@authhero/multi-tenancy 15.1.1 → 15.2.0

package/dist/multi-tenancy.mjs

@@ -1,9 +1,9 @@
 import { Hono as e } from "hono";
-import { MANAGEMENT_API_AUDIENCE as t, MANAGEMENT_API_SCOPES as n, auth0QuerySchema as r, brandingSchema as i, connectionInsertSchema as a, connectionOptionsSchema as o, connectionSchema as s, deepMergePatch as c, emailProviderSchema as l, escapeLuceneValue as u, fetchAll as d, hookInsertSchema as f, init as p, isInteractiveClient as m, listControlPlaneKeys as h, promptSettingSchema as g, provisionDefaultClients as _, resourceServerInsertSchema as v, tenantInsertSchema as y, tenantSchema as b } from "authhero";
-import { OpenAPIHono as x, createRoute as S, z as C } from "@hono/zod-openapi";
-import { HTTPException as w } from "hono/http-exception";
+import { LogTypes as t, MANAGEMENT_API_AUDIENCE as n, MANAGEMENT_API_SCOPES as r, auth0QuerySchema as i, brandingSchema as a, connectionInsertSchema as o, connectionOptionsSchema as s, connectionSchema as c, deepMergePatch as l, emailProviderSchema as u, escapeLuceneValue as d, fetchAll as f, hookInsertSchema as p, init as m, isInteractiveClient as h, listControlPlaneKeys as g, promptSettingSchema as _, provisionDefaultClients as v, resourceServerInsertSchema as y, tenantInsertSchema as b, tenantSchema as x } from "authhero";
+import { OpenAPIHono as S, createRoute as C, z as w } from "@hono/zod-openapi";
+import { HTTPException as T } from "hono/http-exception";
 //#region src/hooks/access-control.ts
-function T(e) {
+function E(e) {
 	let { controlPlaneTenantId: t, requireOrganizationMatch: n = !0 } = e;
 	return { async onTenantAccessValidation(e, r) {
 		if (r === t) return !0;
@@ -14,14 +14,14 @@ function T(e) {
 		return !0;
 	} };
 }
-function E(e, t, n, r) {
+function D(e, t, n, r) {
 	if (t === n) return !0;
 	let i = r || e;
 	return i ? i.toLowerCase() === t.toLowerCase() : !1;
 }
 //#endregion
 //#region src/hooks/database.ts
-function D(e) {
+function ee(e) {
 	return { async resolveDataAdapters(t) {
 		try {
 			return await e.getAdapters(t);
@@ -43,7 +43,7 @@ function A(e) {
 }
 //#endregion
 //#region src/operations/recorder.ts
-var ee = 2048;
+var te = 2048;
 function j(e) {
 	let t;
 	if (e instanceof Error) t = e.message;
@@ -52,7 +52,7 @@ function j(e) {
 	} catch {
 		t = Object.prototype.toString.call(e);
 	}
-	return t.slice(0, ee);
+	return t.slice(0, te);
 }
 function M(e) {
 	let { tenantOperations: t, tenantOperationEvents: n } = e;
@@ -91,17 +91,17 @@ function M(e) {
 		}
 	};
 }
-function N(e) {
+function ne(e) {
 	return e === "succeeded" || e === "failed" || e === "cancelled";
 }
 //#endregion
 //#region src/operations/inline-executor.ts
-var te = { async do(e, t, n) {
+var re = { async do(e, t, n) {
 	let r = typeof t == "function" ? t : n;
 	if (!r) throw Error("StepRunner.do called without a function");
 	return r();
 } };
-function ne(e) {
+function ie(e) {
 	let t = M(e.stores);
 	return {
 		engine: "inline",
@@ -121,7 +121,7 @@ function ne(e) {
 				try {
 					let r = await e.run({
 						operation: n,
-						step: te
+						step: re
 					});
 					await t.appendEvent(n.id, {
 						step: e.name,
@@ -142,7 +142,7 @@ function ne(e) {
 }
 //#endregion
 //#region src/operations/enqueue.ts
-async function re(e, t, n) {
+async function ae(e, t, n) {
 	let r = await e.tenantOperations.create({
 		tenant_id: t.tenant_id,
 		rollout_id: t.rollout_id,
@@ -165,14 +165,14 @@ async function re(e, t, n) {
 		engine_instance_id: i
 	};
 }
-async function ie(e, t, n) {
-	let r = M(e), i = await re(e, n, t.engine);
+async function oe(e, t, n) {
+	let r = M(e), i = await ae(e, n, t.engine);
 	try {
 		await t.start(i);
 	} catch (t) {
 		try {
 			let n = await e.tenantOperations.get(i.id);
-			n && !N(n.status) && await r.markFailed(i.id, t);
+			n && !ne(n.status) && await r.markFailed(i.id, t);
 		} catch (e) {
 			console.warn("Failed to record tenant operation failure:", e);
 		}
@@ -186,14 +186,14 @@ async function ie(e, t, n) {
 }
 //#endregion
 //#region src/operations/record-provision.ts
-function ae(e) {
+function se(e) {
 	if (e.tenantOperations && e.tenantOperationEvents) return {
 		tenantOperations: e.tenantOperations,
 		tenantOperationEvents: e.tenantOperationEvents
 	};
 }
-async function oe(e, t, n) {
-	let r = ae(e);
+async function ce(e, t, n) {
+	let r = se(e);
 	if (!r) {
 		await n(void 0);
 		return;
@@ -206,7 +206,7 @@ async function oe(e, t, n) {
 		}
 	}, o;
 	if (await a(async () => {
-		let e = await re(r, t, "inline");
+		let e = await ae(r, t, "inline");
 		o = e.id, await i.markRunning(e.id);
 	}), !o) {
 		await n(void 0);
@@ -241,30 +241,30 @@ async function oe(e, t, n) {
 }
 //#endregion
 //#region src/hooks/provisioning.ts
-function se(e) {
+function le(e) {
 	return `urn:authhero:tenant:${e.toLowerCase()}`;
 }
-function P(e) {
+function N(e) {
 	return {
 		async beforeCreate(e, t) {
 			return !t.audience && t.id ? {
 				...t,
-				audience: se(t.id)
+				audience: le(t.id)
 			} : t;
 		},
-		async afterCreate(r, i) {
+		async afterCreate(t, i) {
 			let { accessControl: a, databaseIsolation: o } = e;
-			if (a && r.ctx && await ce(r, i, a), o?.onProvision) {
+			if (a && t.ctx && await ue(t, i, a), o?.onProvision) {
 				let e = o.onProvision;
-				o.recordProvisionOperations === !1 ? await e(i.id) : await oe(r.adapters, {
+				o.recordProvisionOperations === !1 ? await e(i.id) : await ce(t.adapters, {
 					kind: "provision",
 					tenant_id: i.id,
-					initiated_by: r.ctx?.var.user?.sub
+					initiated_by: t.ctx?.var.user?.sub
 				}, (t) => e(i.id, t));
 			} else try {
-				await _(r.adapters, i.id, {
-					managementApiIdentifier: t,
-					managementApiScopes: n
+				await v(t.adapters, i.id, {
+					managementApiIdentifier: n,
+					managementApiScopes: r
 				});
 			} catch (e) {
 				throw console.warn(`Failed to provision default clients for tenant ${i.id}:`, e), e;
@@ -286,14 +286,14 @@ function P(e) {
 		}
 	};
 }
-async function ce(e, t, n) {
+async function ue(e, t, n) {
 	let { controlPlaneTenantId: r, defaultPermissions: i, defaultRoles: a, issuer: o, adminRoleName: s = "Tenant Admin", adminRoleDescription: c = "Full access to all tenant management operations", addCreatorToOrganization: l = !0 } = n, u = await e.adapters.organizations.create(r, {
 		name: t.id,
 		display_name: t.friendly_name || t.id
 	}), d;
-	if (o && (d = await ue(e, r, s, c)), l && e.ctx) {
+	if (o && (d = await fe(e, r, s, c)), l && e.ctx) {
 		let t = e.ctx.var.user;
-		if (t?.sub && !await le(e, r, t.sub)) try {
+		if (t?.sub && !await de(e, r, t.sub)) try {
 			await e.adapters.userOrganizations.create(r, {
 				user_id: t.sub,
 				organization_id: u.id
@@ -304,31 +304,31 @@ async function ce(e, t, n) {
 	}
 	a && a.length > 0 && console.log(`Would assign roles ${a.join(", ")} to organization ${u.id}`), i && i.length > 0 && console.log(`Would grant permissions ${i.join(", ")} to organization ${u.id}`);
 }
-async function le(e, n, r) {
-	let i = await e.adapters.userRoles.list(n, r, void 0, "");
-	for (let r of i) if ((await e.adapters.rolePermissions.list(n, r.id, { per_page: 1e3 })).some((e) => e.permission_name === "admin:organizations" && e.resource_server_identifier === t)) return !0;
+async function de(e, t, r) {
+	let i = await e.adapters.userRoles.list(t, r, void 0, "");
+	for (let r of i) if ((await e.adapters.rolePermissions.list(t, r.id, { per_page: 1e3 })).some((e) => e.permission_name === "admin:organizations" && e.resource_server_identifier === n)) return !0;
 	return !1;
 }
-async function ue(e, r, i, a) {
-	let o = (await e.adapters.roles.list(r, {})).roles.find((e) => e.name === i);
+async function fe(e, t, i, a) {
+	let o = (await e.adapters.roles.list(t, {})).roles.find((e) => e.name === i);
 	if (o) return o.id;
-	let s = await e.adapters.roles.create(r, {
+	let s = await e.adapters.roles.create(t, {
 		name: i,
 		description: a
-	}), c = t, l = n.map((e) => ({
+	}), c = n, l = r.map((e) => ({
 		role_id: s.id,
 		resource_server_identifier: c,
 		permission_name: e.value
 	}));
-	return await e.adapters.rolePermissions.assign(r, s.id, l), s.id;
+	return await e.adapters.rolePermissions.assign(t, s.id, l), s.id;
 }
 //#endregion
 //#region src/hooks/sync.ts
-function F(e, t, n = () => !0) {
+function pe(e, t, n = () => !0) {
 	let { controlPlaneTenantId: r, getChildTenantIds: i, getAdapters: a } = e, o = /* @__PURE__ */ new Map();
 	async function s(e, n, r) {
 		return (await t(e).list(n, {
-			q: `name:${u(r)}`,
+			q: `name:${d(r)}`,
 			per_page: 1
 		}))[0] ?? null;
 	}
@@ -379,11 +379,11 @@ function F(e, t, n = () => !0) {
 		}
 	};
 }
-function I(e, t, n = () => !0) {
+function me(e, t, n = () => !0) {
 	let { controlPlaneTenantId: r, getControlPlaneAdapters: i, getAdapters: a } = e;
 	return { async afterCreate(e, o) {
 		if (o.id !== r) try {
-			let e = await i(), s = await a(o.id), c = t(e), l = t(s), u = await d((e) => c.listPaginated(r, e), c.listKey, {
+			let e = await i(), s = await a(o.id), c = t(e), l = t(s), u = await f((e) => c.listPaginated(r, e), c.listKey, {
 				cursorField: "id",
 				pageSize: 100
 			});
@@ -403,7 +403,7 @@ function I(e, t, n = () => !0) {
 		}
 	} };
 }
-var L = (e) => ({
+var he = (e) => ({
 	list: async (t, n) => (await e.resourceServers.list(t, n)).resource_servers,
 	listPaginated: (t, n) => e.resourceServers.list(t, n),
 	get: (t, n) => e.resourceServers.get(t, n),
@@ -421,7 +421,7 @@ var L = (e) => ({
 		token_lifetime: e.token_lifetime,
 		token_lifetime_for_web: e.token_lifetime_for_web
 	})
-}), R = (e) => ({
+}), ge = (e) => ({
 	list: async (t, n) => (await e.roles.list(t, n)).roles,
 	listPaginated: (t, n) => e.roles.list(t, n),
 	get: (t, n) => e.roles.get(t, n),
@@ -436,15 +436,15 @@ var L = (e) => ({
 		description: e.description
 	})
 });
-function z(e) {
+function _e(e) {
 	return e.metadata?.sync !== !1;
 }
-function B(e) {
-	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => z(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => z(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? F(e, L, a) : void 0, c = i ? F(e, R, o) : void 0, l = r ? I(e, L, a) : void 0, f = i ? I(e, R, o) : void 0, p = i ? { async afterCreate(t, r) {
+function ve(e) {
+	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => _e(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => _e(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? pe(e, he, a) : void 0, c = i ? pe(e, ge, o) : void 0, l = r ? me(e, he, a) : void 0, u = i ? me(e, ge, o) : void 0, p = i ? { async afterCreate(t, r) {
 		if (r.id !== e.controlPlaneTenantId) {
-			await f?.afterCreate?.(t, r);
+			await u?.afterCreate?.(t, r);
 			try {
-				let t = await e.getControlPlaneAdapters(), i = await e.getAdapters(r.id), a = await d((n) => t.roles.list(e.controlPlaneTenantId, n), "roles", {
+				let t = await e.getControlPlaneAdapters(), i = await e.getAdapters(r.id), a = await f((n) => t.roles.list(e.controlPlaneTenantId, n), "roles", {
 					cursorField: "id",
 					pageSize: 100
 				}), o = /* @__PURE__ */ new Map();
@@ -472,7 +472,7 @@ function B(e) {
 	} } : void 0;
 	async function m(e, t, n) {
 		return (await e.roles.list(t, {
-			q: `name:${u(n)}`,
+			q: `name:${d(n)}`,
 			per_page: 1
 		})).roles[0] ?? null;
 	}
@@ -482,7 +482,7 @@ function B(e) {
 			roles: c
 		},
 		tenantHooks: { async afterCreate(e, t) {
-			let n = [l?.afterCreate, p?.afterCreate ?? f?.afterCreate], r = [];
+			let n = [l?.afterCreate, p?.afterCreate ?? u?.afterCreate], r = [];
 			for (let i of n) if (i) try {
 				await i(e, t);
 			} catch (e) {
@@ -495,47 +495,71 @@ function B(e) {
 }
 //#endregion
 //#region src/middleware/request-data.ts
-function V(e) {
+function P(e) {
 	return e.var.data ?? e.env.data;
 }
+async function ye(e) {
+	let { tenantId: t, parentTenantId: n, getTenant: r, getChildren: i } = e, a = e.maxDepth ?? 2;
+	if (!n) return;
+	if (t && n === t) throw new T(400, { message: "A tenant cannot be its own parent" });
+	let o = new Set(t ? [t] : []), s = 0, c = n;
+	for (; c;) {
+		if (o.has(c)) throw new T(400, { message: `Setting parent_tenant_id to '${n}' would create a cycle` });
+		o.add(c);
+		let e = await r(c);
+		if (!e) throw new T(400, { message: `Parent tenant '${c}' not found` });
+		if (s += 1, s > a) throw new T(400, { message: `Tenant tree is limited to ${a} levels above a tenant` });
+		c = e.parent_tenant_id;
+	}
+	if (t && i) {
+		let e = new Set([t]), r = 0, o = [t];
+		for (; o.length > 0;) {
+			let t = [];
+			for (let n of o) for (let r of await i(n)) e.has(r) || (e.add(r), t.push(r));
+			if (t.length > 0 && (r += 1, s + r > a)) throw new T(400, { message: `Moving tenant under '${n}' would make its descendant '${t[0]}' exceed the tenant tree limit of ${a} levels` });
+			o = t;
+		}
+	}
+}
 //#endregion
 //#region src/routes/tenants.ts
-var de = C.object({
-	sub: C.string(),
-	tenant_id: C.string().optional(),
-	org_id: C.string().optional(),
-	scope: C.string().optional(),
-	permissions: C.array(C.string()).optional()
+var be = w.object({
+	sub: w.string(),
+	tenant_id: w.string().optional(),
+	org_id: w.string().optional(),
+	scope: w.string().optional(),
+	permissions: w.array(w.string()).optional()
 }).passthrough();
-function fe(e) {
-	let t = de.safeParse(e);
+function xe(e) {
+	let t = be.safeParse(e);
 	return t.success ? t.data : void 0;
 }
-function pe(e) {
+function Se(e) {
 	let t = e.permissions ?? [], n = e.scope ? e.scope.split(" ").filter(Boolean) : [], r = new Set([...t, ...n]);
 	return r.has("delete:tenants") || r.has("admin:organizations");
 }
-function H(e, t) {
-	let n = new x();
-	return n.openapi(S({
+function F(e, t) {
+	let n = new S();
+	return n.openapi(C({
 		tags: ["tenants"],
 		method: "get",
 		path: "/",
-		request: { query: r },
+		request: { query: i },
 		security: [{ Bearer: [] }],
 		responses: { 200: {
-			content: { "application/json": { schema: C.object({
-				tenants: C.array(b),
-				start: C.number().optional(),
-				limit: C.number().optional(),
-				length: C.number().optional()
+			content: { "application/json": { schema: w.object({
+				tenants: w.array(x),
+				start: w.number().optional(),
+				limit: w.number().optional(),
+				length: w.number().optional(),
+				total: w.number().optional()
 			}) } },
 			description: "List of tenants"
 		} }
 	}), async (t) => {
 		let { page: n, per_page: r, include_totals: i, q: a } = t.req.valid("query"), o = t.var.user, s = o?.permissions || [];
 		if (!(o?.org_id ?? t.var.organization_id) && s.includes("admin:organizations")) {
-			let e = await V(t).tenants.list({
+			let e = await P(t).tenants.list({
 				page: n,
 				per_page: r,
 				include_totals: i,
@@ -545,39 +569,43 @@ function H(e, t) {
 				tenants: e.tenants,
 				start: e.totals?.start ?? 0,
 				limit: e.totals?.limit ?? r,
-				length: e.tenants.length
+				length: e.tenants.length,
+				total: e.totals?.length
 			}) : t.json({ tenants: e.tenants });
 		}
-		let c = e.accessControl?.controlPlaneTenantId ?? V(t).multiTenancyConfig?.controlPlaneTenantId;
-		if (c && !o?.sub) throw new w(403, { message: "Access denied: token has no subject" });
+		let c = e.accessControl?.controlPlaneTenantId ?? P(t).multiTenancyConfig?.controlPlaneTenantId;
+		if (c && !o?.sub) throw new T(403, { message: "Access denied: token has no subject" });
 		if (c && o?.sub) {
-			let e = (await d((e) => V(t).userOrganizations.listUserOrganizations(c, o.sub, e), "organizations")).map((e) => e.name);
+			let e = (await f((e) => P(t).userOrganizations.listUserOrganizations(c, o.sub, e), "organizations")).map((e) => e.name);
 			if (e.length === 0) return i ? t.json({
 				tenants: [],
 				start: 0,
 				limit: r ?? 50,
-				length: 0
+				length: 0,
+				total: 0
 			}) : t.json({ tenants: [] });
-			let s = e.length, l = n ?? 0, u = r ?? 50, f = l * u, p = e.slice(f, f + u);
+			let s = e.length, l = n ?? 0, u = r ?? 50, d = l * u, p = e.slice(d, d + u);
 			if (p.length === 0) return i ? t.json({
 				tenants: [],
-				start: f,
+				start: d,
 				limit: u,
-				length: s
+				length: 0,
+				total: s
 			}) : t.json({ tenants: [] });
-			let m = p.map((e) => `id:${e}`).join(" OR "), h = a ? `(${m}) AND (${a})` : m, g = await V(t).tenants.list({
+			let m = p.map((e) => `id:${e}`).join(" OR "), h = a ? `(${m}) AND (${a})` : m, g = await P(t).tenants.list({
 				q: h,
 				per_page: u,
 				include_totals: !1
 			});
 			return i ? t.json({
 				tenants: g.tenants,
-				start: f,
+				start: d,
 				limit: u,
-				length: s
+				length: g.tenants.length,
+				total: s
 			}) : t.json({ tenants: g.tenants });
 		}
-		let l = await V(t).tenants.list({
+		let l = await P(t).tenants.list({
 			page: n,
 			per_page: r,
 			include_totals: i,
@@ -587,36 +615,41 @@ function H(e, t) {
 			tenants: l.tenants,
 			start: l.totals?.start ?? 0,
 			limit: l.totals?.limit ?? r,
-			length: l.tenants.length
+			length: l.tenants.length,
+			total: l.totals?.length
 		}) : t.json({ tenants: l.tenants });
-	}), n.openapi(S({
+	}), n.openapi(C({
 		tags: ["tenants"],
 		method: "post",
 		path: "/",
-		request: { body: { content: { "application/json": { schema: y } } } },
+		request: { body: { content: { "application/json": { schema: b } } } },
 		security: [{ Bearer: [] }],
 		responses: {
 			201: {
-				content: { "application/json": { schema: b } },
+				content: { "application/json": { schema: x } },
 				description: "Tenant created"
 			},
 			400: { description: "Validation error" },
 			409: { description: "Tenant with this ID already exists" }
 		}
 	}), async (e) => {
-		if (!e.var.user?.sub) throw new w(401, { message: "Authentication required to create tenants" });
+		if (!e.var.user?.sub) throw new T(401, { message: "Authentication required to create tenants" });
 		let n = e.req.valid("json"), r = {
-			adapters: V(e),
+			adapters: P(e),
 			ctx: e
 		};
-		t.tenants?.beforeCreate && (n = await t.tenants.beforeCreate(r, n));
-		let i = await V(e).tenants.create(n);
+		t.tenants?.beforeCreate && (n = await t.tenants.beforeCreate(r, n)), await ye({
+			tenantId: n.id,
+			parentTenantId: n.parent_tenant_id,
+			getTenant: (t) => P(e).tenants.get(t)
+		});
+		let i = await P(e).tenants.create(n);
 		return t.tenants?.afterCreate && await t.tenants.afterCreate(r, i), e.json(i, 201);
-	}), n.openapi(S({
+	}), n.openapi(C({
 		tags: ["tenants"],
 		method: "delete",
 		path: "/{id}",
-		request: { params: C.object({ id: C.string() }) },
+		request: { params: w.object({ id: w.string() }) },
 		security: [{ Bearer: ["delete:tenants"] }],
 		responses: {
 			204: { description: "Tenant deleted" },
@@ -624,72 +657,78 @@ function H(e, t) {
 			404: { description: "Tenant not found" }
 		}
 	}), async (n) => {
-		let { id: r } = n.req.valid("param"), i = e.accessControl?.controlPlaneTenantId ?? V(n).multiTenancyConfig?.controlPlaneTenantId;
+		let { id: r } = n.req.valid("param"), i = e.accessControl?.controlPlaneTenantId ?? P(n).multiTenancyConfig?.controlPlaneTenantId;
 		if (i) {
-			let e = fe(n.var.user);
-			if (!e?.sub) throw new w(401, { message: "Authentication required" });
-			if (r === i) throw new w(403, { message: "Cannot delete the control plane" });
+			let e = xe(n.var.user);
+			if (!e?.sub) throw new T(401, { message: "Authentication required" });
+			if (r === i) throw new T(403, { message: "Cannot delete the control plane" });
 			let t = n.var.org_name, a = r.toLowerCase(), o = !!t && t.toLowerCase() === a;
 			if (!o) {
 				let r = !!(e.org_id ?? n.var.organization_id ?? t), a = !e.tenant_id || e.tenant_id === i;
-				!r && a && pe(e) && (o = !0);
+				!r && a && Se(e) && (o = !0);
 			}
-			if (o ||= (await d((t) => V(n).userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new w(403, { message: "Access denied to this tenant" });
+			if (o ||= (await f((t) => P(n).userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new T(403, { message: "Access denied to this tenant" });
 		}
-		if (!await V(n).tenants.get(r)) throw new w(404, { message: "Tenant not found" });
+		if (!await P(n).tenants.get(r)) throw new T(404, { message: "Tenant not found" });
 		let a = {
-			adapters: V(n),
+			adapters: P(n),
 			ctx: n
 		};
-		return t.tenants?.beforeDelete && await t.tenants.beforeDelete(a, r), await V(n).tenants.remove(r), t.tenants?.afterDelete && await t.tenants.afterDelete(a, r), n.body(null, 204);
-	}), n.openapi(S({
+		return t.tenants?.beforeDelete && await t.tenants.beforeDelete(a, r), await P(n).tenants.remove(r), t.tenants?.afterDelete && await t.tenants.afterDelete(a, r), n.body(null, 204);
+	}), n.openapi(C({
 		tags: ["tenants", "settings"],
 		method: "get",
 		path: "/settings",
-		request: { headers: C.object({ "tenant-id": C.string().optional() }) },
+		request: { headers: w.object({ "tenant-id": w.string().optional() }) },
 		security: [{ Bearer: ["read:tenants"] }],
 		responses: { 200: {
-			content: { "application/json": { schema: b } },
+			content: { "application/json": { schema: x } },
 			description: "Current tenant settings"
 		} }
 	}), async (e) => {
-		let t = await V(e).tenants.get(e.var.tenant_id);
-		if (!t) throw new w(404, { message: "Tenant not found" });
+		let t = await P(e).tenants.get(e.var.tenant_id);
+		if (!t) throw new T(404, { message: "Tenant not found" });
 		return e.json(t);
-	}), n.openapi(S({
+	}), n.openapi(C({
 		tags: ["tenants", "settings"],
 		method: "patch",
 		path: "/settings",
 		request: {
-			headers: C.object({ "tenant-id": C.string().optional() }),
-			body: { content: { "application/json": { schema: C.object(y.shape).partial() } } }
+			headers: w.object({ "tenant-id": w.string().optional() }),
+			body: { content: { "application/json": { schema: w.object(b.shape).partial() } } }
 		},
 		security: [{ Bearer: ["update:tenants"] }],
 		responses: { 200: {
-			content: { "application/json": { schema: b } },
+			content: { "application/json": { schema: x } },
 			description: "Updated tenant settings"
 		} }
 	}), async (e) => {
-		let { id: t, ...n } = e.req.valid("json"), r = await V(e).tenants.get(e.var.tenant_id);
-		if (!r) throw new w(404, { message: "Tenant not found" });
+		let { id: t, ...n } = e.req.valid("json"), r = await P(e).tenants.get(e.var.tenant_id);
+		if (!r) throw new T(404, { message: "Tenant not found" });
 		if ("default_client_id" in n) {
 			let t = n.default_client_id;
 			if (typeof t == "string" && t.length > 0) {
-				let n = await V(e).clients.get(e.var.tenant_id, t);
-				if (!n) throw new w(400, { message: `Client with id '${t}' not found` });
-				if (!m(n)) throw new w(400, { message: `Client '${t}' is not an interactive client and cannot be used as the default client` });
+				let n = await P(e).clients.get(e.var.tenant_id, t);
+				if (!n) throw new T(400, { message: `Client with id '${t}' not found` });
+				if (!h(n)) throw new T(400, { message: `Client '${t}' is not an interactive client and cannot be used as the default client` });
 			}
 		}
-		let i = c(r, n);
-		await V(e).tenants.update(e.var.tenant_id, i);
-		let a = await V(e).tenants.get(e.var.tenant_id);
-		if (!a) throw new w(500, { message: "Failed to retrieve updated tenant" });
+		"parent_tenant_id" in n && await ye({
+			tenantId: e.var.tenant_id,
+			parentTenantId: n.parent_tenant_id,
+			getTenant: (t) => P(e).tenants.get(t),
+			getChildren: async (t) => (await f((t) => P(e).tenants.list(t), "tenants")).filter((e) => e.parent_tenant_id === t).map((e) => e.id)
+		});
+		let i = l(r, n);
+		await P(e).tenants.update(e.var.tenant_id, i);
+		let a = await P(e).tenants.get(e.var.tenant_id);
+		if (!a) throw new T(500, { message: "Failed to retrieve updated tenant" });
 		return e.json(a);
 	}), n;
 }
 //#endregion
 //#region src/middleware/protect-synced.ts
-function me(e) {
+function Ce(e) {
 	for (let { pattern: t, type: n } of [
 		{
 			pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
@@ -712,7 +751,7 @@ function me(e) {
 	}
 	return null;
 }
-async function he(e, t, n) {
+async function we(e, t, n) {
 	try {
 		switch (n.type) {
 			case "resource_server": return (await e.resourceServers.get(t, n.id))?.is_system === !0;
@@ -724,47 +763,495 @@ async function he(e, t, n) {
 		return !1;
 	}
 }
-function ge(e) {
+function Te(e) {
 	return {
 		resource_server: "resource server",
 		role: "role",
 		connection: "connection"
 	}[e];
 }
-function U() {
+function Ee() {
 	return async (e, t) => {
 		if (![
 			"PATCH",
 			"PUT",
 			"DELETE"
 		].includes(e.req.method)) return t();
-		let n = me(e.req.path);
+		let n = Ce(e.req.path);
 		if (!n) return t();
 		let r = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
 		if (!r) return t();
-		if (await he(V(e), r, n)) throw new w(403, { message: `This ${ge(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
+		if (await we(P(e), r, n)) throw new T(403, { message: `This ${Te(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
 		return t();
 	};
 }
 //#endregion
+//#region src/inheritance/chain.ts
+async function De(e) {
+	let { tenantId: t, getTenant: n, legacyControlPlane: r } = e, i = e.maxDepth ?? 2, a = await n(t);
+	if (!a?.parent_tenant_id) return r && r !== t ? [r] : [];
+	let o = [], s = new Set([t]), c = a.parent_tenant_id;
+	for (; c;) {
+		if (s.has(c)) throw new T(400, { message: `Tenant chain for '${t}' contains a cycle at '${c}'` });
+		if (s.add(c), o.length >= i) throw new T(400, { message: `Tenant chain for '${t}' is deeper than ${i}` });
+		let e = await n(c);
+		if (!e) break;
+		o.push(c), c = e.parent_tenant_id;
+	}
+	return o;
+}
+//#endregion
+//#region src/inheritance/legacy.ts
+function Oe(e) {
+	let t = {};
+	for (let n of e ?? []) n.value !== void 0 && (t[n.name] = n.value);
+	return t;
+}
+function ke(e, t) {
+	if (!e.inherit) return e;
+	let n = t.find((t) => t.name === e.name && t.is_system);
+	if (!n) return e;
+	let r = {
+		...Oe(n.secrets),
+		...Oe(e.secrets)
+	};
+	return {
+		...e,
+		code: n.code,
+		secrets: Object.entries(r).map(([e, t]) => ({
+			name: e,
+			value: t
+		}))
+	};
+}
+function Ae(e, t) {
+	if (!t) return e;
+	let n = new Set(e.hooks.map((e) => e.hook_id)), r = t.hooks.filter((e) => X(e) && !n.has(e.hook_id));
+	return {
+		connections: e.connections.map((e) => q(e, t.connections)),
+		resourceServers: e.resourceServers.map((e) => e.is_system ? Y(e, t.resourceServers.find((t) => t.id === e.id) ?? null) : e),
+		hooks: [...e.hooks, ...r],
+		actions: e.actions.map((e) => ke(e, t.actions)),
+		emailProvider: e.emailProvider ?? t.emailProvider,
+		branding: e.branding,
+		promptSettings: e.promptSettings
+	};
+}
+//#endregion
+//#region src/inheritance/types.ts
+var je = () => ({
+	connections: [],
+	resourceServers: [],
+	hooks: [],
+	actions: [],
+	emailProvider: null,
+	branding: null,
+	promptSettings: null
+});
+//#endregion
+//#region src/inheritance/merge.ts
+function I(e, t) {
+	if (t.scope) return t.scope;
+	switch (e) {
+		case "connection":
+		case "emailProvider": return "shared";
+		case "resourceServer":
+		case "action": return t.is_system ? "shared" : "local";
+		case "hook": return X(t) ? "shared" : "local";
+		default: return "local";
+	}
+}
+function L(e) {
+	return e.override ?? "fields";
+}
+var Me = /secret|password|private_key|api_key|token/i;
+function Ne(e, t) {
+	let n = { ...e ?? {} };
+	for (let [e, r] of Object.entries(t ?? {})) Me.test(e) && (n[e] = r);
+	return n;
+}
+function R(e, t) {
+	switch (L(e)) {
+		case "none": return {
+			...e,
+			id: t.id
+		};
+		case "secrets": return {
+			...e,
+			id: t.id,
+			options: Ne(e.options, t.options)
+		};
+		default: return {
+			...e,
+			...t,
+			options: {
+				...e.options ?? {},
+				...t.options ?? {}
+			}
+		};
+	}
+}
+function Pe(e, t) {
+	switch (L(e)) {
+		case "none": return {
+			...e,
+			id: t.id
+		};
+		case "secrets": return {
+			...e,
+			id: t.id,
+			signing_secret: t.signing_secret ?? e.signing_secret
+		};
+		default: return {
+			...t,
+			scopes: $e(t.scopes, e.scopes)
+		};
+	}
+}
+function Fe(e) {
+	return new Map((e ?? []).map((e) => [e.name, e]));
+}
+function Ie(e, t) {
+	let n = L(e);
+	if (n === "none") return {
+		...e,
+		id: t.id
+	};
+	let r = Fe(e.secrets);
+	if (n === "secrets" || n === "fields") for (let [e, n] of Fe(t.secrets)) r.set(e, n);
+	return {
+		...n === "fields" && !t.inherit ? t : e,
+		id: t.id,
+		secrets: [...r.values()]
+	};
+}
+function Le(e, t) {
+	let n = /* @__PURE__ */ new Set(), r = [...e].reverse().concat(t), i = (e, t, r, i) => r ? t : t.filter((t) => {
+		let r = I(e, t);
+		return r === "local" ? !1 : (r === "platform" && n.add(`${e}:${i(t)}`), !0);
+	}), a = je(), o = (e) => `${e.strategy}:${e.name}`, s = (e) => e.identifier, c = (e) => e.hook_id ?? "", l = (e) => e.name, u = /* @__PURE__ */ new Map(), d = [], f = /* @__PURE__ */ new Map(), p = /* @__PURE__ */ new Map(), m = /* @__PURE__ */ new Map();
+	r.forEach((e, t) => {
+		let h = t === r.length - 1;
+		for (let t of i("connection", e.connections, h, o)) {
+			let e = u.get(t.strategy);
+			h ? d.push(e ? R(e, t) : t) : u.set(t.strategy, e ? R(e, t) : t);
+		}
+		for (let t of i("resourceServer", e.resourceServers, h, s)) {
+			let e = f.get(s(t));
+			f.set(s(t), e ? Pe(e, t) : t);
+		}
+		for (let t of i("hook", e.hooks, h, c)) p.set(c(t), t);
+		for (let t of i("action", e.actions, h, l)) {
+			let e = m.get(l(t));
+			m.set(l(t), e ? Ie(e, t) : t);
+		}
+		for (let t of [
+			"emailProvider",
+			"branding",
+			"promptSettings"
+		]) {
+			let r = e[t];
+			r && (h || I(t, r) !== "local") && (!h && I(t, r) === "platform" && n.add(`${t}:singleton`), a[t] = r);
+		}
+	});
+	let h = new Set(r[r.length - 1].connections.map((e) => e.strategy));
+	return a.connections = [...d, ...[...u.values()].filter((e) => !h.has(e.strategy))], a.resourceServers = [...f.values()], a.hooks = [...p.values()], a.actions = [...m.values()], {
+		...a,
+		hidden: [...n]
+	};
+}
+//#endregion
+//#region src/rollout/defaults-projection.ts
+function z(e = {}) {
+	return {
+		connections: e.connections ?? !0,
+		resourceServers: e.resourceServers ?? !0,
+		hooks: e.hooks ?? !0,
+		emailProvider: e.emailProvider ?? !0,
+		branding: e.branding ?? !0,
+		promptSettings: e.promptSettings ?? !0
+	};
+}
+function B() {
+	return {
+		upserted: 0,
+		errors: []
+	};
+}
+function Re(e) {
+	return {
+		tenantId: e,
+		connections: B(),
+		resourceServers: B(),
+		hooks: B(),
+		emailProvider: B(),
+		branding: B(),
+		promptSettings: B()
+	};
+}
+function ze(e) {
+	let t = e.metadata;
+	return !!(t && t.inheritable === !0);
+}
+async function V(e, t, n, r) {
+	try {
+		await r();
+	} catch (r) {
+		let i = `${t}: ${r instanceof Error ? r.message : String(r)}`;
+		if (!n) throw Error(i, { cause: r });
+		e.errors.push(i);
+	}
+}
+async function H(e, t, n) {
+	return {
+		connections: n.connections ? await f((n) => e.connections.list(t, n), "connections", {
+			cursorField: "id",
+			pageSize: 100
+		}) : [],
+		resourceServers: n.resourceServers ? await f((n) => e.resourceServers.list(t, n), "resource_servers", {
+			cursorField: "id",
+			pageSize: 100
+		}) : [],
+		hooks: n.hooks ? await f((n) => e.hooks.list(t, n), "hooks", {
+			cursorField: "hook_id",
+			pageSize: 100
+		}) : [],
+		emailProvider: n.emailProvider ? await e.emailProviders.get(t) ?? null : null,
+		branding: n.branding ? await e.branding.get(t) ?? null : null,
+		promptSettings: n.promptSettings ? await e.promptSettings.get(t) ?? null : null
+	};
+}
+async function Be(e, t, n, r, i, a) {
+	if (r.connections) for (let r of e.connections) {
+		let e = r.id;
+		e && await V(a.connections, `connection ${e}`, i, async () => {
+			let i = o.parse(r);
+			await t.connections.get(n, e) ? await t.connections.update(n, e, i) : await t.connections.create(n, i), a.connections.upserted += 1;
+		});
+	}
+	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await V(a.resourceServers, `resource_server ${r.id}`, i, async () => {
+		let e = y.parse(r);
+		await t.resourceServers.get(n, r.id) ? await t.resourceServers.update(n, r.id, e) : await t.resourceServers.create(n, e), a.resourceServers.upserted += 1;
+	});
+	if (r.hooks) for (let r of e.hooks) !ze(r) || !r.hook_id || await V(a.hooks, `hook ${r.hook_id}`, i, async () => {
+		let e = p.parse(r);
+		await t.hooks.get(n, r.hook_id) ? await t.hooks.update(n, r.hook_id, e) : await t.hooks.create(n, e), a.hooks.upserted += 1;
+	});
+	r.emailProvider && e.emailProvider && await V(a.emailProvider, "email_provider", i, async () => {
+		let r = e.emailProvider;
+		await t.emailProviders.get(n) ? await t.emailProviders.update(n, r) : await t.emailProviders.create(n, r), a.emailProvider.upserted += 1;
+	}), r.branding && e.branding && await V(a.branding, "branding", i, async () => {
+		await t.branding.set(n, e.branding), a.branding.upserted += 1;
+	}), r.promptSettings && e.promptSettings && await V(a.promptSettings, "prompt_settings", i, async () => {
+		await t.promptSettings.set(n, e.promptSettings), a.promptSettings.upserted += 1;
+	});
+}
+async function U(e, t) {
+	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = z(a), c = await H(await r(), n, s), l = await i(t), u = Re(t);
+	return await Be(c, l, n, s, o, u), u;
+}
+//#endregion
+//#region src/inheritance/read.ts
+async function W(e, t) {
+	let n = await H(e, t, {
+		connections: !0,
+		resourceServers: !0,
+		hooks: !0,
+		emailProvider: !0,
+		branding: !0,
+		promptSettings: !0
+	}), r = await f((n) => e.actions.list(t, n), "actions", {
+		cursorField: "id",
+		pageSize: 100
+	});
+	return {
+		...n,
+		actions: r
+	};
+}
+//#endregion
+//#region src/inheritance/shadow.ts
+var Ve = /secret|password|private_key|api_key|token/i, He = new Set([
+	"id",
+	"tenant_id",
+	"created_at",
+	"updated_at",
+	"scope",
+	"override",
+	"enforce",
+	"enabled_clients"
+]);
+async function G(e) {
+	let t = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
+	return [...new Uint8Array(t)].map((e) => e.toString(16).padStart(2, "0")).join("").slice(0, 16);
+}
+async function K(e, t = "") {
+	if (Array.isArray(e)) {
+		if (t === "secrets") {
+			let t = {};
+			for (let n of e) t[n.name] = n.value === void 0 ? null : `sha256:${await G(n.value)}`;
+			return t;
+		}
+		return Promise.all(e.map((e) => K(e, t)));
+	}
+	if (e && typeof e == "object") {
+		let t = {};
+		for (let n of Object.keys(e).sort()) {
+			let r = e[n];
+			r != null && (t[n] = typeof r == "string" && Ve.test(n) ? `sha256:${await G(r)}` : await K(r, n));
+		}
+		return t;
+	}
+	return e;
+}
+async function Ue(e) {
+	let t = {};
+	for (let [n, r] of Object.entries(e)) He.has(n) || (t[n] = r);
+	return await K(t);
+}
+var We = {
+	connection: (e) => `${e.strategy}:${e.name}`,
+	resourceServer: (e) => e.identifier,
+	hook: (e) => e.hook_id,
+	action: (e) => e.name
+}, Ge = new Set([
+	"connection",
+	"resourceServer",
+	"action",
+	"emailProvider",
+	"branding",
+	"promptSettings"
+]);
+async function Ke(e) {
+	let t = /* @__PURE__ */ new Map(), n = async (e, n, r) => {
+		let i = t.get(e) ?? /* @__PURE__ */ new Map();
+		i.set(n, await Ue(r)), t.set(e, i);
+	};
+	for (let [t, r] of Object.entries(We)) {
+		let i = e[{
+			connection: "connections",
+			resourceServer: "resourceServers",
+			hook: "hooks",
+			action: "actions"
+		}[t]];
+		for (let e of i) await n(t, r(e), e);
+	}
+	for (let t of [
+		"emailProvider",
+		"branding",
+		"promptSettings"
+	]) e[t] && await n(t, "singleton", e[t]);
+	return t;
+}
+async function qe(e, t) {
+	let [n, r] = await Promise.all([Ke(e), Ke(t)]), i = [], a = new Set([...n.keys(), ...r.keys()]);
+	for (let e of a) {
+		let t = n.get(e) ?? /* @__PURE__ */ new Map(), a = r.get(e) ?? /* @__PURE__ */ new Map();
+		for (let n of new Set([...t.keys(), ...a.keys()])) {
+			let r = t.get(n), o = a.get(n);
+			if (r && !o) i.push({
+				entity: e,
+				key: n,
+				kind: "missing",
+				fields: [],
+				expected: !1
+			});
+			else if (!r && o) i.push({
+				entity: e,
+				key: n,
+				kind: "extra",
+				fields: [],
+				expected: Ge.has(e)
+			});
+			else if (r && o) {
+				let t = JSON.stringify(r), a = JSON.stringify(o);
+				if (t === a) continue;
+				let s = [...new Set([...Object.keys(r), ...Object.keys(o)])].filter((e) => JSON.stringify(r[e]) !== JSON.stringify(o[e])).sort();
+				i.push({
+					entity: e,
+					key: n,
+					kind: "changed",
+					fields: s,
+					expected: !1,
+					legacy_hash: await G(t),
+					new_hash: await G(a)
+				});
+			}
+		}
+	}
+	return i;
+}
+async function Je(e) {
+	let { adapters: t, tenantId: n, legacyControlPlane: r } = e, i = await De({
+		tenantId: n,
+		getTenant: (e) => t.tenants.get(e),
+		legacyControlPlane: r,
+		maxDepth: e.maxDepth
+	}), a = await W(t, n), o = await Promise.all(i.map((e) => W(t, e))), s = r && r !== n ? await W(t, r) : void 0, { hidden: c, ...l } = Le(o, a), u = new Set(c);
+	return (await qe(Ae(a, s), l)).filter((e) => !u.has(`${e.entity}:${e.key}`));
+}
+//#endregion
+//#region src/inheritance/report.ts
+var Ye = 3600 * 1e3, Xe = 1e4;
+function Ze(e, t) {
+	let n = t.sample ?? 1, r = t.intervalMs ?? 6e4, i = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Set(), o = /* @__PURE__ */ new Map();
+	async function s(n, r) {
+		let i = await Je({
+			adapters: e,
+			tenantId: n,
+			legacyControlPlane: r
+		}), a = Date.now();
+		o.size > Xe && o.clear();
+		for (let s of i) {
+			if (s.expected && !t.includeExpected) continue;
+			let i = await G([
+				n,
+				s.entity,
+				s.key,
+				s.kind,
+				s.fields.join(",")
+			].join("|")), c = o.get(i);
+			c !== void 0 && a - c < Ye || (o.set(i, a), await Qe(e, n, s, r));
+		}
+	}
+	return { schedule(e, t) {
+		if (a.has(e) || n < 1 && Math.random() >= n) return;
+		let o = Date.now(), c = i.get(e);
+		c !== void 0 && o - c < r || (i.set(e, o), a.add(e), s(e, t).catch(() => {}).finally(() => a.delete(e)));
+	} };
+}
+async function Qe(e, n, r, i) {
+	await e.logs.create(n, {
+		type: t.CONFIG_INHERITANCE_DIFF,
+		date: (/* @__PURE__ */ new Date()).toISOString(),
+		isMobile: !1,
+		description: `${r.kind} ${r.entity} ${r.key}`,
+		details: {
+			shadow: "config-inheritance",
+			legacy_control_plane: i,
+			...r
+		}
+	});
+}
+//#endregion
 //#region src/middleware/settings-inheritance.ts
-function W(e, t) {
+function q(e, t) {
 	let n = t.find((t) => t.strategy === e.strategy);
 	if (!n?.options) return e;
-	let r = s.passthrough().parse({
+	let r = c.passthrough().parse({
 		...n,
 		...e
 	});
-	return r.options = o.passthrough().parse({
+	return r.options = s.passthrough().parse({
 		...n.options || {},
 		...e.options
 	}), r;
 }
-function G(e, t) {
+function J(e, t) {
 	let n = [...t || [], ...e || []];
 	return [...new Set(n)];
 }
-function _e(e, t) {
+function $e(e, t) {
 	if (!t?.length) return e || [];
 	if (!e?.length) return t;
 	let n = /* @__PURE__ */ new Map();
@@ -772,22 +1259,22 @@ function _e(e, t) {
 	for (let t of e) n.set(t.value, t);
 	return Array.from(n.values());
 }
-function ve(e, t) {
+function Y(e, t) {
 	return t ? {
 		...e,
-		scopes: _e(e.scopes, t.scopes)
+		scopes: $e(e.scopes, t.scopes)
 	} : e;
 }
-function ye(e, t) {
+function et(e, t) {
 	return t ? {
 		...e,
-		callbacks: G(e.callbacks, t.callbacks),
-		web_origins: G(e.web_origins, t.web_origins),
-		allowed_logout_urls: G(e.allowed_logout_urls, t.allowed_logout_urls),
-		allowed_origins: G(e.allowed_origins, t.allowed_origins)
+		callbacks: J(e.callbacks, t.callbacks),
+		web_origins: J(e.web_origins, t.web_origins),
+		allowed_logout_urls: J(e.allowed_logout_urls, t.allowed_logout_urls),
+		allowed_origins: J(e.allowed_origins, t.allowed_origins)
 	} : e;
 }
-function be(e) {
+function tt(e) {
 	let { controlPlaneTenantId: t, controlPlaneClientId: n, resolveControlPlane: r } = e;
 	if (r) return async (e) => r({ tenant_id: e });
 	if (!t) return async () => void 0;
@@ -797,14 +1284,14 @@ function be(e) {
 	};
 	return async () => i;
 }
-function xe(e, t) {
+function nt(e, t) {
 	return {
 		...e.resourceServers,
 		get: async (n, r) => {
 			let i = await e.resourceServers.get(n, r);
 			if (!i) return i;
 			let a = await t(n);
-			return !a || n === a.tenantId || !i.is_system ? i : ve(i, await e.resourceServers.get(a.tenantId, r));
+			return !a || n === a.tenantId || !i.is_system ? i : Y(i, await e.resourceServers.get(a.tenantId, r));
 		},
 		list: async (n, r) => {
 			let i = await e.resourceServers.list(n, r), a = await t(n);
@@ -816,7 +1303,7 @@ function xe(e, t) {
 				let n = await e.resourceServers.get(o, t);
 				n && c.set(t, n);
 			}));
-			let l = i.resource_servers.map((e) => e.is_system && e.id ? ve(e, c.get(e.id) ?? null) : e);
+			let l = i.resource_servers.map((e) => e.is_system && e.id ? Y(e, c.get(e.id) ?? null) : e);
 			return {
 				...i,
 				resource_servers: l
@@ -824,22 +1311,25 @@ function xe(e, t) {
 		}
 	};
 }
-function Se(e, t) {
-	let n = be({
+function rt(e, t) {
+	let n = tt({
 		controlPlaneTenantId: t.controlPlaneTenantId,
 		resolveControlPlane: t.resolveControlPlane
 	});
 	return {
 		...e,
-		resourceServers: xe(e, n)
+		resourceServers: nt(e, n)
 	};
 }
-function Ce(e, t) {
-	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i } = t, a = be({
+function it(e, t) {
+	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i, inheritanceShadow: a } = t, o = tt({
 		controlPlaneTenantId: n,
 		controlPlaneClientId: r,
 		resolveControlPlane: i
-	});
+	}), s = a ? Ze(e, a === !0 ? {} : a) : void 0, c = s ? async (e) => {
+		let t = await o(e);
+		return s.schedule(e, t?.tenantId), t;
+	} : o;
 	return {
 		...e,
 		multiTenancyConfig: {
@@ -852,16 +1342,16 @@ function Ce(e, t) {
 			get: async (t, n) => {
 				let r = await e.connections.get(t, n);
 				if (!r) return r;
-				let i = await a(t);
-				return !i || t === i.tenantId ? r : W(r, (await e.connections.list(i.tenantId)).connections || []);
+				let i = await c(t);
+				return !i || t === i.tenantId ? r : q(r, (await e.connections.list(i.tenantId)).connections || []);
 			},
 			list: async (t, n) => {
-				let r = await e.connections.list(t, n), i = await a(t);
+				let r = await e.connections.list(t, n), i = await c(t);
 				if (!i || t === i.tenantId) return r;
-				let o = await e.connections.list(i.tenantId), s = r.connections.map((e) => W(e, o.connections || []));
+				let a = await e.connections.list(i.tenantId), o = r.connections.map((e) => q(e, a.connections || []));
 				return {
 					...r,
-					connections: s
+					connections: o
 				};
 			}
 		},
@@ -870,10 +1360,10 @@ function Ce(e, t) {
 			listByClient: async (t, n) => {
 				let r = await e.clientConnections.listByClient(t, n);
 				r.length === 0 && (r = (await e.connections.list(t)).connections || []);
-				let i = await a(t);
+				let i = await c(t);
 				if (!i || t === i.tenantId) return r;
-				let o = await e.connections.list(i.tenantId);
-				return r.map((e) => W(e, o.connections || []));
+				let a = await e.connections.list(i.tenantId);
+				return r.map((e) => q(e, a.connections || []));
 			}
 		},
 		emailProviders: {
@@ -881,26 +1371,26 @@ function Ce(e, t) {
 			get: async (t) => {
 				let n = await e.emailProviders.get(t);
 				if (n) return n;
-				let r = await a(t);
+				let r = await c(t);
 				return !r || t === r.tenantId ? null : e.emailProviders.get(r.tenantId);
 			}
 		},
-		resourceServers: xe(e, a),
-		hooks: Te(e, a)
+		resourceServers: nt(e, c),
+		hooks: at(e, c)
 	};
 }
-function we(e) {
+function X(e) {
 	if (!e || typeof e != "object") return !1;
 	let t = e.metadata;
 	return !t || typeof t != "object" ? !1 : t.inheritable === !0;
 }
-function Te(e, t) {
+function at(e, t) {
 	return {
 		...e.hooks,
 		list: async (n, r) => {
 			let i = await e.hooks.list(n, r), a = await t(n);
 			if (!a || n === a.tenantId) return i;
-			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(we);
+			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(X);
 			if (o.length === 0) return i;
 			let s = new Set((i.hooks || []).map((e) => e.hook_id)), c = o.filter((e) => !s.has(e.hook_id));
 			return {
@@ -915,31 +1405,31 @@ function Te(e, t) {
 			let a = await t(n);
 			if (!a || n === a.tenantId) return i;
 			let o = await e.hooks.get(a.tenantId, r);
-			return o && we(o) ? o : null;
+			return o && X(o) ? o : null;
 		}
 	};
 }
-function K(e, t) {
-	return Ce(e, t);
+function Z(e, t) {
+	return it(e, t);
 }
 //#endregion
 //#region src/middleware/index.ts
-function Ee(e) {
+function ot(e) {
 	return async (t, n) => {
 		let r = t.var.user;
 		return r?.tenant_id === e && r.org_name && t.set("tenant_id", r.org_name), n();
 	};
 }
-function De(e) {
-	return async (n, r) => {
+function st(e) {
+	return async (t, r) => {
 		if (!e.accessControl) return r();
-		let { controlPlaneTenantId: i } = e.accessControl, a = n.var.org_name, o = n.var.organization_id, s = a || o, c = n.var.tenant_id, l = n.var.user, u = (l?.aud ? Array.isArray(l.aud) ? l.aud : [l.aud] : []).includes(t);
-		if (!c && s && u && (n.set("tenant_id", s), c = s), !c) throw new w(400, { message: "Tenant ID not found in request" });
-		if (!E(o, c, i, a)) throw new w(403, { message: `Access denied to tenant ${c}` });
+		let { controlPlaneTenantId: i } = e.accessControl, a = t.var.org_name, o = t.var.organization_id, s = a || o, c = t.var.tenant_id, l = t.var.user, u = (l?.aud ? Array.isArray(l.aud) ? l.aud : [l.aud] : []).includes(n);
+		if (!c && s && u && (t.set("tenant_id", s), c = s), !c) throw new T(400, { message: "Tenant ID not found in request" });
+		if (!D(o, c, i, a)) throw new T(403, { message: `Access denied to tenant ${c}` });
 		return r();
 	};
 }
-function Oe(e) {
+function ct(e) {
 	return async (t, n) => {
 		if (!e.subdomainRouting) return n();
 		let { baseDomain: r, reservedSubdomains: i = [], resolveSubdomain: a } = e.subdomainRouting, o = t.req.header("x-forwarded-host") || t.req.header("host") || "", s = null;
@@ -951,18 +1441,18 @@ function Oe(e) {
 		let c = null;
 		if (a) c = await a(s);
 		else if (e.subdomainRouting.useOrganizations !== !1 && e.accessControl) try {
-			let n = await V(t).organizations.get(e.accessControl.controlPlaneTenantId, s);
+			let n = await P(t).organizations.get(e.accessControl.controlPlaneTenantId, s);
 			n && (c = n.id);
 		} catch {}
-		if (!c) throw new w(404, { message: `Tenant not found for subdomain: ${s}` });
+		if (!c) throw new T(404, { message: `Tenant not found for subdomain: ${s}` });
 		return t.set("tenant_id", c), n();
 	};
 }
-function ke(e) {
+function lt(e) {
 	return async (t, n) => {
 		if (!e.databaseIsolation) return n();
 		let r = t.var.tenant_id;
-		if (!r) throw new w(400, { message: "Tenant ID not found in request" });
+		if (!r) throw new T(400, { message: "Tenant ID not found in request" });
 		try {
 			let n = await e.databaseIsolation.getAdapters(r);
 			t.set("baseData", n), t.env = {
@@ -970,30 +1460,31 @@ function ke(e) {
 				data: n
 			};
 		} catch (e) {
-			throw console.error(`Failed to resolve database for tenant ${r}:`, e), new w(500, { message: "Failed to resolve tenant database" });
+			throw console.error(`Failed to resolve database for tenant ${r}:`, e), new T(500, { message: "Failed to resolve tenant database" });
 		}
 		return n();
 	};
 }
-function q(e) {
-	let t = Oe(e), n = De(e), r = ke(e);
+function Q(e) {
+	let t = ct(e), n = st(e), r = lt(e);
 	return async (e, i) => (await t(e, async () => {}), await n(e, async () => {}), await r(e, async () => {}), i());
 }
 //#endregion
 //#region src/init.ts
-function Ae(e) {
-	let { dataAdapter: t, controlPlane: n, controlPlane: { tenantId: r = "control_plane", clientId: i } = {}, resolveControlPlane: a, sync: o = {
+function ut(e) {
+	let { dataAdapter: t, controlPlane: n, controlPlane: { tenantId: r = "control_plane", clientId: i } = {}, resolveControlPlane: a, inheritanceShadow: o, sync: s = {
 		resourceServers: !0,
 		roles: !0
-	}, defaultPermissions: s = ["tenant:admin"], requireOrganizationMatch: c = !1, managementApiExtensions: l = [], entityHooks: u, getChildTenantIds: f, getAdapters: m, ...h } = e;
+	}, defaultPermissions: c = ["tenant:admin"], requireOrganizationMatch: l = !1, managementApiExtensions: u = [], entityHooks: d, getChildTenantIds: p, getAdapters: h, ...g } = e;
 	if (a && !n) throw Error("initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it.");
-	let g = t, _ = t;
-	n && (g = K(t, {
+	let _ = t, v = t;
+	n && (_ = Z(t, {
 		controlPlaneTenantId: r,
 		controlPlaneClientId: i,
-		resolveControlPlane: a
-	}), _ = {
-		...Se(t, {
+		resolveControlPlane: a,
+		inheritanceShadow: o
+	}), v = {
+		...rt(t, {
 			controlPlaneTenantId: r,
 			resolveControlPlane: a
 		}),
@@ -1003,12 +1494,12 @@ function Ae(e) {
 			resolveControlPlane: a
 		}
 	});
-	let v = h.tenantOperationExecutor;
-	if (!v && t.tenantOperations && t.tenantOperationEvents && h.tenantUpgrade) {
+	let y = g.tenantOperationExecutor;
+	if (!y && t.tenantOperations && t.tenantOperationEvents && g.tenantUpgrade) {
 		let e = {
 			tenantOperations: t.tenantOperations,
 			tenantOperationEvents: t.tenantOperationEvents
-		}, n = h.tenantUpgrade, r = ne({
+		}, n = g.tenantUpgrade, r = ie({
 			stores: e,
 			definitions: { upgrade: (e) => [{
 				name: "upgrade",
@@ -1018,172 +1509,82 @@ function Ae(e) {
 				}
 			}] }
 		});
-		v = {
+		y = {
 			engine: r.engine,
-			enqueue: (t) => ie(e, r, {
+			enqueue: (t) => oe(e, r, {
 				...t,
 				tenant_id: t.tenant_id
 			})
 		};
 	}
-	let y = o !== !1, b = y ? {
-		resourceServers: o.resourceServers ?? !0,
-		roles: o.roles ?? !0
+	let b = s !== !1, x = b ? {
+		resourceServers: s.resourceServers ?? !0,
+		roles: s.roles ?? !0
 	} : {
 		resourceServers: !1,
 		roles: !1
-	}, { entityHooks: x, tenantHooks: S } = B({
+	}, { entityHooks: S, tenantHooks: C } = ve({
 		controlPlaneTenantId: r,
-		getChildTenantIds: f ?? (async () => (await d((e) => g.tenants.list(e), "tenants", {
+		getChildTenantIds: p ?? (async () => (await f((e) => _.tenants.list(e), "tenants", {
 			cursorField: "id",
 			pageSize: 100
 		})).filter((e) => e.id !== r).map((e) => e.id)),
-		getAdapters: m ?? (async () => g),
-		getControlPlaneAdapters: async () => g,
-		sync: b
-	}), C = {
-		resourceServers: [x.resourceServers, ...u?.resourceServers ?? []],
-		roles: [x.roles, ...u?.roles ?? []],
-		connections: u?.connections ?? [],
-		tenants: u?.tenants ?? [],
-		rolePermissions: u?.rolePermissions ?? []
-	}, w = P({ accessControl: {
+		getAdapters: h ?? (async () => _),
+		getControlPlaneAdapters: async () => _,
+		sync: x
+	}), w = {
+		resourceServers: [S.resourceServers, ...d?.resourceServers ?? []],
+		roles: [S.roles, ...d?.roles ?? []],
+		connections: d?.connections ?? [],
+		tenants: d?.tenants ?? [],
+		rolePermissions: d?.rolePermissions ?? []
+	}, T = N({ accessControl: {
 		controlPlaneTenantId: r,
-		requireOrganizationMatch: c,
-		defaultPermissions: s
-	} }), T = H({ accessControl: {
+		requireOrganizationMatch: l,
+		defaultPermissions: c
+	} }), E = F({ accessControl: {
 		controlPlaneTenantId: r,
-		requireOrganizationMatch: c,
-		defaultPermissions: s
+		requireOrganizationMatch: l,
+		defaultPermissions: c
 	} }, { tenants: {
 		async beforeCreate(e, t) {
-			return w.beforeCreate && (t = await w.beforeCreate(e, t)), S.beforeCreate && (t = await S.beforeCreate(e, t)), t;
+			return T.beforeCreate && (t = await T.beforeCreate(e, t)), C.beforeCreate && (t = await C.beforeCreate(e, t)), t;
 		},
 		async afterCreate(e, t) {
-			await w.afterCreate?.(e, t), await S.afterCreate?.(e, t);
+			await T.afterCreate?.(e, t), await C.afterCreate?.(e, t);
 		},
 		async beforeDelete(e, t) {
-			await w.beforeDelete?.(e, t), await S.beforeDelete?.(e, t);
+			await T.beforeDelete?.(e, t), await C.beforeDelete?.(e, t);
 		}
-	} }), { app: E } = p({
-		dataAdapter: g,
-		managementDataAdapter: _,
-		...h,
-		tenantOperationExecutor: v,
-		entityHooks: C,
-		managementApiExtensions: [...l, {
+	} }), { app: D } = m({
+		dataAdapter: _,
+		managementDataAdapter: v,
+		...g,
+		tenantOperationExecutor: y,
+		entityHooks: w,
+		managementApiExtensions: [...u, {
 			path: "/tenants",
-			router: T
+			router: E
 		}],
-		managementApiMiddleware: [...h.managementApiMiddleware ?? [], ...y ? [U()] : []]
+		managementApiMiddleware: [...g.managementApiMiddleware ?? [], ...b ? [Ee()] : []]
 	});
 	return {
-		app: E,
+		app: D,
 		controlPlaneTenantId: r
 	};
 }
 //#endregion
-//#region src/rollout/defaults-projection.ts
-function J(e = {}) {
-	return {
-		connections: e.connections ?? !0,
-		resourceServers: e.resourceServers ?? !0,
-		hooks: e.hooks ?? !0,
-		emailProvider: e.emailProvider ?? !0,
-		branding: e.branding ?? !0,
-		promptSettings: e.promptSettings ?? !0
-	};
-}
-function Y() {
-	return {
-		upserted: 0,
-		errors: []
-	};
-}
-function je(e) {
-	return {
-		tenantId: e,
-		connections: Y(),
-		resourceServers: Y(),
-		hooks: Y(),
-		emailProvider: Y(),
-		branding: Y(),
-		promptSettings: Y()
-	};
-}
-function Me(e) {
-	let t = e.metadata;
-	return !!(t && t.inheritable === !0);
-}
-async function X(e, t, n, r) {
-	try {
-		await r();
-	} catch (r) {
-		let i = `${t}: ${r instanceof Error ? r.message : String(r)}`;
-		if (!n) throw Error(i, { cause: r });
-		e.errors.push(i);
-	}
-}
-async function Ne(e, t, n) {
-	return {
-		connections: n.connections ? await d((n) => e.connections.list(t, n), "connections", {
-			cursorField: "id",
-			pageSize: 100
-		}) : [],
-		resourceServers: n.resourceServers ? await d((n) => e.resourceServers.list(t, n), "resource_servers", {
-			cursorField: "id",
-			pageSize: 100
-		}) : [],
-		hooks: n.hooks ? await d((n) => e.hooks.list(t, n), "hooks", {
-			cursorField: "hook_id",
-			pageSize: 100
-		}) : [],
-		emailProvider: n.emailProvider ? await e.emailProviders.get(t) ?? null : null,
-		branding: n.branding ? await e.branding.get(t) ?? null : null,
-		promptSettings: n.promptSettings ? await e.promptSettings.get(t) ?? null : null
-	};
-}
-async function Pe(e, t, n, r, i, o) {
-	if (r.connections) for (let r of e.connections) {
-		let e = r.id;
-		e && await X(o.connections, `connection ${e}`, i, async () => {
-			let i = a.parse(r);
-			await t.connections.get(n, e) ? await t.connections.update(n, e, i) : await t.connections.create(n, i), o.connections.upserted += 1;
-		});
-	}
-	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await X(o.resourceServers, `resource_server ${r.id}`, i, async () => {
-		let e = v.parse(r);
-		await t.resourceServers.get(n, r.id) ? await t.resourceServers.update(n, r.id, e) : await t.resourceServers.create(n, e), o.resourceServers.upserted += 1;
-	});
-	if (r.hooks) for (let r of e.hooks) !Me(r) || !r.hook_id || await X(o.hooks, `hook ${r.hook_id}`, i, async () => {
-		let e = f.parse(r);
-		await t.hooks.get(n, r.hook_id) ? await t.hooks.update(n, r.hook_id, e) : await t.hooks.create(n, e), o.hooks.upserted += 1;
-	});
-	r.emailProvider && e.emailProvider && await X(o.emailProvider, "email_provider", i, async () => {
-		let r = e.emailProvider;
-		await t.emailProviders.get(n) ? await t.emailProviders.update(n, r) : await t.emailProviders.create(n, r), o.emailProvider.upserted += 1;
-	}), r.branding && e.branding && await X(o.branding, "branding", i, async () => {
-		await t.branding.set(n, e.branding), o.branding.upserted += 1;
-	}), r.promptSettings && e.promptSettings && await X(o.promptSettings, "prompt_settings", i, async () => {
-		await t.promptSettings.set(n, e.promptSettings), o.promptSettings.upserted += 1;
-	});
-}
-async function Z(e, t) {
-	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = J(a), c = await Ne(await r(), n, s), l = await i(t), u = je(t);
-	return await Pe(c, l, n, s, o, u), u;
-}
-//#endregion
 //#region src/rollout/payload.ts
-function Fe(e) {
+function dt(e) {
 	let { pkcs7: t, tenant_id: n, ...r } = e;
 	return r;
 }
-async function Ie(e, t, n = {}, r) {
-	let i = J(n), a = n.signingKeys ?? !0, o = n.tenants ?? !0, s = await Ne(e, t, i), c = a ? (await h(e.keys)).map(Fe) : [], l = o ? await Le(e, t, r) : [];
+async function ft(e, t, n = {}, r) {
+	let i = z(n), a = n.signingKeys ?? !0, o = n.tenants ?? !0, s = await H(e, t, i), c = a ? (await g(e.keys)).map(dt) : [], l = o ? await pt(e, t, r) : [];
 	return {
 		connections: s.connections,
 		resourceServers: s.resourceServers.filter((e) => e.is_system),
-		hooks: s.hooks.filter(Me),
+		hooks: s.hooks.filter(ze),
 		emailProvider: s.emailProvider,
 		branding: s.branding,
 		promptSettings: s.promptSettings,
@@ -1191,7 +1592,7 @@ async function Ie(e, t, n = {}, r) {
 		tenants: l
 	};
 }
-async function Le(e, t, n) {
+async function pt(e, t, n) {
 	let r = n && n !== t ? [t, n] : [t], i = [];
 	for (let t of r) {
 		let n = await e.tenants.get(t);
@@ -1202,19 +1603,19 @@ async function Le(e, t, n) {
 	}
 	return i;
 }
-async function Re(e, t, n) {
-	let r = Y();
+async function mt(e, t, n) {
+	let r = B();
 	if (e.length === 0) return r;
-	let i = await h(t.keys), a = new Set(i.map((e) => e.kid));
-	for (let i of e) await X(r, `signing_key ${i.kid}`, n, async () => {
-		let e = Fe(i);
+	let i = await g(t.keys), a = new Set(i.map((e) => e.kid));
+	for (let i of e) await V(r, `signing_key ${i.kid}`, n, async () => {
+		let e = dt(i);
 		a.has(e.kid) || (await t.keys.create(e), a.add(e.kid), r.upserted += 1);
 	});
 	return r;
 }
-async function ze(e, t, n) {
-	let r = Y();
-	for (let i of e) await X(r, `tenant ${i.id}`, n, async () => {
+async function ht(e, t, n) {
+	let r = B();
+	for (let i of e) await V(r, `tenant ${i.id}`, n, async () => {
 		await t.tenants.get(i.id) || (await t.tenants.create({
 			id: i.id,
 			friendly_name: i.friendly_name
@@ -1222,17 +1623,17 @@ async function ze(e, t, n) {
 	});
 	return r;
 }
-async function Be(e, t, n, r = {}) {
-	let a = r.continueOnError ?? !1, o = J(r.entities), s = r.entities?.signingKeys ?? !0, c = r.entities?.tenants ?? !0, u = {
+async function gt(e, t, n, r = {}) {
+	let i = r.continueOnError ?? !1, o = z(r.entities), s = r.entities?.signingKeys ?? !0, c = r.entities?.tenants ?? !0, l = {
 		connections: e.connections,
 		resourceServers: e.resourceServers,
 		hooks: e.hooks,
-		emailProvider: e.emailProvider ? l.parse(e.emailProvider) : null,
-		branding: e.branding ? i.parse(e.branding) : null,
-		promptSettings: e.promptSettings ? g.parse(e.promptSettings) : null
-	}, d = c ? await ze(e.tenants ?? [], t, a) : Y(), f = je(n);
-	await Pe(u, t, n, o, a, f);
-	let p = s ? await Re(e.signingKeys, t, a) : Y();
+		emailProvider: e.emailProvider ? u.parse(e.emailProvider) : null,
+		branding: e.branding ? a.parse(e.branding) : null,
+		promptSettings: e.promptSettings ? _.parse(e.promptSettings) : null
+	}, d = c ? await ht(e.tenants ?? [], t, i) : B(), f = Re(n);
+	await Be(l, t, n, o, i, f);
+	let p = s ? await mt(e.signingKeys, t, i) : B();
 	return {
 		...f,
 		signingKeys: p,
@@ -1241,27 +1642,27 @@ async function Be(e, t, n, r = {}) {
 }
 //#endregion
 //#region src/rollout/index.ts
-function Ve(e) {
+function _t(e) {
 	return {
-		syncDefaults: (t) => Z(e, t),
+		syncDefaults: (t) => U(e, t),
 		syncDefaultsToTenants: async (t) => {
 			let n = [];
-			for (let r of t) n.push(await Z(e, r));
+			for (let r of t) n.push(await U(e, r));
 			return n;
 		}
 	};
 }
 //#endregion
 //#region src/plugin.ts
-function He(e) {
-	let t = Q(e);
+function vt(e) {
+	let t = $(e);
 	return {
 		name: "multi-tenancy",
-		middleware: q(e),
+		middleware: Q(e),
 		hooks: t,
 		routes: [{
 			path: "/management",
-			handler: H(e, t)
+			handler: F(e, t)
 		}],
 		onRegister: async () => {
 			console.log("Multi-tenancy plugin registered"), e.accessControl && console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`), e.subdomainRouting && console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`), e.databaseIsolation && console.log("  - Database isolation enabled");
@@ -1270,29 +1671,29 @@ function He(e) {
 }
 //#endregion
 //#region src/index.ts
-function Q(e) {
-	let t = e.accessControl ? T(e.accessControl) : {}, n = e.databaseIsolation ? D(e.databaseIsolation) : {}, r = P(e);
+function $(e) {
+	let t = e.accessControl ? E(e.accessControl) : {}, n = e.databaseIsolation ? ee(e.databaseIsolation) : {}, r = N(e);
 	return {
 		...t,
 		...n,
 		tenants: r
 	};
 }
-function $(t) {
-	let n = new e(), r = Q(t);
-	return n.route("/tenants", H(t, r)), n;
+function yt(t) {
+	let n = new e(), r = $(t);
+	return n.route("/tenants", F(t, r)), n;
 }
-function Ue(e) {
+function bt(e) {
 	return {
-		hooks: Q(e),
-		middleware: q(e),
-		app: $(e),
+		hooks: $(e),
+		middleware: Q(e),
+		app: yt(e),
 		config: e,
-		wrapAdapters: (t, n) => K(t, {
+		wrapAdapters: (t, n) => Z(t, {
 			controlPlaneTenantId: e.accessControl?.controlPlaneTenantId,
 			controlPlaneClientId: n?.controlPlaneClientId
 		})
 	};
 }
 //#endregion
-export { Be as applyControlPlaneDefaultsPayload, Ie as buildControlPlaneDefaultsPayload, A as buildEngineInstanceId, T as createAccessControlHooks, De as createAccessControlMiddleware, Ee as createControlPlaneTenantMiddleware, D as createDatabaseHooks, ke as createDatabaseMiddleware, Ve as createDirectRolloutAdapter, ne as createInlineExecutor, $ as createMultiTenancy, Q as createMultiTenancyHooks, q as createMultiTenancyMiddleware, He as createMultiTenancyPlugin, M as createOperationRecorder, U as createProtectSyncedMiddleware, P as createProvisioningHooks, Ce as createRuntimeFallbackAdapter, Oe as createSubdomainMiddleware, B as createSyncHooks, H as createTenantsOpenAPIRouter, ie as enqueueTenantOperation, j as errorToMessage, Ae as initMultiTenant, te as inlineStepRunner, N as isTerminalStatus, ye as mergeClientWithFallback, Z as projectControlPlaneDefaults, oe as runRecordedTenantOperation, Ue as setupMultiTenancy, E as validateTenantAccess, K as withRuntimeFallback, Se as withSystemResourceServerInheritance };
+export { gt as applyControlPlaneDefaultsPayload, ft as buildControlPlaneDefaultsPayload, A as buildEngineInstanceId, Je as compareShadow, Ae as computeLegacyConfig, E as createAccessControlHooks, st as createAccessControlMiddleware, ot as createControlPlaneTenantMiddleware, ee as createDatabaseHooks, lt as createDatabaseMiddleware, _t as createDirectRolloutAdapter, ie as createInlineExecutor, yt as createMultiTenancy, $ as createMultiTenancyHooks, Q as createMultiTenancyMiddleware, vt as createMultiTenancyPlugin, M as createOperationRecorder, Ee as createProtectSyncedMiddleware, N as createProvisioningHooks, it as createRuntimeFallbackAdapter, Ze as createShadowReporter, ct as createSubdomainMiddleware, ve as createSyncHooks, F as createTenantsOpenAPIRouter, qe as diffConfig, L as effectiveOverride, I as effectiveScope, oe as enqueueTenantOperation, j as errorToMessage, ut as initMultiTenant, re as inlineStepRunner, ne as isTerminalStatus, et as mergeClientWithFallback, Le as mergeConfig, U as projectControlPlaneDefaults, W as readConfigRows, De as resolveTenantChain, ce as runRecordedTenantOperation, bt as setupMultiTenancy, D as validateTenantAccess, Z as withRuntimeFallback, rt as withSystemResourceServerInheritance };