@authhero/multi-tenancy 14.25.1 → 14.27.0

package/dist/multi-tenancy.mjs

@@ -1,9 +1,9 @@
 import { Hono as e } from "hono";
-import { MANAGEMENT_API_AUDIENCE as t, MANAGEMENT_API_SCOPES as n, auth0QuerySchema as r, brandingSchema as i, connectionInsertSchema as a, connectionOptionsSchema as o, connectionSchema as s, deepMergePatch as c, emailProviderSchema as l, fetchAll as u, hookInsertSchema as d, init as f, listControlPlaneKeys as p, promptSettingSchema as m, resourceServerInsertSchema as h, tenantInsertSchema as g, tenantSchema as _ } from "authhero";
-import { OpenAPIHono as v, createRoute as y, z as b } from "@hono/zod-openapi";
-import { HTTPException as x } from "hono/http-exception";
+import { MANAGEMENT_API_AUDIENCE as t, MANAGEMENT_API_SCOPES as n, auth0QuerySchema as r, brandingSchema as i, connectionInsertSchema as a, connectionOptionsSchema as o, connectionSchema as s, deepMergePatch as c, emailProviderSchema as l, fetchAll as u, hookInsertSchema as d, init as f, isInteractiveClient as p, listControlPlaneKeys as m, promptSettingSchema as h, provisionDefaultClients as g, resourceServerInsertSchema as _, tenantInsertSchema as v, tenantSchema as y } from "authhero";
+import { OpenAPIHono as ee, createRoute as b, z as x } from "@hono/zod-openapi";
+import { HTTPException as S } from "hono/http-exception";
 //#region src/hooks/access-control.ts
-function S(e) {
+function C(e) {
 	let { controlPlaneTenantId: t, requireOrganizationMatch: n = !0 } = e;
 	return { async onTenantAccessValidation(e, r) {
 		if (r === t) return !0;
@@ -14,14 +14,14 @@ function S(e) {
 		return !0;
 	} };
 }
-function C(e, t, n, r) {
+function w(e, t, n, r) {
 	if (t === n) return !0;
 	let i = r || e;
 	return i ? i.toLowerCase() === t.toLowerCase() : !1;
 }
 //#endregion
 //#region src/hooks/database.ts
-function w(e) {
+function T(e) {
 	return { async resolveDataAdapters(t) {
 		try {
 			return await e.getAdapters(t);
@@ -32,21 +32,243 @@ function w(e) {
 	} };
 }
 //#endregion
+//#region src/operations/instance-id.ts
+var E = 64;
+function D(e) {
+	return e.replace(/[^a-zA-Z0-9_-]/g, "-");
+}
+function te(e) {
+	let t = D(e.id), n = Math.max(0, E - (5 + t.length)), r = D(e.kind).slice(0, n), i = 3 + r.length + 2 + t.length, a = Math.max(0, E - i);
+	return `op-${r}-${D(e.tenant_id ?? "fleet").slice(0, a)}-${t}`.slice(0, E);
+}
+//#endregion
+//#region src/operations/recorder.ts
+var ne = 2048;
+function O(e) {
+	let t;
+	if (e instanceof Error) t = e.message;
+	else try {
+		t = String(e ?? "unknown error");
+	} catch {
+		t = Object.prototype.toString.call(e);
+	}
+	return t.slice(0, ne);
+}
+function k(e) {
+	let { tenantOperations: t, tenantOperationEvents: n } = e;
+	return {
+		async markRunning(e, n) {
+			await t.update(e, {
+				status: "running",
+				...n === void 0 ? {} : { current_step: n }
+			});
+		},
+		async setCurrentStep(e, n) {
+			await t.update(e, { current_step: n });
+		},
+		async appendEvent(e, t) {
+			await n.create({
+				operation_id: e,
+				step: t.step,
+				outcome: t.outcome,
+				detail: t.detail,
+				attempt: t.attempt ?? 1
+			});
+		},
+		async markSucceeded(e) {
+			await t.update(e, {
+				status: "succeeded",
+				error: null,
+				finished_at: (/* @__PURE__ */ new Date()).toISOString()
+			});
+		},
+		async markFailed(e, n) {
+			await t.update(e, {
+				status: "failed",
+				error: O(n),
+				finished_at: (/* @__PURE__ */ new Date()).toISOString()
+			});
+		}
+	};
+}
+function re(e) {
+	return e === "succeeded" || e === "failed" || e === "cancelled";
+}
+//#endregion
+//#region src/operations/inline-executor.ts
+var A = { async do(e, t, n) {
+	let r = typeof t == "function" ? t : n;
+	if (!r) throw Error("StepRunner.do called without a function");
+	return r();
+} };
+function j(e) {
+	let t = k(e.stores);
+	return {
+		engine: "inline",
+		async start(n) {
+			let r = e.definitions[n.kind];
+			if (!r) {
+				let e = /* @__PURE__ */ Error(`No inline operation definition for kind "${n.kind}"`);
+				throw await t.markFailed(n.id, e), e;
+			}
+			let i = r(n);
+			await t.markRunning(n.id, i[0]?.name);
+			for (let e of i) {
+				await t.setCurrentStep(n.id, e.name), await t.appendEvent(n.id, {
+					step: e.name,
+					outcome: "started"
+				});
+				try {
+					let r = await e.run({
+						operation: n,
+						step: A
+					});
+					await t.appendEvent(n.id, {
+						step: e.name,
+						outcome: "succeeded",
+						detail: r ?? void 0
+					});
+				} catch (r) {
+					throw await t.appendEvent(n.id, {
+						step: e.name,
+						outcome: "failed",
+						detail: { message: O(r) }
+					}), await t.markFailed(n.id, r), r;
+				}
+			}
+			await t.markSucceeded(n.id);
+		}
+	};
+}
+//#endregion
+//#region src/operations/enqueue.ts
+async function M(e, t, n) {
+	let r = await e.tenantOperations.create({
+		tenant_id: t.tenant_id,
+		rollout_id: t.rollout_id,
+		kind: t.kind,
+		engine: n,
+		initiated_by: t.initiated_by,
+		target_worker_version: t.target_worker_version,
+		target_database_version: t.target_database_version
+	}), i = te(r);
+	try {
+		await e.tenantOperations.update(r.id, { engine_instance_id: i });
+	} catch (t) {
+		try {
+			await k(e).markFailed(r.id, t);
+		} catch {}
+		throw t;
+	}
+	return {
+		...r,
+		engine_instance_id: i
+	};
+}
+async function N(e, t, n) {
+	let r = k(e), i = await M(e, n, t.engine);
+	try {
+		await t.start(i);
+	} catch (t) {
+		try {
+			let n = await e.tenantOperations.get(i.id);
+			n && !re(n.status) && await r.markFailed(i.id, t);
+		} catch (e) {
+			console.warn("Failed to record tenant operation failure:", e);
+		}
+		throw t;
+	}
+	try {
+		return await e.tenantOperations.get(i.id) ?? i;
+	} catch (e) {
+		return console.warn("Failed to re-fetch tenant operation after start:", e), i;
+	}
+}
+//#endregion
+//#region src/operations/record-provision.ts
+function ie(e) {
+	if (e.tenantOperations && e.tenantOperationEvents) return {
+		tenantOperations: e.tenantOperations,
+		tenantOperationEvents: e.tenantOperationEvents
+	};
+}
+async function P(e, t, n) {
+	let r = ie(e);
+	if (!r) {
+		await n(void 0);
+		return;
+	}
+	let i = k(r), a = async (e) => {
+		try {
+			await e();
+		} catch (e) {
+			console.warn("Failed to record tenant operation progress:", e);
+		}
+	}, o;
+	if (await a(async () => {
+		let e = await M(r, t, "inline");
+		o = e.id, await i.markRunning(e.id);
+	}), !o) {
+		await n(void 0);
+		return;
+	}
+	let s = o, c = !1, l = async (e, t, n) => {
+		c = !0, await a(async () => {
+			t === "started" && await i.setCurrentStep(s, e), await i.appendEvent(s, {
+				step: e,
+				outcome: t,
+				detail: n
+			});
+		});
+	};
+	try {
+		await n(l);
+	} catch (e) {
+		throw await a(async () => {
+			c || await i.appendEvent(s, {
+				step: t.kind,
+				outcome: "failed",
+				detail: { message: O(e) }
+			}), await i.markFailed(s, e);
+		}), e;
+	}
+	await a(async () => {
+		c || await i.appendEvent(s, {
+			step: t.kind,
+			outcome: "succeeded"
+		}), await i.markSucceeded(s);
+	});
+}
+//#endregion
 //#region src/hooks/provisioning.ts
-function T(e) {
+function ae(e) {
 	return `urn:authhero:tenant:${e.toLowerCase()}`;
 }
-function E(e) {
+function F(e) {
 	return {
 		async beforeCreate(e, t) {
 			return !t.audience && t.id ? {
 				...t,
-				audience: T(t.id)
+				audience: ae(t.id)
 			} : t;
 		},
-		async afterCreate(t, n) {
-			let { accessControl: r, databaseIsolation: i } = e;
-			r && t.ctx && await ee(t, n, r), i?.onProvision && await i.onProvision(n.id);
+		async afterCreate(r, i) {
+			let { accessControl: a, databaseIsolation: o } = e;
+			if (a && r.ctx && await oe(r, i, a), o?.onProvision) {
+				let e = o.onProvision;
+				o.recordProvisionOperations === !1 ? await e(i.id) : await P(r.adapters, {
+					kind: "provision",
+					tenant_id: i.id,
+					initiated_by: r.ctx?.var.user?.sub
+				}, (t) => e(i.id, t));
+			} else try {
+				await g(r.adapters, i.id, {
+					managementApiIdentifier: t,
+					managementApiScopes: n
+				});
+			} catch (e) {
+				throw console.warn(`Failed to provision default clients for tenant ${i.id}:`, e), e;
+			}
 		},
 		async beforeDelete(t, n) {
 			let { accessControl: r, databaseIsolation: i } = e;
@@ -64,14 +286,14 @@ function E(e) {
 		}
 	};
 }
-async function ee(e, t, n) {
+async function oe(e, t, n) {
 	let { controlPlaneTenantId: r, defaultPermissions: i, defaultRoles: a, issuer: o, adminRoleName: s = "Tenant Admin", adminRoleDescription: c = "Full access to all tenant management operations", addCreatorToOrganization: l = !0 } = n, u = await e.adapters.organizations.create(r, {
 		name: t.id,
 		display_name: t.friendly_name || t.id
 	}), d;
-	if (o && (d = await ne(e, r, s, c)), l && e.ctx) {
+	if (o && (d = await ce(e, r, s, c)), l && e.ctx) {
 		let t = e.ctx.var.user;
-		if (t?.sub && !await te(e, r, t.sub)) try {
+		if (t?.sub && !await se(e, r, t.sub)) try {
 			await e.adapters.userOrganizations.create(r, {
 				user_id: t.sub,
 				organization_id: u.id
@@ -82,12 +304,12 @@ async function ee(e, t, n) {
 	}
 	a && a.length > 0 && console.log(`Would assign roles ${a.join(", ")} to organization ${u.id}`), i && i.length > 0 && console.log(`Would grant permissions ${i.join(", ")} to organization ${u.id}`);
 }
-async function te(e, t, n) {
+async function se(e, t, n) {
 	let r = await e.adapters.userRoles.list(t, n, void 0, "");
 	for (let n of r) if ((await e.adapters.rolePermissions.list(t, n.id, { per_page: 1e3 })).some((e) => e.permission_name === "admin:organizations")) return !0;
 	return !1;
 }
-async function ne(e, r, i, a) {
+async function ce(e, r, i, a) {
 	let o = (await e.adapters.roles.list(r, {})).roles.find((e) => e.name === i);
 	if (o) return o.id;
 	let s = await e.adapters.roles.create(r, {
@@ -102,7 +324,7 @@ async function ne(e, r, i, a) {
 }
 //#endregion
 //#region src/hooks/sync.ts
-function D(e, t, n = () => !0) {
+function le(e, t, n = () => !0) {
 	let { controlPlaneTenantId: r, getChildTenantIds: i, getAdapters: a } = e, o = /* @__PURE__ */ new Map();
 	async function s(e, n, r) {
 		return (await t(e).list(n, {
@@ -157,7 +379,7 @@ function D(e, t, n = () => !0) {
 		}
 	};
 }
-function O(e, t, n = () => !0) {
+function ue(e, t, n = () => !0) {
 	let { controlPlaneTenantId: r, getControlPlaneAdapters: i, getAdapters: a } = e;
 	return { async afterCreate(e, o) {
 		if (o.id !== r) try {
@@ -181,7 +403,7 @@ function O(e, t, n = () => !0) {
 		}
 	} };
 }
-var k = (e) => ({
+var de = (e) => ({
 	list: async (t, n) => (await e.resourceServers.list(t, n)).resource_servers,
 	listPaginated: (t, n) => e.resourceServers.list(t, n),
 	get: (t, n) => e.resourceServers.get(t, n),
@@ -199,7 +421,7 @@ var k = (e) => ({
 		token_lifetime: e.token_lifetime,
 		token_lifetime_for_web: e.token_lifetime_for_web
 	})
-}), A = (e) => ({
+}), fe = (e) => ({
 	list: async (t, n) => (await e.roles.list(t, n)).roles,
 	listPaginated: (t, n) => e.roles.list(t, n),
 	get: (t, n) => e.roles.get(t, n),
@@ -214,11 +436,11 @@ var k = (e) => ({
 		description: e.description
 	})
 });
-function j(e) {
+function pe(e) {
 	return e.metadata?.sync !== !1;
 }
-function re(e) {
-	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => j(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => j(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? D(e, k, a) : void 0, c = i ? D(e, A, o) : void 0, l = r ? O(e, k, a) : void 0, d = i ? O(e, A, o) : void 0, f = i ? { async afterCreate(t, r) {
+function I(e) {
+	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => pe(e) ? !n.resourceServers || n.resourceServers(e) : !1, o = (e) => pe(e) ? !n.roles || n.roles(e) : !1, s = r ? le(e, de, a) : void 0, c = i ? le(e, fe, o) : void 0, l = r ? ue(e, de, a) : void 0, d = i ? ue(e, fe, o) : void 0, f = i ? { async afterCreate(t, r) {
 		if (r.id !== e.controlPlaneTenantId) {
 			await d?.afterCreate?.(t, r);
 			try {
@@ -273,35 +495,35 @@ function re(e) {
 }
 //#endregion
 //#region src/routes/tenants.ts
-var ie = b.object({
-	sub: b.string(),
-	tenant_id: b.string().optional(),
-	org_id: b.string().optional(),
-	scope: b.string().optional(),
-	permissions: b.array(b.string()).optional()
+var me = x.object({
+	sub: x.string(),
+	tenant_id: x.string().optional(),
+	org_id: x.string().optional(),
+	scope: x.string().optional(),
+	permissions: x.array(x.string()).optional()
 }).passthrough();
-function ae(e) {
-	let t = ie.safeParse(e);
+function he(e) {
+	let t = me.safeParse(e);
 	return t.success ? t.data : void 0;
 }
-function oe(e) {
-	let t = e.permissions ?? [], n = e.scope ? e.scope.split(" ").filter(Boolean) : [], r = new Set([...t, ...n]);
+function ge(e) {
+	let t = e.permissions ?? [], n = e.scope ? e.scope.split(" ").filter(Boolean) : [], r = /* @__PURE__ */ new Set([...t, ...n]);
 	return r.has("delete:tenants") || r.has("admin:organizations");
 }
-function M(e, t) {
-	let n = new v();
-	return n.openapi(y({
+function L(e, t) {
+	let n = new ee();
+	return n.openapi(b({
 		tags: ["tenants"],
 		method: "get",
 		path: "/",
 		request: { query: r },
 		security: [{ Bearer: [] }],
 		responses: { 200: {
-			content: { "application/json": { schema: b.object({
-				tenants: b.array(_),
-				start: b.number().optional(),
-				limit: b.number().optional(),
-				length: b.number().optional()
+			content: { "application/json": { schema: x.object({
+				tenants: x.array(y),
+				start: x.number().optional(),
+				limit: x.number().optional(),
+				length: x.number().optional()
 			}) } },
 			description: "List of tenants"
 		} }
@@ -322,7 +544,7 @@ function M(e, t) {
 			}) : t.json({ tenants: e.tenants });
 		}
 		let c = e.accessControl?.controlPlaneTenantId ?? t.env.data.multiTenancyConfig?.controlPlaneTenantId;
-		if (c && !o?.sub) throw new x(403, { message: "Access denied: token has no subject" });
+		if (c && !o?.sub) throw new S(403, { message: "Access denied: token has no subject" });
 		if (c && o?.sub) {
 			let e = (await u((e) => t.env.data.userOrganizations.listUserOrganizations(c, o.sub, e), "organizations")).map((e) => e.name);
 			if (e.length === 0) return i ? t.json({
@@ -362,22 +584,22 @@ function M(e, t) {
 			limit: l.totals?.limit ?? r,
 			length: l.tenants.length
 		}) : t.json({ tenants: l.tenants });
-	}), n.openapi(y({
+	}), n.openapi(b({
 		tags: ["tenants"],
 		method: "post",
 		path: "/",
-		request: { body: { content: { "application/json": { schema: g } } } },
+		request: { body: { content: { "application/json": { schema: v } } } },
 		security: [{ Bearer: [] }],
 		responses: {
 			201: {
-				content: { "application/json": { schema: _ } },
+				content: { "application/json": { schema: y } },
 				description: "Tenant created"
 			},
 			400: { description: "Validation error" },
 			409: { description: "Tenant with this ID already exists" }
 		}
 	}), async (e) => {
-		if (!e.var.user?.sub) throw new x(401, { message: "Authentication required to create tenants" });
+		if (!e.var.user?.sub) throw new S(401, { message: "Authentication required to create tenants" });
 		let n = e.req.valid("json"), r = {
 			adapters: e.env.data,
 			ctx: e
@@ -385,11 +607,11 @@ function M(e, t) {
 		t.tenants?.beforeCreate && (n = await t.tenants.beforeCreate(r, n));
 		let i = await e.env.data.tenants.create(n);
 		return t.tenants?.afterCreate && await t.tenants.afterCreate(r, i), e.json(i, 201);
-	}), n.openapi(y({
+	}), n.openapi(b({
 		tags: ["tenants"],
 		method: "delete",
 		path: "/{id}",
-		request: { params: b.object({ id: b.string() }) },
+		request: { params: x.object({ id: x.string() }) },
 		security: [{ Bearer: ["delete:tenants"] }],
 		responses: {
 			204: { description: "Tenant deleted" },
@@ -399,62 +621,70 @@ function M(e, t) {
 	}), async (n) => {
 		let { id: r } = n.req.valid("param"), i = e.accessControl?.controlPlaneTenantId ?? n.env.data.multiTenancyConfig?.controlPlaneTenantId;
 		if (i) {
-			let e = ae(n.var.user);
-			if (!e?.sub) throw new x(401, { message: "Authentication required" });
-			if (r === i) throw new x(403, { message: "Cannot delete the control plane" });
+			let e = he(n.var.user);
+			if (!e?.sub) throw new S(401, { message: "Authentication required" });
+			if (r === i) throw new S(403, { message: "Cannot delete the control plane" });
 			let t = n.var.org_name, a = r.toLowerCase(), o = !!t && t.toLowerCase() === a;
 			if (!o) {
 				let r = !!(e.org_id ?? n.var.organization_id ?? t), a = !e.tenant_id || e.tenant_id === i;
-				!r && a && oe(e) && (o = !0);
+				!r && a && ge(e) && (o = !0);
 			}
-			if (o ||= (await u((t) => n.env.data.userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new x(403, { message: "Access denied to this tenant" });
+			if (o ||= (await u((t) => n.env.data.userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new S(403, { message: "Access denied to this tenant" });
 		}
-		if (!await n.env.data.tenants.get(r)) throw new x(404, { message: "Tenant not found" });
+		if (!await n.env.data.tenants.get(r)) throw new S(404, { message: "Tenant not found" });
 		let a = {
 			adapters: n.env.data,
 			ctx: n
 		};
 		return t.tenants?.beforeDelete && await t.tenants.beforeDelete(a, r), await n.env.data.tenants.remove(r), t.tenants?.afterDelete && await t.tenants.afterDelete(a, r), n.body(null, 204);
-	}), n.openapi(y({
+	}), n.openapi(b({
 		tags: ["tenants", "settings"],
 		method: "get",
 		path: "/settings",
-		request: { headers: b.object({ "tenant-id": b.string().optional() }) },
+		request: { headers: x.object({ "tenant-id": x.string().optional() }) },
 		security: [{ Bearer: ["read:tenants"] }],
 		responses: { 200: {
-			content: { "application/json": { schema: _ } },
+			content: { "application/json": { schema: y } },
 			description: "Current tenant settings"
 		} }
 	}), async (e) => {
 		let t = await e.env.data.tenants.get(e.var.tenant_id);
-		if (!t) throw new x(404, { message: "Tenant not found" });
+		if (!t) throw new S(404, { message: "Tenant not found" });
 		return e.json(t);
-	}), n.openapi(y({
+	}), n.openapi(b({
 		tags: ["tenants", "settings"],
 		method: "patch",
 		path: "/settings",
 		request: {
-			headers: b.object({ "tenant-id": b.string().optional() }),
-			body: { content: { "application/json": { schema: b.object(g.shape).partial() } } }
+			headers: x.object({ "tenant-id": x.string().optional() }),
+			body: { content: { "application/json": { schema: x.object(v.shape).partial() } } }
 		},
 		security: [{ Bearer: ["update:tenants"] }],
 		responses: { 200: {
-			content: { "application/json": { schema: _ } },
+			content: { "application/json": { schema: y } },
 			description: "Updated tenant settings"
 		} }
 	}), async (e) => {
 		let { id: t, ...n } = e.req.valid("json"), r = await e.env.data.tenants.get(e.var.tenant_id);
-		if (!r) throw new x(404, { message: "Tenant not found" });
+		if (!r) throw new S(404, { message: "Tenant not found" });
+		if ("default_client_id" in n) {
+			let t = n.default_client_id;
+			if (typeof t == "string" && t.length > 0) {
+				let n = await e.env.data.clients.get(e.var.tenant_id, t);
+				if (!n) throw new S(400, { message: `Client with id '${t}' not found` });
+				if (!p(n)) throw new S(400, { message: `Client '${t}' is not an interactive client and cannot be used as the default client` });
+			}
+		}
 		let i = c(r, n);
 		await e.env.data.tenants.update(e.var.tenant_id, i);
 		let a = await e.env.data.tenants.get(e.var.tenant_id);
-		if (!a) throw new x(500, { message: "Failed to retrieve updated tenant" });
+		if (!a) throw new S(500, { message: "Failed to retrieve updated tenant" });
 		return e.json(a);
 	}), n;
 }
 //#endregion
 //#region src/middleware/protect-synced.ts
-function se(e) {
+function _e(e) {
 	for (let { pattern: t, type: n } of [
 		{
 			pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
@@ -477,7 +707,7 @@ function se(e) {
 	}
 	return null;
 }
-async function ce(e, t, n) {
+async function ve(e, t, n) {
 	try {
 		switch (n.type) {
 			case "resource_server": return (await e.resourceServers.get(t, n.id))?.is_system === !0;
@@ -489,31 +719,31 @@ async function ce(e, t, n) {
 		return !1;
 	}
 }
-function le(e) {
+function ye(e) {
 	return {
 		resource_server: "resource server",
 		role: "role",
 		connection: "connection"
 	}[e];
 }
-function N() {
+function R() {
 	return async (e, t) => {
 		if (![
 			"PATCH",
 			"PUT",
 			"DELETE"
 		].includes(e.req.method)) return t();
-		let n = se(e.req.path);
+		let n = _e(e.req.path);
 		if (!n) return t();
 		let r = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
 		if (!r) return t();
-		if (await ce(e.env.data, r, n)) throw new x(403, { message: `This ${le(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
+		if (await ve(e.env.data, r, n)) throw new S(403, { message: `This ${ye(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
 		return t();
 	};
 }
 //#endregion
 //#region src/middleware/settings-inheritance.ts
-function P(e, t) {
+function z(e, t) {
 	let n = t.find((t) => t.strategy === e.strategy);
 	if (!n?.options) return e;
 	let r = s.passthrough().parse({
@@ -525,11 +755,11 @@ function P(e, t) {
 		...e.options
 	}), r;
 }
-function F(e, t) {
+function B(e, t) {
 	let n = [...t || [], ...e || []];
 	return [...new Set(n)];
 }
-function ue(e, t) {
+function be(e, t) {
 	if (!t?.length) return e || [];
 	if (!e?.length) return t;
 	let n = /* @__PURE__ */ new Map();
@@ -537,22 +767,22 @@ function ue(e, t) {
 	for (let t of e) n.set(t.value, t);
 	return Array.from(n.values());
 }
-function I(e, t) {
+function V(e, t) {
 	return t ? {
 		...e,
-		scopes: ue(e.scopes, t.scopes)
+		scopes: be(e.scopes, t.scopes)
 	} : e;
 }
-function de(e, t) {
+function xe(e, t) {
 	return t ? {
 		...e,
-		callbacks: F(e.callbacks, t.callbacks),
-		web_origins: F(e.web_origins, t.web_origins),
-		allowed_logout_urls: F(e.allowed_logout_urls, t.allowed_logout_urls),
-		allowed_origins: F(e.allowed_origins, t.allowed_origins)
+		callbacks: B(e.callbacks, t.callbacks),
+		web_origins: B(e.web_origins, t.web_origins),
+		allowed_logout_urls: B(e.allowed_logout_urls, t.allowed_logout_urls),
+		allowed_origins: B(e.allowed_origins, t.allowed_origins)
 	} : e;
 }
-function L(e) {
+function H(e) {
 	let { controlPlaneTenantId: t, controlPlaneClientId: n, resolveControlPlane: r } = e;
 	if (r) return async (e) => r({ tenant_id: e });
 	if (!t) return async () => void 0;
@@ -562,14 +792,14 @@ function L(e) {
 	};
 	return async () => i;
 }
-function R(e, t) {
+function U(e, t) {
 	return {
 		...e.resourceServers,
 		get: async (n, r) => {
 			let i = await e.resourceServers.get(n, r);
 			if (!i) return i;
 			let a = await t(n);
-			return !a || n === a.tenantId || !i.is_system ? i : I(i, await e.resourceServers.get(a.tenantId, r));
+			return !a || n === a.tenantId || !i.is_system ? i : V(i, await e.resourceServers.get(a.tenantId, r));
 		},
 		list: async (n, r) => {
 			let i = await e.resourceServers.list(n, r), a = await t(n);
@@ -581,7 +811,7 @@ function R(e, t) {
 				let n = await e.resourceServers.get(o, t);
 				n && c.set(t, n);
 			}));
-			let l = i.resource_servers.map((e) => e.is_system && e.id ? I(e, c.get(e.id) ?? null) : e);
+			let l = i.resource_servers.map((e) => e.is_system && e.id ? V(e, c.get(e.id) ?? null) : e);
 			return {
 				...i,
 				resource_servers: l
@@ -589,18 +819,18 @@ function R(e, t) {
 		}
 	};
 }
-function z(e, t) {
-	let n = L({
+function W(e, t) {
+	let n = H({
 		controlPlaneTenantId: t.controlPlaneTenantId,
 		resolveControlPlane: t.resolveControlPlane
 	});
 	return {
 		...e,
-		resourceServers: R(e, n)
+		resourceServers: U(e, n)
 	};
 }
-function B(e, t) {
-	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i } = t, a = L({
+function G(e, t) {
+	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i } = t, a = H({
 		controlPlaneTenantId: n,
 		controlPlaneClientId: r,
 		resolveControlPlane: i
@@ -618,12 +848,12 @@ function B(e, t) {
 				let r = await e.connections.get(t, n);
 				if (!r) return r;
 				let i = await a(t);
-				return !i || t === i.tenantId ? r : P(r, (await e.connections.list(i.tenantId)).connections || []);
+				return !i || t === i.tenantId ? r : z(r, (await e.connections.list(i.tenantId)).connections || []);
 			},
 			list: async (t, n) => {
 				let r = await e.connections.list(t, n), i = await a(t);
 				if (!i || t === i.tenantId) return r;
-				let o = await e.connections.list(i.tenantId), s = r.connections.map((e) => P(e, o.connections || []));
+				let o = await e.connections.list(i.tenantId), s = r.connections.map((e) => z(e, o.connections || []));
 				return {
 					...r,
 					connections: s
@@ -638,7 +868,7 @@ function B(e, t) {
 				let i = await a(t);
 				if (!i || t === i.tenantId) return r;
 				let o = await e.connections.list(i.tenantId);
-				return r.map((e) => P(e, o.connections || []));
+				return r.map((e) => z(e, o.connections || []));
 			}
 		},
 		emailProviders: {
@@ -650,22 +880,22 @@ function B(e, t) {
 				return !r || t === r.tenantId ? null : e.emailProviders.get(r.tenantId);
 			}
 		},
-		resourceServers: R(e, a),
-		hooks: fe(e, a)
+		resourceServers: U(e, a),
+		hooks: Se(e, a)
 	};
 }
-function V(e) {
+function K(e) {
 	if (!e || typeof e != "object") return !1;
 	let t = e.metadata;
 	return !t || typeof t != "object" ? !1 : t.inheritable === !0;
 }
-function fe(e, t) {
+function Se(e, t) {
 	return {
 		...e.hooks,
 		list: async (n, r) => {
 			let i = await e.hooks.list(n, r), a = await t(n);
 			if (!a || n === a.tenantId) return i;
-			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(V);
+			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(K);
 			if (o.length === 0) return i;
 			let s = new Set((i.hooks || []).map((e) => e.hook_id)), c = o.filter((e) => !s.has(e.hook_id));
 			return {
@@ -680,31 +910,31 @@ function fe(e, t) {
 			let a = await t(n);
 			if (!a || n === a.tenantId) return i;
 			let o = await e.hooks.get(a.tenantId, r);
-			return o && V(o) ? o : null;
+			return o && K(o) ? o : null;
 		}
 	};
 }
-function H(e, t) {
-	return B(e, t);
+function q(e, t) {
+	return G(e, t);
 }
 //#endregion
 //#region src/middleware/index.ts
-function U(e) {
+function Ce(e) {
 	return async (t, n) => {
 		let r = t.var.user;
 		return r?.tenant_id === e && r.org_name && t.set("tenant_id", r.org_name), n();
 	};
 }
-function W(e) {
+function we(e) {
 	return async (n, r) => {
 		if (!e.accessControl) return r();
 		let { controlPlaneTenantId: i } = e.accessControl, a = n.var.org_name, o = n.var.organization_id, s = a || o, c = n.var.tenant_id, l = n.var.user, u = (l?.aud ? Array.isArray(l.aud) ? l.aud : [l.aud] : []).includes(t);
-		if (!c && s && u && (n.set("tenant_id", s), c = s), !c) throw new x(400, { message: "Tenant ID not found in request" });
-		if (!C(o, c, i, a)) throw new x(403, { message: `Access denied to tenant ${c}` });
+		if (!c && s && u && (n.set("tenant_id", s), c = s), !c) throw new S(400, { message: "Tenant ID not found in request" });
+		if (!w(o, c, i, a)) throw new S(403, { message: `Access denied to tenant ${c}` });
 		return r();
 	};
 }
-function G(e) {
+function Te(e) {
 	return async (t, n) => {
 		if (!e.subdomainRouting) return n();
 		let { baseDomain: r, reservedSubdomains: i = [], resolveSubdomain: a } = e.subdomainRouting, o = t.req.header("x-forwarded-host") || t.req.header("host") || "", s = null;
@@ -719,43 +949,43 @@ function G(e) {
 			let n = await t.env.data.organizations.get(e.accessControl.controlPlaneTenantId, s);
 			n && (c = n.id);
 		} catch {}
-		if (!c) throw new x(404, { message: `Tenant not found for subdomain: ${s}` });
+		if (!c) throw new S(404, { message: `Tenant not found for subdomain: ${s}` });
 		return t.set("tenant_id", c), n();
 	};
 }
-function K(e) {
+function Ee(e) {
 	return async (t, n) => {
 		if (!e.databaseIsolation) return n();
 		let r = t.var.tenant_id;
-		if (!r) throw new x(400, { message: "Tenant ID not found in request" });
+		if (!r) throw new S(400, { message: "Tenant ID not found in request" });
 		try {
 			let n = await e.databaseIsolation.getAdapters(r);
 			t.env.data = n;
 		} catch (e) {
-			throw console.error(`Failed to resolve database for tenant ${r}:`, e), new x(500, { message: "Failed to resolve tenant database" });
+			throw console.error(`Failed to resolve database for tenant ${r}:`, e), new S(500, { message: "Failed to resolve tenant database" });
 		}
 		return n();
 	};
 }
-function q(e) {
-	let t = G(e), n = W(e), r = K(e);
+function J(e) {
+	let t = Te(e), n = we(e), r = Ee(e);
 	return async (e, i) => (await t(e, async () => {}), await n(e, async () => {}), await r(e, async () => {}), i());
 }
 //#endregion
 //#region src/init.ts
-function pe(e) {
+function De(e) {
 	let { dataAdapter: t, controlPlane: n, controlPlane: { tenantId: r = "control_plane", clientId: i } = {}, resolveControlPlane: a, sync: o = {
 		resourceServers: !0,
 		roles: !0
 	}, defaultPermissions: s = ["tenant:admin"], requireOrganizationMatch: c = !1, managementApiExtensions: l = [], entityHooks: d, getChildTenantIds: p, getAdapters: m, ...h } = e;
 	if (a && !n) throw Error("initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it.");
 	let g = t, _ = t;
-	n && (g = H(t, {
+	n && (g = q(t, {
 		controlPlaneTenantId: r,
 		controlPlaneClientId: i,
 		resolveControlPlane: a
 	}), _ = {
-		...z(t, {
+		...W(t, {
 			controlPlaneTenantId: r,
 			resolveControlPlane: a
 		}),
@@ -765,13 +995,36 @@ function pe(e) {
 			resolveControlPlane: a
 		}
 	});
-	let v = o !== !1, y = v ? {
+	let v = h.tenantOperationExecutor;
+	if (!v && t.tenantOperations && t.tenantOperationEvents && h.tenantUpgrade) {
+		let e = {
+			tenantOperations: t.tenantOperations,
+			tenantOperationEvents: t.tenantOperationEvents
+		}, n = h.tenantUpgrade, r = j({
+			stores: e,
+			definitions: { upgrade: (e) => [{
+				name: "upgrade",
+				async run() {
+					if (!e.tenant_id) throw Error("upgrade operations require a tenant_id");
+					await n(e.tenant_id);
+				}
+			}] }
+		});
+		v = {
+			engine: r.engine,
+			enqueue: (t) => N(e, r, {
+				...t,
+				tenant_id: t.tenant_id
+			})
+		};
+	}
+	let y = o !== !1, ee = y ? {
 		resourceServers: o.resourceServers ?? !0,
 		roles: o.roles ?? !0
 	} : {
 		resourceServers: !1,
 		roles: !1
-	}, { entityHooks: b, tenantHooks: x } = re({
+	}, { entityHooks: b, tenantHooks: x } = I({
 		controlPlaneTenantId: r,
 		getChildTenantIds: p ?? (async () => (await u((e) => g.tenants.list(e), "tenants", {
 			cursorField: "id",
@@ -779,18 +1032,18 @@ function pe(e) {
 		})).filter((e) => e.id !== r).map((e) => e.id)),
 		getAdapters: m ?? (async () => g),
 		getControlPlaneAdapters: async () => g,
-		sync: y
+		sync: ee
 	}), S = {
 		resourceServers: [b.resourceServers, ...d?.resourceServers ?? []],
 		roles: [b.roles, ...d?.roles ?? []],
 		connections: d?.connections ?? [],
 		tenants: d?.tenants ?? [],
 		rolePermissions: d?.rolePermissions ?? []
-	}, C = E({ accessControl: {
+	}, C = F({ accessControl: {
 		controlPlaneTenantId: r,
 		requireOrganizationMatch: c,
 		defaultPermissions: s
-	} }), w = M({ accessControl: {
+	} }), w = L({ accessControl: {
 		controlPlaneTenantId: r,
 		requireOrganizationMatch: c,
 		defaultPermissions: s
@@ -808,20 +1061,21 @@ function pe(e) {
 		dataAdapter: g,
 		managementDataAdapter: _,
 		...h,
+		tenantOperationExecutor: v,
 		entityHooks: S,
 		managementApiExtensions: [...l, {
 			path: "/tenants",
 			router: w
 		}]
 	});
-	return T.use("/api/v2/*", U(r)), v && T.use("/api/v2/*", N()), {
+	return T.use("/api/v2/*", Ce(r)), y && T.use("/api/v2/*", R()), {
 		app: T,
 		controlPlaneTenantId: r
 	};
 }
 //#endregion
 //#region src/rollout/defaults-projection.ts
-function J(e = {}) {
+function Y(e = {}) {
 	return {
 		connections: e.connections ?? !0,
 		resourceServers: e.resourceServers ?? !0,
@@ -831,28 +1085,28 @@ function J(e = {}) {
 		promptSettings: e.promptSettings ?? !0
 	};
 }
-function Y() {
+function X() {
 	return {
 		upserted: 0,
 		errors: []
 	};
 }
-function me(e) {
+function Oe(e) {
 	return {
 		tenantId: e,
-		connections: Y(),
-		resourceServers: Y(),
-		hooks: Y(),
-		emailProvider: Y(),
-		branding: Y(),
-		promptSettings: Y()
+		connections: X(),
+		resourceServers: X(),
+		hooks: X(),
+		emailProvider: X(),
+		branding: X(),
+		promptSettings: X()
 	};
 }
-function he(e) {
+function ke(e) {
 	let t = e.metadata;
 	return !!(t && t.inheritable === !0);
 }
-async function X(e, t, n, r) {
+async function Z(e, t, n, r) {
 	try {
 		await r();
 	} catch (r) {
@@ -861,7 +1115,7 @@ async function X(e, t, n, r) {
 		e.errors.push(i);
 	}
 }
-async function ge(e, t, n) {
+async function Ae(e, t, n) {
 	return {
 		connections: n.connections ? await u((n) => e.connections.list(t, n), "connections", {
 			cursorField: "id",
@@ -880,47 +1134,47 @@ async function ge(e, t, n) {
 		promptSettings: n.promptSettings ? await e.promptSettings.get(t) ?? null : null
 	};
 }
-async function _e(e, t, n, r, i, o) {
+async function je(e, t, n, r, i, o) {
 	if (r.connections) for (let r of e.connections) {
 		let e = r.id;
-		e && await X(o.connections, `connection ${e}`, i, async () => {
+		e && await Z(o.connections, `connection ${e}`, i, async () => {
 			let i = a.parse(r);
 			await t.connections.get(n, e) ? await t.connections.update(n, e, i) : await t.connections.create(n, i), o.connections.upserted += 1;
 		});
 	}
-	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await X(o.resourceServers, `resource_server ${r.id}`, i, async () => {
-		let e = h.parse(r);
+	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await Z(o.resourceServers, `resource_server ${r.id}`, i, async () => {
+		let e = _.parse(r);
 		await t.resourceServers.get(n, r.id) ? await t.resourceServers.update(n, r.id, e) : await t.resourceServers.create(n, e), o.resourceServers.upserted += 1;
 	});
-	if (r.hooks) for (let r of e.hooks) !he(r) || !r.hook_id || await X(o.hooks, `hook ${r.hook_id}`, i, async () => {
+	if (r.hooks) for (let r of e.hooks) !ke(r) || !r.hook_id || await Z(o.hooks, `hook ${r.hook_id}`, i, async () => {
 		let e = d.parse(r);
 		await t.hooks.get(n, r.hook_id) ? await t.hooks.update(n, r.hook_id, e) : await t.hooks.create(n, e), o.hooks.upserted += 1;
 	});
-	r.emailProvider && e.emailProvider && await X(o.emailProvider, "email_provider", i, async () => {
+	r.emailProvider && e.emailProvider && await Z(o.emailProvider, "email_provider", i, async () => {
 		let r = e.emailProvider;
 		await t.emailProviders.get(n) ? await t.emailProviders.update(n, r) : await t.emailProviders.create(n, r), o.emailProvider.upserted += 1;
-	}), r.branding && e.branding && await X(o.branding, "branding", i, async () => {
+	}), r.branding && e.branding && await Z(o.branding, "branding", i, async () => {
 		await t.branding.set(n, e.branding), o.branding.upserted += 1;
-	}), r.promptSettings && e.promptSettings && await X(o.promptSettings, "prompt_settings", i, async () => {
+	}), r.promptSettings && e.promptSettings && await Z(o.promptSettings, "prompt_settings", i, async () => {
 		await t.promptSettings.set(n, e.promptSettings), o.promptSettings.upserted += 1;
 	});
 }
-async function Z(e, t) {
-	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = J(a), c = await ge(await r(), n, s), l = await i(t), u = me(t);
-	return await _e(c, l, n, s, o, u), u;
+async function Q(e, t) {
+	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = Y(a), c = await Ae(await r(), n, s), l = await i(t), u = Oe(t);
+	return await je(c, l, n, s, o, u), u;
 }
 //#endregion
 //#region src/rollout/payload.ts
-function ve(e) {
+function Me(e) {
 	let { pkcs7: t, tenant_id: n, ...r } = e;
 	return r;
 }
-async function ye(e, t, n = {}, r) {
-	let i = J(n), a = n.signingKeys ?? !0, o = n.tenants ?? !0, s = await ge(e, t, i), c = a ? (await p(e.keys)).map(ve) : [], l = o ? await be(e, t, r) : [];
+async function Ne(e, t, n = {}, r) {
+	let i = Y(n), a = n.signingKeys ?? !0, o = n.tenants ?? !0, s = await Ae(e, t, i), c = a ? (await m(e.keys)).map(Me) : [], l = o ? await Pe(e, t, r) : [];
 	return {
 		connections: s.connections,
 		resourceServers: s.resourceServers.filter((e) => e.is_system),
-		hooks: s.hooks.filter(he),
+		hooks: s.hooks.filter(ke),
 		emailProvider: s.emailProvider,
 		branding: s.branding,
 		promptSettings: s.promptSettings,
@@ -928,7 +1182,7 @@ async function ye(e, t, n = {}, r) {
 		tenants: l
 	};
 }
-async function be(e, t, n) {
+async function Pe(e, t, n) {
 	let r = n && n !== t ? [t, n] : [t], i = [];
 	for (let t of r) {
 		let n = await e.tenants.get(t);
@@ -939,19 +1193,19 @@ async function be(e, t, n) {
 	}
 	return i;
 }
-async function xe(e, t, n) {
-	let r = Y();
+async function Fe(e, t, n) {
+	let r = X();
 	if (e.length === 0) return r;
-	let i = await p(t.keys), a = new Set(i.map((e) => e.kid));
-	for (let i of e) await X(r, `signing_key ${i.kid}`, n, async () => {
-		let e = ve(i);
+	let i = await m(t.keys), a = new Set(i.map((e) => e.kid));
+	for (let i of e) await Z(r, `signing_key ${i.kid}`, n, async () => {
+		let e = Me(i);
 		a.has(e.kid) || (await t.keys.create(e), a.add(e.kid), r.upserted += 1);
 	});
 	return r;
 }
-async function Se(e, t, n) {
-	let r = Y();
-	for (let i of e) await X(r, `tenant ${i.id}`, n, async () => {
+async function Ie(e, t, n) {
+	let r = X();
+	for (let i of e) await Z(r, `tenant ${i.id}`, n, async () => {
 		await t.tenants.get(i.id) || (await t.tenants.create({
 			id: i.id,
 			friendly_name: i.friendly_name
@@ -959,17 +1213,17 @@ async function Se(e, t, n) {
 	});
 	return r;
 }
-async function Ce(e, t, n, r = {}) {
-	let a = r.continueOnError ?? !1, o = J(r.entities), s = r.entities?.signingKeys ?? !0, c = r.entities?.tenants ?? !0, u = {
+async function Le(e, t, n, r = {}) {
+	let a = r.continueOnError ?? !1, o = Y(r.entities), s = r.entities?.signingKeys ?? !0, c = r.entities?.tenants ?? !0, u = {
 		connections: e.connections,
 		resourceServers: e.resourceServers,
 		hooks: e.hooks,
 		emailProvider: e.emailProvider ? l.parse(e.emailProvider) : null,
 		branding: e.branding ? i.parse(e.branding) : null,
-		promptSettings: e.promptSettings ? m.parse(e.promptSettings) : null
-	}, d = c ? await Se(e.tenants ?? [], t, a) : Y(), f = me(n);
-	await _e(u, t, n, o, a, f);
-	let p = s ? await xe(e.signingKeys, t, a) : Y();
+		promptSettings: e.promptSettings ? h.parse(e.promptSettings) : null
+	}, d = c ? await Ie(e.tenants ?? [], t, a) : X(), f = Oe(n);
+	await je(u, t, n, o, a, f);
+	let p = s ? await Fe(e.signingKeys, t, a) : X();
 	return {
 		...f,
 		signingKeys: p,
@@ -978,27 +1232,27 @@ async function Ce(e, t, n, r = {}) {
 }
 //#endregion
 //#region src/rollout/index.ts
-function we(e) {
+function Re(e) {
 	return {
-		syncDefaults: (t) => Z(e, t),
+		syncDefaults: (t) => Q(e, t),
 		syncDefaultsToTenants: async (t) => {
 			let n = [];
-			for (let r of t) n.push(await Z(e, r));
+			for (let r of t) n.push(await Q(e, r));
 			return n;
 		}
 	};
 }
 //#endregion
 //#region src/plugin.ts
-function Te(e) {
-	let t = Q(e);
+function ze(e) {
+	let t = $(e);
 	return {
 		name: "multi-tenancy",
-		middleware: q(e),
+		middleware: J(e),
 		hooks: t,
 		routes: [{
 			path: "/management",
-			handler: M(e, t)
+			handler: L(e, t)
 		}],
 		onRegister: async () => {
 			console.log("Multi-tenancy plugin registered"), e.accessControl && console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`), e.subdomainRouting && console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`), e.databaseIsolation && console.log("  - Database isolation enabled");
@@ -1007,29 +1261,29 @@ function Te(e) {
 }
 //#endregion
 //#region src/index.ts
-function Q(e) {
-	let t = e.accessControl ? S(e.accessControl) : {}, n = e.databaseIsolation ? w(e.databaseIsolation) : {}, r = E(e);
+function $(e) {
+	let t = e.accessControl ? C(e.accessControl) : {}, n = e.databaseIsolation ? T(e.databaseIsolation) : {}, r = F(e);
 	return {
 		...t,
 		...n,
 		tenants: r
 	};
 }
-function $(t) {
-	let n = new e(), r = Q(t);
-	return n.route("/tenants", M(t, r)), n;
+function Be(t) {
+	let n = new e(), r = $(t);
+	return n.route("/tenants", L(t, r)), n;
 }
-function Ee(e) {
+function Ve(e) {
 	return {
-		hooks: Q(e),
-		middleware: q(e),
-		app: $(e),
+		hooks: $(e),
+		middleware: J(e),
+		app: Be(e),
 		config: e,
-		wrapAdapters: (t, n) => H(t, {
+		wrapAdapters: (t, n) => q(t, {
 			controlPlaneTenantId: e.accessControl?.controlPlaneTenantId,
 			controlPlaneClientId: n?.controlPlaneClientId
 		})
 	};
 }
 //#endregion
-export { Ce as applyControlPlaneDefaultsPayload, ye as buildControlPlaneDefaultsPayload, S as createAccessControlHooks, W as createAccessControlMiddleware, U as createControlPlaneTenantMiddleware, w as createDatabaseHooks, K as createDatabaseMiddleware, we as createDirectRolloutAdapter, $ as createMultiTenancy, Q as createMultiTenancyHooks, q as createMultiTenancyMiddleware, Te as createMultiTenancyPlugin, N as createProtectSyncedMiddleware, E as createProvisioningHooks, B as createRuntimeFallbackAdapter, G as createSubdomainMiddleware, re as createSyncHooks, M as createTenantsOpenAPIRouter, pe as initMultiTenant, de as mergeClientWithFallback, Z as projectControlPlaneDefaults, Ee as setupMultiTenancy, C as validateTenantAccess, H as withRuntimeFallback, z as withSystemResourceServerInheritance };
+export { Le as applyControlPlaneDefaultsPayload, Ne as buildControlPlaneDefaultsPayload, te as buildEngineInstanceId, C as createAccessControlHooks, we as createAccessControlMiddleware, Ce as createControlPlaneTenantMiddleware, T as createDatabaseHooks, Ee as createDatabaseMiddleware, Re as createDirectRolloutAdapter, j as createInlineExecutor, Be as createMultiTenancy, $ as createMultiTenancyHooks, J as createMultiTenancyMiddleware, ze as createMultiTenancyPlugin, k as createOperationRecorder, R as createProtectSyncedMiddleware, F as createProvisioningHooks, G as createRuntimeFallbackAdapter, Te as createSubdomainMiddleware, I as createSyncHooks, L as createTenantsOpenAPIRouter, N as enqueueTenantOperation, O as errorToMessage, De as initMultiTenant, A as inlineStepRunner, re as isTerminalStatus, xe as mergeClientWithFallback, Q as projectControlPlaneDefaults, P as runRecordedTenantOperation, Ve as setupMultiTenancy, w as validateTenantAccess, q as withRuntimeFallback, W as withSystemResourceServerInheritance };