@authhero/multi-tenancy 14.5.0 → 14.6.0

package/dist/multi-tenancy.mjs

@@ -1,18 +1,18 @@
 var X = Object.defineProperty;
 var Y = (t, e, n) => e in t ? X(t, e, { enumerable: !0, configurable: !0, writable: !0, value: n }) : t[e] = n;
-var R = (t, e, n) => Y(t, typeof e != "symbol" ? e + "" : e, n);
+var F = (t, e, n) => Y(t, typeof e != "symbol" ? e + "" : e, n);
 import { Hono as Z } from "hono";
-import { MANAGEMENT_API_SCOPES as x, MANAGEMENT_API_AUDIENCE as W, fetchAll as z, auth0QuerySchema as ee, tenantSchema as H, tenantInsertSchema as te, connectionSchema as F, connectionOptionsSchema as O, init as ne } from "authhero";
+import { MANAGEMENT_API_SCOPES as x, MANAGEMENT_API_AUDIENCE as W, fetchAll as O, auth0QuerySchema as ee, tenantSchema as G, tenantInsertSchema as te, connectionSchema as R, connectionOptionsSchema as D, init as ne } from "authhero";
 import { OpenAPIHono as re, createRoute as M, z as S } from "@hono/zod-openapi";
 function se(t) {
   const { controlPlaneTenantId: e, requireOrganizationMatch: n = !0 } = t;
   return {
-    async onTenantAccessValidation(r, s) {
-      if (s === e)
+    async onTenantAccessValidation(r, a) {
+      if (a === e)
         return !0;
       if (n) {
-        const c = r.var.org_name, o = r.var.organization_id, a = c || o;
-        return a ? a.toLowerCase() === s.toLowerCase() : !1;
+        const c = r.var.org_name, l = r.var.organization_id, s = c || l;
+        return s ? s.toLowerCase() === a.toLowerCase() : !1;
       }
       return !0;
     }
@@ -21,8 +21,8 @@ function se(t) {
 function ae(t, e, n, r) {
   if (e === n)
     return !0;
-  const s = r || t;
-  return s ? s.toLowerCase() === e.toLowerCase() : !1;
+  const a = r || t;
+  return a ? a.toLowerCase() === e.toLowerCase() : !1;
 }
 function oe(t) {
   return {
@@ -51,19 +51,19 @@ function ce(t) {
       } : n;
     },
     async afterCreate(e, n) {
-      const { accessControl: r, databaseIsolation: s } = t;
-      r && e.ctx && await le(e, n, r), s != null && s.onProvision && await s.onProvision(n.id);
+      const { accessControl: r, databaseIsolation: a } = t;
+      r && e.ctx && await le(e, n, r), a != null && a.onProvision && await a.onProvision(n.id);
     },
     async beforeDelete(e, n) {
-      const { accessControl: r, databaseIsolation: s } = t;
+      const { accessControl: r, databaseIsolation: a } = t;
       if (r)
         try {
-          const o = (await e.adapters.organizations.list(
+          const l = (await e.adapters.organizations.list(
             r.controlPlaneTenantId
-          )).organizations.find((a) => a.name === n);
-          o && await e.adapters.organizations.remove(
+          )).organizations.find((s) => s.name === n);
+          l && await e.adapters.organizations.remove(
             r.controlPlaneTenantId,
-            o.id
+            l.id
           );
         } catch (c) {
           console.warn(
@@ -71,9 +71,9 @@ function ce(t) {
             c
           );
         }
-      if (s != null && s.onDeprovision)
+      if (a != null && a.onDeprovision)
         try {
-          await s.onDeprovision(n);
+          await a.onDeprovision(n);
         } catch (c) {
           console.warn(
             `Failed to deprovision database for tenant ${n}:`,
@@ -86,12 +86,12 @@ function ce(t) {
 async function le(t, e, n) {
   const {
     controlPlaneTenantId: r,
-    defaultPermissions: s,
+    defaultPermissions: a,
     defaultRoles: c,
-    issuer: o,
-    adminRoleName: a = "Tenant Admin",
-    adminRoleDescription: d = "Full access to all tenant management operations",
-    addCreatorToOrganization: u = !0
+    issuer: l,
+    adminRoleName: s = "Tenant Admin",
+    adminRoleDescription: p = "Full access to all tenant management operations",
+    addCreatorToOrganization: o = !0
   } = n, i = await t.adapters.organizations.create(
     r,
     {
@@ -100,40 +100,40 @@ async function le(t, e, n) {
     }
   );
   let f;
-  if (o && (f = await ue(
+  if (l && (f = await ue(
     t,
     r,
-    a,
-    d
-  )), u && t.ctx) {
-    const l = t.ctx.var.user;
-    if (l != null && l.sub && !await de(
+    s,
+    p
+  )), o && t.ctx) {
+    const d = t.ctx.var.user;
+    if (d != null && d.sub && !await de(
       t,
       r,
-      l.sub
+      d.sub
     ))
       try {
         await t.adapters.userOrganizations.create(r, {
-          user_id: l.sub,
+          user_id: d.sub,
           organization_id: i.id
         }), f && await t.adapters.userRoles.create(
           r,
-          l.sub,
+          d.sub,
           f,
           i.id
           // organizationId
         );
-      } catch (g) {
+      } catch (m) {
         console.warn(
-          `Failed to add creator ${l.sub} to organization ${i.id}:`,
-          g
+          `Failed to add creator ${d.sub} to organization ${i.id}:`,
+          m
         );
       }
   }
   c && c.length > 0 && console.log(
     `Would assign roles ${c.join(", ")} to organization ${i.id}`
-  ), s && s.length > 0 && console.log(
-    `Would grant permissions ${s.join(", ")} to organization ${i.id}`
+  ), a && a.length > 0 && console.log(
+    `Would grant permissions ${a.join(", ")} to organization ${i.id}`
   );
 }
 async function de(t, e, n) {
@@ -144,77 +144,77 @@ async function de(t, e, n) {
     ""
     // Empty string for global roles
   );
-  for (const s of r)
+  for (const a of r)
     if ((await t.adapters.rolePermissions.list(
       e,
-      s.id,
+      a.id,
       { per_page: 1e3 }
     )).some(
-      (a) => a.permission_name === "admin:organizations"
+      (s) => s.permission_name === "admin:organizations"
     ))
       return !0;
   return !1;
 }
 async function ue(t, e, n, r) {
-  const c = (await t.adapters.roles.list(e, {})).roles.find((u) => u.name === n);
+  const c = (await t.adapters.roles.list(e, {})).roles.find((o) => o.name === n);
   if (c)
     return c.id;
-  const o = await t.adapters.roles.create(e, {
+  const l = await t.adapters.roles.create(e, {
     name: n,
     description: r
-  }), a = W, d = x.map((u) => ({
-    role_id: o.id,
-    resource_server_identifier: a,
-    permission_name: u.value
+  }), s = W, p = x.map((o) => ({
+    role_id: l.id,
+    resource_server_identifier: s,
+    permission_name: o.value
   }));
   return await t.adapters.rolePermissions.assign(
     e,
-    o.id,
-    d
-  ), o.id;
+    l.id,
+    p
+  ), l.id;
 }
-function G(t, e, n = () => !0) {
-  const { controlPlaneTenantId: r, getChildTenantIds: s, getAdapters: c } = t, o = /* @__PURE__ */ new Map();
-  async function a(i, f, l) {
+function L(t, e, n = () => !0) {
+  const { controlPlaneTenantId: r, getChildTenantIds: a, getAdapters: c } = t, l = /* @__PURE__ */ new Map();
+  async function s(i, f, d) {
     return (await e(i).list(f, {
-      q: `name:${l}`,
+      q: `name:${d}`,
       per_page: 1
     }))[0] ?? null;
   }
-  async function d(i) {
-    const f = await s(), l = e(await c(r));
+  async function p(i) {
+    const f = await a(), d = e(await c(r));
     await Promise.all(
-      f.map(async (m) => {
+      f.map(async (u) => {
         try {
-          const g = await c(m), p = e(g), w = {
-            ...l.transform(i),
+          const m = await c(u), g = e(m), w = {
+            ...d.transform(i),
             is_system: !0
-          }, y = await a(g, m, i.name), T = y ? p.getId(y) : void 0;
-          if (y && T) {
-            const b = p.preserveOnUpdate ? p.preserveOnUpdate(y, w) : w;
-            await p.update(m, T, b);
+          }, y = await s(m, u, i.name), _ = y ? g.getId(y) : void 0;
+          if (y && _) {
+            const T = g.preserveOnUpdate ? g.preserveOnUpdate(y, w) : w;
+            await g.update(u, _, T);
           } else
-            await p.create(m, w);
-        } catch (g) {
+            await g.create(u, w);
+        } catch (m) {
           console.error(
-            `Failed to sync ${l.listKey} "${i.name}" to tenant "${m}":`,
-            g
+            `Failed to sync ${d.listKey} "${i.name}" to tenant "${u}":`,
+            m
           );
         }
       })
     );
   }
-  async function u(i) {
-    const f = await s();
+  async function o(i) {
+    const f = await a();
     await Promise.all(
-      f.map(async (l) => {
+      f.map(async (d) => {
         try {
-          const m = await c(l), g = e(m), p = await a(m, l, i), h = p ? g.getId(p) : void 0;
-          p && h && await g.remove(l, h);
-        } catch (m) {
+          const u = await c(d), m = e(u), g = await s(u, d, i), h = g ? m.getId(g) : void 0;
+          g && h && await m.remove(d, h);
+        } catch (u) {
           console.error(
-            `Failed to delete entity "${i}" from tenant "${l}":`,
-            m
+            `Failed to delete entity "${i}" from tenant "${d}":`,
+            u
           );
         }
       })
@@ -222,60 +222,60 @@ function G(t, e, n = () => !0) {
   }
   return {
     afterCreate: async (i, f) => {
-      i.tenantId === r && n(f) && await d(f);
+      i.tenantId === r && n(f) && await p(f);
     },
-    afterUpdate: async (i, f, l) => {
-      i.tenantId === r && n(l) && await d(l);
+    afterUpdate: async (i, f, d) => {
+      i.tenantId === r && n(d) && await p(d);
     },
     beforeDelete: async (i, f) => {
       if (i.tenantId !== r) return;
-      const m = await e(i.adapters).get(i.tenantId, f);
-      m && n(m) && o.set(f, m);
+      const u = await e(i.adapters).get(i.tenantId, f);
+      u && n(u) && l.set(f, u);
     },
     afterDelete: async (i, f) => {
       if (i.tenantId !== r) return;
-      const l = o.get(f);
-      l && (o.delete(f), await u(l.name));
+      const d = l.get(f);
+      d && (l.delete(f), await o(d.name));
     }
   };
 }
-function L(t, e, n = () => !0) {
-  const { controlPlaneTenantId: r, getControlPlaneAdapters: s, getAdapters: c } = t;
+function U(t, e, n = () => !0) {
+  const { controlPlaneTenantId: r, getControlPlaneAdapters: a, getAdapters: c } = t;
   return {
-    async afterCreate(o, a) {
-      if (a.id !== r)
+    async afterCreate(l, s) {
+      if (s.id !== r)
         try {
-          const d = await s(), u = await c(a.id), i = e(d), f = e(u), l = await z(
-            (m) => i.listPaginated(r, m),
+          const p = await a(), o = await c(s.id), i = e(p), f = e(o), d = await O(
+            (u) => i.listPaginated(r, u),
             i.listKey,
             { cursorField: "id", pageSize: 100 }
           );
           await Promise.all(
-            l.filter((m) => n(m)).map(async (m) => {
+            d.filter((u) => n(u)).map(async (u) => {
               try {
-                const g = i.transform(m);
-                await f.create(a.id, {
-                  ...g,
+                const m = i.transform(u);
+                await f.create(s.id, {
+                  ...m,
                   is_system: !0
                 });
-              } catch (g) {
+              } catch (m) {
                 console.error(
-                  `Failed to sync entity to new tenant "${a.id}":`,
-                  g
+                  `Failed to sync entity to new tenant "${s.id}":`,
+                  m
                 );
               }
             })
           );
-        } catch (d) {
+        } catch (p) {
           console.error(
-            `Failed to sync entities to new tenant "${a.id}":`,
-            d
+            `Failed to sync entities to new tenant "${s.id}":`,
+            p
           );
         }
     }
   };
 }
-const U = (t) => ({
+const B = (t) => ({
   list: async (e, n) => (await t.resourceServers.list(e, n)).resource_servers,
   listPaginated: (e, n) => t.resourceServers.list(e, n),
   get: (e, n) => t.resourceServers.get(e, n),
@@ -293,7 +293,7 @@ const U = (t) => ({
     token_lifetime: e.token_lifetime,
     token_lifetime_for_web: e.token_lifetime_for_web
   })
-}), B = (t) => ({
+}), K = (t) => ({
   list: async (e, n) => (await t.roles.list(e, n)).roles,
   listPaginated: (e, n) => t.roles.list(e, n),
   get: (e, n) => t.roles.get(e, n),
@@ -308,116 +308,116 @@ const U = (t) => ({
     description: e.description
   })
 });
-function K(t) {
+function V(t) {
   var e;
   return ((e = t.metadata) == null ? void 0 : e.sync) !== !1;
 }
 function fe(t) {
-  const { sync: e = {}, filters: n = {} } = t, r = e.resourceServers ?? !0, s = e.roles ?? !0, c = (g) => K(g) ? n.resourceServers ? n.resourceServers(g) : !0 : !1, o = (g) => K(g) ? n.roles ? n.roles(g) : !0 : !1, a = r ? G(
+  const { sync: e = {}, filters: n = {} } = t, r = e.resourceServers ?? !0, a = e.roles ?? !0, c = (m) => V(m) ? n.resourceServers ? n.resourceServers(m) : !0 : !1, l = (m) => V(m) ? n.roles ? n.roles(m) : !0 : !1, s = r ? L(
     t,
-    U,
+    B,
     c
-  ) : void 0, d = s ? G(
+  ) : void 0, p = a ? L(
     t,
-    B,
-    o
-  ) : void 0, u = r ? L(
+    K,
+    l
+  ) : void 0, o = r ? U(
     t,
-    U,
+    B,
     c
-  ) : void 0, i = s ? L(
+  ) : void 0, i = a ? U(
     t,
-    B,
-    o
-  ) : void 0, f = s ? {
-    async afterCreate(g, p) {
+    K,
+    l
+  ) : void 0, f = a ? {
+    async afterCreate(m, g) {
       var h;
-      if (p.id !== t.controlPlaneTenantId) {
-        await ((h = i == null ? void 0 : i.afterCreate) == null ? void 0 : h.call(i, g, p));
+      if (g.id !== t.controlPlaneTenantId) {
+        await ((h = i == null ? void 0 : i.afterCreate) == null ? void 0 : h.call(i, m, g));
         try {
-          const w = await t.getControlPlaneAdapters(), y = await t.getAdapters(p.id), T = await z(
+          const w = await t.getControlPlaneAdapters(), y = await t.getAdapters(g.id), _ = await O(
             (A) => w.roles.list(
               t.controlPlaneTenantId,
               A
             ),
             "roles",
             { cursorField: "id", pageSize: 100 }
-          ), b = /* @__PURE__ */ new Map();
-          for (const A of T.filter(
-            (_) => {
-              var v;
-              return ((v = n.roles) == null ? void 0 : v.call(n, _)) ?? !0;
+          ), T = /* @__PURE__ */ new Map();
+          for (const A of _.filter(
+            (v) => {
+              var b;
+              return ((b = n.roles) == null ? void 0 : b.call(n, v)) ?? !0;
             }
           )) {
-            const _ = await l(
+            const v = await d(
               y,
-              p.id,
+              g.id,
               A.name
             );
-            _ && b.set(A.name, _.id);
+            v && T.set(A.name, v.id);
           }
-          for (const A of T.filter(
-            (_) => {
-              var v;
-              return ((v = n.roles) == null ? void 0 : v.call(n, _)) ?? !0;
+          for (const A of _.filter(
+            (v) => {
+              var b;
+              return ((b = n.roles) == null ? void 0 : b.call(n, v)) ?? !0;
             }
           )) {
-            const _ = b.get(A.name);
-            if (_)
+            const v = T.get(A.name);
+            if (v)
               try {
-                const v = await w.rolePermissions.list(
+                const b = await w.rolePermissions.list(
                   t.controlPlaneTenantId,
                   A.id,
                   {}
                 );
-                v.length > 0 && await y.rolePermissions.assign(
-                  p.id,
-                  _,
-                  v.map((P) => ({
-                    role_id: _,
-                    resource_server_identifier: P.resource_server_identifier,
-                    permission_name: P.permission_name
+                b.length > 0 && await y.rolePermissions.assign(
+                  g.id,
+                  v,
+                  b.map((C) => ({
+                    role_id: v,
+                    resource_server_identifier: C.resource_server_identifier,
+                    permission_name: C.permission_name
                   }))
                 );
-              } catch (v) {
+              } catch (b) {
                 console.error(
-                  `Failed to sync permissions for role "${A.name}" to tenant "${p.id}":`,
-                  v
+                  `Failed to sync permissions for role "${A.name}" to tenant "${g.id}":`,
+                  b
                 );
               }
           }
         } catch (w) {
           console.error(
-            `Failed to sync role permissions to tenant "${p.id}":`,
+            `Failed to sync role permissions to tenant "${g.id}":`,
             w
           );
         }
       }
     }
   } : void 0;
-  async function l(g, p, h) {
-    return (await g.roles.list(p, {
+  async function d(m, g, h) {
+    return (await m.roles.list(g, {
       q: `name:${h}`,
       per_page: 1
     })).roles[0] ?? null;
   }
   return {
     entityHooks: {
-      resourceServers: a,
-      roles: d
+      resourceServers: s,
+      roles: p
     },
     tenantHooks: {
-      async afterCreate(g, p) {
+      async afterCreate(m, g) {
         const h = [
-          u == null ? void 0 : u.afterCreate,
+          o == null ? void 0 : o.afterCreate,
           (f == null ? void 0 : f.afterCreate) ?? (i == null ? void 0 : i.afterCreate)
         ], w = [];
         for (const y of h)
           if (y)
             try {
-              await y(g, p);
-            } catch (T) {
-              w.push(T instanceof Error ? T : new Error(String(T)));
+              await y(m, g);
+            } catch (_) {
+              w.push(_ instanceof Error ? _ : new Error(String(_)));
             }
         if (w.length === 1) throw w[0];
         if (w.length > 1)
@@ -429,7 +429,7 @@ function fe(t) {
     }
   };
 }
-var C = class extends Error {
+var P = class extends Error {
   /**
    * Creates an instance of `HTTPException`.
    * @param status - HTTP status code for the exception. Defaults to 500.
@@ -437,8 +437,8 @@ var C = class extends Error {
    */
   constructor(e = 500, n) {
     super(n == null ? void 0 : n.message, { cause: n == null ? void 0 : n.cause });
-    R(this, "res");
-    R(this, "status");
+    F(this, "res");
+    F(this, "status");
     this.res = n == null ? void 0 : n.res, this.status = e;
   }
   /**
@@ -455,7 +455,7 @@ var C = class extends Error {
     });
   }
 };
-function D(t, e) {
+function E(t, e) {
   const n = new re();
   return n.openapi(
     M({
@@ -475,7 +475,7 @@ function D(t, e) {
           content: {
             "application/json": {
               schema: S.object({
-                tenants: S.array(H),
+                tenants: S.array(G),
                 start: S.number().optional(),
                 limit: S.number().optional(),
                 length: S.number().optional()
@@ -487,72 +487,72 @@ function D(t, e) {
       }
     }),
     async (r) => {
-      var g, p, h, w, y, T;
-      const s = r.req.valid("query"), { page: c, per_page: o, include_totals: a, q: d } = s, u = r.var.user, i = (u == null ? void 0 : u.permissions) || [];
+      var m, g, h, w, y, _;
+      const a = r.req.valid("query"), { page: c, per_page: l, include_totals: s, q: p } = a, o = r.var.user, i = (o == null ? void 0 : o.permissions) || [];
       if (i.includes("auth:read") || i.includes("admin:organizations")) {
-        const b = await r.env.data.tenants.list({
+        const T = await r.env.data.tenants.list({
           page: c,
-          per_page: o,
-          include_totals: a,
-          q: d
+          per_page: l,
+          include_totals: s,
+          q: p
         });
-        return a ? r.json({
-          tenants: b.tenants,
-          start: ((g = b.totals) == null ? void 0 : g.start) ?? 0,
-          limit: ((p = b.totals) == null ? void 0 : p.limit) ?? o,
-          length: b.tenants.length
-        }) : r.json({ tenants: b.tenants });
+        return s ? r.json({
+          tenants: T.tenants,
+          start: ((m = T.totals) == null ? void 0 : m.start) ?? 0,
+          limit: ((g = T.totals) == null ? void 0 : g.limit) ?? l,
+          length: T.tenants.length
+        }) : r.json({ tenants: T.tenants });
       }
-      const l = ((h = t.accessControl) == null ? void 0 : h.controlPlaneTenantId) ?? ((w = r.env.data.multiTenancyConfig) == null ? void 0 : w.controlPlaneTenantId);
-      if (l && (u != null && u.sub)) {
-        const A = (await z(
-          ($) => r.env.data.userOrganizations.listUserOrganizations(
-            l,
-            u.sub,
-            $
+      const d = ((h = t.accessControl) == null ? void 0 : h.controlPlaneTenantId) ?? ((w = r.env.data.multiTenancyConfig) == null ? void 0 : w.controlPlaneTenantId);
+      if (d && (o != null && o.sub)) {
+        const A = (await O(
+          (z) => r.env.data.userOrganizations.listUserOrganizations(
+            d,
+            o.sub,
+            z
           ),
           "organizations"
-        )).map(($) => $.name);
+        )).map((z) => z.name);
         if (A.length === 0)
-          return a ? r.json({
+          return s ? r.json({
             tenants: [],
             start: 0,
-            limit: o ?? 50,
+            limit: l ?? 50,
             length: 0
           }) : r.json({ tenants: [] });
-        const _ = A.length, v = c ?? 0, P = o ?? 50, I = v * P, k = A.slice(I, I + P);
-        if (k.length === 0)
-          return a ? r.json({
+        const v = A.length, b = c ?? 0, C = l ?? 50, $ = b * C, I = A.slice($, $ + C);
+        if (I.length === 0)
+          return s ? r.json({
             tenants: [],
-            start: I,
-            limit: P,
-            length: _
+            start: $,
+            limit: C,
+            length: v
           }) : r.json({ tenants: [] });
-        const E = k.map(($) => `id:${$}`).join(" OR "), J = d ? `(${E}) AND (${d})` : E, N = await r.env.data.tenants.list({
+        const N = I.map((z) => `id:${z}`).join(" OR "), J = p ? `(${N}) AND (${p})` : N, H = await r.env.data.tenants.list({
           q: J,
-          per_page: P,
+          per_page: C,
           include_totals: !1
           // We calculate totals from accessibleTenantIds
         });
-        return a ? r.json({
-          tenants: N.tenants,
-          start: I,
-          limit: P,
-          length: _
-        }) : r.json({ tenants: N.tenants });
+        return s ? r.json({
+          tenants: H.tenants,
+          start: $,
+          limit: C,
+          length: v
+        }) : r.json({ tenants: H.tenants });
       }
-      const m = await r.env.data.tenants.list({
+      const u = await r.env.data.tenants.list({
         page: c,
-        per_page: o,
-        include_totals: a,
-        q: d
+        per_page: l,
+        include_totals: s,
+        q: p
       });
-      return a ? r.json({
-        tenants: m.tenants,
-        start: ((y = m.totals) == null ? void 0 : y.start) ?? 0,
-        limit: ((T = m.totals) == null ? void 0 : T.limit) ?? o,
-        length: m.tenants.length
-      }) : r.json({ tenants: m.tenants });
+      return s ? r.json({
+        tenants: u.tenants,
+        start: ((y = u.totals) == null ? void 0 : y.start) ?? 0,
+        limit: ((_ = u.totals) == null ? void 0 : _.limit) ?? l,
+        length: u.tenants.length
+      }) : r.json({ tenants: u.tenants });
     }
   ), n.openapi(
     M({
@@ -577,7 +577,7 @@ function D(t, e) {
         201: {
           content: {
             "application/json": {
-              schema: H
+              schema: G
             }
           },
           description: "Tenant created"
@@ -591,20 +591,20 @@ function D(t, e) {
       }
     }),
     async (r) => {
-      var d, u;
-      const s = r.var.user;
-      if (!(s != null && s.sub))
-        throw new C(401, {
+      var p, o;
+      const a = r.var.user;
+      if (!(a != null && a.sub))
+        throw new P(401, {
           message: "Authentication required to create tenants"
         });
       let c = r.req.valid("json");
-      const o = {
+      const l = {
         adapters: r.env.data,
         ctx: r
       };
-      (d = e.tenants) != null && d.beforeCreate && (c = await e.tenants.beforeCreate(o, c));
-      const a = await r.env.data.tenants.create(c);
-      return (u = e.tenants) != null && u.afterCreate && await e.tenants.afterCreate(o, a), r.json(a, 201);
+      (p = e.tenants) != null && p.beforeCreate && (c = await e.tenants.beforeCreate(l, c));
+      const s = await r.env.data.tenants.create(c);
+      return (o = e.tenants) != null && o.afterCreate && await e.tenants.afterCreate(l, s), r.json(s, 201);
     }
   ), n.openapi(
     M({
@@ -634,39 +634,39 @@ function D(t, e) {
       }
     }),
     async (r) => {
-      var d, u, i, f;
-      const { id: s } = r.req.valid("param"), c = ((d = t.accessControl) == null ? void 0 : d.controlPlaneTenantId) ?? ((u = r.env.data.multiTenancyConfig) == null ? void 0 : u.controlPlaneTenantId);
+      var p, o, i, f;
+      const { id: a } = r.req.valid("param"), c = ((p = t.accessControl) == null ? void 0 : p.controlPlaneTenantId) ?? ((o = r.env.data.multiTenancyConfig) == null ? void 0 : o.controlPlaneTenantId);
       if (c) {
-        const l = r.var.user;
-        if (!(l != null && l.sub))
-          throw new C(401, {
+        const d = r.var.user;
+        if (!(d != null && d.sub))
+          throw new P(401, {
             message: "Authentication required"
           });
-        if (s === c)
-          throw new C(403, {
+        if (a === c)
+          throw new P(403, {
             message: "Cannot delete the control plane"
           });
-        if (!(await z(
-          (p) => r.env.data.userOrganizations.listUserOrganizations(
+        if (!(await O(
+          (g) => r.env.data.userOrganizations.listUserOrganizations(
             c,
-            l.sub,
-            p
+            d.sub,
+            g
           ),
           "organizations"
-        )).some((p) => p.name === s))
-          throw new C(403, {
+        )).some((g) => g.name === a))
+          throw new P(403, {
             message: "Access denied to this tenant"
           });
       }
-      if (!await r.env.data.tenants.get(s))
-        throw new C(404, {
+      if (!await r.env.data.tenants.get(a))
+        throw new P(404, {
           message: "Tenant not found"
         });
-      const a = {
+      const s = {
         adapters: r.env.data,
         ctx: r
       };
-      return (i = e.tenants) != null && i.beforeDelete && await e.tenants.beforeDelete(a, s), await r.env.data.tenants.remove(s), (f = e.tenants) != null && f.afterDelete && await e.tenants.afterDelete(a, s), r.body(null, 204);
+      return (i = e.tenants) != null && i.beforeDelete && await e.tenants.beforeDelete(s, a), await r.env.data.tenants.remove(a), (f = e.tenants) != null && f.afterDelete && await e.tenants.afterDelete(s, a), r.body(null, 204);
     }
   ), n;
 }
@@ -680,13 +680,13 @@ function me(t) {
     { pattern: /\/api\/v2\/connections\/([^/]+)$/, type: "connection" }
   ];
   for (const { pattern: n, type: r } of e) {
-    const s = t.match(n);
-    if (s && s[1])
-      return { type: r, id: s[1] };
+    const a = t.match(n);
+    if (a && a[1])
+      return { type: r, id: a[1] };
   }
   return null;
 }
-async function ge(t, e, n) {
+async function pe(t, e, n) {
   try {
     switch (n.type) {
       case "resource_server": {
@@ -708,7 +708,7 @@ async function ge(t, e, n) {
     return !1;
   }
 }
-function pe(t) {
+function ge(t) {
   return {
     resource_server: "resource server",
     role: "role",
@@ -725,15 +725,31 @@ function we() {
     const r = t.var.tenant_id || t.req.header("x-tenant-id") || t.req.header("tenant-id");
     if (!r)
       return e();
-    if (await ge(t.env.data, r, n))
-      throw new C(403, {
-        message: `This ${pe(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
+    if (await pe(t.env.data, r, n))
+      throw new P(403, {
+        message: `This ${ge(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
       });
     return e();
   };
 }
-function Q(t, e) {
-  const { controlPlaneTenantId: n, controlPlaneClientId: r } = e;
+const ye = [
+  "client_secret",
+  "app_secret",
+  "twilio_token"
+];
+function q(t) {
+  if (!t) return t;
+  const e = { ...t };
+  for (const n of ye)
+    delete e[n];
+  return e;
+}
+function he(t, e) {
+  const {
+    controlPlaneTenantId: n,
+    controlPlaneClientId: r,
+    excludeSensitiveFields: a = !1
+  } = e;
   return {
     ...t,
     // Store config for use by tenants route access control
@@ -743,98 +759,98 @@ function Q(t, e) {
     },
     legacyClients: {
       ...t.legacyClients,
-      get: async (s) => {
-        var f;
-        const c = await t.legacyClients.get(s);
-        if (!c)
+      get: async (c) => {
+        var d;
+        const l = await t.legacyClients.get(c);
+        if (!l)
           return null;
-        const o = r ? await t.legacyClients.get(r) : void 0, a = await t.connections.list(
-          c.tenant.id
-        ), d = n ? await t.connections.list(n) : { connections: [] }, u = a.connections.map((l) => {
-          var p;
-          const m = (p = d.connections) == null ? void 0 : p.find(
-            (h) => h.strategy === l.strategy
+        const s = r ? await t.legacyClients.get(r) : void 0, p = await t.connections.list(
+          l.tenant.id
+        ), o = n ? await t.connections.list(n) : { connections: [] }, i = p.connections.map((u) => {
+          var w;
+          const m = (w = o.connections) == null ? void 0 : w.find(
+            (y) => y.strategy === u.strategy
           );
           if (!(m != null && m.options))
-            return l;
-          const g = F.parse({
+            return u;
+          const g = R.parse({
             ...m || {},
-            ...l
-          });
-          return g.options = O.parse({
-            ...m.options || {},
-            ...l.options
+            ...u
+          }), h = a ? q(m.options) : m.options;
+          return g.options = D.parse({
+            ...h || {},
+            ...u.options
           }), g;
-        }).filter((l) => l), i = {
-          ...(o == null ? void 0 : o.tenant) || {},
-          ...c.tenant
+        }).filter((u) => u), f = {
+          ...(s == null ? void 0 : s.tenant) || {},
+          ...l.tenant
         };
-        return !c.tenant.audience && ((f = o == null ? void 0 : o.tenant) != null && f.audience) && (i.audience = o.tenant.audience), {
-          ...c,
+        return !l.tenant.audience && ((d = s == null ? void 0 : s.tenant) != null && d.audience) && (f.audience = s.tenant.audience), {
+          ...l,
           web_origins: [
-            ...(o == null ? void 0 : o.web_origins) || [],
-            ...c.web_origins || []
+            ...(s == null ? void 0 : s.web_origins) || [],
+            ...l.web_origins || []
           ],
           allowed_logout_urls: [
-            ...(o == null ? void 0 : o.allowed_logout_urls) || [],
-            ...c.allowed_logout_urls || []
+            ...(s == null ? void 0 : s.allowed_logout_urls) || [],
+            ...l.allowed_logout_urls || []
           ],
           callbacks: [
-            ...(o == null ? void 0 : o.callbacks) || [],
-            ...c.callbacks || []
+            ...(s == null ? void 0 : s.callbacks) || [],
+            ...l.callbacks || []
           ],
-          connections: u,
-          tenant: i
+          connections: i,
+          tenant: f
         };
       }
     },
     connections: {
       ...t.connections,
-      get: async (s, c) => {
-        var i;
-        const o = await t.connections.get(
-          s,
-          c
+      get: async (c, l) => {
+        var d;
+        const s = await t.connections.get(
+          c,
+          l
         );
-        if (!o || !n || s === n)
-          return o;
-        const d = (i = (await t.connections.list(n)).connections) == null ? void 0 : i.find(
-          (f) => f.strategy === o.strategy
+        if (!s || !n || c === n)
+          return s;
+        const o = (d = (await t.connections.list(n)).connections) == null ? void 0 : d.find(
+          (u) => u.strategy === s.strategy
         );
-        if (!(d != null && d.options))
-          return o;
-        const u = F.parse({
-          ...d,
-          ...o
-        });
-        return u.options = O.parse({
-          ...d.options || {},
-          ...o.options
-        }), u;
+        if (!(o != null && o.options))
+          return s;
+        const i = R.parse({
+          ...o,
+          ...s
+        }), f = a ? q(o.options) : o.options;
+        return i.options = D.parse({
+          ...f || {},
+          ...s.options
+        }), i;
       },
-      list: async (s, c) => {
-        const o = await t.connections.list(s, c);
-        if (!n || s === n)
-          return o;
-        const a = await t.connections.list(n), d = o.connections.map((u) => {
-          var l;
-          const i = (l = a.connections) == null ? void 0 : l.find(
-            (m) => m.strategy === u.strategy
+      list: async (c, l) => {
+        const s = await t.connections.list(c, l);
+        if (!n || c === n)
+          return s;
+        const p = await t.connections.list(n), o = s.connections.map((i) => {
+          var m;
+          const f = (m = p.connections) == null ? void 0 : m.find(
+            (g) => g.strategy === i.strategy
           );
-          if (!(i != null && i.options))
-            return u;
-          const f = F.parse({
-            ...i,
-            ...u
-          });
-          return f.options = O.parse({
-            ...i.options || {},
-            ...u.options
-          }), f;
+          if (!(f != null && f.options))
+            return i;
+          const d = R.parse({
+            ...f,
+            ...i
+          }), u = a ? q(f.options) : f.options;
+          return d.options = D.parse({
+            ...u || {},
+            ...i.options
+          }), d;
         });
         return {
-          ...o,
-          connections: d
+          ...s,
+          connections: o
         };
       }
     }
@@ -847,174 +863,185 @@ function Q(t, e) {
     // They remain part of ...baseAdapters and can be properly wrapped by caching.
   };
 }
-function q(t, e) {
-  return Q(t, e);
+function j(t, e) {
+  return he(t, e);
 }
-const Pe = Q, Se = q;
-function ye(t) {
+function ve(t) {
   return async (e, n) => {
     const r = e.var.user;
     return (r == null ? void 0 : r.tenant_id) === t && r.org_name && e.set("tenant_id", r.org_name), n();
   };
 }
-function he(t) {
+function _e(t) {
   return async (e, n) => {
     if (!t.accessControl)
       return n();
-    const { controlPlaneTenantId: r } = t.accessControl, s = e.var.org_name, c = e.var.organization_id, o = s || c;
-    let a = e.var.tenant_id;
-    const d = e.var.user, i = (d != null && d.aud ? Array.isArray(d.aud) ? d.aud : [d.aud] : []).includes(W);
-    if (!a && o && i && (e.set("tenant_id", o), a = o), !a)
-      throw new C(400, {
+    const { controlPlaneTenantId: r } = t.accessControl, a = e.var.org_name, c = e.var.organization_id, l = a || c;
+    let s = e.var.tenant_id;
+    const p = e.var.user, i = (p != null && p.aud ? Array.isArray(p.aud) ? p.aud : [p.aud] : []).includes(W);
+    if (!s && l && i && (e.set("tenant_id", l), s = l), !s)
+      throw new P(400, {
         message: "Tenant ID not found in request"
       });
     if (!ae(
       c,
-      a,
+      s,
       r,
-      s
+      a
     ))
-      throw new C(403, {
-        message: `Access denied to tenant ${a}`
+      throw new P(403, {
+        message: `Access denied to tenant ${s}`
       });
     return n();
   };
 }
-function ve(t) {
+function Te(t) {
   return async (e, n) => {
     if (!t.subdomainRouting)
       return n();
     const {
       baseDomain: r,
-      reservedSubdomains: s = [],
+      reservedSubdomains: a = [],
       resolveSubdomain: c
-    } = t.subdomainRouting, o = e.req.header("host") || "";
-    let a = null;
-    if (o.endsWith(r)) {
-      const u = o.slice(0, -(r.length + 1));
-      u && !u.includes(".") && (a = u);
+    } = t.subdomainRouting, l = e.req.header("host") || "";
+    let s = null;
+    if (l.endsWith(r)) {
+      const o = l.slice(0, -(r.length + 1));
+      o && !o.includes(".") && (s = o);
     }
-    if (a && s.includes(a) && (a = null), !a)
+    if (s && a.includes(s) && (s = null), !s)
       return t.accessControl && e.set("tenant_id", t.accessControl.controlPlaneTenantId), n();
-    let d = null;
+    let p = null;
     if (c)
-      d = await c(a);
+      p = await c(s);
     else if (t.subdomainRouting.useOrganizations !== !1 && t.accessControl)
       try {
-        const u = await e.env.data.organizations.get(
+        const o = await e.env.data.organizations.get(
           t.accessControl.controlPlaneTenantId,
-          a
+          s
         );
-        u && (d = u.id);
+        o && (p = o.id);
       } catch {
       }
-    if (!d)
-      throw new C(404, {
-        message: `Tenant not found for subdomain: ${a}`
+    if (!p)
+      throw new P(404, {
+        message: `Tenant not found for subdomain: ${s}`
       });
-    return e.set("tenant_id", d), n();
+    return e.set("tenant_id", p), n();
   };
 }
-function Te(t) {
+function Ae(t) {
   return async (e, n) => {
     if (!t.databaseIsolation)
       return n();
     const r = e.var.tenant_id;
     if (!r)
-      throw new C(400, {
+      throw new P(400, {
         message: "Tenant ID not found in request"
       });
     try {
-      const s = await t.databaseIsolation.getAdapters(r);
-      e.env.data = s;
-    } catch (s) {
+      const a = await t.databaseIsolation.getAdapters(r);
+      e.env.data = a;
+    } catch (a) {
       throw console.error(
         `Failed to resolve database for tenant ${r}:`,
-        s
-      ), new C(500, {
+        a
+      ), new P(500, {
         message: "Failed to resolve tenant database"
       });
     }
     return n();
   };
 }
-function V(t) {
-  const e = ve(t), n = he(t), r = Te(t);
-  return async (s, c) => (await e(s, async () => {
-  }), await n(s, async () => {
-  }), await r(s, async () => {
+function Q(t) {
+  const e = Te(t), n = _e(t), r = Ae(t);
+  return async (a, c) => (await e(a, async () => {
+  }), await n(a, async () => {
+  }), await r(a, async () => {
   }), c());
 }
 function $e(t) {
   const {
     dataAdapter: e,
     controlPlane: n,
-    sync: r = { resourceServers: !0, roles: !0 },
-    defaultPermissions: s = ["tenant:admin"],
-    requireOrganizationMatch: c = !1,
-    managementApiExtensions: o = [],
-    entityHooks: a,
-    getChildTenantIds: d,
-    getAdapters: u,
-    ...i
-  } = t, f = (n == null ? void 0 : n.tenantId) ?? "control_plane", l = n == null ? void 0 : n.clientId, m = n ? q(e, {
-    controlPlaneTenantId: f,
-    controlPlaneClientId: l
-  }) : e, g = r !== !1, p = g ? {
-    resourceServers: r.resourceServers ?? !0,
-    roles: r.roles ?? !0
-  } : { resourceServers: !1, roles: !1 }, y = {
-    controlPlaneTenantId: f,
-    getChildTenantIds: d ?? (async () => (await z(
-      (I) => m.tenants.list(I),
+    controlPlane: {
+      tenantId: r = "control_plane",
+      clientId: a
+    } = {},
+    sync: c = { resourceServers: !0, roles: !0 },
+    defaultPermissions: l = ["tenant:admin"],
+    requireOrganizationMatch: s = !1,
+    managementApiExtensions: p = [],
+    entityHooks: o,
+    getChildTenantIds: i,
+    getAdapters: f,
+    ...d
+  } = t;
+  let u = e, m = e;
+  n && (u = j(e, {
+    controlPlaneTenantId: r,
+    controlPlaneClientId: a
+  }), m = j(e, {
+    controlPlaneTenantId: r,
+    controlPlaneClientId: a,
+    excludeSensitiveFields: !0
+  }));
+  const g = c !== !1, h = g ? {
+    resourceServers: c.resourceServers ?? !0,
+    roles: c.roles ?? !0
+  } : { resourceServers: !1, roles: !1 }, _ = {
+    controlPlaneTenantId: r,
+    getChildTenantIds: i ?? (async () => (await O(
+      (I) => u.tenants.list(I),
       "tenants",
       { cursorField: "id", pageSize: 100 }
-    )).filter((I) => I.id !== f).map((I) => I.id)),
-    getAdapters: u ?? (async () => m),
-    getControlPlaneAdapters: async () => m,
-    sync: p
-  }, { entityHooks: T, tenantHooks: b } = fe(y), A = {
+    )).filter((I) => I.id !== r).map((I) => I.id)),
+    getAdapters: f ?? (async () => u),
+    getControlPlaneAdapters: async () => u,
+    sync: h
+  }, { entityHooks: T, tenantHooks: A } = fe(_), v = {
     resourceServers: [
       T.resourceServers,
-      ...(a == null ? void 0 : a.resourceServers) ?? []
+      ...(o == null ? void 0 : o.resourceServers) ?? []
     ],
-    roles: [T.roles, ...(a == null ? void 0 : a.roles) ?? []],
-    connections: (a == null ? void 0 : a.connections) ?? [],
-    tenants: (a == null ? void 0 : a.tenants) ?? [],
-    rolePermissions: (a == null ? void 0 : a.rolePermissions) ?? []
-  }, _ = D(
+    roles: [T.roles, ...(o == null ? void 0 : o.roles) ?? []],
+    connections: (o == null ? void 0 : o.connections) ?? [],
+    tenants: (o == null ? void 0 : o.tenants) ?? [],
+    rolePermissions: (o == null ? void 0 : o.rolePermissions) ?? []
+  }, b = E(
     {
       accessControl: {
-        controlPlaneTenantId: f,
-        requireOrganizationMatch: c,
-        defaultPermissions: s
+        controlPlaneTenantId: r,
+        requireOrganizationMatch: s,
+        defaultPermissions: l
       }
     },
-    { tenants: b }
-  ), { app: v } = ne({
-    dataAdapter: m,
-    ...i,
-    entityHooks: A,
+    { tenants: A }
+  ), { app: C } = ne({
+    dataAdapter: u,
+    managementDataAdapter: m,
+    ...d,
+    entityHooks: v,
     managementApiExtensions: [
-      ...o,
-      { path: "/tenants", router: _ }
+      ...p,
+      { path: "/tenants", router: b }
     ]
   });
-  return v.use("/api/v2/*", ye(f)), g && v.use("/api/v2/*", we()), { app: v, controlPlaneTenantId: f };
+  return C.use("/api/v2/*", ve(r)), g && C.use("/api/v2/*", we()), { app: C, controlPlaneTenantId: r };
 }
 function ze(t) {
-  const e = j(t);
+  const e = k(t);
   return {
     name: "multi-tenancy",
     // Apply multi-tenancy middleware for subdomain routing, database resolution, etc.
-    middleware: V(t),
+    middleware: Q(t),
     // Provide lifecycle hooks
     hooks: e,
     // Mount tenant management routes
     routes: [
       {
         path: "/management",
-        handler: D(t, e)
+        handler: E(t, e)
       }
     ],
     // Called when plugin is registered
@@ -1027,7 +1054,7 @@ function ze(t) {
     }
   };
 }
-function j(t) {
+function k(t) {
   const e = t.accessControl ? se(t.accessControl) : {}, n = t.databaseIsolation ? oe(t.databaseIsolation) : {}, r = ce(t);
   return {
     ...e,
@@ -1035,15 +1062,15 @@ function j(t) {
     tenants: r
   };
 }
-function _e(t) {
-  const e = new Z(), n = j(t);
-  return e.route("/tenants", D(t, n)), e;
+function be(t) {
+  const e = new Z(), n = k(t);
+  return e.route("/tenants", E(t, n)), e;
 }
-function Re(t) {
+function Oe(t) {
   return {
-    hooks: j(t),
-    middleware: V(t),
-    app: _e(t),
+    hooks: k(t),
+    middleware: Q(t),
+    app: be(t),
     config: t,
     /**
      * Wraps data adapters with runtime fallback from the control plane.
@@ -1055,7 +1082,7 @@ function Re(t) {
      */
     wrapAdapters: (e, n) => {
       var r;
-      return q(e, {
+      return j(e, {
         controlPlaneTenantId: (r = t.accessControl) == null ? void 0 : r.controlPlaneTenantId,
         controlPlaneClientId: n == null ? void 0 : n.controlPlaneClientId
       });
@@ -1064,24 +1091,22 @@ function Re(t) {
 }
 export {
   se as createAccessControlHooks,
-  he as createAccessControlMiddleware,
-  ye as createControlPlaneTenantMiddleware,
+  _e as createAccessControlMiddleware,
+  ve as createControlPlaneTenantMiddleware,
   oe as createDatabaseHooks,
-  Te as createDatabaseMiddleware,
-  _e as createMultiTenancy,
-  j as createMultiTenancyHooks,
-  V as createMultiTenancyMiddleware,
+  Ae as createDatabaseMiddleware,
+  be as createMultiTenancy,
+  k as createMultiTenancyHooks,
+  Q as createMultiTenancyMiddleware,
   ze as createMultiTenancyPlugin,
   we as createProtectSyncedMiddleware,
   ce as createProvisioningHooks,
-  Q as createRuntimeFallbackAdapter,
-  Pe as createSettingsInheritanceAdapter,
-  ve as createSubdomainMiddleware,
+  he as createRuntimeFallbackAdapter,
+  Te as createSubdomainMiddleware,
   fe as createSyncHooks,
-  D as createTenantsOpenAPIRouter,
+  E as createTenantsOpenAPIRouter,
   $e as initMultiTenant,
-  Re as setupMultiTenancy,
+  Oe as setupMultiTenancy,
   ae as validateTenantAccess,
-  q as withRuntimeFallback,
-  Se as withSettingsInheritance
+  j as withRuntimeFallback
 };