@authhero/multi-tenancy 15.1.2 → 15.3.0

package/dist/multi-tenancy.mjs

@@ -1,9 +1,9 @@
 import { Hono as e } from "hono";
-import { MANAGEMENT_API_AUDIENCE as t, MANAGEMENT_API_SCOPES as n, auth0QuerySchema as r, brandingSchema as i, connectionInsertSchema as a, connectionOptionsSchema as o, connectionSchema as s, deepMergePatch as c, emailProviderSchema as l, escapeLuceneValue as u, fetchAll as d, hookInsertSchema as f, init as p, isInteractiveClient as m, listControlPlaneKeys as h, promptSettingSchema as g, provisionDefaultClients as _, resourceServerInsertSchema as v, tenantInsertSchema as y, tenantSchema as b } from "authhero";
-import { OpenAPIHono as x, createRoute as S, z as C } from "@hono/zod-openapi";
+import { LogTypes as t, MANAGEMENT_API_AUDIENCE as n, MANAGEMENT_API_SCOPES as r, actionInsertSchema as i, auth0QuerySchema as a, brandingSchema as o, canDecrypt as s, connectionInsertSchema as c, connectionOptionsSchema as l, connectionSchema as u, deepMergePatch as d, emailProviderSchema as f, escapeLuceneValue as p, fetchAll as m, hookCodeInsertSchema as h, hookInsertSchema as g, init as _, isInteractiveClient as v, isSyncedRowId as y, listControlPlaneKeys as b, promptSettingSchema as ee, provisionDefaultClients as te, resourceServerInsertSchema as x, tenantInsertSchema as S, tenantSchema as C } from "authhero";
 import { HTTPException as w } from "hono/http-exception";
+import { OpenAPIHono as T, createRoute as E, z as D } from "@hono/zod-openapi";
 //#region src/hooks/access-control.ts
-function T(e) {
+function ne(e) {
 	let { controlPlaneTenantId: t, requireOrganizationMatch: n = !0 } = e;
 	return { async onTenantAccessValidation(e, r) {
 		if (r === t) return !0;
@@ -14,14 +14,14 @@ function T(e) {
 		return !0;
 	} };
 }
-function E(e, t, n, r) {
+function O(e, t, n, r) {
 	if (t === n) return !0;
 	let i = r || e;
 	return i ? i.toLowerCase() === t.toLowerCase() : !1;
 }
 //#endregion
 //#region src/hooks/database.ts
-function D(e) {
+function re(e) {
 	return { async resolveDataAdapters(t) {
 		try {
 			return await e.getAdapters(t);
@@ -33,18 +33,18 @@ function D(e) {
 }
 //#endregion
 //#region src/operations/instance-id.ts
-var O = 64;
-function k(e) {
+var k = 64;
+function ie(e) {
 	return e.replace(/[^a-zA-Z0-9_-]/g, "-");
 }
-function A(e) {
-	let t = k(e.id), n = Math.max(0, O - (5 + t.length)), r = k(e.kind).slice(0, n), i = 3 + r.length + 2 + t.length, a = Math.max(0, O - i);
-	return `op-${r}-${k(e.tenant_id ?? "fleet").slice(0, a)}-${t}`.slice(0, O);
+function ae(e) {
+	let t = ie(e.id), n = Math.max(0, k - (5 + t.length)), r = ie(e.kind).slice(0, n), i = 3 + r.length + 2 + t.length, a = Math.max(0, k - i);
+	return `op-${r}-${ie(e.tenant_id ?? "fleet").slice(0, a)}-${t}`.slice(0, k);
 }
 //#endregion
 //#region src/operations/recorder.ts
-var ee = 2048;
-function j(e) {
+var oe = 2048;
+function se(e) {
 	let t;
 	if (e instanceof Error) t = e.message;
 	else try {
@@ -52,9 +52,9 @@ function j(e) {
 	} catch {
 		t = Object.prototype.toString.call(e);
 	}
-	return t.slice(0, ee);
+	return t.slice(0, oe);
 }
-function M(e) {
+function A(e) {
 	let { tenantOperations: t, tenantOperationEvents: n } = e;
 	return {
 		async markRunning(e, n) {
@@ -75,6 +75,9 @@ function M(e) {
 				attempt: t.attempt ?? 1
 			});
 		},
+		async setResult(e, n) {
+			await t.update(e, { result: n });
+		},
 		async markSucceeded(e) {
 			await t.update(e, {
 				status: "succeeded",
@@ -85,24 +88,24 @@ function M(e) {
 		async markFailed(e, n) {
 			await t.update(e, {
 				status: "failed",
-				error: j(n),
+				error: se(n),
 				finished_at: (/* @__PURE__ */ new Date()).toISOString()
 			});
 		}
 	};
 }
-function N(e) {
+function j(e) {
 	return e === "succeeded" || e === "failed" || e === "cancelled";
 }
 //#endregion
 //#region src/operations/inline-executor.ts
-var te = { async do(e, t, n) {
+var ce = { async do(e, t, n) {
 	let r = typeof t == "function" ? t : n;
 	if (!r) throw Error("StepRunner.do called without a function");
 	return r();
 } };
-function ne(e) {
-	let t = M(e.stores);
+function le(e) {
+	let t = A(e.stores);
 	return {
 		engine: "inline",
 		async start(n) {
@@ -121,7 +124,7 @@ function ne(e) {
 				try {
 					let r = await e.run({
 						operation: n,
-						step: te
+						step: ce
 					});
 					await t.appendEvent(n.id, {
 						step: e.name,
@@ -132,7 +135,7 @@ function ne(e) {
 					throw await t.appendEvent(n.id, {
 						step: e.name,
 						outcome: "failed",
-						detail: { message: j(r) }
+						detail: { message: se(r) }
 					}), await t.markFailed(n.id, r), r;
 				}
 			}
@@ -142,7 +145,7 @@ function ne(e) {
 }
 //#endregion
 //#region src/operations/enqueue.ts
-async function re(e, t, n) {
+async function M(e, t, n) {
 	let r = await e.tenantOperations.create({
 		tenant_id: t.tenant_id,
 		rollout_id: t.rollout_id,
@@ -150,13 +153,14 @@ async function re(e, t, n) {
 		engine: n,
 		initiated_by: t.initiated_by,
 		target_worker_version: t.target_worker_version,
-		target_database_version: t.target_database_version
-	}), i = A(r);
+		target_database_version: t.target_database_version,
+		input: t.input
+	}), i = ae(r);
 	try {
 		await e.tenantOperations.update(r.id, { engine_instance_id: i });
 	} catch (t) {
 		try {
-			await M(e).markFailed(r.id, t);
+			await A(e).markFailed(r.id, t);
 		} catch {}
 		throw t;
 	}
@@ -165,236 +169,1230 @@ async function re(e, t, n) {
 		engine_instance_id: i
 	};
 }
-async function ie(e, t, n) {
-	let r = M(e), i = await re(e, n, t.engine);
+async function ue(e, t, n, r = {}) {
+	let i = A(e), a = await M(e, n, t.engine);
 	try {
-		await t.start(i);
+		await t.start(a);
 	} catch (t) {
+		let n = null;
 		try {
-			let n = await e.tenantOperations.get(i.id);
-			n && !N(n.status) && await r.markFailed(i.id, t);
+			let r = await e.tenantOperations.get(a.id);
+			r && !j(r.status) && await i.markFailed(a.id, t), n = await e.tenantOperations.get(a.id);
 		} catch (e) {
 			console.warn("Failed to record tenant operation failure:", e);
 		}
+		if (r.returnFailed && n) return n;
 		throw t;
 	}
 	try {
-		return await e.tenantOperations.get(i.id) ?? i;
+		return await e.tenantOperations.get(a.id) ?? a;
 	} catch (e) {
-		return console.warn("Failed to re-fetch tenant operation after start:", e), i;
+		return console.warn("Failed to re-fetch tenant operation after start:", e), a;
 	}
 }
-//#endregion
-//#region src/operations/record-provision.ts
-function ae(e) {
-	if (e.tenantOperations && e.tenantOperationEvents) return {
-		tenantOperations: e.tenantOperations,
-		tenantOperationEvents: e.tenantOperationEvents
-	};
-}
-async function oe(e, t, n) {
-	let r = ae(e);
-	if (!r) {
-		await n(void 0);
-		return;
+async function de(e) {
+	let { tenantId: t, parentTenantId: n, getTenant: r, getChildren: i } = e, a = e.maxDepth ?? 2;
+	if (!n) return;
+	if (t && n === t) throw new w(400, { message: "A tenant cannot be its own parent" });
+	let o = new Set(t ? [t] : []), s = 0, c = n;
+	for (; c;) {
+		if (o.has(c)) throw new w(400, { message: `Setting parent_tenant_id to '${n}' would create a cycle` });
+		o.add(c);
+		let e = await r(c);
+		if (!e) throw new w(400, { message: `Parent tenant '${c}' not found` });
+		if (s += 1, s > a) throw new w(400, { message: `Tenant tree is limited to ${a} levels above a tenant` });
+		c = e.parent_tenant_id;
 	}
-	let i = M(r), a = async (e) => {
-		try {
-			await e();
-		} catch (e) {
-			console.warn("Failed to record tenant operation progress:", e);
+	if (t && i) {
+		let e = new Set([t]), r = 0, o = [t];
+		for (; o.length > 0;) {
+			let t = [];
+			for (let n of o) for (let r of await i(n)) e.has(r) || (e.add(r), t.push(r));
+			if (t.length > 0 && (r += 1, s + r > a)) throw new w(400, { message: `Moving tenant under '${n}' would make its descendant '${t[0]}' exceed the tenant tree limit of ${a} levels` });
+			o = t;
 		}
-	}, o;
-	if (await a(async () => {
-		let e = await re(r, t, "inline");
-		o = e.id, await i.markRunning(e.id);
-	}), !o) {
-		await n(void 0);
-		return;
 	}
-	let s = o, c = !1, l = async (e, t, n) => {
-		c = !0, await a(async () => {
-			t === "started" && await i.setCurrentStep(s, e), await i.appendEvent(s, {
-				step: e,
-				outcome: t,
-				detail: n
-			});
-		});
+}
+//#endregion
+//#region src/inheritance/chain.ts
+async function N(e) {
+	let { tenantId: t, getTenant: n, legacyControlPlane: r } = e, i = e.maxDepth ?? 2, a = await n(t);
+	if (!a?.parent_tenant_id) return r && r !== t ? [r] : [];
+	let o = [], s = new Set([t]), c = a.parent_tenant_id;
+	for (; c;) {
+		if (s.has(c)) throw new w(400, { message: `Tenant chain for '${t}' contains a cycle at '${c}'` });
+		if (s.add(c), o.length >= i) throw new w(400, { message: `Tenant chain for '${t}' is deeper than ${i}` });
+		let e = await n(c);
+		if (!e) break;
+		o.push(c), c = e.parent_tenant_id;
+	}
+	return o;
+}
+//#endregion
+//#region src/inheritance/legacy.ts
+function fe(e) {
+	let t = {};
+	for (let n of e ?? []) n.value !== void 0 && (t[n.name] = n.value);
+	return t;
+}
+function pe(e, t) {
+	if (!e.inherit) return e;
+	let n = t.find((t) => t.name === e.name && t.is_system);
+	if (!n) return e;
+	let r = {
+		...fe(n.secrets),
+		...fe(e.secrets)
+	};
+	return {
+		...e,
+		code: n.code,
+		secrets: Object.entries(r).map(([e, t]) => ({
+			name: e,
+			value: t
+		}))
+	};
+}
+function me(e, t) {
+	if (!t) return e;
+	let n = new Set(e.hooks.map((e) => e.hook_id)), r = t.hooks.filter((e) => B(e) && !n.has(e.hook_id));
+	return {
+		connections: e.connections.map((e) => R(e, t.connections)),
+		resourceServers: e.resourceServers.map((e) => e.is_system ? Ie(e, t.resourceServers.find((t) => t.id === e.id) ?? null) : e),
+		hooks: [...e.hooks, ...r],
+		hookCode: e.hookCode,
+		actions: e.actions.map((e) => pe(e, t.actions)),
+		emailProvider: e.emailProvider ?? t.emailProvider,
+		branding: e.branding,
+		promptSettings: e.promptSettings
+	};
+}
+//#endregion
+//#region src/rollout/defaults-projection.ts
+function he(e = {}) {
+	return {
+		connections: e.connections ?? !0,
+		resourceServers: e.resourceServers ?? !0,
+		hooks: e.hooks ?? !0,
+		emailProvider: e.emailProvider ?? !0,
+		branding: e.branding ?? !0,
+		promptSettings: e.promptSettings ?? !0
+	};
+}
+function P() {
+	return {
+		upserted: 0,
+		errors: []
+	};
+}
+function ge(e) {
+	return {
+		tenantId: e,
+		connections: P(),
+		resourceServers: P(),
+		hooks: P(),
+		emailProvider: P(),
+		branding: P(),
+		promptSettings: P()
 	};
+}
+function _e(e) {
+	let t = e.metadata;
+	return !!(t && t.inheritable === !0);
+}
+async function F(e, t, n, r) {
 	try {
-		await n(l);
-	} catch (e) {
-		throw await a(async () => {
-			c || await i.appendEvent(s, {
-				step: t.kind,
-				outcome: "failed",
-				detail: { message: j(e) }
-			}), await i.markFailed(s, e);
-		}), e;
+		await r();
+	} catch (r) {
+		let i = `${t}: ${r instanceof Error ? r.message : String(r)}`;
+		if (!n) throw Error(i, { cause: r });
+		e.errors.push(i);
 	}
-	await a(async () => {
-		c || await i.appendEvent(s, {
-			step: t.kind,
-			outcome: "succeeded"
-		}), await i.markSucceeded(s);
+}
+async function ve(e, t, n) {
+	return {
+		connections: n.connections ? await m((n) => e.connections.list(t, n), "connections", {
+			cursorField: "id",
+			pageSize: 100
+		}) : [],
+		resourceServers: n.resourceServers ? await m((n) => e.resourceServers.list(t, n), "resource_servers", {
+			cursorField: "id",
+			pageSize: 100
+		}) : [],
+		hooks: n.hooks ? await m((n) => e.hooks.list(t, n), "hooks", {
+			cursorField: "hook_id",
+			pageSize: 100
+		}) : [],
+		emailProvider: n.emailProvider ? await e.emailProviders.get(t) ?? null : null,
+		branding: n.branding ? await e.branding.get(t) ?? null : null,
+		promptSettings: n.promptSettings ? await e.promptSettings.get(t) ?? null : null
+	};
+}
+async function ye(e, t, n, r, i, a) {
+	if (r.connections) for (let r of e.connections) {
+		let e = r.id;
+		e && await F(a.connections, `connection ${e}`, i, async () => {
+			let i = c.parse(r);
+			await t.connections.get(n, e) ? await t.connections.update(n, e, i) : await t.connections.create(n, i), a.connections.upserted += 1;
+		});
+	}
+	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await F(a.resourceServers, `resource_server ${r.id}`, i, async () => {
+		let e = x.parse(r);
+		await t.resourceServers.get(n, r.id) ? await t.resourceServers.update(n, r.id, e) : await t.resourceServers.create(n, e), a.resourceServers.upserted += 1;
+	});
+	if (r.hooks) for (let r of e.hooks) !_e(r) || !r.hook_id || await F(a.hooks, `hook ${r.hook_id}`, i, async () => {
+		let e = g.parse(r);
+		await t.hooks.get(n, r.hook_id) ? await t.hooks.update(n, r.hook_id, e) : await t.hooks.create(n, e), a.hooks.upserted += 1;
+	});
+	r.emailProvider && e.emailProvider && await F(a.emailProvider, "email_provider", i, async () => {
+		let r = e.emailProvider;
+		await t.emailProviders.get(n) ? await t.emailProviders.update(n, r) : await t.emailProviders.create(n, r), a.emailProvider.upserted += 1;
+	}), r.branding && e.branding && await F(a.branding, "branding", i, async () => {
+		await t.branding.set(n, e.branding), a.branding.upserted += 1;
+	}), r.promptSettings && e.promptSettings && await F(a.promptSettings, "prompt_settings", i, async () => {
+		await t.promptSettings.set(n, e.promptSettings), a.promptSettings.upserted += 1;
 	});
 }
-//#endregion
-//#region src/hooks/provisioning.ts
-function se(e) {
-	return `urn:authhero:tenant:${e.toLowerCase()}`;
+async function be(e, t) {
+	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = he(a), c = await ve(await r(), n, s), l = await i(t), u = ge(t);
+	return await ye(c, l, n, s, o, u), u;
 }
-function P(e) {
+//#endregion
+//#region src/inheritance/read.ts
+async function I(e, t) {
+	let n = await ve(e, t, {
+		connections: !0,
+		resourceServers: !0,
+		hooks: !0,
+		emailProvider: !0,
+		branding: !0,
+		promptSettings: !0
+	}), r = await m((n) => e.actions.list(t, n), "actions", {
+		cursorField: "id",
+		pageSize: 100
+	}), i = new Set(r.map((e) => e.id)), a = /* @__PURE__ */ new Set();
+	for (let e of n.hooks) {
+		let t = e.code_id;
+		t && !i.has(t) && a.add(t);
+	}
+	let o = [];
+	for (let n of a) {
+		let r = await e.hookCode.get(t, n);
+		r && o.push(r);
+	}
 	return {
-		async beforeCreate(e, t) {
-			return !t.audience && t.id ? {
-				...t,
-				audience: se(t.id)
-			} : t;
-		},
-		async afterCreate(r, i) {
-			let { accessControl: a, databaseIsolation: o } = e;
-			if (a && r.ctx && await ce(r, i, a), o?.onProvision) {
-				let e = o.onProvision;
-				o.recordProvisionOperations === !1 ? await e(i.id) : await oe(r.adapters, {
-					kind: "provision",
-					tenant_id: i.id,
-					initiated_by: r.ctx?.var.user?.sub
-				}, (t) => e(i.id, t));
-			} else try {
-				await _(r.adapters, i.id, {
-					managementApiIdentifier: t,
-					managementApiScopes: n
+		...n,
+		actions: r,
+		hookCode: o
+	};
+}
+//#endregion
+//#region src/inheritance/shadow.ts
+var xe = /secret|password|private_key|api_key|token/i, Se = new Set([
+	"id",
+	"tenant_id",
+	"created_at",
+	"updated_at",
+	"scope",
+	"override",
+	"enforce",
+	"enabled_clients"
+]);
+async function L(e) {
+	let t = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
+	return [...new Uint8Array(t)].map((e) => e.toString(16).padStart(2, "0")).join("").slice(0, 16);
+}
+async function Ce(e, t = "") {
+	if (Array.isArray(e)) {
+		if (t === "secrets") {
+			let t = {};
+			for (let n of e) t[n.name] = n.value === void 0 ? null : `sha256:${await L(n.value)}`;
+			return t;
+		}
+		return Promise.all(e.map((e) => Ce(e, t)));
+	}
+	if (e && typeof e == "object") {
+		let t = {};
+		for (let n of Object.keys(e).sort()) {
+			let r = e[n];
+			r != null && (t[n] = typeof r == "string" && xe.test(n) ? `sha256:${await L(r)}` : await Ce(r, n));
+		}
+		return t;
+	}
+	return e;
+}
+async function we(e) {
+	let t = {};
+	for (let [n, r] of Object.entries(e)) Se.has(n) || (t[n] = r);
+	return await Ce(t);
+}
+var Te = {
+	connection: (e) => `${e.strategy}:${e.name}`,
+	resourceServer: (e) => e.identifier,
+	hook: (e) => e.hook_id,
+	action: (e) => e.name
+}, Ee = new Set([
+	"connection",
+	"resourceServer",
+	"action",
+	"emailProvider",
+	"branding",
+	"promptSettings"
+]);
+async function De(e) {
+	let t = /* @__PURE__ */ new Map(), n = async (e, n, r) => {
+		let i = t.get(e) ?? /* @__PURE__ */ new Map();
+		i.set(n, await we(r)), t.set(e, i);
+	};
+	for (let [t, r] of Object.entries(Te)) {
+		let i = e[{
+			connection: "connections",
+			resourceServer: "resourceServers",
+			hook: "hooks",
+			action: "actions"
+		}[t]];
+		for (let e of i) await n(t, r(e), e);
+	}
+	for (let t of [
+		"emailProvider",
+		"branding",
+		"promptSettings"
+	]) e[t] && await n(t, "singleton", e[t]);
+	return t;
+}
+async function Oe(e, t) {
+	let [n, r] = await Promise.all([De(e), De(t)]), i = [], a = new Set([...n.keys(), ...r.keys()]);
+	for (let e of a) {
+		let t = n.get(e) ?? /* @__PURE__ */ new Map(), a = r.get(e) ?? /* @__PURE__ */ new Map();
+		for (let n of new Set([...t.keys(), ...a.keys()])) {
+			let r = t.get(n), o = a.get(n);
+			if (r && !o) i.push({
+				entity: e,
+				key: n,
+				kind: "missing",
+				fields: [],
+				expected: !1
+			});
+			else if (!r && o) i.push({
+				entity: e,
+				key: n,
+				kind: "extra",
+				fields: [],
+				expected: Ee.has(e)
+			});
+			else if (r && o) {
+				let t = JSON.stringify(r), a = JSON.stringify(o);
+				if (t === a) continue;
+				let s = [...new Set([...Object.keys(r), ...Object.keys(o)])].filter((e) => JSON.stringify(r[e]) !== JSON.stringify(o[e])).sort();
+				i.push({
+					entity: e,
+					key: n,
+					kind: "changed",
+					fields: s,
+					expected: !1,
+					legacy_hash: await L(t),
+					new_hash: await L(a)
 				});
-			} catch (e) {
-				throw console.warn(`Failed to provision default clients for tenant ${i.id}:`, e), e;
-			}
-		},
-		async beforeDelete(t, n) {
-			let { accessControl: r, databaseIsolation: i } = e;
-			if (r) try {
-				let e = (await t.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find((e) => e.name === n);
-				e && await t.adapters.organizations.remove(r.controlPlaneTenantId, e.id);
-			} catch (e) {
-				console.warn(`Failed to remove organization for tenant ${n}:`, e);
-			}
-			if (i?.onDeprovision) try {
-				await i.onDeprovision(n);
-			} catch (e) {
-				console.warn(`Failed to deprovision database for tenant ${n}:`, e);
 			}
 		}
-	};
+	}
+	return i;
 }
-async function ce(e, t, n) {
-	let { controlPlaneTenantId: r, defaultPermissions: i, defaultRoles: a, issuer: o, adminRoleName: s = "Tenant Admin", adminRoleDescription: c = "Full access to all tenant management operations", addCreatorToOrganization: l = !0 } = n, u = await e.adapters.organizations.create(r, {
-		name: t.id,
-		display_name: t.friendly_name || t.id
-	}), d;
-	if (o && (d = await ue(e, r, s, c)), l && e.ctx) {
-		let t = e.ctx.var.user;
-		if (t?.sub && !await le(e, r, t.sub)) try {
-			await e.adapters.userOrganizations.create(r, {
-				user_id: t.sub,
-				organization_id: u.id
-			}), d && await e.adapters.userRoles.create(r, t.sub, d, u.id);
-		} catch (e) {
-			console.warn(`Failed to add creator ${t.sub} to organization ${u.id}:`, e);
+async function ke(e) {
+	let { adapters: t, tenantId: n, legacyControlPlane: r } = e, i = await N({
+		tenantId: n,
+		getTenant: (e) => t.tenants.get(e),
+		legacyControlPlane: r,
+		maxDepth: e.maxDepth
+	}), a = await I(t, n), o = await Promise.all(i.map((e) => I(t, e))), s = r && r !== n ? await I(t, r) : void 0, { hidden: c, ...l } = Ze(o, a), u = new Set(c);
+	return (await Oe(me(a, s), l)).filter((e) => !u.has(`${e.entity}:${e.key}`));
+}
+//#endregion
+//#region src/inheritance/report.ts
+var Ae = 3600 * 1e3, je = 1e4;
+function Me(e, t) {
+	let n = t.sample ?? 1, r = t.intervalMs ?? 6e4, i = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Set(), o = /* @__PURE__ */ new Map();
+	async function s(n, r) {
+		let i = await ke({
+			adapters: e,
+			tenantId: n,
+			legacyControlPlane: r
+		}), a = Date.now();
+		o.size > je && o.clear();
+		for (let s of i) {
+			if (s.expected && !t.includeExpected) continue;
+			let i = await L([
+				n,
+				s.entity,
+				s.key,
+				s.kind,
+				s.fields.join(",")
+			].join("|")), c = o.get(i);
+			c !== void 0 && a - c < Ae || (o.set(i, a), await Ne(e, n, s, r));
 		}
 	}
-	a && a.length > 0 && console.log(`Would assign roles ${a.join(", ")} to organization ${u.id}`), i && i.length > 0 && console.log(`Would grant permissions ${i.join(", ")} to organization ${u.id}`);
-}
-async function le(e, n, r) {
-	let i = await e.adapters.userRoles.list(n, r, void 0, "");
-	for (let r of i) if ((await e.adapters.rolePermissions.list(n, r.id, { per_page: 1e3 })).some((e) => e.permission_name === "admin:organizations" && e.resource_server_identifier === t)) return !0;
-	return !1;
+	return { schedule(e, t) {
+		if (a.has(e) || n < 1 && Math.random() >= n) return;
+		let o = Date.now(), c = i.get(e);
+		c !== void 0 && o - c < r || (i.set(e, o), a.add(e), s(e, t).catch(() => {}).finally(() => a.delete(e)));
+	} };
 }
-async function ue(e, r, i, a) {
-	let o = (await e.adapters.roles.list(r, {})).roles.find((e) => e.name === i);
-	if (o) return o.id;
-	let s = await e.adapters.roles.create(r, {
-		name: i,
-		description: a
-	}), c = t, l = n.map((e) => ({
-		role_id: s.id,
-		resource_server_identifier: c,
-		permission_name: e.value
-	}));
-	return await e.adapters.rolePermissions.assign(r, s.id, l), s.id;
+async function Ne(e, n, r, i) {
+	await e.logs.create(n, {
+		type: t.CONFIG_INHERITANCE_DIFF,
+		date: (/* @__PURE__ */ new Date()).toISOString(),
+		isMobile: !1,
+		description: `${r.kind} ${r.entity} ${r.key}`,
+		details: {
+			shadow: "config-inheritance",
+			legacy_control_plane: i,
+			...r
+		}
+	});
 }
 //#endregion
-//#region src/hooks/sync.ts
-function F(e, t, n = () => !0) {
-	let { controlPlaneTenantId: r, getChildTenantIds: i, getAdapters: a } = e, o = /* @__PURE__ */ new Map();
-	async function s(e, n, r) {
-		return (await t(e).list(n, {
-			q: `name:${u(r)}`,
-			per_page: 1
-		}))[0] ?? null;
-	}
-	async function c(e) {
-		let n = await i(), o = t(await a(r));
-		await Promise.all(n.map(async (n) => {
-			try {
-				let r = await a(n), i = t(r), c = {
-					...o.transform(e),
-					is_system: !0
-				}, l = await s(r, n, e.name), u = l ? i.getId(l) : void 0;
-				if (l && u) {
-					let e = i.preserveOnUpdate ? i.preserveOnUpdate(l, c) : c;
-					await i.update(n, u, e);
-				} else await i.create(n, c);
-			} catch (t) {
-				console.error(`Failed to sync ${o.listKey} "${e.name}" to tenant "${n}":`, t);
-			}
-		}));
-	}
-	async function l(e) {
-		let n = await i();
-		await Promise.all(n.map(async (n) => {
-			try {
-				let r = await a(n), i = t(r), o = await s(r, n, e), c = o ? i.getId(o) : void 0;
-				o && c && await i.remove(n, c);
-			} catch (t) {
-				console.error(`Failed to delete entity "${e}" from tenant "${n}":`, t);
-			}
-		}));
+//#region src/middleware/config-sync-mode.ts
+function Pe(e) {
+	let { base: t, getTenant: n, controlPlaneTenantId: r } = e, i = e.ttlMs ?? 3e4, a = e.maxEntries ?? 1e3, o = /* @__PURE__ */ new Map();
+	async function s(e) {
+		if (e === r) return !1;
+		let t = o.get(e), s = Date.now();
+		if (t && t.expires > s) return t.synced;
+		try {
+			let t = (await n(e))?.config_sync === "synced";
+			return o.size >= a && o.clear(), o.set(e, {
+				synced: t,
+				expires: s + i
+			}), t;
+		} catch {
+			return !1;
+		}
 	}
 	return {
-		afterCreate: async (e, t) => {
-			e.tenantId === r && n(t) && await c(t);
-		},
-		afterUpdate: async (e, t, i) => {
-			e.tenantId === r && n(i) && await c(i);
-		},
-		beforeDelete: async (e, i) => {
-			if (e.tenantId !== r) return;
-			let a = await t(e.adapters).get(e.tenantId, i);
-			a && n(a) && o.set(i, a);
+		isSynced: s,
+		invalidate(e) {
+			e ? o.delete(e) : o.clear();
 		},
-		afterDelete: async (e, t) => {
-			if (e.tenantId !== r) return;
-			let n = o.get(t);
-			n && (o.delete(t), await l(n.name));
+		async resolve({ tenant_id: e }) {
+			let n = await t(e);
+			return !n || n.tenantId === e ? n : await s(e) ? void 0 : n;
 		}
 	};
 }
-function I(e, t, n = () => !0) {
-	let { controlPlaneTenantId: r, getControlPlaneAdapters: i, getAdapters: a } = e;
-	return { async afterCreate(e, o) {
-		if (o.id !== r) try {
-			let e = await i(), s = await a(o.id), c = t(e), l = t(s), u = await d((e) => c.listPaginated(r, e), c.listKey, {
-				cursorField: "id",
-				pageSize: 100
-			});
-			await Promise.all(u.filter((e) => n(e)).map(async (e) => {
-				try {
-					let t = c.transform(e);
-					await l.create(o.id, {
-						...t,
-						is_system: !0
-					});
-				} catch (e) {
+//#endregion
+//#region src/middleware/settings-inheritance.ts
+function R(e, t) {
+	let n = t.find((t) => t.strategy === e.strategy);
+	if (!n?.options) return e;
+	let r = u.passthrough().parse({
+		...n,
+		...e
+	});
+	return r.options = l.passthrough().parse({
+		...n.options || {},
+		...e.options
+	}), r;
+}
+function z(e, t) {
+	let n = [...t || [], ...e || []];
+	return [...new Set(n)];
+}
+function Fe(e, t) {
+	if (!t?.length) return e || [];
+	if (!e?.length) return t;
+	let n = /* @__PURE__ */ new Map();
+	for (let e of t) n.set(e.value, e);
+	for (let t of e) n.set(t.value, t);
+	return Array.from(n.values());
+}
+function Ie(e, t) {
+	return t ? {
+		...e,
+		scopes: Fe(e.scopes, t.scopes)
+	} : e;
+}
+function Le(e, t) {
+	return t ? {
+		...e,
+		callbacks: z(e.callbacks, t.callbacks),
+		web_origins: z(e.web_origins, t.web_origins),
+		allowed_logout_urls: z(e.allowed_logout_urls, t.allowed_logout_urls),
+		allowed_origins: z(e.allowed_origins, t.allowed_origins)
+	} : e;
+}
+function Re(e) {
+	let { controlPlaneTenantId: t, controlPlaneClientId: n, resolveControlPlane: r } = e;
+	if (r) return async (e) => r({ tenant_id: e });
+	if (!t) return async () => void 0;
+	let i = {
+		tenantId: t,
+		clientId: n
+	};
+	return async () => i;
+}
+function ze(e, t) {
+	return {
+		...e.resourceServers,
+		get: async (n, r) => {
+			let i = await e.resourceServers.get(n, r);
+			if (!i) return i;
+			let a = await t(n);
+			return !a || n === a.tenantId || !i.is_system ? i : Ie(i, await e.resourceServers.get(a.tenantId, r));
+		},
+		list: async (n, r) => {
+			let i = await e.resourceServers.list(n, r), a = await t(n);
+			if (!a || n === a.tenantId) return i;
+			let o = a.tenantId, s = i.resource_servers.filter((e) => !!(e.is_system && e.id)).map((e) => e.id);
+			if (s.length === 0) return i;
+			let c = /* @__PURE__ */ new Map();
+			await Promise.all(s.map(async (t) => {
+				let n = await e.resourceServers.get(o, t);
+				n && c.set(t, n);
+			}));
+			let l = i.resource_servers.map((e) => e.is_system && e.id ? Ie(e, c.get(e.id) ?? null) : e);
+			return {
+				...i,
+				resource_servers: l
+			};
+		}
+	};
+}
+function Be(e, t) {
+	let n = Re({
+		controlPlaneTenantId: t.controlPlaneTenantId,
+		resolveControlPlane: t.resolveControlPlane
+	});
+	return {
+		...e,
+		resourceServers: ze(e, n)
+	};
+}
+function Ve(e, t) {
+	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i, inheritanceShadow: a } = t, o = t.configSync ?? Pe({
+		base: Re({
+			controlPlaneTenantId: n,
+			controlPlaneClientId: r,
+			resolveControlPlane: i
+		}),
+		getTenant: async (t) => await e.tenants.get(t) ?? null,
+		controlPlaneTenantId: n
+	}), s = (e) => o.resolve({ tenant_id: e }), c = a ? Me(e, a === !0 ? {} : a) : void 0, l = c ? async (e) => {
+		let t = await s(e);
+		return await o.isSynced(e) || c.schedule(e, t?.tenantId), t;
+	} : s;
+	return {
+		...e,
+		multiTenancyConfig: {
+			controlPlaneTenantId: n,
+			controlPlaneClientId: r,
+			resolveControlPlane: o.resolve
+		},
+		connections: {
+			...e.connections,
+			get: async (t, n) => {
+				let r = await e.connections.get(t, n);
+				if (!r) return r;
+				let i = await l(t);
+				return !i || t === i.tenantId ? r : R(r, (await e.connections.list(i.tenantId)).connections || []);
+			},
+			list: async (t, n) => {
+				let r = await e.connections.list(t, n), i = await l(t);
+				if (!i || t === i.tenantId) return r;
+				let a = await e.connections.list(i.tenantId), o = r.connections.map((e) => R(e, a.connections || []));
+				return {
+					...r,
+					connections: o
+				};
+			}
+		},
+		clientConnections: {
+			...e.clientConnections,
+			listByClient: async (t, n) => {
+				let r = await e.clientConnections.listByClient(t, n);
+				r.length === 0 && (r = (await e.connections.list(t)).connections || []);
+				let i = await l(t);
+				if (!i || t === i.tenantId) return r;
+				let a = await e.connections.list(i.tenantId);
+				return r.map((e) => R(e, a.connections || []));
+			}
+		},
+		emailProviders: {
+			...e.emailProviders,
+			get: async (t) => {
+				let n = await e.emailProviders.get(t);
+				if (n) return n;
+				let r = await l(t);
+				return !r || t === r.tenantId ? null : e.emailProviders.get(r.tenantId);
+			}
+		},
+		resourceServers: ze(e, l),
+		hooks: He(e, l)
+	};
+}
+function B(e) {
+	if (!e || typeof e != "object") return !1;
+	let t = e.metadata;
+	return !t || typeof t != "object" ? !1 : t.inheritable === !0;
+}
+function He(e, t) {
+	return {
+		...e.hooks,
+		list: async (n, r) => {
+			let i = await e.hooks.list(n, r), a = await t(n);
+			if (!a || n === a.tenantId) return i;
+			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(B);
+			if (o.length === 0) return i;
+			let s = new Set((i.hooks || []).map((e) => e.hook_id)), c = [];
+			for (let e of o) s.has(e.hook_id) || e.hook_id && s.has(await W("hook", n, e.hook_id)) || c.push(e);
+			return {
+				...i,
+				hooks: [...i.hooks || [], ...c],
+				length: typeof i.length == "number" ? i.length + c.length : i.length
+			};
+		},
+		get: async (n, r) => {
+			let i = await e.hooks.get(n, r);
+			if (i) return i;
+			let a = await t(n);
+			if (!a || n === a.tenantId) return i;
+			let o = await e.hooks.get(a.tenantId, r);
+			return o && B(o) ? o : null;
+		}
+	};
+}
+function Ue(e, t) {
+	return Ve(e, t);
+}
+//#endregion
+//#region src/inheritance/types.ts
+var We = () => ({
+	connections: [],
+	resourceServers: [],
+	hooks: [],
+	hookCode: [],
+	actions: [],
+	emailProvider: null,
+	branding: null,
+	promptSettings: null
+});
+//#endregion
+//#region src/inheritance/merge.ts
+function V(e, t) {
+	if (t.scope) return t.scope;
+	switch (e) {
+		case "connection":
+		case "emailProvider": return "shared";
+		case "resourceServer":
+		case "action": return t.is_system ? "shared" : "local";
+		case "hook": return B(t) ? "shared" : "local";
+		default: return "local";
+	}
+}
+function H(e) {
+	return e.override ?? "fields";
+}
+var Ge = /secret|password|private_key|api_key|token/i;
+function Ke(e, t) {
+	let n = { ...e ?? {} };
+	for (let [e, r] of Object.entries(t ?? {})) Ge.test(e) && (n[e] = r);
+	return n;
+}
+function qe(e, t) {
+	switch (H(e)) {
+		case "none": return {
+			...e,
+			id: t.id
+		};
+		case "secrets": return {
+			...e,
+			id: t.id,
+			options: Ke(e.options, t.options)
+		};
+		default: return {
+			...e,
+			...t,
+			options: {
+				...e.options ?? {},
+				...t.options ?? {}
+			}
+		};
+	}
+}
+function Je(e, t) {
+	switch (H(e)) {
+		case "none": return {
+			...e,
+			id: t.id
+		};
+		case "secrets": return {
+			...e,
+			id: t.id,
+			signing_secret: t.signing_secret ?? e.signing_secret
+		};
+		default: return {
+			...t,
+			scopes: Fe(t.scopes, e.scopes)
+		};
+	}
+}
+function Ye(e) {
+	return new Map((e ?? []).map((e) => [e.name, e]));
+}
+function Xe(e, t) {
+	let n = H(e);
+	if (n === "none") return {
+		...e,
+		id: t.id
+	};
+	let r = Ye(e.secrets);
+	if (n === "secrets" || n === "fields") for (let [e, n] of Ye(t.secrets)) r.set(e, n);
+	return {
+		...n === "fields" && !t.inherit ? t : e,
+		id: t.id,
+		secrets: [...r.values()]
+	};
+}
+function Ze(e, t) {
+	let n = /* @__PURE__ */ new Set(), r = [...e].reverse().concat(t), i = (e, t, r, i) => r ? t : t.filter((t) => {
+		let r = V(e, t);
+		return r === "local" ? !1 : (r === "platform" && n.add(`${e}:${i(t)}`), !0);
+	}), a = We(), o = (e) => `${e.strategy}:${e.name}`, s = (e) => e.identifier, c = (e) => e.hook_id ?? "", l = (e) => e.name, u = /* @__PURE__ */ new Map(), d = [], f = /* @__PURE__ */ new Map(), p = /* @__PURE__ */ new Map(), m = /* @__PURE__ */ new Map();
+	r.forEach((e, t) => {
+		let h = t === r.length - 1;
+		for (let t of i("connection", e.connections, h, o)) {
+			let e = u.get(t.strategy);
+			h ? d.push(e ? qe(e, t) : t) : u.set(t.strategy, e ? qe(e, t) : t);
+		}
+		for (let t of i("resourceServer", e.resourceServers, h, s)) {
+			let e = f.get(s(t));
+			f.set(s(t), e ? Je(e, t) : t);
+		}
+		for (let t of i("hook", e.hooks, h, c)) p.set(c(t), t);
+		for (let t of i("action", e.actions, h, l)) {
+			let e = m.get(l(t));
+			m.set(l(t), e ? Xe(e, t) : t);
+		}
+		for (let t of [
+			"emailProvider",
+			"branding",
+			"promptSettings"
+		]) {
+			let r = e[t];
+			r && (h || V(t, r) !== "local") && (!h && V(t, r) === "platform" && n.add(`${t}:singleton`), a[t] = r);
+		}
+	});
+	let h = new Set(r[r.length - 1].connections.map((e) => e.strategy));
+	a.connections = [...d, ...[...u.values()].filter((e) => !h.has(e.strategy))], a.resourceServers = [...f.values()], a.hooks = [...p.values()];
+	let g = new Set(a.hooks.map((e) => e.code_id).filter((e) => !!e)), _ = /* @__PURE__ */ new Map();
+	for (let e of [...r].reverse()) for (let t of e.hookCode) g.has(t.id) && !_.has(t.id) && _.set(t.id, t);
+	return a.hookCode = [..._.values()], a.actions = [...m.values()], {
+		...a,
+		hidden: [...n]
+	};
+}
+//#endregion
+//#region src/rollout/resolved-sync.ts
+function U(e) {
+	return Array.isArray(e) ? `[${e.map(U).join(",")}]` : e && typeof e == "object" ? `{${Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : 1).map(([e, t]) => `${JSON.stringify(e)}:${U(t)}`).join(",")}}` : JSON.stringify(e) ?? "null";
+}
+async function Qe(e) {
+	let t = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
+	return [...new Uint8Array(t)].map((e) => e.toString(16).padStart(2, "0")).join("");
+}
+var $e = {
+	connection: "con_",
+	resourceServer: "api_",
+	hook: "h_",
+	hookCode: "hc_",
+	action: "act_"
+};
+async function W(e, t, n) {
+	let r = await Qe(`${t}|${e}|${n}`);
+	return `${$e[e]}sy${r.slice(0, 15)}`;
+}
+function G(e, t) {
+	let n = t;
+	switch (e) {
+		case "connection": return `${n.strategy}:${n.name}`;
+		case "resourceServer": return n.identifier;
+		case "action": return n.name;
+		case "hookCode": return n.id;
+		case "hook": return n.hook_id;
+	}
+}
+async function et(e, t, n = {}) {
+	let r = await N({
+		tenantId: t,
+		getTenant: (t) => e.tenants.get(t),
+		legacyControlPlane: n.legacyControlPlane,
+		maxDepth: n.maxDepth
+	}), i = Ze(await Promise.all(r.map((t) => I(e, t))), We()), a = {
+		version: 1,
+		chain: r,
+		connections: i.connections,
+		resourceServers: i.resourceServers,
+		hookCode: i.hookCode,
+		actions: i.actions,
+		hooks: i.hooks,
+		emailProvider: i.emailProvider,
+		branding: i.branding,
+		promptSettings: i.promptSettings,
+		hidden: i.hidden,
+		deletes: n.deletes ?? []
+	};
+	return {
+		...a,
+		hash: await Qe(U(a))
+	};
+}
+function tt(e, t) {
+	if (typeof e == "string") e.startsWith("enc:v1:") && t.add(e);
+	else if (Array.isArray(e)) for (let n of e) tt(n, t);
+	else if (e && typeof e == "object") for (let n of Object.values(e)) tt(n, t);
+}
+function nt(e) {
+	let t = e.slice(7), n = t.indexOf(":");
+	return n === -1 ? "default" : t.slice(0, n);
+}
+async function rt(e, t) {
+	let n = /* @__PURE__ */ new Set();
+	tt(e, n);
+	let r = /* @__PURE__ */ new Set();
+	for (let e of n) await s(e, t) || r.add(nt(e));
+	return [...r].sort();
+}
+var K = () => ({
+	added: 0,
+	changed: 0,
+	unchanged: 0,
+	deleted: 0,
+	errors: []
+}), it = (e) => U(e);
+async function at(e, t, n, r = {}) {
+	let { dryRun: a = !1, continueOnError: s = !0 } = r, l = {
+		status: a ? "dry-run" : "applied",
+		hash: e.hash,
+		entities: {
+			connection: K(),
+			resourceServer: K(),
+			hookCode: K(),
+			action: K(),
+			hook: K(),
+			emailProvider: K(),
+			branding: K(),
+			promptSettings: K()
+		},
+		changes: []
+	}, u = await t.tenants.get(n), d = !!r.deletes && e.deletes.length > 0;
+	if (!a && !r.force && !d && u?.config_sync_hash === e.hash) return {
+		...l,
+		status: "up-to-date"
+	};
+	if (r.keyRing) {
+		let t = await rt(e, r.keyRing);
+		if (t.length > 0) throw Error(`Cannot sync config to '${n}': its key ring cannot decrypt key id(s) ${t.map((e) => `"${e}"`).join(", ")} carried by the payload. Nothing was written.`);
+	}
+	let p = async (e, t, n) => {
+		let r = l.entities[e];
+		try {
+			let i = await n();
+			r[i] += 1, i !== "unchanged" && l.changes.push(`${e}:${t}`);
+		} catch (n) {
+			let i = `${e} ${t}: ${n instanceof Error ? n.message : String(n)}`;
+			if (!s) throw Error(i, { cause: n });
+			r.errors.push(i);
+		}
+	}, m = async (e) => e.existing ? it(e.view(e.existing)) === it(e.view(e.desired)) ? "unchanged" : (a || await e.update(), "changed") : (a || await e.create(), "added"), _ = (e, t) => W(e, n, t), v = /* @__PURE__ */ new Map();
+	for (let t of e.hookCode) v.set(t.id, await _("hookCode", G("hookCode", t)));
+	for (let t of e.actions) v.set(t.id, await _("action", G("action", t)));
+	for (let r of e.connections) {
+		let e = G("connection", r), i = await _("connection", e);
+		await p("connection", e, async () => {
+			let { enabled_clients: e, ...a } = r, o = c.parse({
+				...a,
+				id: i
+			}), s = await t.connections.get(n, i);
+			return m({
+				existing: s ? c.parse(s) : null,
+				desired: o,
+				create: () => t.connections.create(n, o),
+				update: () => t.connections.update(n, i, o),
+				view: (e) => e
+			});
+		});
+	}
+	for (let r of e.resourceServers) {
+		let e = G("resourceServer", r), i = await _("resourceServer", e);
+		await p("resourceServer", e, async () => {
+			let e = x.parse({
+				...r,
+				id: i
+			}), a = await t.resourceServers.get(n, i);
+			return m({
+				existing: a ? x.parse(a) : null,
+				desired: e,
+				create: () => t.resourceServers.create(n, e),
+				update: () => t.resourceServers.update(n, i, e),
+				view: (e) => e
+			});
+		});
+	}
+	for (let r of e.hookCode) {
+		let e = G("hookCode", r), i = v.get(r.id);
+		await p("hookCode", e, async () => {
+			let e = h.parse(r), a = await t.hookCode.get(n, i);
+			return m({
+				existing: a ? h.parse(a) : null,
+				desired: e,
+				create: () => t.hookCode.create(n, e, { importMetadata: { id: i } }),
+				update: () => t.hookCode.update(n, i, e),
+				view: (e) => e
+			});
+		});
+	}
+	for (let r of e.actions) {
+		let e = G("action", r), a = v.get(r.id);
+		await p("action", e, async () => {
+			let e = i.parse(r), o = await t.actions.get(n, a);
+			return m({
+				existing: o ? i.parse(o) : null,
+				desired: e,
+				create: () => t.actions.create(n, e, { importMetadata: { id: a } }),
+				update: () => t.actions.update(n, a, e),
+				view: (e) => e
+			});
+		});
+	}
+	for (let r of e.hooks) {
+		let e = G("hook", r), i = await _("hook", e);
+		await p("hook", e, async () => {
+			let e = r.code_id, a = g.parse({
+				...r,
+				hook_id: i,
+				...e ? { code_id: v.get(e) ?? e } : {}
+			}), o = await t.hooks.get(n, i);
+			return m({
+				existing: o ? g.parse(o) : null,
+				desired: a,
+				create: () => t.hooks.create(n, a),
+				update: () => t.hooks.update(n, i, a),
+				view: (e) => e
+			});
+		});
+	}
+	e.emailProvider && await p("emailProvider", "singleton", async () => {
+		let r = f.parse(e.emailProvider);
+		return await t.emailProviders.get(n) ? "unchanged" : (a || await t.emailProviders.create(n, r), "added");
+	}), e.branding && await p("branding", "singleton", async () => {
+		let r = o.parse(e.branding);
+		return await t.branding.get(n) ? "unchanged" : (a || await t.branding.set(n, r), "added");
+	});
+	for (let i of e.deletes) {
+		let e = await _(i.entity, i.key), o = `${i.entity}:${i.key}`;
+		try {
+			if (!await ot(t, n, i.entity, e)) continue;
+			l.changes.push(`delete ${o}`), r.deletes && !a && (await st(t, n, i.entity, e), l.entities[i.entity].deleted += 1);
+		} catch (e) {
+			l.entities[i.entity].errors.push(`delete ${o}: ${e instanceof Error ? e.message : e}`);
+		}
+	}
+	let y = Object.values(l.entities).some((e) => e.errors.length > 0);
+	return !a && !y && u && await t.tenants.update(n, {
+		config_sync_hash: e.hash,
+		config_synced_at: (/* @__PURE__ */ new Date()).toISOString()
+	}), l;
+}
+async function ot(e, t, n, r) {
+	switch (n) {
+		case "connection": return !!await e.connections.get(t, r);
+		case "resourceServer": return !!await e.resourceServers.get(t, r);
+		case "hookCode": return !!await e.hookCode.get(t, r);
+		case "action": return !!await e.actions.get(t, r);
+		case "hook": return !!await e.hooks.get(t, r);
+	}
+}
+async function st(e, t, n, r) {
+	switch (n) {
+		case "connection":
+			await e.connections.remove(t, r);
+			return;
+		case "resourceServer":
+			await e.resourceServers.remove(t, r);
+			return;
+		case "hookCode":
+			await e.hookCode.remove(t, r);
+			return;
+		case "action":
+			await e.actions.remove(t, r);
+			return;
+		case "hook":
+			await e.hooks.remove(t, r);
+			return;
+	}
+}
+//#endregion
+//#region src/operations/sync-defaults.ts
+function ct(e) {
+	let t = e.input ?? {};
+	return {
+		dryRun: t.dry_run === !0,
+		force: t.force === !0
+	};
+}
+function lt(e) {
+	return Object.values(e.entities).flatMap((e) => e.errors);
+}
+function ut(e, t) {
+	return {
+		dry_run: t.dryRun,
+		status: e.status,
+		hash: e.hash,
+		changes: e.changes,
+		entities: Object.fromEntries(Object.entries(e.entities).map(([e, t]) => [e, {
+			added: t.added,
+			changed: t.changed,
+			unchanged: t.unchanged,
+			deleted: t.deleted,
+			errors: t.errors.length
+		}]))
+	};
+}
+async function dt(e) {
+	let { operation: t, syncConfig: n, recorder: r } = e;
+	if (!t.tenant_id) throw Error("sync-defaults operations require a tenant_id");
+	let i = ct(t), a = await n(t.tenant_id, i), o = ut(a, i);
+	await r.setResult(t.id, o);
+	let s = lt(a);
+	if (s.length > 0) {
+		let e = s.slice(0, 3).join("; ");
+		throw Error(`sync-defaults reported ${s.length} error(s): ${e}${s.length > 3 ? "; ..." : ""}`);
+	}
+	return o;
+}
+function ft(e, t) {
+	return async (n, r) => {
+		let i = await e.tenants.get(n);
+		if (!i) throw Error(`Tenant "${n}" not found`);
+		if (i.deployment_type === "wfp") throw Error(`Tenant "${n}" has its own database: configure a dispatch sync (syncDefaults) for it`);
+		return at(await et(e, n, {
+			legacyControlPlane: (t.resolveControlPlane ? await t.resolveControlPlane({ tenant_id: n }) : { tenantId: t.controlPlaneTenantId })?.tenantId,
+			maxDepth: t.maxDepth
+		}), e, n, {
+			dryRun: r.dryRun,
+			force: r.force
+		});
+	};
+}
+//#endregion
+//#region src/operations/record-provision.ts
+function pt(e) {
+	if (e.tenantOperations && e.tenantOperationEvents) return {
+		tenantOperations: e.tenantOperations,
+		tenantOperationEvents: e.tenantOperationEvents
+	};
+}
+async function mt(e, t, n) {
+	let r = pt(e);
+	if (!r) {
+		await n(void 0);
+		return;
+	}
+	let i = A(r), a = async (e) => {
+		try {
+			await e();
+		} catch (e) {
+			console.warn("Failed to record tenant operation progress:", e);
+		}
+	}, o;
+	if (await a(async () => {
+		let e = await M(r, t, "inline");
+		o = e.id, await i.markRunning(e.id);
+	}), !o) {
+		await n(void 0);
+		return;
+	}
+	let s = o, c = !1, l = async (e, t, n) => {
+		c = !0, await a(async () => {
+			t === "started" && await i.setCurrentStep(s, e), await i.appendEvent(s, {
+				step: e,
+				outcome: t,
+				detail: n
+			});
+		});
+	};
+	try {
+		await n(l);
+	} catch (e) {
+		throw await a(async () => {
+			c || await i.appendEvent(s, {
+				step: t.kind,
+				outcome: "failed",
+				detail: { message: se(e) }
+			}), await i.markFailed(s, e);
+		}), e;
+	}
+	await a(async () => {
+		c || await i.appendEvent(s, {
+			step: t.kind,
+			outcome: "succeeded"
+		}), await i.markSucceeded(s);
+	});
+}
+//#endregion
+//#region src/hooks/provisioning.ts
+function ht(e) {
+	return `urn:authhero:tenant:${e.toLowerCase()}`;
+}
+function gt(e) {
+	return {
+		async beforeCreate(e, t) {
+			return !t.audience && t.id ? {
+				...t,
+				audience: ht(t.id)
+			} : t;
+		},
+		async afterCreate(t, i) {
+			let { accessControl: a, databaseIsolation: o } = e;
+			if (a && t.ctx && await _t(t, i, a), o?.onProvision) {
+				let e = o.onProvision;
+				o.recordProvisionOperations === !1 ? await e(i.id) : await mt(t.adapters, {
+					kind: "provision",
+					tenant_id: i.id,
+					initiated_by: t.ctx?.var.user?.sub
+				}, (t) => e(i.id, t));
+			} else try {
+				await te(t.adapters, i.id, {
+					managementApiIdentifier: n,
+					managementApiScopes: r
+				});
+			} catch (e) {
+				throw console.warn(`Failed to provision default clients for tenant ${i.id}:`, e), e;
+			}
+		},
+		async beforeDelete(t, n) {
+			let { accessControl: r, databaseIsolation: i } = e;
+			if (r) try {
+				let e = (await t.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find((e) => e.name === n);
+				e && await t.adapters.organizations.remove(r.controlPlaneTenantId, e.id);
+			} catch (e) {
+				console.warn(`Failed to remove organization for tenant ${n}:`, e);
+			}
+			if (i?.onDeprovision) try {
+				await i.onDeprovision(n);
+			} catch (e) {
+				console.warn(`Failed to deprovision database for tenant ${n}:`, e);
+			}
+		}
+	};
+}
+async function _t(e, t, n) {
+	let { controlPlaneTenantId: r, defaultPermissions: i, defaultRoles: a, issuer: o, adminRoleName: s = "Tenant Admin", adminRoleDescription: c = "Full access to all tenant management operations", addCreatorToOrganization: l = !0 } = n, u = await e.adapters.organizations.create(r, {
+		name: t.id,
+		display_name: t.friendly_name || t.id
+	}), d;
+	if (o && (d = await yt(e, r, s, c)), l && e.ctx) {
+		let t = e.ctx.var.user;
+		if (t?.sub && !await vt(e, r, t.sub)) try {
+			await e.adapters.userOrganizations.create(r, {
+				user_id: t.sub,
+				organization_id: u.id
+			}), d && await e.adapters.userRoles.create(r, t.sub, d, u.id);
+		} catch (e) {
+			console.warn(`Failed to add creator ${t.sub} to organization ${u.id}:`, e);
+		}
+	}
+	a && a.length > 0 && console.log(`Would assign roles ${a.join(", ")} to organization ${u.id}`), i && i.length > 0 && console.log(`Would grant permissions ${i.join(", ")} to organization ${u.id}`);
+}
+async function vt(e, t, r) {
+	let i = await e.adapters.userRoles.list(t, r, void 0, "");
+	for (let r of i) if ((await e.adapters.rolePermissions.list(t, r.id, { per_page: 1e3 })).some((e) => e.permission_name === "admin:organizations" && e.resource_server_identifier === n)) return !0;
+	return !1;
+}
+async function yt(e, t, i, a) {
+	let o = (await e.adapters.roles.list(t, {})).roles.find((e) => e.name === i);
+	if (o) return o.id;
+	let s = await e.adapters.roles.create(t, {
+		name: i,
+		description: a
+	}), c = n, l = r.map((e) => ({
+		role_id: s.id,
+		resource_server_identifier: c,
+		permission_name: e.value
+	}));
+	return await e.adapters.rolePermissions.assign(t, s.id, l), s.id;
+}
+//#endregion
+//#region src/hooks/sync.ts
+function bt(e, t, n = () => !0) {
+	let { controlPlaneTenantId: r, getChildTenantIds: i, getAdapters: a } = e, o = /* @__PURE__ */ new Map();
+	async function s(e, n, r) {
+		return (await t(e).list(n, {
+			q: `name:${p(r)}`,
+			per_page: 1
+		}))[0] ?? null;
+	}
+	async function c(e) {
+		let n = await i(), o = t(await a(r));
+		await Promise.all(n.map(async (n) => {
+			try {
+				let r = await a(n), i = t(r), c = {
+					...o.transform(e),
+					is_system: !0
+				}, l = await s(r, n, e.name), u = l ? i.getId(l) : void 0;
+				if (l && u) {
+					let e = i.preserveOnUpdate ? i.preserveOnUpdate(l, c) : c;
+					await i.update(n, u, e);
+				} else await i.create(n, c);
+			} catch (t) {
+				console.error(`Failed to sync ${o.listKey} "${e.name}" to tenant "${n}":`, t);
+			}
+		}));
+	}
+	async function l(e) {
+		let n = await i();
+		await Promise.all(n.map(async (n) => {
+			try {
+				let r = await a(n), i = t(r), o = await s(r, n, e), c = o ? i.getId(o) : void 0;
+				o && c && await i.remove(n, c);
+			} catch (t) {
+				console.error(`Failed to delete entity "${e}" from tenant "${n}":`, t);
+			}
+		}));
+	}
+	return {
+		afterCreate: async (e, t) => {
+			e.tenantId === r && n(t) && await c(t);
+		},
+		afterUpdate: async (e, t, i) => {
+			e.tenantId === r && n(i) && await c(i);
+		},
+		beforeDelete: async (e, i) => {
+			if (e.tenantId !== r) return;
+			let a = await t(e.adapters).get(e.tenantId, i);
+			a && n(a) && o.set(i, a);
+		},
+		afterDelete: async (e, t) => {
+			if (e.tenantId !== r) return;
+			let n = o.get(t);
+			n && (o.delete(t), await l(n.name));
+		}
+	};
+}
+function xt(e, t, n = () => !0) {
+	let { controlPlaneTenantId: r, getControlPlaneAdapters: i, getAdapters: a } = e;
+	return { async afterCreate(e, o) {
+		if (o.id !== r) try {
+			let e = await i(), s = await a(o.id), c = t(e), l = t(s), u = await m((e) => c.listPaginated(r, e), c.listKey, {
+				cursorField: "id",
+				pageSize: 100
+			});
+			await Promise.all(u.filter((e) => n(e)).map(async (e) => {
+				try {
+					let t = c.transform(e);
+					await l.create(o.id, {
+						...t,
+						is_system: !0
+					});
+				} catch (e) {
 					console.error(`Failed to sync entity to new tenant "${o.id}":`, e);
 				}
 			}));
@@ -403,7 +1401,7 @@ function I(e, t, n = () => !0) {
 		}
 	} };
 }
-var L = (e) => ({
+var St = (e) => ({
 	list: async (t, n) => (await e.resourceServers.list(t, n)).resource_servers,
 	listPaginated: (t, n) => e.resourceServers.list(t, n),
 	get: (t, n) => e.resourceServers.get(t, n),
@@ -421,7 +1419,7 @@ var L = (e) => ({
 		token_lifetime: e.token_lifetime,
 		token_lifetime_for_web: e.token_lifetime_for_web
 	})
-}), R = (e) => ({
+}), Ct = (e) => ({
 	list: async (t, n) => (await e.roles.list(t, n)).roles,
 	listPaginated: (t, n) => e.roles.list(t, n),
 	get: (t, n) => e.roles.get(t, n),
@@ -436,20 +1434,20 @@ var L = (e) => ({
 		description: e.description
 	})
 });
-function z(e) {
+function wt(e) {
 	return e.metadata?.sync !== !1;
 }
-function B(e) {
-	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => z(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => z(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? F(e, L, a) : void 0, c = i ? F(e, R, o) : void 0, l = r ? I(e, L, a) : void 0, f = i ? I(e, R, o) : void 0, p = i ? { async afterCreate(t, r) {
+function Tt(e) {
+	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => wt(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => wt(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? bt(e, St, a) : void 0, c = i ? bt(e, Ct, o) : void 0, l = r ? xt(e, St, a) : void 0, u = i ? xt(e, Ct, o) : void 0, d = i ? { async afterCreate(t, r) {
 		if (r.id !== e.controlPlaneTenantId) {
-			await f?.afterCreate?.(t, r);
+			await u?.afterCreate?.(t, r);
 			try {
-				let t = await e.getControlPlaneAdapters(), i = await e.getAdapters(r.id), a = await d((n) => t.roles.list(e.controlPlaneTenantId, n), "roles", {
+				let t = await e.getControlPlaneAdapters(), i = await e.getAdapters(r.id), a = await m((n) => t.roles.list(e.controlPlaneTenantId, n), "roles", {
 					cursorField: "id",
 					pageSize: 100
 				}), o = /* @__PURE__ */ new Map();
 				for (let e of a.filter((e) => n.roles?.(e) ?? !0)) {
-					let t = await m(i, r.id, e.name);
+					let t = await f(i, r.id, e.name);
 					t && o.set(e.name, t.id);
 				}
 				for (let s of a.filter((e) => n.roles?.(e) ?? !0)) {
@@ -470,9 +1468,9 @@ function B(e) {
 			}
 		}
 	} } : void 0;
-	async function m(e, t, n) {
+	async function f(e, t, n) {
 		return (await e.roles.list(t, {
-			q: `name:${u(n)}`,
+			q: `name:${p(n)}`,
 			per_page: 1
 		})).roles[0] ?? null;
 	}
@@ -482,7 +1480,7 @@ function B(e) {
 			roles: c
 		},
 		tenantHooks: { async afterCreate(e, t) {
-			let n = [l?.afterCreate, p?.afterCreate ?? f?.afterCreate], r = [];
+			let n = [l?.afterCreate, d?.afterCreate ?? u?.afterCreate], r = [];
 			for (let i of n) if (i) try {
 				await i(e, t);
 			} catch (e) {
@@ -495,48 +1493,54 @@ function B(e) {
 }
 //#endregion
 //#region src/middleware/request-data.ts
-function V(e) {
+function q(e) {
 	return e.var.data ?? e.env.data;
 }
 //#endregion
 //#region src/routes/tenants.ts
-var de = C.object({
-	sub: C.string(),
-	tenant_id: C.string().optional(),
-	org_id: C.string().optional(),
-	scope: C.string().optional(),
-	permissions: C.array(C.string()).optional()
+var Et = D.object({
+	sub: D.string(),
+	tenant_id: D.string().optional(),
+	org_id: D.string().optional(),
+	scope: D.string().optional(),
+	permissions: D.array(D.string()).optional()
 }).passthrough();
-function fe(e) {
-	let t = de.safeParse(e);
+function Dt(e) {
+	let t = Et.safeParse(e);
 	return t.success ? t.data : void 0;
 }
-function pe(e) {
+function Ot(e, t, n) {
+	return t ? !e || n ? !1 : e.tenant_id === t : !0;
+}
+function kt(e) {
 	let t = e.permissions ?? [], n = e.scope ? e.scope.split(" ").filter(Boolean) : [], r = new Set([...t, ...n]);
 	return r.has("delete:tenants") || r.has("admin:organizations");
 }
-function H(e, t) {
-	let n = new x();
-	return n.openapi(S({
+function At(e, t) {
+	let n = new T(), r = (t) => {
+		let n = Dt(t.var.user);
+		return Ot(n, e.accessControl?.controlPlaneTenantId ?? q(t).multiTenancyConfig?.controlPlaneTenantId, !!(n?.org_id ?? t.var.organization_id ?? t.var.org_name));
+	};
+	if (n.openapi(E({
 		tags: ["tenants"],
 		method: "get",
 		path: "/",
-		request: { query: r },
+		request: { query: a },
 		security: [{ Bearer: [] }],
 		responses: { 200: {
-			content: { "application/json": { schema: C.object({
-				tenants: C.array(b),
-				start: C.number().optional(),
-				limit: C.number().optional(),
-				length: C.number().optional(),
-				total: C.number().optional()
+			content: { "application/json": { schema: D.object({
+				tenants: D.array(C),
+				start: D.number().optional(),
+				limit: D.number().optional(),
+				length: D.number().optional(),
+				total: D.number().optional()
 			}) } },
 			description: "List of tenants"
 		} }
 	}), async (t) => {
 		let { page: n, per_page: r, include_totals: i, q: a } = t.req.valid("query"), o = t.var.user, s = o?.permissions || [];
 		if (!(o?.org_id ?? t.var.organization_id) && s.includes("admin:organizations")) {
-			let e = await V(t).tenants.list({
+			let e = await q(t).tenants.list({
 				page: n,
 				per_page: r,
 				include_totals: i,
@@ -550,10 +1554,10 @@ function H(e, t) {
 				total: e.totals?.length
 			}) : t.json({ tenants: e.tenants });
 		}
-		let c = e.accessControl?.controlPlaneTenantId ?? V(t).multiTenancyConfig?.controlPlaneTenantId;
+		let c = e.accessControl?.controlPlaneTenantId ?? q(t).multiTenancyConfig?.controlPlaneTenantId;
 		if (c && !o?.sub) throw new w(403, { message: "Access denied: token has no subject" });
 		if (c && o?.sub) {
-			let e = (await d((e) => V(t).userOrganizations.listUserOrganizations(c, o.sub, e), "organizations")).map((e) => e.name);
+			let e = (await m((e) => q(t).userOrganizations.listUserOrganizations(c, o.sub, e), "organizations")).map((e) => e.name);
 			if (e.length === 0) return i ? t.json({
 				tenants: [],
 				start: 0,
@@ -561,28 +1565,28 @@ function H(e, t) {
 				length: 0,
 				total: 0
 			}) : t.json({ tenants: [] });
-			let s = e.length, l = n ?? 0, u = r ?? 50, f = l * u, p = e.slice(f, f + u);
-			if (p.length === 0) return i ? t.json({
+			let s = e.length, l = n ?? 0, u = r ?? 50, d = l * u, f = e.slice(d, d + u);
+			if (f.length === 0) return i ? t.json({
 				tenants: [],
-				start: f,
+				start: d,
 				limit: u,
 				length: 0,
 				total: s
 			}) : t.json({ tenants: [] });
-			let m = p.map((e) => `id:${e}`).join(" OR "), h = a ? `(${m}) AND (${a})` : m, g = await V(t).tenants.list({
+			let p = f.map((e) => `id:${e}`).join(" OR "), h = a ? `(${p}) AND (${a})` : p, g = await q(t).tenants.list({
 				q: h,
 				per_page: u,
 				include_totals: !1
 			});
 			return i ? t.json({
 				tenants: g.tenants,
-				start: f,
+				start: d,
 				limit: u,
 				length: g.tenants.length,
 				total: s
 			}) : t.json({ tenants: g.tenants });
 		}
-		let l = await V(t).tenants.list({
+		let l = await q(t).tenants.list({
 			page: n,
 			per_page: r,
 			include_totals: i,
@@ -595,34 +1599,44 @@ function H(e, t) {
 			length: l.tenants.length,
 			total: l.totals?.length
 		}) : t.json({ tenants: l.tenants });
-	}), n.openapi(S({
+	}), n.openapi(E({
 		tags: ["tenants"],
 		method: "post",
 		path: "/",
-		request: { body: { content: { "application/json": { schema: y } } } },
+		request: { body: { content: { "application/json": { schema: S } } } },
 		security: [{ Bearer: [] }],
 		responses: {
 			201: {
-				content: { "application/json": { schema: b } },
+				content: { "application/json": { schema: C } },
 				description: "Tenant created"
 			},
 			400: { description: "Validation error" },
 			409: { description: "Tenant with this ID already exists" }
 		}
-	}), async (e) => {
-		if (!e.var.user?.sub) throw new w(401, { message: "Authentication required to create tenants" });
-		let n = e.req.valid("json"), r = {
-			adapters: V(e),
-			ctx: e
+	}), async (n) => {
+		if (!n.var.user?.sub) throw new w(401, { message: "Authentication required to create tenants" });
+		let { config_sync_hash: i, config_synced_at: a, config_sync: o, ...s } = n.req.valid("json"), c = s;
+		if (c.parent_tenant_id && !r(n)) throw new w(403, { message: "Only the control plane can set a tenant's parent" });
+		o !== void 0 && r(n) && (c = {
+			...c,
+			config_sync: o
+		});
+		let l = {
+			adapters: q(n),
+			ctx: n
 		};
-		t.tenants?.beforeCreate && (n = await t.tenants.beforeCreate(r, n));
-		let i = await V(e).tenants.create(n);
-		return t.tenants?.afterCreate && await t.tenants.afterCreate(r, i), e.json(i, 201);
-	}), n.openapi(S({
+		t.tenants?.beforeCreate && (c = await t.tenants.beforeCreate(l, c)), await de({
+			tenantId: c.id,
+			parentTenantId: c.parent_tenant_id,
+			getTenant: (e) => q(n).tenants.get(e)
+		});
+		let u = await q(n).tenants.create(c);
+		return t.tenants?.afterCreate && await t.tenants.afterCreate(l, u), e.onConfigSyncChange?.(u.id), n.json(u, 201);
+	}), n.openapi(E({
 		tags: ["tenants"],
 		method: "delete",
 		path: "/{id}",
-		request: { params: C.object({ id: C.string() }) },
+		request: { params: D.object({ id: D.string() }) },
 		security: [{ Bearer: ["delete:tenants"] }],
 		responses: {
 			204: { description: "Tenant deleted" },
@@ -630,72 +1644,116 @@ function H(e, t) {
 			404: { description: "Tenant not found" }
 		}
 	}), async (n) => {
-		let { id: r } = n.req.valid("param"), i = e.accessControl?.controlPlaneTenantId ?? V(n).multiTenancyConfig?.controlPlaneTenantId;
+		let { id: r } = n.req.valid("param"), i = e.accessControl?.controlPlaneTenantId ?? q(n).multiTenancyConfig?.controlPlaneTenantId;
 		if (i) {
-			let e = fe(n.var.user);
+			let e = Dt(n.var.user);
 			if (!e?.sub) throw new w(401, { message: "Authentication required" });
 			if (r === i) throw new w(403, { message: "Cannot delete the control plane" });
 			let t = n.var.org_name, a = r.toLowerCase(), o = !!t && t.toLowerCase() === a;
 			if (!o) {
 				let r = !!(e.org_id ?? n.var.organization_id ?? t), a = !e.tenant_id || e.tenant_id === i;
-				!r && a && pe(e) && (o = !0);
+				!r && a && kt(e) && (o = !0);
 			}
-			if (o ||= (await d((t) => V(n).userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new w(403, { message: "Access denied to this tenant" });
+			if (o ||= (await m((t) => q(n).userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new w(403, { message: "Access denied to this tenant" });
 		}
-		if (!await V(n).tenants.get(r)) throw new w(404, { message: "Tenant not found" });
+		if (!await q(n).tenants.get(r)) throw new w(404, { message: "Tenant not found" });
 		let a = {
-			adapters: V(n),
+			adapters: q(n),
 			ctx: n
 		};
-		return t.tenants?.beforeDelete && await t.tenants.beforeDelete(a, r), await V(n).tenants.remove(r), t.tenants?.afterDelete && await t.tenants.afterDelete(a, r), n.body(null, 204);
-	}), n.openapi(S({
+		return t.tenants?.beforeDelete && await t.tenants.beforeDelete(a, r), await q(n).tenants.remove(r), t.tenants?.afterDelete && await t.tenants.afterDelete(a, r), n.body(null, 204);
+	}), e.configSyncStatus) {
+		let t = e.configSyncStatus;
+		n.openapi(E({
+			tags: ["tenants"],
+			method: "get",
+			path: "/{id}/config-sync",
+			request: { params: D.object({ id: D.string() }) },
+			security: [{ Bearer: ["read:tenants"] }],
+			responses: {
+				200: {
+					content: { "application/json": { schema: D.object({
+						tenant_id: D.string(),
+						parent_tenant_id: D.string().nullable(),
+						config_sync: D.enum(["inherit-on-read", "synced"]),
+						config_sync_hash: D.string().nullable(),
+						config_synced_at: D.string().nullable(),
+						expected_hash: D.string().nullable(),
+						drifted: D.boolean(),
+						chain: D.array(D.string()),
+						inherited: D.record(D.string(), D.string())
+					}) } },
+					description: "Config sync status of the tenant"
+				},
+				403: { description: "Not allowed to read this tenant" },
+				404: { description: "Tenant not found" }
+			}
+		}), async (e) => {
+			let { id: n } = e.req.valid("param");
+			if (n !== e.var.tenant_id && !r(e)) throw new w(403, { message: "Config sync status is only readable for your own tenant" });
+			let i = await t(n);
+			if (!i) throw new w(404, { message: "Tenant not found" });
+			return e.json(i);
+		});
+	}
+	return n.openapi(E({
 		tags: ["tenants", "settings"],
 		method: "get",
 		path: "/settings",
-		request: { headers: C.object({ "tenant-id": C.string().optional() }) },
+		request: { headers: D.object({ "tenant-id": D.string().optional() }) },
 		security: [{ Bearer: ["read:tenants"] }],
 		responses: { 200: {
-			content: { "application/json": { schema: b } },
+			content: { "application/json": { schema: C } },
 			description: "Current tenant settings"
 		} }
 	}), async (e) => {
-		let t = await V(e).tenants.get(e.var.tenant_id);
+		let t = await q(e).tenants.get(e.var.tenant_id);
 		if (!t) throw new w(404, { message: "Tenant not found" });
 		return e.json(t);
-	}), n.openapi(S({
+	}), n.openapi(E({
 		tags: ["tenants", "settings"],
 		method: "patch",
 		path: "/settings",
 		request: {
-			headers: C.object({ "tenant-id": C.string().optional() }),
-			body: { content: { "application/json": { schema: C.object(y.shape).partial() } } }
+			headers: D.object({ "tenant-id": D.string().optional() }),
+			body: { content: { "application/json": { schema: D.object(S.shape).partial() } } }
 		},
 		security: [{ Bearer: ["update:tenants"] }],
 		responses: { 200: {
-			content: { "application/json": { schema: b } },
+			content: { "application/json": { schema: C } },
 			description: "Updated tenant settings"
 		} }
-	}), async (e) => {
-		let { id: t, ...n } = e.req.valid("json"), r = await V(e).tenants.get(e.var.tenant_id);
-		if (!r) throw new w(404, { message: "Tenant not found" });
-		if ("default_client_id" in n) {
-			let t = n.default_client_id;
-			if (typeof t == "string" && t.length > 0) {
-				let n = await V(e).clients.get(e.var.tenant_id, t);
-				if (!n) throw new w(400, { message: `Client with id '${t}' not found` });
-				if (!m(n)) throw new w(400, { message: `Client '${t}' is not an interactive client and cannot be used as the default client` });
+	}), async (t) => {
+		let { id: n, config_sync_hash: i, config_synced_at: a, ...o } = t.req.valid("json"), s = await q(t).tenants.get(t.var.tenant_id);
+		if (!s) throw new w(404, { message: "Tenant not found" });
+		if ("config_sync" in o && (o.config_sync ?? "inherit-on-read") !== (s.config_sync ?? "inherit-on-read") && !r(t)) throw new w(403, { message: "Only the control plane can change a tenant's config_sync mode" });
+		if ("default_client_id" in o) {
+			let e = o.default_client_id;
+			if (typeof e == "string" && e.length > 0) {
+				let n = await q(t).clients.get(t.var.tenant_id, e);
+				if (!n) throw new w(400, { message: `Client with id '${e}' not found` });
+				if (!v(n)) throw new w(400, { message: `Client '${e}' is not an interactive client and cannot be used as the default client` });
 			}
 		}
-		let i = c(r, n);
-		await V(e).tenants.update(e.var.tenant_id, i);
-		let a = await V(e).tenants.get(e.var.tenant_id);
-		if (!a) throw new w(500, { message: "Failed to retrieve updated tenant" });
-		return e.json(a);
+		if ("parent_tenant_id" in o) {
+			if ((o.parent_tenant_id ?? null) !== (s.parent_tenant_id ?? null) && !r(t)) throw new w(403, { message: "Only the control plane can change a tenant's parent" });
+			await de({
+				tenantId: t.var.tenant_id,
+				parentTenantId: o.parent_tenant_id,
+				getTenant: (e) => q(t).tenants.get(e),
+				getChildren: async (e) => (await m((e) => q(t).tenants.list(e), "tenants")).filter((t) => t.parent_tenant_id === e).map((e) => e.id)
+			});
+		}
+		let c = d(s, o);
+		await q(t).tenants.update(t.var.tenant_id, c), "config_sync" in o && e.onConfigSyncChange?.(t.var.tenant_id);
+		let l = await q(t).tenants.get(t.var.tenant_id);
+		if (!l) throw new w(500, { message: "Failed to retrieve updated tenant" });
+		return t.json(l);
 	}), n;
 }
 //#endregion
 //#region src/middleware/protect-synced.ts
-function me(e) {
+function jt(e) {
 	for (let { pattern: t, type: n } of [
 		{
 			pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
@@ -718,7 +1776,7 @@ function me(e) {
 	}
 	return null;
 }
-async function he(e, t, n) {
+async function Mt(e, t, n) {
 	try {
 		switch (n.type) {
 			case "resource_server": return (await e.resourceServers.get(t, n.id))?.is_system === !0;
@@ -730,222 +1788,148 @@ async function he(e, t, n) {
 		return !1;
 	}
 }
-function ge(e) {
-	return {
-		resource_server: "resource server",
-		role: "role",
-		connection: "connection"
-	}[e];
-}
-function U() {
-	return async (e, t) => {
-		if (![
-			"PATCH",
-			"PUT",
-			"DELETE"
-		].includes(e.req.method)) return t();
-		let n = me(e.req.path);
-		if (!n) return t();
-		let r = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
-		if (!r) return t();
-		if (await he(V(e), r, n)) throw new w(403, { message: `This ${ge(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
-		return t();
-	};
-}
-//#endregion
-//#region src/middleware/settings-inheritance.ts
-function W(e, t) {
-	let n = t.find((t) => t.strategy === e.strategy);
-	if (!n?.options) return e;
-	let r = s.passthrough().parse({
-		...n,
-		...e
-	});
-	return r.options = o.passthrough().parse({
-		...n.options || {},
-		...e.options
-	}), r;
-}
-function G(e, t) {
-	let n = [...t || [], ...e || []];
-	return [...new Set(n)];
-}
-function _e(e, t) {
-	if (!t?.length) return e || [];
-	if (!e?.length) return t;
-	let n = /* @__PURE__ */ new Map();
-	for (let e of t) n.set(e.value, e);
-	for (let t of e) n.set(t.value, t);
-	return Array.from(n.values());
-}
-function ve(e, t) {
-	return t ? {
-		...e,
-		scopes: _e(e.scopes, t.scopes)
-	} : e;
-}
-function ye(e, t) {
-	return t ? {
-		...e,
-		callbacks: G(e.callbacks, t.callbacks),
-		web_origins: G(e.web_origins, t.web_origins),
-		allowed_logout_urls: G(e.allowed_logout_urls, t.allowed_logout_urls),
-		allowed_origins: G(e.allowed_origins, t.allowed_origins)
-	} : e;
-}
-function be(e) {
-	let { controlPlaneTenantId: t, controlPlaneClientId: n, resolveControlPlane: r } = e;
-	if (r) return async (e) => r({ tenant_id: e });
-	if (!t) return async () => void 0;
-	let i = {
-		tenantId: t,
-		clientId: n
-	};
-	return async () => i;
-}
-function xe(e, t) {
-	return {
-		...e.resourceServers,
-		get: async (n, r) => {
-			let i = await e.resourceServers.get(n, r);
-			if (!i) return i;
-			let a = await t(n);
-			return !a || n === a.tenantId || !i.is_system ? i : ve(i, await e.resourceServers.get(a.tenantId, r));
-		},
-		list: async (n, r) => {
-			let i = await e.resourceServers.list(n, r), a = await t(n);
-			if (!a || n === a.tenantId) return i;
-			let o = a.tenantId, s = i.resource_servers.filter((e) => !!(e.is_system && e.id)).map((e) => e.id);
-			if (s.length === 0) return i;
-			let c = /* @__PURE__ */ new Map();
-			await Promise.all(s.map(async (t) => {
-				let n = await e.resourceServers.get(o, t);
-				n && c.set(t, n);
-			}));
-			let l = i.resource_servers.map((e) => e.is_system && e.id ? ve(e, c.get(e.id) ?? null) : e);
-			return {
-				...i,
-				resource_servers: l
-			};
-		}
-	};
-}
-function Se(e, t) {
-	let n = be({
-		controlPlaneTenantId: t.controlPlaneTenantId,
-		resolveControlPlane: t.resolveControlPlane
-	});
-	return {
-		...e,
-		resourceServers: xe(e, n)
-	};
-}
-function Ce(e, t) {
-	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i } = t, a = be({
-		controlPlaneTenantId: n,
-		controlPlaneClientId: r,
-		resolveControlPlane: i
-	});
-	return {
-		...e,
-		multiTenancyConfig: {
-			controlPlaneTenantId: n,
-			controlPlaneClientId: r,
-			resolveControlPlane: i
-		},
-		connections: {
-			...e.connections,
-			get: async (t, n) => {
-				let r = await e.connections.get(t, n);
-				if (!r) return r;
-				let i = await a(t);
-				return !i || t === i.tenantId ? r : W(r, (await e.connections.list(i.tenantId)).connections || []);
-			},
-			list: async (t, n) => {
-				let r = await e.connections.list(t, n), i = await a(t);
-				if (!i || t === i.tenantId) return r;
-				let o = await e.connections.list(i.tenantId), s = r.connections.map((e) => W(e, o.connections || []));
-				return {
-					...r,
-					connections: s
-				};
-			}
-		},
-		clientConnections: {
-			...e.clientConnections,
-			listByClient: async (t, n) => {
-				let r = await e.clientConnections.listByClient(t, n);
-				r.length === 0 && (r = (await e.connections.list(t)).connections || []);
-				let i = await a(t);
-				if (!i || t === i.tenantId) return r;
-				let o = await e.connections.list(i.tenantId);
-				return r.map((e) => W(e, o.connections || []));
-			}
-		},
-		emailProviders: {
-			...e.emailProviders,
-			get: async (t) => {
-				let n = await e.emailProviders.get(t);
-				if (n) return n;
-				let r = await a(t);
-				return !r || t === r.tenantId ? null : e.emailProviders.get(r.tenantId);
-			}
-		},
-		resourceServers: xe(e, a),
-		hooks: Te(e, a)
-	};
-}
-function we(e) {
-	if (!e || typeof e != "object") return !1;
-	let t = e.metadata;
-	return !t || typeof t != "object" ? !1 : t.inheritable === !0;
-}
-function Te(e, t) {
+function Nt(e) {
 	return {
-		...e.hooks,
-		list: async (n, r) => {
-			let i = await e.hooks.list(n, r), a = await t(n);
-			if (!a || n === a.tenantId) return i;
-			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(we);
-			if (o.length === 0) return i;
-			let s = new Set((i.hooks || []).map((e) => e.hook_id)), c = o.filter((e) => !s.has(e.hook_id));
-			return {
-				...i,
-				hooks: [...i.hooks || [], ...c],
-				length: typeof i.length == "number" ? i.length + c.length : i.length
-			};
+		resource_server: "resource server",
+		role: "role",
+		connection: "connection"
+	}[e];
+}
+function Pt(e) {
+	for (let { pattern: t, type: n } of [
+		{
+			pattern: /\/api\/v2\/connections\/([^/]+)$/,
+			type: "connection"
 		},
-		get: async (n, r) => {
-			let i = await e.hooks.get(n, r);
-			if (i) return i;
-			let a = await t(n);
-			if (!a || n === a.tenantId) return i;
-			let o = await e.hooks.get(a.tenantId, r);
-			return o && we(o) ? o : null;
+		{
+			pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
+			type: "resource_server"
+		},
+		{
+			pattern: /\/api\/v2\/actions\/actions\/([^/]+)$/,
+			type: "action"
+		},
+		{
+			pattern: /\/api\/v2\/hooks\/([^/]+)$/,
+			type: "hook"
+		},
+		{
+			pattern: /\/api\/v2\/hook-code\/([^/]+)$/,
+			type: "hook_code"
+		}
+	]) {
+		let r = e.match(t);
+		if (r?.[1]) return {
+			type: n,
+			id: r[1]
+		};
+	}
+	return null;
+}
+async function Ft(e, t, n) {
+	try {
+		switch (n.type) {
+			case "connection": return await e.connections.get(t, n.id);
+			case "resource_server": return await e.resourceServers.get(t, n.id);
+			case "action": return await e.actions.get(t, n.id);
+			case "hook": return await e.hooks.get(t, n.id);
+			case "hook_code": return await e.hookCode.get(t, n.id);
 		}
+	} catch {
+		return null;
+	}
+}
+var It = {
+	connection: ["options"],
+	resource_server: ["signing_secret"],
+	action: ["secrets"],
+	hook: [],
+	hook_code: []
+}, Lt = new Set([
+	"client_secret",
+	"app_secret",
+	"twilio_token"
+]);
+function Rt(e, t) {
+	let n = (e) => {
+		let { client_secret: t, ...n } = e ?? {};
+		return n;
 	};
+	return zt(n(e), n(t));
+}
+var zt = (e, t) => JSON.stringify(e) === JSON.stringify(t);
+function J(e, t) {
+	return new w(403, { message: `This ${e.type.replace("_", " ")} is synced from a parent tenant and ${t}. Make changes in the parent tenant instead.` });
+}
+async function Bt(e, t, n) {
+	let r = await Ft(q(e), t, n);
+	if (!r) return;
+	if (n.type === "hook_code") throw J(n, "cannot be modified");
+	if (e.req.method === "DELETE") {
+		if (r.enforce === !0) throw J(n, "cannot be deleted");
+		return;
+	}
+	let i = r.override ?? "fields";
+	if (i === "none") throw J(n, "cannot be edited");
+	let a = {};
+	try {
+		let t = await e.req.raw.clone().json();
+		t && typeof t == "object" && (a = t);
+	} catch {}
+	for (let e of [
+		"scope",
+		"override",
+		"enforce"
+	]) if (e in a && !zt(a[e] ?? null, r[e] ?? null)) throw J(n, `has a locked ${e}`);
+	if (r.enforce === !0 && a.enabled === !1) throw J(n, "cannot be disabled");
+	if (i === "secrets") {
+		let e = It[n.type];
+		for (let [t, i] of Object.entries(a)) if (![
+			"scope",
+			"override",
+			"enforce"
+		].includes(t) && !zt(i, r[t])) {
+			if (!e.includes(t)) throw J(n, `only allows its secrets to be changed (not ${t})`);
+			if (t === "options" && i && typeof i == "object") {
+				let e = r.options ?? {};
+				for (let [t, r] of Object.entries(i)) if (!zt(r, e[t]) && !t.endsWith("_hint") && !(Lt.has(t) || t === "configuration" && Rt(r, e[t]))) throw J(n, `only allows its secrets to be changed (not options.${t})`);
+			}
+		}
+	}
 }
-function K(e, t) {
-	return Ce(e, t);
+function Vt() {
+	return async (e, t) => {
+		if (![
+			"PATCH",
+			"PUT",
+			"DELETE"
+		].includes(e.req.method)) return t();
+		let n = jt(e.req.path), r = Pt(e.req.path);
+		if (!n && !r) return t();
+		let i = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
+		if (!i) return t();
+		if (n && await Mt(q(e), i, n)) throw new w(403, { message: `This ${Nt(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
+		return r && y(r.id) && await Bt(e, i, r), t();
+	};
 }
 //#endregion
 //#region src/middleware/index.ts
-function Ee(e) {
+function Ht(e) {
 	return async (t, n) => {
 		let r = t.var.user;
 		return r?.tenant_id === e && r.org_name && t.set("tenant_id", r.org_name), n();
 	};
 }
-function De(e) {
-	return async (n, r) => {
+function Ut(e) {
+	return async (t, r) => {
 		if (!e.accessControl) return r();
-		let { controlPlaneTenantId: i } = e.accessControl, a = n.var.org_name, o = n.var.organization_id, s = a || o, c = n.var.tenant_id, l = n.var.user, u = (l?.aud ? Array.isArray(l.aud) ? l.aud : [l.aud] : []).includes(t);
-		if (!c && s && u && (n.set("tenant_id", s), c = s), !c) throw new w(400, { message: "Tenant ID not found in request" });
-		if (!E(o, c, i, a)) throw new w(403, { message: `Access denied to tenant ${c}` });
+		let { controlPlaneTenantId: i } = e.accessControl, a = t.var.org_name, o = t.var.organization_id, s = a || o, c = t.var.tenant_id, l = t.var.user, u = (l?.aud ? Array.isArray(l.aud) ? l.aud : [l.aud] : []).includes(n);
+		if (!c && s && u && (t.set("tenant_id", s), c = s), !c) throw new w(400, { message: "Tenant ID not found in request" });
+		if (!O(o, c, i, a)) throw new w(403, { message: `Access denied to tenant ${c}` });
 		return r();
 	};
 }
-function Oe(e) {
+function Wt(e) {
 	return async (t, n) => {
 		if (!e.subdomainRouting) return n();
 		let { baseDomain: r, reservedSubdomains: i = [], resolveSubdomain: a } = e.subdomainRouting, o = t.req.header("x-forwarded-host") || t.req.header("host") || "", s = null;
@@ -957,14 +1941,14 @@ function Oe(e) {
 		let c = null;
 		if (a) c = await a(s);
 		else if (e.subdomainRouting.useOrganizations !== !1 && e.accessControl) try {
-			let n = await V(t).organizations.get(e.accessControl.controlPlaneTenantId, s);
+			let n = await q(t).organizations.get(e.accessControl.controlPlaneTenantId, s);
 			n && (c = n.id);
 		} catch {}
 		if (!c) throw new w(404, { message: `Tenant not found for subdomain: ${s}` });
 		return t.set("tenant_id", c), n();
 	};
 }
-function ke(e) {
+function Gt(e) {
 	return async (t, n) => {
 		if (!e.databaseIsolation) return n();
 		let r = t.var.tenant_id;
@@ -981,215 +1965,669 @@ function ke(e) {
 		return n();
 	};
 }
-function q(e) {
-	let t = Oe(e), n = De(e), r = ke(e);
+function Kt(e) {
+	let t = Wt(e), n = Ut(e), r = Gt(e);
 	return async (e, i) => (await t(e, async () => {}), await n(e, async () => {}), await r(e, async () => {}), i());
 }
 //#endregion
+//#region src/rollouts/config.ts
+var qt = [
+	10,
+	50,
+	100
+], Y = {
+	canary: 1,
+	waves: qt,
+	failure_threshold: .1,
+	max_concurrent: 25,
+	debounce_ms: 6e4
+};
+function X(e) {
+	let t = e.config ?? {};
+	return {
+		...Y,
+		trigger: "manual",
+		root_tenant_id: "",
+		...t,
+		waves: Array.isArray(t.waves) && t.waves.length > 0 ? t.waves : [...qt]
+	};
+}
+function Jt(e, t, n) {
+	let r = Array(e).fill(0);
+	if (e === 0) return r;
+	let i = Math.min(Math.max(t, 0), e), a = [], o = i;
+	for (let t of n) {
+		let n = Math.min(e, Math.max(o, Math.ceil(e * t / 100)));
+		n > o && (a.push(n), o = n);
+	}
+	o < e && a.push(e);
+	let s = +(i > 0), c = i;
+	for (let e of a) {
+		for (; c < e; c++) r[c] = s;
+		s++;
+	}
+	return r;
+}
+//#endregion
+//#region src/rollouts/enumerate.ts
+async function Yt(e, t, n) {
+	let r = n.maxDepth ?? 8, i = await m((t) => e.tenants.list(t), "tenants", {
+		cursorField: "id",
+		pageSize: 100
+	}), a = new Map(i.map((e) => [e.id, e])), o = async (e) => e.parent_tenant_id ?? (e.id === t ? void 0 : await n.resolveLegacyParent(e.id)), s = [];
+	for (let e of i) {
+		if (e.id === t || e.config_sync !== "synced") continue;
+		let n = 0, i = e, c = !1;
+		for (; i && n <= r;) {
+			let e = await o(i);
+			if (!e) break;
+			if (n++, e === t) {
+				c = !0;
+				break;
+			}
+			i = a.get(e);
+		}
+		c && s.push({
+			tenantId: e.id,
+			depth: n,
+			appliedHash: e.config_sync_hash ?? null
+		});
+	}
+	return s.sort((e, t) => e.depth - t.depth || (e.tenantId < t.tenantId ? -1 : 1));
+}
+//#endregion
+//#region src/rollouts/hashes.ts
+async function Xt(e, t) {
+	return e.resolveControlPlane ? (await e.resolveControlPlane({ tenant_id: t }))?.tenantId : e.controlPlaneTenantId;
+}
+function Zt(e) {
+	let t = /* @__PURE__ */ new Map();
+	return async (n) => {
+		let r = await Xt(e, n), i = (await N({
+			tenantId: n,
+			getTenant: (t) => e.adapters.tenants.get(t),
+			legacyControlPlane: r,
+			maxDepth: e.maxDepth
+		})).join(">"), a = t.get(i);
+		return a || (a = et(e.adapters, n, {
+			legacyControlPlane: r,
+			maxDepth: e.maxDepth
+		}).then((e) => e.hash), t.set(i, a)), a;
+	};
+}
+//#endregion
+//#region src/rollouts/plan.ts
+var Qt = [
+	"pending",
+	"canary",
+	"rolling",
+	"paused"
+];
+function $t(e) {
+	let { tenantOperations: t, tenantOperationEvents: n } = e.adapters;
+	if (!t || !n) throw Error("Fleet rollouts need the tenant operations adapters");
+	return {
+		tenantOperations: t,
+		tenantOperationEvents: n
+	};
+}
+function Z(e) {
+	if (!e.adapters.rollouts) throw Error("Fleet rollouts need the rollouts adapter");
+	return e.adapters.rollouts;
+}
+async function en(e, t, n = {}) {
+	let r = Z(e), i = $t(e), a = X(t), o = await Yt(e.adapters, a.root_tenant_id, {
+		resolveLegacyParent: (t) => Xt(e, t),
+		maxDepth: e.maxDepth
+	});
+	if (n.tenantIds) {
+		let e = new Set(n.tenantIds);
+		o = o.filter((t) => e.has(t.tenantId));
+	}
+	let s = Zt(e), c = [];
+	for (let e of o) (a.force || e.appliedHash !== await s(e.tenantId)) && c.push(e);
+	let l = o.length - c.length;
+	if (c.length === 0) return a.trigger === "write" ? await r.remove(t.id) : await r.update(t.id, {
+		status: "done",
+		finished_at: new Date(e.now?.() ?? Date.now()).toISOString(),
+		config: {
+			...a,
+			planned: !0,
+			tenant_count: 0
+		}
+	}), {
+		planned: 0,
+		upToDate: l
+	};
+	let u = new Set((await Q(e, t.id)).map((e) => e.tenant_id)), d = Jt(c.length, a.canary, a.waves);
+	for (let [n, r] of c.entries()) u.has(r.tenantId) || await M(i, {
+		kind: "sync-defaults",
+		tenant_id: r.tenantId,
+		rollout_id: t.id,
+		initiated_by: `rollout:${t.id}`,
+		input: {
+			wave: d[n],
+			...a.dry_run ? { dry_run: !0 } : {},
+			...a.force ? { force: !0 } : {}
+		}
+	}, e.executor.engine);
+	return await r.update(t.id, {
+		status: "canary",
+		config: {
+			...a,
+			planned: !0,
+			tenant_count: c.length
+		}
+	}), {
+		planned: c.length,
+		upToDate: l
+	};
+}
+async function Q(e, t) {
+	let { tenantOperations: n } = $t(e), r = [];
+	for (let e = 0;; e++) {
+		let { operations: i } = await n.list({
+			rollout_id: t,
+			page: e,
+			per_page: 200
+		});
+		if (r.push(...i), i.length < 200) break;
+	}
+	return r.sort((e, t) => e.created_at === t.created_at ? e.id < t.id ? -1 : 1 : e.created_at < t.created_at ? -1 : 1);
+}
+//#endregion
+//#region src/rollouts/advance.ts
+var $ = (e) => {
+	let t = e.input?.wave;
+	return typeof t == "number" ? t : 0;
+}, tn = (e) => e.status === "failed" || e.status === "cancelled";
+function nn(e, t, n) {
+	let r = t.filter((e) => $(e) === n), i = r.filter(tn).length, a = n === 0 && e.canary > 0, o = a ? 0 : e.failure_threshold;
+	return r.length === 0 || i === 0 || i / r.length <= o ? null : `${a ? "canary" : `wave ${n}`} failed for ${i} of ${r.length} tenant(s)`;
+}
+async function rn(e, t) {
+	let n = Z(e), r = e.now?.() ?? Date.now(), i = typeof t == "string" ? await n.get(t) : t;
+	if (!i || i.kind !== "config-sync") return {
+		rolloutId: String(i?.id ?? t),
+		outcome: "skipped",
+		started: 0
+	};
+	let a = i.id;
+	if (!Qt.includes(i.status) || i.status === "paused") return {
+		rolloutId: a,
+		outcome: "skipped",
+		started: 0
+	};
+	let o = X(i);
+	if (!o.planned) {
+		if (r - Date.parse(i.updated_at) < o.debounce_ms) return {
+			rolloutId: a,
+			outcome: "waiting",
+			started: 0
+		};
+		let { planned: t } = await en(e, i);
+		if (t === 0) return {
+			rolloutId: a,
+			outcome: "planned-empty",
+			started: 0
+		};
+		i = await n.get(a) ?? i, o = X(i);
+	}
+	let s = await Q(e, a), c = s.filter((e) => !j(e.status));
+	if (c.length === 0) {
+		let e = Math.max(0, ...s.map($)), t = s.length > 0 && e > (o.accepted_through ?? -1) ? nn(o, s, e) : null;
+		return await n.update(a, {
+			status: t ? "failed" : "done",
+			...t ? { paused_reason: t } : {},
+			finished_at: new Date(r).toISOString()
+		}), {
+			rolloutId: a,
+			outcome: "done",
+			started: 0
+		};
+	}
+	let l = Math.min(...c.map($)), u = l - 1;
+	if (u >= 0 && u > (o.accepted_through ?? -1)) {
+		let e = nn(o, s, u);
+		if (e) return await n.update(a, {
+			status: "paused",
+			paused_reason: e
+		}), {
+			rolloutId: a,
+			outcome: "paused",
+			started: 0,
+			wave: l
+		};
+	}
+	let d = l === 0 ? "canary" : "rolling";
+	i.status !== d && await n.update(a, { status: d });
+	let f = c.filter((e) => $(e) === l), p = f.filter((e) => e.status === "running").length, m = Math.max(0, o.max_concurrent - p), { tenantOperations: h, tenantOperationEvents: g } = $t(e), _ = A({
+		tenantOperations: h,
+		tenantOperationEvents: g
+	}), v = 0;
+	for (let t of f.filter((e) => e.status === "pending").slice(0, m)) {
+		try {
+			await _.markRunning(t.id), await e.executor.start(t);
+		} catch (e) {
+			try {
+				let n = await h.get(t.id);
+				n && !j(n.status) && await _.markFailed(t.id, e);
+			} catch {}
+		}
+		v++;
+	}
+	return {
+		rolloutId: a,
+		outcome: v > 0 ? "started" : "running",
+		started: v,
+		wave: l
+	};
+}
+async function an(e, t = {}) {
+	let { rollouts: n } = await Z(e).list({
+		kind: "config-sync",
+		status: [
+			"pending",
+			"canary",
+			"rolling"
+		],
+		per_page: t.limit ?? 20
+	}), r = [];
+	for (let i of n) try {
+		r.push(await rn(e, i));
+	} catch (e) {
+		t.logger?.warn(`Advancing rollout ${i.id} failed:`, e);
+	}
+	return r;
+}
+async function on(e, t, n = "paused by an operator") {
+	let r = Z(e), i = await r.get(t);
+	return !i || i.kind !== "config-sync" ? null : i.status === "done" || i.status === "failed" ? i : (await r.update(t, {
+		status: "paused",
+		paused_reason: n
+	}), r.get(t));
+}
+async function sn(e, t) {
+	let n = Z(e), r = await n.get(t);
+	if (!r || r.kind !== "config-sync") return null;
+	if (r.status !== "paused") return r;
+	let i = X(r), a = (await Q(e, t)).filter((e) => !j(e.status)), o = a.length > 0 ? Math.min(...a.map($)) : 0;
+	return await n.update(t, {
+		status: o === 0 ? "canary" : "rolling",
+		paused_reason: null,
+		config: {
+			...i,
+			accepted_through: Math.max(i.accepted_through ?? -1, o - 1)
+		}
+	}), n.get(t);
+}
+//#endregion
+//#region src/rollouts/status.ts
+async function cn(e, t) {
+	let n = await e.adapters.tenants.get(t);
+	if (!n) return null;
+	let r = n.config_sync === "synced", i = await N({
+		tenantId: t,
+		getTenant: (t) => e.adapters.tenants.get(t),
+		legacyControlPlane: await Xt(e, t),
+		maxDepth: e.maxDepth
+	}), a = r ? await Zt(e)(t) : null, o = n.config_sync_hash ?? null, s = {};
+	for (let n of [...i].reverse()) {
+		let r = await I(e.adapters, n), i = (e, t) => V(e, t) === "shared", a = async (e, r, a) => {
+			for (let o of r) {
+				let r = o.id ?? o.hook_id;
+				r && y(r) || i(a, o) && (s[await W(e, t, G(e, o))] = n);
+			}
+		};
+		await a("connection", r.connections, "connection"), await a("resourceServer", r.resourceServers, "resourceServer"), await a("action", r.actions, "action"), await a("hook", r.hooks, "hook"), r.emailProvider && i("emailProvider", r.emailProvider) && (s.emailProvider = n), r.branding && i("branding", r.branding) && (s.branding = n), r.promptSettings && i("promptSettings", r.promptSettings) && (s.promptSettings = n);
+	}
+	return {
+		tenant_id: t,
+		parent_tenant_id: n.parent_tenant_id ?? null,
+		config_sync: r ? "synced" : "inherit-on-read",
+		config_sync_hash: o,
+		config_synced_at: n.config_synced_at ?? null,
+		expected_hash: a,
+		drifted: r && a !== o,
+		chain: i,
+		inherited: s
+	};
+}
+//#endregion
+//#region src/rollouts/reconcile.ts
+async function ln(e, n = {}) {
+	let r = Z(e), i = n.rootTenantId ?? e.controlPlaneTenantId, a = n.limit ?? 500, o = await Yt(e.adapters, i, {
+		resolveLegacyParent: (t) => Xt(e, t),
+		maxDepth: e.maxDepth
+	}), s = Zt(e), c = [];
+	for (let e of o) {
+		if (c.length >= a) break;
+		try {
+			let t = await s(e.tenantId);
+			e.appliedHash !== t && c.push({
+				tenantId: e.tenantId,
+				expected: t,
+				applied: e.appliedHash
+			});
+		} catch (t) {
+			n.logger?.warn(`Could not compute the expected hash of ${e.tenantId}:`, t);
+		}
+	}
+	let l = {
+		checked: o.length,
+		drifted: c.length,
+		alreadyCovered: 0,
+		recentlyFailed: 0
+	};
+	if (c.length === 0) return l;
+	let u = /* @__PURE__ */ new Set(), { rollouts: d } = await r.list({
+		kind: "config-sync",
+		status: [...Qt],
+		per_page: 100
+	});
+	for (let t of d) for (let n of await Q(e, t.id)) n.tenant_id && !j(n.status) && u.add(n.tenant_id);
+	for (let r of c) try {
+		await e.adapters.logs.create(r.tenantId, {
+			type: t.CONFIG_DRIFT,
+			date: new Date(e.now?.() ?? Date.now()).toISOString(),
+			isMobile: !1,
+			description: r.applied ? "hash-mismatch: applied config differs from what the parent chain publishes" : "never-synced: no config has been applied to this synced tenant",
+			details: {
+				reason: r.applied ? "hash-mismatch" : "never-synced",
+				applied_hash: r.applied,
+				expected_hash: r.expected,
+				covered_by_open_rollout: u.has(r.tenantId),
+				trigger: "reconcile"
+			}
+		});
+	} catch (e) {
+		n.logger?.warn(`Could not record drift for ${r.tenantId}:`, e);
+	}
+	let f = c.filter((e) => !u.has(e.tenantId));
+	l.alreadyCovered = c.length - f.length;
+	let { tenantOperations: p } = $t(e), m = e.now?.() ?? Date.now(), h = n.retryAfterMs ?? 36e5, g = [];
+	for (let e of f) {
+		try {
+			let { operations: t } = await p.list({
+				tenant_id: e.tenantId,
+				kind: "sync-defaults",
+				per_page: 5
+			}), n = t.sort((e, t) => e.created_at === t.created_at ? e.id < t.id ? 1 : -1 : e.created_at < t.created_at ? 1 : -1)[0];
+			if (n?.status === "failed" && m - Date.parse(n.updated_at) < h) {
+				l.recentlyFailed++;
+				continue;
+			}
+		} catch (t) {
+			n.logger?.warn(`Could not read the latest sync of ${e.tenantId}:`, t);
+		}
+		g.push(e);
+	}
+	if (g.length === 0) return l;
+	let _ = await r.create({
+		kind: "config-sync",
+		initiated_by: "reconcile",
+		config: {
+			...Y,
+			trigger: "reconcile",
+			root_tenant_id: i,
+			planned: !1
+		}
+	});
+	return await en(e, _, { tenantIds: g.map((e) => e.tenantId) }), l.rolloutId = _.id, l;
+}
+//#endregion
+//#region src/rollouts/trigger.ts
+function un(e, t) {
+	return e === "hookCode" ? !0 : !t || typeof t != "object" ? !1 : V(e, t) !== "local";
+}
+async function dn(e, t, n) {
+	let r = Z(e), { rollouts: i } = await r.list({
+		kind: "config-sync",
+		status: "pending",
+		per_page: 100
+	}), a = i.find((e) => {
+		let n = X(e);
+		return n.trigger === "write" && n.planned !== !0 && n.origin_tenant_id === t;
+	});
+	return a ? (await r.update(a.id, {}), await r.get(a.id) ?? a) : r.create({
+		kind: "config-sync",
+		initiated_by: n ?? `write:${t}`,
+		config: {
+			...Y,
+			trigger: "write",
+			root_tenant_id: t,
+			origin_tenant_id: t,
+			planned: !1
+		}
+	});
+}
+async function fn(e, t) {
+	if (t === e.controlPlaneTenantId) return !0;
+	try {
+		let { tenants: n } = await e.adapters.tenants.list({
+			q: `parent_tenant_id:${t}`,
+			per_page: 1
+		});
+		return n.some((e) => e.parent_tenant_id === t);
+	} catch {
+		return !0;
+	}
+}
+function pn(e, t = {}) {
+	let n = async (n) => {
+		try {
+			await fn(e, n) && await dn(e, n);
+		} catch (e) {
+			t.logger?.warn(`Could not record a config change for ${n}:`, e);
+		}
+	}, r = (e) => ({
+		afterCreate: async (t, r) => {
+			un(e, r) && await n(t.tenantId);
+		},
+		afterUpdate: async (t, r, i) => {
+			un(e, i) && await n(t.tenantId);
+		},
+		afterDelete: async (e) => n(e.tenantId)
+	});
+	return {
+		actions: r("action"),
+		hooks: r("hook"),
+		hookCode: r("hookCode"),
+		connections: r("connection"),
+		resourceServers: r("resourceServer")
+	};
+}
+//#endregion
+//#region src/rollouts/controller.ts
+function mn(e) {
+	return {
+		async create(t) {
+			let n = {
+				...Y,
+				waves: t.waves ?? [...Y.waves],
+				canary: t.canary ?? Y.canary,
+				failure_threshold: t.failureThreshold ?? Y.failure_threshold,
+				max_concurrent: t.maxConcurrent ?? Y.max_concurrent,
+				trigger: "manual",
+				root_tenant_id: t.rootTenantId ?? e.controlPlaneTenantId,
+				dry_run: t.dryRun,
+				force: t.force,
+				planned: !1
+			}, r = Z(e), i = await r.create({
+				kind: "config-sync",
+				initiated_by: t.initiatedBy,
+				config: n
+			});
+			return await en(e, i, { tenantIds: t.tenantIds }), await rn(e, i.id), await r.get(i.id) ?? i;
+		},
+		pause: (t, n) => on(e, t, n),
+		resume: (t) => sn(e, t)
+	};
+}
+//#endregion
 //#region src/init.ts
-function Ae(e) {
-	let { dataAdapter: t, controlPlane: n, controlPlane: { tenantId: r = "control_plane", clientId: i } = {}, resolveControlPlane: a, sync: o = {
+function hn(e) {
+	let { dataAdapter: t, controlPlane: n, controlPlane: { tenantId: r = "control_plane", clientId: i } = {}, resolveControlPlane: a, inheritanceShadow: o, syncDefaults: s, rolloutExecutor: c, sync: l = {
 		resourceServers: !0,
 		roles: !0
-	}, defaultPermissions: s = ["tenant:admin"], requireOrganizationMatch: c = !1, managementApiExtensions: l = [], entityHooks: u, getChildTenantIds: f, getAdapters: m, ...h } = e;
+	}, defaultPermissions: u = ["tenant:admin"], requireOrganizationMatch: d = !1, managementApiExtensions: f = [], entityHooks: p, getChildTenantIds: h, getAdapters: g, ...v } = e;
 	if (a && !n) throw Error("initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it.");
-	let g = t, _ = t;
-	n && (g = K(t, {
-		controlPlaneTenantId: r,
-		controlPlaneClientId: i,
-		resolveControlPlane: a
-	}), _ = {
-		...Se(t, {
-			controlPlaneTenantId: r,
-			resolveControlPlane: a
-		}),
-		multiTenancyConfig: {
+	let y = t, b = t, ee;
+	if (n) {
+		let e = Pe({
+			base: Re({
+				controlPlaneTenantId: r,
+				controlPlaneClientId: i,
+				resolveControlPlane: a
+			}),
+			getTenant: async (e) => await t.tenants.get(e) ?? null,
+			controlPlaneTenantId: r
+		});
+		ee = (t) => e.invalidate(t), y = Ue(t, {
 			controlPlaneTenantId: r,
 			controlPlaneClientId: i,
-			resolveControlPlane: a
-		}
-	});
-	let v = h.tenantOperationExecutor;
-	if (!v && t.tenantOperations && t.tenantOperationEvents && h.tenantUpgrade) {
+			resolveControlPlane: a,
+			inheritanceShadow: o,
+			configSync: e
+		}), b = {
+			...Be(t, {
+				controlPlaneTenantId: r,
+				resolveControlPlane: e.resolve
+			}),
+			multiTenancyConfig: {
+				controlPlaneTenantId: r,
+				controlPlaneClientId: i,
+				resolveControlPlane: e.resolve
+			}
+		};
+	}
+	let te = v.tenantOperationExecutor, x;
+	if (t.tenantOperations && t.tenantOperationEvents) {
 		let e = {
 			tenantOperations: t.tenantOperations,
 			tenantOperationEvents: t.tenantOperationEvents
-		}, n = h.tenantUpgrade, r = ne({
+		}, n = v.tenantUpgrade, i = A(e), o = s ?? ft(t, {
+			controlPlaneTenantId: r,
+			resolveControlPlane: a
+		}), c = le({
 			stores: e,
-			definitions: { upgrade: (e) => [{
-				name: "upgrade",
-				async run() {
-					if (!e.tenant_id) throw Error("upgrade operations require a tenant_id");
-					await n(e.tenant_id);
-				}
-			}] }
+			definitions: {
+				...n ? { upgrade: (e) => [{
+					name: "upgrade",
+					async run() {
+						if (!e.tenant_id) throw Error("upgrade operations require a tenant_id");
+						await n(e.tenant_id);
+					}
+				}] } : {},
+				"sync-defaults": (e) => [{
+					name: "sync-defaults",
+					run: () => dt({
+						operation: e,
+						syncConfig: o,
+						recorder: i
+					})
+				}]
+			}
 		});
-		v = {
-			engine: r.engine,
-			enqueue: (t) => ie(e, r, {
+		x = c, te ??= {
+			engine: c.engine,
+			kinds: n ? ["upgrade", "sync-defaults"] : ["sync-defaults"],
+			enqueue: (t) => ue(e, c, {
 				...t,
 				tenant_id: t.tenant_id
-			})
+			}, { returnFailed: t.kind === "sync-defaults" })
 		};
 	}
-	let y = o !== !1, b = y ? {
-		resourceServers: o.resourceServers ?? !0,
-		roles: o.roles ?? !0
+	let S = c ?? x, C = S && t.rollouts && t.tenantOperations && t.tenantOperationEvents ? {
+		adapters: t,
+		executor: S,
+		controlPlaneTenantId: r,
+		resolveControlPlane: a
+	} : void 0, w = C ? mn(C) : void 0, T = C ? pn(C, { logger: console }) : void 0, E = l !== !1, D = E ? {
+		resourceServers: l.resourceServers ?? !0,
+		roles: l.roles ?? !0
 	} : {
 		resourceServers: !1,
 		roles: !1
-	}, { entityHooks: x, tenantHooks: S } = B({
+	}, { entityHooks: ne, tenantHooks: O } = Tt({
 		controlPlaneTenantId: r,
-		getChildTenantIds: f ?? (async () => (await d((e) => g.tenants.list(e), "tenants", {
+		getChildTenantIds: h ?? (async () => (await m((e) => y.tenants.list(e), "tenants", {
 			cursorField: "id",
 			pageSize: 100
 		})).filter((e) => e.id !== r).map((e) => e.id)),
-		getAdapters: m ?? (async () => g),
-		getControlPlaneAdapters: async () => g,
-		sync: b
-	}), C = {
-		resourceServers: [x.resourceServers, ...u?.resourceServers ?? []],
-		roles: [x.roles, ...u?.roles ?? []],
-		connections: u?.connections ?? [],
-		tenants: u?.tenants ?? [],
-		rolePermissions: u?.rolePermissions ?? []
-	}, w = P({ accessControl: {
+		getAdapters: g ?? (async () => y),
+		getControlPlaneAdapters: async () => y,
+		sync: D
+	}), re = {
+		resourceServers: [
+			ne.resourceServers,
+			T?.resourceServers,
+			...p?.resourceServers ?? []
+		],
+		roles: [ne.roles, ...p?.roles ?? []],
+		connections: [T?.connections, ...p?.connections ?? []],
+		tenants: p?.tenants ?? [],
+		rolePermissions: p?.rolePermissions ?? [],
+		actions: [T?.actions, ...p?.actions ?? []],
+		hooks: [T?.hooks, ...p?.hooks ?? []],
+		hookCode: [T?.hookCode, ...p?.hookCode ?? []]
+	}, k = gt({ accessControl: {
 		controlPlaneTenantId: r,
-		requireOrganizationMatch: c,
-		defaultPermissions: s
-	} }), T = H({ accessControl: {
-		controlPlaneTenantId: r,
-		requireOrganizationMatch: c,
-		defaultPermissions: s
-	} }, { tenants: {
+		requireOrganizationMatch: d,
+		defaultPermissions: u
+	} }), ie = At({
+		accessControl: {
+			controlPlaneTenantId: r,
+			requireOrganizationMatch: d,
+			defaultPermissions: u
+		},
+		onConfigSyncChange: (e) => ee?.(e),
+		configSyncStatus: (e) => cn({
+			adapters: t,
+			controlPlaneTenantId: r,
+			resolveControlPlane: a
+		}, e)
+	}, { tenants: {
 		async beforeCreate(e, t) {
-			return w.beforeCreate && (t = await w.beforeCreate(e, t)), S.beforeCreate && (t = await S.beforeCreate(e, t)), t;
+			return k.beforeCreate && (t = await k.beforeCreate(e, t)), O.beforeCreate && (t = await O.beforeCreate(e, t)), t;
 		},
 		async afterCreate(e, t) {
-			await w.afterCreate?.(e, t), await S.afterCreate?.(e, t);
+			await k.afterCreate?.(e, t), await O.afterCreate?.(e, t);
 		},
 		async beforeDelete(e, t) {
-			await w.beforeDelete?.(e, t), await S.beforeDelete?.(e, t);
+			await k.beforeDelete?.(e, t), await O.beforeDelete?.(e, t);
 		}
-	} }), { app: E } = p({
-		dataAdapter: g,
-		managementDataAdapter: _,
-		...h,
-		tenantOperationExecutor: v,
-		entityHooks: C,
-		managementApiExtensions: [...l, {
+	} }), { app: ae } = _({
+		dataAdapter: y,
+		managementDataAdapter: b,
+		...v,
+		tenantOperationExecutor: te,
+		...w ? { rolloutController: w } : {},
+		entityHooks: re,
+		managementApiExtensions: [...f, {
 			path: "/tenants",
-			router: T
+			router: ie
 		}],
-		managementApiMiddleware: [...h.managementApiMiddleware ?? [], ...y ? [U()] : []]
+		managementApiMiddleware: [...v.managementApiMiddleware ?? [], ...E ? [Vt()] : []]
 	});
 	return {
-		app: E,
-		controlPlaneTenantId: r
-	};
-}
-//#endregion
-//#region src/rollout/defaults-projection.ts
-function J(e = {}) {
-	return {
-		connections: e.connections ?? !0,
-		resourceServers: e.resourceServers ?? !0,
-		hooks: e.hooks ?? !0,
-		emailProvider: e.emailProvider ?? !0,
-		branding: e.branding ?? !0,
-		promptSettings: e.promptSettings ?? !0
-	};
-}
-function Y() {
-	return {
-		upserted: 0,
-		errors: []
-	};
-}
-function je(e) {
-	return {
-		tenantId: e,
-		connections: Y(),
-		resourceServers: Y(),
-		hooks: Y(),
-		emailProvider: Y(),
-		branding: Y(),
-		promptSettings: Y()
-	};
-}
-function Me(e) {
-	let t = e.metadata;
-	return !!(t && t.inheritable === !0);
-}
-async function X(e, t, n, r) {
-	try {
-		await r();
-	} catch (r) {
-		let i = `${t}: ${r instanceof Error ? r.message : String(r)}`;
-		if (!n) throw Error(i, { cause: r });
-		e.errors.push(i);
-	}
-}
-async function Ne(e, t, n) {
-	return {
-		connections: n.connections ? await d((n) => e.connections.list(t, n), "connections", {
-			cursorField: "id",
-			pageSize: 100
-		}) : [],
-		resourceServers: n.resourceServers ? await d((n) => e.resourceServers.list(t, n), "resource_servers", {
-			cursorField: "id",
-			pageSize: 100
-		}) : [],
-		hooks: n.hooks ? await d((n) => e.hooks.list(t, n), "hooks", {
-			cursorField: "hook_id",
-			pageSize: 100
-		}) : [],
-		emailProvider: n.emailProvider ? await e.emailProviders.get(t) ?? null : null,
-		branding: n.branding ? await e.branding.get(t) ?? null : null,
-		promptSettings: n.promptSettings ? await e.promptSettings.get(t) ?? null : null
+		app: ae,
+		controlPlaneTenantId: r,
+		rollouts: C
 	};
 }
-async function Pe(e, t, n, r, i, o) {
-	if (r.connections) for (let r of e.connections) {
-		let e = r.id;
-		e && await X(o.connections, `connection ${e}`, i, async () => {
-			let i = a.parse(r);
-			await t.connections.get(n, e) ? await t.connections.update(n, e, i) : await t.connections.create(n, i), o.connections.upserted += 1;
-		});
-	}
-	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await X(o.resourceServers, `resource_server ${r.id}`, i, async () => {
-		let e = v.parse(r);
-		await t.resourceServers.get(n, r.id) ? await t.resourceServers.update(n, r.id, e) : await t.resourceServers.create(n, e), o.resourceServers.upserted += 1;
-	});
-	if (r.hooks) for (let r of e.hooks) !Me(r) || !r.hook_id || await X(o.hooks, `hook ${r.hook_id}`, i, async () => {
-		let e = f.parse(r);
-		await t.hooks.get(n, r.hook_id) ? await t.hooks.update(n, r.hook_id, e) : await t.hooks.create(n, e), o.hooks.upserted += 1;
-	});
-	r.emailProvider && e.emailProvider && await X(o.emailProvider, "email_provider", i, async () => {
-		let r = e.emailProvider;
-		await t.emailProviders.get(n) ? await t.emailProviders.update(n, r) : await t.emailProviders.create(n, r), o.emailProvider.upserted += 1;
-	}), r.branding && e.branding && await X(o.branding, "branding", i, async () => {
-		await t.branding.set(n, e.branding), o.branding.upserted += 1;
-	}), r.promptSettings && e.promptSettings && await X(o.promptSettings, "prompt_settings", i, async () => {
-		await t.promptSettings.set(n, e.promptSettings), o.promptSettings.upserted += 1;
-	});
-}
-async function Z(e, t) {
-	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = J(a), c = await Ne(await r(), n, s), l = await i(t), u = je(t);
-	return await Pe(c, l, n, s, o, u), u;
-}
 //#endregion
 //#region src/rollout/payload.ts
-function Fe(e) {
+function gn(e) {
 	let { pkcs7: t, tenant_id: n, ...r } = e;
 	return r;
 }
-async function Ie(e, t, n = {}, r) {
-	let i = J(n), a = n.signingKeys ?? !0, o = n.tenants ?? !0, s = await Ne(e, t, i), c = a ? (await h(e.keys)).map(Fe) : [], l = o ? await Le(e, t, r) : [];
+async function _n(e, t, n = {}, r) {
+	let i = he(n), a = n.signingKeys ?? !0, o = n.tenants ?? !0, s = await ve(e, t, i), c = a ? (await b(e.keys)).map(gn) : [], l = o ? await vn(e, t, r) : [];
 	return {
 		connections: s.connections,
 		resourceServers: s.resourceServers.filter((e) => e.is_system),
-		hooks: s.hooks.filter(Me),
+		hooks: s.hooks.filter(_e),
 		emailProvider: s.emailProvider,
 		branding: s.branding,
 		promptSettings: s.promptSettings,
@@ -1197,7 +2635,7 @@ async function Ie(e, t, n = {}, r) {
 		tenants: l
 	};
 }
-async function Le(e, t, n) {
+async function vn(e, t, n) {
 	let r = n && n !== t ? [t, n] : [t], i = [];
 	for (let t of r) {
 		let n = await e.tenants.get(t);
@@ -1208,19 +2646,19 @@ async function Le(e, t, n) {
 	}
 	return i;
 }
-async function Re(e, t, n) {
-	let r = Y();
+async function yn(e, t, n) {
+	let r = P();
 	if (e.length === 0) return r;
-	let i = await h(t.keys), a = new Set(i.map((e) => e.kid));
-	for (let i of e) await X(r, `signing_key ${i.kid}`, n, async () => {
-		let e = Fe(i);
+	let i = await b(t.keys), a = new Set(i.map((e) => e.kid));
+	for (let i of e) await F(r, `signing_key ${i.kid}`, n, async () => {
+		let e = gn(i);
 		a.has(e.kid) || (await t.keys.create(e), a.add(e.kid), r.upserted += 1);
 	});
 	return r;
 }
-async function ze(e, t, n) {
-	let r = Y();
-	for (let i of e) await X(r, `tenant ${i.id}`, n, async () => {
+async function bn(e, t, n) {
+	let r = P();
+	for (let i of e) await F(r, `tenant ${i.id}`, n, async () => {
 		await t.tenants.get(i.id) || (await t.tenants.create({
 			id: i.id,
 			friendly_name: i.friendly_name
@@ -1228,46 +2666,50 @@ async function ze(e, t, n) {
 	});
 	return r;
 }
-async function Be(e, t, n, r = {}) {
-	let a = r.continueOnError ?? !1, o = J(r.entities), s = r.entities?.signingKeys ?? !0, c = r.entities?.tenants ?? !0, u = {
+async function xn(e, t, n, r = {}) {
+	let i = r.continueOnError ?? !1, a = he(r.entities), s = r.entities?.signingKeys ?? !0, c = r.entities?.tenants ?? !0, l = {
 		connections: e.connections,
 		resourceServers: e.resourceServers,
 		hooks: e.hooks,
-		emailProvider: e.emailProvider ? l.parse(e.emailProvider) : null,
-		branding: e.branding ? i.parse(e.branding) : null,
-		promptSettings: e.promptSettings ? g.parse(e.promptSettings) : null
-	}, d = c ? await ze(e.tenants ?? [], t, a) : Y(), f = je(n);
-	await Pe(u, t, n, o, a, f);
-	let p = s ? await Re(e.signingKeys, t, a) : Y();
+		emailProvider: e.emailProvider ? f.parse(e.emailProvider) : null,
+		branding: e.branding ? o.parse(e.branding) : null,
+		promptSettings: e.promptSettings ? ee.parse(e.promptSettings) : null
+	}, u = c ? await bn(e.tenants ?? [], t, i) : P(), d = ge(n);
+	await ye(l, t, n, a, i, d);
+	let p = s ? await yn(e.signingKeys, t, i) : P(), m = e.resolved && r.resolved ? await at(e.resolved, t, r.resolved.tenantId, {
+		continueOnError: i,
+		...r.resolved
+	}) : void 0;
 	return {
-		...f,
+		...d,
 		signingKeys: p,
-		tenants: d
+		tenants: u,
+		...m ? { resolved: m } : {}
 	};
 }
 //#endregion
 //#region src/rollout/index.ts
-function Ve(e) {
+function Sn(e) {
 	return {
-		syncDefaults: (t) => Z(e, t),
+		syncDefaults: (t) => be(e, t),
 		syncDefaultsToTenants: async (t) => {
 			let n = [];
-			for (let r of t) n.push(await Z(e, r));
+			for (let r of t) n.push(await be(e, r));
 			return n;
 		}
 	};
 }
 //#endregion
 //#region src/plugin.ts
-function He(e) {
-	let t = Q(e);
+function Cn(e) {
+	let t = wn(e);
 	return {
 		name: "multi-tenancy",
-		middleware: q(e),
+		middleware: Kt(e),
 		hooks: t,
 		routes: [{
 			path: "/management",
-			handler: H(e, t)
+			handler: At(e, t)
 		}],
 		onRegister: async () => {
 			console.log("Multi-tenancy plugin registered"), e.accessControl && console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`), e.subdomainRouting && console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`), e.databaseIsolation && console.log("  - Database isolation enabled");
@@ -1276,29 +2718,29 @@ function He(e) {
 }
 //#endregion
 //#region src/index.ts
-function Q(e) {
-	let t = e.accessControl ? T(e.accessControl) : {}, n = e.databaseIsolation ? D(e.databaseIsolation) : {}, r = P(e);
+function wn(e) {
+	let t = e.accessControl ? ne(e.accessControl) : {}, n = e.databaseIsolation ? re(e.databaseIsolation) : {}, r = gt(e);
 	return {
 		...t,
 		...n,
 		tenants: r
 	};
 }
-function $(t) {
-	let n = new e(), r = Q(t);
-	return n.route("/tenants", H(t, r)), n;
+function Tn(t) {
+	let n = new e(), r = wn(t);
+	return n.route("/tenants", At(t, r)), n;
 }
-function Ue(e) {
+function En(e) {
 	return {
-		hooks: Q(e),
-		middleware: q(e),
-		app: $(e),
+		hooks: wn(e),
+		middleware: Kt(e),
+		app: Tn(e),
 		config: e,
-		wrapAdapters: (t, n) => K(t, {
+		wrapAdapters: (t, n) => Ue(t, {
 			controlPlaneTenantId: e.accessControl?.controlPlaneTenantId,
 			controlPlaneClientId: n?.controlPlaneClientId
 		})
 	};
 }
 //#endregion
-export { Be as applyControlPlaneDefaultsPayload, Ie as buildControlPlaneDefaultsPayload, A as buildEngineInstanceId, T as createAccessControlHooks, De as createAccessControlMiddleware, Ee as createControlPlaneTenantMiddleware, D as createDatabaseHooks, ke as createDatabaseMiddleware, Ve as createDirectRolloutAdapter, ne as createInlineExecutor, $ as createMultiTenancy, Q as createMultiTenancyHooks, q as createMultiTenancyMiddleware, He as createMultiTenancyPlugin, M as createOperationRecorder, U as createProtectSyncedMiddleware, P as createProvisioningHooks, Ce as createRuntimeFallbackAdapter, Oe as createSubdomainMiddleware, B as createSyncHooks, H as createTenantsOpenAPIRouter, ie as enqueueTenantOperation, j as errorToMessage, Ae as initMultiTenant, te as inlineStepRunner, N as isTerminalStatus, ye as mergeClientWithFallback, Z as projectControlPlaneDefaults, oe as runRecordedTenantOperation, Ue as setupMultiTenancy, E as validateTenantAccess, K as withRuntimeFallback, Se as withSystemResourceServerInheritance };
+export { Y as DEFAULT_ROLLOUT_SETTINGS, qt as DEFAULT_ROLLOUT_WAVES, rn as advanceRollout, an as advanceRollouts, xn as applyControlPlaneDefaultsPayload, at as applyResolvedConfigBlock, Jt as assignWaves, _n as buildControlPlaneDefaultsPayload, ae as buildEngineInstanceId, et as buildResolvedConfigBlock, ke as compareShadow, me as computeLegacyConfig, ne as createAccessControlHooks, Ut as createAccessControlMiddleware, Pe as createConfigSyncResolver, Ht as createControlPlaneTenantMiddleware, re as createDatabaseHooks, Gt as createDatabaseMiddleware, Sn as createDirectRolloutAdapter, Zt as createExpectedHash, ft as createInProcessSyncConfig, le as createInlineExecutor, Tn as createMultiTenancy, wn as createMultiTenancyHooks, Kt as createMultiTenancyMiddleware, Cn as createMultiTenancyPlugin, A as createOperationRecorder, M as createOperationRow, Vt as createProtectSyncedMiddleware, gt as createProvisioningHooks, mn as createRolloutController, pn as createRolloutWriteHooks, Ve as createRuntimeFallbackAdapter, Me as createShadowReporter, Wt as createSubdomainMiddleware, Tt as createSyncHooks, At as createTenantsOpenAPIRouter, Oe as diffConfig, H as effectiveOverride, V as effectiveScope, ue as enqueueTenantOperation, se as errorToMessage, rt as findUndecryptableKeyIds, cn as getConfigSyncStatus, hn as initMultiTenant, ce as inlineStepRunner, un as isPublishedRow, j as isTerminalStatus, Q as listRolloutOperations, Yt as listSyncedDescendants, Le as mergeClientWithFallback, Ze as mergeConfig, on as pauseRollout, en as planRollout, be as projectControlPlaneDefaults, I as readConfigRows, X as readRolloutConfig, ln as reconcileConfigDrift, dn as requestRollout, N as resolveTenantChain, sn as resumeRollout, mt as runRecordedTenantOperation, dt as runSyncDefaultsStep, En as setupMultiTenancy, ut as summarizeSyncResult, lt as syncErrors, ct as syncOptionsOf, W as syncedRowId, O as validateTenantAccess, Ue as withRuntimeFallback, Be as withSystemResourceServerInheritance };