) ?? []],
-    connections: (o == null ? void 0 : o.connections) ?? [],
-    tenants: (o == null ? void 0 : o.tenants) ?? [],
-    rolePermissions: (o == null ? void 0 : o.rolePermissions) ?? []
+    roles: [I.roles, ...(a == null ? void 0 : a.roles) ?? []],
+    connections: (a == null ? void 0 : a.connections) ?? [],
+    tenants: (a == null ? void 0 : a.tenants) ?? [],
+    rolePermissions: (a == null ? void 0 : a.rolePermissions) ?? []
   }, p = Z({
     accessControl: {
       controlPlaneTenantId: r,
@@ -1233,16 +1237,16 @@ function qe(e) {
       }
     },
     { tenants: {
-      async beforeCreate(S, v) {
-        return p.beforeCreate && (v = await p.beforeCreate(S, v)), h.beforeCreate && (v = await h.beforeCreate(S, v)), v;
+      async beforeCreate(A, v) {
+        return p.beforeCreate && (v = await p.beforeCreate(A, v)), h.beforeCreate && (v = await h.beforeCreate(A, v)), v;
       },
-      async afterCreate(S, v) {
+      async afterCreate(A, v) {
         var j, z;
-        await ((j = p.afterCreate) == null ? void 0 : j.call(p, S, v)), await ((z = h.afterCreate) == null ? void 0 : z.call(h, S, v));
+        await ((j = p.afterCreate) == null ? void 0 : j.call(p, A, v)), await ((z = h.afterCreate) == null ? void 0 : z.call(h, A, v));
       },
-      async beforeDelete(S, v) {
+      async beforeDelete(A, v) {
         var j, z;
-        await ((j = p.beforeDelete) == null ? void 0 : j.call(p, S, v)), await ((z = h.beforeDelete) == null ? void 0 : z.call(h, S, v));
+        await ((j = p.beforeDelete) == null ? void 0 : j.call(p, A, v)), await ((z = h.beforeDelete) == null ? void 0 : z.call(h, A, v));
       }
     } }
   ), { app: R } = ue({
@@ -1251,7 +1255,7 @@ function qe(e) {
     ...d,
     entityHooks: C,
     managementApiExtensions: [
-      ...u,
+      ...l,
       { path: "/tenants", router: $ }
     ]
   });
@@ -1294,7 +1298,7 @@ function U(e) {
   };
 }
 function Fe(e) {
-  const t = new ae(), n = U(e);
+  const t = new se(), n = U(e);
   return t.route("/tenants", N(e, n)), t;
 }
 function Be(e) {
@@ -1332,7 +1336,7 @@ export {
   Ee as createMultiTenancyPlugin,
   be as createProtectSyncedMiddleware,
   Z as createProvisioningHooks,
-  Ae as createRuntimeFallbackAdapter,
+  Se as createRuntimeFallbackAdapter,
   $e as createSubdomainMiddleware,
   ve as createSyncHooks,
   N as createTenantsOpenAPIRouter,
@@ -1340,5 +1344,5 @@ export {
   Be as setupMultiTenancy,
   me as validateTenantAccess,
   ee as withRuntimeFallback,
-  Se as withSystemResourceServerInheritance
+  Ae as withSystemResourceServerInheritance
 };