@authhero/multi-tenancy 14.20.2 → 14.21.0

package/dist/multi-tenancy.mjs

@@ -1,27 +1,27 @@
 var ne = Object.defineProperty;
-var re = (e, t, n) => t in e ? ne(e, t, { enumerable: !0, configurable: !0, writable: !0, value: n }) : e[t] = n;
-var E = (e, t, n) => re(e, typeof t != "symbol" ? t + "" : t, n);
+var re = (e, t, r) => t in e ? ne(e, t, { enumerable: !0, configurable: !0, writable: !0, value: r }) : e[t] = r;
+var E = (e, t, r) => re(e, typeof t != "symbol" ? t + "" : t, r);
 import { Hono as ae } from "hono";
-import { MANAGEMENT_API_SCOPES as se, MANAGEMENT_API_AUDIENCE as Y, fetchAll as D, auth0QuerySchema as oe, tenantSchema as O, tenantInsertSchema as G, deepMergePatch as ie, connectionSchema as ce, connectionOptionsSchema as le, init as ue } from "authhero";
-import { OpenAPIHono as de, createRoute as k, z as A } from "@hono/zod-openapi";
+import { MANAGEMENT_API_SCOPES as se, MANAGEMENT_API_AUDIENCE as X, fetchAll as q, auth0QuerySchema as oe, tenantSchema as D, tenantInsertSchema as G, deepMergePatch as ie, connectionSchema as ce, connectionOptionsSchema as le, init as ue } from "authhero";
+import { OpenAPIHono as de, createRoute as M, z as S } from "@hono/zod-openapi";
 function fe(e) {
-  const { controlPlaneTenantId: t, requireOrganizationMatch: n = !0 } = e;
+  const { controlPlaneTenantId: t, requireOrganizationMatch: r = !0 } = e;
   return {
-    async onTenantAccessValidation(r, a) {
+    async onTenantAccessValidation(n, a) {
       if (a === t)
         return !0;
-      if (n) {
-        const s = r.var.org_name, i = r.var.organization_id, c = s || i;
-        return c ? c.toLowerCase() === a.toLowerCase() : !1;
+      if (r) {
+        const o = n.var.org_name, c = n.var.organization_id, i = o || c;
+        return i ? i.toLowerCase() === a.toLowerCase() : !1;
       }
       return !0;
     }
   };
 }
-function me(e, t, n, r) {
-  if (t === n)
+function me(e, t, r, n) {
+  if (t === r)
     return !0;
-  const a = r || e;
+  const a = n || e;
   return a ? a.toLowerCase() === t.toLowerCase() : !1;
 }
 function ge(e) {
@@ -29,10 +29,10 @@ function ge(e) {
     async resolveDataAdapters(t) {
       try {
         return await e.getAdapters(t);
-      } catch (n) {
+      } catch (r) {
         console.error(
           `Failed to resolve data adapters for tenant ${t}:`,
-          n
+          r
         );
         return;
       }
@@ -42,246 +42,246 @@ function ge(e) {
 function we(e) {
   return `urn:authhero:tenant:${e.toLowerCase()}`;
 }
-function Z(e) {
+function Y(e) {
   return {
-    async beforeCreate(t, n) {
-      return !n.audience && n.id ? {
-        ...n,
-        audience: we(n.id)
-      } : n;
+    async beforeCreate(t, r) {
+      return !r.audience && r.id ? {
+        ...r,
+        audience: we(r.id)
+      } : r;
     },
-    async afterCreate(t, n) {
-      const { accessControl: r, databaseIsolation: a } = e;
-      r && t.ctx && await he(t, n, r), a != null && a.onProvision && await a.onProvision(n.id);
+    async afterCreate(t, r) {
+      const { accessControl: n, databaseIsolation: a } = e;
+      n && t.ctx && await pe(t, r, n), a != null && a.onProvision && await a.onProvision(r.id);
     },
-    async beforeDelete(t, n) {
-      const { accessControl: r, databaseIsolation: a } = e;
-      if (r)
+    async beforeDelete(t, r) {
+      const { accessControl: n, databaseIsolation: a } = e;
+      if (n)
         try {
-          const i = (await t.adapters.organizations.list(
-            r.controlPlaneTenantId
-          )).organizations.find((c) => c.name === n);
-          i && await t.adapters.organizations.remove(
-            r.controlPlaneTenantId,
-            i.id
+          const c = (await t.adapters.organizations.list(
+            n.controlPlaneTenantId
+          )).organizations.find((i) => i.name === r);
+          c && await t.adapters.organizations.remove(
+            n.controlPlaneTenantId,
+            c.id
           );
-        } catch (s) {
+        } catch (o) {
           console.warn(
-            `Failed to remove organization for tenant ${n}:`,
-            s
+            `Failed to remove organization for tenant ${r}:`,
+            o
           );
         }
       if (a != null && a.onDeprovision)
         try {
-          await a.onDeprovision(n);
-        } catch (s) {
+          await a.onDeprovision(r);
+        } catch (o) {
           console.warn(
-            `Failed to deprovision database for tenant ${n}:`,
-            s
+            `Failed to deprovision database for tenant ${r}:`,
+            o
           );
         }
     }
   };
 }
-async function he(e, t, n) {
+async function pe(e, t, r) {
   const {
-    controlPlaneTenantId: r,
+    controlPlaneTenantId: n,
     defaultPermissions: a,
-    defaultRoles: s,
-    issuer: i,
-    adminRoleName: c = "Tenant Admin",
-    adminRoleDescription: u = "Full access to all tenant management operations",
-    addCreatorToOrganization: o = !0
-  } = n, l = await e.adapters.organizations.create(
-    r,
+    defaultRoles: o,
+    issuer: c,
+    adminRoleName: i = "Tenant Admin",
+    adminRoleDescription: l = "Full access to all tenant management operations",
+    addCreatorToOrganization: u = !0
+  } = r, s = await e.adapters.organizations.create(
+    n,
     {
       name: t.id,
       display_name: t.friendly_name || t.id
     }
   );
-  let g;
-  if (i && (g = await ye(
+  let d;
+  if (c && (d = await ye(
     e,
-    r,
-    c,
-    u
-  )), o && e.ctx) {
-    const d = e.ctx.var.user;
-    if (d != null && d.sub && !await pe(
+    n,
+    i,
+    l
+  )), u && e.ctx) {
+    const m = e.ctx.var.user;
+    if (m != null && m.sub && !await he(
       e,
-      r,
-      d.sub
+      n,
+      m.sub
     ))
       try {
-        await e.adapters.userOrganizations.create(r, {
-          user_id: d.sub,
-          organization_id: l.id
-        }), g && await e.adapters.userRoles.create(
-          r,
-          d.sub,
-          g,
-          l.id
+        await e.adapters.userOrganizations.create(n, {
+          user_id: m.sub,
+          organization_id: s.id
+        }), d && await e.adapters.userRoles.create(
+          n,
+          m.sub,
+          d,
+          s.id
           // organizationId
         );
       } catch (f) {
         console.warn(
-          `Failed to add creator ${d.sub} to organization ${l.id}:`,
+          `Failed to add creator ${m.sub} to organization ${s.id}:`,
           f
         );
       }
   }
-  s && s.length > 0 && console.log(
-    `Would assign roles ${s.join(", ")} to organization ${l.id}`
+  o && o.length > 0 && console.log(
+    `Would assign roles ${o.join(", ")} to organization ${s.id}`
   ), a && a.length > 0 && console.log(
-    `Would grant permissions ${a.join(", ")} to organization ${l.id}`
+    `Would grant permissions ${a.join(", ")} to organization ${s.id}`
   );
 }
-async function pe(e, t, n) {
-  const r = await e.adapters.userRoles.list(
+async function he(e, t, r) {
+  const n = await e.adapters.userRoles.list(
     t,
-    n,
+    r,
     void 0,
     ""
     // Empty string for global roles
   );
-  for (const a of r)
+  for (const a of n)
     if ((await e.adapters.rolePermissions.list(
       t,
       a.id,
       { per_page: 1e3 }
     )).some(
-      (c) => c.permission_name === "admin:organizations"
+      (i) => i.permission_name === "admin:organizations"
     ))
       return !0;
   return !1;
 }
-async function ye(e, t, n, r) {
-  const s = (await e.adapters.roles.list(t, {})).roles.find((o) => o.name === n);
-  if (s)
-    return s.id;
-  const i = await e.adapters.roles.create(t, {
-    name: n,
-    description: r
-  }), c = Y, u = se.map((o) => ({
-    role_id: i.id,
-    resource_server_identifier: c,
-    permission_name: o.value
+async function ye(e, t, r, n) {
+  const o = (await e.adapters.roles.list(t, {})).roles.find((u) => u.name === r);
+  if (o)
+    return o.id;
+  const c = await e.adapters.roles.create(t, {
+    name: r,
+    description: n
+  }), i = X, l = se.map((u) => ({
+    role_id: c.id,
+    resource_server_identifier: i,
+    permission_name: u.value
   }));
   return await e.adapters.rolePermissions.assign(
     t,
-    i.id,
-    u
-  ), i.id;
+    c.id,
+    l
+  ), c.id;
 }
-function H(e, t, n = () => !0) {
-  const { controlPlaneTenantId: r, getChildTenantIds: a, getAdapters: s } = e, i = /* @__PURE__ */ new Map();
-  async function c(l, g, d) {
-    return (await t(l).list(g, {
-      q: `name:${d}`,
+function H(e, t, r = () => !0) {
+  const { controlPlaneTenantId: n, getChildTenantIds: a, getAdapters: o } = e, c = /* @__PURE__ */ new Map();
+  async function i(s, d, m) {
+    return (await t(s).list(d, {
+      q: `name:${m}`,
       per_page: 1
     }))[0] ?? null;
   }
-  async function u(l) {
-    const g = await a(), d = t(await s(r));
+  async function l(s) {
+    const d = await a(), m = t(await o(n));
     await Promise.all(
-      g.map(async (m) => {
+      d.map(async (w) => {
         try {
-          const f = await s(m), w = t(f), y = {
-            ...d.transform(l),
+          const f = await o(w), g = t(f), h = {
+            ...m.transform(s),
             is_system: !0
-          }, _ = await c(f, m, l.name), b = _ ? w.getId(_) : void 0;
-          if (_ && b) {
-            const I = w.preserveOnUpdate ? w.preserveOnUpdate(_, y) : y;
-            await w.update(m, b, I);
+          }, T = await i(f, w, s.name), b = T ? g.getId(T) : void 0;
+          if (T && b) {
+            const z = g.preserveOnUpdate ? g.preserveOnUpdate(T, h) : h;
+            await g.update(w, b, z);
           } else
-            await w.create(m, y);
+            await g.create(w, h);
         } catch (f) {
           console.error(
-            `Failed to sync ${d.listKey} "${l.name}" to tenant "${m}":`,
+            `Failed to sync ${m.listKey} "${s.name}" to tenant "${w}":`,
             f
           );
         }
       })
     );
   }
-  async function o(l) {
-    const g = await a();
+  async function u(s) {
+    const d = await a();
     await Promise.all(
-      g.map(async (d) => {
+      d.map(async (m) => {
         try {
-          const m = await s(d), f = t(m), w = await c(m, d, l), T = w ? f.getId(w) : void 0;
-          w && T && await f.remove(d, T);
-        } catch (m) {
+          const w = await o(m), f = t(w), g = await i(w, m, s), _ = g ? f.getId(g) : void 0;
+          g && _ && await f.remove(m, _);
+        } catch (w) {
           console.error(
-            `Failed to delete entity "${l}" from tenant "${d}":`,
-            m
+            `Failed to delete entity "${s}" from tenant "${m}":`,
+            w
           );
         }
       })
     );
   }
   return {
-    afterCreate: async (l, g) => {
-      l.tenantId === r && n(g) && await u(g);
+    afterCreate: async (s, d) => {
+      s.tenantId === n && r(d) && await l(d);
     },
-    afterUpdate: async (l, g, d) => {
-      l.tenantId === r && n(d) && await u(d);
+    afterUpdate: async (s, d, m) => {
+      s.tenantId === n && r(m) && await l(m);
     },
-    beforeDelete: async (l, g) => {
-      if (l.tenantId !== r) return;
-      const m = await t(l.adapters).get(l.tenantId, g);
-      m && n(m) && i.set(g, m);
+    beforeDelete: async (s, d) => {
+      if (s.tenantId !== n) return;
+      const w = await t(s.adapters).get(s.tenantId, d);
+      w && r(w) && c.set(d, w);
     },
-    afterDelete: async (l, g) => {
-      if (l.tenantId !== r) return;
-      const d = i.get(g);
-      d && (i.delete(g), await o(d.name));
+    afterDelete: async (s, d) => {
+      if (s.tenantId !== n) return;
+      const m = c.get(d);
+      m && (c.delete(d), await u(m.name));
     }
   };
 }
-function W(e, t, n = () => !0) {
-  const { controlPlaneTenantId: r, getControlPlaneAdapters: a, getAdapters: s } = e;
+function W(e, t, r = () => !0) {
+  const { controlPlaneTenantId: n, getControlPlaneAdapters: a, getAdapters: o } = e;
   return {
-    async afterCreate(i, c) {
-      if (c.id !== r)
+    async afterCreate(c, i) {
+      if (i.id !== n)
         try {
-          const u = await a(), o = await s(c.id), l = t(u), g = t(o), d = await D(
-            (m) => l.listPaginated(r, m),
-            l.listKey,
+          const l = await a(), u = await o(i.id), s = t(l), d = t(u), m = await q(
+            (w) => s.listPaginated(n, w),
+            s.listKey,
             { cursorField: "id", pageSize: 100 }
           );
           await Promise.all(
-            d.filter((m) => n(m)).map(async (m) => {
+            m.filter((w) => r(w)).map(async (w) => {
               try {
-                const f = l.transform(m);
-                await g.create(c.id, {
+                const f = s.transform(w);
+                await d.create(i.id, {
                   ...f,
                   is_system: !0
                 });
               } catch (f) {
                 console.error(
-                  `Failed to sync entity to new tenant "${c.id}":`,
+                  `Failed to sync entity to new tenant "${i.id}":`,
                   f
                 );
               }
             })
           );
-        } catch (u) {
+        } catch (l) {
           console.error(
-            `Failed to sync entities to new tenant "${c.id}":`,
-            u
+            `Failed to sync entities to new tenant "${i.id}":`,
+            l
           );
         }
     }
   };
 }
 const L = (e) => ({
-  list: async (t, n) => (await e.resourceServers.list(t, n)).resource_servers,
-  listPaginated: (t, n) => e.resourceServers.list(t, n),
-  get: (t, n) => e.resourceServers.get(t, n),
-  create: (t, n) => e.resourceServers.create(t, n),
-  update: (t, n, r) => e.resourceServers.update(t, n, r),
-  remove: (t, n) => e.resourceServers.remove(t, n),
+  list: async (t, r) => (await e.resourceServers.list(t, r)).resource_servers,
+  listPaginated: (t, r) => e.resourceServers.list(t, r),
+  get: (t, r) => e.resourceServers.get(t, r),
+  create: (t, r) => e.resourceServers.create(t, r),
+  update: (t, r, n) => e.resourceServers.update(t, r, n),
+  remove: (t, r) => e.resourceServers.remove(t, r),
   listKey: "resource_servers",
   getId: (t) => t.id,
   transform: (t) => ({
@@ -294,12 +294,12 @@ const L = (e) => ({
     token_lifetime_for_web: t.token_lifetime_for_web
   })
 }), K = (e) => ({
-  list: async (t, n) => (await e.roles.list(t, n)).roles,
-  listPaginated: (t, n) => e.roles.list(t, n),
-  get: (t, n) => e.roles.get(t, n),
-  create: (t, n) => e.roles.create(t, n),
-  update: (t, n, r) => e.roles.update(t, n, r),
-  remove: (t, n) => e.roles.remove(t, n),
+  list: async (t, r) => (await e.roles.list(t, r)).roles,
+  listPaginated: (t, r) => e.roles.list(t, r),
+  get: (t, r) => e.roles.get(t, r),
+  create: (t, r) => e.roles.create(t, r),
+  update: (t, r, n) => e.roles.update(t, r, n),
+  remove: (t, r) => e.roles.remove(t, r),
   listKey: "roles",
   getId: (t) => t.id,
   transform: (t) => ({
@@ -313,113 +313,113 @@ function Q(e) {
   return ((t = e.metadata) == null ? void 0 : t.sync) !== !1;
 }
 function ve(e) {
-  const { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, a = t.roles ?? !0, s = (f) => Q(f) ? n.resourceServers ? n.resourceServers(f) : !0 : !1, i = (f) => Q(f) ? n.roles ? n.roles(f) : !0 : !1, c = r ? H(
+  const { sync: t = {}, filters: r = {} } = e, n = t.resourceServers ?? !0, a = t.roles ?? !0, o = (f) => Q(f) ? r.resourceServers ? r.resourceServers(f) : !0 : !1, c = (f) => Q(f) ? r.roles ? r.roles(f) : !0 : !1, i = n ? H(
     e,
     L,
-    s
-  ) : void 0, u = a ? H(e, K, i) : void 0, o = r ? W(
+    o
+  ) : void 0, l = a ? H(e, K, c) : void 0, u = n ? W(
     e,
     L,
-    s
-  ) : void 0, l = a ? W(
+    o
+  ) : void 0, s = a ? W(
     e,
     K,
-    i
-  ) : void 0, g = a ? {
-    async afterCreate(f, w) {
-      var T;
-      if (w.id !== e.controlPlaneTenantId) {
-        await ((T = l == null ? void 0 : l.afterCreate) == null ? void 0 : T.call(l, f, w));
+    c
+  ) : void 0, d = a ? {
+    async afterCreate(f, g) {
+      var _;
+      if (g.id !== e.controlPlaneTenantId) {
+        await ((_ = s == null ? void 0 : s.afterCreate) == null ? void 0 : _.call(s, f, g));
         try {
-          const y = await e.getControlPlaneAdapters(), _ = await e.getAdapters(w.id), b = await D(
-            (h) => y.roles.list(
+          const h = await e.getControlPlaneAdapters(), T = await e.getAdapters(g.id), b = await q(
+            (v) => h.roles.list(
               e.controlPlaneTenantId,
-              h
+              v
             ),
             "roles",
             { cursorField: "id", pageSize: 100 }
-          ), I = /* @__PURE__ */ new Map();
-          for (const h of b.filter(
-            (C) => {
-              var p;
-              return ((p = n.roles) == null ? void 0 : p.call(n, C)) ?? !0;
+          ), z = /* @__PURE__ */ new Map();
+          for (const v of b.filter(
+            (p) => {
+              var C;
+              return ((C = r.roles) == null ? void 0 : C.call(r, p)) ?? !0;
             }
           )) {
-            const C = await d(
-              _,
-              w.id,
-              h.name
+            const p = await m(
+              T,
+              g.id,
+              v.name
             );
-            C && I.set(h.name, C.id);
+            p && z.set(v.name, p.id);
           }
-          for (const h of b.filter(
-            (C) => {
-              var p;
-              return ((p = n.roles) == null ? void 0 : p.call(n, C)) ?? !0;
+          for (const v of b.filter(
+            (p) => {
+              var C;
+              return ((C = r.roles) == null ? void 0 : C.call(r, p)) ?? !0;
             }
           )) {
-            const C = I.get(h.name);
-            if (C)
+            const p = z.get(v.name);
+            if (p)
               try {
-                const p = await y.rolePermissions.list(
+                const C = await h.rolePermissions.list(
                   e.controlPlaneTenantId,
-                  h.id,
+                  v.id,
                   {}
                 );
-                p.length > 0 && await _.rolePermissions.assign(
-                  w.id,
-                  C,
-                  p.map((F) => ({
-                    role_id: C,
-                    resource_server_identifier: F.resource_server_identifier,
-                    permission_name: F.permission_name
+                C.length > 0 && await T.rolePermissions.assign(
+                  g.id,
+                  p,
+                  C.map((I) => ({
+                    role_id: p,
+                    resource_server_identifier: I.resource_server_identifier,
+                    permission_name: I.permission_name
                   }))
                 );
-              } catch (p) {
+              } catch (C) {
                 console.error(
-                  `Failed to sync permissions for role "${h.name}" to tenant "${w.id}":`,
-                  p
+                  `Failed to sync permissions for role "${v.name}" to tenant "${g.id}":`,
+                  C
                 );
               }
           }
-        } catch (y) {
+        } catch (h) {
           console.error(
-            `Failed to sync role permissions to tenant "${w.id}":`,
-            y
+            `Failed to sync role permissions to tenant "${g.id}":`,
+            h
           );
         }
       }
     }
   } : void 0;
-  async function d(f, w, T) {
-    return (await f.roles.list(w, {
-      q: `name:${T}`,
+  async function m(f, g, _) {
+    return (await f.roles.list(g, {
+      q: `name:${_}`,
       per_page: 1
     })).roles[0] ?? null;
   }
   return {
     entityHooks: {
-      resourceServers: c,
-      roles: u
+      resourceServers: i,
+      roles: l
     },
     tenantHooks: {
-      async afterCreate(f, w) {
-        const T = [
-          o == null ? void 0 : o.afterCreate,
-          (g == null ? void 0 : g.afterCreate) ?? (l == null ? void 0 : l.afterCreate)
-        ], y = [];
-        for (const _ of T)
-          if (_)
+      async afterCreate(f, g) {
+        const _ = [
+          u == null ? void 0 : u.afterCreate,
+          (d == null ? void 0 : d.afterCreate) ?? (s == null ? void 0 : s.afterCreate)
+        ], h = [];
+        for (const T of _)
+          if (T)
             try {
-              await _(f, w);
+              await T(f, g);
             } catch (b) {
-              y.push(b instanceof Error ? b : new Error(String(b)));
+              h.push(b instanceof Error ? b : new Error(String(b)));
             }
-        if (y.length === 1) throw y[0];
-        if (y.length > 1)
+        if (h.length === 1) throw h[0];
+        if (h.length > 1)
           throw new AggregateError(
-            y,
-            y.map((_) => _.message).join("; ")
+            h,
+            h.map((T) => T.message).join("; ")
           );
       }
     }
@@ -431,11 +431,11 @@ var P = class extends Error {
    * @param status - HTTP status code for the exception. Defaults to 500.
    * @param options - Additional options for the exception.
    */
-  constructor(t = 500, n) {
-    super(n == null ? void 0 : n.message, { cause: n == null ? void 0 : n.cause });
+  constructor(t = 500, r) {
+    super(r == null ? void 0 : r.message, { cause: r == null ? void 0 : r.cause });
     E(this, "res");
     E(this, "status");
-    this.res = n == null ? void 0 : n.res, this.status = t;
+    this.res = r == null ? void 0 : r.res, this.status = t;
   }
   /**
    * Returns the response object associated with the exception.
@@ -451,10 +451,10 @@ var P = class extends Error {
     });
   }
 };
-function N(e, t) {
-  const n = new de();
-  return n.openapi(
-    k({
+function B(e, t) {
+  const r = new de();
+  return r.openapi(
+    M({
       tags: ["tenants"],
       method: "get",
       path: "/",
@@ -463,18 +463,18 @@ function N(e, t) {
       },
       security: [
         {
-          Bearer: ["read:tenants", "auth:read"]
+          Bearer: []
         }
       ],
       responses: {
         200: {
           content: {
             "application/json": {
-              schema: A.object({
-                tenants: A.array(O),
-                start: A.number().optional(),
-                limit: A.number().optional(),
-                length: A.number().optional()
+              schema: S.object({
+                tenants: S.array(D),
+                start: S.number().optional(),
+                limit: S.number().optional(),
+                length: S.number().optional()
               })
             }
           },
@@ -482,76 +482,80 @@ function N(e, t) {
         }
       }
     }),
-    async (r) => {
-      var w, T, y, _, b, I;
-      const a = r.req.valid("query"), { page: s, per_page: i, include_totals: c, q: u } = a, o = r.var.user, l = (o == null ? void 0 : o.permissions) || [];
-      if (!!!((o == null ? void 0 : o.org_id) ?? r.var.organization_id) && (l.includes("auth:read") || l.includes("admin:organizations"))) {
-        const h = await r.env.data.tenants.list({
-          page: s,
-          per_page: i,
-          include_totals: c,
-          q: u
+    async (n) => {
+      var g, _, h, T, b, z;
+      const a = n.req.valid("query"), { page: o, per_page: c, include_totals: i, q: l } = a, u = n.var.user, s = (u == null ? void 0 : u.permissions) || [];
+      if (!!!((u == null ? void 0 : u.org_id) ?? n.var.organization_id) && s.includes("admin:organizations")) {
+        const v = await n.env.data.tenants.list({
+          page: o,
+          per_page: c,
+          include_totals: i,
+          q: l
         });
-        return c ? r.json({
-          tenants: h.tenants,
-          start: ((w = h.totals) == null ? void 0 : w.start) ?? 0,
-          limit: ((T = h.totals) == null ? void 0 : T.limit) ?? i,
-          length: h.tenants.length
-        }) : r.json({ tenants: h.tenants });
+        return i ? n.json({
+          tenants: v.tenants,
+          start: ((g = v.totals) == null ? void 0 : g.start) ?? 0,
+          limit: ((_ = v.totals) == null ? void 0 : _.limit) ?? c,
+          length: v.tenants.length
+        }) : n.json({ tenants: v.tenants });
       }
-      const m = ((y = e.accessControl) == null ? void 0 : y.controlPlaneTenantId) ?? ((_ = r.env.data.multiTenancyConfig) == null ? void 0 : _.controlPlaneTenantId);
-      if (m && (o != null && o.sub)) {
-        const C = (await D(
-          (M) => r.env.data.userOrganizations.listUserOrganizations(
-            m,
-            o.sub,
-            M
+      const w = ((h = e.accessControl) == null ? void 0 : h.controlPlaneTenantId) ?? ((T = n.env.data.multiTenancyConfig) == null ? void 0 : T.controlPlaneTenantId);
+      if (w && !(u != null && u.sub))
+        throw new P(403, {
+          message: "Access denied: token has no subject"
+        });
+      if (w && (u != null && u.sub)) {
+        const p = (await q(
+          (R) => n.env.data.userOrganizations.listUserOrganizations(
+            w,
+            u.sub,
+            R
           ),
           "organizations"
-        )).map((M) => M.name);
-        if (C.length === 0)
-          return c ? r.json({
+        )).map((R) => R.name);
+        if (p.length === 0)
+          return i ? n.json({
             tenants: [],
             start: 0,
-            limit: i ?? 50,
+            limit: c ?? 50,
             length: 0
-          }) : r.json({ tenants: [] });
-        const p = C.length, F = s ?? 0, $ = i ?? 50, R = F * $, S = C.slice(R, R + $);
-        if (S.length === 0)
-          return c ? r.json({
+          }) : n.json({ tenants: [] });
+        const C = p.length, I = o ?? 0, j = c ?? 50, k = I * j, F = p.slice(k, k + j);
+        if (F.length === 0)
+          return i ? n.json({
             tenants: [],
-            start: R,
-            limit: $,
-            length: p
-          }) : r.json({ tenants: [] });
-        const v = S.map((M) => `id:${M}`).join(" OR "), j = u ? `(${v}) AND (${u})` : v, z = await r.env.data.tenants.list({
-          q: j,
-          per_page: $,
+            start: k,
+            limit: j,
+            length: C
+          }) : n.json({ tenants: [] });
+        const A = F.map((R) => `id:${R}`).join(" OR "), y = l ? `(${A}) AND (${l})` : A, $ = await n.env.data.tenants.list({
+          q: y,
+          per_page: j,
           include_totals: !1
           // We calculate totals from accessibleTenantIds
         });
-        return c ? r.json({
-          tenants: z.tenants,
-          start: R,
-          limit: $,
-          length: p
-        }) : r.json({ tenants: z.tenants });
+        return i ? n.json({
+          tenants: $.tenants,
+          start: k,
+          limit: j,
+          length: C
+        }) : n.json({ tenants: $.tenants });
       }
-      const f = await r.env.data.tenants.list({
-        page: s,
-        per_page: i,
-        include_totals: c,
-        q: u
+      const f = await n.env.data.tenants.list({
+        page: o,
+        per_page: c,
+        include_totals: i,
+        q: l
       });
-      return c ? r.json({
+      return i ? n.json({
         tenants: f.tenants,
         start: ((b = f.totals) == null ? void 0 : b.start) ?? 0,
-        limit: ((I = f.totals) == null ? void 0 : I.limit) ?? i,
+        limit: ((z = f.totals) == null ? void 0 : z.limit) ?? c,
         length: f.tenants.length
-      }) : r.json({ tenants: f.tenants });
+      }) : n.json({ tenants: f.tenants });
     }
-  ), n.openapi(
-    k({
+  ), r.openapi(
+    M({
       tags: ["tenants"],
       method: "post",
       path: "/",
@@ -573,7 +577,7 @@ function N(e, t) {
         201: {
           content: {
             "application/json": {
-              schema: O
+              schema: D
             }
           },
           description: "Tenant created"
@@ -586,30 +590,30 @@ function N(e, t) {
         }
       }
     }),
-    async (r) => {
-      var u, o;
-      const a = r.var.user;
+    async (n) => {
+      var l, u;
+      const a = n.var.user;
       if (!(a != null && a.sub))
         throw new P(401, {
           message: "Authentication required to create tenants"
         });
-      let s = r.req.valid("json");
-      const i = {
-        adapters: r.env.data,
-        ctx: r
+      let o = n.req.valid("json");
+      const c = {
+        adapters: n.env.data,
+        ctx: n
       };
-      (u = t.tenants) != null && u.beforeCreate && (s = await t.tenants.beforeCreate(i, s));
-      const c = await r.env.data.tenants.create(s);
-      return (o = t.tenants) != null && o.afterCreate && await t.tenants.afterCreate(i, c), r.json(c, 201);
+      (l = t.tenants) != null && l.beforeCreate && (o = await t.tenants.beforeCreate(c, o));
+      const i = await n.env.data.tenants.create(o);
+      return (u = t.tenants) != null && u.afterCreate && await t.tenants.afterCreate(c, i), n.json(i, 201);
     }
-  ), n.openapi(
-    k({
+  ), r.openapi(
+    M({
       tags: ["tenants"],
       method: "delete",
       path: "/{id}",
       request: {
-        params: A.object({
-          id: A.string()
+        params: S.object({
+          id: S.string()
         })
       },
       security: [
@@ -629,49 +633,49 @@ function N(e, t) {
         }
       }
     }),
-    async (r) => {
-      var u, o, l, g;
-      const { id: a } = r.req.valid("param"), s = ((u = e.accessControl) == null ? void 0 : u.controlPlaneTenantId) ?? ((o = r.env.data.multiTenancyConfig) == null ? void 0 : o.controlPlaneTenantId);
-      if (s) {
-        const d = r.var.user;
-        if (!(d != null && d.sub))
+    async (n) => {
+      var l, u, s, d;
+      const { id: a } = n.req.valid("param"), o = ((l = e.accessControl) == null ? void 0 : l.controlPlaneTenantId) ?? ((u = n.env.data.multiTenancyConfig) == null ? void 0 : u.controlPlaneTenantId);
+      if (o) {
+        const m = n.var.user;
+        if (!(m != null && m.sub))
           throw new P(401, {
             message: "Authentication required"
           });
-        if (a === s)
+        if (a === o)
           throw new P(403, {
             message: "Cannot delete the control plane"
           });
-        if (!(await D(
-          (w) => r.env.data.userOrganizations.listUserOrganizations(
-            s,
-            d.sub,
-            w
+        if (!(await q(
+          (g) => n.env.data.userOrganizations.listUserOrganizations(
+            o,
+            m.sub,
+            g
           ),
           "organizations"
-        )).some((w) => w.name === a))
+        )).some((g) => g.name === a))
           throw new P(403, {
             message: "Access denied to this tenant"
           });
       }
-      if (!await r.env.data.tenants.get(a))
+      if (!await n.env.data.tenants.get(a))
         throw new P(404, {
           message: "Tenant not found"
         });
-      const c = {
-        adapters: r.env.data,
-        ctx: r
+      const i = {
+        adapters: n.env.data,
+        ctx: n
       };
-      return (l = t.tenants) != null && l.beforeDelete && await t.tenants.beforeDelete(c, a), await r.env.data.tenants.remove(a), (g = t.tenants) != null && g.afterDelete && await t.tenants.afterDelete(c, a), r.body(null, 204);
+      return (s = t.tenants) != null && s.beforeDelete && await t.tenants.beforeDelete(i, a), await n.env.data.tenants.remove(a), (d = t.tenants) != null && d.afterDelete && await t.tenants.afterDelete(i, a), n.body(null, 204);
     }
-  ), n.openapi(
-    k({
+  ), r.openapi(
+    M({
       tags: ["tenants", "settings"],
       method: "get",
       path: "/settings",
       request: {
-        headers: A.object({
-          "tenant-id": A.string().optional()
+        headers: S.object({
+          "tenant-id": S.string().optional()
         })
       },
       security: [
@@ -683,34 +687,34 @@ function N(e, t) {
         200: {
           content: {
             "application/json": {
-              schema: O
+              schema: D
             }
           },
           description: "Current tenant settings"
         }
       }
     }),
-    async (r) => {
-      const a = await r.env.data.tenants.get(r.var.tenant_id);
+    async (n) => {
+      const a = await n.env.data.tenants.get(n.var.tenant_id);
       if (!a)
         throw new P(404, {
           message: "Tenant not found"
         });
-      return r.json(a);
+      return n.json(a);
     }
-  ), n.openapi(
-    k({
+  ), r.openapi(
+    M({
       tags: ["tenants", "settings"],
       method: "patch",
       path: "/settings",
       request: {
-        headers: A.object({
-          "tenant-id": A.string().optional()
+        headers: S.object({
+          "tenant-id": S.string().optional()
         }),
         body: {
           content: {
             "application/json": {
-              schema: A.object(G.shape).partial()
+              schema: S.object(G.shape).partial()
             }
           }
         }
@@ -724,29 +728,29 @@ function N(e, t) {
         200: {
           content: {
             "application/json": {
-              schema: O
+              schema: D
             }
           },
           description: "Updated tenant settings"
         }
       }
     }),
-    async (r) => {
-      const a = r.req.valid("json"), { id: s, ...i } = a, c = await r.env.data.tenants.get(r.var.tenant_id);
-      if (!c)
+    async (n) => {
+      const a = n.req.valid("json"), { id: o, ...c } = a, i = await n.env.data.tenants.get(n.var.tenant_id);
+      if (!i)
         throw new P(404, {
           message: "Tenant not found"
         });
-      const u = ie(c, i);
-      await r.env.data.tenants.update(r.var.tenant_id, u);
-      const o = await r.env.data.tenants.get(r.var.tenant_id);
-      if (!o)
+      const l = ie(i, c);
+      await n.env.data.tenants.update(n.var.tenant_id, l);
+      const u = await n.env.data.tenants.get(n.var.tenant_id);
+      if (!u)
         throw new P(500, {
           message: "Failed to retrieve updated tenant"
         });
-      return r.json(o);
+      return n.json(u);
     }
-  ), n;
+  ), r;
 }
 function _e(e) {
   const t = [
@@ -757,27 +761,27 @@ function _e(e) {
     { pattern: /\/api\/v2\/roles\/([^/]+)$/, type: "role" },
     { pattern: /\/api\/v2\/connections\/([^/]+)$/, type: "connection" }
   ];
-  for (const { pattern: n, type: r } of t) {
-    const a = e.match(n);
+  for (const { pattern: r, type: n } of t) {
+    const a = e.match(r);
     if (a && a[1])
-      return { type: r, id: a[1] };
+      return { type: n, id: a[1] };
   }
   return null;
 }
-async function Ce(e, t, n) {
+async function Te(e, t, r) {
   try {
-    switch (n.type) {
+    switch (r.type) {
       case "resource_server": {
-        const r = await e.resourceServers.get(t, n.id);
-        return (r == null ? void 0 : r.is_system) === !0;
+        const n = await e.resourceServers.get(t, r.id);
+        return (n == null ? void 0 : n.is_system) === !0;
       }
       case "role": {
-        const r = await e.roles.get(t, n.id);
-        return (r == null ? void 0 : r.is_system) === !0;
+        const n = await e.roles.get(t, r.id);
+        return (n == null ? void 0 : n.is_system) === !0;
       }
       case "connection": {
-        const r = await e.connections.get(t, n.id);
-        return (r == null ? void 0 : r.is_system) === !0;
+        const n = await e.connections.get(t, r.id);
+        return (n == null ? void 0 : n.is_system) === !0;
       }
       default:
         return !1;
@@ -786,128 +790,144 @@ async function Ce(e, t, n) {
     return !1;
   }
 }
-function Te(e) {
+function Ce(e) {
   return {
     resource_server: "resource server",
     role: "role",
     connection: "connection"
   }[e];
 }
-function be() {
+function Pe() {
   return async (e, t) => {
     if (!["PATCH", "PUT", "DELETE"].includes(e.req.method))
       return t();
-    const n = _e(e.req.path);
-    if (!n)
-      return t();
-    const r = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
+    const r = _e(e.req.path);
     if (!r)
       return t();
-    if (await Ce(e.env.data, r, n))
+    const n = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
+    if (!n)
+      return t();
+    if (await Te(e.env.data, n, r))
       throw new P(403, {
-        message: `This ${Te(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
+        message: `This ${Ce(r.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
       });
     return t();
   };
 }
-function B(e, t) {
-  const n = t.find(
+function N(e, t) {
+  const r = t.find(
     (a) => a.strategy === e.strategy
   );
-  if (!(n != null && n.options))
+  if (!(r != null && r.options))
     return e;
-  const r = ce.passthrough().parse({
-    ...n,
+  const n = ce.passthrough().parse({
+    ...r,
     ...e
   });
-  return r.options = le.passthrough().parse({
-    ...n.options || {},
+  return n.options = le.passthrough().parse({
+    ...r.options || {},
     ...e.options
-  }), r;
+  }), n;
 }
-function q(e, t) {
-  const n = [...t || [], ...e || []];
-  return [...new Set(n)];
+function O(e, t) {
+  const r = [...t || [], ...e || []];
+  return [...new Set(r)];
 }
-function Pe(e, t) {
+function be(e, t) {
   if (!(t != null && t.length))
     return e || [];
   if (!(e != null && e.length))
     return t;
-  const n = /* @__PURE__ */ new Map();
-  for (const r of t)
-    n.set(r.value, r);
-  for (const r of e)
-    n.set(r.value, r);
-  return Array.from(n.values());
+  const r = /* @__PURE__ */ new Map();
+  for (const n of t)
+    r.set(n.value, n);
+  for (const n of e)
+    r.set(n.value, n);
+  return Array.from(r.values());
 }
 function V(e, t) {
   return t ? {
     ...e,
-    scopes: Pe(
+    scopes: be(
       e.scopes,
       t.scopes
     )
   } : e;
 }
-function J(e, t) {
+function Oe(e, t) {
   return t ? {
     ...e,
-    callbacks: q(e.callbacks, t.callbacks),
-    web_origins: q(
+    callbacks: O(e.callbacks, t.callbacks),
+    web_origins: O(
       e.web_origins,
       t.web_origins
     ),
-    allowed_logout_urls: q(
+    allowed_logout_urls: O(
       e.allowed_logout_urls,
       t.allowed_logout_urls
     ),
-    allowed_origins: q(
+    allowed_origins: O(
       e.allowed_origins,
       t.allowed_origins
     )
   } : e;
 }
+function Z(e) {
+  const { controlPlaneTenantId: t, controlPlaneClientId: r, resolveControlPlane: n } = e;
+  if (n)
+    return async (o) => n({ tenant_id: o });
+  if (!t)
+    return async () => {
+    };
+  const a = {
+    tenantId: t,
+    clientId: r
+  };
+  return async () => a;
+}
 function x(e, t) {
   return {
     ...e.resourceServers,
-    get: async (n, r) => {
+    get: async (r, n) => {
       const a = await e.resourceServers.get(
-        n,
-        r
+        r,
+        n
       );
-      if (!a || !t || n === t || !a.is_system)
+      if (!a)
         return a;
-      const s = await e.resourceServers.get(
-        t,
-        r
+      const o = await t(r);
+      if (!o || r === o.tenantId || !a.is_system)
+        return a;
+      const c = await e.resourceServers.get(
+        o.tenantId,
+        n
       );
       return V(
         a,
-        s
+        c
       );
     },
-    list: async (n, r) => {
-      const a = await e.resourceServers.list(n, r);
-      if (!t || n === t)
+    list: async (r, n) => {
+      const a = await e.resourceServers.list(r, n), o = await t(r);
+      if (!o || r === o.tenantId)
         return a;
-      const s = t, i = a.resource_servers.filter(
-        (o) => !!(o.is_system && o.id)
-      ).map((o) => o.id);
+      const c = o.tenantId, i = a.resource_servers.filter(
+        (s) => !!(s.is_system && s.id)
+      ).map((s) => s.id);
       if (i.length === 0)
         return a;
-      const c = /* @__PURE__ */ new Map();
+      const l = /* @__PURE__ */ new Map();
       await Promise.all(
-        i.map(async (o) => {
-          const l = await e.resourceServers.get(s, o);
-          l && c.set(o, l);
+        i.map(async (s) => {
+          const d = await e.resourceServers.get(c, s);
+          d && l.set(s, d);
         })
       );
       const u = a.resource_servers.map(
-        (o) => o.is_system && o.id ? V(
-          o,
-          c.get(o.id) ?? null
-        ) : o
+        (s) => s.is_system && s.id ? V(
+          s,
+          l.get(s.id) ?? null
+        ) : s
       );
       return {
         ...a,
@@ -916,156 +936,160 @@ function x(e, t) {
     }
   };
 }
-function Se(e, t) {
+function Ie(e, t) {
+  const r = Z({
+    controlPlaneTenantId: t.controlPlaneTenantId,
+    resolveControlPlane: t.resolveControlPlane
+  });
   return {
     ...e,
     resourceServers: x(
       e,
-      t.controlPlaneTenantId
+      r
     )
   };
 }
 function Ae(e, t) {
-  const { controlPlaneTenantId: n, controlPlaneClientId: r } = t;
+  const { controlPlaneTenantId: r, controlPlaneClientId: n, resolveControlPlane: a } = t, o = Z({
+    controlPlaneTenantId: r,
+    controlPlaneClientId: n,
+    resolveControlPlane: a
+  });
   return {
     ...e,
-    // Store config for use by tenants route access control
+    // Store the static config for use by tenants route access control.
+    // Per-tenant inheritance overrides do NOT affect access-control values —
+    // those intentionally use a single global control plane id. The resolver
+    // is exposed here so runtime helpers (e.g. `getEnrichedClient`) can
+    // consult it before merging control-plane URLs.
     multiTenancyConfig: {
-      controlPlaneTenantId: n,
-      controlPlaneClientId: r
+      controlPlaneTenantId: r,
+      controlPlaneClientId: n,
+      resolveControlPlane: a
     },
     connections: {
       ...e.connections,
-      get: async (a, s) => {
-        const i = await e.connections.get(
-          a,
-          s
+      get: async (c, i) => {
+        const l = await e.connections.get(
+          c,
+          i
         );
-        if (!i || !n || a === n)
-          return i;
-        const c = await e.connections.list(n);
-        return B(
-          i,
-          c.connections || []
+        if (!l)
+          return l;
+        const u = await o(c);
+        if (!u || c === u.tenantId)
+          return l;
+        const s = await e.connections.list(
+          u.tenantId
+        );
+        return N(
+          l,
+          s.connections || []
         );
       },
-      list: async (a, s) => {
-        const i = await e.connections.list(a, s);
-        if (!n || a === n)
-          return i;
-        const c = await e.connections.list(n), u = i.connections.map(
-          (o) => B(
-            o,
-            c.connections || []
+      list: async (c, i) => {
+        const l = await e.connections.list(c, i), u = await o(c);
+        if (!u || c === u.tenantId)
+          return l;
+        const s = await e.connections.list(
+          u.tenantId
+        ), d = l.connections.map(
+          (m) => N(
+            m,
+            s.connections || []
           )
         );
         return {
-          ...i,
-          connections: u
+          ...l,
+          connections: d
         };
       }
     },
     clientConnections: {
       ...e.clientConnections,
-      listByClient: async (a, s) => {
-        let i = await e.clientConnections.listByClient(
-          a,
-          s
+      listByClient: async (c, i) => {
+        let l = await e.clientConnections.listByClient(
+          c,
+          i
         );
-        if (i.length === 0 && (i = (await e.connections.list(a)).connections || []), !n || a === n)
-          return i;
-        const c = await e.connections.list(n);
-        return i.map(
-          (u) => B(
-            u,
-            c.connections || []
-          )
+        l.length === 0 && (l = (await e.connections.list(c)).connections || []);
+        const u = await o(c);
+        if (!u || c === u.tenantId)
+          return l;
+        const s = await e.connections.list(
+          u.tenantId
         );
-      }
-    },
-    clients: {
-      ...e.clients,
-      get: async (a, s) => {
-        const i = await e.clients.get(a, s);
-        if (!i)
-          return null;
-        if (!n || !r || a === n && s === r)
-          return i;
-        const c = await e.clients.get(
-          n,
-          r
-        );
-        return J(i, c);
-      },
-      getByClientId: async (a) => {
-        const s = await e.clients.getByClientId(a);
-        if (!s)
-          return null;
-        if (!n || !r || s.tenant_id === n && s.client_id === r)
-          return s;
-        const i = await e.clients.get(
-          n,
-          r
+        return l.map(
+          (d) => N(
+            d,
+            s.connections || []
+          )
         );
-        return {
-          ...J(s, i),
-          tenant_id: s.tenant_id
-        };
       }
     },
+    // Note: clients.get / getByClientId are intentionally NOT wrapped here.
+    // Storage reads must return the tenant's own stored URLs so that the
+    // management API and DCR don't echo control-plane callbacks back on
+    // update. Runtime URL merging for auth flows happens in
+    // `getEnrichedClient` (packages/authhero/src/helpers/client.ts).
     emailProviders: {
       ...e.emailProviders,
-      get: async (a) => {
-        const s = await e.emailProviders.get(a);
-        return s || (!n || a === n ? null : e.emailProviders.get(n));
+      get: async (c) => {
+        const i = await e.emailProviders.get(c);
+        if (i)
+          return i;
+        const l = await o(c);
+        return !l || c === l.tenantId ? null : e.emailProviders.get(l.tenantId);
       }
     },
     resourceServers: x(
       e,
-      n
+      o
     ),
-    hooks: Ie(e, n)
+    hooks: Se(e, o)
     // Note: Additional adapters can be extended here for runtime fallback:
     // - promptSettings: Fall back to control plane prompts
     // - branding: Fall back to control plane branding/themes
   };
 }
-function X(e) {
+function J(e) {
   if (!e || typeof e != "object") return !1;
   const t = e.metadata;
   return !t || typeof t != "object" ? !1 : t.inheritable === !0;
 }
-function Ie(e, t) {
+function Se(e, t) {
   return {
     ...e.hooks,
-    list: async (n, r) => {
-      const a = await e.hooks.list(n, r);
-      if (!t || n === t)
+    list: async (r, n) => {
+      const a = await e.hooks.list(r, n), o = await t(r);
+      if (!o || r === o.tenantId)
         return a;
       const i = ((await e.hooks.list(
-        t,
-        r
+        o.tenantId,
+        n
       )).hooks || []).filter(
-        X
+        J
       );
       if (i.length === 0)
         return a;
-      const c = new Set((a.hooks || []).map((o) => o.hook_id)), u = i.filter((o) => !c.has(o.hook_id));
+      const l = new Set((a.hooks || []).map((s) => s.hook_id)), u = i.filter((s) => !l.has(s.hook_id));
       return {
         ...a,
         hooks: [...a.hooks || [], ...u],
         length: typeof a.length == "number" ? a.length + u.length : a.length
       };
     },
-    get: async (n, r) => {
-      const a = await e.hooks.get(n, r);
-      if (a || !t || n === t)
+    get: async (r, n) => {
+      const a = await e.hooks.get(r, n);
+      if (a) return a;
+      const o = await t(r);
+      if (!o || r === o.tenantId)
         return a;
-      const s = await e.hooks.get(
-        t,
-        r
+      const c = await e.hooks.get(
+        o.tenantId,
+        n
       );
-      return s && X(s) ? s : null;
+      return c && J(c) ? c : null;
     }
   };
 }
@@ -1073,194 +1097,202 @@ function ee(e, t) {
   return Ae(e, t);
 }
 function Re(e) {
-  return async (t, n) => {
-    const r = t.var.user;
-    return (r == null ? void 0 : r.tenant_id) === e && r.org_name && t.set("tenant_id", r.org_name), n();
+  return async (t, r) => {
+    const n = t.var.user;
+    return (n == null ? void 0 : n.tenant_id) === e && n.org_name && t.set("tenant_id", n.org_name), r();
   };
 }
 function ze(e) {
-  return async (t, n) => {
+  return async (t, r) => {
     if (!e.accessControl)
-      return n();
-    const { controlPlaneTenantId: r } = e.accessControl, a = t.var.org_name, s = t.var.organization_id, i = a || s;
-    let c = t.var.tenant_id;
-    const u = t.var.user, l = (u != null && u.aud ? Array.isArray(u.aud) ? u.aud : [u.aud] : []).includes(Y);
-    if (!c && i && l && (t.set("tenant_id", i), c = i), !c)
+      return r();
+    const { controlPlaneTenantId: n } = e.accessControl, a = t.var.org_name, o = t.var.organization_id, c = a || o;
+    let i = t.var.tenant_id;
+    const l = t.var.user, s = (l != null && l.aud ? Array.isArray(l.aud) ? l.aud : [l.aud] : []).includes(X);
+    if (!i && c && s && (t.set("tenant_id", c), i = c), !i)
       throw new P(400, {
         message: "Tenant ID not found in request"
       });
     if (!me(
-      s,
-      c,
-      r,
+      o,
+      i,
+      n,
       a
     ))
       throw new P(403, {
-        message: `Access denied to tenant ${c}`
+        message: `Access denied to tenant ${i}`
       });
-    return n();
+    return r();
   };
 }
 function $e(e) {
-  return async (t, n) => {
+  return async (t, r) => {
     if (!e.subdomainRouting)
-      return n();
+      return r();
     const {
-      baseDomain: r,
+      baseDomain: n,
       reservedSubdomains: a = [],
-      resolveSubdomain: s
-    } = e.subdomainRouting, i = t.req.header("x-forwarded-host") || t.req.header("host") || "";
-    let c = null;
-    if (i.endsWith(r)) {
-      const o = i.slice(0, -(r.length + 1));
-      o && !o.includes(".") && (c = o);
+      resolveSubdomain: o
+    } = e.subdomainRouting, c = t.req.header("x-forwarded-host") || t.req.header("host") || "";
+    let i = null;
+    if (c.endsWith(n)) {
+      const u = c.slice(0, -(n.length + 1));
+      u && !u.includes(".") && (i = u);
     }
-    if (c && a.includes(c) && (c = null), !c)
-      return e.accessControl && t.set("tenant_id", e.accessControl.controlPlaneTenantId), n();
-    let u = null;
-    if (s)
-      u = await s(c);
+    if (i && a.includes(i) && (i = null), !i)
+      return e.accessControl && t.set("tenant_id", e.accessControl.controlPlaneTenantId), r();
+    let l = null;
+    if (o)
+      l = await o(i);
     else if (e.subdomainRouting.useOrganizations !== !1 && e.accessControl)
       try {
-        const o = await t.env.data.organizations.get(
+        const u = await t.env.data.organizations.get(
           e.accessControl.controlPlaneTenantId,
-          c
+          i
         );
-        o && (u = o.id);
+        u && (l = u.id);
       } catch {
       }
-    if (!u)
+    if (!l)
       throw new P(404, {
-        message: `Tenant not found for subdomain: ${c}`
+        message: `Tenant not found for subdomain: ${i}`
       });
-    return t.set("tenant_id", u), n();
+    return t.set("tenant_id", l), r();
   };
 }
 function je(e) {
-  return async (t, n) => {
+  return async (t, r) => {
     if (!e.databaseIsolation)
-      return n();
-    const r = t.var.tenant_id;
-    if (!r)
+      return r();
+    const n = t.var.tenant_id;
+    if (!n)
       throw new P(400, {
         message: "Tenant ID not found in request"
       });
     try {
-      const a = await e.databaseIsolation.getAdapters(r);
+      const a = await e.databaseIsolation.getAdapters(n);
       t.env.data = a;
     } catch (a) {
       throw console.error(
-        `Failed to resolve database for tenant ${r}:`,
+        `Failed to resolve database for tenant ${n}:`,
         a
       ), new P(500, {
         message: "Failed to resolve tenant database"
       });
     }
-    return n();
+    return r();
   };
 }
 function te(e) {
-  const t = $e(e), n = ze(e), r = je(e);
-  return async (a, s) => (await t(a, async () => {
-  }), await n(a, async () => {
+  const t = $e(e), r = ze(e), n = je(e);
+  return async (a, o) => (await t(a, async () => {
   }), await r(a, async () => {
-  }), s());
+  }), await n(a, async () => {
+  }), o());
 }
-function qe(e) {
+function Ee(e) {
   const {
     dataAdapter: t,
-    controlPlane: n,
+    controlPlane: r,
     controlPlane: {
-      tenantId: r = "control_plane",
+      tenantId: n = "control_plane",
       clientId: a
     } = {},
-    sync: s = { resourceServers: !0, roles: !0 },
+    resolveControlPlane: o,
+    sync: c = { resourceServers: !0, roles: !0 },
     defaultPermissions: i = ["tenant:admin"],
-    requireOrganizationMatch: c = !1,
+    requireOrganizationMatch: l = !1,
     managementApiExtensions: u = [],
-    entityHooks: o,
-    getChildTenantIds: l,
-    getAdapters: g,
-    ...d
+    entityHooks: s,
+    getChildTenantIds: d,
+    getAdapters: m,
+    ...w
   } = e;
-  let m = t, f = t;
-  n && (m = ee(t, {
-    controlPlaneTenantId: r,
-    controlPlaneClientId: a
-  }), f = {
-    ...Se(t, {
-      controlPlaneTenantId: r
+  if (o && !r)
+    throw new Error(
+      "initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it."
+    );
+  let f = t, g = t;
+  r && (f = ee(t, {
+    controlPlaneTenantId: n,
+    controlPlaneClientId: a,
+    resolveControlPlane: o
+  }), g = {
+    ...Ie(t, {
+      controlPlaneTenantId: n,
+      resolveControlPlane: o
     }),
     multiTenancyConfig: {
-      controlPlaneTenantId: r,
-      controlPlaneClientId: a
+      controlPlaneTenantId: n,
+      controlPlaneClientId: a,
+      resolveControlPlane: o
     }
   });
-  const w = s !== !1, T = w ? {
-    resourceServers: s.resourceServers ?? !0,
-    roles: s.roles ?? !0
-  } : { resourceServers: !1, roles: !1 }, b = {
-    controlPlaneTenantId: r,
-    getChildTenantIds: l ?? (async () => (await D(
-      (v) => m.tenants.list(v),
+  const _ = c !== !1, h = _ ? {
+    resourceServers: c.resourceServers ?? !0,
+    roles: c.roles ?? !0
+  } : { resourceServers: !1, roles: !1 }, z = {
+    controlPlaneTenantId: n,
+    getChildTenantIds: d ?? (async () => (await q(
+      (y) => f.tenants.list(y),
       "tenants",
       { cursorField: "id", pageSize: 100 }
-    )).filter((v) => v.id !== r).map((v) => v.id)),
-    getAdapters: g ?? (async () => m),
-    getControlPlaneAdapters: async () => m,
-    sync: T
-  }, { entityHooks: I, tenantHooks: h } = ve(b), C = {
+    )).filter((y) => y.id !== n).map((y) => y.id)),
+    getAdapters: m ?? (async () => f),
+    getControlPlaneAdapters: async () => f,
+    sync: h
+  }, { entityHooks: v, tenantHooks: p } = ve(z), C = {
     resourceServers: [
-      I.resourceServers,
-      ...(o == null ? void 0 : o.resourceServers) ?? []
+      v.resourceServers,
+      ...(s == null ? void 0 : s.resourceServers) ?? []
     ],
-    roles: [I.roles, ...(o == null ? void 0 : o.roles) ?? []],
-    connections: (o == null ? void 0 : o.connections) ?? [],
-    tenants: (o == null ? void 0 : o.tenants) ?? [],
-    rolePermissions: (o == null ? void 0 : o.rolePermissions) ?? []
-  }, p = Z({
+    roles: [v.roles, ...(s == null ? void 0 : s.roles) ?? []],
+    connections: (s == null ? void 0 : s.connections) ?? [],
+    tenants: (s == null ? void 0 : s.tenants) ?? [],
+    rolePermissions: (s == null ? void 0 : s.rolePermissions) ?? []
+  }, I = Y({
     accessControl: {
-      controlPlaneTenantId: r,
-      requireOrganizationMatch: c,
+      controlPlaneTenantId: n,
+      requireOrganizationMatch: l,
       defaultPermissions: i
     }
-  }), $ = N(
+  }), k = B(
     {
       accessControl: {
-        controlPlaneTenantId: r,
-        requireOrganizationMatch: c,
+        controlPlaneTenantId: n,
+        requireOrganizationMatch: l,
         defaultPermissions: i
       }
     },
     { tenants: {
-      async beforeCreate(S, v) {
-        return p.beforeCreate && (v = await p.beforeCreate(S, v)), h.beforeCreate && (v = await h.beforeCreate(S, v)), v;
+      async beforeCreate(A, y) {
+        return I.beforeCreate && (y = await I.beforeCreate(A, y)), p.beforeCreate && (y = await p.beforeCreate(A, y)), y;
       },
-      async afterCreate(S, v) {
-        var j, z;
-        await ((j = p.afterCreate) == null ? void 0 : j.call(p, S, v)), await ((z = h.afterCreate) == null ? void 0 : z.call(h, S, v));
+      async afterCreate(A, y) {
+        var $, R;
+        await (($ = I.afterCreate) == null ? void 0 : $.call(I, A, y)), await ((R = p.afterCreate) == null ? void 0 : R.call(p, A, y));
       },
-      async beforeDelete(S, v) {
-        var j, z;
-        await ((j = p.beforeDelete) == null ? void 0 : j.call(p, S, v)), await ((z = h.beforeDelete) == null ? void 0 : z.call(h, S, v));
+      async beforeDelete(A, y) {
+        var $, R;
+        await (($ = I.beforeDelete) == null ? void 0 : $.call(I, A, y)), await ((R = p.beforeDelete) == null ? void 0 : R.call(p, A, y));
       }
     } }
-  ), { app: R } = ue({
-    dataAdapter: m,
-    managementDataAdapter: f,
-    ...d,
+  ), { app: F } = ue({
+    dataAdapter: f,
+    managementDataAdapter: g,
+    ...w,
     entityHooks: C,
     managementApiExtensions: [
       ...u,
-      { path: "/tenants", router: $ }
+      { path: "/tenants", router: k }
     ]
   });
-  return R.use(
+  return F.use(
     "/api/v2/*",
-    Re(r)
-  ), w && R.use("/api/v2/*", be()), { app: R, controlPlaneTenantId: r };
+    Re(n)
+  ), _ && F.use("/api/v2/*", Pe()), { app: F, controlPlaneTenantId: n };
 }
-function Ee(e) {
+function Ne(e) {
   const t = U(e);
   return {
     name: "multi-tenancy",
@@ -1272,7 +1304,7 @@ function Ee(e) {
     routes: [
       {
         path: "/management",
-        handler: N(e, t)
+        handler: B(e, t)
       }
     ],
     // Called when plugin is registered
@@ -1286,22 +1318,22 @@ function Ee(e) {
   };
 }
 function U(e) {
-  const t = e.accessControl ? fe(e.accessControl) : {}, n = e.databaseIsolation ? ge(e.databaseIsolation) : {}, r = Z(e);
+  const t = e.accessControl ? fe(e.accessControl) : {}, r = e.databaseIsolation ? ge(e.databaseIsolation) : {}, n = Y(e);
   return {
     ...t,
-    ...n,
-    tenants: r
+    ...r,
+    tenants: n
   };
 }
-function Fe(e) {
-  const t = new ae(), n = U(e);
-  return t.route("/tenants", N(e, n)), t;
+function ke(e) {
+  const t = new ae(), r = U(e);
+  return t.route("/tenants", B(e, r)), t;
 }
 function Be(e) {
   return {
     hooks: U(e),
     middleware: te(e),
-    app: Fe(e),
+    app: ke(e),
     config: e,
     /**
      * Wraps data adapters with runtime fallback from the control plane.
@@ -1311,11 +1343,11 @@ function Be(e) {
      * @param additionalConfig - Additional config (controlPlaneClientId, etc.)
      * @returns Wrapped adapters with runtime fallback
      */
-    wrapAdapters: (t, n) => {
-      var r;
+    wrapAdapters: (t, r) => {
+      var n;
       return ee(t, {
-        controlPlaneTenantId: (r = e.accessControl) == null ? void 0 : r.controlPlaneTenantId,
-        controlPlaneClientId: n == null ? void 0 : n.controlPlaneClientId
+        controlPlaneTenantId: (n = e.accessControl) == null ? void 0 : n.controlPlaneTenantId,
+        controlPlaneClientId: r == null ? void 0 : r.controlPlaneClientId
       });
     }
   };
@@ -1326,19 +1358,20 @@ export {
   Re as createControlPlaneTenantMiddleware,
   ge as createDatabaseHooks,
   je as createDatabaseMiddleware,
-  Fe as createMultiTenancy,
+  ke as createMultiTenancy,
   U as createMultiTenancyHooks,
   te as createMultiTenancyMiddleware,
-  Ee as createMultiTenancyPlugin,
-  be as createProtectSyncedMiddleware,
-  Z as createProvisioningHooks,
+  Ne as createMultiTenancyPlugin,
+  Pe as createProtectSyncedMiddleware,
+  Y as createProvisioningHooks,
   Ae as createRuntimeFallbackAdapter,
   $e as createSubdomainMiddleware,
   ve as createSyncHooks,
-  N as createTenantsOpenAPIRouter,
-  qe as initMultiTenant,
+  B as createTenantsOpenAPIRouter,
+  Ee as initMultiTenant,
+  Oe as mergeClientWithFallback,
   Be as setupMultiTenancy,
   me as validateTenantAccess,
   ee as withRuntimeFallback,
-  Se as withSystemResourceServerInheritance
+  Ie as withSystemResourceServerInheritance
 };