@authhero/multi-tenancy 14.5.0 → 14.7.0

package/dist/multi-tenancy.mjs

@@ -1,28 +1,28 @@
 var X = Object.defineProperty;
 var Y = (t, e, n) => e in t ? X(t, e, { enumerable: !0, configurable: !0, writable: !0, value: n }) : t[e] = n;
-var R = (t, e, n) => Y(t, typeof e != "symbol" ? e + "" : e, n);
+var O = (t, e, n) => Y(t, typeof e != "symbol" ? e + "" : e, n);
 import { Hono as Z } from "hono";
-import { MANAGEMENT_API_SCOPES as x, MANAGEMENT_API_AUDIENCE as W, fetchAll as z, auth0QuerySchema as ee, tenantSchema as H, tenantInsertSchema as te, connectionSchema as F, connectionOptionsSchema as O, init as ne } from "authhero";
-import { OpenAPIHono as re, createRoute as M, z as S } from "@hono/zod-openapi";
-function se(t) {
+import { MANAGEMENT_API_SCOPES as x, MANAGEMENT_API_AUDIENCE as W, fetchAll as F, auth0QuerySchema as ee, tenantSchema as N, tenantInsertSchema as te, connectionSchema as k, connectionOptionsSchema as H, init as ne } from "authhero";
+import { OpenAPIHono as re, createRoute as R, z as S } from "@hono/zod-openapi";
+function ae(t) {
   const { controlPlaneTenantId: e, requireOrganizationMatch: n = !0 } = t;
   return {
-    async onTenantAccessValidation(r, s) {
-      if (s === e)
+    async onTenantAccessValidation(r, a) {
+      if (a === e)
         return !0;
       if (n) {
-        const c = r.var.org_name, o = r.var.organization_id, a = c || o;
-        return a ? a.toLowerCase() === s.toLowerCase() : !1;
+        const c = r.var.org_name, d = r.var.organization_id, s = c || d;
+        return s ? s.toLowerCase() === a.toLowerCase() : !1;
       }
       return !0;
     }
   };
 }
-function ae(t, e, n, r) {
+function se(t, e, n, r) {
   if (e === n)
     return !0;
-  const s = r || t;
-  return s ? s.toLowerCase() === e.toLowerCase() : !1;
+  const a = r || t;
+  return a ? a.toLowerCase() === e.toLowerCase() : !1;
 }
 function oe(t) {
   return {
@@ -51,19 +51,19 @@ function ce(t) {
       } : n;
     },
     async afterCreate(e, n) {
-      const { accessControl: r, databaseIsolation: s } = t;
-      r && e.ctx && await le(e, n, r), s != null && s.onProvision && await s.onProvision(n.id);
+      const { accessControl: r, databaseIsolation: a } = t;
+      r && e.ctx && await le(e, n, r), a != null && a.onProvision && await a.onProvision(n.id);
     },
     async beforeDelete(e, n) {
-      const { accessControl: r, databaseIsolation: s } = t;
+      const { accessControl: r, databaseIsolation: a } = t;
       if (r)
         try {
-          const o = (await e.adapters.organizations.list(
+          const d = (await e.adapters.organizations.list(
             r.controlPlaneTenantId
-          )).organizations.find((a) => a.name === n);
-          o && await e.adapters.organizations.remove(
+          )).organizations.find((s) => s.name === n);
+          d && await e.adapters.organizations.remove(
             r.controlPlaneTenantId,
-            o.id
+            d.id
           );
         } catch (c) {
           console.warn(
@@ -71,9 +71,9 @@ function ce(t) {
             c
           );
         }
-      if (s != null && s.onDeprovision)
+      if (a != null && a.onDeprovision)
         try {
-          await s.onDeprovision(n);
+          await a.onDeprovision(n);
         } catch (c) {
           console.warn(
             `Failed to deprovision database for tenant ${n}:`,
@@ -86,12 +86,12 @@ function ce(t) {
 async function le(t, e, n) {
   const {
     controlPlaneTenantId: r,
-    defaultPermissions: s,
+    defaultPermissions: a,
     defaultRoles: c,
-    issuer: o,
-    adminRoleName: a = "Tenant Admin",
-    adminRoleDescription: d = "Full access to all tenant management operations",
-    addCreatorToOrganization: u = !0
+    issuer: d,
+    adminRoleName: s = "Tenant Admin",
+    adminRoleDescription: f = "Full access to all tenant management operations",
+    addCreatorToOrganization: o = !0
   } = n, i = await t.adapters.organizations.create(
     r,
     {
@@ -99,13 +99,13 @@ async function le(t, e, n) {
       display_name: e.friendly_name || e.id
     }
   );
-  let f;
-  if (o && (f = await ue(
+  let u;
+  if (d && (u = await ue(
     t,
     r,
-    a,
-    d
-  )), u && t.ctx) {
+    s,
+    f
+  )), o && t.ctx) {
     const l = t.ctx.var.user;
     if (l != null && l.sub && !await de(
       t,
@@ -116,24 +116,24 @@ async function le(t, e, n) {
         await t.adapters.userOrganizations.create(r, {
           user_id: l.sub,
           organization_id: i.id
-        }), f && await t.adapters.userRoles.create(
+        }), u && await t.adapters.userRoles.create(
           r,
           l.sub,
-          f,
+          u,
           i.id
           // organizationId
         );
-      } catch (g) {
+      } catch (p) {
         console.warn(
           `Failed to add creator ${l.sub} to organization ${i.id}:`,
-          g
+          p
         );
       }
   }
   c && c.length > 0 && console.log(
     `Would assign roles ${c.join(", ")} to organization ${i.id}`
-  ), s && s.length > 0 && console.log(
-    `Would grant permissions ${s.join(", ")} to organization ${i.id}`
+  ), a && a.length > 0 && console.log(
+    `Would grant permissions ${a.join(", ")} to organization ${i.id}`
   );
 }
 async function de(t, e, n) {
@@ -144,73 +144,73 @@ async function de(t, e, n) {
     ""
     // Empty string for global roles
   );
-  for (const s of r)
+  for (const a of r)
     if ((await t.adapters.rolePermissions.list(
       e,
-      s.id,
+      a.id,
       { per_page: 1e3 }
     )).some(
-      (a) => a.permission_name === "admin:organizations"
+      (s) => s.permission_name === "admin:organizations"
     ))
       return !0;
   return !1;
 }
 async function ue(t, e, n, r) {
-  const c = (await t.adapters.roles.list(e, {})).roles.find((u) => u.name === n);
+  const c = (await t.adapters.roles.list(e, {})).roles.find((o) => o.name === n);
   if (c)
     return c.id;
-  const o = await t.adapters.roles.create(e, {
+  const d = await t.adapters.roles.create(e, {
     name: n,
     description: r
-  }), a = W, d = x.map((u) => ({
-    role_id: o.id,
-    resource_server_identifier: a,
-    permission_name: u.value
+  }), s = W, f = x.map((o) => ({
+    role_id: d.id,
+    resource_server_identifier: s,
+    permission_name: o.value
   }));
   return await t.adapters.rolePermissions.assign(
     e,
-    o.id,
-    d
-  ), o.id;
+    d.id,
+    f
+  ), d.id;
 }
 function G(t, e, n = () => !0) {
-  const { controlPlaneTenantId: r, getChildTenantIds: s, getAdapters: c } = t, o = /* @__PURE__ */ new Map();
-  async function a(i, f, l) {
-    return (await e(i).list(f, {
+  const { controlPlaneTenantId: r, getChildTenantIds: a, getAdapters: c } = t, d = /* @__PURE__ */ new Map();
+  async function s(i, u, l) {
+    return (await e(i).list(u, {
       q: `name:${l}`,
       per_page: 1
     }))[0] ?? null;
   }
-  async function d(i) {
-    const f = await s(), l = e(await c(r));
+  async function f(i) {
+    const u = await a(), l = e(await c(r));
     await Promise.all(
-      f.map(async (m) => {
+      u.map(async (m) => {
         try {
-          const g = await c(m), p = e(g), w = {
+          const p = await c(m), g = e(p), w = {
             ...l.transform(i),
             is_system: !0
-          }, y = await a(g, m, i.name), T = y ? p.getId(y) : void 0;
+          }, y = await s(p, m, i.name), T = y ? g.getId(y) : void 0;
           if (y && T) {
-            const b = p.preserveOnUpdate ? p.preserveOnUpdate(y, w) : w;
-            await p.update(m, T, b);
+            const A = g.preserveOnUpdate ? g.preserveOnUpdate(y, w) : w;
+            await g.update(m, T, A);
           } else
-            await p.create(m, w);
-        } catch (g) {
+            await g.create(m, w);
+        } catch (p) {
           console.error(
             `Failed to sync ${l.listKey} "${i.name}" to tenant "${m}":`,
-            g
+            p
           );
         }
       })
     );
   }
-  async function u(i) {
-    const f = await s();
+  async function o(i) {
+    const u = await a();
     await Promise.all(
-      f.map(async (l) => {
+      u.map(async (l) => {
         try {
-          const m = await c(l), g = e(m), p = await a(m, l, i), h = p ? g.getId(p) : void 0;
-          p && h && await g.remove(l, h);
+          const m = await c(l), p = e(m), g = await s(m, l, i), h = g ? p.getId(g) : void 0;
+          g && h && await p.remove(l, h);
         } catch (m) {
           console.error(
             `Failed to delete entity "${i}" from tenant "${l}":`,
@@ -221,31 +221,31 @@ function G(t, e, n = () => !0) {
     );
   }
   return {
-    afterCreate: async (i, f) => {
-      i.tenantId === r && n(f) && await d(f);
+    afterCreate: async (i, u) => {
+      i.tenantId === r && n(u) && await f(u);
     },
-    afterUpdate: async (i, f, l) => {
-      i.tenantId === r && n(l) && await d(l);
+    afterUpdate: async (i, u, l) => {
+      i.tenantId === r && n(l) && await f(l);
     },
-    beforeDelete: async (i, f) => {
+    beforeDelete: async (i, u) => {
       if (i.tenantId !== r) return;
-      const m = await e(i.adapters).get(i.tenantId, f);
-      m && n(m) && o.set(f, m);
+      const m = await e(i.adapters).get(i.tenantId, u);
+      m && n(m) && d.set(u, m);
     },
-    afterDelete: async (i, f) => {
+    afterDelete: async (i, u) => {
       if (i.tenantId !== r) return;
-      const l = o.get(f);
-      l && (o.delete(f), await u(l.name));
+      const l = d.get(u);
+      l && (d.delete(u), await o(l.name));
     }
   };
 }
 function L(t, e, n = () => !0) {
-  const { controlPlaneTenantId: r, getControlPlaneAdapters: s, getAdapters: c } = t;
+  const { controlPlaneTenantId: r, getControlPlaneAdapters: a, getAdapters: c } = t;
   return {
-    async afterCreate(o, a) {
-      if (a.id !== r)
+    async afterCreate(d, s) {
+      if (s.id !== r)
         try {
-          const d = await s(), u = await c(a.id), i = e(d), f = e(u), l = await z(
+          const f = await a(), o = await c(s.id), i = e(f), u = e(o), l = await F(
             (m) => i.listPaginated(r, m),
             i.listKey,
             { cursorField: "id", pageSize: 100 }
@@ -253,23 +253,23 @@ function L(t, e, n = () => !0) {
           await Promise.all(
             l.filter((m) => n(m)).map(async (m) => {
               try {
-                const g = i.transform(m);
-                await f.create(a.id, {
-                  ...g,
+                const p = i.transform(m);
+                await u.create(s.id, {
+                  ...p,
                   is_system: !0
                 });
-              } catch (g) {
+              } catch (p) {
                 console.error(
-                  `Failed to sync entity to new tenant "${a.id}":`,
-                  g
+                  `Failed to sync entity to new tenant "${s.id}":`,
+                  p
                 );
               }
             })
           );
-        } catch (d) {
+        } catch (f) {
           console.error(
-            `Failed to sync entities to new tenant "${a.id}":`,
-            d
+            `Failed to sync entities to new tenant "${s.id}":`,
+            f
           );
         }
     }
@@ -313,109 +313,109 @@ function K(t) {
   return ((e = t.metadata) == null ? void 0 : e.sync) !== !1;
 }
 function fe(t) {
-  const { sync: e = {}, filters: n = {} } = t, r = e.resourceServers ?? !0, s = e.roles ?? !0, c = (g) => K(g) ? n.resourceServers ? n.resourceServers(g) : !0 : !1, o = (g) => K(g) ? n.roles ? n.roles(g) : !0 : !1, a = r ? G(
+  const { sync: e = {}, filters: n = {} } = t, r = e.resourceServers ?? !0, a = e.roles ?? !0, c = (p) => K(p) ? n.resourceServers ? n.resourceServers(p) : !0 : !1, d = (p) => K(p) ? n.roles ? n.roles(p) : !0 : !1, s = r ? G(
     t,
     U,
     c
-  ) : void 0, d = s ? G(
+  ) : void 0, f = a ? G(
     t,
     B,
-    o
-  ) : void 0, u = r ? L(
+    d
+  ) : void 0, o = r ? L(
     t,
     U,
     c
-  ) : void 0, i = s ? L(
+  ) : void 0, i = a ? L(
     t,
     B,
-    o
-  ) : void 0, f = s ? {
-    async afterCreate(g, p) {
+    d
+  ) : void 0, u = a ? {
+    async afterCreate(p, g) {
       var h;
-      if (p.id !== t.controlPlaneTenantId) {
-        await ((h = i == null ? void 0 : i.afterCreate) == null ? void 0 : h.call(i, g, p));
+      if (g.id !== t.controlPlaneTenantId) {
+        await ((h = i == null ? void 0 : i.afterCreate) == null ? void 0 : h.call(i, p, g));
         try {
-          const w = await t.getControlPlaneAdapters(), y = await t.getAdapters(p.id), T = await z(
-            (A) => w.roles.list(
+          const w = await t.getControlPlaneAdapters(), y = await t.getAdapters(g.id), T = await F(
+            (_) => w.roles.list(
               t.controlPlaneTenantId,
-              A
+              _
             ),
             "roles",
             { cursorField: "id", pageSize: 100 }
-          ), b = /* @__PURE__ */ new Map();
-          for (const A of T.filter(
-            (_) => {
-              var v;
-              return ((v = n.roles) == null ? void 0 : v.call(n, _)) ?? !0;
+          ), A = /* @__PURE__ */ new Map();
+          for (const _ of T.filter(
+            (v) => {
+              var P;
+              return ((P = n.roles) == null ? void 0 : P.call(n, v)) ?? !0;
             }
           )) {
-            const _ = await l(
+            const v = await l(
               y,
-              p.id,
-              A.name
+              g.id,
+              _.name
             );
-            _ && b.set(A.name, _.id);
+            v && A.set(_.name, v.id);
           }
-          for (const A of T.filter(
-            (_) => {
-              var v;
-              return ((v = n.roles) == null ? void 0 : v.call(n, _)) ?? !0;
+          for (const _ of T.filter(
+            (v) => {
+              var P;
+              return ((P = n.roles) == null ? void 0 : P.call(n, v)) ?? !0;
             }
           )) {
-            const _ = b.get(A.name);
-            if (_)
+            const v = A.get(_.name);
+            if (v)
               try {
-                const v = await w.rolePermissions.list(
+                const P = await w.rolePermissions.list(
                   t.controlPlaneTenantId,
-                  A.id,
+                  _.id,
                   {}
                 );
-                v.length > 0 && await y.rolePermissions.assign(
-                  p.id,
-                  _,
-                  v.map((P) => ({
-                    role_id: _,
-                    resource_server_identifier: P.resource_server_identifier,
-                    permission_name: P.permission_name
+                P.length > 0 && await y.rolePermissions.assign(
+                  g.id,
+                  v,
+                  P.map((C) => ({
+                    role_id: v,
+                    resource_server_identifier: C.resource_server_identifier,
+                    permission_name: C.permission_name
                   }))
                 );
-              } catch (v) {
+              } catch (P) {
                 console.error(
-                  `Failed to sync permissions for role "${A.name}" to tenant "${p.id}":`,
-                  v
+                  `Failed to sync permissions for role "${_.name}" to tenant "${g.id}":`,
+                  P
                 );
               }
           }
         } catch (w) {
           console.error(
-            `Failed to sync role permissions to tenant "${p.id}":`,
+            `Failed to sync role permissions to tenant "${g.id}":`,
             w
           );
         }
       }
     }
   } : void 0;
-  async function l(g, p, h) {
-    return (await g.roles.list(p, {
+  async function l(p, g, h) {
+    return (await p.roles.list(g, {
       q: `name:${h}`,
       per_page: 1
     })).roles[0] ?? null;
   }
   return {
     entityHooks: {
-      resourceServers: a,
-      roles: d
+      resourceServers: s,
+      roles: f
     },
     tenantHooks: {
-      async afterCreate(g, p) {
+      async afterCreate(p, g) {
         const h = [
-          u == null ? void 0 : u.afterCreate,
-          (f == null ? void 0 : f.afterCreate) ?? (i == null ? void 0 : i.afterCreate)
+          o == null ? void 0 : o.afterCreate,
+          (u == null ? void 0 : u.afterCreate) ?? (i == null ? void 0 : i.afterCreate)
         ], w = [];
         for (const y of h)
           if (y)
             try {
-              await y(g, p);
+              await y(p, g);
             } catch (T) {
               w.push(T instanceof Error ? T : new Error(String(T)));
             }
@@ -429,7 +429,7 @@ function fe(t) {
     }
   };
 }
-var C = class extends Error {
+var b = class extends Error {
   /**
    * Creates an instance of `HTTPException`.
    * @param status - HTTP status code for the exception. Defaults to 500.
@@ -437,8 +437,8 @@ var C = class extends Error {
    */
   constructor(e = 500, n) {
     super(n == null ? void 0 : n.message, { cause: n == null ? void 0 : n.cause });
-    R(this, "res");
-    R(this, "status");
+    O(this, "res");
+    O(this, "status");
     this.res = n == null ? void 0 : n.res, this.status = e;
   }
   /**
@@ -455,10 +455,10 @@ var C = class extends Error {
     });
   }
 };
-function D(t, e) {
+function M(t, e) {
   const n = new re();
   return n.openapi(
-    M({
+    R({
       tags: ["tenants"],
       method: "get",
       path: "/",
@@ -475,7 +475,7 @@ function D(t, e) {
           content: {
             "application/json": {
               schema: S.object({
-                tenants: S.array(H),
+                tenants: S.array(N),
                 start: S.number().optional(),
                 limit: S.number().optional(),
                 length: S.number().optional()
@@ -487,75 +487,75 @@ function D(t, e) {
       }
     }),
     async (r) => {
-      var g, p, h, w, y, T;
-      const s = r.req.valid("query"), { page: c, per_page: o, include_totals: a, q: d } = s, u = r.var.user, i = (u == null ? void 0 : u.permissions) || [];
+      var p, g, h, w, y, T;
+      const a = r.req.valid("query"), { page: c, per_page: d, include_totals: s, q: f } = a, o = r.var.user, i = (o == null ? void 0 : o.permissions) || [];
       if (i.includes("auth:read") || i.includes("admin:organizations")) {
-        const b = await r.env.data.tenants.list({
+        const A = await r.env.data.tenants.list({
           page: c,
-          per_page: o,
-          include_totals: a,
-          q: d
+          per_page: d,
+          include_totals: s,
+          q: f
         });
-        return a ? r.json({
-          tenants: b.tenants,
-          start: ((g = b.totals) == null ? void 0 : g.start) ?? 0,
-          limit: ((p = b.totals) == null ? void 0 : p.limit) ?? o,
-          length: b.tenants.length
-        }) : r.json({ tenants: b.tenants });
+        return s ? r.json({
+          tenants: A.tenants,
+          start: ((p = A.totals) == null ? void 0 : p.start) ?? 0,
+          limit: ((g = A.totals) == null ? void 0 : g.limit) ?? d,
+          length: A.tenants.length
+        }) : r.json({ tenants: A.tenants });
       }
       const l = ((h = t.accessControl) == null ? void 0 : h.controlPlaneTenantId) ?? ((w = r.env.data.multiTenancyConfig) == null ? void 0 : w.controlPlaneTenantId);
-      if (l && (u != null && u.sub)) {
-        const A = (await z(
-          ($) => r.env.data.userOrganizations.listUserOrganizations(
+      if (l && (o != null && o.sub)) {
+        const _ = (await F(
+          (z) => r.env.data.userOrganizations.listUserOrganizations(
             l,
-            u.sub,
-            $
+            o.sub,
+            z
           ),
           "organizations"
-        )).map(($) => $.name);
-        if (A.length === 0)
-          return a ? r.json({
+        )).map((z) => z.name);
+        if (_.length === 0)
+          return s ? r.json({
             tenants: [],
             start: 0,
-            limit: o ?? 50,
+            limit: d ?? 50,
             length: 0
           }) : r.json({ tenants: [] });
-        const _ = A.length, v = c ?? 0, P = o ?? 50, I = v * P, k = A.slice(I, I + P);
-        if (k.length === 0)
-          return a ? r.json({
+        const v = _.length, P = c ?? 0, C = d ?? 50, $ = P * C, I = _.slice($, $ + C);
+        if (I.length === 0)
+          return s ? r.json({
             tenants: [],
-            start: I,
-            limit: P,
-            length: _
+            start: $,
+            limit: C,
+            length: v
           }) : r.json({ tenants: [] });
-        const E = k.map(($) => `id:${$}`).join(" OR "), J = d ? `(${E}) AND (${d})` : E, N = await r.env.data.tenants.list({
+        const j = I.map((z) => `id:${z}`).join(" OR "), J = f ? `(${j}) AND (${f})` : j, E = await r.env.data.tenants.list({
           q: J,
-          per_page: P,
+          per_page: C,
           include_totals: !1
           // We calculate totals from accessibleTenantIds
         });
-        return a ? r.json({
-          tenants: N.tenants,
-          start: I,
-          limit: P,
-          length: _
-        }) : r.json({ tenants: N.tenants });
+        return s ? r.json({
+          tenants: E.tenants,
+          start: $,
+          limit: C,
+          length: v
+        }) : r.json({ tenants: E.tenants });
       }
       const m = await r.env.data.tenants.list({
         page: c,
-        per_page: o,
-        include_totals: a,
-        q: d
+        per_page: d,
+        include_totals: s,
+        q: f
       });
-      return a ? r.json({
+      return s ? r.json({
         tenants: m.tenants,
         start: ((y = m.totals) == null ? void 0 : y.start) ?? 0,
-        limit: ((T = m.totals) == null ? void 0 : T.limit) ?? o,
+        limit: ((T = m.totals) == null ? void 0 : T.limit) ?? d,
         length: m.tenants.length
       }) : r.json({ tenants: m.tenants });
     }
   ), n.openapi(
-    M({
+    R({
       tags: ["tenants"],
       method: "post",
       path: "/",
@@ -577,7 +577,7 @@ function D(t, e) {
         201: {
           content: {
             "application/json": {
-              schema: H
+              schema: N
             }
           },
           description: "Tenant created"
@@ -591,23 +591,23 @@ function D(t, e) {
       }
     }),
     async (r) => {
-      var d, u;
-      const s = r.var.user;
-      if (!(s != null && s.sub))
-        throw new C(401, {
+      var f, o;
+      const a = r.var.user;
+      if (!(a != null && a.sub))
+        throw new b(401, {
           message: "Authentication required to create tenants"
         });
       let c = r.req.valid("json");
-      const o = {
+      const d = {
         adapters: r.env.data,
         ctx: r
       };
-      (d = e.tenants) != null && d.beforeCreate && (c = await e.tenants.beforeCreate(o, c));
-      const a = await r.env.data.tenants.create(c);
-      return (u = e.tenants) != null && u.afterCreate && await e.tenants.afterCreate(o, a), r.json(a, 201);
+      (f = e.tenants) != null && f.beforeCreate && (c = await e.tenants.beforeCreate(d, c));
+      const s = await r.env.data.tenants.create(c);
+      return (o = e.tenants) != null && o.afterCreate && await e.tenants.afterCreate(d, s), r.json(s, 201);
     }
   ), n.openapi(
-    M({
+    R({
       tags: ["tenants"],
       method: "delete",
       path: "/{id}",
@@ -634,39 +634,39 @@ function D(t, e) {
       }
     }),
     async (r) => {
-      var d, u, i, f;
-      const { id: s } = r.req.valid("param"), c = ((d = t.accessControl) == null ? void 0 : d.controlPlaneTenantId) ?? ((u = r.env.data.multiTenancyConfig) == null ? void 0 : u.controlPlaneTenantId);
+      var f, o, i, u;
+      const { id: a } = r.req.valid("param"), c = ((f = t.accessControl) == null ? void 0 : f.controlPlaneTenantId) ?? ((o = r.env.data.multiTenancyConfig) == null ? void 0 : o.controlPlaneTenantId);
       if (c) {
         const l = r.var.user;
         if (!(l != null && l.sub))
-          throw new C(401, {
+          throw new b(401, {
             message: "Authentication required"
           });
-        if (s === c)
-          throw new C(403, {
+        if (a === c)
+          throw new b(403, {
             message: "Cannot delete the control plane"
           });
-        if (!(await z(
-          (p) => r.env.data.userOrganizations.listUserOrganizations(
+        if (!(await F(
+          (g) => r.env.data.userOrganizations.listUserOrganizations(
             c,
             l.sub,
-            p
+            g
           ),
           "organizations"
-        )).some((p) => p.name === s))
-          throw new C(403, {
+        )).some((g) => g.name === a))
+          throw new b(403, {
             message: "Access denied to this tenant"
           });
       }
-      if (!await r.env.data.tenants.get(s))
-        throw new C(404, {
+      if (!await r.env.data.tenants.get(a))
+        throw new b(404, {
           message: "Tenant not found"
         });
-      const a = {
+      const s = {
         adapters: r.env.data,
         ctx: r
       };
-      return (i = e.tenants) != null && i.beforeDelete && await e.tenants.beforeDelete(a, s), await r.env.data.tenants.remove(s), (f = e.tenants) != null && f.afterDelete && await e.tenants.afterDelete(a, s), r.body(null, 204);
+      return (i = e.tenants) != null && i.beforeDelete && await e.tenants.beforeDelete(s, a), await r.env.data.tenants.remove(a), (u = e.tenants) != null && u.afterDelete && await e.tenants.afterDelete(s, a), r.body(null, 204);
     }
   ), n;
 }
@@ -680,13 +680,13 @@ function me(t) {
     { pattern: /\/api\/v2\/connections\/([^/]+)$/, type: "connection" }
   ];
   for (const { pattern: n, type: r } of e) {
-    const s = t.match(n);
-    if (s && s[1])
-      return { type: r, id: s[1] };
+    const a = t.match(n);
+    if (a && a[1])
+      return { type: r, id: a[1] };
   }
   return null;
 }
-async function ge(t, e, n) {
+async function pe(t, e, n) {
   try {
     switch (n.type) {
       case "resource_server": {
@@ -708,7 +708,7 @@ async function ge(t, e, n) {
     return !1;
   }
 }
-function pe(t) {
+function ge(t) {
   return {
     resource_server: "resource server",
     role: "role",
@@ -725,15 +725,31 @@ function we() {
     const r = t.var.tenant_id || t.req.header("x-tenant-id") || t.req.header("tenant-id");
     if (!r)
       return e();
-    if (await ge(t.env.data, r, n))
-      throw new C(403, {
-        message: `This ${pe(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
+    if (await pe(t.env.data, r, n))
+      throw new b(403, {
+        message: `This ${ge(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
       });
     return e();
   };
 }
-function Q(t, e) {
-  const { controlPlaneTenantId: n, controlPlaneClientId: r } = e;
+const ye = [
+  "client_secret",
+  "app_secret",
+  "twilio_token"
+];
+function V(t) {
+  if (!t) return t;
+  const e = { ...t };
+  for (const n of ye)
+    delete e[n];
+  return e;
+}
+function he(t, e) {
+  const {
+    controlPlaneTenantId: n,
+    controlPlaneClientId: r,
+    excludeSensitiveFields: a = !1
+  } = e;
   return {
     ...t,
     // Store config for use by tenants route access control
@@ -741,100 +757,53 @@ function Q(t, e) {
       controlPlaneTenantId: n,
       controlPlaneClientId: r
     },
-    legacyClients: {
-      ...t.legacyClients,
-      get: async (s) => {
-        var f;
-        const c = await t.legacyClients.get(s);
-        if (!c)
-          return null;
-        const o = r ? await t.legacyClients.get(r) : void 0, a = await t.connections.list(
-          c.tenant.id
-        ), d = n ? await t.connections.list(n) : { connections: [] }, u = a.connections.map((l) => {
-          var p;
-          const m = (p = d.connections) == null ? void 0 : p.find(
-            (h) => h.strategy === l.strategy
-          );
-          if (!(m != null && m.options))
-            return l;
-          const g = F.parse({
-            ...m || {},
-            ...l
-          });
-          return g.options = O.parse({
-            ...m.options || {},
-            ...l.options
-          }), g;
-        }).filter((l) => l), i = {
-          ...(o == null ? void 0 : o.tenant) || {},
-          ...c.tenant
-        };
-        return !c.tenant.audience && ((f = o == null ? void 0 : o.tenant) != null && f.audience) && (i.audience = o.tenant.audience), {
-          ...c,
-          web_origins: [
-            ...(o == null ? void 0 : o.web_origins) || [],
-            ...c.web_origins || []
-          ],
-          allowed_logout_urls: [
-            ...(o == null ? void 0 : o.allowed_logout_urls) || [],
-            ...c.allowed_logout_urls || []
-          ],
-          callbacks: [
-            ...(o == null ? void 0 : o.callbacks) || [],
-            ...c.callbacks || []
-          ],
-          connections: u,
-          tenant: i
-        };
-      }
-    },
     connections: {
       ...t.connections,
-      get: async (s, c) => {
-        var i;
-        const o = await t.connections.get(
-          s,
-          c
+      get: async (c, d) => {
+        var l;
+        const s = await t.connections.get(
+          c,
+          d
         );
-        if (!o || !n || s === n)
-          return o;
-        const d = (i = (await t.connections.list(n)).connections) == null ? void 0 : i.find(
-          (f) => f.strategy === o.strategy
+        if (!s || !n || c === n)
+          return s;
+        const o = (l = (await t.connections.list(n)).connections) == null ? void 0 : l.find(
+          (m) => m.strategy === s.strategy
         );
-        if (!(d != null && d.options))
-          return o;
-        const u = F.parse({
-          ...d,
-          ...o
-        });
-        return u.options = O.parse({
-          ...d.options || {},
-          ...o.options
-        }), u;
+        if (!(o != null && o.options))
+          return s;
+        const i = k.parse({
+          ...o,
+          ...s
+        }), u = a ? V(o.options) : o.options;
+        return i.options = H.parse({
+          ...u || {},
+          ...s.options
+        }), i;
       },
-      list: async (s, c) => {
-        const o = await t.connections.list(s, c);
-        if (!n || s === n)
-          return o;
-        const a = await t.connections.list(n), d = o.connections.map((u) => {
-          var l;
-          const i = (l = a.connections) == null ? void 0 : l.find(
-            (m) => m.strategy === u.strategy
+      list: async (c, d) => {
+        const s = await t.connections.list(c, d);
+        if (!n || c === n)
+          return s;
+        const f = await t.connections.list(n), o = s.connections.map((i) => {
+          var p;
+          const u = (p = f.connections) == null ? void 0 : p.find(
+            (g) => g.strategy === i.strategy
           );
-          if (!(i != null && i.options))
-            return u;
-          const f = F.parse({
-            ...i,
-            ...u
-          });
-          return f.options = O.parse({
-            ...i.options || {},
-            ...u.options
-          }), f;
+          if (!(u != null && u.options))
+            return i;
+          const l = k.parse({
+            ...u,
+            ...i
+          }), m = a ? V(u.options) : u.options;
+          return l.options = H.parse({
+            ...m || {},
+            ...i.options
+          }), l;
         });
         return {
-          ...o,
-          connections: d
+          ...s,
+          connections: o
         };
       }
     }
@@ -847,174 +816,185 @@ function Q(t, e) {
     // They remain part of ...baseAdapters and can be properly wrapped by caching.
   };
 }
-function q(t, e) {
-  return Q(t, e);
+function D(t, e) {
+  return he(t, e);
 }
-const Pe = Q, Se = q;
-function ye(t) {
+function ve(t) {
   return async (e, n) => {
     const r = e.var.user;
     return (r == null ? void 0 : r.tenant_id) === t && r.org_name && e.set("tenant_id", r.org_name), n();
   };
 }
-function he(t) {
+function Te(t) {
   return async (e, n) => {
     if (!t.accessControl)
       return n();
-    const { controlPlaneTenantId: r } = t.accessControl, s = e.var.org_name, c = e.var.organization_id, o = s || c;
-    let a = e.var.tenant_id;
-    const d = e.var.user, i = (d != null && d.aud ? Array.isArray(d.aud) ? d.aud : [d.aud] : []).includes(W);
-    if (!a && o && i && (e.set("tenant_id", o), a = o), !a)
-      throw new C(400, {
+    const { controlPlaneTenantId: r } = t.accessControl, a = e.var.org_name, c = e.var.organization_id, d = a || c;
+    let s = e.var.tenant_id;
+    const f = e.var.user, i = (f != null && f.aud ? Array.isArray(f.aud) ? f.aud : [f.aud] : []).includes(W);
+    if (!s && d && i && (e.set("tenant_id", d), s = d), !s)
+      throw new b(400, {
         message: "Tenant ID not found in request"
       });
-    if (!ae(
+    if (!se(
       c,
-      a,
+      s,
       r,
-      s
+      a
     ))
-      throw new C(403, {
-        message: `Access denied to tenant ${a}`
+      throw new b(403, {
+        message: `Access denied to tenant ${s}`
       });
     return n();
   };
 }
-function ve(t) {
+function Ae(t) {
   return async (e, n) => {
     if (!t.subdomainRouting)
       return n();
     const {
       baseDomain: r,
-      reservedSubdomains: s = [],
+      reservedSubdomains: a = [],
       resolveSubdomain: c
-    } = t.subdomainRouting, o = e.req.header("host") || "";
-    let a = null;
-    if (o.endsWith(r)) {
-      const u = o.slice(0, -(r.length + 1));
-      u && !u.includes(".") && (a = u);
+    } = t.subdomainRouting, d = e.req.header("host") || "";
+    let s = null;
+    if (d.endsWith(r)) {
+      const o = d.slice(0, -(r.length + 1));
+      o && !o.includes(".") && (s = o);
     }
-    if (a && s.includes(a) && (a = null), !a)
+    if (s && a.includes(s) && (s = null), !s)
       return t.accessControl && e.set("tenant_id", t.accessControl.controlPlaneTenantId), n();
-    let d = null;
+    let f = null;
     if (c)
-      d = await c(a);
+      f = await c(s);
     else if (t.subdomainRouting.useOrganizations !== !1 && t.accessControl)
       try {
-        const u = await e.env.data.organizations.get(
+        const o = await e.env.data.organizations.get(
           t.accessControl.controlPlaneTenantId,
-          a
+          s
         );
-        u && (d = u.id);
+        o && (f = o.id);
       } catch {
       }
-    if (!d)
-      throw new C(404, {
-        message: `Tenant not found for subdomain: ${a}`
+    if (!f)
+      throw new b(404, {
+        message: `Tenant not found for subdomain: ${s}`
       });
-    return e.set("tenant_id", d), n();
+    return e.set("tenant_id", f), n();
   };
 }
-function Te(t) {
+function _e(t) {
   return async (e, n) => {
     if (!t.databaseIsolation)
       return n();
     const r = e.var.tenant_id;
     if (!r)
-      throw new C(400, {
+      throw new b(400, {
         message: "Tenant ID not found in request"
       });
     try {
-      const s = await t.databaseIsolation.getAdapters(r);
-      e.env.data = s;
-    } catch (s) {
+      const a = await t.databaseIsolation.getAdapters(r);
+      e.env.data = a;
+    } catch (a) {
       throw console.error(
         `Failed to resolve database for tenant ${r}:`,
-        s
-      ), new C(500, {
+        a
+      ), new b(500, {
         message: "Failed to resolve tenant database"
       });
     }
     return n();
   };
 }
-function V(t) {
-  const e = ve(t), n = he(t), r = Te(t);
-  return async (s, c) => (await e(s, async () => {
-  }), await n(s, async () => {
-  }), await r(s, async () => {
+function Q(t) {
+  const e = Ae(t), n = Te(t), r = _e(t);
+  return async (a, c) => (await e(a, async () => {
+  }), await n(a, async () => {
+  }), await r(a, async () => {
   }), c());
 }
 function $e(t) {
   const {
     dataAdapter: e,
     controlPlane: n,
-    sync: r = { resourceServers: !0, roles: !0 },
-    defaultPermissions: s = ["tenant:admin"],
-    requireOrganizationMatch: c = !1,
-    managementApiExtensions: o = [],
-    entityHooks: a,
-    getChildTenantIds: d,
+    controlPlane: {
+      tenantId: r = "control_plane",
+      clientId: a
+    } = {},
+    sync: c = { resourceServers: !0, roles: !0 },
+    defaultPermissions: d = ["tenant:admin"],
+    requireOrganizationMatch: s = !1,
+    managementApiExtensions: f = [],
+    entityHooks: o,
+    getChildTenantIds: i,
     getAdapters: u,
-    ...i
-  } = t, f = (n == null ? void 0 : n.tenantId) ?? "control_plane", l = n == null ? void 0 : n.clientId, m = n ? q(e, {
-    controlPlaneTenantId: f,
-    controlPlaneClientId: l
-  }) : e, g = r !== !1, p = g ? {
-    resourceServers: r.resourceServers ?? !0,
-    roles: r.roles ?? !0
-  } : { resourceServers: !1, roles: !1 }, y = {
-    controlPlaneTenantId: f,
-    getChildTenantIds: d ?? (async () => (await z(
+    ...l
+  } = t;
+  let m = e, p = e;
+  n && (m = D(e, {
+    controlPlaneTenantId: r,
+    controlPlaneClientId: a
+  }), p = D(e, {
+    controlPlaneTenantId: r,
+    controlPlaneClientId: a,
+    excludeSensitiveFields: !0
+  }));
+  const g = c !== !1, h = g ? {
+    resourceServers: c.resourceServers ?? !0,
+    roles: c.roles ?? !0
+  } : { resourceServers: !1, roles: !1 }, T = {
+    controlPlaneTenantId: r,
+    getChildTenantIds: i ?? (async () => (await F(
       (I) => m.tenants.list(I),
       "tenants",
       { cursorField: "id", pageSize: 100 }
-    )).filter((I) => I.id !== f).map((I) => I.id)),
+    )).filter((I) => I.id !== r).map((I) => I.id)),
     getAdapters: u ?? (async () => m),
     getControlPlaneAdapters: async () => m,
-    sync: p
-  }, { entityHooks: T, tenantHooks: b } = fe(y), A = {
+    sync: h
+  }, { entityHooks: A, tenantHooks: _ } = fe(T), v = {
     resourceServers: [
-      T.resourceServers,
-      ...(a == null ? void 0 : a.resourceServers) ?? []
+      A.resourceServers,
+      ...(o == null ? void 0 : o.resourceServers) ?? []
     ],
-    roles: [T.roles, ...(a == null ? void 0 : a.roles) ?? []],
-    connections: (a == null ? void 0 : a.connections) ?? [],
-    tenants: (a == null ? void 0 : a.tenants) ?? [],
-    rolePermissions: (a == null ? void 0 : a.rolePermissions) ?? []
-  }, _ = D(
+    roles: [A.roles, ...(o == null ? void 0 : o.roles) ?? []],
+    connections: (o == null ? void 0 : o.connections) ?? [],
+    tenants: (o == null ? void 0 : o.tenants) ?? [],
+    rolePermissions: (o == null ? void 0 : o.rolePermissions) ?? []
+  }, P = M(
     {
       accessControl: {
-        controlPlaneTenantId: f,
-        requireOrganizationMatch: c,
-        defaultPermissions: s
+        controlPlaneTenantId: r,
+        requireOrganizationMatch: s,
+        defaultPermissions: d
       }
     },
-    { tenants: b }
-  ), { app: v } = ne({
+    { tenants: _ }
+  ), { app: C } = ne({
     dataAdapter: m,
-    ...i,
-    entityHooks: A,
+    managementDataAdapter: p,
+    ...l,
+    entityHooks: v,
     managementApiExtensions: [
-      ...o,
-      { path: "/tenants", router: _ }
+      ...f,
+      { path: "/tenants", router: P }
     ]
   });
-  return v.use("/api/v2/*", ye(f)), g && v.use("/api/v2/*", we()), { app: v, controlPlaneTenantId: f };
+  return C.use("/api/v2/*", ve(r)), g && C.use("/api/v2/*", we()), { app: C, controlPlaneTenantId: r };
 }
 function ze(t) {
-  const e = j(t);
+  const e = q(t);
   return {
     name: "multi-tenancy",
     // Apply multi-tenancy middleware for subdomain routing, database resolution, etc.
-    middleware: V(t),
+    middleware: Q(t),
     // Provide lifecycle hooks
     hooks: e,
     // Mount tenant management routes
     routes: [
       {
         path: "/management",
-        handler: D(t, e)
+        handler: M(t, e)
       }
     ],
     // Called when plugin is registered
@@ -1027,23 +1007,23 @@ function ze(t) {
     }
   };
 }
-function j(t) {
-  const e = t.accessControl ? se(t.accessControl) : {}, n = t.databaseIsolation ? oe(t.databaseIsolation) : {}, r = ce(t);
+function q(t) {
+  const e = t.accessControl ? ae(t.accessControl) : {}, n = t.databaseIsolation ? oe(t.databaseIsolation) : {}, r = ce(t);
   return {
     ...e,
     ...n,
     tenants: r
   };
 }
-function _e(t) {
-  const e = new Z(), n = j(t);
-  return e.route("/tenants", D(t, n)), e;
+function Pe(t) {
+  const e = new Z(), n = q(t);
+  return e.route("/tenants", M(t, n)), e;
 }
-function Re(t) {
+function Fe(t) {
   return {
-    hooks: j(t),
-    middleware: V(t),
-    app: _e(t),
+    hooks: q(t),
+    middleware: Q(t),
+    app: Pe(t),
     config: t,
     /**
      * Wraps data adapters with runtime fallback from the control plane.
@@ -1055,7 +1035,7 @@ function Re(t) {
      */
     wrapAdapters: (e, n) => {
       var r;
-      return q(e, {
+      return D(e, {
         controlPlaneTenantId: (r = t.accessControl) == null ? void 0 : r.controlPlaneTenantId,
         controlPlaneClientId: n == null ? void 0 : n.controlPlaneClientId
       });
@@ -1063,25 +1043,23 @@ function Re(t) {
   };
 }
 export {
-  se as createAccessControlHooks,
-  he as createAccessControlMiddleware,
-  ye as createControlPlaneTenantMiddleware,
+  ae as createAccessControlHooks,
+  Te as createAccessControlMiddleware,
+  ve as createControlPlaneTenantMiddleware,
   oe as createDatabaseHooks,
-  Te as createDatabaseMiddleware,
-  _e as createMultiTenancy,
-  j as createMultiTenancyHooks,
-  V as createMultiTenancyMiddleware,
+  _e as createDatabaseMiddleware,
+  Pe as createMultiTenancy,
+  q as createMultiTenancyHooks,
+  Q as createMultiTenancyMiddleware,
   ze as createMultiTenancyPlugin,
   we as createProtectSyncedMiddleware,
   ce as createProvisioningHooks,
-  Q as createRuntimeFallbackAdapter,
-  Pe as createSettingsInheritanceAdapter,
-  ve as createSubdomainMiddleware,
+  he as createRuntimeFallbackAdapter,
+  Ae as createSubdomainMiddleware,
   fe as createSyncHooks,
-  D as createTenantsOpenAPIRouter,
+  M as createTenantsOpenAPIRouter,
   $e as initMultiTenant,
-  Re as setupMultiTenancy,
-  ae as validateTenantAccess,
-  q as withRuntimeFallback,
-  Se as withSettingsInheritance
+  Fe as setupMultiTenancy,
+  se as validateTenantAccess,
+  D as withRuntimeFallback
 };