@authhero/multi-tenancy 14.25.0 → 14.26.0

package/dist/multi-tenancy.mjs

@@ -32,21 +32,236 @@ function w(e) {
 	} };
 }
 //#endregion
+//#region src/operations/instance-id.ts
+var T = 64;
+function E(e) {
+	return e.replace(/[^a-zA-Z0-9_-]/g, "-");
+}
+function ee(e) {
+	let t = E(e.id), n = Math.max(0, T - (5 + t.length)), r = E(e.kind).slice(0, n), i = 3 + r.length + 2 + t.length, a = Math.max(0, T - i);
+	return `op-${r}-${E(e.tenant_id ?? "fleet").slice(0, a)}-${t}`.slice(0, T);
+}
+//#endregion
+//#region src/operations/recorder.ts
+var te = 2048;
+function D(e) {
+	let t;
+	if (e instanceof Error) t = e.message;
+	else try {
+		t = String(e ?? "unknown error");
+	} catch {
+		t = Object.prototype.toString.call(e);
+	}
+	return t.slice(0, te);
+}
+function O(e) {
+	let { tenantOperations: t, tenantOperationEvents: n } = e;
+	return {
+		async markRunning(e, n) {
+			await t.update(e, {
+				status: "running",
+				...n === void 0 ? {} : { current_step: n }
+			});
+		},
+		async setCurrentStep(e, n) {
+			await t.update(e, { current_step: n });
+		},
+		async appendEvent(e, t) {
+			await n.create({
+				operation_id: e,
+				step: t.step,
+				outcome: t.outcome,
+				detail: t.detail,
+				attempt: t.attempt ?? 1
+			});
+		},
+		async markSucceeded(e) {
+			await t.update(e, {
+				status: "succeeded",
+				error: null,
+				finished_at: (/* @__PURE__ */ new Date()).toISOString()
+			});
+		},
+		async markFailed(e, n) {
+			await t.update(e, {
+				status: "failed",
+				error: D(n),
+				finished_at: (/* @__PURE__ */ new Date()).toISOString()
+			});
+		}
+	};
+}
+function k(e) {
+	return e === "succeeded" || e === "failed" || e === "cancelled";
+}
+//#endregion
+//#region src/operations/inline-executor.ts
+var A = { async do(e, t, n) {
+	let r = typeof t == "function" ? t : n;
+	if (!r) throw Error("StepRunner.do called without a function");
+	return r();
+} };
+function ne(e) {
+	let t = O(e.stores);
+	return {
+		engine: "inline",
+		async start(n) {
+			let r = e.definitions[n.kind];
+			if (!r) {
+				let e = /* @__PURE__ */ Error(`No inline operation definition for kind "${n.kind}"`);
+				throw await t.markFailed(n.id, e), e;
+			}
+			let i = r(n);
+			await t.markRunning(n.id, i[0]?.name);
+			for (let e of i) {
+				await t.setCurrentStep(n.id, e.name), await t.appendEvent(n.id, {
+					step: e.name,
+					outcome: "started"
+				});
+				try {
+					let r = await e.run({
+						operation: n,
+						step: A
+					});
+					await t.appendEvent(n.id, {
+						step: e.name,
+						outcome: "succeeded",
+						detail: r ?? void 0
+					});
+				} catch (r) {
+					throw await t.appendEvent(n.id, {
+						step: e.name,
+						outcome: "failed",
+						detail: { message: D(r) }
+					}), await t.markFailed(n.id, r), r;
+				}
+			}
+			await t.markSucceeded(n.id);
+		}
+	};
+}
+//#endregion
+//#region src/operations/enqueue.ts
+async function re(e, t, n) {
+	let r = await e.tenantOperations.create({
+		tenant_id: t.tenant_id,
+		rollout_id: t.rollout_id,
+		kind: t.kind,
+		engine: n,
+		initiated_by: t.initiated_by,
+		target_worker_version: t.target_worker_version,
+		target_database_version: t.target_database_version
+	}), i = ee(r);
+	try {
+		await e.tenantOperations.update(r.id, { engine_instance_id: i });
+	} catch (t) {
+		try {
+			await O(e).markFailed(r.id, t);
+		} catch {}
+		throw t;
+	}
+	return {
+		...r,
+		engine_instance_id: i
+	};
+}
+async function ie(e, t, n) {
+	let r = O(e), i = await re(e, n, t.engine);
+	try {
+		await t.start(i);
+	} catch (t) {
+		try {
+			let n = await e.tenantOperations.get(i.id);
+			n && !k(n.status) && await r.markFailed(i.id, t);
+		} catch (e) {
+			console.warn("Failed to record tenant operation failure:", e);
+		}
+		throw t;
+	}
+	try {
+		return await e.tenantOperations.get(i.id) ?? i;
+	} catch (e) {
+		return console.warn("Failed to re-fetch tenant operation after start:", e), i;
+	}
+}
+//#endregion
+//#region src/operations/record-provision.ts
+function ae(e) {
+	if (e.tenantOperations && e.tenantOperationEvents) return {
+		tenantOperations: e.tenantOperations,
+		tenantOperationEvents: e.tenantOperationEvents
+	};
+}
+async function oe(e, t, n) {
+	let r = ae(e);
+	if (!r) {
+		await n(void 0);
+		return;
+	}
+	let i = O(r), a = async (e) => {
+		try {
+			await e();
+		} catch (e) {
+			console.warn("Failed to record tenant operation progress:", e);
+		}
+	}, o;
+	if (await a(async () => {
+		let e = await re(r, t, "inline");
+		o = e.id, await i.markRunning(e.id);
+	}), !o) {
+		await n(void 0);
+		return;
+	}
+	let s = o, c = !1, l = async (e, t, n) => {
+		c = !0, await a(async () => {
+			t === "started" && await i.setCurrentStep(s, e), await i.appendEvent(s, {
+				step: e,
+				outcome: t,
+				detail: n
+			});
+		});
+	};
+	try {
+		await n(l);
+	} catch (e) {
+		throw await a(async () => {
+			c || await i.appendEvent(s, {
+				step: t.kind,
+				outcome: "failed",
+				detail: { message: D(e) }
+			}), await i.markFailed(s, e);
+		}), e;
+	}
+	await a(async () => {
+		c || await i.appendEvent(s, {
+			step: t.kind,
+			outcome: "succeeded"
+		}), await i.markSucceeded(s);
+	});
+}
+//#endregion
 //#region src/hooks/provisioning.ts
-function T(e) {
+function se(e) {
 	return `urn:authhero:tenant:${e.toLowerCase()}`;
 }
-function E(e) {
+function j(e) {
 	return {
 		async beforeCreate(e, t) {
 			return !t.audience && t.id ? {
 				...t,
-				audience: T(t.id)
+				audience: se(t.id)
 			} : t;
 		},
 		async afterCreate(t, n) {
 			let { accessControl: r, databaseIsolation: i } = e;
-			r && t.ctx && await ee(t, n, r), i?.onProvision && await i.onProvision(n.id);
+			if (r && t.ctx && await ce(t, n, r), i?.onProvision) {
+				let e = i.onProvision;
+				i.recordProvisionOperations === !1 ? await e(n.id) : await oe(t.adapters, {
+					kind: "provision",
+					tenant_id: n.id,
+					initiated_by: t.ctx?.var.user?.sub
+				}, (t) => e(n.id, t));
+			}
 		},
 		async beforeDelete(t, n) {
 			let { accessControl: r, databaseIsolation: i } = e;
@@ -64,14 +279,14 @@ function E(e) {
 		}
 	};
 }
-async function ee(e, t, n) {
+async function ce(e, t, n) {
 	let { controlPlaneTenantId: r, defaultPermissions: i, defaultRoles: a, issuer: o, adminRoleName: s = "Tenant Admin", adminRoleDescription: c = "Full access to all tenant management operations", addCreatorToOrganization: l = !0 } = n, u = await e.adapters.organizations.create(r, {
 		name: t.id,
 		display_name: t.friendly_name || t.id
 	}), d;
-	if (o && (d = await ne(e, r, s, c)), l && e.ctx) {
+	if (o && (d = await ue(e, r, s, c)), l && e.ctx) {
 		let t = e.ctx.var.user;
-		if (t?.sub && !await te(e, r, t.sub)) try {
+		if (t?.sub && !await le(e, r, t.sub)) try {
 			await e.adapters.userOrganizations.create(r, {
 				user_id: t.sub,
 				organization_id: u.id
@@ -82,12 +297,12 @@ async function ee(e, t, n) {
 	}
 	a && a.length > 0 && console.log(`Would assign roles ${a.join(", ")} to organization ${u.id}`), i && i.length > 0 && console.log(`Would grant permissions ${i.join(", ")} to organization ${u.id}`);
 }
-async function te(e, t, n) {
+async function le(e, t, n) {
 	let r = await e.adapters.userRoles.list(t, n, void 0, "");
 	for (let n of r) if ((await e.adapters.rolePermissions.list(t, n.id, { per_page: 1e3 })).some((e) => e.permission_name === "admin:organizations")) return !0;
 	return !1;
 }
-async function ne(e, r, i, a) {
+async function ue(e, r, i, a) {
 	let o = (await e.adapters.roles.list(r, {})).roles.find((e) => e.name === i);
 	if (o) return o.id;
 	let s = await e.adapters.roles.create(r, {
@@ -102,7 +317,7 @@ async function ne(e, r, i, a) {
 }
 //#endregion
 //#region src/hooks/sync.ts
-function D(e, t, n = () => !0) {
+function M(e, t, n = () => !0) {
 	let { controlPlaneTenantId: r, getChildTenantIds: i, getAdapters: a } = e, o = /* @__PURE__ */ new Map();
 	async function s(e, n, r) {
 		return (await t(e).list(n, {
@@ -157,7 +372,7 @@ function D(e, t, n = () => !0) {
 		}
 	};
 }
-function O(e, t, n = () => !0) {
+function N(e, t, n = () => !0) {
 	let { controlPlaneTenantId: r, getControlPlaneAdapters: i, getAdapters: a } = e;
 	return { async afterCreate(e, o) {
 		if (o.id !== r) try {
@@ -181,7 +396,7 @@ function O(e, t, n = () => !0) {
 		}
 	} };
 }
-var k = (e) => ({
+var P = (e) => ({
 	list: async (t, n) => (await e.resourceServers.list(t, n)).resource_servers,
 	listPaginated: (t, n) => e.resourceServers.list(t, n),
 	get: (t, n) => e.resourceServers.get(t, n),
@@ -199,7 +414,7 @@ var k = (e) => ({
 		token_lifetime: e.token_lifetime,
 		token_lifetime_for_web: e.token_lifetime_for_web
 	})
-}), A = (e) => ({
+}), F = (e) => ({
 	list: async (t, n) => (await e.roles.list(t, n)).roles,
 	listPaginated: (t, n) => e.roles.list(t, n),
 	get: (t, n) => e.roles.get(t, n),
@@ -214,11 +429,11 @@ var k = (e) => ({
 		description: e.description
 	})
 });
-function re(e) {
+function I(e) {
 	return e.metadata?.sync !== !1;
 }
-function ie(e) {
-	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => re(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => re(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? D(e, k, a) : void 0, c = i ? D(e, A, o) : void 0, l = r ? O(e, k, a) : void 0, d = i ? O(e, A, o) : void 0, f = i ? { async afterCreate(t, r) {
+function L(e) {
+	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => I(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => I(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? M(e, P, a) : void 0, c = i ? M(e, F, o) : void 0, l = r ? N(e, P, a) : void 0, d = i ? N(e, F, o) : void 0, f = i ? { async afterCreate(t, r) {
 		if (r.id !== e.controlPlaneTenantId) {
 			await d?.afterCreate?.(t, r);
 			try {
@@ -273,22 +488,22 @@ function ie(e) {
 }
 //#endregion
 //#region src/routes/tenants.ts
-var ae = b.object({
+var de = b.object({
 	sub: b.string(),
 	tenant_id: b.string().optional(),
 	org_id: b.string().optional(),
 	scope: b.string().optional(),
 	permissions: b.array(b.string()).optional()
 }).passthrough();
-function oe(e) {
-	let t = ae.safeParse(e);
+function fe(e) {
+	let t = de.safeParse(e);
 	return t.success ? t.data : void 0;
 }
-function se(e) {
-	let t = e.permissions ?? [], n = e.scope ? e.scope.split(" ").filter(Boolean) : [], r = new Set([...t, ...n]);
+function pe(e) {
+	let t = e.permissions ?? [], n = e.scope ? e.scope.split(" ").filter(Boolean) : [], r = /* @__PURE__ */ new Set([...t, ...n]);
 	return r.has("delete:tenants") || r.has("admin:organizations");
 }
-function j(e, t) {
+function R(e, t) {
 	let n = new v();
 	return n.openapi(y({
 		tags: ["tenants"],
@@ -399,13 +614,13 @@ function j(e, t) {
 	}), async (n) => {
 		let { id: r } = n.req.valid("param"), i = e.accessControl?.controlPlaneTenantId ?? n.env.data.multiTenancyConfig?.controlPlaneTenantId;
 		if (i) {
-			let e = oe(n.var.user);
+			let e = fe(n.var.user);
 			if (!e?.sub) throw new x(401, { message: "Authentication required" });
 			if (r === i) throw new x(403, { message: "Cannot delete the control plane" });
 			let t = n.var.org_name, a = r.toLowerCase(), o = !!t && t.toLowerCase() === a;
 			if (!o) {
 				let r = !!(e.org_id ?? n.var.organization_id ?? t), a = !e.tenant_id || e.tenant_id === i;
-				!r && a && se(e) && (o = !0);
+				!r && a && pe(e) && (o = !0);
 			}
 			if (o ||= (await u((t) => n.env.data.userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new x(403, { message: "Access denied to this tenant" });
 		}
@@ -454,7 +669,7 @@ function j(e, t) {
 }
 //#endregion
 //#region src/middleware/protect-synced.ts
-function ce(e) {
+function me(e) {
 	for (let { pattern: t, type: n } of [
 		{
 			pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
@@ -477,7 +692,7 @@ function ce(e) {
 	}
 	return null;
 }
-async function le(e, t, n) {
+async function he(e, t, n) {
 	try {
 		switch (n.type) {
 			case "resource_server": return (await e.resourceServers.get(t, n.id))?.is_system === !0;
@@ -489,31 +704,31 @@ async function le(e, t, n) {
 		return !1;
 	}
 }
-function ue(e) {
+function ge(e) {
 	return {
 		resource_server: "resource server",
 		role: "role",
 		connection: "connection"
 	}[e];
 }
-function M() {
+function z() {
 	return async (e, t) => {
 		if (![
 			"PATCH",
 			"PUT",
 			"DELETE"
 		].includes(e.req.method)) return t();
-		let n = ce(e.req.path);
+		let n = me(e.req.path);
 		if (!n) return t();
 		let r = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
 		if (!r) return t();
-		if (await le(e.env.data, r, n)) throw new x(403, { message: `This ${ue(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
+		if (await he(e.env.data, r, n)) throw new x(403, { message: `This ${ge(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
 		return t();
 	};
 }
 //#endregion
 //#region src/middleware/settings-inheritance.ts
-function N(e, t) {
+function B(e, t) {
 	let n = t.find((t) => t.strategy === e.strategy);
 	if (!n?.options) return e;
 	let r = s.passthrough().parse({
@@ -525,11 +740,11 @@ function N(e, t) {
 		...e.options
 	}), r;
 }
-function P(e, t) {
+function V(e, t) {
 	let n = [...t || [], ...e || []];
 	return [...new Set(n)];
 }
-function de(e, t) {
+function _e(e, t) {
 	if (!t?.length) return e || [];
 	if (!e?.length) return t;
 	let n = /* @__PURE__ */ new Map();
@@ -537,22 +752,22 @@ function de(e, t) {
 	for (let t of e) n.set(t.value, t);
 	return Array.from(n.values());
 }
-function F(e, t) {
+function H(e, t) {
 	return t ? {
 		...e,
-		scopes: de(e.scopes, t.scopes)
+		scopes: _e(e.scopes, t.scopes)
 	} : e;
 }
-function fe(e, t) {
+function ve(e, t) {
 	return t ? {
 		...e,
-		callbacks: P(e.callbacks, t.callbacks),
-		web_origins: P(e.web_origins, t.web_origins),
-		allowed_logout_urls: P(e.allowed_logout_urls, t.allowed_logout_urls),
-		allowed_origins: P(e.allowed_origins, t.allowed_origins)
+		callbacks: V(e.callbacks, t.callbacks),
+		web_origins: V(e.web_origins, t.web_origins),
+		allowed_logout_urls: V(e.allowed_logout_urls, t.allowed_logout_urls),
+		allowed_origins: V(e.allowed_origins, t.allowed_origins)
 	} : e;
 }
-function I(e) {
+function U(e) {
 	let { controlPlaneTenantId: t, controlPlaneClientId: n, resolveControlPlane: r } = e;
 	if (r) return async (e) => r({ tenant_id: e });
 	if (!t) return async () => void 0;
@@ -562,14 +777,14 @@ function I(e) {
 	};
 	return async () => i;
 }
-function L(e, t) {
+function W(e, t) {
 	return {
 		...e.resourceServers,
 		get: async (n, r) => {
 			let i = await e.resourceServers.get(n, r);
 			if (!i) return i;
 			let a = await t(n);
-			return !a || n === a.tenantId || !i.is_system ? i : F(i, await e.resourceServers.get(a.tenantId, r));
+			return !a || n === a.tenantId || !i.is_system ? i : H(i, await e.resourceServers.get(a.tenantId, r));
 		},
 		list: async (n, r) => {
 			let i = await e.resourceServers.list(n, r), a = await t(n);
@@ -581,7 +796,7 @@ function L(e, t) {
 				let n = await e.resourceServers.get(o, t);
 				n && c.set(t, n);
 			}));
-			let l = i.resource_servers.map((e) => e.is_system && e.id ? F(e, c.get(e.id) ?? null) : e);
+			let l = i.resource_servers.map((e) => e.is_system && e.id ? H(e, c.get(e.id) ?? null) : e);
 			return {
 				...i,
 				resource_servers: l
@@ -589,18 +804,18 @@ function L(e, t) {
 		}
 	};
 }
-function R(e, t) {
-	let n = I({
+function ye(e, t) {
+	let n = U({
 		controlPlaneTenantId: t.controlPlaneTenantId,
 		resolveControlPlane: t.resolveControlPlane
 	});
 	return {
 		...e,
-		resourceServers: L(e, n)
+		resourceServers: W(e, n)
 	};
 }
-function z(e, t) {
-	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i } = t, a = I({
+function be(e, t) {
+	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i } = t, a = U({
 		controlPlaneTenantId: n,
 		controlPlaneClientId: r,
 		resolveControlPlane: i
@@ -618,12 +833,12 @@ function z(e, t) {
 				let r = await e.connections.get(t, n);
 				if (!r) return r;
 				let i = await a(t);
-				return !i || t === i.tenantId ? r : N(r, (await e.connections.list(i.tenantId)).connections || []);
+				return !i || t === i.tenantId ? r : B(r, (await e.connections.list(i.tenantId)).connections || []);
 			},
 			list: async (t, n) => {
 				let r = await e.connections.list(t, n), i = await a(t);
 				if (!i || t === i.tenantId) return r;
-				let o = await e.connections.list(i.tenantId), s = r.connections.map((e) => N(e, o.connections || []));
+				let o = await e.connections.list(i.tenantId), s = r.connections.map((e) => B(e, o.connections || []));
 				return {
 					...r,
 					connections: s
@@ -638,7 +853,7 @@ function z(e, t) {
 				let i = await a(t);
 				if (!i || t === i.tenantId) return r;
 				let o = await e.connections.list(i.tenantId);
-				return r.map((e) => N(e, o.connections || []));
+				return r.map((e) => B(e, o.connections || []));
 			}
 		},
 		emailProviders: {
@@ -650,22 +865,22 @@ function z(e, t) {
 				return !r || t === r.tenantId ? null : e.emailProviders.get(r.tenantId);
 			}
 		},
-		resourceServers: L(e, a),
-		hooks: pe(e, a)
+		resourceServers: W(e, a),
+		hooks: Se(e, a)
 	};
 }
-function B(e) {
+function xe(e) {
 	if (!e || typeof e != "object") return !1;
 	let t = e.metadata;
 	return !t || typeof t != "object" ? !1 : t.inheritable === !0;
 }
-function pe(e, t) {
+function Se(e, t) {
 	return {
 		...e.hooks,
 		list: async (n, r) => {
 			let i = await e.hooks.list(n, r), a = await t(n);
 			if (!a || n === a.tenantId) return i;
-			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(B);
+			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(xe);
 			if (o.length === 0) return i;
 			let s = new Set((i.hooks || []).map((e) => e.hook_id)), c = o.filter((e) => !s.has(e.hook_id));
 			return {
@@ -680,22 +895,22 @@ function pe(e, t) {
 			let a = await t(n);
 			if (!a || n === a.tenantId) return i;
 			let o = await e.hooks.get(a.tenantId, r);
-			return o && B(o) ? o : null;
+			return o && xe(o) ? o : null;
 		}
 	};
 }
-function V(e, t) {
-	return z(e, t);
+function G(e, t) {
+	return be(e, t);
 }
 //#endregion
 //#region src/middleware/index.ts
-function H(e) {
+function Ce(e) {
 	return async (t, n) => {
 		let r = t.var.user;
 		return r?.tenant_id === e && r.org_name && t.set("tenant_id", r.org_name), n();
 	};
 }
-function U(e) {
+function we(e) {
 	return async (n, r) => {
 		if (!e.accessControl) return r();
 		let { controlPlaneTenantId: i } = e.accessControl, a = n.var.org_name, o = n.var.organization_id, s = a || o, c = n.var.tenant_id, l = n.var.user, u = (l?.aud ? Array.isArray(l.aud) ? l.aud : [l.aud] : []).includes(t);
@@ -704,7 +919,7 @@ function U(e) {
 		return r();
 	};
 }
-function W(e) {
+function Te(e) {
 	return async (t, n) => {
 		if (!e.subdomainRouting) return n();
 		let { baseDomain: r, reservedSubdomains: i = [], resolveSubdomain: a } = e.subdomainRouting, o = t.req.header("x-forwarded-host") || t.req.header("host") || "", s = null;
@@ -723,7 +938,7 @@ function W(e) {
 		return t.set("tenant_id", c), n();
 	};
 }
-function G(e) {
+function Ee(e) {
 	return async (t, n) => {
 		if (!e.databaseIsolation) return n();
 		let r = t.var.tenant_id;
@@ -738,24 +953,24 @@ function G(e) {
 	};
 }
 function K(e) {
-	let t = W(e), n = U(e), r = G(e);
+	let t = Te(e), n = we(e), r = Ee(e);
 	return async (e, i) => (await t(e, async () => {}), await n(e, async () => {}), await r(e, async () => {}), i());
 }
 //#endregion
 //#region src/init.ts
-function me(e) {
+function De(e) {
 	let { dataAdapter: t, controlPlane: n, controlPlane: { tenantId: r = "control_plane", clientId: i } = {}, resolveControlPlane: a, sync: o = {
 		resourceServers: !0,
 		roles: !0
 	}, defaultPermissions: s = ["tenant:admin"], requireOrganizationMatch: c = !1, managementApiExtensions: l = [], entityHooks: d, getChildTenantIds: p, getAdapters: m, ...h } = e;
 	if (a && !n) throw Error("initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it.");
 	let g = t, _ = t;
-	n && (g = V(t, {
+	n && (g = G(t, {
 		controlPlaneTenantId: r,
 		controlPlaneClientId: i,
 		resolveControlPlane: a
 	}), _ = {
-		...R(t, {
+		...ye(t, {
 			controlPlaneTenantId: r,
 			resolveControlPlane: a
 		}),
@@ -765,13 +980,36 @@ function me(e) {
 			resolveControlPlane: a
 		}
 	});
-	let v = o !== !1, y = v ? {
+	let v = h.tenantOperationExecutor;
+	if (!v && t.tenantOperations && t.tenantOperationEvents && h.tenantUpgrade) {
+		let e = {
+			tenantOperations: t.tenantOperations,
+			tenantOperationEvents: t.tenantOperationEvents
+		}, n = h.tenantUpgrade, r = ne({
+			stores: e,
+			definitions: { upgrade: (e) => [{
+				name: "upgrade",
+				async run() {
+					if (!e.tenant_id) throw Error("upgrade operations require a tenant_id");
+					await n(e.tenant_id);
+				}
+			}] }
+		});
+		v = {
+			engine: r.engine,
+			enqueue: (t) => ie(e, r, {
+				...t,
+				tenant_id: t.tenant_id
+			})
+		};
+	}
+	let y = o !== !1, b = y ? {
 		resourceServers: o.resourceServers ?? !0,
 		roles: o.roles ?? !0
 	} : {
 		resourceServers: !1,
 		roles: !1
-	}, { entityHooks: b, tenantHooks: x } = ie({
+	}, { entityHooks: x, tenantHooks: S } = L({
 		controlPlaneTenantId: r,
 		getChildTenantIds: p ?? (async () => (await u((e) => g.tenants.list(e), "tenants", {
 			cursorField: "id",
@@ -779,43 +1017,44 @@ function me(e) {
 		})).filter((e) => e.id !== r).map((e) => e.id)),
 		getAdapters: m ?? (async () => g),
 		getControlPlaneAdapters: async () => g,
-		sync: y
-	}), S = {
-		resourceServers: [b.resourceServers, ...d?.resourceServers ?? []],
-		roles: [b.roles, ...d?.roles ?? []],
+		sync: b
+	}), C = {
+		resourceServers: [x.resourceServers, ...d?.resourceServers ?? []],
+		roles: [x.roles, ...d?.roles ?? []],
 		connections: d?.connections ?? [],
 		tenants: d?.tenants ?? [],
 		rolePermissions: d?.rolePermissions ?? []
-	}, C = E({ accessControl: {
+	}, w = j({ accessControl: {
 		controlPlaneTenantId: r,
 		requireOrganizationMatch: c,
 		defaultPermissions: s
-	} }), w = j({ accessControl: {
+	} }), T = R({ accessControl: {
 		controlPlaneTenantId: r,
 		requireOrganizationMatch: c,
 		defaultPermissions: s
 	} }, { tenants: {
 		async beforeCreate(e, t) {
-			return C.beforeCreate && (t = await C.beforeCreate(e, t)), x.beforeCreate && (t = await x.beforeCreate(e, t)), t;
+			return w.beforeCreate && (t = await w.beforeCreate(e, t)), S.beforeCreate && (t = await S.beforeCreate(e, t)), t;
 		},
 		async afterCreate(e, t) {
-			await C.afterCreate?.(e, t), await x.afterCreate?.(e, t);
+			await w.afterCreate?.(e, t), await S.afterCreate?.(e, t);
 		},
 		async beforeDelete(e, t) {
-			await C.beforeDelete?.(e, t), await x.beforeDelete?.(e, t);
+			await w.beforeDelete?.(e, t), await S.beforeDelete?.(e, t);
 		}
-	} }), { app: T } = f({
+	} }), { app: E } = f({
 		dataAdapter: g,
 		managementDataAdapter: _,
 		...h,
-		entityHooks: S,
+		tenantOperationExecutor: v,
+		entityHooks: C,
 		managementApiExtensions: [...l, {
 			path: "/tenants",
-			router: w
+			router: T
 		}]
 	});
-	return T.use("/api/v2/*", H(r)), v && T.use("/api/v2/*", M()), {
-		app: T,
+	return E.use("/api/v2/*", Ce(r)), y && E.use("/api/v2/*", z()), {
+		app: E,
 		controlPlaneTenantId: r
 	};
 }
@@ -837,7 +1076,7 @@ function J() {
 		errors: []
 	};
 }
-function he(e) {
+function Y(e) {
 	return {
 		tenantId: e,
 		connections: J(),
@@ -848,11 +1087,11 @@ function he(e) {
 		promptSettings: J()
 	};
 }
-function ge(e) {
+function Oe(e) {
 	let t = e.metadata;
 	return !!(t && t.inheritable === !0);
 }
-async function Y(e, t, n, r) {
+async function X(e, t, n, r) {
 	try {
 		await r();
 	} catch (r) {
@@ -861,7 +1100,7 @@ async function Y(e, t, n, r) {
 		e.errors.push(i);
 	}
 }
-async function _e(e, t, n) {
+async function ke(e, t, n) {
 	return {
 		connections: n.connections ? await u((n) => e.connections.list(t, n), "connections", {
 			cursorField: "id",
@@ -880,94 +1119,117 @@ async function _e(e, t, n) {
 		promptSettings: n.promptSettings ? await e.promptSettings.get(t) ?? null : null
 	};
 }
-async function ve(e, t, n, r, i, o) {
+async function Ae(e, t, n, r, i, o) {
 	if (r.connections) for (let r of e.connections) {
 		let e = r.id;
-		e && await Y(o.connections, `connection ${e}`, i, async () => {
+		e && await X(o.connections, `connection ${e}`, i, async () => {
 			let i = a.parse(r);
 			await t.connections.get(n, e) ? await t.connections.update(n, e, i) : await t.connections.create(n, i), o.connections.upserted += 1;
 		});
 	}
-	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await Y(o.resourceServers, `resource_server ${r.id}`, i, async () => {
+	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await X(o.resourceServers, `resource_server ${r.id}`, i, async () => {
 		let e = h.parse(r);
 		await t.resourceServers.get(n, r.id) ? await t.resourceServers.update(n, r.id, e) : await t.resourceServers.create(n, e), o.resourceServers.upserted += 1;
 	});
-	if (r.hooks) for (let r of e.hooks) !ge(r) || !r.hook_id || await Y(o.hooks, `hook ${r.hook_id}`, i, async () => {
+	if (r.hooks) for (let r of e.hooks) !Oe(r) || !r.hook_id || await X(o.hooks, `hook ${r.hook_id}`, i, async () => {
 		let e = d.parse(r);
 		await t.hooks.get(n, r.hook_id) ? await t.hooks.update(n, r.hook_id, e) : await t.hooks.create(n, e), o.hooks.upserted += 1;
 	});
-	r.emailProvider && e.emailProvider && await Y(o.emailProvider, "email_provider", i, async () => {
+	r.emailProvider && e.emailProvider && await X(o.emailProvider, "email_provider", i, async () => {
 		let r = e.emailProvider;
 		await t.emailProviders.get(n) ? await t.emailProviders.update(n, r) : await t.emailProviders.create(n, r), o.emailProvider.upserted += 1;
-	}), r.branding && e.branding && await Y(o.branding, "branding", i, async () => {
+	}), r.branding && e.branding && await X(o.branding, "branding", i, async () => {
 		await t.branding.set(n, e.branding), o.branding.upserted += 1;
-	}), r.promptSettings && e.promptSettings && await Y(o.promptSettings, "prompt_settings", i, async () => {
+	}), r.promptSettings && e.promptSettings && await X(o.promptSettings, "prompt_settings", i, async () => {
 		await t.promptSettings.set(n, e.promptSettings), o.promptSettings.upserted += 1;
 	});
 }
-async function X(e, t) {
-	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = q(a), c = await _e(await r(), n, s), l = await i(t), u = he(t);
-	return await ve(c, l, n, s, o, u), u;
+async function Z(e, t) {
+	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = q(a), c = await ke(await r(), n, s), l = await i(t), u = Y(t);
+	return await Ae(c, l, n, s, o, u), u;
 }
 //#endregion
 //#region src/rollout/payload.ts
-function Z(e) {
+function je(e) {
 	let { pkcs7: t, tenant_id: n, ...r } = e;
 	return r;
 }
-async function ye(e, t, n = {}) {
-	let r = q(n), i = n.signingKeys ?? !0, a = await _e(e, t, r), o = i ? (await p(e.keys)).map(Z) : [];
+async function Me(e, t, n = {}, r) {
+	let i = q(n), a = n.signingKeys ?? !0, o = n.tenants ?? !0, s = await ke(e, t, i), c = a ? (await p(e.keys)).map(je) : [], l = o ? await Ne(e, t, r) : [];
 	return {
-		connections: a.connections,
-		resourceServers: a.resourceServers.filter((e) => e.is_system),
-		hooks: a.hooks.filter(ge),
-		emailProvider: a.emailProvider,
-		branding: a.branding,
-		promptSettings: a.promptSettings,
-		signingKeys: o
+		connections: s.connections,
+		resourceServers: s.resourceServers.filter((e) => e.is_system),
+		hooks: s.hooks.filter(Oe),
+		emailProvider: s.emailProvider,
+		branding: s.branding,
+		promptSettings: s.promptSettings,
+		signingKeys: c,
+		tenants: l
 	};
 }
-async function be(e, t, n) {
+async function Ne(e, t, n) {
+	let r = n && n !== t ? [t, n] : [t], i = [];
+	for (let t of r) {
+		let n = await e.tenants.get(t);
+		i.push({
+			id: t,
+			friendly_name: n?.friendly_name || t
+		});
+	}
+	return i;
+}
+async function Pe(e, t, n) {
 	let r = J();
 	if (e.length === 0) return r;
 	let i = await p(t.keys), a = new Set(i.map((e) => e.kid));
-	for (let i of e) await Y(r, `signing_key ${i.kid}`, n, async () => {
-		let e = Z(i);
+	for (let i of e) await X(r, `signing_key ${i.kid}`, n, async () => {
+		let e = je(i);
 		a.has(e.kid) || (await t.keys.create(e), a.add(e.kid), r.upserted += 1);
 	});
 	return r;
 }
-async function xe(e, t, n, r = {}) {
-	let a = r.continueOnError ?? !1, o = q(r.entities), s = r.entities?.signingKeys ?? !0, c = {
+async function Fe(e, t, n) {
+	let r = J();
+	for (let i of e) await X(r, `tenant ${i.id}`, n, async () => {
+		await t.tenants.get(i.id) || (await t.tenants.create({
+			id: i.id,
+			friendly_name: i.friendly_name
+		}), r.upserted += 1);
+	});
+	return r;
+}
+async function Ie(e, t, n, r = {}) {
+	let a = r.continueOnError ?? !1, o = q(r.entities), s = r.entities?.signingKeys ?? !0, c = r.entities?.tenants ?? !0, u = {
 		connections: e.connections,
 		resourceServers: e.resourceServers,
 		hooks: e.hooks,
 		emailProvider: e.emailProvider ? l.parse(e.emailProvider) : null,
 		branding: e.branding ? i.parse(e.branding) : null,
 		promptSettings: e.promptSettings ? m.parse(e.promptSettings) : null
-	}, u = he(n);
-	await ve(c, t, n, o, a, u);
-	let d = s ? await be(e.signingKeys, t, a) : J();
+	}, d = c ? await Fe(e.tenants ?? [], t, a) : J(), f = Y(n);
+	await Ae(u, t, n, o, a, f);
+	let p = s ? await Pe(e.signingKeys, t, a) : J();
 	return {
-		...u,
-		signingKeys: d
+		...f,
+		signingKeys: p,
+		tenants: d
 	};
 }
 //#endregion
 //#region src/rollout/index.ts
-function Se(e) {
+function Le(e) {
 	return {
-		syncDefaults: (t) => X(e, t),
+		syncDefaults: (t) => Z(e, t),
 		syncDefaultsToTenants: async (t) => {
 			let n = [];
-			for (let r of t) n.push(await X(e, r));
+			for (let r of t) n.push(await Z(e, r));
 			return n;
 		}
 	};
 }
 //#endregion
 //#region src/plugin.ts
-function Ce(e) {
+function Re(e) {
 	let t = Q(e);
 	return {
 		name: "multi-tenancy",
@@ -975,7 +1237,7 @@ function Ce(e) {
 		hooks: t,
 		routes: [{
 			path: "/management",
-			handler: j(e, t)
+			handler: R(e, t)
 		}],
 		onRegister: async () => {
 			console.log("Multi-tenancy plugin registered"), e.accessControl && console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`), e.subdomainRouting && console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`), e.databaseIsolation && console.log("  - Database isolation enabled");
@@ -985,7 +1247,7 @@ function Ce(e) {
 //#endregion
 //#region src/index.ts
 function Q(e) {
-	let t = e.accessControl ? S(e.accessControl) : {}, n = e.databaseIsolation ? w(e.databaseIsolation) : {}, r = E(e);
+	let t = e.accessControl ? S(e.accessControl) : {}, n = e.databaseIsolation ? w(e.databaseIsolation) : {}, r = j(e);
 	return {
 		...t,
 		...n,
@@ -994,19 +1256,19 @@ function Q(e) {
 }
 function $(t) {
 	let n = new e(), r = Q(t);
-	return n.route("/tenants", j(t, r)), n;
+	return n.route("/tenants", R(t, r)), n;
 }
-function we(e) {
+function ze(e) {
 	return {
 		hooks: Q(e),
 		middleware: K(e),
 		app: $(e),
 		config: e,
-		wrapAdapters: (t, n) => V(t, {
+		wrapAdapters: (t, n) => G(t, {
 			controlPlaneTenantId: e.accessControl?.controlPlaneTenantId,
 			controlPlaneClientId: n?.controlPlaneClientId
 		})
 	};
 }
 //#endregion
-export { xe as applyControlPlaneDefaultsPayload, ye as buildControlPlaneDefaultsPayload, S as createAccessControlHooks, U as createAccessControlMiddleware, H as createControlPlaneTenantMiddleware, w as createDatabaseHooks, G as createDatabaseMiddleware, Se as createDirectRolloutAdapter, $ as createMultiTenancy, Q as createMultiTenancyHooks, K as createMultiTenancyMiddleware, Ce as createMultiTenancyPlugin, M as createProtectSyncedMiddleware, E as createProvisioningHooks, z as createRuntimeFallbackAdapter, W as createSubdomainMiddleware, ie as createSyncHooks, j as createTenantsOpenAPIRouter, me as initMultiTenant, fe as mergeClientWithFallback, X as projectControlPlaneDefaults, we as setupMultiTenancy, C as validateTenantAccess, V as withRuntimeFallback, R as withSystemResourceServerInheritance };
+export { Ie as applyControlPlaneDefaultsPayload, Me as buildControlPlaneDefaultsPayload, ee as buildEngineInstanceId, S as createAccessControlHooks, we as createAccessControlMiddleware, Ce as createControlPlaneTenantMiddleware, w as createDatabaseHooks, Ee as createDatabaseMiddleware, Le as createDirectRolloutAdapter, ne as createInlineExecutor, $ as createMultiTenancy, Q as createMultiTenancyHooks, K as createMultiTenancyMiddleware, Re as createMultiTenancyPlugin, O as createOperationRecorder, z as createProtectSyncedMiddleware, j as createProvisioningHooks, be as createRuntimeFallbackAdapter, Te as createSubdomainMiddleware, L as createSyncHooks, R as createTenantsOpenAPIRouter, ie as enqueueTenantOperation, D as errorToMessage, De as initMultiTenant, A as inlineStepRunner, k as isTerminalStatus, ve as mergeClientWithFallback, Z as projectControlPlaneDefaults, oe as runRecordedTenantOperation, ze as setupMultiTenancy, C as validateTenantAccess, G as withRuntimeFallback, ye as withSystemResourceServerInheritance };