@authhero/multi-tenancy 15.0.0 → 15.0.1

package/dist/multi-tenancy.mjs

@@ -1,9 +1,9 @@
 import { Hono as e } from "hono";
-import { MANAGEMENT_API_AUDIENCE as t, MANAGEMENT_API_SCOPES as n, auth0QuerySchema as r, brandingSchema as i, connectionInsertSchema as a, connectionOptionsSchema as o, connectionSchema as s, deepMergePatch as c, emailProviderSchema as l, fetchAll as u, hookInsertSchema as d, init as f, isInteractiveClient as p, listControlPlaneKeys as m, promptSettingSchema as h, provisionDefaultClients as g, resourceServerInsertSchema as _, tenantInsertSchema as v, tenantSchema as y } from "authhero";
-import { OpenAPIHono as ee, createRoute as b, z as x } from "@hono/zod-openapi";
-import { HTTPException as S } from "hono/http-exception";
+import { MANAGEMENT_API_AUDIENCE as t, MANAGEMENT_API_SCOPES as n, auth0QuerySchema as r, brandingSchema as i, connectionInsertSchema as a, connectionOptionsSchema as o, connectionSchema as s, deepMergePatch as c, emailProviderSchema as l, escapeLuceneValue as u, fetchAll as d, hookInsertSchema as f, init as p, isInteractiveClient as m, listControlPlaneKeys as h, promptSettingSchema as g, provisionDefaultClients as _, resourceServerInsertSchema as v, tenantInsertSchema as y, tenantSchema as b } from "authhero";
+import { OpenAPIHono as x, createRoute as S, z as C } from "@hono/zod-openapi";
+import { HTTPException as w } from "hono/http-exception";
 //#region src/hooks/access-control.ts
-function C(e) {
+function T(e) {
 	let { controlPlaneTenantId: t, requireOrganizationMatch: n = !0 } = e;
 	return { async onTenantAccessValidation(e, r) {
 		if (r === t) return !0;
@@ -14,14 +14,14 @@ function C(e) {
 		return !0;
 	} };
 }
-function w(e, t, n, r) {
+function E(e, t, n, r) {
 	if (t === n) return !0;
 	let i = r || e;
 	return i ? i.toLowerCase() === t.toLowerCase() : !1;
 }
 //#endregion
 //#region src/hooks/database.ts
-function T(e) {
+function D(e) {
 	return { async resolveDataAdapters(t) {
 		try {
 			return await e.getAdapters(t);
@@ -33,18 +33,18 @@ function T(e) {
 }
 //#endregion
 //#region src/operations/instance-id.ts
-var E = 64;
-function D(e) {
+var O = 64;
+function k(e) {
 	return e.replace(/[^a-zA-Z0-9_-]/g, "-");
 }
-function te(e) {
-	let t = D(e.id), n = Math.max(0, E - (5 + t.length)), r = D(e.kind).slice(0, n), i = 3 + r.length + 2 + t.length, a = Math.max(0, E - i);
-	return `op-${r}-${D(e.tenant_id ?? "fleet").slice(0, a)}-${t}`.slice(0, E);
+function A(e) {
+	let t = k(e.id), n = Math.max(0, O - (5 + t.length)), r = k(e.kind).slice(0, n), i = 3 + r.length + 2 + t.length, a = Math.max(0, O - i);
+	return `op-${r}-${k(e.tenant_id ?? "fleet").slice(0, a)}-${t}`.slice(0, O);
 }
 //#endregion
 //#region src/operations/recorder.ts
-var ne = 2048;
-function O(e) {
+var ee = 2048;
+function j(e) {
 	let t;
 	if (e instanceof Error) t = e.message;
 	else try {
@@ -52,9 +52,9 @@ function O(e) {
 	} catch {
 		t = Object.prototype.toString.call(e);
 	}
-	return t.slice(0, ne);
+	return t.slice(0, ee);
 }
-function k(e) {
+function M(e) {
 	let { tenantOperations: t, tenantOperationEvents: n } = e;
 	return {
 		async markRunning(e, n) {
@@ -85,24 +85,24 @@ function k(e) {
 		async markFailed(e, n) {
 			await t.update(e, {
 				status: "failed",
-				error: O(n),
+				error: j(n),
 				finished_at: (/* @__PURE__ */ new Date()).toISOString()
 			});
 		}
 	};
 }
-function re(e) {
+function N(e) {
 	return e === "succeeded" || e === "failed" || e === "cancelled";
 }
 //#endregion
 //#region src/operations/inline-executor.ts
-var A = { async do(e, t, n) {
+var P = { async do(e, t, n) {
 	let r = typeof t == "function" ? t : n;
 	if (!r) throw Error("StepRunner.do called without a function");
 	return r();
 } };
-function j(e) {
-	let t = k(e.stores);
+function te(e) {
+	let t = M(e.stores);
 	return {
 		engine: "inline",
 		async start(n) {
@@ -121,7 +121,7 @@ function j(e) {
 				try {
 					let r = await e.run({
 						operation: n,
-						step: A
+						step: P
 					});
 					await t.appendEvent(n.id, {
 						step: e.name,
@@ -132,7 +132,7 @@ function j(e) {
 					throw await t.appendEvent(n.id, {
 						step: e.name,
 						outcome: "failed",
-						detail: { message: O(r) }
+						detail: { message: j(r) }
 					}), await t.markFailed(n.id, r), r;
 				}
 			}
@@ -142,7 +142,7 @@ function j(e) {
 }
 //#endregion
 //#region src/operations/enqueue.ts
-async function M(e, t, n) {
+async function ne(e, t, n) {
 	let r = await e.tenantOperations.create({
 		tenant_id: t.tenant_id,
 		rollout_id: t.rollout_id,
@@ -151,12 +151,12 @@ async function M(e, t, n) {
 		initiated_by: t.initiated_by,
 		target_worker_version: t.target_worker_version,
 		target_database_version: t.target_database_version
-	}), i = te(r);
+	}), i = A(r);
 	try {
 		await e.tenantOperations.update(r.id, { engine_instance_id: i });
 	} catch (t) {
 		try {
-			await k(e).markFailed(r.id, t);
+			await M(e).markFailed(r.id, t);
 		} catch {}
 		throw t;
 	}
@@ -165,14 +165,14 @@ async function M(e, t, n) {
 		engine_instance_id: i
 	};
 }
-async function N(e, t, n) {
-	let r = k(e), i = await M(e, n, t.engine);
+async function re(e, t, n) {
+	let r = M(e), i = await ne(e, n, t.engine);
 	try {
 		await t.start(i);
 	} catch (t) {
 		try {
 			let n = await e.tenantOperations.get(i.id);
-			n && !re(n.status) && await r.markFailed(i.id, t);
+			n && !N(n.status) && await r.markFailed(i.id, t);
 		} catch (e) {
 			console.warn("Failed to record tenant operation failure:", e);
 		}
@@ -192,13 +192,13 @@ function ie(e) {
 		tenantOperationEvents: e.tenantOperationEvents
 	};
 }
-async function P(e, t, n) {
+async function ae(e, t, n) {
 	let r = ie(e);
 	if (!r) {
 		await n(void 0);
 		return;
 	}
-	let i = k(r), a = async (e) => {
+	let i = M(r), a = async (e) => {
 		try {
 			await e();
 		} catch (e) {
@@ -206,7 +206,7 @@ async function P(e, t, n) {
 		}
 	}, o;
 	if (await a(async () => {
-		let e = await M(r, t, "inline");
+		let e = await ne(r, t, "inline");
 		o = e.id, await i.markRunning(e.id);
 	}), !o) {
 		await n(void 0);
@@ -228,7 +228,7 @@ async function P(e, t, n) {
 			c || await i.appendEvent(s, {
 				step: t.kind,
 				outcome: "failed",
-				detail: { message: O(e) }
+				detail: { message: j(e) }
 			}), await i.markFailed(s, e);
 		}), e;
 	}
@@ -241,7 +241,7 @@ async function P(e, t, n) {
 }
 //#endregion
 //#region src/hooks/provisioning.ts
-function ae(e) {
+function oe(e) {
 	return `urn:authhero:tenant:${e.toLowerCase()}`;
 }
 function F(e) {
@@ -249,20 +249,20 @@ function F(e) {
 		async beforeCreate(e, t) {
 			return !t.audience && t.id ? {
 				...t,
-				audience: ae(t.id)
+				audience: oe(t.id)
 			} : t;
 		},
 		async afterCreate(r, i) {
 			let { accessControl: a, databaseIsolation: o } = e;
-			if (a && r.ctx && await oe(r, i, a), o?.onProvision) {
+			if (a && r.ctx && await se(r, i, a), o?.onProvision) {
 				let e = o.onProvision;
-				o.recordProvisionOperations === !1 ? await e(i.id) : await P(r.adapters, {
+				o.recordProvisionOperations === !1 ? await e(i.id) : await ae(r.adapters, {
 					kind: "provision",
 					tenant_id: i.id,
 					initiated_by: r.ctx?.var.user?.sub
 				}, (t) => e(i.id, t));
 			} else try {
-				await g(r.adapters, i.id, {
+				await _(r.adapters, i.id, {
 					managementApiIdentifier: t,
 					managementApiScopes: n
 				});
@@ -286,14 +286,14 @@ function F(e) {
 		}
 	};
 }
-async function oe(e, t, n) {
+async function se(e, t, n) {
 	let { controlPlaneTenantId: r, defaultPermissions: i, defaultRoles: a, issuer: o, adminRoleName: s = "Tenant Admin", adminRoleDescription: c = "Full access to all tenant management operations", addCreatorToOrganization: l = !0 } = n, u = await e.adapters.organizations.create(r, {
 		name: t.id,
 		display_name: t.friendly_name || t.id
 	}), d;
-	if (o && (d = await ce(e, r, s, c)), l && e.ctx) {
+	if (o && (d = await le(e, r, s, c)), l && e.ctx) {
 		let t = e.ctx.var.user;
-		if (t?.sub && !await se(e, r, t.sub)) try {
+		if (t?.sub && !await ce(e, r, t.sub)) try {
 			await e.adapters.userOrganizations.create(r, {
 				user_id: t.sub,
 				organization_id: u.id
@@ -304,12 +304,12 @@ async function oe(e, t, n) {
 	}
 	a && a.length > 0 && console.log(`Would assign roles ${a.join(", ")} to organization ${u.id}`), i && i.length > 0 && console.log(`Would grant permissions ${i.join(", ")} to organization ${u.id}`);
 }
-async function se(e, n, r) {
+async function ce(e, n, r) {
 	let i = await e.adapters.userRoles.list(n, r, void 0, "");
 	for (let r of i) if ((await e.adapters.rolePermissions.list(n, r.id, { per_page: 1e3 })).some((e) => e.permission_name === "admin:organizations" && e.resource_server_identifier === t)) return !0;
 	return !1;
 }
-async function ce(e, r, i, a) {
+async function le(e, r, i, a) {
 	let o = (await e.adapters.roles.list(r, {})).roles.find((e) => e.name === i);
 	if (o) return o.id;
 	let s = await e.adapters.roles.create(r, {
@@ -324,11 +324,11 @@ async function ce(e, r, i, a) {
 }
 //#endregion
 //#region src/hooks/sync.ts
-function le(e, t, n = () => !0) {
+function I(e, t, n = () => !0) {
 	let { controlPlaneTenantId: r, getChildTenantIds: i, getAdapters: a } = e, o = /* @__PURE__ */ new Map();
 	async function s(e, n, r) {
 		return (await t(e).list(n, {
-			q: `name:${r}`,
+			q: `name:${u(r)}`,
 			per_page: 1
 		}))[0] ?? null;
 	}
@@ -379,15 +379,15 @@ function le(e, t, n = () => !0) {
 		}
 	};
 }
-function ue(e, t, n = () => !0) {
+function L(e, t, n = () => !0) {
 	let { controlPlaneTenantId: r, getControlPlaneAdapters: i, getAdapters: a } = e;
 	return { async afterCreate(e, o) {
 		if (o.id !== r) try {
-			let e = await i(), s = await a(o.id), c = t(e), l = t(s), d = await u((e) => c.listPaginated(r, e), c.listKey, {
+			let e = await i(), s = await a(o.id), c = t(e), l = t(s), u = await d((e) => c.listPaginated(r, e), c.listKey, {
 				cursorField: "id",
 				pageSize: 100
 			});
-			await Promise.all(d.filter((e) => n(e)).map(async (e) => {
+			await Promise.all(u.filter((e) => n(e)).map(async (e) => {
 				try {
 					let t = c.transform(e);
 					await l.create(o.id, {
@@ -403,7 +403,7 @@ function ue(e, t, n = () => !0) {
 		}
 	} };
 }
-var de = (e) => ({
+var R = (e) => ({
 	list: async (t, n) => (await e.resourceServers.list(t, n)).resource_servers,
 	listPaginated: (t, n) => e.resourceServers.list(t, n),
 	get: (t, n) => e.resourceServers.get(t, n),
@@ -421,7 +421,7 @@ var de = (e) => ({
 		token_lifetime: e.token_lifetime,
 		token_lifetime_for_web: e.token_lifetime_for_web
 	})
-}), fe = (e) => ({
+}), z = (e) => ({
 	list: async (t, n) => (await e.roles.list(t, n)).roles,
 	listPaginated: (t, n) => e.roles.list(t, n),
 	get: (t, n) => e.roles.get(t, n),
@@ -436,20 +436,20 @@ var de = (e) => ({
 		description: e.description
 	})
 });
-function pe(e) {
+function B(e) {
 	return e.metadata?.sync !== !1;
 }
-function I(e) {
-	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => pe(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => pe(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? le(e, de, a) : void 0, c = i ? le(e, fe, o) : void 0, l = r ? ue(e, de, a) : void 0, d = i ? ue(e, fe, o) : void 0, f = i ? { async afterCreate(t, r) {
+function V(e) {
+	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => B(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => B(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? I(e, R, a) : void 0, c = i ? I(e, z, o) : void 0, l = r ? L(e, R, a) : void 0, f = i ? L(e, z, o) : void 0, p = i ? { async afterCreate(t, r) {
 		if (r.id !== e.controlPlaneTenantId) {
-			await d?.afterCreate?.(t, r);
+			await f?.afterCreate?.(t, r);
 			try {
-				let t = await e.getControlPlaneAdapters(), i = await e.getAdapters(r.id), a = await u((n) => t.roles.list(e.controlPlaneTenantId, n), "roles", {
+				let t = await e.getControlPlaneAdapters(), i = await e.getAdapters(r.id), a = await d((n) => t.roles.list(e.controlPlaneTenantId, n), "roles", {
 					cursorField: "id",
 					pageSize: 100
 				}), o = /* @__PURE__ */ new Map();
 				for (let e of a.filter((e) => n.roles?.(e) ?? !0)) {
-					let t = await p(i, r.id, e.name);
+					let t = await m(i, r.id, e.name);
 					t && o.set(e.name, t.id);
 				}
 				for (let s of a.filter((e) => n.roles?.(e) ?? !0)) {
@@ -470,9 +470,9 @@ function I(e) {
 			}
 		}
 	} } : void 0;
-	async function p(e, t, n) {
+	async function m(e, t, n) {
 		return (await e.roles.list(t, {
-			q: `name:${n}`,
+			q: `name:${u(n)}`,
 			per_page: 1
 		})).roles[0] ?? null;
 	}
@@ -482,7 +482,7 @@ function I(e) {
 			roles: c
 		},
 		tenantHooks: { async afterCreate(e, t) {
-			let n = [l?.afterCreate, f?.afterCreate ?? d?.afterCreate], r = [];
+			let n = [l?.afterCreate, p?.afterCreate ?? f?.afterCreate], r = [];
 			for (let i of n) if (i) try {
 				await i(e, t);
 			} catch (e) {
@@ -495,35 +495,35 @@ function I(e) {
 }
 //#endregion
 //#region src/routes/tenants.ts
-var me = x.object({
-	sub: x.string(),
-	tenant_id: x.string().optional(),
-	org_id: x.string().optional(),
-	scope: x.string().optional(),
-	permissions: x.array(x.string()).optional()
+var ue = C.object({
+	sub: C.string(),
+	tenant_id: C.string().optional(),
+	org_id: C.string().optional(),
+	scope: C.string().optional(),
+	permissions: C.array(C.string()).optional()
 }).passthrough();
-function he(e) {
-	let t = me.safeParse(e);
+function de(e) {
+	let t = ue.safeParse(e);
 	return t.success ? t.data : void 0;
 }
-function ge(e) {
+function fe(e) {
 	let t = e.permissions ?? [], n = e.scope ? e.scope.split(" ").filter(Boolean) : [], r = new Set([...t, ...n]);
 	return r.has("delete:tenants") || r.has("admin:organizations");
 }
-function L(e, t) {
-	let n = new ee();
-	return n.openapi(b({
+function H(e, t) {
+	let n = new x();
+	return n.openapi(S({
 		tags: ["tenants"],
 		method: "get",
 		path: "/",
 		request: { query: r },
 		security: [{ Bearer: [] }],
 		responses: { 200: {
-			content: { "application/json": { schema: x.object({
-				tenants: x.array(y),
-				start: x.number().optional(),
-				limit: x.number().optional(),
-				length: x.number().optional()
+			content: { "application/json": { schema: C.object({
+				tenants: C.array(b),
+				start: C.number().optional(),
+				limit: C.number().optional(),
+				length: C.number().optional()
 			}) } },
 			description: "List of tenants"
 		} }
@@ -544,31 +544,31 @@ function L(e, t) {
 			}) : t.json({ tenants: e.tenants });
 		}
 		let c = e.accessControl?.controlPlaneTenantId ?? t.env.data.multiTenancyConfig?.controlPlaneTenantId;
-		if (c && !o?.sub) throw new S(403, { message: "Access denied: token has no subject" });
+		if (c && !o?.sub) throw new w(403, { message: "Access denied: token has no subject" });
 		if (c && o?.sub) {
-			let e = (await u((e) => t.env.data.userOrganizations.listUserOrganizations(c, o.sub, e), "organizations")).map((e) => e.name);
+			let e = (await d((e) => t.env.data.userOrganizations.listUserOrganizations(c, o.sub, e), "organizations")).map((e) => e.name);
 			if (e.length === 0) return i ? t.json({
 				tenants: [],
 				start: 0,
 				limit: r ?? 50,
 				length: 0
 			}) : t.json({ tenants: [] });
-			let s = e.length, l = n ?? 0, d = r ?? 50, f = l * d, p = e.slice(f, f + d);
+			let s = e.length, l = n ?? 0, u = r ?? 50, f = l * u, p = e.slice(f, f + u);
 			if (p.length === 0) return i ? t.json({
 				tenants: [],
 				start: f,
-				limit: d,
+				limit: u,
 				length: s
 			}) : t.json({ tenants: [] });
 			let m = p.map((e) => `id:${e}`).join(" OR "), h = a ? `(${m}) AND (${a})` : m, g = await t.env.data.tenants.list({
 				q: h,
-				per_page: d,
+				per_page: u,
 				include_totals: !1
 			});
 			return i ? t.json({
 				tenants: g.tenants,
 				start: f,
-				limit: d,
+				limit: u,
 				length: s
 			}) : t.json({ tenants: g.tenants });
 		}
@@ -584,22 +584,22 @@ function L(e, t) {
 			limit: l.totals?.limit ?? r,
 			length: l.tenants.length
 		}) : t.json({ tenants: l.tenants });
-	}), n.openapi(b({
+	}), n.openapi(S({
 		tags: ["tenants"],
 		method: "post",
 		path: "/",
-		request: { body: { content: { "application/json": { schema: v } } } },
+		request: { body: { content: { "application/json": { schema: y } } } },
 		security: [{ Bearer: [] }],
 		responses: {
 			201: {
-				content: { "application/json": { schema: y } },
+				content: { "application/json": { schema: b } },
 				description: "Tenant created"
 			},
 			400: { description: "Validation error" },
 			409: { description: "Tenant with this ID already exists" }
 		}
 	}), async (e) => {
-		if (!e.var.user?.sub) throw new S(401, { message: "Authentication required to create tenants" });
+		if (!e.var.user?.sub) throw new w(401, { message: "Authentication required to create tenants" });
 		let n = e.req.valid("json"), r = {
 			adapters: e.env.data,
 			ctx: e
@@ -607,11 +607,11 @@ function L(e, t) {
 		t.tenants?.beforeCreate && (n = await t.tenants.beforeCreate(r, n));
 		let i = await e.env.data.tenants.create(n);
 		return t.tenants?.afterCreate && await t.tenants.afterCreate(r, i), e.json(i, 201);
-	}), n.openapi(b({
+	}), n.openapi(S({
 		tags: ["tenants"],
 		method: "delete",
 		path: "/{id}",
-		request: { params: x.object({ id: x.string() }) },
+		request: { params: C.object({ id: C.string() }) },
 		security: [{ Bearer: ["delete:tenants"] }],
 		responses: {
 			204: { description: "Tenant deleted" },
@@ -621,70 +621,70 @@ function L(e, t) {
 	}), async (n) => {
 		let { id: r } = n.req.valid("param"), i = e.accessControl?.controlPlaneTenantId ?? n.env.data.multiTenancyConfig?.controlPlaneTenantId;
 		if (i) {
-			let e = he(n.var.user);
-			if (!e?.sub) throw new S(401, { message: "Authentication required" });
-			if (r === i) throw new S(403, { message: "Cannot delete the control plane" });
+			let e = de(n.var.user);
+			if (!e?.sub) throw new w(401, { message: "Authentication required" });
+			if (r === i) throw new w(403, { message: "Cannot delete the control plane" });
 			let t = n.var.org_name, a = r.toLowerCase(), o = !!t && t.toLowerCase() === a;
 			if (!o) {
 				let r = !!(e.org_id ?? n.var.organization_id ?? t), a = !e.tenant_id || e.tenant_id === i;
-				!r && a && ge(e) && (o = !0);
+				!r && a && fe(e) && (o = !0);
 			}
-			if (o ||= (await u((t) => n.env.data.userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new S(403, { message: "Access denied to this tenant" });
+			if (o ||= (await d((t) => n.env.data.userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new w(403, { message: "Access denied to this tenant" });
 		}
-		if (!await n.env.data.tenants.get(r)) throw new S(404, { message: "Tenant not found" });
+		if (!await n.env.data.tenants.get(r)) throw new w(404, { message: "Tenant not found" });
 		let a = {
 			adapters: n.env.data,
 			ctx: n
 		};
 		return t.tenants?.beforeDelete && await t.tenants.beforeDelete(a, r), await n.env.data.tenants.remove(r), t.tenants?.afterDelete && await t.tenants.afterDelete(a, r), n.body(null, 204);
-	}), n.openapi(b({
+	}), n.openapi(S({
 		tags: ["tenants", "settings"],
 		method: "get",
 		path: "/settings",
-		request: { headers: x.object({ "tenant-id": x.string().optional() }) },
+		request: { headers: C.object({ "tenant-id": C.string().optional() }) },
 		security: [{ Bearer: ["read:tenants"] }],
 		responses: { 200: {
-			content: { "application/json": { schema: y } },
+			content: { "application/json": { schema: b } },
 			description: "Current tenant settings"
 		} }
 	}), async (e) => {
 		let t = await e.env.data.tenants.get(e.var.tenant_id);
-		if (!t) throw new S(404, { message: "Tenant not found" });
+		if (!t) throw new w(404, { message: "Tenant not found" });
 		return e.json(t);
-	}), n.openapi(b({
+	}), n.openapi(S({
 		tags: ["tenants", "settings"],
 		method: "patch",
 		path: "/settings",
 		request: {
-			headers: x.object({ "tenant-id": x.string().optional() }),
-			body: { content: { "application/json": { schema: x.object(v.shape).partial() } } }
+			headers: C.object({ "tenant-id": C.string().optional() }),
+			body: { content: { "application/json": { schema: C.object(y.shape).partial() } } }
 		},
 		security: [{ Bearer: ["update:tenants"] }],
 		responses: { 200: {
-			content: { "application/json": { schema: y } },
+			content: { "application/json": { schema: b } },
 			description: "Updated tenant settings"
 		} }
 	}), async (e) => {
 		let { id: t, ...n } = e.req.valid("json"), r = await e.env.data.tenants.get(e.var.tenant_id);
-		if (!r) throw new S(404, { message: "Tenant not found" });
+		if (!r) throw new w(404, { message: "Tenant not found" });
 		if ("default_client_id" in n) {
 			let t = n.default_client_id;
 			if (typeof t == "string" && t.length > 0) {
 				let n = await e.env.data.clients.get(e.var.tenant_id, t);
-				if (!n) throw new S(400, { message: `Client with id '${t}' not found` });
-				if (!p(n)) throw new S(400, { message: `Client '${t}' is not an interactive client and cannot be used as the default client` });
+				if (!n) throw new w(400, { message: `Client with id '${t}' not found` });
+				if (!m(n)) throw new w(400, { message: `Client '${t}' is not an interactive client and cannot be used as the default client` });
 			}
 		}
 		let i = c(r, n);
 		await e.env.data.tenants.update(e.var.tenant_id, i);
 		let a = await e.env.data.tenants.get(e.var.tenant_id);
-		if (!a) throw new S(500, { message: "Failed to retrieve updated tenant" });
+		if (!a) throw new w(500, { message: "Failed to retrieve updated tenant" });
 		return e.json(a);
 	}), n;
 }
 //#endregion
 //#region src/middleware/protect-synced.ts
-function _e(e) {
+function pe(e) {
 	for (let { pattern: t, type: n } of [
 		{
 			pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
@@ -707,7 +707,7 @@ function _e(e) {
 	}
 	return null;
 }
-async function ve(e, t, n) {
+async function me(e, t, n) {
 	try {
 		switch (n.type) {
 			case "resource_server": return (await e.resourceServers.get(t, n.id))?.is_system === !0;
@@ -719,31 +719,31 @@ async function ve(e, t, n) {
 		return !1;
 	}
 }
-function ye(e) {
+function he(e) {
 	return {
 		resource_server: "resource server",
 		role: "role",
 		connection: "connection"
 	}[e];
 }
-function R() {
+function U() {
 	return async (e, t) => {
 		if (![
 			"PATCH",
 			"PUT",
 			"DELETE"
 		].includes(e.req.method)) return t();
-		let n = _e(e.req.path);
+		let n = pe(e.req.path);
 		if (!n) return t();
 		let r = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
 		if (!r) return t();
-		if (await ve(e.env.data, r, n)) throw new S(403, { message: `This ${ye(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
+		if (await me(e.env.data, r, n)) throw new w(403, { message: `This ${he(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
 		return t();
 	};
 }
 //#endregion
 //#region src/middleware/settings-inheritance.ts
-function z(e, t) {
+function W(e, t) {
 	let n = t.find((t) => t.strategy === e.strategy);
 	if (!n?.options) return e;
 	let r = s.passthrough().parse({
@@ -755,11 +755,11 @@ function z(e, t) {
 		...e.options
 	}), r;
 }
-function B(e, t) {
+function G(e, t) {
 	let n = [...t || [], ...e || []];
 	return [...new Set(n)];
 }
-function be(e, t) {
+function ge(e, t) {
 	if (!t?.length) return e || [];
 	if (!e?.length) return t;
 	let n = /* @__PURE__ */ new Map();
@@ -767,22 +767,22 @@ function be(e, t) {
 	for (let t of e) n.set(t.value, t);
 	return Array.from(n.values());
 }
-function V(e, t) {
+function _e(e, t) {
 	return t ? {
 		...e,
-		scopes: be(e.scopes, t.scopes)
+		scopes: ge(e.scopes, t.scopes)
 	} : e;
 }
-function xe(e, t) {
+function ve(e, t) {
 	return t ? {
 		...e,
-		callbacks: B(e.callbacks, t.callbacks),
-		web_origins: B(e.web_origins, t.web_origins),
-		allowed_logout_urls: B(e.allowed_logout_urls, t.allowed_logout_urls),
-		allowed_origins: B(e.allowed_origins, t.allowed_origins)
+		callbacks: G(e.callbacks, t.callbacks),
+		web_origins: G(e.web_origins, t.web_origins),
+		allowed_logout_urls: G(e.allowed_logout_urls, t.allowed_logout_urls),
+		allowed_origins: G(e.allowed_origins, t.allowed_origins)
 	} : e;
 }
-function H(e) {
+function ye(e) {
 	let { controlPlaneTenantId: t, controlPlaneClientId: n, resolveControlPlane: r } = e;
 	if (r) return async (e) => r({ tenant_id: e });
 	if (!t) return async () => void 0;
@@ -792,14 +792,14 @@ function H(e) {
 	};
 	return async () => i;
 }
-function U(e, t) {
+function be(e, t) {
 	return {
 		...e.resourceServers,
 		get: async (n, r) => {
 			let i = await e.resourceServers.get(n, r);
 			if (!i) return i;
 			let a = await t(n);
-			return !a || n === a.tenantId || !i.is_system ? i : V(i, await e.resourceServers.get(a.tenantId, r));
+			return !a || n === a.tenantId || !i.is_system ? i : _e(i, await e.resourceServers.get(a.tenantId, r));
 		},
 		list: async (n, r) => {
 			let i = await e.resourceServers.list(n, r), a = await t(n);
@@ -811,7 +811,7 @@ function U(e, t) {
 				let n = await e.resourceServers.get(o, t);
 				n && c.set(t, n);
 			}));
-			let l = i.resource_servers.map((e) => e.is_system && e.id ? V(e, c.get(e.id) ?? null) : e);
+			let l = i.resource_servers.map((e) => e.is_system && e.id ? _e(e, c.get(e.id) ?? null) : e);
 			return {
 				...i,
 				resource_servers: l
@@ -819,18 +819,18 @@ function U(e, t) {
 		}
 	};
 }
-function W(e, t) {
-	let n = H({
+function xe(e, t) {
+	let n = ye({
 		controlPlaneTenantId: t.controlPlaneTenantId,
 		resolveControlPlane: t.resolveControlPlane
 	});
 	return {
 		...e,
-		resourceServers: U(e, n)
+		resourceServers: be(e, n)
 	};
 }
-function G(e, t) {
-	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i } = t, a = H({
+function Se(e, t) {
+	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i } = t, a = ye({
 		controlPlaneTenantId: n,
 		controlPlaneClientId: r,
 		resolveControlPlane: i
@@ -848,12 +848,12 @@ function G(e, t) {
 				let r = await e.connections.get(t, n);
 				if (!r) return r;
 				let i = await a(t);
-				return !i || t === i.tenantId ? r : z(r, (await e.connections.list(i.tenantId)).connections || []);
+				return !i || t === i.tenantId ? r : W(r, (await e.connections.list(i.tenantId)).connections || []);
 			},
 			list: async (t, n) => {
 				let r = await e.connections.list(t, n), i = await a(t);
 				if (!i || t === i.tenantId) return r;
-				let o = await e.connections.list(i.tenantId), s = r.connections.map((e) => z(e, o.connections || []));
+				let o = await e.connections.list(i.tenantId), s = r.connections.map((e) => W(e, o.connections || []));
 				return {
 					...r,
 					connections: s
@@ -868,7 +868,7 @@ function G(e, t) {
 				let i = await a(t);
 				if (!i || t === i.tenantId) return r;
 				let o = await e.connections.list(i.tenantId);
-				return r.map((e) => z(e, o.connections || []));
+				return r.map((e) => W(e, o.connections || []));
 			}
 		},
 		emailProviders: {
@@ -880,22 +880,22 @@ function G(e, t) {
 				return !r || t === r.tenantId ? null : e.emailProviders.get(r.tenantId);
 			}
 		},
-		resourceServers: U(e, a),
-		hooks: Se(e, a)
+		resourceServers: be(e, a),
+		hooks: we(e, a)
 	};
 }
-function K(e) {
+function Ce(e) {
 	if (!e || typeof e != "object") return !1;
 	let t = e.metadata;
 	return !t || typeof t != "object" ? !1 : t.inheritable === !0;
 }
-function Se(e, t) {
+function we(e, t) {
 	return {
 		...e.hooks,
 		list: async (n, r) => {
 			let i = await e.hooks.list(n, r), a = await t(n);
 			if (!a || n === a.tenantId) return i;
-			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(K);
+			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(Ce);
 			if (o.length === 0) return i;
 			let s = new Set((i.hooks || []).map((e) => e.hook_id)), c = o.filter((e) => !s.has(e.hook_id));
 			return {
@@ -910,31 +910,31 @@ function Se(e, t) {
 			let a = await t(n);
 			if (!a || n === a.tenantId) return i;
 			let o = await e.hooks.get(a.tenantId, r);
-			return o && K(o) ? o : null;
+			return o && Ce(o) ? o : null;
 		}
 	};
 }
-function q(e, t) {
-	return G(e, t);
+function K(e, t) {
+	return Se(e, t);
 }
 //#endregion
 //#region src/middleware/index.ts
-function Ce(e) {
+function Te(e) {
 	return async (t, n) => {
 		let r = t.var.user;
 		return r?.tenant_id === e && r.org_name && t.set("tenant_id", r.org_name), n();
 	};
 }
-function we(e) {
+function Ee(e) {
 	return async (n, r) => {
 		if (!e.accessControl) return r();
 		let { controlPlaneTenantId: i } = e.accessControl, a = n.var.org_name, o = n.var.organization_id, s = a || o, c = n.var.tenant_id, l = n.var.user, u = (l?.aud ? Array.isArray(l.aud) ? l.aud : [l.aud] : []).includes(t);
-		if (!c && s && u && (n.set("tenant_id", s), c = s), !c) throw new S(400, { message: "Tenant ID not found in request" });
-		if (!w(o, c, i, a)) throw new S(403, { message: `Access denied to tenant ${c}` });
+		if (!c && s && u && (n.set("tenant_id", s), c = s), !c) throw new w(400, { message: "Tenant ID not found in request" });
+		if (!E(o, c, i, a)) throw new w(403, { message: `Access denied to tenant ${c}` });
 		return r();
 	};
 }
-function Te(e) {
+function De(e) {
 	return async (t, n) => {
 		if (!e.subdomainRouting) return n();
 		let { baseDomain: r, reservedSubdomains: i = [], resolveSubdomain: a } = e.subdomainRouting, o = t.req.header("x-forwarded-host") || t.req.header("host") || "", s = null;
@@ -949,43 +949,43 @@ function Te(e) {
 			let n = await t.env.data.organizations.get(e.accessControl.controlPlaneTenantId, s);
 			n && (c = n.id);
 		} catch {}
-		if (!c) throw new S(404, { message: `Tenant not found for subdomain: ${s}` });
+		if (!c) throw new w(404, { message: `Tenant not found for subdomain: ${s}` });
 		return t.set("tenant_id", c), n();
 	};
 }
-function Ee(e) {
+function Oe(e) {
 	return async (t, n) => {
 		if (!e.databaseIsolation) return n();
 		let r = t.var.tenant_id;
-		if (!r) throw new S(400, { message: "Tenant ID not found in request" });
+		if (!r) throw new w(400, { message: "Tenant ID not found in request" });
 		try {
 			let n = await e.databaseIsolation.getAdapters(r);
 			t.env.data = n;
 		} catch (e) {
-			throw console.error(`Failed to resolve database for tenant ${r}:`, e), new S(500, { message: "Failed to resolve tenant database" });
+			throw console.error(`Failed to resolve database for tenant ${r}:`, e), new w(500, { message: "Failed to resolve tenant database" });
 		}
 		return n();
 	};
 }
-function J(e) {
-	let t = Te(e), n = we(e), r = Ee(e);
+function q(e) {
+	let t = De(e), n = Ee(e), r = Oe(e);
 	return async (e, i) => (await t(e, async () => {}), await n(e, async () => {}), await r(e, async () => {}), i());
 }
 //#endregion
 //#region src/init.ts
-function De(e) {
+function ke(e) {
 	let { dataAdapter: t, controlPlane: n, controlPlane: { tenantId: r = "control_plane", clientId: i } = {}, resolveControlPlane: a, sync: o = {
 		resourceServers: !0,
 		roles: !0
-	}, defaultPermissions: s = ["tenant:admin"], requireOrganizationMatch: c = !1, managementApiExtensions: l = [], entityHooks: d, getChildTenantIds: p, getAdapters: m, ...h } = e;
+	}, defaultPermissions: s = ["tenant:admin"], requireOrganizationMatch: c = !1, managementApiExtensions: l = [], entityHooks: u, getChildTenantIds: f, getAdapters: m, ...h } = e;
 	if (a && !n) throw Error("initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it.");
 	let g = t, _ = t;
-	n && (g = q(t, {
+	n && (g = K(t, {
 		controlPlaneTenantId: r,
 		controlPlaneClientId: i,
 		resolveControlPlane: a
 	}), _ = {
-		...W(t, {
+		...xe(t, {
 			controlPlaneTenantId: r,
 			resolveControlPlane: a
 		}),
@@ -1000,7 +1000,7 @@ function De(e) {
 		let e = {
 			tenantOperations: t.tenantOperations,
 			tenantOperationEvents: t.tenantOperationEvents
-		}, n = h.tenantUpgrade, r = j({
+		}, n = h.tenantUpgrade, r = te({
 			stores: e,
 			definitions: { upgrade: (e) => [{
 				name: "upgrade",
@@ -1012,70 +1012,70 @@ function De(e) {
 		});
 		v = {
 			engine: r.engine,
-			enqueue: (t) => N(e, r, {
+			enqueue: (t) => re(e, r, {
 				...t,
 				tenant_id: t.tenant_id
 			})
 		};
 	}
-	let y = o !== !1, ee = y ? {
+	let y = o !== !1, b = y ? {
 		resourceServers: o.resourceServers ?? !0,
 		roles: o.roles ?? !0
 	} : {
 		resourceServers: !1,
 		roles: !1
-	}, { entityHooks: b, tenantHooks: x } = I({
+	}, { entityHooks: x, tenantHooks: S } = V({
 		controlPlaneTenantId: r,
-		getChildTenantIds: p ?? (async () => (await u((e) => g.tenants.list(e), "tenants", {
+		getChildTenantIds: f ?? (async () => (await d((e) => g.tenants.list(e), "tenants", {
 			cursorField: "id",
 			pageSize: 100
 		})).filter((e) => e.id !== r).map((e) => e.id)),
 		getAdapters: m ?? (async () => g),
 		getControlPlaneAdapters: async () => g,
-		sync: ee
-	}), S = {
-		resourceServers: [b.resourceServers, ...d?.resourceServers ?? []],
-		roles: [b.roles, ...d?.roles ?? []],
-		connections: d?.connections ?? [],
-		tenants: d?.tenants ?? [],
-		rolePermissions: d?.rolePermissions ?? []
-	}, C = F({ accessControl: {
+		sync: b
+	}), C = {
+		resourceServers: [x.resourceServers, ...u?.resourceServers ?? []],
+		roles: [x.roles, ...u?.roles ?? []],
+		connections: u?.connections ?? [],
+		tenants: u?.tenants ?? [],
+		rolePermissions: u?.rolePermissions ?? []
+	}, w = F({ accessControl: {
 		controlPlaneTenantId: r,
 		requireOrganizationMatch: c,
 		defaultPermissions: s
-	} }), w = L({ accessControl: {
+	} }), T = H({ accessControl: {
 		controlPlaneTenantId: r,
 		requireOrganizationMatch: c,
 		defaultPermissions: s
 	} }, { tenants: {
 		async beforeCreate(e, t) {
-			return C.beforeCreate && (t = await C.beforeCreate(e, t)), x.beforeCreate && (t = await x.beforeCreate(e, t)), t;
+			return w.beforeCreate && (t = await w.beforeCreate(e, t)), S.beforeCreate && (t = await S.beforeCreate(e, t)), t;
 		},
 		async afterCreate(e, t) {
-			await C.afterCreate?.(e, t), await x.afterCreate?.(e, t);
+			await w.afterCreate?.(e, t), await S.afterCreate?.(e, t);
 		},
 		async beforeDelete(e, t) {
-			await C.beforeDelete?.(e, t), await x.beforeDelete?.(e, t);
+			await w.beforeDelete?.(e, t), await S.beforeDelete?.(e, t);
 		}
-	} }), { app: T } = f({
+	} }), { app: E } = p({
 		dataAdapter: g,
 		managementDataAdapter: _,
 		...h,
 		tenantOperationExecutor: v,
-		entityHooks: S,
+		entityHooks: C,
 		managementApiExtensions: [...l, {
 			path: "/tenants",
-			router: w
+			router: T
 		}]
 	});
-	return T.use("/api/v2/*", Ce(r)), y && T.use("/api/v2/*", R()), {
-		app: T,
+	return E.use("/api/v2/*", Te(r)), y && E.use("/api/v2/*", U()), {
+		app: E,
 		controlPlaneTenantId: r
 	};
 }
 //#endregion
 //#region src/rollout/defaults-projection.ts
-function Y(e = {}) {
+function J(e = {}) {
 	return {
 		connections: e.connections ?? !0,
 		resourceServers: e.resourceServers ?? !0,
@@ -1085,28 +1085,28 @@ function Y(e = {}) {
 		promptSettings: e.promptSettings ?? !0
 	};
 }
-function X() {
+function Y() {
 	return {
 		upserted: 0,
 		errors: []
 	};
 }
-function Oe(e) {
+function Ae(e) {
 	return {
 		tenantId: e,
-		connections: X(),
-		resourceServers: X(),
-		hooks: X(),
-		emailProvider: X(),
-		branding: X(),
-		promptSettings: X()
+		connections: Y(),
+		resourceServers: Y(),
+		hooks: Y(),
+		emailProvider: Y(),
+		branding: Y(),
+		promptSettings: Y()
 	};
 }
-function ke(e) {
+function je(e) {
 	let t = e.metadata;
 	return !!(t && t.inheritable === !0);
 }
-async function Z(e, t, n, r) {
+async function X(e, t, n, r) {
 	try {
 		await r();
 	} catch (r) {
@@ -1115,17 +1115,17 @@ async function Z(e, t, n, r) {
 		e.errors.push(i);
 	}
 }
-async function Ae(e, t, n) {
+async function Me(e, t, n) {
 	return {
-		connections: n.connections ? await u((n) => e.connections.list(t, n), "connections", {
+		connections: n.connections ? await d((n) => e.connections.list(t, n), "connections", {
 			cursorField: "id",
 			pageSize: 100
 		}) : [],
-		resourceServers: n.resourceServers ? await u((n) => e.resourceServers.list(t, n), "resource_servers", {
+		resourceServers: n.resourceServers ? await d((n) => e.resourceServers.list(t, n), "resource_servers", {
 			cursorField: "id",
 			pageSize: 100
 		}) : [],
-		hooks: n.hooks ? await u((n) => e.hooks.list(t, n), "hooks", {
+		hooks: n.hooks ? await d((n) => e.hooks.list(t, n), "hooks", {
 			cursorField: "hook_id",
 			pageSize: 100
 		}) : [],
@@ -1134,47 +1134,47 @@ async function Ae(e, t, n) {
 		promptSettings: n.promptSettings ? await e.promptSettings.get(t) ?? null : null
 	};
 }
-async function je(e, t, n, r, i, o) {
+async function Ne(e, t, n, r, i, o) {
 	if (r.connections) for (let r of e.connections) {
 		let e = r.id;
-		e && await Z(o.connections, `connection ${e}`, i, async () => {
+		e && await X(o.connections, `connection ${e}`, i, async () => {
 			let i = a.parse(r);
 			await t.connections.get(n, e) ? await t.connections.update(n, e, i) : await t.connections.create(n, i), o.connections.upserted += 1;
 		});
 	}
-	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await Z(o.resourceServers, `resource_server ${r.id}`, i, async () => {
-		let e = _.parse(r);
+	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await X(o.resourceServers, `resource_server ${r.id}`, i, async () => {
+		let e = v.parse(r);
 		await t.resourceServers.get(n, r.id) ? await t.resourceServers.update(n, r.id, e) : await t.resourceServers.create(n, e), o.resourceServers.upserted += 1;
 	});
-	if (r.hooks) for (let r of e.hooks) !ke(r) || !r.hook_id || await Z(o.hooks, `hook ${r.hook_id}`, i, async () => {
-		let e = d.parse(r);
+	if (r.hooks) for (let r of e.hooks) !je(r) || !r.hook_id || await X(o.hooks, `hook ${r.hook_id}`, i, async () => {
+		let e = f.parse(r);
 		await t.hooks.get(n, r.hook_id) ? await t.hooks.update(n, r.hook_id, e) : await t.hooks.create(n, e), o.hooks.upserted += 1;
 	});
-	r.emailProvider && e.emailProvider && await Z(o.emailProvider, "email_provider", i, async () => {
+	r.emailProvider && e.emailProvider && await X(o.emailProvider, "email_provider", i, async () => {
 		let r = e.emailProvider;
 		await t.emailProviders.get(n) ? await t.emailProviders.update(n, r) : await t.emailProviders.create(n, r), o.emailProvider.upserted += 1;
-	}), r.branding && e.branding && await Z(o.branding, "branding", i, async () => {
+	}), r.branding && e.branding && await X(o.branding, "branding", i, async () => {
 		await t.branding.set(n, e.branding), o.branding.upserted += 1;
-	}), r.promptSettings && e.promptSettings && await Z(o.promptSettings, "prompt_settings", i, async () => {
+	}), r.promptSettings && e.promptSettings && await X(o.promptSettings, "prompt_settings", i, async () => {
 		await t.promptSettings.set(n, e.promptSettings), o.promptSettings.upserted += 1;
 	});
 }
-async function Q(e, t) {
-	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = Y(a), c = await Ae(await r(), n, s), l = await i(t), u = Oe(t);
-	return await je(c, l, n, s, o, u), u;
+async function Z(e, t) {
+	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = J(a), c = await Me(await r(), n, s), l = await i(t), u = Ae(t);
+	return await Ne(c, l, n, s, o, u), u;
 }
 //#endregion
 //#region src/rollout/payload.ts
-function Me(e) {
+function Pe(e) {
 	let { pkcs7: t, tenant_id: n, ...r } = e;
 	return r;
 }
-async function Ne(e, t, n = {}, r) {
-	let i = Y(n), a = n.signingKeys ?? !0, o = n.tenants ?? !0, s = await Ae(e, t, i), c = a ? (await m(e.keys)).map(Me) : [], l = o ? await Pe(e, t, r) : [];
+async function Fe(e, t, n = {}, r) {
+	let i = J(n), a = n.signingKeys ?? !0, o = n.tenants ?? !0, s = await Me(e, t, i), c = a ? (await h(e.keys)).map(Pe) : [], l = o ? await Ie(e, t, r) : [];
 	return {
 		connections: s.connections,
 		resourceServers: s.resourceServers.filter((e) => e.is_system),
-		hooks: s.hooks.filter(ke),
+		hooks: s.hooks.filter(je),
 		emailProvider: s.emailProvider,
 		branding: s.branding,
 		promptSettings: s.promptSettings,
@@ -1182,7 +1182,7 @@ async function Ne(e, t, n = {}, r) {
 		tenants: l
 	};
 }
-async function Pe(e, t, n) {
+async function Ie(e, t, n) {
 	let r = n && n !== t ? [t, n] : [t], i = [];
 	for (let t of r) {
 		let n = await e.tenants.get(t);
@@ -1193,19 +1193,19 @@ async function Pe(e, t, n) {
 	}
 	return i;
 }
-async function Fe(e, t, n) {
-	let r = X();
+async function Le(e, t, n) {
+	let r = Y();
 	if (e.length === 0) return r;
-	let i = await m(t.keys), a = new Set(i.map((e) => e.kid));
-	for (let i of e) await Z(r, `signing_key ${i.kid}`, n, async () => {
-		let e = Me(i);
+	let i = await h(t.keys), a = new Set(i.map((e) => e.kid));
+	for (let i of e) await X(r, `signing_key ${i.kid}`, n, async () => {
+		let e = Pe(i);
 		a.has(e.kid) || (await t.keys.create(e), a.add(e.kid), r.upserted += 1);
 	});
 	return r;
 }
-async function Ie(e, t, n) {
-	let r = X();
-	for (let i of e) await Z(r, `tenant ${i.id}`, n, async () => {
+async function Re(e, t, n) {
+	let r = Y();
+	for (let i of e) await X(r, `tenant ${i.id}`, n, async () => {
 		await t.tenants.get(i.id) || (await t.tenants.create({
 			id: i.id,
 			friendly_name: i.friendly_name
@@ -1213,17 +1213,17 @@ async function Ie(e, t, n) {
 	});
 	return r;
 }
-async function Le(e, t, n, r = {}) {
-	let a = r.continueOnError ?? !1, o = Y(r.entities), s = r.entities?.signingKeys ?? !0, c = r.entities?.tenants ?? !0, u = {
+async function ze(e, t, n, r = {}) {
+	let a = r.continueOnError ?? !1, o = J(r.entities), s = r.entities?.signingKeys ?? !0, c = r.entities?.tenants ?? !0, u = {
 		connections: e.connections,
 		resourceServers: e.resourceServers,
 		hooks: e.hooks,
 		emailProvider: e.emailProvider ? l.parse(e.emailProvider) : null,
 		branding: e.branding ? i.parse(e.branding) : null,
-		promptSettings: e.promptSettings ? h.parse(e.promptSettings) : null
-	}, d = c ? await Ie(e.tenants ?? [], t, a) : X(), f = Oe(n);
-	await je(u, t, n, o, a, f);
-	let p = s ? await Fe(e.signingKeys, t, a) : X();
+		promptSettings: e.promptSettings ? g.parse(e.promptSettings) : null
+	}, d = c ? await Re(e.tenants ?? [], t, a) : Y(), f = Ae(n);
+	await Ne(u, t, n, o, a, f);
+	let p = s ? await Le(e.signingKeys, t, a) : Y();
 	return {
 		...f,
 		signingKeys: p,
@@ -1232,27 +1232,27 @@ async function Le(e, t, n, r = {}) {
 }
 //#endregion
 //#region src/rollout/index.ts
-function Re(e) {
+function Be(e) {
 	return {
-		syncDefaults: (t) => Q(e, t),
+		syncDefaults: (t) => Z(e, t),
 		syncDefaultsToTenants: async (t) => {
 			let n = [];
-			for (let r of t) n.push(await Q(e, r));
+			for (let r of t) n.push(await Z(e, r));
 			return n;
 		}
 	};
 }
 //#endregion
 //#region src/plugin.ts
-function ze(e) {
-	let t = $(e);
+function Ve(e) {
+	let t = Q(e);
 	return {
 		name: "multi-tenancy",
-		middleware: J(e),
+		middleware: q(e),
 		hooks: t,
 		routes: [{
 			path: "/management",
-			handler: L(e, t)
+			handler: H(e, t)
 		}],
 		onRegister: async () => {
 			console.log("Multi-tenancy plugin registered"), e.accessControl && console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`), e.subdomainRouting && console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`), e.databaseIsolation && console.log("  - Database isolation enabled");
@@ -1261,29 +1261,29 @@ function ze(e) {
 }
 //#endregion
 //#region src/index.ts
-function $(e) {
-	let t = e.accessControl ? C(e.accessControl) : {}, n = e.databaseIsolation ? T(e.databaseIsolation) : {}, r = F(e);
+function Q(e) {
+	let t = e.accessControl ? T(e.accessControl) : {}, n = e.databaseIsolation ? D(e.databaseIsolation) : {}, r = F(e);
 	return {
 		...t,
 		...n,
 		tenants: r
 	};
 }
-function Be(t) {
-	let n = new e(), r = $(t);
-	return n.route("/tenants", L(t, r)), n;
+function $(t) {
+	let n = new e(), r = Q(t);
+	return n.route("/tenants", H(t, r)), n;
 }
-function Ve(e) {
+function He(e) {
 	return {
-		hooks: $(e),
-		middleware: J(e),
-		app: Be(e),
+		hooks: Q(e),
+		middleware: q(e),
+		app: $(e),
 		config: e,
-		wrapAdapters: (t, n) => q(t, {
+		wrapAdapters: (t, n) => K(t, {
 			controlPlaneTenantId: e.accessControl?.controlPlaneTenantId,
 			controlPlaneClientId: n?.controlPlaneClientId
 		})
 	};
 }
 //#endregion
-export { Le as applyControlPlaneDefaultsPayload, Ne as buildControlPlaneDefaultsPayload, te as buildEngineInstanceId, C as createAccessControlHooks, we as createAccessControlMiddleware, Ce as createControlPlaneTenantMiddleware, T as createDatabaseHooks, Ee as createDatabaseMiddleware, Re as createDirectRolloutAdapter, j as createInlineExecutor, Be as createMultiTenancy, $ as createMultiTenancyHooks, J as createMultiTenancyMiddleware, ze as createMultiTenancyPlugin, k as createOperationRecorder, R as createProtectSyncedMiddleware, F as createProvisioningHooks, G as createRuntimeFallbackAdapter, Te as createSubdomainMiddleware, I as createSyncHooks, L as createTenantsOpenAPIRouter, N as enqueueTenantOperation, O as errorToMessage, De as initMultiTenant, A as inlineStepRunner, re as isTerminalStatus, xe as mergeClientWithFallback, Q as projectControlPlaneDefaults, P as runRecordedTenantOperation, Ve as setupMultiTenancy, w as validateTenantAccess, q as withRuntimeFallback, W as withSystemResourceServerInheritance };
+export { ze as applyControlPlaneDefaultsPayload, Fe as buildControlPlaneDefaultsPayload, A as buildEngineInstanceId, T as createAccessControlHooks, Ee as createAccessControlMiddleware, Te as createControlPlaneTenantMiddleware, D as createDatabaseHooks, Oe as createDatabaseMiddleware, Be as createDirectRolloutAdapter, te as createInlineExecutor, $ as createMultiTenancy, Q as createMultiTenancyHooks, q as createMultiTenancyMiddleware, Ve as createMultiTenancyPlugin, M as createOperationRecorder, U as createProtectSyncedMiddleware, F as createProvisioningHooks, Se as createRuntimeFallbackAdapter, De as createSubdomainMiddleware, V as createSyncHooks, H as createTenantsOpenAPIRouter, re as enqueueTenantOperation, j as errorToMessage, ke as initMultiTenant, P as inlineStepRunner, N as isTerminalStatus, ve as mergeClientWithFallback, Z as projectControlPlaneDefaults, ae as runRecordedTenantOperation, He as setupMultiTenancy, E as validateTenantAccess, K as withRuntimeFallback, xe as withSystemResourceServerInheritance };