@authhero/multi-tenancy 14.22.0 → 14.23.1

package/dist/multi-tenancy.mjs

@@ -1,1377 +1,861 @@
-var ne = Object.defineProperty;
-var re = (e, t, r) => t in e ? ne(e, t, { enumerable: !0, configurable: !0, writable: !0, value: r }) : e[t] = r;
-var E = (e, t, r) => re(e, typeof t != "symbol" ? t + "" : t, r);
-import { Hono as ae } from "hono";
-import { MANAGEMENT_API_SCOPES as se, MANAGEMENT_API_AUDIENCE as X, fetchAll as q, auth0QuerySchema as oe, tenantSchema as D, tenantInsertSchema as G, deepMergePatch as ie, connectionSchema as ce, connectionOptionsSchema as le, init as ue } from "authhero";
-import { OpenAPIHono as de, createRoute as M, z as S } from "@hono/zod-openapi";
-function fe(e) {
-  const { controlPlaneTenantId: t, requireOrganizationMatch: r = !0 } = e;
-  return {
-    async onTenantAccessValidation(n, a) {
-      if (a === t)
-        return !0;
-      if (r) {
-        const o = n.var.org_name, c = n.var.organization_id, i = o || c;
-        return i ? i.toLowerCase() === a.toLowerCase() : !1;
-      }
-      return !0;
-    }
-  };
-}
-function me(e, t, r, n) {
-  if (t === r)
-    return !0;
-  const a = n || e;
-  return a ? a.toLowerCase() === t.toLowerCase() : !1;
-}
-function ge(e) {
-  return {
-    async resolveDataAdapters(t) {
-      try {
-        return await e.getAdapters(t);
-      } catch (r) {
-        console.error(
-          `Failed to resolve data adapters for tenant ${t}:`,
-          r
-        );
-        return;
-      }
-    }
-  };
-}
-function we(e) {
-  return `urn:authhero:tenant:${e.toLowerCase()}`;
-}
-function Y(e) {
-  return {
-    async beforeCreate(t, r) {
-      return !r.audience && r.id ? {
-        ...r,
-        audience: we(r.id)
-      } : r;
-    },
-    async afterCreate(t, r) {
-      const { accessControl: n, databaseIsolation: a } = e;
-      n && t.ctx && await pe(t, r, n), a != null && a.onProvision && await a.onProvision(r.id);
-    },
-    async beforeDelete(t, r) {
-      const { accessControl: n, databaseIsolation: a } = e;
-      if (n)
-        try {
-          const c = (await t.adapters.organizations.list(
-            n.controlPlaneTenantId
-          )).organizations.find((i) => i.name === r);
-          c && await t.adapters.organizations.remove(
-            n.controlPlaneTenantId,
-            c.id
-          );
-        } catch (o) {
-          console.warn(
-            `Failed to remove organization for tenant ${r}:`,
-            o
-          );
-        }
-      if (a != null && a.onDeprovision)
-        try {
-          await a.onDeprovision(r);
-        } catch (o) {
-          console.warn(
-            `Failed to deprovision database for tenant ${r}:`,
-            o
-          );
-        }
-    }
-  };
-}
-async function pe(e, t, r) {
-  const {
-    controlPlaneTenantId: n,
-    defaultPermissions: a,
-    defaultRoles: o,
-    issuer: c,
-    adminRoleName: i = "Tenant Admin",
-    adminRoleDescription: l = "Full access to all tenant management operations",
-    addCreatorToOrganization: u = !0
-  } = r, s = await e.adapters.organizations.create(
-    n,
-    {
-      name: t.id,
-      display_name: t.friendly_name || t.id
-    }
-  );
-  let d;
-  if (c && (d = await ye(
-    e,
-    n,
-    i,
-    l
-  )), u && e.ctx) {
-    const m = e.ctx.var.user;
-    if (m != null && m.sub && !await he(
-      e,
-      n,
-      m.sub
-    ))
-      try {
-        await e.adapters.userOrganizations.create(n, {
-          user_id: m.sub,
-          organization_id: s.id
-        }), d && await e.adapters.userRoles.create(
-          n,
-          m.sub,
-          d,
-          s.id
-          // organizationId
-        );
-      } catch (f) {
-        console.warn(
-          `Failed to add creator ${m.sub} to organization ${s.id}:`,
-          f
-        );
-      }
-  }
-  o && o.length > 0 && console.log(
-    `Would assign roles ${o.join(", ")} to organization ${s.id}`
-  ), a && a.length > 0 && console.log(
-    `Would grant permissions ${a.join(", ")} to organization ${s.id}`
-  );
-}
-async function he(e, t, r) {
-  const n = await e.adapters.userRoles.list(
-    t,
-    r,
-    void 0,
-    ""
-    // Empty string for global roles
-  );
-  for (const a of n)
-    if ((await e.adapters.rolePermissions.list(
-      t,
-      a.id,
-      { per_page: 1e3 }
-    )).some(
-      (i) => i.permission_name === "admin:organizations"
-    ))
-      return !0;
-  return !1;
-}
-async function ye(e, t, r, n) {
-  const o = (await e.adapters.roles.list(t, {})).roles.find((u) => u.name === r);
-  if (o)
-    return o.id;
-  const c = await e.adapters.roles.create(t, {
-    name: r,
-    description: n
-  }), i = X, l = se.map((u) => ({
-    role_id: c.id,
-    resource_server_identifier: i,
-    permission_name: u.value
-  }));
-  return await e.adapters.rolePermissions.assign(
-    t,
-    c.id,
-    l
-  ), c.id;
-}
-function H(e, t, r = () => !0) {
-  const { controlPlaneTenantId: n, getChildTenantIds: a, getAdapters: o } = e, c = /* @__PURE__ */ new Map();
-  async function i(s, d, m) {
-    return (await t(s).list(d, {
-      q: `name:${m}`,
-      per_page: 1
-    }))[0] ?? null;
-  }
-  async function l(s) {
-    const d = await a(), m = t(await o(n));
-    await Promise.all(
-      d.map(async (w) => {
-        try {
-          const f = await o(w), g = t(f), h = {
-            ...m.transform(s),
-            is_system: !0
-          }, T = await i(f, w, s.name), b = T ? g.getId(T) : void 0;
-          if (T && b) {
-            const z = g.preserveOnUpdate ? g.preserveOnUpdate(T, h) : h;
-            await g.update(w, b, z);
-          } else
-            await g.create(w, h);
-        } catch (f) {
-          console.error(
-            `Failed to sync ${m.listKey} "${s.name}" to tenant "${w}":`,
-            f
-          );
-        }
-      })
-    );
-  }
-  async function u(s) {
-    const d = await a();
-    await Promise.all(
-      d.map(async (m) => {
-        try {
-          const w = await o(m), f = t(w), g = await i(w, m, s), _ = g ? f.getId(g) : void 0;
-          g && _ && await f.remove(m, _);
-        } catch (w) {
-          console.error(
-            `Failed to delete entity "${s}" from tenant "${m}":`,
-            w
-          );
-        }
-      })
-    );
-  }
-  return {
-    afterCreate: async (s, d) => {
-      s.tenantId === n && r(d) && await l(d);
-    },
-    afterUpdate: async (s, d, m) => {
-      s.tenantId === n && r(m) && await l(m);
-    },
-    beforeDelete: async (s, d) => {
-      if (s.tenantId !== n) return;
-      const w = await t(s.adapters).get(s.tenantId, d);
-      w && r(w) && c.set(d, w);
-    },
-    afterDelete: async (s, d) => {
-      if (s.tenantId !== n) return;
-      const m = c.get(d);
-      m && (c.delete(d), await u(m.name));
-    }
-  };
-}
-function W(e, t, r = () => !0) {
-  const { controlPlaneTenantId: n, getControlPlaneAdapters: a, getAdapters: o } = e;
-  return {
-    async afterCreate(c, i) {
-      if (i.id !== n)
-        try {
-          const l = await a(), u = await o(i.id), s = t(l), d = t(u), m = await q(
-            (w) => s.listPaginated(n, w),
-            s.listKey,
-            { cursorField: "id", pageSize: 100 }
-          );
-          await Promise.all(
-            m.filter((w) => r(w)).map(async (w) => {
-              try {
-                const f = s.transform(w);
-                await d.create(i.id, {
-                  ...f,
-                  is_system: !0
-                });
-              } catch (f) {
-                console.error(
-                  `Failed to sync entity to new tenant "${i.id}":`,
-                  f
-                );
-              }
-            })
-          );
-        } catch (l) {
-          console.error(
-            `Failed to sync entities to new tenant "${i.id}":`,
-            l
-          );
-        }
-    }
-  };
-}
-const L = (e) => ({
-  list: async (t, r) => (await e.resourceServers.list(t, r)).resource_servers,
-  listPaginated: (t, r) => e.resourceServers.list(t, r),
-  get: (t, r) => e.resourceServers.get(t, r),
-  create: (t, r) => e.resourceServers.create(t, r),
-  update: (t, r, n) => e.resourceServers.update(t, r, n),
-  remove: (t, r) => e.resourceServers.remove(t, r),
-  listKey: "resource_servers",
-  getId: (t) => t.id,
-  transform: (t) => ({
-    id: t.id,
-    name: t.name,
-    identifier: t.identifier,
-    scopes: t.scopes,
-    signing_alg: t.signing_alg,
-    token_lifetime: t.token_lifetime,
-    token_lifetime_for_web: t.token_lifetime_for_web
-  })
-}), K = (e) => ({
-  list: async (t, r) => (await e.roles.list(t, r)).roles,
-  listPaginated: (t, r) => e.roles.list(t, r),
-  get: (t, r) => e.roles.get(t, r),
-  create: (t, r) => e.roles.create(t, r),
-  update: (t, r, n) => e.roles.update(t, r, n),
-  remove: (t, r) => e.roles.remove(t, r),
-  listKey: "roles",
-  getId: (t) => t.id,
-  transform: (t) => ({
-    id: t.id,
-    name: t.name,
-    description: t.description
-  })
+import { Hono as e } from "hono";
+import { MANAGEMENT_API_AUDIENCE as t, MANAGEMENT_API_SCOPES as n, auth0QuerySchema as r, connectionOptionsSchema as i, connectionSchema as a, deepMergePatch as o, fetchAll as s, init as c, tenantInsertSchema as l, tenantSchema as u } from "authhero";
+import { OpenAPIHono as d, createRoute as f, z as p } from "@hono/zod-openapi";
+//#region src/hooks/access-control.ts
+function m(e) {
+	let { controlPlaneTenantId: t, requireOrganizationMatch: n = !0 } = e;
+	return { async onTenantAccessValidation(e, r) {
+		if (r === t) return !0;
+		if (n) {
+			let t = e.var.org_name, n = e.var.organization_id, i = t || n;
+			return i ? i.toLowerCase() === r.toLowerCase() : !1;
+		}
+		return !0;
+	} };
+}
+function h(e, t, n, r) {
+	if (t === n) return !0;
+	let i = r || e;
+	return i ? i.toLowerCase() === t.toLowerCase() : !1;
+}
+//#endregion
+//#region src/hooks/database.ts
+function g(e) {
+	return { async resolveDataAdapters(t) {
+		try {
+			return await e.getAdapters(t);
+		} catch (e) {
+			console.error(`Failed to resolve data adapters for tenant ${t}:`, e);
+			return;
+		}
+	} };
+}
+//#endregion
+//#region src/hooks/provisioning.ts
+function _(e) {
+	return `urn:authhero:tenant:${e.toLowerCase()}`;
+}
+function v(e) {
+	return {
+		async beforeCreate(e, t) {
+			return !t.audience && t.id ? {
+				...t,
+				audience: _(t.id)
+			} : t;
+		},
+		async afterCreate(t, n) {
+			let { accessControl: r, databaseIsolation: i } = e;
+			r && t.ctx && await y(t, n, r), i?.onProvision && await i.onProvision(n.id);
+		},
+		async beforeDelete(t, n) {
+			let { accessControl: r, databaseIsolation: i } = e;
+			if (r) try {
+				let e = (await t.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find((e) => e.name === n);
+				e && await t.adapters.organizations.remove(r.controlPlaneTenantId, e.id);
+			} catch (e) {
+				console.warn(`Failed to remove organization for tenant ${n}:`, e);
+			}
+			if (i?.onDeprovision) try {
+				await i.onDeprovision(n);
+			} catch (e) {
+				console.warn(`Failed to deprovision database for tenant ${n}:`, e);
+			}
+		}
+	};
+}
+async function y(e, t, n) {
+	let { controlPlaneTenantId: r, defaultPermissions: i, defaultRoles: a, issuer: o, adminRoleName: s = "Tenant Admin", adminRoleDescription: c = "Full access to all tenant management operations", addCreatorToOrganization: l = !0 } = n, u = await e.adapters.organizations.create(r, {
+		name: t.id,
+		display_name: t.friendly_name || t.id
+	}), d;
+	if (o && (d = await x(e, r, s, c)), l && e.ctx) {
+		let t = e.ctx.var.user;
+		if (t?.sub && !await b(e, r, t.sub)) try {
+			await e.adapters.userOrganizations.create(r, {
+				user_id: t.sub,
+				organization_id: u.id
+			}), d && await e.adapters.userRoles.create(r, t.sub, d, u.id);
+		} catch (e) {
+			console.warn(`Failed to add creator ${t.sub} to organization ${u.id}:`, e);
+		}
+	}
+	a && a.length > 0 && console.log(`Would assign roles ${a.join(", ")} to organization ${u.id}`), i && i.length > 0 && console.log(`Would grant permissions ${i.join(", ")} to organization ${u.id}`);
+}
+async function b(e, t, n) {
+	let r = await e.adapters.userRoles.list(t, n, void 0, "");
+	for (let n of r) if ((await e.adapters.rolePermissions.list(t, n.id, { per_page: 1e3 })).some((e) => e.permission_name === "admin:organizations")) return !0;
+	return !1;
+}
+async function x(e, r, i, a) {
+	let o = (await e.adapters.roles.list(r, {})).roles.find((e) => e.name === i);
+	if (o) return o.id;
+	let s = await e.adapters.roles.create(r, {
+		name: i,
+		description: a
+	}), c = t, l = n.map((e) => ({
+		role_id: s.id,
+		resource_server_identifier: c,
+		permission_name: e.value
+	}));
+	return await e.adapters.rolePermissions.assign(r, s.id, l), s.id;
+}
+//#endregion
+//#region src/hooks/sync.ts
+function S(e, t, n = () => !0) {
+	let { controlPlaneTenantId: r, getChildTenantIds: i, getAdapters: a } = e, o = /* @__PURE__ */ new Map();
+	async function s(e, n, r) {
+		return (await t(e).list(n, {
+			q: `name:${r}`,
+			per_page: 1
+		}))[0] ?? null;
+	}
+	async function c(e) {
+		let n = await i(), o = t(await a(r));
+		await Promise.all(n.map(async (n) => {
+			try {
+				let r = await a(n), i = t(r), c = {
+					...o.transform(e),
+					is_system: !0
+				}, l = await s(r, n, e.name), u = l ? i.getId(l) : void 0;
+				if (l && u) {
+					let e = i.preserveOnUpdate ? i.preserveOnUpdate(l, c) : c;
+					await i.update(n, u, e);
+				} else await i.create(n, c);
+			} catch (t) {
+				console.error(`Failed to sync ${o.listKey} "${e.name}" to tenant "${n}":`, t);
+			}
+		}));
+	}
+	async function l(e) {
+		let n = await i();
+		await Promise.all(n.map(async (n) => {
+			try {
+				let r = await a(n), i = t(r), o = await s(r, n, e), c = o ? i.getId(o) : void 0;
+				o && c && await i.remove(n, c);
+			} catch (t) {
+				console.error(`Failed to delete entity "${e}" from tenant "${n}":`, t);
+			}
+		}));
+	}
+	return {
+		afterCreate: async (e, t) => {
+			e.tenantId === r && n(t) && await c(t);
+		},
+		afterUpdate: async (e, t, i) => {
+			e.tenantId === r && n(i) && await c(i);
+		},
+		beforeDelete: async (e, i) => {
+			if (e.tenantId !== r) return;
+			let a = await t(e.adapters).get(e.tenantId, i);
+			a && n(a) && o.set(i, a);
+		},
+		afterDelete: async (e, t) => {
+			if (e.tenantId !== r) return;
+			let n = o.get(t);
+			n && (o.delete(t), await l(n.name));
+		}
+	};
+}
+function C(e, t, n = () => !0) {
+	let { controlPlaneTenantId: r, getControlPlaneAdapters: i, getAdapters: a } = e;
+	return { async afterCreate(e, o) {
+		if (o.id !== r) try {
+			let e = await i(), c = await a(o.id), l = t(e), u = t(c), d = await s((e) => l.listPaginated(r, e), l.listKey, {
+				cursorField: "id",
+				pageSize: 100
+			});
+			await Promise.all(d.filter((e) => n(e)).map(async (e) => {
+				try {
+					let t = l.transform(e);
+					await u.create(o.id, {
+						...t,
+						is_system: !0
+					});
+				} catch (e) {
+					console.error(`Failed to sync entity to new tenant "${o.id}":`, e);
+				}
+			}));
+		} catch (e) {
+			console.error(`Failed to sync entities to new tenant "${o.id}":`, e);
+		}
+	} };
+}
+var w = (e) => ({
+	list: async (t, n) => (await e.resourceServers.list(t, n)).resource_servers,
+	listPaginated: (t, n) => e.resourceServers.list(t, n),
+	get: (t, n) => e.resourceServers.get(t, n),
+	create: (t, n) => e.resourceServers.create(t, n),
+	update: (t, n, r) => e.resourceServers.update(t, n, r),
+	remove: (t, n) => e.resourceServers.remove(t, n),
+	listKey: "resource_servers",
+	getId: (e) => e.id,
+	transform: (e) => ({
+		id: e.id,
+		name: e.name,
+		identifier: e.identifier,
+		scopes: e.scopes,
+		signing_alg: e.signing_alg,
+		token_lifetime: e.token_lifetime,
+		token_lifetime_for_web: e.token_lifetime_for_web
+	})
+}), T = (e) => ({
+	list: async (t, n) => (await e.roles.list(t, n)).roles,
+	listPaginated: (t, n) => e.roles.list(t, n),
+	get: (t, n) => e.roles.get(t, n),
+	create: (t, n) => e.roles.create(t, n),
+	update: (t, n, r) => e.roles.update(t, n, r),
+	remove: (t, n) => e.roles.remove(t, n),
+	listKey: "roles",
+	getId: (e) => e.id,
+	transform: (e) => ({
+		id: e.id,
+		name: e.name,
+		description: e.description
+	})
 });
-function Q(e) {
-  var t;
-  return ((t = e.metadata) == null ? void 0 : t.sync) !== !1;
-}
-function ve(e) {
-  const { sync: t = {}, filters: r = {} } = e, n = t.resourceServers ?? !0, a = t.roles ?? !0, o = (f) => Q(f) ? r.resourceServers ? r.resourceServers(f) : !0 : !1, c = (f) => Q(f) ? r.roles ? r.roles(f) : !0 : !1, i = n ? H(
-    e,
-    L,
-    o
-  ) : void 0, l = a ? H(e, K, c) : void 0, u = n ? W(
-    e,
-    L,
-    o
-  ) : void 0, s = a ? W(
-    e,
-    K,
-    c
-  ) : void 0, d = a ? {
-    async afterCreate(f, g) {
-      var _;
-      if (g.id !== e.controlPlaneTenantId) {
-        await ((_ = s == null ? void 0 : s.afterCreate) == null ? void 0 : _.call(s, f, g));
-        try {
-          const h = await e.getControlPlaneAdapters(), T = await e.getAdapters(g.id), b = await q(
-            (v) => h.roles.list(
-              e.controlPlaneTenantId,
-              v
-            ),
-            "roles",
-            { cursorField: "id", pageSize: 100 }
-          ), z = /* @__PURE__ */ new Map();
-          for (const v of b.filter(
-            (p) => {
-              var C;
-              return ((C = r.roles) == null ? void 0 : C.call(r, p)) ?? !0;
-            }
-          )) {
-            const p = await m(
-              T,
-              g.id,
-              v.name
-            );
-            p && z.set(v.name, p.id);
-          }
-          for (const v of b.filter(
-            (p) => {
-              var C;
-              return ((C = r.roles) == null ? void 0 : C.call(r, p)) ?? !0;
-            }
-          )) {
-            const p = z.get(v.name);
-            if (p)
-              try {
-                const C = await h.rolePermissions.list(
-                  e.controlPlaneTenantId,
-                  v.id,
-                  {}
-                );
-                C.length > 0 && await T.rolePermissions.assign(
-                  g.id,
-                  p,
-                  C.map((I) => ({
-                    role_id: p,
-                    resource_server_identifier: I.resource_server_identifier,
-                    permission_name: I.permission_name
-                  }))
-                );
-              } catch (C) {
-                console.error(
-                  `Failed to sync permissions for role "${v.name}" to tenant "${g.id}":`,
-                  C
-                );
-              }
-          }
-        } catch (h) {
-          console.error(
-            `Failed to sync role permissions to tenant "${g.id}":`,
-            h
-          );
-        }
-      }
-    }
-  } : void 0;
-  async function m(f, g, _) {
-    return (await f.roles.list(g, {
-      q: `name:${_}`,
-      per_page: 1
-    })).roles[0] ?? null;
-  }
-  return {
-    entityHooks: {
-      resourceServers: i,
-      roles: l
-    },
-    tenantHooks: {
-      async afterCreate(f, g) {
-        const _ = [
-          u == null ? void 0 : u.afterCreate,
-          (d == null ? void 0 : d.afterCreate) ?? (s == null ? void 0 : s.afterCreate)
-        ], h = [];
-        for (const T of _)
-          if (T)
-            try {
-              await T(f, g);
-            } catch (b) {
-              h.push(b instanceof Error ? b : new Error(String(b)));
-            }
-        if (h.length === 1) throw h[0];
-        if (h.length > 1)
-          throw new AggregateError(
-            h,
-            h.map((T) => T.message).join("; ")
-          );
-      }
-    }
-  };
-}
-var P = class extends Error {
-  /**
-   * Creates an instance of `HTTPException`.
-   * @param status - HTTP status code for the exception. Defaults to 500.
-   * @param options - Additional options for the exception.
-   */
-  constructor(t = 500, r) {
-    super(r == null ? void 0 : r.message, { cause: r == null ? void 0 : r.cause });
-    E(this, "res");
-    E(this, "status");
-    this.res = r == null ? void 0 : r.res, this.status = t;
-  }
-  /**
-   * Returns the response object associated with the exception.
-   * If a response object is not provided, a new response is created with the error message and status code.
-   * @returns The response object.
-   */
-  getResponse() {
-    return this.res ? new Response(this.res.body, {
-      status: this.status,
-      headers: this.res.headers
-    }) : new Response(this.message, {
-      status: this.status
-    });
-  }
+function E(e) {
+	return e.metadata?.sync !== !1;
+}
+function D(e) {
+	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => E(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => E(e) ? n.roles ? n.roles(e) : !0 : !1, c = r ? S(e, w, a) : void 0, l = i ? S(e, T, o) : void 0, u = r ? C(e, w, a) : void 0, d = i ? C(e, T, o) : void 0, f = i ? { async afterCreate(t, r) {
+		if (r.id !== e.controlPlaneTenantId) {
+			await d?.afterCreate?.(t, r);
+			try {
+				let t = await e.getControlPlaneAdapters(), i = await e.getAdapters(r.id), a = await s((n) => t.roles.list(e.controlPlaneTenantId, n), "roles", {
+					cursorField: "id",
+					pageSize: 100
+				}), o = /* @__PURE__ */ new Map();
+				for (let e of a.filter((e) => n.roles?.(e) ?? !0)) {
+					let t = await p(i, r.id, e.name);
+					t && o.set(e.name, t.id);
+				}
+				for (let s of a.filter((e) => n.roles?.(e) ?? !0)) {
+					let n = o.get(s.name);
+					if (n) try {
+						let a = await t.rolePermissions.list(e.controlPlaneTenantId, s.id, {});
+						a.length > 0 && await i.rolePermissions.assign(r.id, n, a.map((e) => ({
+							role_id: n,
+							resource_server_identifier: e.resource_server_identifier,
+							permission_name: e.permission_name
+						})));
+					} catch (e) {
+						console.error(`Failed to sync permissions for role "${s.name}" to tenant "${r.id}":`, e);
+					}
+				}
+			} catch (e) {
+				console.error(`Failed to sync role permissions to tenant "${r.id}":`, e);
+			}
+		}
+	} } : void 0;
+	async function p(e, t, n) {
+		return (await e.roles.list(t, {
+			q: `name:${n}`,
+			per_page: 1
+		})).roles[0] ?? null;
+	}
+	return {
+		entityHooks: {
+			resourceServers: c,
+			roles: l
+		},
+		tenantHooks: { async afterCreate(e, t) {
+			let n = [u?.afterCreate, f?.afterCreate ?? d?.afterCreate], r = [];
+			for (let i of n) if (i) try {
+				await i(e, t);
+			} catch (e) {
+				r.push(e instanceof Error ? e : Error(String(e)));
+			}
+			if (r.length === 1) throw r[0];
+			if (r.length > 1) throw AggregateError(r, r.map((e) => e.message).join("; "));
+		} }
+	};
+}
+//#endregion
+//#region ../../node_modules/.pnpm/hono@4.12.25/node_modules/hono/dist/http-exception.js
+var O = class extends Error {
+	res;
+	status;
+	constructor(e = 500, t) {
+		super(t?.message, { cause: t?.cause }), this.res = t?.res, this.status = e;
+	}
+	getResponse() {
+		return this.res ? new Response(this.res.body, {
+			status: this.status,
+			headers: this.res.headers
+		}) : new Response(this.message, { status: this.status });
+	}
 };
-function B(e, t) {
-  const r = new de();
-  return r.openapi(
-    M({
-      tags: ["tenants"],
-      method: "get",
-      path: "/",
-      request: {
-        query: oe
-      },
-      security: [
-        {
-          Bearer: []
-        }
-      ],
-      responses: {
-        200: {
-          content: {
-            "application/json": {
-              schema: S.object({
-                tenants: S.array(D),
-                start: S.number().optional(),
-                limit: S.number().optional(),
-                length: S.number().optional()
-              })
-            }
-          },
-          description: "List of tenants"
-        }
-      }
-    }),
-    async (n) => {
-      var g, _, h, T, b, z;
-      const a = n.req.valid("query"), { page: o, per_page: c, include_totals: i, q: l } = a, u = n.var.user, s = (u == null ? void 0 : u.permissions) || [];
-      if (!!!((u == null ? void 0 : u.org_id) ?? n.var.organization_id) && s.includes("admin:organizations")) {
-        const v = await n.env.data.tenants.list({
-          page: o,
-          per_page: c,
-          include_totals: i,
-          q: l
-        });
-        return i ? n.json({
-          tenants: v.tenants,
-          start: ((g = v.totals) == null ? void 0 : g.start) ?? 0,
-          limit: ((_ = v.totals) == null ? void 0 : _.limit) ?? c,
-          length: v.tenants.length
-        }) : n.json({ tenants: v.tenants });
-      }
-      const w = ((h = e.accessControl) == null ? void 0 : h.controlPlaneTenantId) ?? ((T = n.env.data.multiTenancyConfig) == null ? void 0 : T.controlPlaneTenantId);
-      if (w && !(u != null && u.sub))
-        throw new P(403, {
-          message: "Access denied: token has no subject"
-        });
-      if (w && (u != null && u.sub)) {
-        const p = (await q(
-          (R) => n.env.data.userOrganizations.listUserOrganizations(
-            w,
-            u.sub,
-            R
-          ),
-          "organizations"
-        )).map((R) => R.name);
-        if (p.length === 0)
-          return i ? n.json({
-            tenants: [],
-            start: 0,
-            limit: c ?? 50,
-            length: 0
-          }) : n.json({ tenants: [] });
-        const C = p.length, I = o ?? 0, j = c ?? 50, k = I * j, F = p.slice(k, k + j);
-        if (F.length === 0)
-          return i ? n.json({
-            tenants: [],
-            start: k,
-            limit: j,
-            length: C
-          }) : n.json({ tenants: [] });
-        const A = F.map((R) => `id:${R}`).join(" OR "), y = l ? `(${A}) AND (${l})` : A, $ = await n.env.data.tenants.list({
-          q: y,
-          per_page: j,
-          include_totals: !1
-          // We calculate totals from accessibleTenantIds
-        });
-        return i ? n.json({
-          tenants: $.tenants,
-          start: k,
-          limit: j,
-          length: C
-        }) : n.json({ tenants: $.tenants });
-      }
-      const f = await n.env.data.tenants.list({
-        page: o,
-        per_page: c,
-        include_totals: i,
-        q: l
-      });
-      return i ? n.json({
-        tenants: f.tenants,
-        start: ((b = f.totals) == null ? void 0 : b.start) ?? 0,
-        limit: ((z = f.totals) == null ? void 0 : z.limit) ?? c,
-        length: f.tenants.length
-      }) : n.json({ tenants: f.tenants });
-    }
-  ), r.openapi(
-    M({
-      tags: ["tenants"],
-      method: "post",
-      path: "/",
-      request: {
-        body: {
-          content: {
-            "application/json": {
-              schema: G
-            }
-          }
-        }
-      },
-      security: [
-        {
-          Bearer: []
-        }
-      ],
-      responses: {
-        201: {
-          content: {
-            "application/json": {
-              schema: D
-            }
-          },
-          description: "Tenant created"
-        },
-        400: {
-          description: "Validation error"
-        },
-        409: {
-          description: "Tenant with this ID already exists"
-        }
-      }
-    }),
-    async (n) => {
-      var l, u;
-      const a = n.var.user;
-      if (!(a != null && a.sub))
-        throw new P(401, {
-          message: "Authentication required to create tenants"
-        });
-      let o = n.req.valid("json");
-      const c = {
-        adapters: n.env.data,
-        ctx: n
-      };
-      (l = t.tenants) != null && l.beforeCreate && (o = await t.tenants.beforeCreate(c, o));
-      const i = await n.env.data.tenants.create(o);
-      return (u = t.tenants) != null && u.afterCreate && await t.tenants.afterCreate(c, i), n.json(i, 201);
-    }
-  ), r.openapi(
-    M({
-      tags: ["tenants"],
-      method: "delete",
-      path: "/{id}",
-      request: {
-        params: S.object({
-          id: S.string()
-        })
-      },
-      security: [
-        {
-          Bearer: ["delete:tenants"]
-        }
-      ],
-      responses: {
-        204: {
-          description: "Tenant deleted"
-        },
-        403: {
-          description: "Access denied or cannot delete the control plane"
-        },
-        404: {
-          description: "Tenant not found"
-        }
-      }
-    }),
-    async (n) => {
-      var l, u, s, d;
-      const { id: a } = n.req.valid("param"), o = ((l = e.accessControl) == null ? void 0 : l.controlPlaneTenantId) ?? ((u = n.env.data.multiTenancyConfig) == null ? void 0 : u.controlPlaneTenantId);
-      if (o) {
-        const m = n.var.user;
-        if (!(m != null && m.sub))
-          throw new P(401, {
-            message: "Authentication required"
-          });
-        if (a === o)
-          throw new P(403, {
-            message: "Cannot delete the control plane"
-          });
-        if (!(await q(
-          (g) => n.env.data.userOrganizations.listUserOrganizations(
-            o,
-            m.sub,
-            g
-          ),
-          "organizations"
-        )).some((g) => g.name === a))
-          throw new P(403, {
-            message: "Access denied to this tenant"
-          });
-      }
-      if (!await n.env.data.tenants.get(a))
-        throw new P(404, {
-          message: "Tenant not found"
-        });
-      const i = {
-        adapters: n.env.data,
-        ctx: n
-      };
-      return (s = t.tenants) != null && s.beforeDelete && await t.tenants.beforeDelete(i, a), await n.env.data.tenants.remove(a), (d = t.tenants) != null && d.afterDelete && await t.tenants.afterDelete(i, a), n.body(null, 204);
-    }
-  ), r.openapi(
-    M({
-      tags: ["tenants", "settings"],
-      method: "get",
-      path: "/settings",
-      request: {
-        headers: S.object({
-          "tenant-id": S.string().optional()
-        })
-      },
-      security: [
-        {
-          Bearer: ["read:tenants"]
-        }
-      ],
-      responses: {
-        200: {
-          content: {
-            "application/json": {
-              schema: D
-            }
-          },
-          description: "Current tenant settings"
-        }
-      }
-    }),
-    async (n) => {
-      const a = await n.env.data.tenants.get(n.var.tenant_id);
-      if (!a)
-        throw new P(404, {
-          message: "Tenant not found"
-        });
-      return n.json(a);
-    }
-  ), r.openapi(
-    M({
-      tags: ["tenants", "settings"],
-      method: "patch",
-      path: "/settings",
-      request: {
-        headers: S.object({
-          "tenant-id": S.string().optional()
-        }),
-        body: {
-          content: {
-            "application/json": {
-              schema: S.object(G.shape).partial()
-            }
-          }
-        }
-      },
-      security: [
-        {
-          Bearer: ["update:tenants"]
-        }
-      ],
-      responses: {
-        200: {
-          content: {
-            "application/json": {
-              schema: D
-            }
-          },
-          description: "Updated tenant settings"
-        }
-      }
-    }),
-    async (n) => {
-      const a = n.req.valid("json"), { id: o, ...c } = a, i = await n.env.data.tenants.get(n.var.tenant_id);
-      if (!i)
-        throw new P(404, {
-          message: "Tenant not found"
-        });
-      const l = ie(i, c);
-      await n.env.data.tenants.update(n.var.tenant_id, l);
-      const u = await n.env.data.tenants.get(n.var.tenant_id);
-      if (!u)
-        throw new P(500, {
-          message: "Failed to retrieve updated tenant"
-        });
-      return n.json(u);
-    }
-  ), r;
-}
-function _e(e) {
-  const t = [
-    {
-      pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
-      type: "resource_server"
-    },
-    { pattern: /\/api\/v2\/roles\/([^/]+)$/, type: "role" },
-    { pattern: /\/api\/v2\/connections\/([^/]+)$/, type: "connection" }
-  ];
-  for (const { pattern: r, type: n } of t) {
-    const a = e.match(r);
-    if (a && a[1])
-      return { type: n, id: a[1] };
-  }
-  return null;
-}
-async function Te(e, t, r) {
-  try {
-    switch (r.type) {
-      case "resource_server": {
-        const n = await e.resourceServers.get(t, r.id);
-        return (n == null ? void 0 : n.is_system) === !0;
-      }
-      case "role": {
-        const n = await e.roles.get(t, r.id);
-        return (n == null ? void 0 : n.is_system) === !0;
-      }
-      case "connection": {
-        const n = await e.connections.get(t, r.id);
-        return (n == null ? void 0 : n.is_system) === !0;
-      }
-      default:
-        return !1;
-    }
-  } catch {
-    return !1;
-  }
+//#endregion
+//#region src/routes/tenants.ts
+function k(e, t) {
+	let n = new d();
+	return n.openapi(f({
+		tags: ["tenants"],
+		method: "get",
+		path: "/",
+		request: { query: r },
+		security: [{ Bearer: [] }],
+		responses: { 200: {
+			content: { "application/json": { schema: p.object({
+				tenants: p.array(u),
+				start: p.number().optional(),
+				limit: p.number().optional(),
+				length: p.number().optional()
+			}) } },
+			description: "List of tenants"
+		} }
+	}), async (t) => {
+		let { page: n, per_page: r, include_totals: i, q: a } = t.req.valid("query"), o = t.var.user, c = o?.permissions || [];
+		if (!(o?.org_id ?? t.var.organization_id) && c.includes("admin:organizations")) {
+			let e = await t.env.data.tenants.list({
+				page: n,
+				per_page: r,
+				include_totals: i,
+				q: a
+			});
+			return i ? t.json({
+				tenants: e.tenants,
+				start: e.totals?.start ?? 0,
+				limit: e.totals?.limit ?? r,
+				length: e.tenants.length
+			}) : t.json({ tenants: e.tenants });
+		}
+		let l = e.accessControl?.controlPlaneTenantId ?? t.env.data.multiTenancyConfig?.controlPlaneTenantId;
+		if (l && !o?.sub) throw new O(403, { message: "Access denied: token has no subject" });
+		if (l && o?.sub) {
+			let e = (await s((e) => t.env.data.userOrganizations.listUserOrganizations(l, o.sub, e), "organizations")).map((e) => e.name);
+			if (e.length === 0) return i ? t.json({
+				tenants: [],
+				start: 0,
+				limit: r ?? 50,
+				length: 0
+			}) : t.json({ tenants: [] });
+			let c = e.length, u = n ?? 0, d = r ?? 50, f = u * d, p = e.slice(f, f + d);
+			if (p.length === 0) return i ? t.json({
+				tenants: [],
+				start: f,
+				limit: d,
+				length: c
+			}) : t.json({ tenants: [] });
+			let m = p.map((e) => `id:${e}`).join(" OR "), h = a ? `(${m}) AND (${a})` : m, g = await t.env.data.tenants.list({
+				q: h,
+				per_page: d,
+				include_totals: !1
+			});
+			return i ? t.json({
+				tenants: g.tenants,
+				start: f,
+				limit: d,
+				length: c
+			}) : t.json({ tenants: g.tenants });
+		}
+		let u = await t.env.data.tenants.list({
+			page: n,
+			per_page: r,
+			include_totals: i,
+			q: a
+		});
+		return i ? t.json({
+			tenants: u.tenants,
+			start: u.totals?.start ?? 0,
+			limit: u.totals?.limit ?? r,
+			length: u.tenants.length
+		}) : t.json({ tenants: u.tenants });
+	}), n.openapi(f({
+		tags: ["tenants"],
+		method: "post",
+		path: "/",
+		request: { body: { content: { "application/json": { schema: l } } } },
+		security: [{ Bearer: [] }],
+		responses: {
+			201: {
+				content: { "application/json": { schema: u } },
+				description: "Tenant created"
+			},
+			400: { description: "Validation error" },
+			409: { description: "Tenant with this ID already exists" }
+		}
+	}), async (e) => {
+		if (!e.var.user?.sub) throw new O(401, { message: "Authentication required to create tenants" });
+		let n = e.req.valid("json"), r = {
+			adapters: e.env.data,
+			ctx: e
+		};
+		t.tenants?.beforeCreate && (n = await t.tenants.beforeCreate(r, n));
+		let i = await e.env.data.tenants.create(n);
+		return t.tenants?.afterCreate && await t.tenants.afterCreate(r, i), e.json(i, 201);
+	}), n.openapi(f({
+		tags: ["tenants"],
+		method: "delete",
+		path: "/{id}",
+		request: { params: p.object({ id: p.string() }) },
+		security: [{ Bearer: ["delete:tenants"] }],
+		responses: {
+			204: { description: "Tenant deleted" },
+			403: { description: "Access denied or cannot delete the control plane" },
+			404: { description: "Tenant not found" }
+		}
+	}), async (n) => {
+		let { id: r } = n.req.valid("param"), i = e.accessControl?.controlPlaneTenantId ?? n.env.data.multiTenancyConfig?.controlPlaneTenantId;
+		if (i) {
+			let e = n.var.user;
+			if (!e?.sub) throw new O(401, { message: "Authentication required" });
+			if (r === i) throw new O(403, { message: "Cannot delete the control plane" });
+			let t = n.var.org_name, a = r.toLowerCase(), o = !!t && t.toLowerCase() === a;
+			if (o ||= (await s((t) => n.env.data.userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new O(403, { message: "Access denied to this tenant" });
+		}
+		if (!await n.env.data.tenants.get(r)) throw new O(404, { message: "Tenant not found" });
+		let a = {
+			adapters: n.env.data,
+			ctx: n
+		};
+		return t.tenants?.beforeDelete && await t.tenants.beforeDelete(a, r), await n.env.data.tenants.remove(r), t.tenants?.afterDelete && await t.tenants.afterDelete(a, r), n.body(null, 204);
+	}), n.openapi(f({
+		tags: ["tenants", "settings"],
+		method: "get",
+		path: "/settings",
+		request: { headers: p.object({ "tenant-id": p.string().optional() }) },
+		security: [{ Bearer: ["read:tenants"] }],
+		responses: { 200: {
+			content: { "application/json": { schema: u } },
+			description: "Current tenant settings"
+		} }
+	}), async (e) => {
+		let t = await e.env.data.tenants.get(e.var.tenant_id);
+		if (!t) throw new O(404, { message: "Tenant not found" });
+		return e.json(t);
+	}), n.openapi(f({
+		tags: ["tenants", "settings"],
+		method: "patch",
+		path: "/settings",
+		request: {
+			headers: p.object({ "tenant-id": p.string().optional() }),
+			body: { content: { "application/json": { schema: p.object(l.shape).partial() } } }
+		},
+		security: [{ Bearer: ["update:tenants"] }],
+		responses: { 200: {
+			content: { "application/json": { schema: u } },
+			description: "Updated tenant settings"
+		} }
+	}), async (e) => {
+		let { id: t, ...n } = e.req.valid("json"), r = await e.env.data.tenants.get(e.var.tenant_id);
+		if (!r) throw new O(404, { message: "Tenant not found" });
+		let i = o(r, n);
+		await e.env.data.tenants.update(e.var.tenant_id, i);
+		let a = await e.env.data.tenants.get(e.var.tenant_id);
+		if (!a) throw new O(500, { message: "Failed to retrieve updated tenant" });
+		return e.json(a);
+	}), n;
+}
+//#endregion
+//#region src/middleware/protect-synced.ts
+function A(e) {
+	for (let { pattern: t, type: n } of [
+		{
+			pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
+			type: "resource_server"
+		},
+		{
+			pattern: /\/api\/v2\/roles\/([^/]+)$/,
+			type: "role"
+		},
+		{
+			pattern: /\/api\/v2\/connections\/([^/]+)$/,
+			type: "connection"
+		}
+	]) {
+		let r = e.match(t);
+		if (r && r[1]) return {
+			type: n,
+			id: r[1]
+		};
+	}
+	return null;
+}
+async function j(e, t, n) {
+	try {
+		switch (n.type) {
+			case "resource_server": return (await e.resourceServers.get(t, n.id))?.is_system === !0;
+			case "role": return (await e.roles.get(t, n.id))?.is_system === !0;
+			case "connection": return (await e.connections.get(t, n.id))?.is_system === !0;
+			default: return !1;
+		}
+	} catch {
+		return !1;
+	}
+}
+function M(e) {
+	return {
+		resource_server: "resource server",
+		role: "role",
+		connection: "connection"
+	}[e];
+}
+function N() {
+	return async (e, t) => {
+		if (![
+			"PATCH",
+			"PUT",
+			"DELETE"
+		].includes(e.req.method)) return t();
+		let n = A(e.req.path);
+		if (!n) return t();
+		let r = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
+		if (!r) return t();
+		if (await j(e.env.data, r, n)) throw new O(403, { message: `This ${M(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
+		return t();
+	};
+}
+//#endregion
+//#region src/middleware/settings-inheritance.ts
+function P(e, t) {
+	let n = t.find((t) => t.strategy === e.strategy);
+	if (!n?.options) return e;
+	let r = a.passthrough().parse({
+		...n,
+		...e
+	});
+	return r.options = i.passthrough().parse({
+		...n.options || {},
+		...e.options
+	}), r;
+}
+function F(e, t) {
+	let n = [...t || [], ...e || []];
+	return [...new Set(n)];
+}
+function I(e, t) {
+	if (!t?.length) return e || [];
+	if (!e?.length) return t;
+	let n = /* @__PURE__ */ new Map();
+	for (let e of t) n.set(e.value, e);
+	for (let t of e) n.set(t.value, t);
+	return Array.from(n.values());
+}
+function L(e, t) {
+	return t ? {
+		...e,
+		scopes: I(e.scopes, t.scopes)
+	} : e;
+}
+function R(e, t) {
+	return t ? {
+		...e,
+		callbacks: F(e.callbacks, t.callbacks),
+		web_origins: F(e.web_origins, t.web_origins),
+		allowed_logout_urls: F(e.allowed_logout_urls, t.allowed_logout_urls),
+		allowed_origins: F(e.allowed_origins, t.allowed_origins)
+	} : e;
+}
+function z(e) {
+	let { controlPlaneTenantId: t, controlPlaneClientId: n, resolveControlPlane: r } = e;
+	if (r) return async (e) => r({ tenant_id: e });
+	if (!t) return async () => void 0;
+	let i = {
+		tenantId: t,
+		clientId: n
+	};
+	return async () => i;
 }
-function Ce(e) {
-  return {
-    resource_server: "resource server",
-    role: "role",
-    connection: "connection"
-  }[e];
-}
-function Pe() {
-  return async (e, t) => {
-    if (!["PATCH", "PUT", "DELETE"].includes(e.req.method))
-      return t();
-    const r = _e(e.req.path);
-    if (!r)
-      return t();
-    const n = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
-    if (!n)
-      return t();
-    if (await Te(e.env.data, n, r))
-      throw new P(403, {
-        message: `This ${Ce(r.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
-      });
-    return t();
-  };
-}
-function N(e, t) {
-  const r = t.find(
-    (a) => a.strategy === e.strategy
-  );
-  if (!(r != null && r.options))
-    return e;
-  const n = ce.passthrough().parse({
-    ...r,
-    ...e
-  });
-  return n.options = le.passthrough().parse({
-    ...r.options || {},
-    ...e.options
-  }), n;
-}
-function O(e, t) {
-  const r = [...t || [], ...e || []];
-  return [...new Set(r)];
-}
-function be(e, t) {
-  if (!(t != null && t.length))
-    return e || [];
-  if (!(e != null && e.length))
-    return t;
-  const r = /* @__PURE__ */ new Map();
-  for (const n of t)
-    r.set(n.value, n);
-  for (const n of e)
-    r.set(n.value, n);
-  return Array.from(r.values());
+function B(e, t) {
+	return {
+		...e.resourceServers,
+		get: async (n, r) => {
+			let i = await e.resourceServers.get(n, r);
+			if (!i) return i;
+			let a = await t(n);
+			return !a || n === a.tenantId || !i.is_system ? i : L(i, await e.resourceServers.get(a.tenantId, r));
+		},
+		list: async (n, r) => {
+			let i = await e.resourceServers.list(n, r), a = await t(n);
+			if (!a || n === a.tenantId) return i;
+			let o = a.tenantId, s = i.resource_servers.filter((e) => !!(e.is_system && e.id)).map((e) => e.id);
+			if (s.length === 0) return i;
+			let c = /* @__PURE__ */ new Map();
+			await Promise.all(s.map(async (t) => {
+				let n = await e.resourceServers.get(o, t);
+				n && c.set(t, n);
+			}));
+			let l = i.resource_servers.map((e) => e.is_system && e.id ? L(e, c.get(e.id) ?? null) : e);
+			return {
+				...i,
+				resource_servers: l
+			};
+		}
+	};
 }
 function V(e, t) {
-  return t ? {
-    ...e,
-    scopes: be(
-      e.scopes,
-      t.scopes
-    )
-  } : e;
+	let n = z({
+		controlPlaneTenantId: t.controlPlaneTenantId,
+		resolveControlPlane: t.resolveControlPlane
+	});
+	return {
+		...e,
+		resourceServers: B(e, n)
+	};
+}
+function H(e, t) {
+	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i } = t, a = z({
+		controlPlaneTenantId: n,
+		controlPlaneClientId: r,
+		resolveControlPlane: i
+	});
+	return {
+		...e,
+		multiTenancyConfig: {
+			controlPlaneTenantId: n,
+			controlPlaneClientId: r,
+			resolveControlPlane: i
+		},
+		connections: {
+			...e.connections,
+			get: async (t, n) => {
+				let r = await e.connections.get(t, n);
+				if (!r) return r;
+				let i = await a(t);
+				return !i || t === i.tenantId ? r : P(r, (await e.connections.list(i.tenantId)).connections || []);
+			},
+			list: async (t, n) => {
+				let r = await e.connections.list(t, n), i = await a(t);
+				if (!i || t === i.tenantId) return r;
+				let o = await e.connections.list(i.tenantId), s = r.connections.map((e) => P(e, o.connections || []));
+				return {
+					...r,
+					connections: s
+				};
+			}
+		},
+		clientConnections: {
+			...e.clientConnections,
+			listByClient: async (t, n) => {
+				let r = await e.clientConnections.listByClient(t, n);
+				r.length === 0 && (r = (await e.connections.list(t)).connections || []);
+				let i = await a(t);
+				if (!i || t === i.tenantId) return r;
+				let o = await e.connections.list(i.tenantId);
+				return r.map((e) => P(e, o.connections || []));
+			}
+		},
+		emailProviders: {
+			...e.emailProviders,
+			get: async (t) => {
+				let n = await e.emailProviders.get(t);
+				if (n) return n;
+				let r = await a(t);
+				return !r || t === r.tenantId ? null : e.emailProviders.get(r.tenantId);
+			}
+		},
+		resourceServers: B(e, a),
+		hooks: W(e, a)
+	};
 }
-function Oe(e, t) {
-  return t ? {
-    ...e,
-    callbacks: O(e.callbacks, t.callbacks),
-    web_origins: O(
-      e.web_origins,
-      t.web_origins
-    ),
-    allowed_logout_urls: O(
-      e.allowed_logout_urls,
-      t.allowed_logout_urls
-    ),
-    allowed_origins: O(
-      e.allowed_origins,
-      t.allowed_origins
-    )
-  } : e;
-}
-function Z(e) {
-  const { controlPlaneTenantId: t, controlPlaneClientId: r, resolveControlPlane: n } = e;
-  if (n)
-    return async (o) => n({ tenant_id: o });
-  if (!t)
-    return async () => {
-    };
-  const a = {
-    tenantId: t,
-    clientId: r
-  };
-  return async () => a;
-}
-function x(e, t) {
-  return {
-    ...e.resourceServers,
-    get: async (r, n) => {
-      const a = await e.resourceServers.get(
-        r,
-        n
-      );
-      if (!a)
-        return a;
-      const o = await t(r);
-      if (!o || r === o.tenantId || !a.is_system)
-        return a;
-      const c = await e.resourceServers.get(
-        o.tenantId,
-        n
-      );
-      return V(
-        a,
-        c
-      );
-    },
-    list: async (r, n) => {
-      const a = await e.resourceServers.list(r, n), o = await t(r);
-      if (!o || r === o.tenantId)
-        return a;
-      const c = o.tenantId, i = a.resource_servers.filter(
-        (s) => !!(s.is_system && s.id)
-      ).map((s) => s.id);
-      if (i.length === 0)
-        return a;
-      const l = /* @__PURE__ */ new Map();
-      await Promise.all(
-        i.map(async (s) => {
-          const d = await e.resourceServers.get(c, s);
-          d && l.set(s, d);
-        })
-      );
-      const u = a.resource_servers.map(
-        (s) => s.is_system && s.id ? V(
-          s,
-          l.get(s.id) ?? null
-        ) : s
-      );
-      return {
-        ...a,
-        resource_servers: u
-      };
-    }
-  };
-}
-function Ie(e, t) {
-  const r = Z({
-    controlPlaneTenantId: t.controlPlaneTenantId,
-    resolveControlPlane: t.resolveControlPlane
-  });
-  return {
-    ...e,
-    resourceServers: x(
-      e,
-      r
-    )
-  };
-}
-function Ae(e, t) {
-  const { controlPlaneTenantId: r, controlPlaneClientId: n, resolveControlPlane: a } = t, o = Z({
-    controlPlaneTenantId: r,
-    controlPlaneClientId: n,
-    resolveControlPlane: a
-  });
-  return {
-    ...e,
-    // Store the static config for use by tenants route access control.
-    // Per-tenant inheritance overrides do NOT affect access-control values —
-    // those intentionally use a single global control plane id. The resolver
-    // is exposed here so runtime helpers (e.g. `getEnrichedClient`) can
-    // consult it before merging control-plane URLs.
-    multiTenancyConfig: {
-      controlPlaneTenantId: r,
-      controlPlaneClientId: n,
-      resolveControlPlane: a
-    },
-    connections: {
-      ...e.connections,
-      get: async (c, i) => {
-        const l = await e.connections.get(
-          c,
-          i
-        );
-        if (!l)
-          return l;
-        const u = await o(c);
-        if (!u || c === u.tenantId)
-          return l;
-        const s = await e.connections.list(
-          u.tenantId
-        );
-        return N(
-          l,
-          s.connections || []
-        );
-      },
-      list: async (c, i) => {
-        const l = await e.connections.list(c, i), u = await o(c);
-        if (!u || c === u.tenantId)
-          return l;
-        const s = await e.connections.list(
-          u.tenantId
-        ), d = l.connections.map(
-          (m) => N(
-            m,
-            s.connections || []
-          )
-        );
-        return {
-          ...l,
-          connections: d
-        };
-      }
-    },
-    clientConnections: {
-      ...e.clientConnections,
-      listByClient: async (c, i) => {
-        let l = await e.clientConnections.listByClient(
-          c,
-          i
-        );
-        l.length === 0 && (l = (await e.connections.list(c)).connections || []);
-        const u = await o(c);
-        if (!u || c === u.tenantId)
-          return l;
-        const s = await e.connections.list(
-          u.tenantId
-        );
-        return l.map(
-          (d) => N(
-            d,
-            s.connections || []
-          )
-        );
-      }
-    },
-    // Note: clients.get / getByClientId are intentionally NOT wrapped here.
-    // Storage reads must return the tenant's own stored URLs so that the
-    // management API and DCR don't echo control-plane callbacks back on
-    // update. Runtime URL merging for auth flows happens in
-    // `getEnrichedClient` (packages/authhero/src/helpers/client.ts).
-    emailProviders: {
-      ...e.emailProviders,
-      get: async (c) => {
-        const i = await e.emailProviders.get(c);
-        if (i)
-          return i;
-        const l = await o(c);
-        return !l || c === l.tenantId ? null : e.emailProviders.get(l.tenantId);
-      }
-    },
-    resourceServers: x(
-      e,
-      o
-    ),
-    hooks: Se(e, o)
-    // Note: Additional adapters can be extended here for runtime fallback:
-    // - promptSettings: Fall back to control plane prompts
-    // - branding: Fall back to control plane branding/themes
-  };
+function U(e) {
+	if (!e || typeof e != "object") return !1;
+	let t = e.metadata;
+	return !t || typeof t != "object" ? !1 : t.inheritable === !0;
+}
+function W(e, t) {
+	return {
+		...e.hooks,
+		list: async (n, r) => {
+			let i = await e.hooks.list(n, r), a = await t(n);
+			if (!a || n === a.tenantId) return i;
+			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(U);
+			if (o.length === 0) return i;
+			let s = new Set((i.hooks || []).map((e) => e.hook_id)), c = o.filter((e) => !s.has(e.hook_id));
+			return {
+				...i,
+				hooks: [...i.hooks || [], ...c],
+				length: typeof i.length == "number" ? i.length + c.length : i.length
+			};
+		},
+		get: async (n, r) => {
+			let i = await e.hooks.get(n, r);
+			if (i) return i;
+			let a = await t(n);
+			if (!a || n === a.tenantId) return i;
+			let o = await e.hooks.get(a.tenantId, r);
+			return o && U(o) ? o : null;
+		}
+	};
+}
+function G(e, t) {
+	return H(e, t);
+}
+//#endregion
+//#region src/middleware/index.ts
+function K(e) {
+	return async (t, n) => {
+		let r = t.var.user;
+		return r?.tenant_id === e && r.org_name && t.set("tenant_id", r.org_name), n();
+	};
+}
+function q(e) {
+	return async (n, r) => {
+		if (!e.accessControl) return r();
+		let { controlPlaneTenantId: i } = e.accessControl, a = n.var.org_name, o = n.var.organization_id, s = a || o, c = n.var.tenant_id, l = n.var.user, u = (l?.aud ? Array.isArray(l.aud) ? l.aud : [l.aud] : []).includes(t);
+		if (!c && s && u && (n.set("tenant_id", s), c = s), !c) throw new O(400, { message: "Tenant ID not found in request" });
+		if (!h(o, c, i, a)) throw new O(403, { message: `Access denied to tenant ${c}` });
+		return r();
+	};
 }
 function J(e) {
-  if (!e || typeof e != "object") return !1;
-  const t = e.metadata;
-  return !t || typeof t != "object" ? !1 : t.inheritable === !0;
+	return async (t, n) => {
+		if (!e.subdomainRouting) return n();
+		let { baseDomain: r, reservedSubdomains: i = [], resolveSubdomain: a } = e.subdomainRouting, o = t.req.header("x-forwarded-host") || t.req.header("host") || "", s = null;
+		if (o.endsWith(r)) {
+			let e = o.slice(0, -(r.length + 1));
+			e && !e.includes(".") && (s = e);
+		}
+		if (s && i.includes(s) && (s = null), !s) return e.accessControl && t.set("tenant_id", e.accessControl.controlPlaneTenantId), n();
+		let c = null;
+		if (a) c = await a(s);
+		else if (e.subdomainRouting.useOrganizations !== !1 && e.accessControl) try {
+			let n = await t.env.data.organizations.get(e.accessControl.controlPlaneTenantId, s);
+			n && (c = n.id);
+		} catch {}
+		if (!c) throw new O(404, { message: `Tenant not found for subdomain: ${s}` });
+		return t.set("tenant_id", c), n();
+	};
 }
-function Se(e, t) {
-  return {
-    ...e.hooks,
-    list: async (r, n) => {
-      const a = await e.hooks.list(r, n), o = await t(r);
-      if (!o || r === o.tenantId)
-        return a;
-      const i = ((await e.hooks.list(
-        o.tenantId,
-        n
-      )).hooks || []).filter(
-        J
-      );
-      if (i.length === 0)
-        return a;
-      const l = new Set((a.hooks || []).map((s) => s.hook_id)), u = i.filter((s) => !l.has(s.hook_id));
-      return {
-        ...a,
-        hooks: [...a.hooks || [], ...u],
-        length: typeof a.length == "number" ? a.length + u.length : a.length
-      };
-    },
-    get: async (r, n) => {
-      const a = await e.hooks.get(r, n);
-      if (a) return a;
-      const o = await t(r);
-      if (!o || r === o.tenantId)
-        return a;
-      const c = await e.hooks.get(
-        o.tenantId,
-        n
-      );
-      return c && J(c) ? c : null;
-    }
-  };
-}
-function ee(e, t) {
-  return Ae(e, t);
-}
-function Re(e) {
-  return async (t, r) => {
-    const n = t.var.user;
-    return (n == null ? void 0 : n.tenant_id) === e && n.org_name && t.set("tenant_id", n.org_name), r();
-  };
-}
-function ze(e) {
-  return async (t, r) => {
-    if (!e.accessControl)
-      return r();
-    const { controlPlaneTenantId: n } = e.accessControl, a = t.var.org_name, o = t.var.organization_id, c = a || o;
-    let i = t.var.tenant_id;
-    const l = t.var.user, s = (l != null && l.aud ? Array.isArray(l.aud) ? l.aud : [l.aud] : []).includes(X);
-    if (!i && c && s && (t.set("tenant_id", c), i = c), !i)
-      throw new P(400, {
-        message: "Tenant ID not found in request"
-      });
-    if (!me(
-      o,
-      i,
-      n,
-      a
-    ))
-      throw new P(403, {
-        message: `Access denied to tenant ${i}`
-      });
-    return r();
-  };
-}
-function $e(e) {
-  return async (t, r) => {
-    if (!e.subdomainRouting)
-      return r();
-    const {
-      baseDomain: n,
-      reservedSubdomains: a = [],
-      resolveSubdomain: o
-    } = e.subdomainRouting, c = t.req.header("x-forwarded-host") || t.req.header("host") || "";
-    let i = null;
-    if (c.endsWith(n)) {
-      const u = c.slice(0, -(n.length + 1));
-      u && !u.includes(".") && (i = u);
-    }
-    if (i && a.includes(i) && (i = null), !i)
-      return e.accessControl && t.set("tenant_id", e.accessControl.controlPlaneTenantId), r();
-    let l = null;
-    if (o)
-      l = await o(i);
-    else if (e.subdomainRouting.useOrganizations !== !1 && e.accessControl)
-      try {
-        const u = await t.env.data.organizations.get(
-          e.accessControl.controlPlaneTenantId,
-          i
-        );
-        u && (l = u.id);
-      } catch {
-      }
-    if (!l)
-      throw new P(404, {
-        message: `Tenant not found for subdomain: ${i}`
-      });
-    return t.set("tenant_id", l), r();
-  };
+function Y(e) {
+	return async (t, n) => {
+		if (!e.databaseIsolation) return n();
+		let r = t.var.tenant_id;
+		if (!r) throw new O(400, { message: "Tenant ID not found in request" });
+		try {
+			let n = await e.databaseIsolation.getAdapters(r);
+			t.env.data = n;
+		} catch (e) {
+			throw console.error(`Failed to resolve database for tenant ${r}:`, e), new O(500, { message: "Failed to resolve tenant database" });
+		}
+		return n();
+	};
+}
+function X(e) {
+	let t = J(e), n = q(e), r = Y(e);
+	return async (e, i) => (await t(e, async () => {}), await n(e, async () => {}), await r(e, async () => {}), i());
+}
+//#endregion
+//#region src/init.ts
+function Z(e) {
+	let { dataAdapter: t, controlPlane: n, controlPlane: { tenantId: r = "control_plane", clientId: i } = {}, resolveControlPlane: a, sync: o = {
+		resourceServers: !0,
+		roles: !0
+	}, defaultPermissions: l = ["tenant:admin"], requireOrganizationMatch: u = !1, managementApiExtensions: d = [], entityHooks: f, getChildTenantIds: p, getAdapters: m, ...h } = e;
+	if (a && !n) throw Error("initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it.");
+	let g = t, _ = t;
+	n && (g = G(t, {
+		controlPlaneTenantId: r,
+		controlPlaneClientId: i,
+		resolveControlPlane: a
+	}), _ = {
+		...V(t, {
+			controlPlaneTenantId: r,
+			resolveControlPlane: a
+		}),
+		multiTenancyConfig: {
+			controlPlaneTenantId: r,
+			controlPlaneClientId: i,
+			resolveControlPlane: a
+		}
+	});
+	let y = o !== !1, b = y ? {
+		resourceServers: o.resourceServers ?? !0,
+		roles: o.roles ?? !0
+	} : {
+		resourceServers: !1,
+		roles: !1
+	}, { entityHooks: x, tenantHooks: S } = D({
+		controlPlaneTenantId: r,
+		getChildTenantIds: p ?? (async () => (await s((e) => g.tenants.list(e), "tenants", {
+			cursorField: "id",
+			pageSize: 100
+		})).filter((e) => e.id !== r).map((e) => e.id)),
+		getAdapters: m ?? (async () => g),
+		getControlPlaneAdapters: async () => g,
+		sync: b
+	}), C = {
+		resourceServers: [x.resourceServers, ...f?.resourceServers ?? []],
+		roles: [x.roles, ...f?.roles ?? []],
+		connections: f?.connections ?? [],
+		tenants: f?.tenants ?? [],
+		rolePermissions: f?.rolePermissions ?? []
+	}, w = v({ accessControl: {
+		controlPlaneTenantId: r,
+		requireOrganizationMatch: u,
+		defaultPermissions: l
+	} }), T = k({ accessControl: {
+		controlPlaneTenantId: r,
+		requireOrganizationMatch: u,
+		defaultPermissions: l
+	} }, { tenants: {
+		async beforeCreate(e, t) {
+			return w.beforeCreate && (t = await w.beforeCreate(e, t)), S.beforeCreate && (t = await S.beforeCreate(e, t)), t;
+		},
+		async afterCreate(e, t) {
+			await w.afterCreate?.(e, t), await S.afterCreate?.(e, t);
+		},
+		async beforeDelete(e, t) {
+			await w.beforeDelete?.(e, t), await S.beforeDelete?.(e, t);
+		}
+	} }), { app: E } = c({
+		dataAdapter: g,
+		managementDataAdapter: _,
+		...h,
+		entityHooks: C,
+		managementApiExtensions: [...d, {
+			path: "/tenants",
+			router: T
+		}]
+	});
+	return E.use("/api/v2/*", K(r)), y && E.use("/api/v2/*", N()), {
+		app: E,
+		controlPlaneTenantId: r
+	};
+}
+//#endregion
+//#region src/plugin.ts
+function ee(e) {
+	let t = Q(e);
+	return {
+		name: "multi-tenancy",
+		middleware: X(e),
+		hooks: t,
+		routes: [{
+			path: "/management",
+			handler: k(e, t)
+		}],
+		onRegister: async () => {
+			console.log("Multi-tenancy plugin registered"), e.accessControl && console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`), e.subdomainRouting && console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`), e.databaseIsolation && console.log("  - Database isolation enabled");
+		}
+	};
+}
+//#endregion
+//#region src/index.ts
+function Q(e) {
+	let t = e.accessControl ? m(e.accessControl) : {}, n = e.databaseIsolation ? g(e.databaseIsolation) : {}, r = v(e);
+	return {
+		...t,
+		...n,
+		tenants: r
+	};
 }
-function je(e) {
-  return async (t, r) => {
-    if (!e.databaseIsolation)
-      return r();
-    const n = t.var.tenant_id;
-    if (!n)
-      throw new P(400, {
-        message: "Tenant ID not found in request"
-      });
-    try {
-      const a = await e.databaseIsolation.getAdapters(n);
-      t.env.data = a;
-    } catch (a) {
-      throw console.error(
-        `Failed to resolve database for tenant ${n}:`,
-        a
-      ), new P(500, {
-        message: "Failed to resolve tenant database"
-      });
-    }
-    return r();
-  };
+function $(t) {
+	let n = new e(), r = Q(t);
+	return n.route("/tenants", k(t, r)), n;
 }
 function te(e) {
-  const t = $e(e), r = ze(e), n = je(e);
-  return async (a, o) => (await t(a, async () => {
-  }), await r(a, async () => {
-  }), await n(a, async () => {
-  }), o());
-}
-function Ee(e) {
-  const {
-    dataAdapter: t,
-    controlPlane: r,
-    controlPlane: {
-      tenantId: n = "control_plane",
-      clientId: a
-    } = {},
-    resolveControlPlane: o,
-    sync: c = { resourceServers: !0, roles: !0 },
-    defaultPermissions: i = ["tenant:admin"],
-    requireOrganizationMatch: l = !1,
-    managementApiExtensions: u = [],
-    entityHooks: s,
-    getChildTenantIds: d,
-    getAdapters: m,
-    ...w
-  } = e;
-  if (o && !r)
-    throw new Error(
-      "initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it."
-    );
-  let f = t, g = t;
-  r && (f = ee(t, {
-    controlPlaneTenantId: n,
-    controlPlaneClientId: a,
-    resolveControlPlane: o
-  }), g = {
-    ...Ie(t, {
-      controlPlaneTenantId: n,
-      resolveControlPlane: o
-    }),
-    multiTenancyConfig: {
-      controlPlaneTenantId: n,
-      controlPlaneClientId: a,
-      resolveControlPlane: o
-    }
-  });
-  const _ = c !== !1, h = _ ? {
-    resourceServers: c.resourceServers ?? !0,
-    roles: c.roles ?? !0
-  } : { resourceServers: !1, roles: !1 }, z = {
-    controlPlaneTenantId: n,
-    getChildTenantIds: d ?? (async () => (await q(
-      (y) => f.tenants.list(y),
-      "tenants",
-      { cursorField: "id", pageSize: 100 }
-    )).filter((y) => y.id !== n).map((y) => y.id)),
-    getAdapters: m ?? (async () => f),
-    getControlPlaneAdapters: async () => f,
-    sync: h
-  }, { entityHooks: v, tenantHooks: p } = ve(z), C = {
-    resourceServers: [
-      v.resourceServers,
-      ...(s == null ? void 0 : s.resourceServers) ?? []
-    ],
-    roles: [v.roles, ...(s == null ? void 0 : s.roles) ?? []],
-    connections: (s == null ? void 0 : s.connections) ?? [],
-    tenants: (s == null ? void 0 : s.tenants) ?? [],
-    rolePermissions: (s == null ? void 0 : s.rolePermissions) ?? []
-  }, I = Y({
-    accessControl: {
-      controlPlaneTenantId: n,
-      requireOrganizationMatch: l,
-      defaultPermissions: i
-    }
-  }), k = B(
-    {
-      accessControl: {
-        controlPlaneTenantId: n,
-        requireOrganizationMatch: l,
-        defaultPermissions: i
-      }
-    },
-    { tenants: {
-      async beforeCreate(A, y) {
-        return I.beforeCreate && (y = await I.beforeCreate(A, y)), p.beforeCreate && (y = await p.beforeCreate(A, y)), y;
-      },
-      async afterCreate(A, y) {
-        var $, R;
-        await (($ = I.afterCreate) == null ? void 0 : $.call(I, A, y)), await ((R = p.afterCreate) == null ? void 0 : R.call(p, A, y));
-      },
-      async beforeDelete(A, y) {
-        var $, R;
-        await (($ = I.beforeDelete) == null ? void 0 : $.call(I, A, y)), await ((R = p.beforeDelete) == null ? void 0 : R.call(p, A, y));
-      }
-    } }
-  ), { app: F } = ue({
-    dataAdapter: f,
-    managementDataAdapter: g,
-    ...w,
-    entityHooks: C,
-    managementApiExtensions: [
-      ...u,
-      { path: "/tenants", router: k }
-    ]
-  });
-  return F.use(
-    "/api/v2/*",
-    Re(n)
-  ), _ && F.use("/api/v2/*", Pe()), { app: F, controlPlaneTenantId: n };
-}
-function Ne(e) {
-  const t = U(e);
-  return {
-    name: "multi-tenancy",
-    // Apply multi-tenancy middleware for subdomain routing, database resolution, etc.
-    middleware: te(e),
-    // Provide lifecycle hooks
-    hooks: t,
-    // Mount tenant management routes
-    routes: [
-      {
-        path: "/management",
-        handler: B(e, t)
-      }
-    ],
-    // Called when plugin is registered
-    onRegister: async () => {
-      console.log("Multi-tenancy plugin registered"), e.accessControl && console.log(
-        `  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`
-      ), e.subdomainRouting && console.log(
-        `  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`
-      ), e.databaseIsolation && console.log("  - Database isolation enabled");
-    }
-  };
-}
-function U(e) {
-  const t = e.accessControl ? fe(e.accessControl) : {}, r = e.databaseIsolation ? ge(e.databaseIsolation) : {}, n = Y(e);
-  return {
-    ...t,
-    ...r,
-    tenants: n
-  };
-}
-function ke(e) {
-  const t = new ae(), r = U(e);
-  return t.route("/tenants", B(e, r)), t;
-}
-function Be(e) {
-  return {
-    hooks: U(e),
-    middleware: te(e),
-    app: ke(e),
-    config: e,
-    /**
-     * Wraps data adapters with runtime fallback from the control plane.
-     * Uses the controlPlaneTenantId from the multi-tenancy config.
-     *
-     * @param adapters - Base data adapters to wrap
-     * @param additionalConfig - Additional config (controlPlaneClientId, etc.)
-     * @returns Wrapped adapters with runtime fallback
-     */
-    wrapAdapters: (t, r) => {
-      var n;
-      return ee(t, {
-        controlPlaneTenantId: (n = e.accessControl) == null ? void 0 : n.controlPlaneTenantId,
-        controlPlaneClientId: r == null ? void 0 : r.controlPlaneClientId
-      });
-    }
-  };
-}
-export {
-  fe as createAccessControlHooks,
-  ze as createAccessControlMiddleware,
-  Re as createControlPlaneTenantMiddleware,
-  ge as createDatabaseHooks,
-  je as createDatabaseMiddleware,
-  ke as createMultiTenancy,
-  U as createMultiTenancyHooks,
-  te as createMultiTenancyMiddleware,
-  Ne as createMultiTenancyPlugin,
-  Pe as createProtectSyncedMiddleware,
-  Y as createProvisioningHooks,
-  Ae as createRuntimeFallbackAdapter,
-  $e as createSubdomainMiddleware,
-  ve as createSyncHooks,
-  B as createTenantsOpenAPIRouter,
-  Ee as initMultiTenant,
-  Oe as mergeClientWithFallback,
-  Be as setupMultiTenancy,
-  me as validateTenantAccess,
-  ee as withRuntimeFallback,
-  Ie as withSystemResourceServerInheritance
-};
+	return {
+		hooks: Q(e),
+		middleware: X(e),
+		app: $(e),
+		config: e,
+		wrapAdapters: (t, n) => G(t, {
+			controlPlaneTenantId: e.accessControl?.controlPlaneTenantId,
+			controlPlaneClientId: n?.controlPlaneClientId
+		})
+	};
+}
+//#endregion
+export { m as createAccessControlHooks, q as createAccessControlMiddleware, K as createControlPlaneTenantMiddleware, g as createDatabaseHooks, Y as createDatabaseMiddleware, $ as createMultiTenancy, Q as createMultiTenancyHooks, X as createMultiTenancyMiddleware, ee as createMultiTenancyPlugin, N as createProtectSyncedMiddleware, v as createProvisioningHooks, H as createRuntimeFallbackAdapter, J as createSubdomainMiddleware, D as createSyncHooks, k as createTenantsOpenAPIRouter, Z as initMultiTenant, R as mergeClientWithFallback, te as setupMultiTenancy, h as validateTenantAccess, G as withRuntimeFallback, V as withSystemResourceServerInheritance };