@authhero/multi-tenancy 14.23.1 → 14.24.1

package/dist/multi-tenancy.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("hono"),t=require("authhero"),n=require("@hono/zod-openapi");function r(e){let{controlPlaneTenantId:t,requireOrganizationMatch:n=!0}=e;return{async onTenantAccessValidation(e,r){if(r===t)return!0;if(n){let t=e.var.org_name,n=e.var.organization_id,i=t||n;return i?i.toLowerCase()===r.toLowerCase():!1}return!0}}}function i(e,t,n,r){if(t===n)return!0;let i=r||e;return i?i.toLowerCase()===t.toLowerCase():!1}function a(e){return{async resolveDataAdapters(t){try{return await e.getAdapters(t)}catch(e){console.error(`Failed to resolve data adapters for tenant ${t}:`,e);return}}}}function o(e){return`urn:authhero:tenant:${e.toLowerCase()}`}function s(e){return{async beforeCreate(e,t){return!t.audience&&t.id?{...t,audience:o(t.id)}:t},async afterCreate(t,n){let{accessControl:r,databaseIsolation:i}=e;r&&t.ctx&&await c(t,n,r),i?.onProvision&&await i.onProvision(n.id)},async beforeDelete(t,n){let{accessControl:r,databaseIsolation:i}=e;if(r)try{let e=(await t.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find(e=>e.name===n);e&&await t.adapters.organizations.remove(r.controlPlaneTenantId,e.id)}catch(e){console.warn(`Failed to remove organization for tenant ${n}:`,e)}if(i?.onDeprovision)try{await i.onDeprovision(n)}catch(e){console.warn(`Failed to deprovision database for tenant ${n}:`,e)}}}}async function c(e,t,n){let{controlPlaneTenantId:r,defaultPermissions:i,defaultRoles:a,issuer:o,adminRoleName:s=`Tenant Admin`,adminRoleDescription:c=`Full access to all tenant management operations`,addCreatorToOrganization:d=!0}=n,f=await e.adapters.organizations.create(r,{name:t.id,display_name:t.friendly_name||t.id}),p;if(o&&(p=await u(e,r,s,c)),d&&e.ctx){let t=e.ctx.var.user;if(t?.sub&&!await l(e,r,t.sub))try{await e.adapters.userOrganizations.create(r,{user_id:t.sub,organization_id:f.id}),p&&await e.adapters.userRoles.create(r,t.sub,p,f.id)}catch(e){console.warn(`Failed to add creator ${t.sub} to organization ${f.id}:`,e)}}a&&a.length>0&&console.log(`Would assign roles ${a.join(`, `)} to organization ${f.id}`),i&&i.length>0&&console.log(`Would grant permissions ${i.join(`, `)} to organization ${f.id}`)}async function l(e,t,n){let r=await e.adapters.userRoles.list(t,n,void 0,``);for(let n of r)if((await e.adapters.rolePermissions.list(t,n.id,{per_page:1e3})).some(e=>e.permission_name===`admin:organizations`))return!0;return!1}async function u(e,n,r,i){let a=(await e.adapters.roles.list(n,{})).roles.find(e=>e.name===r);if(a)return a.id;let o=await e.adapters.roles.create(n,{name:r,description:i}),s=t.MANAGEMENT_API_AUDIENCE,c=t.MANAGEMENT_API_SCOPES.map(e=>({role_id:o.id,resource_server_identifier:s,permission_name:e.value}));return await e.adapters.rolePermissions.assign(n,o.id,c),o.id}function d(e,t,n=()=>!0){let{controlPlaneTenantId:r,getChildTenantIds:i,getAdapters:a}=e,o=new Map;async function s(e,n,r){return(await t(e).list(n,{q:`name:${r}`,per_page:1}))[0]??null}async function c(e){let n=await i(),o=t(await a(r));await Promise.all(n.map(async n=>{try{let r=await a(n),i=t(r),c={...o.transform(e),is_system:!0},l=await s(r,n,e.name),u=l?i.getId(l):void 0;if(l&&u){let e=i.preserveOnUpdate?i.preserveOnUpdate(l,c):c;await i.update(n,u,e)}else await i.create(n,c)}catch(t){console.error(`Failed to sync ${o.listKey} "${e.name}" to tenant "${n}":`,t)}}))}async function l(e){let n=await i();await Promise.all(n.map(async n=>{try{let r=await a(n),i=t(r),o=await s(r,n,e),c=o?i.getId(o):void 0;o&&c&&await i.remove(n,c)}catch(t){console.error(`Failed to delete entity "${e}" from tenant "${n}":`,t)}}))}return{afterCreate:async(e,t)=>{e.tenantId===r&&n(t)&&await c(t)},afterUpdate:async(e,t,i)=>{e.tenantId===r&&n(i)&&await c(i)},beforeDelete:async(e,i)=>{if(e.tenantId!==r)return;let a=await t(e.adapters).get(e.tenantId,i);a&&n(a)&&o.set(i,a)},afterDelete:async(e,t)=>{if(e.tenantId!==r)return;let n=o.get(t);n&&(o.delete(t),await l(n.name))}}}function f(e,n,r=()=>!0){let{controlPlaneTenantId:i,getControlPlaneAdapters:a,getAdapters:o}=e;return{async afterCreate(e,s){if(s.id!==i)try{let e=await a(),c=await o(s.id),l=n(e),u=n(c),d=await(0,t.fetchAll)(e=>l.listPaginated(i,e),l.listKey,{cursorField:`id`,pageSize:100});await Promise.all(d.filter(e=>r(e)).map(async e=>{try{let t=l.transform(e);await u.create(s.id,{...t,is_system:!0})}catch(e){console.error(`Failed to sync entity to new tenant "${s.id}":`,e)}}))}catch(e){console.error(`Failed to sync entities to new tenant "${s.id}":`,e)}}}}var p=e=>({list:async(t,n)=>(await e.resourceServers.list(t,n)).resource_servers,listPaginated:(t,n)=>e.resourceServers.list(t,n),get:(t,n)=>e.resourceServers.get(t,n),create:(t,n)=>e.resourceServers.create(t,n),update:(t,n,r)=>e.resourceServers.update(t,n,r),remove:(t,n)=>e.resourceServers.remove(t,n),listKey:`resource_servers`,getId:e=>e.id,transform:e=>({id:e.id,name:e.name,identifier:e.identifier,scopes:e.scopes,signing_alg:e.signing_alg,token_lifetime:e.token_lifetime,token_lifetime_for_web:e.token_lifetime_for_web})}),m=e=>({list:async(t,n)=>(await e.roles.list(t,n)).roles,listPaginated:(t,n)=>e.roles.list(t,n),get:(t,n)=>e.roles.get(t,n),create:(t,n)=>e.roles.create(t,n),update:(t,n,r)=>e.roles.update(t,n,r),remove:(t,n)=>e.roles.remove(t,n),listKey:`roles`,getId:e=>e.id,transform:e=>({id:e.id,name:e.name,description:e.description})});function h(e){return e.metadata?.sync!==!1}function g(e){let{sync:n={},filters:r={}}=e,i=n.resourceServers??!0,a=n.roles??!0,o=e=>h(e)?r.resourceServers?r.resourceServers(e):!0:!1,s=e=>h(e)?r.roles?r.roles(e):!0:!1,c=i?d(e,p,o):void 0,l=a?d(e,m,s):void 0,u=i?f(e,p,o):void 0,g=a?f(e,m,s):void 0,_=a?{async afterCreate(n,i){if(i.id!==e.controlPlaneTenantId){await g?.afterCreate?.(n,i);try{let n=await e.getControlPlaneAdapters(),a=await e.getAdapters(i.id),o=await(0,t.fetchAll)(t=>n.roles.list(e.controlPlaneTenantId,t),`roles`,{cursorField:`id`,pageSize:100}),s=new Map;for(let e of o.filter(e=>r.roles?.(e)??!0)){let t=await v(a,i.id,e.name);t&&s.set(e.name,t.id)}for(let t of o.filter(e=>r.roles?.(e)??!0)){let r=s.get(t.name);if(r)try{let o=await n.rolePermissions.list(e.controlPlaneTenantId,t.id,{});o.length>0&&await a.rolePermissions.assign(i.id,r,o.map(e=>({role_id:r,resource_server_identifier:e.resource_server_identifier,permission_name:e.permission_name})))}catch(e){console.error(`Failed to sync permissions for role "${t.name}" to tenant "${i.id}":`,e)}}}catch(e){console.error(`Failed to sync role permissions to tenant "${i.id}":`,e)}}}}:void 0;async function v(e,t,n){return(await e.roles.list(t,{q:`name:${n}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:c,roles:l},tenantHooks:{async afterCreate(e,t){let n=[u?.afterCreate,_?.afterCreate??g?.afterCreate],r=[];for(let i of n)if(i)try{await i(e,t)}catch(e){r.push(e instanceof Error?e:Error(String(e)))}if(r.length===1)throw r[0];if(r.length>1)throw AggregateError(r,r.map(e=>e.message).join(`; `))}}}}var _=class extends Error{res;status;constructor(e=500,t){super(t?.message,{cause:t?.cause}),this.res=t?.res,this.status=e}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function v(e,r){let i=new n.OpenAPIHono;return i.openapi((0,n.createRoute)({tags:[`tenants`],method:`get`,path:`/`,request:{query:t.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:n.z.object({tenants:n.z.array(t.tenantSchema),start:n.z.number().optional(),limit:n.z.number().optional(),length:n.z.number().optional()})}},description:`List of tenants`}}}),async n=>{let{page:r,per_page:i,include_totals:a,q:o}=n.req.valid(`query`),s=n.var.user,c=s?.permissions||[];if(!(s?.org_id??n.var.organization_id)&&c.includes(`admin:organizations`)){let e=await n.env.data.tenants.list({page:r,per_page:i,include_totals:a,q:o});return a?n.json({tenants:e.tenants,start:e.totals?.start??0,limit:e.totals?.limit??i,length:e.tenants.length}):n.json({tenants:e.tenants})}let l=e.accessControl?.controlPlaneTenantId??n.env.data.multiTenancyConfig?.controlPlaneTenantId;if(l&&!s?.sub)throw new _(403,{message:`Access denied: token has no subject`});if(l&&s?.sub){let e=(await(0,t.fetchAll)(e=>n.env.data.userOrganizations.listUserOrganizations(l,s.sub,e),`organizations`)).map(e=>e.name);if(e.length===0)return a?n.json({tenants:[],start:0,limit:i??50,length:0}):n.json({tenants:[]});let c=e.length,u=r??0,d=i??50,f=u*d,p=e.slice(f,f+d);if(p.length===0)return a?n.json({tenants:[],start:f,limit:d,length:c}):n.json({tenants:[]});let m=p.map(e=>`id:${e}`).join(` OR `),h=o?`(${m}) AND (${o})`:m,g=await n.env.data.tenants.list({q:h,per_page:d,include_totals:!1});return a?n.json({tenants:g.tenants,start:f,limit:d,length:c}):n.json({tenants:g.tenants})}let u=await n.env.data.tenants.list({page:r,per_page:i,include_totals:a,q:o});return a?n.json({tenants:u.tenants,start:u.totals?.start??0,limit:u.totals?.limit??i,length:u.tenants.length}):n.json({tenants:u.tenants})}),i.openapi((0,n.createRoute)({tags:[`tenants`],method:`post`,path:`/`,request:{body:{content:{"application/json":{schema:t.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:t.tenantSchema}},description:`Tenant created`},400:{description:`Validation error`},409:{description:`Tenant with this ID already exists`}}}),async e=>{if(!e.var.user?.sub)throw new _(401,{message:`Authentication required to create tenants`});let t=e.req.valid(`json`),n={adapters:e.env.data,ctx:e};r.tenants?.beforeCreate&&(t=await r.tenants.beforeCreate(n,t));let i=await e.env.data.tenants.create(t);return r.tenants?.afterCreate&&await r.tenants.afterCreate(n,i),e.json(i,201)}),i.openapi((0,n.createRoute)({tags:[`tenants`],method:`delete`,path:`/{id}`,request:{params:n.z.object({id:n.z.string()})},security:[{Bearer:[`delete:tenants`]}],responses:{204:{description:`Tenant deleted`},403:{description:`Access denied or cannot delete the control plane`},404:{description:`Tenant not found`}}}),async n=>{let{id:i}=n.req.valid(`param`),a=e.accessControl?.controlPlaneTenantId??n.env.data.multiTenancyConfig?.controlPlaneTenantId;if(a){let e=n.var.user;if(!e?.sub)throw new _(401,{message:`Authentication required`});if(i===a)throw new _(403,{message:`Cannot delete the control plane`});let r=n.var.org_name,o=i.toLowerCase(),s=!!r&&r.toLowerCase()===o;if(s||=(await(0,t.fetchAll)(t=>n.env.data.userOrganizations.listUserOrganizations(a,e.sub,t),`organizations`)).some(e=>e.name?.toLowerCase()===o),!s)throw new _(403,{message:`Access denied to this tenant`})}if(!await n.env.data.tenants.get(i))throw new _(404,{message:`Tenant not found`});let o={adapters:n.env.data,ctx:n};return r.tenants?.beforeDelete&&await r.tenants.beforeDelete(o,i),await n.env.data.tenants.remove(i),r.tenants?.afterDelete&&await r.tenants.afterDelete(o,i),n.body(null,204)}),i.openapi((0,n.createRoute)({tags:[`tenants`,`settings`],method:`get`,path:`/settings`,request:{headers:n.z.object({"tenant-id":n.z.string().optional()})},security:[{Bearer:[`read:tenants`]}],responses:{200:{content:{"application/json":{schema:t.tenantSchema}},description:`Current tenant settings`}}}),async e=>{let t=await e.env.data.tenants.get(e.var.tenant_id);if(!t)throw new _(404,{message:`Tenant not found`});return e.json(t)}),i.openapi((0,n.createRoute)({tags:[`tenants`,`settings`],method:`patch`,path:`/settings`,request:{headers:n.z.object({"tenant-id":n.z.string().optional()}),body:{content:{"application/json":{schema:n.z.object(t.tenantInsertSchema.shape).partial()}}}},security:[{Bearer:[`update:tenants`]}],responses:{200:{content:{"application/json":{schema:t.tenantSchema}},description:`Updated tenant settings`}}}),async e=>{let{id:n,...r}=e.req.valid(`json`),i=await e.env.data.tenants.get(e.var.tenant_id);if(!i)throw new _(404,{message:`Tenant not found`});let a=(0,t.deepMergePatch)(i,r);await e.env.data.tenants.update(e.var.tenant_id,a);let o=await e.env.data.tenants.get(e.var.tenant_id);if(!o)throw new _(500,{message:`Failed to retrieve updated tenant`});return e.json(o)}),i}function y(e){for(let{pattern:t,type:n}of[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:`resource_server`},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:`role`},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:`connection`}]){let r=e.match(t);if(r&&r[1])return{type:n,id:r[1]}}return null}async function b(e,t,n){try{switch(n.type){case`resource_server`:return(await e.resourceServers.get(t,n.id))?.is_system===!0;case`role`:return(await e.roles.get(t,n.id))?.is_system===!0;case`connection`:return(await e.connections.get(t,n.id))?.is_system===!0;default:return!1}}catch{return!1}}function x(e){return{resource_server:`resource server`,role:`role`,connection:`connection`}[e]}function S(){return async(e,t)=>{if(![`PATCH`,`PUT`,`DELETE`].includes(e.req.method))return t();let n=y(e.req.path);if(!n)return t();let r=e.var.tenant_id||e.req.header(`x-tenant-id`)||e.req.header(`tenant-id`);if(!r)return t();if(await b(e.env.data,r,n))throw new _(403,{message:`This ${x(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return t()}}function C(e,n){let r=n.find(t=>t.strategy===e.strategy);if(!r?.options)return e;let i=t.connectionSchema.passthrough().parse({...r,...e});return i.options=t.connectionOptionsSchema.passthrough().parse({...r.options||{},...e.options}),i}function w(e,t){let n=[...t||[],...e||[]];return[...new Set(n)]}function T(e,t){if(!t?.length)return e||[];if(!e?.length)return t;let n=new Map;for(let e of t)n.set(e.value,e);for(let t of e)n.set(t.value,t);return Array.from(n.values())}function E(e,t){return t?{...e,scopes:T(e.scopes,t.scopes)}:e}function D(e,t){return t?{...e,callbacks:w(e.callbacks,t.callbacks),web_origins:w(e.web_origins,t.web_origins),allowed_logout_urls:w(e.allowed_logout_urls,t.allowed_logout_urls),allowed_origins:w(e.allowed_origins,t.allowed_origins)}:e}function O(e){let{controlPlaneTenantId:t,controlPlaneClientId:n,resolveControlPlane:r}=e;if(r)return async e=>r({tenant_id:e});if(!t)return async()=>void 0;let i={tenantId:t,clientId:n};return async()=>i}function k(e,t){return{...e.resourceServers,get:async(n,r)=>{let i=await e.resourceServers.get(n,r);if(!i)return i;let a=await t(n);return!a||n===a.tenantId||!i.is_system?i:E(i,await e.resourceServers.get(a.tenantId,r))},list:async(n,r)=>{let i=await e.resourceServers.list(n,r),a=await t(n);if(!a||n===a.tenantId)return i;let o=a.tenantId,s=i.resource_servers.filter(e=>!!(e.is_system&&e.id)).map(e=>e.id);if(s.length===0)return i;let c=new Map;await Promise.all(s.map(async t=>{let n=await e.resourceServers.get(o,t);n&&c.set(t,n)}));let l=i.resource_servers.map(e=>e.is_system&&e.id?E(e,c.get(e.id)??null):e);return{...i,resource_servers:l}}}}function A(e,t){let n=O({controlPlaneTenantId:t.controlPlaneTenantId,resolveControlPlane:t.resolveControlPlane});return{...e,resourceServers:k(e,n)}}function j(e,t){let{controlPlaneTenantId:n,controlPlaneClientId:r,resolveControlPlane:i}=t,a=O({controlPlaneTenantId:n,controlPlaneClientId:r,resolveControlPlane:i});return{...e,multiTenancyConfig:{controlPlaneTenantId:n,controlPlaneClientId:r,resolveControlPlane:i},connections:{...e.connections,get:async(t,n)=>{let r=await e.connections.get(t,n);if(!r)return r;let i=await a(t);return!i||t===i.tenantId?r:C(r,(await e.connections.list(i.tenantId)).connections||[])},list:async(t,n)=>{let r=await e.connections.list(t,n),i=await a(t);if(!i||t===i.tenantId)return r;let o=await e.connections.list(i.tenantId),s=r.connections.map(e=>C(e,o.connections||[]));return{...r,connections:s}}},clientConnections:{...e.clientConnections,listByClient:async(t,n)=>{let r=await e.clientConnections.listByClient(t,n);r.length===0&&(r=(await e.connections.list(t)).connections||[]);let i=await a(t);if(!i||t===i.tenantId)return r;let o=await e.connections.list(i.tenantId);return r.map(e=>C(e,o.connections||[]))}},emailProviders:{...e.emailProviders,get:async t=>{let n=await e.emailProviders.get(t);if(n)return n;let r=await a(t);return!r||t===r.tenantId?null:e.emailProviders.get(r.tenantId)}},resourceServers:k(e,a),hooks:N(e,a)}}function M(e){if(!e||typeof e!=`object`)return!1;let t=e.metadata;return!t||typeof t!=`object`?!1:t.inheritable===!0}function N(e,t){return{...e.hooks,list:async(n,r)=>{let i=await e.hooks.list(n,r),a=await t(n);if(!a||n===a.tenantId)return i;let o=((await e.hooks.list(a.tenantId,r)).hooks||[]).filter(M);if(o.length===0)return i;let s=new Set((i.hooks||[]).map(e=>e.hook_id)),c=o.filter(e=>!s.has(e.hook_id));return{...i,hooks:[...i.hooks||[],...c],length:typeof i.length==`number`?i.length+c.length:i.length}},get:async(n,r)=>{let i=await e.hooks.get(n,r);if(i)return i;let a=await t(n);if(!a||n===a.tenantId)return i;let o=await e.hooks.get(a.tenantId,r);return o&&M(o)?o:null}}}function P(e,t){return j(e,t)}function F(e){return async(t,n)=>{let r=t.var.user;return r?.tenant_id===e&&r.org_name&&t.set(`tenant_id`,r.org_name),n()}}function I(e){return async(n,r)=>{if(!e.accessControl)return r();let{controlPlaneTenantId:a}=e.accessControl,o=n.var.org_name,s=n.var.organization_id,c=o||s,l=n.var.tenant_id,u=n.var.user,d=(u?.aud?Array.isArray(u.aud)?u.aud:[u.aud]:[]).includes(t.MANAGEMENT_API_AUDIENCE);if(!l&&c&&d&&(n.set(`tenant_id`,c),l=c),!l)throw new _(400,{message:`Tenant ID not found in request`});if(!i(s,l,a,o))throw new _(403,{message:`Access denied to tenant ${l}`});return r()}}function L(e){return async(t,n)=>{if(!e.subdomainRouting)return n();let{baseDomain:r,reservedSubdomains:i=[],resolveSubdomain:a}=e.subdomainRouting,o=t.req.header(`x-forwarded-host`)||t.req.header(`host`)||``,s=null;if(o.endsWith(r)){let e=o.slice(0,-(r.length+1));e&&!e.includes(`.`)&&(s=e)}if(s&&i.includes(s)&&(s=null),!s)return e.accessControl&&t.set(`tenant_id`,e.accessControl.controlPlaneTenantId),n();let c=null;if(a)c=await a(s);else if(e.subdomainRouting.useOrganizations!==!1&&e.accessControl)try{let n=await t.env.data.organizations.get(e.accessControl.controlPlaneTenantId,s);n&&(c=n.id)}catch{}if(!c)throw new _(404,{message:`Tenant not found for subdomain: ${s}`});return t.set(`tenant_id`,c),n()}}function R(e){return async(t,n)=>{if(!e.databaseIsolation)return n();let r=t.var.tenant_id;if(!r)throw new _(400,{message:`Tenant ID not found in request`});try{let n=await e.databaseIsolation.getAdapters(r);t.env.data=n}catch(e){throw console.error(`Failed to resolve database for tenant ${r}:`,e),new _(500,{message:`Failed to resolve tenant database`})}return n()}}function z(e){let t=L(e),n=I(e),r=R(e);return async(e,i)=>(await t(e,async()=>{}),await n(e,async()=>{}),await r(e,async()=>{}),i())}function B(e){let{dataAdapter:n,controlPlane:r,controlPlane:{tenantId:i=`control_plane`,clientId:a}={},resolveControlPlane:o,sync:c={resourceServers:!0,roles:!0},defaultPermissions:l=[`tenant:admin`],requireOrganizationMatch:u=!1,managementApiExtensions:d=[],entityHooks:f,getChildTenantIds:p,getAdapters:m,...h}=e;if(o&&!r)throw Error("initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it.");let _=n,y=n;r&&(_=P(n,{controlPlaneTenantId:i,controlPlaneClientId:a,resolveControlPlane:o}),y={...A(n,{controlPlaneTenantId:i,resolveControlPlane:o}),multiTenancyConfig:{controlPlaneTenantId:i,controlPlaneClientId:a,resolveControlPlane:o}});let b=c!==!1,x=b?{resourceServers:c.resourceServers??!0,roles:c.roles??!0}:{resourceServers:!1,roles:!1},{entityHooks:C,tenantHooks:w}=g({controlPlaneTenantId:i,getChildTenantIds:p??(async()=>(await(0,t.fetchAll)(e=>_.tenants.list(e),`tenants`,{cursorField:`id`,pageSize:100})).filter(e=>e.id!==i).map(e=>e.id)),getAdapters:m??(async()=>_),getControlPlaneAdapters:async()=>_,sync:x}),T={resourceServers:[C.resourceServers,...f?.resourceServers??[]],roles:[C.roles,...f?.roles??[]],connections:f?.connections??[],tenants:f?.tenants??[],rolePermissions:f?.rolePermissions??[]},E=s({accessControl:{controlPlaneTenantId:i,requireOrganizationMatch:u,defaultPermissions:l}}),D=v({accessControl:{controlPlaneTenantId:i,requireOrganizationMatch:u,defaultPermissions:l}},{tenants:{async beforeCreate(e,t){return E.beforeCreate&&(t=await E.beforeCreate(e,t)),w.beforeCreate&&(t=await w.beforeCreate(e,t)),t},async afterCreate(e,t){await E.afterCreate?.(e,t),await w.afterCreate?.(e,t)},async beforeDelete(e,t){await E.beforeDelete?.(e,t),await w.beforeDelete?.(e,t)}}}),{app:O}=(0,t.init)({dataAdapter:_,managementDataAdapter:y,...h,entityHooks:T,managementApiExtensions:[...d,{path:`/tenants`,router:D}]});return O.use(`/api/v2/*`,F(i)),b&&O.use(`/api/v2/*`,S()),{app:O,controlPlaneTenantId:i}}function V(e){let t=H(e);return{name:`multi-tenancy`,middleware:z(e),hooks:t,routes:[{path:`/management`,handler:v(e,t)}],onRegister:async()=>{console.log(`Multi-tenancy plugin registered`),e.accessControl&&console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`),e.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`),e.databaseIsolation&&console.log(`  - Database isolation enabled`)}}}function H(e){let t=e.accessControl?r(e.accessControl):{},n=e.databaseIsolation?a(e.databaseIsolation):{},i=s(e);return{...t,...n,tenants:i}}function U(t){let n=new e.Hono,r=H(t);return n.route(`/tenants`,v(t,r)),n}function W(e){return{hooks:H(e),middleware:z(e),app:U(e),config:e,wrapAdapters:(t,n)=>P(t,{controlPlaneTenantId:e.accessControl?.controlPlaneTenantId,controlPlaneClientId:n?.controlPlaneClientId})}}exports.createAccessControlHooks=r,exports.createAccessControlMiddleware=I,exports.createControlPlaneTenantMiddleware=F,exports.createDatabaseHooks=a,exports.createDatabaseMiddleware=R,exports.createMultiTenancy=U,exports.createMultiTenancyHooks=H,exports.createMultiTenancyMiddleware=z,exports.createMultiTenancyPlugin=V,exports.createProtectSyncedMiddleware=S,exports.createProvisioningHooks=s,exports.createRuntimeFallbackAdapter=j,exports.createSubdomainMiddleware=L,exports.createSyncHooks=g,exports.createTenantsOpenAPIRouter=v,exports.initMultiTenant=B,exports.mergeClientWithFallback=D,exports.setupMultiTenancy=W,exports.validateTenantAccess=i,exports.withRuntimeFallback=P,exports.withSystemResourceServerInheritance=A;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("hono"),t=require("authhero"),n=require("@hono/zod-openapi"),r=require("hono/http-exception");function i(e){let{controlPlaneTenantId:t,requireOrganizationMatch:n=!0}=e;return{async onTenantAccessValidation(e,r){if(r===t)return!0;if(n){let t=e.var.org_name,n=e.var.organization_id,i=t||n;return i?i.toLowerCase()===r.toLowerCase():!1}return!0}}}function a(e,t,n,r){if(t===n)return!0;let i=r||e;return i?i.toLowerCase()===t.toLowerCase():!1}function o(e){return{async resolveDataAdapters(t){try{return await e.getAdapters(t)}catch(e){console.error(`Failed to resolve data adapters for tenant ${t}:`,e);return}}}}function s(e){return`urn:authhero:tenant:${e.toLowerCase()}`}function c(e){return{async beforeCreate(e,t){return!t.audience&&t.id?{...t,audience:s(t.id)}:t},async afterCreate(t,n){let{accessControl:r,databaseIsolation:i}=e;r&&t.ctx&&await l(t,n,r),i?.onProvision&&await i.onProvision(n.id)},async beforeDelete(t,n){let{accessControl:r,databaseIsolation:i}=e;if(r)try{let e=(await t.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find(e=>e.name===n);e&&await t.adapters.organizations.remove(r.controlPlaneTenantId,e.id)}catch(e){console.warn(`Failed to remove organization for tenant ${n}:`,e)}if(i?.onDeprovision)try{await i.onDeprovision(n)}catch(e){console.warn(`Failed to deprovision database for tenant ${n}:`,e)}}}}async function l(e,t,n){let{controlPlaneTenantId:r,defaultPermissions:i,defaultRoles:a,issuer:o,adminRoleName:s=`Tenant Admin`,adminRoleDescription:c=`Full access to all tenant management operations`,addCreatorToOrganization:l=!0}=n,f=await e.adapters.organizations.create(r,{name:t.id,display_name:t.friendly_name||t.id}),p;if(o&&(p=await d(e,r,s,c)),l&&e.ctx){let t=e.ctx.var.user;if(t?.sub&&!await u(e,r,t.sub))try{await e.adapters.userOrganizations.create(r,{user_id:t.sub,organization_id:f.id}),p&&await e.adapters.userRoles.create(r,t.sub,p,f.id)}catch(e){console.warn(`Failed to add creator ${t.sub} to organization ${f.id}:`,e)}}a&&a.length>0&&console.log(`Would assign roles ${a.join(`, `)} to organization ${f.id}`),i&&i.length>0&&console.log(`Would grant permissions ${i.join(`, `)} to organization ${f.id}`)}async function u(e,t,n){let r=await e.adapters.userRoles.list(t,n,void 0,``);for(let n of r)if((await e.adapters.rolePermissions.list(t,n.id,{per_page:1e3})).some(e=>e.permission_name===`admin:organizations`))return!0;return!1}async function d(e,n,r,i){let a=(await e.adapters.roles.list(n,{})).roles.find(e=>e.name===r);if(a)return a.id;let o=await e.adapters.roles.create(n,{name:r,description:i}),s=t.MANAGEMENT_API_AUDIENCE,c=t.MANAGEMENT_API_SCOPES.map(e=>({role_id:o.id,resource_server_identifier:s,permission_name:e.value}));return await e.adapters.rolePermissions.assign(n,o.id,c),o.id}function f(e,t,n=()=>!0){let{controlPlaneTenantId:r,getChildTenantIds:i,getAdapters:a}=e,o=new Map;async function s(e,n,r){return(await t(e).list(n,{q:`name:${r}`,per_page:1}))[0]??null}async function c(e){let n=await i(),o=t(await a(r));await Promise.all(n.map(async n=>{try{let r=await a(n),i=t(r),c={...o.transform(e),is_system:!0},l=await s(r,n,e.name),u=l?i.getId(l):void 0;if(l&&u){let e=i.preserveOnUpdate?i.preserveOnUpdate(l,c):c;await i.update(n,u,e)}else await i.create(n,c)}catch(t){console.error(`Failed to sync ${o.listKey} "${e.name}" to tenant "${n}":`,t)}}))}async function l(e){let n=await i();await Promise.all(n.map(async n=>{try{let r=await a(n),i=t(r),o=await s(r,n,e),c=o?i.getId(o):void 0;o&&c&&await i.remove(n,c)}catch(t){console.error(`Failed to delete entity "${e}" from tenant "${n}":`,t)}}))}return{afterCreate:async(e,t)=>{e.tenantId===r&&n(t)&&await c(t)},afterUpdate:async(e,t,i)=>{e.tenantId===r&&n(i)&&await c(i)},beforeDelete:async(e,i)=>{if(e.tenantId!==r)return;let a=await t(e.adapters).get(e.tenantId,i);a&&n(a)&&o.set(i,a)},afterDelete:async(e,t)=>{if(e.tenantId!==r)return;let n=o.get(t);n&&(o.delete(t),await l(n.name))}}}function p(e,n,r=()=>!0){let{controlPlaneTenantId:i,getControlPlaneAdapters:a,getAdapters:o}=e;return{async afterCreate(e,s){if(s.id!==i)try{let e=await a(),c=await o(s.id),l=n(e),u=n(c),d=await(0,t.fetchAll)(e=>l.listPaginated(i,e),l.listKey,{cursorField:`id`,pageSize:100});await Promise.all(d.filter(e=>r(e)).map(async e=>{try{let t=l.transform(e);await u.create(s.id,{...t,is_system:!0})}catch(e){console.error(`Failed to sync entity to new tenant "${s.id}":`,e)}}))}catch(e){console.error(`Failed to sync entities to new tenant "${s.id}":`,e)}}}}var m=e=>({list:async(t,n)=>(await e.resourceServers.list(t,n)).resource_servers,listPaginated:(t,n)=>e.resourceServers.list(t,n),get:(t,n)=>e.resourceServers.get(t,n),create:(t,n)=>e.resourceServers.create(t,n),update:(t,n,r)=>e.resourceServers.update(t,n,r),remove:(t,n)=>e.resourceServers.remove(t,n),listKey:`resource_servers`,getId:e=>e.id,transform:e=>({id:e.id,name:e.name,identifier:e.identifier,scopes:e.scopes,signing_alg:e.signing_alg,token_lifetime:e.token_lifetime,token_lifetime_for_web:e.token_lifetime_for_web})}),h=e=>({list:async(t,n)=>(await e.roles.list(t,n)).roles,listPaginated:(t,n)=>e.roles.list(t,n),get:(t,n)=>e.roles.get(t,n),create:(t,n)=>e.roles.create(t,n),update:(t,n,r)=>e.roles.update(t,n,r),remove:(t,n)=>e.roles.remove(t,n),listKey:`roles`,getId:e=>e.id,transform:e=>({id:e.id,name:e.name,description:e.description})});function g(e){return e.metadata?.sync!==!1}function _(e){let{sync:n={},filters:r={}}=e,i=n.resourceServers??!0,a=n.roles??!0,o=e=>g(e)?r.resourceServers?r.resourceServers(e):!0:!1,s=e=>g(e)?r.roles?r.roles(e):!0:!1,c=i?f(e,m,o):void 0,l=a?f(e,h,s):void 0,u=i?p(e,m,o):void 0,d=a?p(e,h,s):void 0,_=a?{async afterCreate(n,i){if(i.id!==e.controlPlaneTenantId){await d?.afterCreate?.(n,i);try{let n=await e.getControlPlaneAdapters(),a=await e.getAdapters(i.id),o=await(0,t.fetchAll)(t=>n.roles.list(e.controlPlaneTenantId,t),`roles`,{cursorField:`id`,pageSize:100}),s=new Map;for(let e of o.filter(e=>r.roles?.(e)??!0)){let t=await v(a,i.id,e.name);t&&s.set(e.name,t.id)}for(let t of o.filter(e=>r.roles?.(e)??!0)){let r=s.get(t.name);if(r)try{let o=await n.rolePermissions.list(e.controlPlaneTenantId,t.id,{});o.length>0&&await a.rolePermissions.assign(i.id,r,o.map(e=>({role_id:r,resource_server_identifier:e.resource_server_identifier,permission_name:e.permission_name})))}catch(e){console.error(`Failed to sync permissions for role "${t.name}" to tenant "${i.id}":`,e)}}}catch(e){console.error(`Failed to sync role permissions to tenant "${i.id}":`,e)}}}}:void 0;async function v(e,t,n){return(await e.roles.list(t,{q:`name:${n}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:c,roles:l},tenantHooks:{async afterCreate(e,t){let n=[u?.afterCreate,_?.afterCreate??d?.afterCreate],r=[];for(let i of n)if(i)try{await i(e,t)}catch(e){r.push(e instanceof Error?e:Error(String(e)))}if(r.length===1)throw r[0];if(r.length>1)throw AggregateError(r,r.map(e=>e.message).join(`; `))}}}}var v=n.z.object({sub:n.z.string(),tenant_id:n.z.string().optional(),org_id:n.z.string().optional(),scope:n.z.string().optional(),permissions:n.z.array(n.z.string()).optional()}).passthrough();function y(e){let t=v.safeParse(e);return t.success?t.data:void 0}function b(e){let t=e.permissions??[],n=e.scope?e.scope.split(` `).filter(Boolean):[],r=new Set([...t,...n]);return r.has(`delete:tenants`)||r.has(`admin:organizations`)}function x(e,i){let a=new n.OpenAPIHono;return a.openapi((0,n.createRoute)({tags:[`tenants`],method:`get`,path:`/`,request:{query:t.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:n.z.object({tenants:n.z.array(t.tenantSchema),start:n.z.number().optional(),limit:n.z.number().optional(),length:n.z.number().optional()})}},description:`List of tenants`}}}),async n=>{let{page:i,per_page:a,include_totals:o,q:s}=n.req.valid(`query`),c=n.var.user,l=c?.permissions||[];if(!(c?.org_id??n.var.organization_id)&&l.includes(`admin:organizations`)){let e=await n.env.data.tenants.list({page:i,per_page:a,include_totals:o,q:s});return o?n.json({tenants:e.tenants,start:e.totals?.start??0,limit:e.totals?.limit??a,length:e.tenants.length}):n.json({tenants:e.tenants})}let u=e.accessControl?.controlPlaneTenantId??n.env.data.multiTenancyConfig?.controlPlaneTenantId;if(u&&!c?.sub)throw new r.HTTPException(403,{message:`Access denied: token has no subject`});if(u&&c?.sub){let e=(await(0,t.fetchAll)(e=>n.env.data.userOrganizations.listUserOrganizations(u,c.sub,e),`organizations`)).map(e=>e.name);if(e.length===0)return o?n.json({tenants:[],start:0,limit:a??50,length:0}):n.json({tenants:[]});let r=e.length,l=i??0,d=a??50,f=l*d,p=e.slice(f,f+d);if(p.length===0)return o?n.json({tenants:[],start:f,limit:d,length:r}):n.json({tenants:[]});let m=p.map(e=>`id:${e}`).join(` OR `),h=s?`(${m}) AND (${s})`:m,g=await n.env.data.tenants.list({q:h,per_page:d,include_totals:!1});return o?n.json({tenants:g.tenants,start:f,limit:d,length:r}):n.json({tenants:g.tenants})}let d=await n.env.data.tenants.list({page:i,per_page:a,include_totals:o,q:s});return o?n.json({tenants:d.tenants,start:d.totals?.start??0,limit:d.totals?.limit??a,length:d.tenants.length}):n.json({tenants:d.tenants})}),a.openapi((0,n.createRoute)({tags:[`tenants`],method:`post`,path:`/`,request:{body:{content:{"application/json":{schema:t.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:t.tenantSchema}},description:`Tenant created`},400:{description:`Validation error`},409:{description:`Tenant with this ID already exists`}}}),async e=>{if(!e.var.user?.sub)throw new r.HTTPException(401,{message:`Authentication required to create tenants`});let t=e.req.valid(`json`),n={adapters:e.env.data,ctx:e};i.tenants?.beforeCreate&&(t=await i.tenants.beforeCreate(n,t));let a=await e.env.data.tenants.create(t);return i.tenants?.afterCreate&&await i.tenants.afterCreate(n,a),e.json(a,201)}),a.openapi((0,n.createRoute)({tags:[`tenants`],method:`delete`,path:`/{id}`,request:{params:n.z.object({id:n.z.string()})},security:[{Bearer:[`delete:tenants`]}],responses:{204:{description:`Tenant deleted`},403:{description:`Access denied or cannot delete the control plane`},404:{description:`Tenant not found`}}}),async n=>{let{id:a}=n.req.valid(`param`),o=e.accessControl?.controlPlaneTenantId??n.env.data.multiTenancyConfig?.controlPlaneTenantId;if(o){let e=y(n.var.user);if(!e?.sub)throw new r.HTTPException(401,{message:`Authentication required`});if(a===o)throw new r.HTTPException(403,{message:`Cannot delete the control plane`});let i=n.var.org_name,s=a.toLowerCase(),c=!!i&&i.toLowerCase()===s;if(!c){let t=!!(e.org_id??n.var.organization_id??i),r=!e.tenant_id||e.tenant_id===o;!t&&r&&b(e)&&(c=!0)}if(c||=(await(0,t.fetchAll)(t=>n.env.data.userOrganizations.listUserOrganizations(o,e.sub,t),`organizations`)).some(e=>e.name?.toLowerCase()===s),!c)throw new r.HTTPException(403,{message:`Access denied to this tenant`})}if(!await n.env.data.tenants.get(a))throw new r.HTTPException(404,{message:`Tenant not found`});let s={adapters:n.env.data,ctx:n};return i.tenants?.beforeDelete&&await i.tenants.beforeDelete(s,a),await n.env.data.tenants.remove(a),i.tenants?.afterDelete&&await i.tenants.afterDelete(s,a),n.body(null,204)}),a.openapi((0,n.createRoute)({tags:[`tenants`,`settings`],method:`get`,path:`/settings`,request:{headers:n.z.object({"tenant-id":n.z.string().optional()})},security:[{Bearer:[`read:tenants`]}],responses:{200:{content:{"application/json":{schema:t.tenantSchema}},description:`Current tenant settings`}}}),async e=>{let t=await e.env.data.tenants.get(e.var.tenant_id);if(!t)throw new r.HTTPException(404,{message:`Tenant not found`});return e.json(t)}),a.openapi((0,n.createRoute)({tags:[`tenants`,`settings`],method:`patch`,path:`/settings`,request:{headers:n.z.object({"tenant-id":n.z.string().optional()}),body:{content:{"application/json":{schema:n.z.object(t.tenantInsertSchema.shape).partial()}}}},security:[{Bearer:[`update:tenants`]}],responses:{200:{content:{"application/json":{schema:t.tenantSchema}},description:`Updated tenant settings`}}}),async e=>{let{id:n,...i}=e.req.valid(`json`),a=await e.env.data.tenants.get(e.var.tenant_id);if(!a)throw new r.HTTPException(404,{message:`Tenant not found`});let o=(0,t.deepMergePatch)(a,i);await e.env.data.tenants.update(e.var.tenant_id,o);let s=await e.env.data.tenants.get(e.var.tenant_id);if(!s)throw new r.HTTPException(500,{message:`Failed to retrieve updated tenant`});return e.json(s)}),a}function S(e){for(let{pattern:t,type:n}of[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:`resource_server`},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:`role`},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:`connection`}]){let r=e.match(t);if(r&&r[1])return{type:n,id:r[1]}}return null}async function C(e,t,n){try{switch(n.type){case`resource_server`:return(await e.resourceServers.get(t,n.id))?.is_system===!0;case`role`:return(await e.roles.get(t,n.id))?.is_system===!0;case`connection`:return(await e.connections.get(t,n.id))?.is_system===!0;default:return!1}}catch{return!1}}function w(e){return{resource_server:`resource server`,role:`role`,connection:`connection`}[e]}function T(){return async(e,t)=>{if(![`PATCH`,`PUT`,`DELETE`].includes(e.req.method))return t();let n=S(e.req.path);if(!n)return t();let i=e.var.tenant_id||e.req.header(`x-tenant-id`)||e.req.header(`tenant-id`);if(!i)return t();if(await C(e.env.data,i,n))throw new r.HTTPException(403,{message:`This ${w(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return t()}}function E(e,n){let r=n.find(t=>t.strategy===e.strategy);if(!r?.options)return e;let i=t.connectionSchema.passthrough().parse({...r,...e});return i.options=t.connectionOptionsSchema.passthrough().parse({...r.options||{},...e.options}),i}function D(e,t){let n=[...t||[],...e||[]];return[...new Set(n)]}function O(e,t){if(!t?.length)return e||[];if(!e?.length)return t;let n=new Map;for(let e of t)n.set(e.value,e);for(let t of e)n.set(t.value,t);return Array.from(n.values())}function k(e,t){return t?{...e,scopes:O(e.scopes,t.scopes)}:e}function A(e,t){return t?{...e,callbacks:D(e.callbacks,t.callbacks),web_origins:D(e.web_origins,t.web_origins),allowed_logout_urls:D(e.allowed_logout_urls,t.allowed_logout_urls),allowed_origins:D(e.allowed_origins,t.allowed_origins)}:e}function j(e){let{controlPlaneTenantId:t,controlPlaneClientId:n,resolveControlPlane:r}=e;if(r)return async e=>r({tenant_id:e});if(!t)return async()=>void 0;let i={tenantId:t,clientId:n};return async()=>i}function M(e,t){return{...e.resourceServers,get:async(n,r)=>{let i=await e.resourceServers.get(n,r);if(!i)return i;let a=await t(n);return!a||n===a.tenantId||!i.is_system?i:k(i,await e.resourceServers.get(a.tenantId,r))},list:async(n,r)=>{let i=await e.resourceServers.list(n,r),a=await t(n);if(!a||n===a.tenantId)return i;let o=a.tenantId,s=i.resource_servers.filter(e=>!!(e.is_system&&e.id)).map(e=>e.id);if(s.length===0)return i;let c=new Map;await Promise.all(s.map(async t=>{let n=await e.resourceServers.get(o,t);n&&c.set(t,n)}));let l=i.resource_servers.map(e=>e.is_system&&e.id?k(e,c.get(e.id)??null):e);return{...i,resource_servers:l}}}}function N(e,t){let n=j({controlPlaneTenantId:t.controlPlaneTenantId,resolveControlPlane:t.resolveControlPlane});return{...e,resourceServers:M(e,n)}}function P(e,t){let{controlPlaneTenantId:n,controlPlaneClientId:r,resolveControlPlane:i}=t,a=j({controlPlaneTenantId:n,controlPlaneClientId:r,resolveControlPlane:i});return{...e,multiTenancyConfig:{controlPlaneTenantId:n,controlPlaneClientId:r,resolveControlPlane:i},connections:{...e.connections,get:async(t,n)=>{let r=await e.connections.get(t,n);if(!r)return r;let i=await a(t);return!i||t===i.tenantId?r:E(r,(await e.connections.list(i.tenantId)).connections||[])},list:async(t,n)=>{let r=await e.connections.list(t,n),i=await a(t);if(!i||t===i.tenantId)return r;let o=await e.connections.list(i.tenantId),s=r.connections.map(e=>E(e,o.connections||[]));return{...r,connections:s}}},clientConnections:{...e.clientConnections,listByClient:async(t,n)=>{let r=await e.clientConnections.listByClient(t,n);r.length===0&&(r=(await e.connections.list(t)).connections||[]);let i=await a(t);if(!i||t===i.tenantId)return r;let o=await e.connections.list(i.tenantId);return r.map(e=>E(e,o.connections||[]))}},emailProviders:{...e.emailProviders,get:async t=>{let n=await e.emailProviders.get(t);if(n)return n;let r=await a(t);return!r||t===r.tenantId?null:e.emailProviders.get(r.tenantId)}},resourceServers:M(e,a),hooks:I(e,a)}}function F(e){if(!e||typeof e!=`object`)return!1;let t=e.metadata;return!t||typeof t!=`object`?!1:t.inheritable===!0}function I(e,t){return{...e.hooks,list:async(n,r)=>{let i=await e.hooks.list(n,r),a=await t(n);if(!a||n===a.tenantId)return i;let o=((await e.hooks.list(a.tenantId,r)).hooks||[]).filter(F);if(o.length===0)return i;let s=new Set((i.hooks||[]).map(e=>e.hook_id)),c=o.filter(e=>!s.has(e.hook_id));return{...i,hooks:[...i.hooks||[],...c],length:typeof i.length==`number`?i.length+c.length:i.length}},get:async(n,r)=>{let i=await e.hooks.get(n,r);if(i)return i;let a=await t(n);if(!a||n===a.tenantId)return i;let o=await e.hooks.get(a.tenantId,r);return o&&F(o)?o:null}}}function L(e,t){return P(e,t)}function R(e){return async(t,n)=>{let r=t.var.user;return r?.tenant_id===e&&r.org_name&&t.set(`tenant_id`,r.org_name),n()}}function z(e){return async(n,i)=>{if(!e.accessControl)return i();let{controlPlaneTenantId:o}=e.accessControl,s=n.var.org_name,c=n.var.organization_id,l=s||c,u=n.var.tenant_id,d=n.var.user,f=(d?.aud?Array.isArray(d.aud)?d.aud:[d.aud]:[]).includes(t.MANAGEMENT_API_AUDIENCE);if(!u&&l&&f&&(n.set(`tenant_id`,l),u=l),!u)throw new r.HTTPException(400,{message:`Tenant ID not found in request`});if(!a(c,u,o,s))throw new r.HTTPException(403,{message:`Access denied to tenant ${u}`});return i()}}function B(e){return async(t,n)=>{if(!e.subdomainRouting)return n();let{baseDomain:i,reservedSubdomains:a=[],resolveSubdomain:o}=e.subdomainRouting,s=t.req.header(`x-forwarded-host`)||t.req.header(`host`)||``,c=null;if(s.endsWith(i)){let e=s.slice(0,-(i.length+1));e&&!e.includes(`.`)&&(c=e)}if(c&&a.includes(c)&&(c=null),!c)return e.accessControl&&t.set(`tenant_id`,e.accessControl.controlPlaneTenantId),n();let l=null;if(o)l=await o(c);else if(e.subdomainRouting.useOrganizations!==!1&&e.accessControl)try{let n=await t.env.data.organizations.get(e.accessControl.controlPlaneTenantId,c);n&&(l=n.id)}catch{}if(!l)throw new r.HTTPException(404,{message:`Tenant not found for subdomain: ${c}`});return t.set(`tenant_id`,l),n()}}function V(e){return async(t,n)=>{if(!e.databaseIsolation)return n();let i=t.var.tenant_id;if(!i)throw new r.HTTPException(400,{message:`Tenant ID not found in request`});try{let n=await e.databaseIsolation.getAdapters(i);t.env.data=n}catch(e){throw console.error(`Failed to resolve database for tenant ${i}:`,e),new r.HTTPException(500,{message:`Failed to resolve tenant database`})}return n()}}function H(e){let t=B(e),n=z(e),r=V(e);return async(e,i)=>(await t(e,async()=>{}),await n(e,async()=>{}),await r(e,async()=>{}),i())}function U(e){let{dataAdapter:n,controlPlane:r,controlPlane:{tenantId:i=`control_plane`,clientId:a}={},resolveControlPlane:o,sync:s={resourceServers:!0,roles:!0},defaultPermissions:l=[`tenant:admin`],requireOrganizationMatch:u=!1,managementApiExtensions:d=[],entityHooks:f,getChildTenantIds:p,getAdapters:m,...h}=e;if(o&&!r)throw Error("initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it.");let g=n,v=n;r&&(g=L(n,{controlPlaneTenantId:i,controlPlaneClientId:a,resolveControlPlane:o}),v={...N(n,{controlPlaneTenantId:i,resolveControlPlane:o}),multiTenancyConfig:{controlPlaneTenantId:i,controlPlaneClientId:a,resolveControlPlane:o}});let y=s!==!1,b=y?{resourceServers:s.resourceServers??!0,roles:s.roles??!0}:{resourceServers:!1,roles:!1},{entityHooks:S,tenantHooks:C}=_({controlPlaneTenantId:i,getChildTenantIds:p??(async()=>(await(0,t.fetchAll)(e=>g.tenants.list(e),`tenants`,{cursorField:`id`,pageSize:100})).filter(e=>e.id!==i).map(e=>e.id)),getAdapters:m??(async()=>g),getControlPlaneAdapters:async()=>g,sync:b}),w={resourceServers:[S.resourceServers,...f?.resourceServers??[]],roles:[S.roles,...f?.roles??[]],connections:f?.connections??[],tenants:f?.tenants??[],rolePermissions:f?.rolePermissions??[]},E=c({accessControl:{controlPlaneTenantId:i,requireOrganizationMatch:u,defaultPermissions:l}}),D=x({accessControl:{controlPlaneTenantId:i,requireOrganizationMatch:u,defaultPermissions:l}},{tenants:{async beforeCreate(e,t){return E.beforeCreate&&(t=await E.beforeCreate(e,t)),C.beforeCreate&&(t=await C.beforeCreate(e,t)),t},async afterCreate(e,t){await E.afterCreate?.(e,t),await C.afterCreate?.(e,t)},async beforeDelete(e,t){await E.beforeDelete?.(e,t),await C.beforeDelete?.(e,t)}}}),{app:O}=(0,t.init)({dataAdapter:g,managementDataAdapter:v,...h,entityHooks:w,managementApiExtensions:[...d,{path:`/tenants`,router:D}]});return O.use(`/api/v2/*`,R(i)),y&&O.use(`/api/v2/*`,T()),{app:O,controlPlaneTenantId:i}}function W(){return{upserted:0,errors:[]}}function G(e){let t=e.metadata;return!!(t&&t.inheritable===!0)}async function K(e,t,n,r){try{await r()}catch(r){let i=`${t}: ${r instanceof Error?r.message:String(r)}`;if(!n)throw Error(i,{cause:r});e.errors.push(i)}}async function q(e,n){let{controlPlaneTenantId:r,getControlPlaneAdapters:i,getAdapters:a,entities:o={},continueOnError:s=!1}=e,c={connections:o.connections??!0,resourceServers:o.resourceServers??!0,hooks:o.hooks??!0,emailProvider:o.emailProvider??!0,branding:o.branding??!0,promptSettings:o.promptSettings??!0},l=await i(),u=await a(n),d={tenantId:n,connections:W(),resourceServers:W(),hooks:W(),emailProvider:W(),branding:W(),promptSettings:W()};if(c.connections){let e=await(0,t.fetchAll)(e=>l.connections.list(r,e),`connections`,{cursorField:`id`,pageSize:100});for(let n of e){let e=n.id;e&&await K(d.connections,`connection ${e}`,s,async()=>{let i=t.connectionInsertSchema.parse(n);await u.connections.get(r,e)?await u.connections.update(r,e,i):await u.connections.create(r,i),d.connections.upserted+=1})}}if(c.resourceServers){let e=await(0,t.fetchAll)(e=>l.resourceServers.list(r,e),`resource_servers`,{cursorField:`id`,pageSize:100});for(let n of e)!n.is_system||!n.id||await K(d.resourceServers,`resource_server ${n.id}`,s,async()=>{let e=t.resourceServerInsertSchema.parse(n);await u.resourceServers.get(r,n.id)?await u.resourceServers.update(r,n.id,e):await u.resourceServers.create(r,e),d.resourceServers.upserted+=1})}if(c.hooks){let e=await(0,t.fetchAll)(e=>l.hooks.list(r,e),`hooks`,{cursorField:`hook_id`,pageSize:100});for(let n of e)!G(n)||!n.hook_id||await K(d.hooks,`hook ${n.hook_id}`,s,async()=>{let e=t.hookInsertSchema.parse(n);await u.hooks.get(r,n.hook_id)?await u.hooks.update(r,n.hook_id,e):await u.hooks.create(r,e),d.hooks.upserted+=1})}return c.emailProvider&&await K(d.emailProvider,`email_provider`,s,async()=>{let e=await l.emailProviders.get(r);e&&(await u.emailProviders.get(r)?await u.emailProviders.update(r,e):await u.emailProviders.create(r,e),d.emailProvider.upserted+=1)}),c.branding&&await K(d.branding,`branding`,s,async()=>{let e=await l.branding.get(r);e&&(await u.branding.set(r,e),d.branding.upserted+=1)}),c.promptSettings&&await K(d.promptSettings,`prompt_settings`,s,async()=>{let e=await l.promptSettings.get(r);e&&(await u.promptSettings.set(r,e),d.promptSettings.upserted+=1)}),d}function J(e){return{syncDefaults:t=>q(e,t),syncDefaultsToTenants:async t=>{let n=[];for(let r of t)n.push(await q(e,r));return n}}}function Y(e){let t=X(e);return{name:`multi-tenancy`,middleware:H(e),hooks:t,routes:[{path:`/management`,handler:x(e,t)}],onRegister:async()=>{console.log(`Multi-tenancy plugin registered`),e.accessControl&&console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`),e.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`),e.databaseIsolation&&console.log(`  - Database isolation enabled`)}}}function X(e){let t=e.accessControl?i(e.accessControl):{},n=e.databaseIsolation?o(e.databaseIsolation):{},r=c(e);return{...t,...n,tenants:r}}function Z(t){let n=new e.Hono,r=X(t);return n.route(`/tenants`,x(t,r)),n}function Q(e){return{hooks:X(e),middleware:H(e),app:Z(e),config:e,wrapAdapters:(t,n)=>L(t,{controlPlaneTenantId:e.accessControl?.controlPlaneTenantId,controlPlaneClientId:n?.controlPlaneClientId})}}exports.createAccessControlHooks=i,exports.createAccessControlMiddleware=z,exports.createControlPlaneTenantMiddleware=R,exports.createDatabaseHooks=o,exports.createDatabaseMiddleware=V,exports.createDirectRolloutAdapter=J,exports.createMultiTenancy=Z,exports.createMultiTenancyHooks=X,exports.createMultiTenancyMiddleware=H,exports.createMultiTenancyPlugin=Y,exports.createProtectSyncedMiddleware=T,exports.createProvisioningHooks=c,exports.createRuntimeFallbackAdapter=P,exports.createSubdomainMiddleware=B,exports.createSyncHooks=_,exports.createTenantsOpenAPIRouter=x,exports.initMultiTenant=U,exports.mergeClientWithFallback=A,exports.projectControlPlaneDefaults=q,exports.setupMultiTenancy=Q,exports.validateTenantAccess=a,exports.withRuntimeFallback=L,exports.withSystemResourceServerInheritance=N;

package/dist/multi-tenancy.mjs

@@ -1,8 +1,9 @@
 import { Hono as e } from "hono";
-import { MANAGEMENT_API_AUDIENCE as t, MANAGEMENT_API_SCOPES as n, auth0QuerySchema as r, connectionOptionsSchema as i, connectionSchema as a, deepMergePatch as o, fetchAll as s, init as c, tenantInsertSchema as l, tenantSchema as u } from "authhero";
-import { OpenAPIHono as d, createRoute as f, z as p } from "@hono/zod-openapi";
+import { MANAGEMENT_API_AUDIENCE as t, MANAGEMENT_API_SCOPES as n, auth0QuerySchema as r, connectionInsertSchema as i, connectionOptionsSchema as a, connectionSchema as o, deepMergePatch as s, fetchAll as c, hookInsertSchema as l, init as u, resourceServerInsertSchema as d, tenantInsertSchema as f, tenantSchema as p } from "authhero";
+import { OpenAPIHono as m, createRoute as h, z as g } from "@hono/zod-openapi";
+import { HTTPException as _ } from "hono/http-exception";
 //#region src/hooks/access-control.ts
-function m(e) {
+function v(e) {
 	let { controlPlaneTenantId: t, requireOrganizationMatch: n = !0 } = e;
 	return { async onTenantAccessValidation(e, r) {
 		if (r === t) return !0;
@@ -13,14 +14,14 @@ function m(e) {
 		return !0;
 	} };
 }
-function h(e, t, n, r) {
+function y(e, t, n, r) {
 	if (t === n) return !0;
 	let i = r || e;
 	return i ? i.toLowerCase() === t.toLowerCase() : !1;
 }
 //#endregion
 //#region src/hooks/database.ts
-function g(e) {
+function b(e) {
 	return { async resolveDataAdapters(t) {
 		try {
 			return await e.getAdapters(t);
@@ -32,20 +33,20 @@ function g(e) {
 }
 //#endregion
 //#region src/hooks/provisioning.ts
-function _(e) {
+function x(e) {
 	return `urn:authhero:tenant:${e.toLowerCase()}`;
 }
-function v(e) {
+function S(e) {
 	return {
 		async beforeCreate(e, t) {
 			return !t.audience && t.id ? {
 				...t,
-				audience: _(t.id)
+				audience: x(t.id)
 			} : t;
 		},
 		async afterCreate(t, n) {
 			let { accessControl: r, databaseIsolation: i } = e;
-			r && t.ctx && await y(t, n, r), i?.onProvision && await i.onProvision(n.id);
+			r && t.ctx && await C(t, n, r), i?.onProvision && await i.onProvision(n.id);
 		},
 		async beforeDelete(t, n) {
 			let { accessControl: r, databaseIsolation: i } = e;
@@ -63,14 +64,14 @@ function v(e) {
 		}
 	};
 }
-async function y(e, t, n) {
+async function C(e, t, n) {
 	let { controlPlaneTenantId: r, defaultPermissions: i, defaultRoles: a, issuer: o, adminRoleName: s = "Tenant Admin", adminRoleDescription: c = "Full access to all tenant management operations", addCreatorToOrganization: l = !0 } = n, u = await e.adapters.organizations.create(r, {
 		name: t.id,
 		display_name: t.friendly_name || t.id
 	}), d;
-	if (o && (d = await x(e, r, s, c)), l && e.ctx) {
+	if (o && (d = await T(e, r, s, c)), l && e.ctx) {
 		let t = e.ctx.var.user;
-		if (t?.sub && !await b(e, r, t.sub)) try {
+		if (t?.sub && !await w(e, r, t.sub)) try {
 			await e.adapters.userOrganizations.create(r, {
 				user_id: t.sub,
 				organization_id: u.id
@@ -81,12 +82,12 @@ async function y(e, t, n) {
 	}
 	a && a.length > 0 && console.log(`Would assign roles ${a.join(", ")} to organization ${u.id}`), i && i.length > 0 && console.log(`Would grant permissions ${i.join(", ")} to organization ${u.id}`);
 }
-async function b(e, t, n) {
+async function w(e, t, n) {
 	let r = await e.adapters.userRoles.list(t, n, void 0, "");
 	for (let n of r) if ((await e.adapters.rolePermissions.list(t, n.id, { per_page: 1e3 })).some((e) => e.permission_name === "admin:organizations")) return !0;
 	return !1;
 }
-async function x(e, r, i, a) {
+async function T(e, r, i, a) {
 	let o = (await e.adapters.roles.list(r, {})).roles.find((e) => e.name === i);
 	if (o) return o.id;
 	let s = await e.adapters.roles.create(r, {
@@ -101,7 +102,7 @@ async function x(e, r, i, a) {
 }
 //#endregion
 //#region src/hooks/sync.ts
-function S(e, t, n = () => !0) {
+function E(e, t, n = () => !0) {
 	let { controlPlaneTenantId: r, getChildTenantIds: i, getAdapters: a } = e, o = /* @__PURE__ */ new Map();
 	async function s(e, n, r) {
 		return (await t(e).list(n, {
@@ -156,11 +157,11 @@ function S(e, t, n = () => !0) {
 		}
 	};
 }
-function C(e, t, n = () => !0) {
+function D(e, t, n = () => !0) {
 	let { controlPlaneTenantId: r, getControlPlaneAdapters: i, getAdapters: a } = e;
 	return { async afterCreate(e, o) {
 		if (o.id !== r) try {
-			let e = await i(), c = await a(o.id), l = t(e), u = t(c), d = await s((e) => l.listPaginated(r, e), l.listKey, {
+			let e = await i(), s = await a(o.id), l = t(e), u = t(s), d = await c((e) => l.listPaginated(r, e), l.listKey, {
 				cursorField: "id",
 				pageSize: 100
 			});
@@ -180,7 +181,7 @@ function C(e, t, n = () => !0) {
 		}
 	} };
 }
-var w = (e) => ({
+var O = (e) => ({
 	list: async (t, n) => (await e.resourceServers.list(t, n)).resource_servers,
 	listPaginated: (t, n) => e.resourceServers.list(t, n),
 	get: (t, n) => e.resourceServers.get(t, n),
@@ -198,7 +199,7 @@ var w = (e) => ({
 		token_lifetime: e.token_lifetime,
 		token_lifetime_for_web: e.token_lifetime_for_web
 	})
-}), T = (e) => ({
+}), k = (e) => ({
 	list: async (t, n) => (await e.roles.list(t, n)).roles,
 	listPaginated: (t, n) => e.roles.list(t, n),
 	get: (t, n) => e.roles.get(t, n),
@@ -213,15 +214,15 @@ var w = (e) => ({
 		description: e.description
 	})
 });
-function E(e) {
+function A(e) {
 	return e.metadata?.sync !== !1;
 }
-function D(e) {
-	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => E(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => E(e) ? n.roles ? n.roles(e) : !0 : !1, c = r ? S(e, w, a) : void 0, l = i ? S(e, T, o) : void 0, u = r ? C(e, w, a) : void 0, d = i ? C(e, T, o) : void 0, f = i ? { async afterCreate(t, r) {
+function j(e) {
+	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => A(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => A(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? E(e, O, a) : void 0, l = i ? E(e, k, o) : void 0, u = r ? D(e, O, a) : void 0, d = i ? D(e, k, o) : void 0, f = i ? { async afterCreate(t, r) {
 		if (r.id !== e.controlPlaneTenantId) {
 			await d?.afterCreate?.(t, r);
 			try {
-				let t = await e.getControlPlaneAdapters(), i = await e.getAdapters(r.id), a = await s((n) => t.roles.list(e.controlPlaneTenantId, n), "roles", {
+				let t = await e.getControlPlaneAdapters(), i = await e.getAdapters(r.id), a = await c((n) => t.roles.list(e.controlPlaneTenantId, n), "roles", {
 					cursorField: "id",
 					pageSize: 100
 				}), o = /* @__PURE__ */ new Map();
@@ -255,7 +256,7 @@ function D(e) {
 	}
 	return {
 		entityHooks: {
-			resourceServers: c,
+			resourceServers: s,
 			roles: l
 		},
 		tenantHooks: { async afterCreate(e, t) {
@@ -271,42 +272,42 @@ function D(e) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/hono@4.12.25/node_modules/hono/dist/http-exception.js
-var O = class extends Error {
-	res;
-	status;
-	constructor(e = 500, t) {
-		super(t?.message, { cause: t?.cause }), this.res = t?.res, this.status = e;
-	}
-	getResponse() {
-		return this.res ? new Response(this.res.body, {
-			status: this.status,
-			headers: this.res.headers
-		}) : new Response(this.message, { status: this.status });
-	}
-};
-//#endregion
 //#region src/routes/tenants.ts
-function k(e, t) {
-	let n = new d();
-	return n.openapi(f({
+var ee = g.object({
+	sub: g.string(),
+	tenant_id: g.string().optional(),
+	org_id: g.string().optional(),
+	scope: g.string().optional(),
+	permissions: g.array(g.string()).optional()
+}).passthrough();
+function te(e) {
+	let t = ee.safeParse(e);
+	return t.success ? t.data : void 0;
+}
+function ne(e) {
+	let t = e.permissions ?? [], n = e.scope ? e.scope.split(" ").filter(Boolean) : [], r = new Set([...t, ...n]);
+	return r.has("delete:tenants") || r.has("admin:organizations");
+}
+function M(e, t) {
+	let n = new m();
+	return n.openapi(h({
 		tags: ["tenants"],
 		method: "get",
 		path: "/",
 		request: { query: r },
 		security: [{ Bearer: [] }],
 		responses: { 200: {
-			content: { "application/json": { schema: p.object({
-				tenants: p.array(u),
-				start: p.number().optional(),
-				limit: p.number().optional(),
-				length: p.number().optional()
+			content: { "application/json": { schema: g.object({
+				tenants: g.array(p),
+				start: g.number().optional(),
+				limit: g.number().optional(),
+				length: g.number().optional()
 			}) } },
 			description: "List of tenants"
 		} }
 	}), async (t) => {
-		let { page: n, per_page: r, include_totals: i, q: a } = t.req.valid("query"), o = t.var.user, c = o?.permissions || [];
-		if (!(o?.org_id ?? t.var.organization_id) && c.includes("admin:organizations")) {
+		let { page: n, per_page: r, include_totals: i, q: a } = t.req.valid("query"), o = t.var.user, s = o?.permissions || [];
+		if (!(o?.org_id ?? t.var.organization_id) && s.includes("admin:organizations")) {
 			let e = await t.env.data.tenants.list({
 				page: n,
 				per_page: r,
@@ -321,21 +322,21 @@ function k(e, t) {
 			}) : t.json({ tenants: e.tenants });
 		}
 		let l = e.accessControl?.controlPlaneTenantId ?? t.env.data.multiTenancyConfig?.controlPlaneTenantId;
-		if (l && !o?.sub) throw new O(403, { message: "Access denied: token has no subject" });
+		if (l && !o?.sub) throw new _(403, { message: "Access denied: token has no subject" });
 		if (l && o?.sub) {
-			let e = (await s((e) => t.env.data.userOrganizations.listUserOrganizations(l, o.sub, e), "organizations")).map((e) => e.name);
+			let e = (await c((e) => t.env.data.userOrganizations.listUserOrganizations(l, o.sub, e), "organizations")).map((e) => e.name);
 			if (e.length === 0) return i ? t.json({
 				tenants: [],
 				start: 0,
 				limit: r ?? 50,
 				length: 0
 			}) : t.json({ tenants: [] });
-			let c = e.length, u = n ?? 0, d = r ?? 50, f = u * d, p = e.slice(f, f + d);
+			let s = e.length, u = n ?? 0, d = r ?? 50, f = u * d, p = e.slice(f, f + d);
 			if (p.length === 0) return i ? t.json({
 				tenants: [],
 				start: f,
 				limit: d,
-				length: c
+				length: s
 			}) : t.json({ tenants: [] });
 			let m = p.map((e) => `id:${e}`).join(" OR "), h = a ? `(${m}) AND (${a})` : m, g = await t.env.data.tenants.list({
 				q: h,
@@ -346,7 +347,7 @@ function k(e, t) {
 				tenants: g.tenants,
 				start: f,
 				limit: d,
-				length: c
+				length: s
 			}) : t.json({ tenants: g.tenants });
 		}
 		let u = await t.env.data.tenants.list({
@@ -361,22 +362,22 @@ function k(e, t) {
 			limit: u.totals?.limit ?? r,
 			length: u.tenants.length
 		}) : t.json({ tenants: u.tenants });
-	}), n.openapi(f({
+	}), n.openapi(h({
 		tags: ["tenants"],
 		method: "post",
 		path: "/",
-		request: { body: { content: { "application/json": { schema: l } } } },
+		request: { body: { content: { "application/json": { schema: f } } } },
 		security: [{ Bearer: [] }],
 		responses: {
 			201: {
-				content: { "application/json": { schema: u } },
+				content: { "application/json": { schema: p } },
 				description: "Tenant created"
 			},
 			400: { description: "Validation error" },
 			409: { description: "Tenant with this ID already exists" }
 		}
 	}), async (e) => {
-		if (!e.var.user?.sub) throw new O(401, { message: "Authentication required to create tenants" });
+		if (!e.var.user?.sub) throw new _(401, { message: "Authentication required to create tenants" });
 		let n = e.req.valid("json"), r = {
 			adapters: e.env.data,
 			ctx: e
@@ -384,11 +385,11 @@ function k(e, t) {
 		t.tenants?.beforeCreate && (n = await t.tenants.beforeCreate(r, n));
 		let i = await e.env.data.tenants.create(n);
 		return t.tenants?.afterCreate && await t.tenants.afterCreate(r, i), e.json(i, 201);
-	}), n.openapi(f({
+	}), n.openapi(h({
 		tags: ["tenants"],
 		method: "delete",
 		path: "/{id}",
-		request: { params: p.object({ id: p.string() }) },
+		request: { params: g.object({ id: g.string() }) },
 		security: [{ Bearer: ["delete:tenants"] }],
 		responses: {
 			204: { description: "Tenant deleted" },
@@ -398,58 +399,62 @@ function k(e, t) {
 	}), async (n) => {
 		let { id: r } = n.req.valid("param"), i = e.accessControl?.controlPlaneTenantId ?? n.env.data.multiTenancyConfig?.controlPlaneTenantId;
 		if (i) {
-			let e = n.var.user;
-			if (!e?.sub) throw new O(401, { message: "Authentication required" });
-			if (r === i) throw new O(403, { message: "Cannot delete the control plane" });
+			let e = te(n.var.user);
+			if (!e?.sub) throw new _(401, { message: "Authentication required" });
+			if (r === i) throw new _(403, { message: "Cannot delete the control plane" });
 			let t = n.var.org_name, a = r.toLowerCase(), o = !!t && t.toLowerCase() === a;
-			if (o ||= (await s((t) => n.env.data.userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new O(403, { message: "Access denied to this tenant" });
+			if (!o) {
+				let r = !!(e.org_id ?? n.var.organization_id ?? t), a = !e.tenant_id || e.tenant_id === i;
+				!r && a && ne(e) && (o = !0);
+			}
+			if (o ||= (await c((t) => n.env.data.userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new _(403, { message: "Access denied to this tenant" });
 		}
-		if (!await n.env.data.tenants.get(r)) throw new O(404, { message: "Tenant not found" });
+		if (!await n.env.data.tenants.get(r)) throw new _(404, { message: "Tenant not found" });
 		let a = {
 			adapters: n.env.data,
 			ctx: n
 		};
 		return t.tenants?.beforeDelete && await t.tenants.beforeDelete(a, r), await n.env.data.tenants.remove(r), t.tenants?.afterDelete && await t.tenants.afterDelete(a, r), n.body(null, 204);
-	}), n.openapi(f({
+	}), n.openapi(h({
 		tags: ["tenants", "settings"],
 		method: "get",
 		path: "/settings",
-		request: { headers: p.object({ "tenant-id": p.string().optional() }) },
+		request: { headers: g.object({ "tenant-id": g.string().optional() }) },
 		security: [{ Bearer: ["read:tenants"] }],
 		responses: { 200: {
-			content: { "application/json": { schema: u } },
+			content: { "application/json": { schema: p } },
 			description: "Current tenant settings"
 		} }
 	}), async (e) => {
 		let t = await e.env.data.tenants.get(e.var.tenant_id);
-		if (!t) throw new O(404, { message: "Tenant not found" });
+		if (!t) throw new _(404, { message: "Tenant not found" });
 		return e.json(t);
-	}), n.openapi(f({
+	}), n.openapi(h({
 		tags: ["tenants", "settings"],
 		method: "patch",
 		path: "/settings",
 		request: {
-			headers: p.object({ "tenant-id": p.string().optional() }),
-			body: { content: { "application/json": { schema: p.object(l.shape).partial() } } }
+			headers: g.object({ "tenant-id": g.string().optional() }),
+			body: { content: { "application/json": { schema: g.object(f.shape).partial() } } }
 		},
 		security: [{ Bearer: ["update:tenants"] }],
 		responses: { 200: {
-			content: { "application/json": { schema: u } },
+			content: { "application/json": { schema: p } },
 			description: "Updated tenant settings"
 		} }
 	}), async (e) => {
 		let { id: t, ...n } = e.req.valid("json"), r = await e.env.data.tenants.get(e.var.tenant_id);
-		if (!r) throw new O(404, { message: "Tenant not found" });
-		let i = o(r, n);
+		if (!r) throw new _(404, { message: "Tenant not found" });
+		let i = s(r, n);
 		await e.env.data.tenants.update(e.var.tenant_id, i);
 		let a = await e.env.data.tenants.get(e.var.tenant_id);
-		if (!a) throw new O(500, { message: "Failed to retrieve updated tenant" });
+		if (!a) throw new _(500, { message: "Failed to retrieve updated tenant" });
 		return e.json(a);
 	}), n;
 }
 //#endregion
 //#region src/middleware/protect-synced.ts
-function A(e) {
+function N(e) {
 	for (let { pattern: t, type: n } of [
 		{
 			pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
@@ -472,7 +477,7 @@ function A(e) {
 	}
 	return null;
 }
-async function j(e, t, n) {
+async function re(e, t, n) {
 	try {
 		switch (n.type) {
 			case "resource_server": return (await e.resourceServers.get(t, n.id))?.is_system === !0;
@@ -484,47 +489,47 @@ async function j(e, t, n) {
 		return !1;
 	}
 }
-function M(e) {
+function ie(e) {
 	return {
 		resource_server: "resource server",
 		role: "role",
 		connection: "connection"
 	}[e];
 }
-function N() {
+function P() {
 	return async (e, t) => {
 		if (![
 			"PATCH",
 			"PUT",
 			"DELETE"
 		].includes(e.req.method)) return t();
-		let n = A(e.req.path);
+		let n = N(e.req.path);
 		if (!n) return t();
 		let r = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
 		if (!r) return t();
-		if (await j(e.env.data, r, n)) throw new O(403, { message: `This ${M(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
+		if (await re(e.env.data, r, n)) throw new _(403, { message: `This ${ie(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
 		return t();
 	};
 }
 //#endregion
 //#region src/middleware/settings-inheritance.ts
-function P(e, t) {
+function F(e, t) {
 	let n = t.find((t) => t.strategy === e.strategy);
 	if (!n?.options) return e;
-	let r = a.passthrough().parse({
+	let r = o.passthrough().parse({
 		...n,
 		...e
 	});
-	return r.options = i.passthrough().parse({
+	return r.options = a.passthrough().parse({
 		...n.options || {},
 		...e.options
 	}), r;
 }
-function F(e, t) {
+function I(e, t) {
 	let n = [...t || [], ...e || []];
 	return [...new Set(n)];
 }
-function I(e, t) {
+function ae(e, t) {
 	if (!t?.length) return e || [];
 	if (!e?.length) return t;
 	let n = /* @__PURE__ */ new Map();
@@ -535,19 +540,19 @@ function I(e, t) {
 function L(e, t) {
 	return t ? {
 		...e,
-		scopes: I(e.scopes, t.scopes)
+		scopes: ae(e.scopes, t.scopes)
 	} : e;
 }
-function R(e, t) {
+function oe(e, t) {
 	return t ? {
 		...e,
-		callbacks: F(e.callbacks, t.callbacks),
-		web_origins: F(e.web_origins, t.web_origins),
-		allowed_logout_urls: F(e.allowed_logout_urls, t.allowed_logout_urls),
-		allowed_origins: F(e.allowed_origins, t.allowed_origins)
+		callbacks: I(e.callbacks, t.callbacks),
+		web_origins: I(e.web_origins, t.web_origins),
+		allowed_logout_urls: I(e.allowed_logout_urls, t.allowed_logout_urls),
+		allowed_origins: I(e.allowed_origins, t.allowed_origins)
 	} : e;
 }
-function z(e) {
+function R(e) {
 	let { controlPlaneTenantId: t, controlPlaneClientId: n, resolveControlPlane: r } = e;
 	if (r) return async (e) => r({ tenant_id: e });
 	if (!t) return async () => void 0;
@@ -557,7 +562,7 @@ function z(e) {
 	};
 	return async () => i;
 }
-function B(e, t) {
+function z(e, t) {
 	return {
 		...e.resourceServers,
 		get: async (n, r) => {
@@ -584,18 +589,18 @@ function B(e, t) {
 		}
 	};
 }
-function V(e, t) {
-	let n = z({
+function B(e, t) {
+	let n = R({
 		controlPlaneTenantId: t.controlPlaneTenantId,
 		resolveControlPlane: t.resolveControlPlane
 	});
 	return {
 		...e,
-		resourceServers: B(e, n)
+		resourceServers: z(e, n)
 	};
 }
-function H(e, t) {
-	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i } = t, a = z({
+function V(e, t) {
+	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i } = t, a = R({
 		controlPlaneTenantId: n,
 		controlPlaneClientId: r,
 		resolveControlPlane: i
@@ -613,12 +618,12 @@ function H(e, t) {
 				let r = await e.connections.get(t, n);
 				if (!r) return r;
 				let i = await a(t);
-				return !i || t === i.tenantId ? r : P(r, (await e.connections.list(i.tenantId)).connections || []);
+				return !i || t === i.tenantId ? r : F(r, (await e.connections.list(i.tenantId)).connections || []);
 			},
 			list: async (t, n) => {
 				let r = await e.connections.list(t, n), i = await a(t);
 				if (!i || t === i.tenantId) return r;
-				let o = await e.connections.list(i.tenantId), s = r.connections.map((e) => P(e, o.connections || []));
+				let o = await e.connections.list(i.tenantId), s = r.connections.map((e) => F(e, o.connections || []));
 				return {
 					...r,
 					connections: s
@@ -633,7 +638,7 @@ function H(e, t) {
 				let i = await a(t);
 				if (!i || t === i.tenantId) return r;
 				let o = await e.connections.list(i.tenantId);
-				return r.map((e) => P(e, o.connections || []));
+				return r.map((e) => F(e, o.connections || []));
 			}
 		},
 		emailProviders: {
@@ -645,22 +650,22 @@ function H(e, t) {
 				return !r || t === r.tenantId ? null : e.emailProviders.get(r.tenantId);
 			}
 		},
-		resourceServers: B(e, a),
-		hooks: W(e, a)
+		resourceServers: z(e, a),
+		hooks: se(e, a)
 	};
 }
-function U(e) {
+function H(e) {
 	if (!e || typeof e != "object") return !1;
 	let t = e.metadata;
 	return !t || typeof t != "object" ? !1 : t.inheritable === !0;
 }
-function W(e, t) {
+function se(e, t) {
 	return {
 		...e.hooks,
 		list: async (n, r) => {
 			let i = await e.hooks.list(n, r), a = await t(n);
 			if (!a || n === a.tenantId) return i;
-			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(U);
+			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(H);
 			if (o.length === 0) return i;
 			let s = new Set((i.hooks || []).map((e) => e.hook_id)), c = o.filter((e) => !s.has(e.hook_id));
 			return {
@@ -675,31 +680,31 @@ function W(e, t) {
 			let a = await t(n);
 			if (!a || n === a.tenantId) return i;
 			let o = await e.hooks.get(a.tenantId, r);
-			return o && U(o) ? o : null;
+			return o && H(o) ? o : null;
 		}
 	};
 }
-function G(e, t) {
-	return H(e, t);
+function U(e, t) {
+	return V(e, t);
 }
 //#endregion
 //#region src/middleware/index.ts
-function K(e) {
+function W(e) {
 	return async (t, n) => {
 		let r = t.var.user;
 		return r?.tenant_id === e && r.org_name && t.set("tenant_id", r.org_name), n();
 	};
 }
-function q(e) {
+function G(e) {
 	return async (n, r) => {
 		if (!e.accessControl) return r();
 		let { controlPlaneTenantId: i } = e.accessControl, a = n.var.org_name, o = n.var.organization_id, s = a || o, c = n.var.tenant_id, l = n.var.user, u = (l?.aud ? Array.isArray(l.aud) ? l.aud : [l.aud] : []).includes(t);
-		if (!c && s && u && (n.set("tenant_id", s), c = s), !c) throw new O(400, { message: "Tenant ID not found in request" });
-		if (!h(o, c, i, a)) throw new O(403, { message: `Access denied to tenant ${c}` });
+		if (!c && s && u && (n.set("tenant_id", s), c = s), !c) throw new _(400, { message: "Tenant ID not found in request" });
+		if (!y(o, c, i, a)) throw new _(403, { message: `Access denied to tenant ${c}` });
 		return r();
 	};
 }
-function J(e) {
+function K(e) {
 	return async (t, n) => {
 		if (!e.subdomainRouting) return n();
 		let { baseDomain: r, reservedSubdomains: i = [], resolveSubdomain: a } = e.subdomainRouting, o = t.req.header("x-forwarded-host") || t.req.header("host") || "", s = null;
@@ -714,43 +719,43 @@ function J(e) {
 			let n = await t.env.data.organizations.get(e.accessControl.controlPlaneTenantId, s);
 			n && (c = n.id);
 		} catch {}
-		if (!c) throw new O(404, { message: `Tenant not found for subdomain: ${s}` });
+		if (!c) throw new _(404, { message: `Tenant not found for subdomain: ${s}` });
 		return t.set("tenant_id", c), n();
 	};
 }
-function Y(e) {
+function q(e) {
 	return async (t, n) => {
 		if (!e.databaseIsolation) return n();
 		let r = t.var.tenant_id;
-		if (!r) throw new O(400, { message: "Tenant ID not found in request" });
+		if (!r) throw new _(400, { message: "Tenant ID not found in request" });
 		try {
 			let n = await e.databaseIsolation.getAdapters(r);
 			t.env.data = n;
 		} catch (e) {
-			throw console.error(`Failed to resolve database for tenant ${r}:`, e), new O(500, { message: "Failed to resolve tenant database" });
+			throw console.error(`Failed to resolve database for tenant ${r}:`, e), new _(500, { message: "Failed to resolve tenant database" });
 		}
 		return n();
 	};
 }
-function X(e) {
-	let t = J(e), n = q(e), r = Y(e);
+function J(e) {
+	let t = K(e), n = G(e), r = q(e);
 	return async (e, i) => (await t(e, async () => {}), await n(e, async () => {}), await r(e, async () => {}), i());
 }
 //#endregion
 //#region src/init.ts
-function Z(e) {
+function ce(e) {
 	let { dataAdapter: t, controlPlane: n, controlPlane: { tenantId: r = "control_plane", clientId: i } = {}, resolveControlPlane: a, sync: o = {
 		resourceServers: !0,
 		roles: !0
-	}, defaultPermissions: l = ["tenant:admin"], requireOrganizationMatch: u = !1, managementApiExtensions: d = [], entityHooks: f, getChildTenantIds: p, getAdapters: m, ...h } = e;
+	}, defaultPermissions: s = ["tenant:admin"], requireOrganizationMatch: l = !1, managementApiExtensions: d = [], entityHooks: f, getChildTenantIds: p, getAdapters: m, ...h } = e;
 	if (a && !n) throw Error("initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it.");
 	let g = t, _ = t;
-	n && (g = G(t, {
+	n && (g = U(t, {
 		controlPlaneTenantId: r,
 		controlPlaneClientId: i,
 		resolveControlPlane: a
 	}), _ = {
-		...V(t, {
+		...B(t, {
 			controlPlaneTenantId: r,
 			resolveControlPlane: a
 		}),
@@ -760,46 +765,46 @@ function Z(e) {
 			resolveControlPlane: a
 		}
 	});
-	let y = o !== !1, b = y ? {
+	let v = o !== !1, y = v ? {
 		resourceServers: o.resourceServers ?? !0,
 		roles: o.roles ?? !0
 	} : {
 		resourceServers: !1,
 		roles: !1
-	}, { entityHooks: x, tenantHooks: S } = D({
+	}, { entityHooks: b, tenantHooks: x } = j({
 		controlPlaneTenantId: r,
-		getChildTenantIds: p ?? (async () => (await s((e) => g.tenants.list(e), "tenants", {
+		getChildTenantIds: p ?? (async () => (await c((e) => g.tenants.list(e), "tenants", {
 			cursorField: "id",
 			pageSize: 100
 		})).filter((e) => e.id !== r).map((e) => e.id)),
 		getAdapters: m ?? (async () => g),
 		getControlPlaneAdapters: async () => g,
-		sync: b
+		sync: y
 	}), C = {
-		resourceServers: [x.resourceServers, ...f?.resourceServers ?? []],
-		roles: [x.roles, ...f?.roles ?? []],
+		resourceServers: [b.resourceServers, ...f?.resourceServers ?? []],
+		roles: [b.roles, ...f?.roles ?? []],
 		connections: f?.connections ?? [],
 		tenants: f?.tenants ?? [],
 		rolePermissions: f?.rolePermissions ?? []
-	}, w = v({ accessControl: {
+	}, w = S({ accessControl: {
 		controlPlaneTenantId: r,
-		requireOrganizationMatch: u,
-		defaultPermissions: l
-	} }), T = k({ accessControl: {
+		requireOrganizationMatch: l,
+		defaultPermissions: s
+	} }), T = M({ accessControl: {
 		controlPlaneTenantId: r,
-		requireOrganizationMatch: u,
-		defaultPermissions: l
+		requireOrganizationMatch: l,
+		defaultPermissions: s
 	} }, { tenants: {
 		async beforeCreate(e, t) {
-			return w.beforeCreate && (t = await w.beforeCreate(e, t)), S.beforeCreate && (t = await S.beforeCreate(e, t)), t;
+			return w.beforeCreate && (t = await w.beforeCreate(e, t)), x.beforeCreate && (t = await x.beforeCreate(e, t)), t;
 		},
 		async afterCreate(e, t) {
-			await w.afterCreate?.(e, t), await S.afterCreate?.(e, t);
+			await w.afterCreate?.(e, t), await x.afterCreate?.(e, t);
 		},
 		async beforeDelete(e, t) {
-			await w.beforeDelete?.(e, t), await S.beforeDelete?.(e, t);
+			await w.beforeDelete?.(e, t), await x.beforeDelete?.(e, t);
 		}
-	} }), { app: E } = c({
+	} }), { app: E } = u({
 		dataAdapter: g,
 		managementDataAdapter: _,
 		...h,
@@ -809,22 +814,116 @@ function Z(e) {
 			router: T
 		}]
 	});
-	return E.use("/api/v2/*", K(r)), y && E.use("/api/v2/*", N()), {
+	return E.use("/api/v2/*", W(r)), v && E.use("/api/v2/*", P()), {
 		app: E,
 		controlPlaneTenantId: r
 	};
 }
 //#endregion
+//#region src/rollout/defaults-projection.ts
+function Y() {
+	return {
+		upserted: 0,
+		errors: []
+	};
+}
+function le(e) {
+	let t = e.metadata;
+	return !!(t && t.inheritable === !0);
+}
+async function X(e, t, n, r) {
+	try {
+		await r();
+	} catch (r) {
+		let i = `${t}: ${r instanceof Error ? r.message : String(r)}`;
+		if (!n) throw Error(i, { cause: r });
+		e.errors.push(i);
+	}
+}
+async function Z(e, t) {
+	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: a, entities: o = {}, continueOnError: s = !1 } = e, u = {
+		connections: o.connections ?? !0,
+		resourceServers: o.resourceServers ?? !0,
+		hooks: o.hooks ?? !0,
+		emailProvider: o.emailProvider ?? !0,
+		branding: o.branding ?? !0,
+		promptSettings: o.promptSettings ?? !0
+	}, f = await r(), p = await a(t), m = {
+		tenantId: t,
+		connections: Y(),
+		resourceServers: Y(),
+		hooks: Y(),
+		emailProvider: Y(),
+		branding: Y(),
+		promptSettings: Y()
+	};
+	if (u.connections) {
+		let e = await c((e) => f.connections.list(n, e), "connections", {
+			cursorField: "id",
+			pageSize: 100
+		});
+		for (let t of e) {
+			let e = t.id;
+			e && await X(m.connections, `connection ${e}`, s, async () => {
+				let r = i.parse(t);
+				await p.connections.get(n, e) ? await p.connections.update(n, e, r) : await p.connections.create(n, r), m.connections.upserted += 1;
+			});
+		}
+	}
+	if (u.resourceServers) {
+		let e = await c((e) => f.resourceServers.list(n, e), "resource_servers", {
+			cursorField: "id",
+			pageSize: 100
+		});
+		for (let t of e) !t.is_system || !t.id || await X(m.resourceServers, `resource_server ${t.id}`, s, async () => {
+			let e = d.parse(t);
+			await p.resourceServers.get(n, t.id) ? await p.resourceServers.update(n, t.id, e) : await p.resourceServers.create(n, e), m.resourceServers.upserted += 1;
+		});
+	}
+	if (u.hooks) {
+		let e = await c((e) => f.hooks.list(n, e), "hooks", {
+			cursorField: "hook_id",
+			pageSize: 100
+		});
+		for (let t of e) !le(t) || !t.hook_id || await X(m.hooks, `hook ${t.hook_id}`, s, async () => {
+			let e = l.parse(t);
+			await p.hooks.get(n, t.hook_id) ? await p.hooks.update(n, t.hook_id, e) : await p.hooks.create(n, e), m.hooks.upserted += 1;
+		});
+	}
+	return u.emailProvider && await X(m.emailProvider, "email_provider", s, async () => {
+		let e = await f.emailProviders.get(n);
+		e && (await p.emailProviders.get(n) ? await p.emailProviders.update(n, e) : await p.emailProviders.create(n, e), m.emailProvider.upserted += 1);
+	}), u.branding && await X(m.branding, "branding", s, async () => {
+		let e = await f.branding.get(n);
+		e && (await p.branding.set(n, e), m.branding.upserted += 1);
+	}), u.promptSettings && await X(m.promptSettings, "prompt_settings", s, async () => {
+		let e = await f.promptSettings.get(n);
+		e && (await p.promptSettings.set(n, e), m.promptSettings.upserted += 1);
+	}), m;
+}
+//#endregion
+//#region src/rollout/index.ts
+function ue(e) {
+	return {
+		syncDefaults: (t) => Z(e, t),
+		syncDefaultsToTenants: async (t) => {
+			let n = [];
+			for (let r of t) n.push(await Z(e, r));
+			return n;
+		}
+	};
+}
+//#endregion
 //#region src/plugin.ts
-function ee(e) {
+function de(e) {
 	let t = Q(e);
 	return {
 		name: "multi-tenancy",
-		middleware: X(e),
+		middleware: J(e),
 		hooks: t,
 		routes: [{
 			path: "/management",
-			handler: k(e, t)
+			handler: M(e, t)
 		}],
 		onRegister: async () => {
 			console.log("Multi-tenancy plugin registered"), e.accessControl && console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`), e.subdomainRouting && console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`), e.databaseIsolation && console.log("  - Database isolation enabled");
@@ -834,7 +933,7 @@ function ee(e) {
 //#endregion
 //#region src/index.ts
 function Q(e) {
-	let t = e.accessControl ? m(e.accessControl) : {}, n = e.databaseIsolation ? g(e.databaseIsolation) : {}, r = v(e);
+	let t = e.accessControl ? v(e.accessControl) : {}, n = e.databaseIsolation ? b(e.databaseIsolation) : {}, r = S(e);
 	return {
 		...t,
 		...n,
@@ -843,19 +942,19 @@ function Q(e) {
 }
 function $(t) {
 	let n = new e(), r = Q(t);
-	return n.route("/tenants", k(t, r)), n;
+	return n.route("/tenants", M(t, r)), n;
 }
-function te(e) {
+function fe(e) {
 	return {
 		hooks: Q(e),
-		middleware: X(e),
+		middleware: J(e),
 		app: $(e),
 		config: e,
-		wrapAdapters: (t, n) => G(t, {
+		wrapAdapters: (t, n) => U(t, {
 			controlPlaneTenantId: e.accessControl?.controlPlaneTenantId,
 			controlPlaneClientId: n?.controlPlaneClientId
 		})
 	};
 }
 //#endregion
-export { m as createAccessControlHooks, q as createAccessControlMiddleware, K as createControlPlaneTenantMiddleware, g as createDatabaseHooks, Y as createDatabaseMiddleware, $ as createMultiTenancy, Q as createMultiTenancyHooks, X as createMultiTenancyMiddleware, ee as createMultiTenancyPlugin, N as createProtectSyncedMiddleware, v as createProvisioningHooks, H as createRuntimeFallbackAdapter, J as createSubdomainMiddleware, D as createSyncHooks, k as createTenantsOpenAPIRouter, Z as initMultiTenant, R as mergeClientWithFallback, te as setupMultiTenancy, h as validateTenantAccess, G as withRuntimeFallback, V as withSystemResourceServerInheritance };
+export { v as createAccessControlHooks, G as createAccessControlMiddleware, W as createControlPlaneTenantMiddleware, b as createDatabaseHooks, q as createDatabaseMiddleware, ue as createDirectRolloutAdapter, $ as createMultiTenancy, Q as createMultiTenancyHooks, J as createMultiTenancyMiddleware, de as createMultiTenancyPlugin, P as createProtectSyncedMiddleware, S as createProvisioningHooks, V as createRuntimeFallbackAdapter, K as createSubdomainMiddleware, j as createSyncHooks, M as createTenantsOpenAPIRouter, ce as initMultiTenant, oe as mergeClientWithFallback, Z as projectControlPlaneDefaults, fe as setupMultiTenancy, y as validateTenantAccess, U as withRuntimeFallback, B as withSystemResourceServerInheritance };

package/dist/types/index.d.ts

@@ -3,6 +3,8 @@ import { MultiTenancyConfig, MultiTenancyHooks, MultiTenancyBindings, MultiTenan
 export * from "./types";
 export { initMultiTenant } from "./init";
 export type { MultiTenantConfig, MultiTenantResult, ControlPlaneConfig, } from "./init";
+export { createDirectRolloutAdapter, projectControlPlaneDefaults, } from "./rollout";
+export type { ControlPlaneRolloutAdapter, DefaultsProjectionConfig, DefaultsProjectionEntities, DefaultsProjectionResult, EntityProjectionOutcome, } from "./rollout";
 export { createSyncHooks } from "./hooks/sync";
 export type { EntitySyncConfig, SyncHooksResult } from "./hooks/sync";
 export { createTenantsOpenAPIRouter } from "./routes";

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAajB,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAGhB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,kCAAkC,EAClC,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEhF,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAgBnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB;cAE/C,oBAAoB;eACnB,qBAAqB;0CASnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB;;;;;;;kBAnD9C,oBAAoB;mBACnB,qBAAqB;;;IAwDhC;;;;;;;OAOG;6BAES,OAAO,UAAU,EAAE,YAAY,qBACtB;QAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE;EAOzD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAajB,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAKhB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,kCAAkC,EAClC,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEhF,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAgBnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB;cAE/C,oBAAoB;eACnB,qBAAqB;0CASnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB;;;;;;;kBAnD9C,oBAAoB;mBACnB,qBAAqB;;;IAwDhC;;;;;;;OAOG;6BAES,OAAO,UAAU,EAAE,YAAY,qBACtB;QAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE;EAOzD"}

package/dist/types/rollout/defaults-projection.d.ts

@@ -0,0 +1,74 @@
+import { DataAdapters } from "authhero";
+/**
+ * Which control plane entities to project into a tenant's own database. Every
+ * entity defaults to `true`.
+ *
+ * The projected rows are the same set the runtime fallback
+ * (`withRuntimeFallback`) reads from the control plane tenant: connections,
+ * `is_system` resource servers, `inheritable` hooks and the email provider.
+ * `branding` and `promptSettings` are projected too so a WFP tenant can render
+ * the control plane's defaults; consuming them on read still depends on the
+ * tenant resolving those singletons against the control plane tenant id.
+ */
+export interface DefaultsProjectionEntities {
+    connections?: boolean;
+    resourceServers?: boolean;
+    hooks?: boolean;
+    emailProvider?: boolean;
+    branding?: boolean;
+    promptSettings?: boolean;
+}
+export interface DefaultsProjectionConfig {
+    /**
+     * The control plane tenant id. Projected rows are written into the target
+     * tenant's database under THIS id, so the existing runtime fallback resolves
+     * them exactly as it does in a shared database.
+     */
+    controlPlaneTenantId: string;
+    /**
+     * Adapters for reading the control plane tenant's rows. Secrets are returned
+     * decrypted (this should be the encrypted adapter), and are re-encrypted at
+     * rest by the target adapter on write.
+     */
+    getControlPlaneAdapters: () => Promise<DataAdapters>;
+    /**
+     * Adapters for the target tenant's own database. For a WFP tenant this is the
+     * adapter over the tenant's D1, ideally wrapped with a key ring that tags
+     * control-plane-tenant rows with a control-plane-only key id so the tenant
+     * operator cannot read the inherited secrets.
+     */
+    getAdapters: (tenantId: string) => Promise<DataAdapters>;
+    /** Which entities to project. All default to true. */
+    entities?: DefaultsProjectionEntities;
+    /**
+     * When false (default) the first failing entity throws, so a pilot rollout
+     * fails loudly. When true, every entity is attempted and errors are collected
+     * into the result instead.
+     */
+    continueOnError?: boolean;
+}
+export interface EntityProjectionOutcome {
+    /** Rows created or updated. */
+    upserted: number;
+    /** Non-fatal errors, populated only when `continueOnError` is true. */
+    errors: string[];
+}
+export interface DefaultsProjectionResult {
+    tenantId: string;
+    connections: EntityProjectionOutcome;
+    resourceServers: EntityProjectionOutcome;
+    hooks: EntityProjectionOutcome;
+    emailProvider: EntityProjectionOutcome;
+    branding: EntityProjectionOutcome;
+    promptSettings: EntityProjectionOutcome;
+}
+/**
+ * Projects the control plane tenant's inheritable defaults into a single target
+ * tenant's database, writing the rows under the control plane tenant id so the
+ * existing runtime fallback resolves them with no read-path change.
+ *
+ * Idempotent: every row is upserted by its stable id, so re-running the
+ * projection (a re-sync, or a later rollout) converges rather than duplicating.
+ */
+export declare function projectControlPlaneDefaults(config: DefaultsProjectionConfig, targetTenantId: string): Promise<DefaultsProjectionResult>;
+//# sourceMappingURL=defaults-projection.d.ts.map

package/dist/types/rollout/defaults-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults-projection.d.ts","sourceRoot":"","sources":["../../../src/rollout/defaults-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAQb,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;OAIG;IACH,uBAAuB,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;IAErD;;;;;OAKG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzD,sDAAsD;IACtD,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IAEtC;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,uBAAuB,CAAC;IACrC,eAAe,EAAE,uBAAuB,CAAC;IACzC,KAAK,EAAE,uBAAuB,CAAC;IAC/B,aAAa,EAAE,uBAAuB,CAAC;IACvC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,cAAc,EAAE,uBAAuB,CAAC;CACzC;AAgCD;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,wBAAwB,EAChC,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,wBAAwB,CAAC,CAyJnC"}

package/dist/types/rollout/index.d.ts

@@ -0,0 +1,30 @@
+import { DefaultsProjectionConfig, DefaultsProjectionResult } from "./defaults-projection";
+export type { DefaultsProjectionConfig, DefaultsProjectionEntities, DefaultsProjectionResult, EntityProjectionOutcome, } from "./defaults-projection";
+export { projectControlPlaneDefaults } from "./defaults-projection";
+/**
+ * A control plane rollout applies the control plane's state to one or more
+ * tenant databases. `syncDefaults` is the only operation today; schema
+ * migrations and tenant worker code deploys are the same shape (enumerate
+ * tenants, apply per-tenant, retry, resume) and will become sibling methods.
+ *
+ * The interface is the seam for execution strategy. The direct implementation
+ * runs inline — right for a single pilot tenant. A future Cloudflare Workflows
+ * implementation will satisfy the same interface with durable, retryable,
+ * resumable fan-out, with no change to callers.
+ */
+export interface ControlPlaneRolloutAdapter {
+    /** Project the control plane defaults into a single tenant's database. */
+    syncDefaults(targetTenantId: string): Promise<DefaultsProjectionResult>;
+    /**
+     * Project the defaults into several tenants. The direct implementation runs
+     * them sequentially; a Workflows implementation fans out durably.
+     */
+    syncDefaultsToTenants(targetTenantIds: string[]): Promise<DefaultsProjectionResult[]>;
+}
+/**
+ * Creates a rollout adapter that executes projections inline in the current
+ * process. Use this to validate the model with a single tenant before moving to
+ * a durable Cloudflare Workflows implementation.
+ */
+export declare function createDirectRolloutAdapter(config: DefaultsProjectionConfig): ControlPlaneRolloutAdapter;
+//# sourceMappingURL=index.d.ts.map

package/dist/types/rollout/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rollout/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAExE;;;OAGG;IACH,qBAAqB,CACnB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,wBAAwB,GAC/B,0BAA0B,CAa5B"}

package/dist/types/routes/tenants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenants.d.ts","sourceRoot":"","sources":["../../../src/routes/tenants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAkB,MAAM,mBAAmB,CAAC;AAUhE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB;cAGZ,oBAAoB;eACnB,qBAAqB;YAuenC"}
+{"version":3,"file":"tenants.d.ts","sourceRoot":"","sources":["../../../src/routes/tenants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAkB,MAAM,mBAAmB,CAAC;AAUhE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,UAAU,CAAC;AAwClB;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB;cAGZ,oBAAoB;eACnB,qBAAqB;YAggBnC"}

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "14.23.1",
+  "version": "14.24.1",
   "description": "Multi-tenancy support for AuthHero with organization-based access control and per-tenant database isolation",
   "files": [
     "dist"
@@ -37,8 +37,8 @@
     "vite": "^8.0.14",
     "vitest": "^4.1.7",
     "@authhero/adapter-interfaces": "3.1.1",
-    "@authhero/kysely-adapter": "11.8.8",
-    "authhero": "7.2.2"
+    "@authhero/kysely-adapter": "11.8.9",
+    "authhero": "8.4.1"
   },
   "dependencies": {
     "zod": "^4.4.3"