@authhero/multi-tenancy 15.2.0 → 15.3.0

package/dist/multi-tenancy.mjs

@@ -1,9 +1,9 @@
 import { Hono as e } from "hono";
-import { LogTypes as t, MANAGEMENT_API_AUDIENCE as n, MANAGEMENT_API_SCOPES as r, auth0QuerySchema as i, brandingSchema as a, connectionInsertSchema as o, connectionOptionsSchema as s, connectionSchema as c, deepMergePatch as l, emailProviderSchema as u, escapeLuceneValue as d, fetchAll as f, hookInsertSchema as p, init as m, isInteractiveClient as h, listControlPlaneKeys as g, promptSettingSchema as _, provisionDefaultClients as v, resourceServerInsertSchema as y, tenantInsertSchema as b, tenantSchema as x } from "authhero";
-import { OpenAPIHono as S, createRoute as C, z as w } from "@hono/zod-openapi";
-import { HTTPException as T } from "hono/http-exception";
+import { LogTypes as t, MANAGEMENT_API_AUDIENCE as n, MANAGEMENT_API_SCOPES as r, actionInsertSchema as i, auth0QuerySchema as a, brandingSchema as o, canDecrypt as s, connectionInsertSchema as c, connectionOptionsSchema as l, connectionSchema as u, deepMergePatch as d, emailProviderSchema as f, escapeLuceneValue as p, fetchAll as m, hookCodeInsertSchema as h, hookInsertSchema as g, init as _, isInteractiveClient as v, isSyncedRowId as y, listControlPlaneKeys as b, promptSettingSchema as ee, provisionDefaultClients as te, resourceServerInsertSchema as x, tenantInsertSchema as S, tenantSchema as C } from "authhero";
+import { HTTPException as w } from "hono/http-exception";
+import { OpenAPIHono as T, createRoute as E, z as D } from "@hono/zod-openapi";
 //#region src/hooks/access-control.ts
-function E(e) {
+function ne(e) {
 	let { controlPlaneTenantId: t, requireOrganizationMatch: n = !0 } = e;
 	return { async onTenantAccessValidation(e, r) {
 		if (r === t) return !0;
@@ -14,14 +14,14 @@ function E(e) {
 		return !0;
 	} };
 }
-function D(e, t, n, r) {
+function O(e, t, n, r) {
 	if (t === n) return !0;
 	let i = r || e;
 	return i ? i.toLowerCase() === t.toLowerCase() : !1;
 }
 //#endregion
 //#region src/hooks/database.ts
-function ee(e) {
+function re(e) {
 	return { async resolveDataAdapters(t) {
 		try {
 			return await e.getAdapters(t);
@@ -33,18 +33,18 @@ function ee(e) {
 }
 //#endregion
 //#region src/operations/instance-id.ts
-var O = 64;
-function k(e) {
+var k = 64;
+function ie(e) {
 	return e.replace(/[^a-zA-Z0-9_-]/g, "-");
 }
-function A(e) {
-	let t = k(e.id), n = Math.max(0, O - (5 + t.length)), r = k(e.kind).slice(0, n), i = 3 + r.length + 2 + t.length, a = Math.max(0, O - i);
-	return `op-${r}-${k(e.tenant_id ?? "fleet").slice(0, a)}-${t}`.slice(0, O);
+function ae(e) {
+	let t = ie(e.id), n = Math.max(0, k - (5 + t.length)), r = ie(e.kind).slice(0, n), i = 3 + r.length + 2 + t.length, a = Math.max(0, k - i);
+	return `op-${r}-${ie(e.tenant_id ?? "fleet").slice(0, a)}-${t}`.slice(0, k);
 }
 //#endregion
 //#region src/operations/recorder.ts
-var te = 2048;
-function j(e) {
+var oe = 2048;
+function se(e) {
 	let t;
 	if (e instanceof Error) t = e.message;
 	else try {
@@ -52,9 +52,9 @@ function j(e) {
 	} catch {
 		t = Object.prototype.toString.call(e);
 	}
-	return t.slice(0, te);
+	return t.slice(0, oe);
 }
-function M(e) {
+function A(e) {
 	let { tenantOperations: t, tenantOperationEvents: n } = e;
 	return {
 		async markRunning(e, n) {
@@ -75,6 +75,9 @@ function M(e) {
 				attempt: t.attempt ?? 1
 			});
 		},
+		async setResult(e, n) {
+			await t.update(e, { result: n });
+		},
 		async markSucceeded(e) {
 			await t.update(e, {
 				status: "succeeded",
@@ -85,24 +88,24 @@ function M(e) {
 		async markFailed(e, n) {
 			await t.update(e, {
 				status: "failed",
-				error: j(n),
+				error: se(n),
 				finished_at: (/* @__PURE__ */ new Date()).toISOString()
 			});
 		}
 	};
 }
-function ne(e) {
+function j(e) {
 	return e === "succeeded" || e === "failed" || e === "cancelled";
 }
 //#endregion
 //#region src/operations/inline-executor.ts
-var re = { async do(e, t, n) {
+var ce = { async do(e, t, n) {
 	let r = typeof t == "function" ? t : n;
 	if (!r) throw Error("StepRunner.do called without a function");
 	return r();
 } };
-function ie(e) {
-	let t = M(e.stores);
+function le(e) {
+	let t = A(e.stores);
 	return {
 		engine: "inline",
 		async start(n) {
@@ -121,7 +124,7 @@ function ie(e) {
 				try {
 					let r = await e.run({
 						operation: n,
-						step: re
+						step: ce
 					});
 					await t.appendEvent(n.id, {
 						step: e.name,
@@ -132,7 +135,7 @@ function ie(e) {
 					throw await t.appendEvent(n.id, {
 						step: e.name,
 						outcome: "failed",
-						detail: { message: j(r) }
+						detail: { message: se(r) }
 					}), await t.markFailed(n.id, r), r;
 				}
 			}
@@ -142,7 +145,7 @@ function ie(e) {
 }
 //#endregion
 //#region src/operations/enqueue.ts
-async function ae(e, t, n) {
+async function M(e, t, n) {
 	let r = await e.tenantOperations.create({
 		tenant_id: t.tenant_id,
 		rollout_id: t.rollout_id,
@@ -150,13 +153,14 @@ async function ae(e, t, n) {
 		engine: n,
 		initiated_by: t.initiated_by,
 		target_worker_version: t.target_worker_version,
-		target_database_version: t.target_database_version
-	}), i = A(r);
+		target_database_version: t.target_database_version,
+		input: t.input
+	}), i = ae(r);
 	try {
 		await e.tenantOperations.update(r.id, { engine_instance_id: i });
 	} catch (t) {
 		try {
-			await M(e).markFailed(r.id, t);
+			await A(e).markFailed(r.id, t);
 		} catch {}
 		throw t;
 	}
@@ -165,713 +169,635 @@ async function ae(e, t, n) {
 		engine_instance_id: i
 	};
 }
-async function oe(e, t, n) {
-	let r = M(e), i = await ae(e, n, t.engine);
+async function ue(e, t, n, r = {}) {
+	let i = A(e), a = await M(e, n, t.engine);
 	try {
-		await t.start(i);
+		await t.start(a);
 	} catch (t) {
+		let n = null;
 		try {
-			let n = await e.tenantOperations.get(i.id);
-			n && !ne(n.status) && await r.markFailed(i.id, t);
+			let r = await e.tenantOperations.get(a.id);
+			r && !j(r.status) && await i.markFailed(a.id, t), n = await e.tenantOperations.get(a.id);
 		} catch (e) {
 			console.warn("Failed to record tenant operation failure:", e);
 		}
+		if (r.returnFailed && n) return n;
 		throw t;
 	}
 	try {
-		return await e.tenantOperations.get(i.id) ?? i;
+		return await e.tenantOperations.get(a.id) ?? a;
 	} catch (e) {
-		return console.warn("Failed to re-fetch tenant operation after start:", e), i;
+		return console.warn("Failed to re-fetch tenant operation after start:", e), a;
 	}
 }
-//#endregion
-//#region src/operations/record-provision.ts
-function se(e) {
-	if (e.tenantOperations && e.tenantOperationEvents) return {
-		tenantOperations: e.tenantOperations,
-		tenantOperationEvents: e.tenantOperationEvents
-	};
-}
-async function ce(e, t, n) {
-	let r = se(e);
-	if (!r) {
-		await n(void 0);
-		return;
+async function de(e) {
+	let { tenantId: t, parentTenantId: n, getTenant: r, getChildren: i } = e, a = e.maxDepth ?? 2;
+	if (!n) return;
+	if (t && n === t) throw new w(400, { message: "A tenant cannot be its own parent" });
+	let o = new Set(t ? [t] : []), s = 0, c = n;
+	for (; c;) {
+		if (o.has(c)) throw new w(400, { message: `Setting parent_tenant_id to '${n}' would create a cycle` });
+		o.add(c);
+		let e = await r(c);
+		if (!e) throw new w(400, { message: `Parent tenant '${c}' not found` });
+		if (s += 1, s > a) throw new w(400, { message: `Tenant tree is limited to ${a} levels above a tenant` });
+		c = e.parent_tenant_id;
 	}
-	let i = M(r), a = async (e) => {
-		try {
-			await e();
-		} catch (e) {
-			console.warn("Failed to record tenant operation progress:", e);
+	if (t && i) {
+		let e = new Set([t]), r = 0, o = [t];
+		for (; o.length > 0;) {
+			let t = [];
+			for (let n of o) for (let r of await i(n)) e.has(r) || (e.add(r), t.push(r));
+			if (t.length > 0 && (r += 1, s + r > a)) throw new w(400, { message: `Moving tenant under '${n}' would make its descendant '${t[0]}' exceed the tenant tree limit of ${a} levels` });
+			o = t;
 		}
-	}, o;
-	if (await a(async () => {
-		let e = await ae(r, t, "inline");
-		o = e.id, await i.markRunning(e.id);
-	}), !o) {
-		await n(void 0);
-		return;
 	}
-	let s = o, c = !1, l = async (e, t, n) => {
-		c = !0, await a(async () => {
-			t === "started" && await i.setCurrentStep(s, e), await i.appendEvent(s, {
-				step: e,
-				outcome: t,
-				detail: n
-			});
-		});
-	};
-	try {
-		await n(l);
-	} catch (e) {
-		throw await a(async () => {
-			c || await i.appendEvent(s, {
-				step: t.kind,
-				outcome: "failed",
-				detail: { message: j(e) }
-			}), await i.markFailed(s, e);
-		}), e;
+}
+//#endregion
+//#region src/inheritance/chain.ts
+async function N(e) {
+	let { tenantId: t, getTenant: n, legacyControlPlane: r } = e, i = e.maxDepth ?? 2, a = await n(t);
+	if (!a?.parent_tenant_id) return r && r !== t ? [r] : [];
+	let o = [], s = new Set([t]), c = a.parent_tenant_id;
+	for (; c;) {
+		if (s.has(c)) throw new w(400, { message: `Tenant chain for '${t}' contains a cycle at '${c}'` });
+		if (s.add(c), o.length >= i) throw new w(400, { message: `Tenant chain for '${t}' is deeper than ${i}` });
+		let e = await n(c);
+		if (!e) break;
+		o.push(c), c = e.parent_tenant_id;
 	}
-	await a(async () => {
-		c || await i.appendEvent(s, {
-			step: t.kind,
-			outcome: "succeeded"
-		}), await i.markSucceeded(s);
-	});
+	return o;
 }
 //#endregion
-//#region src/hooks/provisioning.ts
-function le(e) {
-	return `urn:authhero:tenant:${e.toLowerCase()}`;
+//#region src/inheritance/legacy.ts
+function fe(e) {
+	let t = {};
+	for (let n of e ?? []) n.value !== void 0 && (t[n.name] = n.value);
+	return t;
 }
-function N(e) {
+function pe(e, t) {
+	if (!e.inherit) return e;
+	let n = t.find((t) => t.name === e.name && t.is_system);
+	if (!n) return e;
+	let r = {
+		...fe(n.secrets),
+		...fe(e.secrets)
+	};
 	return {
-		async beforeCreate(e, t) {
-			return !t.audience && t.id ? {
-				...t,
-				audience: le(t.id)
-			} : t;
-		},
-		async afterCreate(t, i) {
-			let { accessControl: a, databaseIsolation: o } = e;
-			if (a && t.ctx && await ue(t, i, a), o?.onProvision) {
-				let e = o.onProvision;
-				o.recordProvisionOperations === !1 ? await e(i.id) : await ce(t.adapters, {
-					kind: "provision",
-					tenant_id: i.id,
-					initiated_by: t.ctx?.var.user?.sub
-				}, (t) => e(i.id, t));
-			} else try {
-				await v(t.adapters, i.id, {
-					managementApiIdentifier: n,
-					managementApiScopes: r
-				});
-			} catch (e) {
-				throw console.warn(`Failed to provision default clients for tenant ${i.id}:`, e), e;
-			}
-		},
-		async beforeDelete(t, n) {
-			let { accessControl: r, databaseIsolation: i } = e;
-			if (r) try {
-				let e = (await t.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find((e) => e.name === n);
-				e && await t.adapters.organizations.remove(r.controlPlaneTenantId, e.id);
-			} catch (e) {
-				console.warn(`Failed to remove organization for tenant ${n}:`, e);
-			}
-			if (i?.onDeprovision) try {
-				await i.onDeprovision(n);
-			} catch (e) {
-				console.warn(`Failed to deprovision database for tenant ${n}:`, e);
-			}
-		}
+		...e,
+		code: n.code,
+		secrets: Object.entries(r).map(([e, t]) => ({
+			name: e,
+			value: t
+		}))
 	};
 }
-async function ue(e, t, n) {
-	let { controlPlaneTenantId: r, defaultPermissions: i, defaultRoles: a, issuer: o, adminRoleName: s = "Tenant Admin", adminRoleDescription: c = "Full access to all tenant management operations", addCreatorToOrganization: l = !0 } = n, u = await e.adapters.organizations.create(r, {
-		name: t.id,
-		display_name: t.friendly_name || t.id
-	}), d;
-	if (o && (d = await fe(e, r, s, c)), l && e.ctx) {
-		let t = e.ctx.var.user;
-		if (t?.sub && !await de(e, r, t.sub)) try {
-			await e.adapters.userOrganizations.create(r, {
-				user_id: t.sub,
-				organization_id: u.id
-			}), d && await e.adapters.userRoles.create(r, t.sub, d, u.id);
-		} catch (e) {
-			console.warn(`Failed to add creator ${t.sub} to organization ${u.id}:`, e);
-		}
-	}
-	a && a.length > 0 && console.log(`Would assign roles ${a.join(", ")} to organization ${u.id}`), i && i.length > 0 && console.log(`Would grant permissions ${i.join(", ")} to organization ${u.id}`);
-}
-async function de(e, t, r) {
-	let i = await e.adapters.userRoles.list(t, r, void 0, "");
-	for (let r of i) if ((await e.adapters.rolePermissions.list(t, r.id, { per_page: 1e3 })).some((e) => e.permission_name === "admin:organizations" && e.resource_server_identifier === n)) return !0;
-	return !1;
-}
-async function fe(e, t, i, a) {
-	let o = (await e.adapters.roles.list(t, {})).roles.find((e) => e.name === i);
-	if (o) return o.id;
-	let s = await e.adapters.roles.create(t, {
-		name: i,
-		description: a
-	}), c = n, l = r.map((e) => ({
-		role_id: s.id,
-		resource_server_identifier: c,
-		permission_name: e.value
-	}));
-	return await e.adapters.rolePermissions.assign(t, s.id, l), s.id;
+function me(e, t) {
+	if (!t) return e;
+	let n = new Set(e.hooks.map((e) => e.hook_id)), r = t.hooks.filter((e) => B(e) && !n.has(e.hook_id));
+	return {
+		connections: e.connections.map((e) => R(e, t.connections)),
+		resourceServers: e.resourceServers.map((e) => e.is_system ? Ie(e, t.resourceServers.find((t) => t.id === e.id) ?? null) : e),
+		hooks: [...e.hooks, ...r],
+		hookCode: e.hookCode,
+		actions: e.actions.map((e) => pe(e, t.actions)),
+		emailProvider: e.emailProvider ?? t.emailProvider,
+		branding: e.branding,
+		promptSettings: e.promptSettings
+	};
 }
 //#endregion
-//#region src/hooks/sync.ts
-function pe(e, t, n = () => !0) {
-	let { controlPlaneTenantId: r, getChildTenantIds: i, getAdapters: a } = e, o = /* @__PURE__ */ new Map();
-	async function s(e, n, r) {
-		return (await t(e).list(n, {
-			q: `name:${d(r)}`,
-			per_page: 1
-		}))[0] ?? null;
-	}
-	async function c(e) {
-		let n = await i(), o = t(await a(r));
-		await Promise.all(n.map(async (n) => {
-			try {
-				let r = await a(n), i = t(r), c = {
-					...o.transform(e),
-					is_system: !0
-				}, l = await s(r, n, e.name), u = l ? i.getId(l) : void 0;
-				if (l && u) {
-					let e = i.preserveOnUpdate ? i.preserveOnUpdate(l, c) : c;
-					await i.update(n, u, e);
-				} else await i.create(n, c);
-			} catch (t) {
-				console.error(`Failed to sync ${o.listKey} "${e.name}" to tenant "${n}":`, t);
-			}
-		}));
-	}
-	async function l(e) {
-		let n = await i();
-		await Promise.all(n.map(async (n) => {
-			try {
-				let r = await a(n), i = t(r), o = await s(r, n, e), c = o ? i.getId(o) : void 0;
-				o && c && await i.remove(n, c);
-			} catch (t) {
-				console.error(`Failed to delete entity "${e}" from tenant "${n}":`, t);
-			}
-		}));
-	}
+//#region src/rollout/defaults-projection.ts
+function he(e = {}) {
 	return {
-		afterCreate: async (e, t) => {
-			e.tenantId === r && n(t) && await c(t);
-		},
-		afterUpdate: async (e, t, i) => {
-			e.tenantId === r && n(i) && await c(i);
-		},
-		beforeDelete: async (e, i) => {
-			if (e.tenantId !== r) return;
-			let a = await t(e.adapters).get(e.tenantId, i);
-			a && n(a) && o.set(i, a);
-		},
-		afterDelete: async (e, t) => {
-			if (e.tenantId !== r) return;
-			let n = o.get(t);
-			n && (o.delete(t), await l(n.name));
-		}
+		connections: e.connections ?? !0,
+		resourceServers: e.resourceServers ?? !0,
+		hooks: e.hooks ?? !0,
+		emailProvider: e.emailProvider ?? !0,
+		branding: e.branding ?? !0,
+		promptSettings: e.promptSettings ?? !0
 	};
 }
-function me(e, t, n = () => !0) {
-	let { controlPlaneTenantId: r, getControlPlaneAdapters: i, getAdapters: a } = e;
-	return { async afterCreate(e, o) {
-		if (o.id !== r) try {
-			let e = await i(), s = await a(o.id), c = t(e), l = t(s), u = await f((e) => c.listPaginated(r, e), c.listKey, {
-				cursorField: "id",
-				pageSize: 100
-			});
-			await Promise.all(u.filter((e) => n(e)).map(async (e) => {
-				try {
-					let t = c.transform(e);
-					await l.create(o.id, {
-						...t,
-						is_system: !0
-					});
-				} catch (e) {
-					console.error(`Failed to sync entity to new tenant "${o.id}":`, e);
-				}
-			}));
-		} catch (e) {
-			console.error(`Failed to sync entities to new tenant "${o.id}":`, e);
-		}
-	} };
+function P() {
+	return {
+		upserted: 0,
+		errors: []
+	};
+}
+function ge(e) {
+	return {
+		tenantId: e,
+		connections: P(),
+		resourceServers: P(),
+		hooks: P(),
+		emailProvider: P(),
+		branding: P(),
+		promptSettings: P()
+	};
 }
-var he = (e) => ({
-	list: async (t, n) => (await e.resourceServers.list(t, n)).resource_servers,
-	listPaginated: (t, n) => e.resourceServers.list(t, n),
-	get: (t, n) => e.resourceServers.get(t, n),
-	create: (t, n) => e.resourceServers.create(t, n),
-	update: (t, n, r) => e.resourceServers.update(t, n, r),
-	remove: (t, n) => e.resourceServers.remove(t, n),
-	listKey: "resource_servers",
-	getId: (e) => e.id,
-	transform: (e) => ({
-		id: e.id,
-		name: e.name,
-		identifier: e.identifier,
-		scopes: e.scopes,
-		signing_alg: e.signing_alg,
-		token_lifetime: e.token_lifetime,
-		token_lifetime_for_web: e.token_lifetime_for_web
-	})
-}), ge = (e) => ({
-	list: async (t, n) => (await e.roles.list(t, n)).roles,
-	listPaginated: (t, n) => e.roles.list(t, n),
-	get: (t, n) => e.roles.get(t, n),
-	create: (t, n) => e.roles.create(t, n),
-	update: (t, n, r) => e.roles.update(t, n, r),
-	remove: (t, n) => e.roles.remove(t, n),
-	listKey: "roles",
-	getId: (e) => e.id,
-	transform: (e) => ({
-		id: e.id,
-		name: e.name,
-		description: e.description
-	})
-});
 function _e(e) {
-	return e.metadata?.sync !== !1;
+	let t = e.metadata;
+	return !!(t && t.inheritable === !0);
 }
-function ve(e) {
-	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => _e(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => _e(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? pe(e, he, a) : void 0, c = i ? pe(e, ge, o) : void 0, l = r ? me(e, he, a) : void 0, u = i ? me(e, ge, o) : void 0, p = i ? { async afterCreate(t, r) {
-		if (r.id !== e.controlPlaneTenantId) {
-			await u?.afterCreate?.(t, r);
-			try {
-				let t = await e.getControlPlaneAdapters(), i = await e.getAdapters(r.id), a = await f((n) => t.roles.list(e.controlPlaneTenantId, n), "roles", {
-					cursorField: "id",
-					pageSize: 100
-				}), o = /* @__PURE__ */ new Map();
-				for (let e of a.filter((e) => n.roles?.(e) ?? !0)) {
-					let t = await m(i, r.id, e.name);
-					t && o.set(e.name, t.id);
-				}
-				for (let s of a.filter((e) => n.roles?.(e) ?? !0)) {
-					let n = o.get(s.name);
-					if (n) try {
-						let a = await t.rolePermissions.list(e.controlPlaneTenantId, s.id, {});
-						a.length > 0 && await i.rolePermissions.assign(r.id, n, a.map((e) => ({
-							role_id: n,
-							resource_server_identifier: e.resource_server_identifier,
-							permission_name: e.permission_name
-						})));
-					} catch (e) {
-						console.error(`Failed to sync permissions for role "${s.name}" to tenant "${r.id}":`, e);
-					}
-				}
-			} catch (e) {
-				console.error(`Failed to sync role permissions to tenant "${r.id}":`, e);
-			}
-		}
-	} } : void 0;
-	async function m(e, t, n) {
-		return (await e.roles.list(t, {
-			q: `name:${d(n)}`,
-			per_page: 1
-		})).roles[0] ?? null;
+async function F(e, t, n, r) {
+	try {
+		await r();
+	} catch (r) {
+		let i = `${t}: ${r instanceof Error ? r.message : String(r)}`;
+		if (!n) throw Error(i, { cause: r });
+		e.errors.push(i);
 	}
+}
+async function ve(e, t, n) {
 	return {
-		entityHooks: {
-			resourceServers: s,
-			roles: c
-		},
-		tenantHooks: { async afterCreate(e, t) {
-			let n = [l?.afterCreate, p?.afterCreate ?? u?.afterCreate], r = [];
-			for (let i of n) if (i) try {
-				await i(e, t);
-			} catch (e) {
-				r.push(e instanceof Error ? e : Error(String(e)));
-			}
-			if (r.length === 1) throw r[0];
-			if (r.length > 1) throw AggregateError(r, r.map((e) => e.message).join("; "));
-		} }
+		connections: n.connections ? await m((n) => e.connections.list(t, n), "connections", {
+			cursorField: "id",
+			pageSize: 100
+		}) : [],
+		resourceServers: n.resourceServers ? await m((n) => e.resourceServers.list(t, n), "resource_servers", {
+			cursorField: "id",
+			pageSize: 100
+		}) : [],
+		hooks: n.hooks ? await m((n) => e.hooks.list(t, n), "hooks", {
+			cursorField: "hook_id",
+			pageSize: 100
+		}) : [],
+		emailProvider: n.emailProvider ? await e.emailProviders.get(t) ?? null : null,
+		branding: n.branding ? await e.branding.get(t) ?? null : null,
+		promptSettings: n.promptSettings ? await e.promptSettings.get(t) ?? null : null
 	};
 }
+async function ye(e, t, n, r, i, a) {
+	if (r.connections) for (let r of e.connections) {
+		let e = r.id;
+		e && await F(a.connections, `connection ${e}`, i, async () => {
+			let i = c.parse(r);
+			await t.connections.get(n, e) ? await t.connections.update(n, e, i) : await t.connections.create(n, i), a.connections.upserted += 1;
+		});
+	}
+	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await F(a.resourceServers, `resource_server ${r.id}`, i, async () => {
+		let e = x.parse(r);
+		await t.resourceServers.get(n, r.id) ? await t.resourceServers.update(n, r.id, e) : await t.resourceServers.create(n, e), a.resourceServers.upserted += 1;
+	});
+	if (r.hooks) for (let r of e.hooks) !_e(r) || !r.hook_id || await F(a.hooks, `hook ${r.hook_id}`, i, async () => {
+		let e = g.parse(r);
+		await t.hooks.get(n, r.hook_id) ? await t.hooks.update(n, r.hook_id, e) : await t.hooks.create(n, e), a.hooks.upserted += 1;
+	});
+	r.emailProvider && e.emailProvider && await F(a.emailProvider, "email_provider", i, async () => {
+		let r = e.emailProvider;
+		await t.emailProviders.get(n) ? await t.emailProviders.update(n, r) : await t.emailProviders.create(n, r), a.emailProvider.upserted += 1;
+	}), r.branding && e.branding && await F(a.branding, "branding", i, async () => {
+		await t.branding.set(n, e.branding), a.branding.upserted += 1;
+	}), r.promptSettings && e.promptSettings && await F(a.promptSettings, "prompt_settings", i, async () => {
+		await t.promptSettings.set(n, e.promptSettings), a.promptSettings.upserted += 1;
+	});
+}
+async function be(e, t) {
+	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = he(a), c = await ve(await r(), n, s), l = await i(t), u = ge(t);
+	return await ye(c, l, n, s, o, u), u;
+}
 //#endregion
-//#region src/middleware/request-data.ts
-function P(e) {
-	return e.var.data ?? e.env.data;
+//#region src/inheritance/read.ts
+async function I(e, t) {
+	let n = await ve(e, t, {
+		connections: !0,
+		resourceServers: !0,
+		hooks: !0,
+		emailProvider: !0,
+		branding: !0,
+		promptSettings: !0
+	}), r = await m((n) => e.actions.list(t, n), "actions", {
+		cursorField: "id",
+		pageSize: 100
+	}), i = new Set(r.map((e) => e.id)), a = /* @__PURE__ */ new Set();
+	for (let e of n.hooks) {
+		let t = e.code_id;
+		t && !i.has(t) && a.add(t);
+	}
+	let o = [];
+	for (let n of a) {
+		let r = await e.hookCode.get(t, n);
+		r && o.push(r);
+	}
+	return {
+		...n,
+		actions: r,
+		hookCode: o
+	};
 }
-async function ye(e) {
-	let { tenantId: t, parentTenantId: n, getTenant: r, getChildren: i } = e, a = e.maxDepth ?? 2;
-	if (!n) return;
-	if (t && n === t) throw new T(400, { message: "A tenant cannot be its own parent" });
-	let o = new Set(t ? [t] : []), s = 0, c = n;
-	for (; c;) {
-		if (o.has(c)) throw new T(400, { message: `Setting parent_tenant_id to '${n}' would create a cycle` });
-		o.add(c);
-		let e = await r(c);
-		if (!e) throw new T(400, { message: `Parent tenant '${c}' not found` });
-		if (s += 1, s > a) throw new T(400, { message: `Tenant tree is limited to ${a} levels above a tenant` });
-		c = e.parent_tenant_id;
+//#endregion
+//#region src/inheritance/shadow.ts
+var xe = /secret|password|private_key|api_key|token/i, Se = new Set([
+	"id",
+	"tenant_id",
+	"created_at",
+	"updated_at",
+	"scope",
+	"override",
+	"enforce",
+	"enabled_clients"
+]);
+async function L(e) {
+	let t = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
+	return [...new Uint8Array(t)].map((e) => e.toString(16).padStart(2, "0")).join("").slice(0, 16);
+}
+async function Ce(e, t = "") {
+	if (Array.isArray(e)) {
+		if (t === "secrets") {
+			let t = {};
+			for (let n of e) t[n.name] = n.value === void 0 ? null : `sha256:${await L(n.value)}`;
+			return t;
+		}
+		return Promise.all(e.map((e) => Ce(e, t)));
 	}
-	if (t && i) {
-		let e = new Set([t]), r = 0, o = [t];
-		for (; o.length > 0;) {
-			let t = [];
-			for (let n of o) for (let r of await i(n)) e.has(r) || (e.add(r), t.push(r));
-			if (t.length > 0 && (r += 1, s + r > a)) throw new T(400, { message: `Moving tenant under '${n}' would make its descendant '${t[0]}' exceed the tenant tree limit of ${a} levels` });
-			o = t;
+	if (e && typeof e == "object") {
+		let t = {};
+		for (let n of Object.keys(e).sort()) {
+			let r = e[n];
+			r != null && (t[n] = typeof r == "string" && xe.test(n) ? `sha256:${await L(r)}` : await Ce(r, n));
 		}
+		return t;
 	}
+	return e;
 }
-//#endregion
-//#region src/routes/tenants.ts
-var be = w.object({
-	sub: w.string(),
-	tenant_id: w.string().optional(),
-	org_id: w.string().optional(),
-	scope: w.string().optional(),
-	permissions: w.array(w.string()).optional()
-}).passthrough();
-function xe(e) {
-	let t = be.safeParse(e);
-	return t.success ? t.data : void 0;
+async function we(e) {
+	let t = {};
+	for (let [n, r] of Object.entries(e)) Se.has(n) || (t[n] = r);
+	return await Ce(t);
 }
-function Se(e) {
-	let t = e.permissions ?? [], n = e.scope ? e.scope.split(" ").filter(Boolean) : [], r = new Set([...t, ...n]);
-	return r.has("delete:tenants") || r.has("admin:organizations");
+var Te = {
+	connection: (e) => `${e.strategy}:${e.name}`,
+	resourceServer: (e) => e.identifier,
+	hook: (e) => e.hook_id,
+	action: (e) => e.name
+}, Ee = new Set([
+	"connection",
+	"resourceServer",
+	"action",
+	"emailProvider",
+	"branding",
+	"promptSettings"
+]);
+async function De(e) {
+	let t = /* @__PURE__ */ new Map(), n = async (e, n, r) => {
+		let i = t.get(e) ?? /* @__PURE__ */ new Map();
+		i.set(n, await we(r)), t.set(e, i);
+	};
+	for (let [t, r] of Object.entries(Te)) {
+		let i = e[{
+			connection: "connections",
+			resourceServer: "resourceServers",
+			hook: "hooks",
+			action: "actions"
+		}[t]];
+		for (let e of i) await n(t, r(e), e);
+	}
+	for (let t of [
+		"emailProvider",
+		"branding",
+		"promptSettings"
+	]) e[t] && await n(t, "singleton", e[t]);
+	return t;
 }
-function F(e, t) {
-	let n = new S();
-	return n.openapi(C({
-		tags: ["tenants"],
-		method: "get",
-		path: "/",
-		request: { query: i },
-		security: [{ Bearer: [] }],
-		responses: { 200: {
-			content: { "application/json": { schema: w.object({
-				tenants: w.array(x),
-				start: w.number().optional(),
-				limit: w.number().optional(),
-				length: w.number().optional(),
-				total: w.number().optional()
-			}) } },
-			description: "List of tenants"
-		} }
-	}), async (t) => {
-		let { page: n, per_page: r, include_totals: i, q: a } = t.req.valid("query"), o = t.var.user, s = o?.permissions || [];
-		if (!(o?.org_id ?? t.var.organization_id) && s.includes("admin:organizations")) {
-			let e = await P(t).tenants.list({
-				page: n,
-				per_page: r,
-				include_totals: i,
-				q: a
+async function Oe(e, t) {
+	let [n, r] = await Promise.all([De(e), De(t)]), i = [], a = new Set([...n.keys(), ...r.keys()]);
+	for (let e of a) {
+		let t = n.get(e) ?? /* @__PURE__ */ new Map(), a = r.get(e) ?? /* @__PURE__ */ new Map();
+		for (let n of new Set([...t.keys(), ...a.keys()])) {
+			let r = t.get(n), o = a.get(n);
+			if (r && !o) i.push({
+				entity: e,
+				key: n,
+				kind: "missing",
+				fields: [],
+				expected: !1
 			});
-			return i ? t.json({
-				tenants: e.tenants,
-				start: e.totals?.start ?? 0,
-				limit: e.totals?.limit ?? r,
-				length: e.tenants.length,
-				total: e.totals?.length
-			}) : t.json({ tenants: e.tenants });
+			else if (!r && o) i.push({
+				entity: e,
+				key: n,
+				kind: "extra",
+				fields: [],
+				expected: Ee.has(e)
+			});
+			else if (r && o) {
+				let t = JSON.stringify(r), a = JSON.stringify(o);
+				if (t === a) continue;
+				let s = [...new Set([...Object.keys(r), ...Object.keys(o)])].filter((e) => JSON.stringify(r[e]) !== JSON.stringify(o[e])).sort();
+				i.push({
+					entity: e,
+					key: n,
+					kind: "changed",
+					fields: s,
+					expected: !1,
+					legacy_hash: await L(t),
+					new_hash: await L(a)
+				});
+			}
 		}
-		let c = e.accessControl?.controlPlaneTenantId ?? P(t).multiTenancyConfig?.controlPlaneTenantId;
-		if (c && !o?.sub) throw new T(403, { message: "Access denied: token has no subject" });
-		if (c && o?.sub) {
-			let e = (await f((e) => P(t).userOrganizations.listUserOrganizations(c, o.sub, e), "organizations")).map((e) => e.name);
-			if (e.length === 0) return i ? t.json({
-				tenants: [],
-				start: 0,
-				limit: r ?? 50,
-				length: 0,
-				total: 0
-			}) : t.json({ tenants: [] });
-			let s = e.length, l = n ?? 0, u = r ?? 50, d = l * u, p = e.slice(d, d + u);
-			if (p.length === 0) return i ? t.json({
-				tenants: [],
-				start: d,
-				limit: u,
-				length: 0,
-				total: s
-			}) : t.json({ tenants: [] });
-			let m = p.map((e) => `id:${e}`).join(" OR "), h = a ? `(${m}) AND (${a})` : m, g = await P(t).tenants.list({
-				q: h,
-				per_page: u,
-				include_totals: !1
-			});
-			return i ? t.json({
-				tenants: g.tenants,
-				start: d,
-				limit: u,
-				length: g.tenants.length,
-				total: s
-			}) : t.json({ tenants: g.tenants });
-		}
-		let l = await P(t).tenants.list({
-			page: n,
-			per_page: r,
-			include_totals: i,
-			q: a
-		});
-		return i ? t.json({
-			tenants: l.tenants,
-			start: l.totals?.start ?? 0,
-			limit: l.totals?.limit ?? r,
-			length: l.tenants.length,
-			total: l.totals?.length
-		}) : t.json({ tenants: l.tenants });
-	}), n.openapi(C({
-		tags: ["tenants"],
-		method: "post",
-		path: "/",
-		request: { body: { content: { "application/json": { schema: b } } } },
-		security: [{ Bearer: [] }],
-		responses: {
-			201: {
-				content: { "application/json": { schema: x } },
-				description: "Tenant created"
-			},
-			400: { description: "Validation error" },
-			409: { description: "Tenant with this ID already exists" }
-		}
-	}), async (e) => {
-		if (!e.var.user?.sub) throw new T(401, { message: "Authentication required to create tenants" });
-		let n = e.req.valid("json"), r = {
-			adapters: P(e),
-			ctx: e
-		};
-		t.tenants?.beforeCreate && (n = await t.tenants.beforeCreate(r, n)), await ye({
-			tenantId: n.id,
-			parentTenantId: n.parent_tenant_id,
-			getTenant: (t) => P(e).tenants.get(t)
-		});
-		let i = await P(e).tenants.create(n);
-		return t.tenants?.afterCreate && await t.tenants.afterCreate(r, i), e.json(i, 201);
-	}), n.openapi(C({
-		tags: ["tenants"],
-		method: "delete",
-		path: "/{id}",
-		request: { params: w.object({ id: w.string() }) },
-		security: [{ Bearer: ["delete:tenants"] }],
-		responses: {
-			204: { description: "Tenant deleted" },
-			403: { description: "Access denied or cannot delete the control plane" },
-			404: { description: "Tenant not found" }
-		}
-	}), async (n) => {
-		let { id: r } = n.req.valid("param"), i = e.accessControl?.controlPlaneTenantId ?? P(n).multiTenancyConfig?.controlPlaneTenantId;
-		if (i) {
-			let e = xe(n.var.user);
-			if (!e?.sub) throw new T(401, { message: "Authentication required" });
-			if (r === i) throw new T(403, { message: "Cannot delete the control plane" });
-			let t = n.var.org_name, a = r.toLowerCase(), o = !!t && t.toLowerCase() === a;
-			if (!o) {
-				let r = !!(e.org_id ?? n.var.organization_id ?? t), a = !e.tenant_id || e.tenant_id === i;
-				!r && a && Se(e) && (o = !0);
-			}
-			if (o ||= (await f((t) => P(n).userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new T(403, { message: "Access denied to this tenant" });
-		}
-		if (!await P(n).tenants.get(r)) throw new T(404, { message: "Tenant not found" });
-		let a = {
-			adapters: P(n),
-			ctx: n
-		};
-		return t.tenants?.beforeDelete && await t.tenants.beforeDelete(a, r), await P(n).tenants.remove(r), t.tenants?.afterDelete && await t.tenants.afterDelete(a, r), n.body(null, 204);
-	}), n.openapi(C({
-		tags: ["tenants", "settings"],
-		method: "get",
-		path: "/settings",
-		request: { headers: w.object({ "tenant-id": w.string().optional() }) },
-		security: [{ Bearer: ["read:tenants"] }],
-		responses: { 200: {
-			content: { "application/json": { schema: x } },
-			description: "Current tenant settings"
-		} }
-	}), async (e) => {
-		let t = await P(e).tenants.get(e.var.tenant_id);
-		if (!t) throw new T(404, { message: "Tenant not found" });
-		return e.json(t);
-	}), n.openapi(C({
-		tags: ["tenants", "settings"],
-		method: "patch",
-		path: "/settings",
-		request: {
-			headers: w.object({ "tenant-id": w.string().optional() }),
-			body: { content: { "application/json": { schema: w.object(b.shape).partial() } } }
-		},
-		security: [{ Bearer: ["update:tenants"] }],
-		responses: { 200: {
-			content: { "application/json": { schema: x } },
-			description: "Updated tenant settings"
-		} }
-	}), async (e) => {
-		let { id: t, ...n } = e.req.valid("json"), r = await P(e).tenants.get(e.var.tenant_id);
-		if (!r) throw new T(404, { message: "Tenant not found" });
-		if ("default_client_id" in n) {
-			let t = n.default_client_id;
-			if (typeof t == "string" && t.length > 0) {
-				let n = await P(e).clients.get(e.var.tenant_id, t);
-				if (!n) throw new T(400, { message: `Client with id '${t}' not found` });
-				if (!h(n)) throw new T(400, { message: `Client '${t}' is not an interactive client and cannot be used as the default client` });
-			}
-		}
-		"parent_tenant_id" in n && await ye({
-			tenantId: e.var.tenant_id,
-			parentTenantId: n.parent_tenant_id,
-			getTenant: (t) => P(e).tenants.get(t),
-			getChildren: async (t) => (await f((t) => P(e).tenants.list(t), "tenants")).filter((e) => e.parent_tenant_id === t).map((e) => e.id)
-		});
-		let i = l(r, n);
-		await P(e).tenants.update(e.var.tenant_id, i);
-		let a = await P(e).tenants.get(e.var.tenant_id);
-		if (!a) throw new T(500, { message: "Failed to retrieve updated tenant" });
-		return e.json(a);
-	}), n;
+	}
+	return i;
+}
+async function ke(e) {
+	let { adapters: t, tenantId: n, legacyControlPlane: r } = e, i = await N({
+		tenantId: n,
+		getTenant: (e) => t.tenants.get(e),
+		legacyControlPlane: r,
+		maxDepth: e.maxDepth
+	}), a = await I(t, n), o = await Promise.all(i.map((e) => I(t, e))), s = r && r !== n ? await I(t, r) : void 0, { hidden: c, ...l } = Ze(o, a), u = new Set(c);
+	return (await Oe(me(a, s), l)).filter((e) => !u.has(`${e.entity}:${e.key}`));
 }
 //#endregion
-//#region src/middleware/protect-synced.ts
-function Ce(e) {
-	for (let { pattern: t, type: n } of [
-		{
-			pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
-			type: "resource_server"
-		},
-		{
-			pattern: /\/api\/v2\/roles\/([^/]+)$/,
-			type: "role"
-		},
-		{
-			pattern: /\/api\/v2\/connections\/([^/]+)$/,
-			type: "connection"
+//#region src/inheritance/report.ts
+var Ae = 3600 * 1e3, je = 1e4;
+function Me(e, t) {
+	let n = t.sample ?? 1, r = t.intervalMs ?? 6e4, i = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Set(), o = /* @__PURE__ */ new Map();
+	async function s(n, r) {
+		let i = await ke({
+			adapters: e,
+			tenantId: n,
+			legacyControlPlane: r
+		}), a = Date.now();
+		o.size > je && o.clear();
+		for (let s of i) {
+			if (s.expected && !t.includeExpected) continue;
+			let i = await L([
+				n,
+				s.entity,
+				s.key,
+				s.kind,
+				s.fields.join(",")
+			].join("|")), c = o.get(i);
+			c !== void 0 && a - c < Ae || (o.set(i, a), await Ne(e, n, s, r));
 		}
-	]) {
-		let r = e.match(t);
-		if (r && r[1]) return {
-			type: n,
-			id: r[1]
-		};
 	}
-	return null;
+	return { schedule(e, t) {
+		if (a.has(e) || n < 1 && Math.random() >= n) return;
+		let o = Date.now(), c = i.get(e);
+		c !== void 0 && o - c < r || (i.set(e, o), a.add(e), s(e, t).catch(() => {}).finally(() => a.delete(e)));
+	} };
 }
-async function we(e, t, n) {
-	try {
-		switch (n.type) {
-			case "resource_server": return (await e.resourceServers.get(t, n.id))?.is_system === !0;
-			case "role": return (await e.roles.get(t, n.id))?.is_system === !0;
-			case "connection": return (await e.connections.get(t, n.id))?.is_system === !0;
-			default: return !1;
+async function Ne(e, n, r, i) {
+	await e.logs.create(n, {
+		type: t.CONFIG_INHERITANCE_DIFF,
+		date: (/* @__PURE__ */ new Date()).toISOString(),
+		isMobile: !1,
+		description: `${r.kind} ${r.entity} ${r.key}`,
+		details: {
+			shadow: "config-inheritance",
+			legacy_control_plane: i,
+			...r
 		}
-	} catch {
-		return !1;
-	}
+	});
 }
-function Te(e) {
+//#endregion
+//#region src/middleware/config-sync-mode.ts
+function Pe(e) {
+	let { base: t, getTenant: n, controlPlaneTenantId: r } = e, i = e.ttlMs ?? 3e4, a = e.maxEntries ?? 1e3, o = /* @__PURE__ */ new Map();
+	async function s(e) {
+		if (e === r) return !1;
+		let t = o.get(e), s = Date.now();
+		if (t && t.expires > s) return t.synced;
+		try {
+			let t = (await n(e))?.config_sync === "synced";
+			return o.size >= a && o.clear(), o.set(e, {
+				synced: t,
+				expires: s + i
+			}), t;
+		} catch {
+			return !1;
+		}
+	}
 	return {
-		resource_server: "resource server",
-		role: "role",
-		connection: "connection"
-	}[e];
-}
-function Ee() {
-	return async (e, t) => {
-		if (![
-			"PATCH",
-			"PUT",
-			"DELETE"
-		].includes(e.req.method)) return t();
-		let n = Ce(e.req.path);
-		if (!n) return t();
-		let r = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
-		if (!r) return t();
-		if (await we(P(e), r, n)) throw new T(403, { message: `This ${Te(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
-		return t();
+		isSynced: s,
+		invalidate(e) {
+			e ? o.delete(e) : o.clear();
+		},
+		async resolve({ tenant_id: e }) {
+			let n = await t(e);
+			return !n || n.tenantId === e ? n : await s(e) ? void 0 : n;
+		}
 	};
 }
 //#endregion
-//#region src/inheritance/chain.ts
-async function De(e) {
-	let { tenantId: t, getTenant: n, legacyControlPlane: r } = e, i = e.maxDepth ?? 2, a = await n(t);
-	if (!a?.parent_tenant_id) return r && r !== t ? [r] : [];
-	let o = [], s = new Set([t]), c = a.parent_tenant_id;
-	for (; c;) {
-		if (s.has(c)) throw new T(400, { message: `Tenant chain for '${t}' contains a cycle at '${c}'` });
-		if (s.add(c), o.length >= i) throw new T(400, { message: `Tenant chain for '${t}' is deeper than ${i}` });
-		let e = await n(c);
-		if (!e) break;
-		o.push(c), c = e.parent_tenant_id;
-	}
-	return o;
+//#region src/middleware/settings-inheritance.ts
+function R(e, t) {
+	let n = t.find((t) => t.strategy === e.strategy);
+	if (!n?.options) return e;
+	let r = u.passthrough().parse({
+		...n,
+		...e
+	});
+	return r.options = l.passthrough().parse({
+		...n.options || {},
+		...e.options
+	}), r;
 }
-//#endregion
-//#region src/inheritance/legacy.ts
-function Oe(e) {
-	let t = {};
-	for (let n of e ?? []) n.value !== void 0 && (t[n.name] = n.value);
-	return t;
+function z(e, t) {
+	let n = [...t || [], ...e || []];
+	return [...new Set(n)];
 }
-function ke(e, t) {
-	if (!e.inherit) return e;
-	let n = t.find((t) => t.name === e.name && t.is_system);
-	if (!n) return e;
-	let r = {
-		...Oe(n.secrets),
-		...Oe(e.secrets)
-	};
-	return {
+function Fe(e, t) {
+	if (!t?.length) return e || [];
+	if (!e?.length) return t;
+	let n = /* @__PURE__ */ new Map();
+	for (let e of t) n.set(e.value, e);
+	for (let t of e) n.set(t.value, t);
+	return Array.from(n.values());
+}
+function Ie(e, t) {
+	return t ? {
 		...e,
-		code: n.code,
-		secrets: Object.entries(r).map(([e, t]) => ({
-			name: e,
-			value: t
-		}))
-	};
+		scopes: Fe(e.scopes, t.scopes)
+	} : e;
 }
-function Ae(e, t) {
-	if (!t) return e;
-	let n = new Set(e.hooks.map((e) => e.hook_id)), r = t.hooks.filter((e) => X(e) && !n.has(e.hook_id));
-	return {
-		connections: e.connections.map((e) => q(e, t.connections)),
-		resourceServers: e.resourceServers.map((e) => e.is_system ? Y(e, t.resourceServers.find((t) => t.id === e.id) ?? null) : e),
-		hooks: [...e.hooks, ...r],
-		actions: e.actions.map((e) => ke(e, t.actions)),
-		emailProvider: e.emailProvider ?? t.emailProvider,
-		branding: e.branding,
-		promptSettings: e.promptSettings
+function Le(e, t) {
+	return t ? {
+		...e,
+		callbacks: z(e.callbacks, t.callbacks),
+		web_origins: z(e.web_origins, t.web_origins),
+		allowed_logout_urls: z(e.allowed_logout_urls, t.allowed_logout_urls),
+		allowed_origins: z(e.allowed_origins, t.allowed_origins)
+	} : e;
+}
+function Re(e) {
+	let { controlPlaneTenantId: t, controlPlaneClientId: n, resolveControlPlane: r } = e;
+	if (r) return async (e) => r({ tenant_id: e });
+	if (!t) return async () => void 0;
+	let i = {
+		tenantId: t,
+		clientId: n
 	};
+	return async () => i;
 }
-//#endregion
-//#region src/inheritance/types.ts
-var je = () => ({
-	connections: [],
-	resourceServers: [],
-	hooks: [],
-	actions: [],
-	emailProvider: null,
-	branding: null,
-	promptSettings: null
-});
-//#endregion
-//#region src/inheritance/merge.ts
-function I(e, t) {
-	if (t.scope) return t.scope;
-	switch (e) {
+function ze(e, t) {
+	return {
+		...e.resourceServers,
+		get: async (n, r) => {
+			let i = await e.resourceServers.get(n, r);
+			if (!i) return i;
+			let a = await t(n);
+			return !a || n === a.tenantId || !i.is_system ? i : Ie(i, await e.resourceServers.get(a.tenantId, r));
+		},
+		list: async (n, r) => {
+			let i = await e.resourceServers.list(n, r), a = await t(n);
+			if (!a || n === a.tenantId) return i;
+			let o = a.tenantId, s = i.resource_servers.filter((e) => !!(e.is_system && e.id)).map((e) => e.id);
+			if (s.length === 0) return i;
+			let c = /* @__PURE__ */ new Map();
+			await Promise.all(s.map(async (t) => {
+				let n = await e.resourceServers.get(o, t);
+				n && c.set(t, n);
+			}));
+			let l = i.resource_servers.map((e) => e.is_system && e.id ? Ie(e, c.get(e.id) ?? null) : e);
+			return {
+				...i,
+				resource_servers: l
+			};
+		}
+	};
+}
+function Be(e, t) {
+	let n = Re({
+		controlPlaneTenantId: t.controlPlaneTenantId,
+		resolveControlPlane: t.resolveControlPlane
+	});
+	return {
+		...e,
+		resourceServers: ze(e, n)
+	};
+}
+function Ve(e, t) {
+	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i, inheritanceShadow: a } = t, o = t.configSync ?? Pe({
+		base: Re({
+			controlPlaneTenantId: n,
+			controlPlaneClientId: r,
+			resolveControlPlane: i
+		}),
+		getTenant: async (t) => await e.tenants.get(t) ?? null,
+		controlPlaneTenantId: n
+	}), s = (e) => o.resolve({ tenant_id: e }), c = a ? Me(e, a === !0 ? {} : a) : void 0, l = c ? async (e) => {
+		let t = await s(e);
+		return await o.isSynced(e) || c.schedule(e, t?.tenantId), t;
+	} : s;
+	return {
+		...e,
+		multiTenancyConfig: {
+			controlPlaneTenantId: n,
+			controlPlaneClientId: r,
+			resolveControlPlane: o.resolve
+		},
+		connections: {
+			...e.connections,
+			get: async (t, n) => {
+				let r = await e.connections.get(t, n);
+				if (!r) return r;
+				let i = await l(t);
+				return !i || t === i.tenantId ? r : R(r, (await e.connections.list(i.tenantId)).connections || []);
+			},
+			list: async (t, n) => {
+				let r = await e.connections.list(t, n), i = await l(t);
+				if (!i || t === i.tenantId) return r;
+				let a = await e.connections.list(i.tenantId), o = r.connections.map((e) => R(e, a.connections || []));
+				return {
+					...r,
+					connections: o
+				};
+			}
+		},
+		clientConnections: {
+			...e.clientConnections,
+			listByClient: async (t, n) => {
+				let r = await e.clientConnections.listByClient(t, n);
+				r.length === 0 && (r = (await e.connections.list(t)).connections || []);
+				let i = await l(t);
+				if (!i || t === i.tenantId) return r;
+				let a = await e.connections.list(i.tenantId);
+				return r.map((e) => R(e, a.connections || []));
+			}
+		},
+		emailProviders: {
+			...e.emailProviders,
+			get: async (t) => {
+				let n = await e.emailProviders.get(t);
+				if (n) return n;
+				let r = await l(t);
+				return !r || t === r.tenantId ? null : e.emailProviders.get(r.tenantId);
+			}
+		},
+		resourceServers: ze(e, l),
+		hooks: He(e, l)
+	};
+}
+function B(e) {
+	if (!e || typeof e != "object") return !1;
+	let t = e.metadata;
+	return !t || typeof t != "object" ? !1 : t.inheritable === !0;
+}
+function He(e, t) {
+	return {
+		...e.hooks,
+		list: async (n, r) => {
+			let i = await e.hooks.list(n, r), a = await t(n);
+			if (!a || n === a.tenantId) return i;
+			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(B);
+			if (o.length === 0) return i;
+			let s = new Set((i.hooks || []).map((e) => e.hook_id)), c = [];
+			for (let e of o) s.has(e.hook_id) || e.hook_id && s.has(await W("hook", n, e.hook_id)) || c.push(e);
+			return {
+				...i,
+				hooks: [...i.hooks || [], ...c],
+				length: typeof i.length == "number" ? i.length + c.length : i.length
+			};
+		},
+		get: async (n, r) => {
+			let i = await e.hooks.get(n, r);
+			if (i) return i;
+			let a = await t(n);
+			if (!a || n === a.tenantId) return i;
+			let o = await e.hooks.get(a.tenantId, r);
+			return o && B(o) ? o : null;
+		}
+	};
+}
+function Ue(e, t) {
+	return Ve(e, t);
+}
+//#endregion
+//#region src/inheritance/types.ts
+var We = () => ({
+	connections: [],
+	resourceServers: [],
+	hooks: [],
+	hookCode: [],
+	actions: [],
+	emailProvider: null,
+	branding: null,
+	promptSettings: null
+});
+//#endregion
+//#region src/inheritance/merge.ts
+function V(e, t) {
+	if (t.scope) return t.scope;
+	switch (e) {
 		case "connection":
 		case "emailProvider": return "shared";
 		case "resourceServer":
 		case "action": return t.is_system ? "shared" : "local";
-		case "hook": return X(t) ? "shared" : "local";
+		case "hook": return B(t) ? "shared" : "local";
 		default: return "local";
 	}
 }
-function L(e) {
+function H(e) {
 	return e.override ?? "fields";
 }
-var Me = /secret|password|private_key|api_key|token/i;
-function Ne(e, t) {
+var Ge = /secret|password|private_key|api_key|token/i;
+function Ke(e, t) {
 	let n = { ...e ?? {} };
-	for (let [e, r] of Object.entries(t ?? {})) Me.test(e) && (n[e] = r);
+	for (let [e, r] of Object.entries(t ?? {})) Ge.test(e) && (n[e] = r);
 	return n;
 }
-function R(e, t) {
-	switch (L(e)) {
+function qe(e, t) {
+	switch (H(e)) {
 		case "none": return {
 			...e,
 			id: t.id
@@ -879,7 +805,7 @@ function R(e, t) {
 		case "secrets": return {
 			...e,
 			id: t.id,
-			options: Ne(e.options, t.options)
+			options: Ke(e.options, t.options)
 		};
 		default: return {
 			...e,
@@ -891,8 +817,8 @@ function R(e, t) {
 		};
 	}
 }
-function Pe(e, t) {
-	switch (L(e)) {
+function Je(e, t) {
+	switch (H(e)) {
 		case "none": return {
 			...e,
 			id: t.id
@@ -904,46 +830,46 @@ function Pe(e, t) {
 		};
 		default: return {
 			...t,
-			scopes: $e(t.scopes, e.scopes)
+			scopes: Fe(t.scopes, e.scopes)
 		};
 	}
 }
-function Fe(e) {
+function Ye(e) {
 	return new Map((e ?? []).map((e) => [e.name, e]));
 }
-function Ie(e, t) {
-	let n = L(e);
+function Xe(e, t) {
+	let n = H(e);
 	if (n === "none") return {
 		...e,
 		id: t.id
 	};
-	let r = Fe(e.secrets);
-	if (n === "secrets" || n === "fields") for (let [e, n] of Fe(t.secrets)) r.set(e, n);
+	let r = Ye(e.secrets);
+	if (n === "secrets" || n === "fields") for (let [e, n] of Ye(t.secrets)) r.set(e, n);
 	return {
 		...n === "fields" && !t.inherit ? t : e,
 		id: t.id,
 		secrets: [...r.values()]
 	};
 }
-function Le(e, t) {
+function Ze(e, t) {
 	let n = /* @__PURE__ */ new Set(), r = [...e].reverse().concat(t), i = (e, t, r, i) => r ? t : t.filter((t) => {
-		let r = I(e, t);
+		let r = V(e, t);
 		return r === "local" ? !1 : (r === "platform" && n.add(`${e}:${i(t)}`), !0);
-	}), a = je(), o = (e) => `${e.strategy}:${e.name}`, s = (e) => e.identifier, c = (e) => e.hook_id ?? "", l = (e) => e.name, u = /* @__PURE__ */ new Map(), d = [], f = /* @__PURE__ */ new Map(), p = /* @__PURE__ */ new Map(), m = /* @__PURE__ */ new Map();
+	}), a = We(), o = (e) => `${e.strategy}:${e.name}`, s = (e) => e.identifier, c = (e) => e.hook_id ?? "", l = (e) => e.name, u = /* @__PURE__ */ new Map(), d = [], f = /* @__PURE__ */ new Map(), p = /* @__PURE__ */ new Map(), m = /* @__PURE__ */ new Map();
 	r.forEach((e, t) => {
 		let h = t === r.length - 1;
 		for (let t of i("connection", e.connections, h, o)) {
 			let e = u.get(t.strategy);
-			h ? d.push(e ? R(e, t) : t) : u.set(t.strategy, e ? R(e, t) : t);
+			h ? d.push(e ? qe(e, t) : t) : u.set(t.strategy, e ? qe(e, t) : t);
 		}
 		for (let t of i("resourceServer", e.resourceServers, h, s)) {
 			let e = f.get(s(t));
-			f.set(s(t), e ? Pe(e, t) : t);
+			f.set(s(t), e ? Je(e, t) : t);
 		}
 		for (let t of i("hook", e.hooks, h, c)) p.set(c(t), t);
 		for (let t of i("action", e.actions, h, l)) {
 			let e = m.get(l(t));
-			m.set(l(t), e ? Ie(e, t) : t);
+			m.set(l(t), e ? Xe(e, t) : t);
 		}
 		for (let t of [
 			"emailProvider",
@@ -951,485 +877,1059 @@ function Le(e, t) {
 			"promptSettings"
 		]) {
 			let r = e[t];
-			r && (h || I(t, r) !== "local") && (!h && I(t, r) === "platform" && n.add(`${t}:singleton`), a[t] = r);
+			r && (h || V(t, r) !== "local") && (!h && V(t, r) === "platform" && n.add(`${t}:singleton`), a[t] = r);
 		}
 	});
 	let h = new Set(r[r.length - 1].connections.map((e) => e.strategy));
-	return a.connections = [...d, ...[...u.values()].filter((e) => !h.has(e.strategy))], a.resourceServers = [...f.values()], a.hooks = [...p.values()], a.actions = [...m.values()], {
+	a.connections = [...d, ...[...u.values()].filter((e) => !h.has(e.strategy))], a.resourceServers = [...f.values()], a.hooks = [...p.values()];
+	let g = new Set(a.hooks.map((e) => e.code_id).filter((e) => !!e)), _ = /* @__PURE__ */ new Map();
+	for (let e of [...r].reverse()) for (let t of e.hookCode) g.has(t.id) && !_.has(t.id) && _.set(t.id, t);
+	return a.hookCode = [..._.values()], a.actions = [...m.values()], {
 		...a,
 		hidden: [...n]
 	};
 }
 //#endregion
-//#region src/rollout/defaults-projection.ts
-function z(e = {}) {
-	return {
-		connections: e.connections ?? !0,
-		resourceServers: e.resourceServers ?? !0,
-		hooks: e.hooks ?? !0,
-		emailProvider: e.emailProvider ?? !0,
-		branding: e.branding ?? !0,
-		promptSettings: e.promptSettings ?? !0
-	};
-}
-function B() {
-	return {
-		upserted: 0,
-		errors: []
-	};
-}
-function Re(e) {
-	return {
-		tenantId: e,
-		connections: B(),
-		resourceServers: B(),
-		hooks: B(),
-		emailProvider: B(),
-		branding: B(),
-		promptSettings: B()
-	};
-}
-function ze(e) {
-	let t = e.metadata;
-	return !!(t && t.inheritable === !0);
+//#region src/rollout/resolved-sync.ts
+function U(e) {
+	return Array.isArray(e) ? `[${e.map(U).join(",")}]` : e && typeof e == "object" ? `{${Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : 1).map(([e, t]) => `${JSON.stringify(e)}:${U(t)}`).join(",")}}` : JSON.stringify(e) ?? "null";
 }
-async function V(e, t, n, r) {
-	try {
-		await r();
-	} catch (r) {
-		let i = `${t}: ${r instanceof Error ? r.message : String(r)}`;
-		if (!n) throw Error(i, { cause: r });
-		e.errors.push(i);
+async function Qe(e) {
+	let t = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
+	return [...new Uint8Array(t)].map((e) => e.toString(16).padStart(2, "0")).join("");
+}
+var $e = {
+	connection: "con_",
+	resourceServer: "api_",
+	hook: "h_",
+	hookCode: "hc_",
+	action: "act_"
+};
+async function W(e, t, n) {
+	let r = await Qe(`${t}|${e}|${n}`);
+	return `${$e[e]}sy${r.slice(0, 15)}`;
+}
+function G(e, t) {
+	let n = t;
+	switch (e) {
+		case "connection": return `${n.strategy}:${n.name}`;
+		case "resourceServer": return n.identifier;
+		case "action": return n.name;
+		case "hookCode": return n.id;
+		case "hook": return n.hook_id;
 	}
 }
-async function H(e, t, n) {
+async function et(e, t, n = {}) {
+	let r = await N({
+		tenantId: t,
+		getTenant: (t) => e.tenants.get(t),
+		legacyControlPlane: n.legacyControlPlane,
+		maxDepth: n.maxDepth
+	}), i = Ze(await Promise.all(r.map((t) => I(e, t))), We()), a = {
+		version: 1,
+		chain: r,
+		connections: i.connections,
+		resourceServers: i.resourceServers,
+		hookCode: i.hookCode,
+		actions: i.actions,
+		hooks: i.hooks,
+		emailProvider: i.emailProvider,
+		branding: i.branding,
+		promptSettings: i.promptSettings,
+		hidden: i.hidden,
+		deletes: n.deletes ?? []
+	};
 	return {
-		connections: n.connections ? await f((n) => e.connections.list(t, n), "connections", {
-			cursorField: "id",
-			pageSize: 100
-		}) : [],
-		resourceServers: n.resourceServers ? await f((n) => e.resourceServers.list(t, n), "resource_servers", {
-			cursorField: "id",
-			pageSize: 100
-		}) : [],
-		hooks: n.hooks ? await f((n) => e.hooks.list(t, n), "hooks", {
-			cursorField: "hook_id",
-			pageSize: 100
-		}) : [],
-		emailProvider: n.emailProvider ? await e.emailProviders.get(t) ?? null : null,
-		branding: n.branding ? await e.branding.get(t) ?? null : null,
-		promptSettings: n.promptSettings ? await e.promptSettings.get(t) ?? null : null
+		...a,
+		hash: await Qe(U(a))
 	};
 }
-async function Be(e, t, n, r, i, a) {
-	if (r.connections) for (let r of e.connections) {
-		let e = r.id;
-		e && await V(a.connections, `connection ${e}`, i, async () => {
-			let i = o.parse(r);
-			await t.connections.get(n, e) ? await t.connections.update(n, e, i) : await t.connections.create(n, i), a.connections.upserted += 1;
+function tt(e, t) {
+	if (typeof e == "string") e.startsWith("enc:v1:") && t.add(e);
+	else if (Array.isArray(e)) for (let n of e) tt(n, t);
+	else if (e && typeof e == "object") for (let n of Object.values(e)) tt(n, t);
+}
+function nt(e) {
+	let t = e.slice(7), n = t.indexOf(":");
+	return n === -1 ? "default" : t.slice(0, n);
+}
+async function rt(e, t) {
+	let n = /* @__PURE__ */ new Set();
+	tt(e, n);
+	let r = /* @__PURE__ */ new Set();
+	for (let e of n) await s(e, t) || r.add(nt(e));
+	return [...r].sort();
+}
+var K = () => ({
+	added: 0,
+	changed: 0,
+	unchanged: 0,
+	deleted: 0,
+	errors: []
+}), it = (e) => U(e);
+async function at(e, t, n, r = {}) {
+	let { dryRun: a = !1, continueOnError: s = !0 } = r, l = {
+		status: a ? "dry-run" : "applied",
+		hash: e.hash,
+		entities: {
+			connection: K(),
+			resourceServer: K(),
+			hookCode: K(),
+			action: K(),
+			hook: K(),
+			emailProvider: K(),
+			branding: K(),
+			promptSettings: K()
+		},
+		changes: []
+	}, u = await t.tenants.get(n), d = !!r.deletes && e.deletes.length > 0;
+	if (!a && !r.force && !d && u?.config_sync_hash === e.hash) return {
+		...l,
+		status: "up-to-date"
+	};
+	if (r.keyRing) {
+		let t = await rt(e, r.keyRing);
+		if (t.length > 0) throw Error(`Cannot sync config to '${n}': its key ring cannot decrypt key id(s) ${t.map((e) => `"${e}"`).join(", ")} carried by the payload. Nothing was written.`);
+	}
+	let p = async (e, t, n) => {
+		let r = l.entities[e];
+		try {
+			let i = await n();
+			r[i] += 1, i !== "unchanged" && l.changes.push(`${e}:${t}`);
+		} catch (n) {
+			let i = `${e} ${t}: ${n instanceof Error ? n.message : String(n)}`;
+			if (!s) throw Error(i, { cause: n });
+			r.errors.push(i);
+		}
+	}, m = async (e) => e.existing ? it(e.view(e.existing)) === it(e.view(e.desired)) ? "unchanged" : (a || await e.update(), "changed") : (a || await e.create(), "added"), _ = (e, t) => W(e, n, t), v = /* @__PURE__ */ new Map();
+	for (let t of e.hookCode) v.set(t.id, await _("hookCode", G("hookCode", t)));
+	for (let t of e.actions) v.set(t.id, await _("action", G("action", t)));
+	for (let r of e.connections) {
+		let e = G("connection", r), i = await _("connection", e);
+		await p("connection", e, async () => {
+			let { enabled_clients: e, ...a } = r, o = c.parse({
+				...a,
+				id: i
+			}), s = await t.connections.get(n, i);
+			return m({
+				existing: s ? c.parse(s) : null,
+				desired: o,
+				create: () => t.connections.create(n, o),
+				update: () => t.connections.update(n, i, o),
+				view: (e) => e
+			});
 		});
 	}
-	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await V(a.resourceServers, `resource_server ${r.id}`, i, async () => {
-		let e = y.parse(r);
-		await t.resourceServers.get(n, r.id) ? await t.resourceServers.update(n, r.id, e) : await t.resourceServers.create(n, e), a.resourceServers.upserted += 1;
-	});
-	if (r.hooks) for (let r of e.hooks) !ze(r) || !r.hook_id || await V(a.hooks, `hook ${r.hook_id}`, i, async () => {
-		let e = p.parse(r);
-		await t.hooks.get(n, r.hook_id) ? await t.hooks.update(n, r.hook_id, e) : await t.hooks.create(n, e), a.hooks.upserted += 1;
-	});
-	r.emailProvider && e.emailProvider && await V(a.emailProvider, "email_provider", i, async () => {
-		let r = e.emailProvider;
-		await t.emailProviders.get(n) ? await t.emailProviders.update(n, r) : await t.emailProviders.create(n, r), a.emailProvider.upserted += 1;
-	}), r.branding && e.branding && await V(a.branding, "branding", i, async () => {
-		await t.branding.set(n, e.branding), a.branding.upserted += 1;
-	}), r.promptSettings && e.promptSettings && await V(a.promptSettings, "prompt_settings", i, async () => {
-		await t.promptSettings.set(n, e.promptSettings), a.promptSettings.upserted += 1;
+	for (let r of e.resourceServers) {
+		let e = G("resourceServer", r), i = await _("resourceServer", e);
+		await p("resourceServer", e, async () => {
+			let e = x.parse({
+				...r,
+				id: i
+			}), a = await t.resourceServers.get(n, i);
+			return m({
+				existing: a ? x.parse(a) : null,
+				desired: e,
+				create: () => t.resourceServers.create(n, e),
+				update: () => t.resourceServers.update(n, i, e),
+				view: (e) => e
+			});
+		});
+	}
+	for (let r of e.hookCode) {
+		let e = G("hookCode", r), i = v.get(r.id);
+		await p("hookCode", e, async () => {
+			let e = h.parse(r), a = await t.hookCode.get(n, i);
+			return m({
+				existing: a ? h.parse(a) : null,
+				desired: e,
+				create: () => t.hookCode.create(n, e, { importMetadata: { id: i } }),
+				update: () => t.hookCode.update(n, i, e),
+				view: (e) => e
+			});
+		});
+	}
+	for (let r of e.actions) {
+		let e = G("action", r), a = v.get(r.id);
+		await p("action", e, async () => {
+			let e = i.parse(r), o = await t.actions.get(n, a);
+			return m({
+				existing: o ? i.parse(o) : null,
+				desired: e,
+				create: () => t.actions.create(n, e, { importMetadata: { id: a } }),
+				update: () => t.actions.update(n, a, e),
+				view: (e) => e
+			});
+		});
+	}
+	for (let r of e.hooks) {
+		let e = G("hook", r), i = await _("hook", e);
+		await p("hook", e, async () => {
+			let e = r.code_id, a = g.parse({
+				...r,
+				hook_id: i,
+				...e ? { code_id: v.get(e) ?? e } : {}
+			}), o = await t.hooks.get(n, i);
+			return m({
+				existing: o ? g.parse(o) : null,
+				desired: a,
+				create: () => t.hooks.create(n, a),
+				update: () => t.hooks.update(n, i, a),
+				view: (e) => e
+			});
+		});
+	}
+	e.emailProvider && await p("emailProvider", "singleton", async () => {
+		let r = f.parse(e.emailProvider);
+		return await t.emailProviders.get(n) ? "unchanged" : (a || await t.emailProviders.create(n, r), "added");
+	}), e.branding && await p("branding", "singleton", async () => {
+		let r = o.parse(e.branding);
+		return await t.branding.get(n) ? "unchanged" : (a || await t.branding.set(n, r), "added");
 	});
+	for (let i of e.deletes) {
+		let e = await _(i.entity, i.key), o = `${i.entity}:${i.key}`;
+		try {
+			if (!await ot(t, n, i.entity, e)) continue;
+			l.changes.push(`delete ${o}`), r.deletes && !a && (await st(t, n, i.entity, e), l.entities[i.entity].deleted += 1);
+		} catch (e) {
+			l.entities[i.entity].errors.push(`delete ${o}: ${e instanceof Error ? e.message : e}`);
+		}
+	}
+	let y = Object.values(l.entities).some((e) => e.errors.length > 0);
+	return !a && !y && u && await t.tenants.update(n, {
+		config_sync_hash: e.hash,
+		config_synced_at: (/* @__PURE__ */ new Date()).toISOString()
+	}), l;
+}
+async function ot(e, t, n, r) {
+	switch (n) {
+		case "connection": return !!await e.connections.get(t, r);
+		case "resourceServer": return !!await e.resourceServers.get(t, r);
+		case "hookCode": return !!await e.hookCode.get(t, r);
+		case "action": return !!await e.actions.get(t, r);
+		case "hook": return !!await e.hooks.get(t, r);
+	}
 }
-async function U(e, t) {
-	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = z(a), c = await H(await r(), n, s), l = await i(t), u = Re(t);
-	return await Be(c, l, n, s, o, u), u;
+async function st(e, t, n, r) {
+	switch (n) {
+		case "connection":
+			await e.connections.remove(t, r);
+			return;
+		case "resourceServer":
+			await e.resourceServers.remove(t, r);
+			return;
+		case "hookCode":
+			await e.hookCode.remove(t, r);
+			return;
+		case "action":
+			await e.actions.remove(t, r);
+			return;
+		case "hook":
+			await e.hooks.remove(t, r);
+			return;
+	}
 }
 //#endregion
-//#region src/inheritance/read.ts
-async function W(e, t) {
-	let n = await H(e, t, {
-		connections: !0,
-		resourceServers: !0,
-		hooks: !0,
-		emailProvider: !0,
-		branding: !0,
-		promptSettings: !0
-	}), r = await f((n) => e.actions.list(t, n), "actions", {
-		cursorField: "id",
-		pageSize: 100
-	});
+//#region src/operations/sync-defaults.ts
+function ct(e) {
+	let t = e.input ?? {};
 	return {
-		...n,
-		actions: r
+		dryRun: t.dry_run === !0,
+		force: t.force === !0
 	};
 }
-//#endregion
-//#region src/inheritance/shadow.ts
-var Ve = /secret|password|private_key|api_key|token/i, He = new Set([
-	"id",
-	"tenant_id",
-	"created_at",
-	"updated_at",
-	"scope",
-	"override",
-	"enforce",
-	"enabled_clients"
-]);
-async function G(e) {
-	let t = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
-	return [...new Uint8Array(t)].map((e) => e.toString(16).padStart(2, "0")).join("").slice(0, 16);
+function lt(e) {
+	return Object.values(e.entities).flatMap((e) => e.errors);
 }
-async function K(e, t = "") {
-	if (Array.isArray(e)) {
-		if (t === "secrets") {
-			let t = {};
-			for (let n of e) t[n.name] = n.value === void 0 ? null : `sha256:${await G(n.value)}`;
-			return t;
-		}
-		return Promise.all(e.map((e) => K(e, t)));
-	}
-	if (e && typeof e == "object") {
-		let t = {};
-		for (let n of Object.keys(e).sort()) {
-			let r = e[n];
-			r != null && (t[n] = typeof r == "string" && Ve.test(n) ? `sha256:${await G(r)}` : await K(r, n));
-		}
-		return t;
+function ut(e, t) {
+	return {
+		dry_run: t.dryRun,
+		status: e.status,
+		hash: e.hash,
+		changes: e.changes,
+		entities: Object.fromEntries(Object.entries(e.entities).map(([e, t]) => [e, {
+			added: t.added,
+			changed: t.changed,
+			unchanged: t.unchanged,
+			deleted: t.deleted,
+			errors: t.errors.length
+		}]))
+	};
+}
+async function dt(e) {
+	let { operation: t, syncConfig: n, recorder: r } = e;
+	if (!t.tenant_id) throw Error("sync-defaults operations require a tenant_id");
+	let i = ct(t), a = await n(t.tenant_id, i), o = ut(a, i);
+	await r.setResult(t.id, o);
+	let s = lt(a);
+	if (s.length > 0) {
+		let e = s.slice(0, 3).join("; ");
+		throw Error(`sync-defaults reported ${s.length} error(s): ${e}${s.length > 3 ? "; ..." : ""}`);
 	}
-	return e;
+	return o;
 }
-async function Ue(e) {
-	let t = {};
-	for (let [n, r] of Object.entries(e)) He.has(n) || (t[n] = r);
-	return await K(t);
+function ft(e, t) {
+	return async (n, r) => {
+		let i = await e.tenants.get(n);
+		if (!i) throw Error(`Tenant "${n}" not found`);
+		if (i.deployment_type === "wfp") throw Error(`Tenant "${n}" has its own database: configure a dispatch sync (syncDefaults) for it`);
+		return at(await et(e, n, {
+			legacyControlPlane: (t.resolveControlPlane ? await t.resolveControlPlane({ tenant_id: n }) : { tenantId: t.controlPlaneTenantId })?.tenantId,
+			maxDepth: t.maxDepth
+		}), e, n, {
+			dryRun: r.dryRun,
+			force: r.force
+		});
+	};
 }
-var We = {
-	connection: (e) => `${e.strategy}:${e.name}`,
-	resourceServer: (e) => e.identifier,
-	hook: (e) => e.hook_id,
-	action: (e) => e.name
-}, Ge = new Set([
-	"connection",
-	"resourceServer",
-	"action",
-	"emailProvider",
-	"branding",
-	"promptSettings"
-]);
-async function Ke(e) {
-	let t = /* @__PURE__ */ new Map(), n = async (e, n, r) => {
-		let i = t.get(e) ?? /* @__PURE__ */ new Map();
-		i.set(n, await Ue(r)), t.set(e, i);
+//#endregion
+//#region src/operations/record-provision.ts
+function pt(e) {
+	if (e.tenantOperations && e.tenantOperationEvents) return {
+		tenantOperations: e.tenantOperations,
+		tenantOperationEvents: e.tenantOperationEvents
 	};
-	for (let [t, r] of Object.entries(We)) {
-		let i = e[{
-			connection: "connections",
-			resourceServer: "resourceServers",
-			hook: "hooks",
-			action: "actions"
-		}[t]];
-		for (let e of i) await n(t, r(e), e);
-	}
-	for (let t of [
-		"emailProvider",
-		"branding",
-		"promptSettings"
-	]) e[t] && await n(t, "singleton", e[t]);
-	return t;
 }
-async function qe(e, t) {
-	let [n, r] = await Promise.all([Ke(e), Ke(t)]), i = [], a = new Set([...n.keys(), ...r.keys()]);
-	for (let e of a) {
-		let t = n.get(e) ?? /* @__PURE__ */ new Map(), a = r.get(e) ?? /* @__PURE__ */ new Map();
-		for (let n of new Set([...t.keys(), ...a.keys()])) {
-			let r = t.get(n), o = a.get(n);
-			if (r && !o) i.push({
-				entity: e,
-				key: n,
-				kind: "missing",
-				fields: [],
-				expected: !1
-			});
-			else if (!r && o) i.push({
-				entity: e,
-				key: n,
-				kind: "extra",
-				fields: [],
-				expected: Ge.has(e)
-			});
-			else if (r && o) {
-				let t = JSON.stringify(r), a = JSON.stringify(o);
-				if (t === a) continue;
-				let s = [...new Set([...Object.keys(r), ...Object.keys(o)])].filter((e) => JSON.stringify(r[e]) !== JSON.stringify(o[e])).sort();
-				i.push({
-					entity: e,
-					key: n,
-					kind: "changed",
-					fields: s,
-					expected: !1,
-					legacy_hash: await G(t),
-					new_hash: await G(a)
-				});
-			}
-		}
+async function mt(e, t, n) {
+	let r = pt(e);
+	if (!r) {
+		await n(void 0);
+		return;
 	}
-	return i;
-}
-async function Je(e) {
-	let { adapters: t, tenantId: n, legacyControlPlane: r } = e, i = await De({
-		tenantId: n,
-		getTenant: (e) => t.tenants.get(e),
-		legacyControlPlane: r,
-		maxDepth: e.maxDepth
-	}), a = await W(t, n), o = await Promise.all(i.map((e) => W(t, e))), s = r && r !== n ? await W(t, r) : void 0, { hidden: c, ...l } = Le(o, a), u = new Set(c);
-	return (await qe(Ae(a, s), l)).filter((e) => !u.has(`${e.entity}:${e.key}`));
-}
-//#endregion
-//#region src/inheritance/report.ts
-var Ye = 3600 * 1e3, Xe = 1e4;
-function Ze(e, t) {
-	let n = t.sample ?? 1, r = t.intervalMs ?? 6e4, i = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Set(), o = /* @__PURE__ */ new Map();
-	async function s(n, r) {
-		let i = await Je({
-			adapters: e,
-			tenantId: n,
-			legacyControlPlane: r
-		}), a = Date.now();
-		o.size > Xe && o.clear();
-		for (let s of i) {
-			if (s.expected && !t.includeExpected) continue;
-			let i = await G([
-				n,
-				s.entity,
-				s.key,
-				s.kind,
-				s.fields.join(",")
-			].join("|")), c = o.get(i);
-			c !== void 0 && a - c < Ye || (o.set(i, a), await Qe(e, n, s, r));
+	let i = A(r), a = async (e) => {
+		try {
+			await e();
+		} catch (e) {
+			console.warn("Failed to record tenant operation progress:", e);
 		}
+	}, o;
+	if (await a(async () => {
+		let e = await M(r, t, "inline");
+		o = e.id, await i.markRunning(e.id);
+	}), !o) {
+		await n(void 0);
+		return;
 	}
-	return { schedule(e, t) {
-		if (a.has(e) || n < 1 && Math.random() >= n) return;
-		let o = Date.now(), c = i.get(e);
-		c !== void 0 && o - c < r || (i.set(e, o), a.add(e), s(e, t).catch(() => {}).finally(() => a.delete(e)));
-	} };
-}
-async function Qe(e, n, r, i) {
-	await e.logs.create(n, {
-		type: t.CONFIG_INHERITANCE_DIFF,
-		date: (/* @__PURE__ */ new Date()).toISOString(),
-		isMobile: !1,
-		description: `${r.kind} ${r.entity} ${r.key}`,
-		details: {
-			shadow: "config-inheritance",
-			legacy_control_plane: i,
-			...r
-		}
+	let s = o, c = !1, l = async (e, t, n) => {
+		c = !0, await a(async () => {
+			t === "started" && await i.setCurrentStep(s, e), await i.appendEvent(s, {
+				step: e,
+				outcome: t,
+				detail: n
+			});
+		});
+	};
+	try {
+		await n(l);
+	} catch (e) {
+		throw await a(async () => {
+			c || await i.appendEvent(s, {
+				step: t.kind,
+				outcome: "failed",
+				detail: { message: se(e) }
+			}), await i.markFailed(s, e);
+		}), e;
+	}
+	await a(async () => {
+		c || await i.appendEvent(s, {
+			step: t.kind,
+			outcome: "succeeded"
+		}), await i.markSucceeded(s);
 	});
 }
 //#endregion
-//#region src/middleware/settings-inheritance.ts
-function q(e, t) {
-	let n = t.find((t) => t.strategy === e.strategy);
-	if (!n?.options) return e;
-	let r = c.passthrough().parse({
-		...n,
-		...e
-	});
-	return r.options = s.passthrough().parse({
-		...n.options || {},
-		...e.options
-	}), r;
-}
-function J(e, t) {
-	let n = [...t || [], ...e || []];
-	return [...new Set(n)];
+//#region src/hooks/provisioning.ts
+function ht(e) {
+	return `urn:authhero:tenant:${e.toLowerCase()}`;
 }
-function $e(e, t) {
-	if (!t?.length) return e || [];
-	if (!e?.length) return t;
-	let n = /* @__PURE__ */ new Map();
-	for (let e of t) n.set(e.value, e);
-	for (let t of e) n.set(t.value, t);
-	return Array.from(n.values());
+function gt(e) {
+	return {
+		async beforeCreate(e, t) {
+			return !t.audience && t.id ? {
+				...t,
+				audience: ht(t.id)
+			} : t;
+		},
+		async afterCreate(t, i) {
+			let { accessControl: a, databaseIsolation: o } = e;
+			if (a && t.ctx && await _t(t, i, a), o?.onProvision) {
+				let e = o.onProvision;
+				o.recordProvisionOperations === !1 ? await e(i.id) : await mt(t.adapters, {
+					kind: "provision",
+					tenant_id: i.id,
+					initiated_by: t.ctx?.var.user?.sub
+				}, (t) => e(i.id, t));
+			} else try {
+				await te(t.adapters, i.id, {
+					managementApiIdentifier: n,
+					managementApiScopes: r
+				});
+			} catch (e) {
+				throw console.warn(`Failed to provision default clients for tenant ${i.id}:`, e), e;
+			}
+		},
+		async beforeDelete(t, n) {
+			let { accessControl: r, databaseIsolation: i } = e;
+			if (r) try {
+				let e = (await t.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find((e) => e.name === n);
+				e && await t.adapters.organizations.remove(r.controlPlaneTenantId, e.id);
+			} catch (e) {
+				console.warn(`Failed to remove organization for tenant ${n}:`, e);
+			}
+			if (i?.onDeprovision) try {
+				await i.onDeprovision(n);
+			} catch (e) {
+				console.warn(`Failed to deprovision database for tenant ${n}:`, e);
+			}
+		}
+	};
 }
-function Y(e, t) {
-	return t ? {
-		...e,
-		scopes: $e(e.scopes, t.scopes)
-	} : e;
+async function _t(e, t, n) {
+	let { controlPlaneTenantId: r, defaultPermissions: i, defaultRoles: a, issuer: o, adminRoleName: s = "Tenant Admin", adminRoleDescription: c = "Full access to all tenant management operations", addCreatorToOrganization: l = !0 } = n, u = await e.adapters.organizations.create(r, {
+		name: t.id,
+		display_name: t.friendly_name || t.id
+	}), d;
+	if (o && (d = await yt(e, r, s, c)), l && e.ctx) {
+		let t = e.ctx.var.user;
+		if (t?.sub && !await vt(e, r, t.sub)) try {
+			await e.adapters.userOrganizations.create(r, {
+				user_id: t.sub,
+				organization_id: u.id
+			}), d && await e.adapters.userRoles.create(r, t.sub, d, u.id);
+		} catch (e) {
+			console.warn(`Failed to add creator ${t.sub} to organization ${u.id}:`, e);
+		}
+	}
+	a && a.length > 0 && console.log(`Would assign roles ${a.join(", ")} to organization ${u.id}`), i && i.length > 0 && console.log(`Would grant permissions ${i.join(", ")} to organization ${u.id}`);
 }
-function et(e, t) {
-	return t ? {
-		...e,
-		callbacks: J(e.callbacks, t.callbacks),
-		web_origins: J(e.web_origins, t.web_origins),
-		allowed_logout_urls: J(e.allowed_logout_urls, t.allowed_logout_urls),
-		allowed_origins: J(e.allowed_origins, t.allowed_origins)
-	} : e;
+async function vt(e, t, r) {
+	let i = await e.adapters.userRoles.list(t, r, void 0, "");
+	for (let r of i) if ((await e.adapters.rolePermissions.list(t, r.id, { per_page: 1e3 })).some((e) => e.permission_name === "admin:organizations" && e.resource_server_identifier === n)) return !0;
+	return !1;
 }
-function tt(e) {
-	let { controlPlaneTenantId: t, controlPlaneClientId: n, resolveControlPlane: r } = e;
-	if (r) return async (e) => r({ tenant_id: e });
-	if (!t) return async () => void 0;
-	let i = {
-		tenantId: t,
-		clientId: n
-	};
-	return async () => i;
+async function yt(e, t, i, a) {
+	let o = (await e.adapters.roles.list(t, {})).roles.find((e) => e.name === i);
+	if (o) return o.id;
+	let s = await e.adapters.roles.create(t, {
+		name: i,
+		description: a
+	}), c = n, l = r.map((e) => ({
+		role_id: s.id,
+		resource_server_identifier: c,
+		permission_name: e.value
+	}));
+	return await e.adapters.rolePermissions.assign(t, s.id, l), s.id;
 }
-function nt(e, t) {
-	return {
-		...e.resourceServers,
-		get: async (n, r) => {
-			let i = await e.resourceServers.get(n, r);
-			if (!i) return i;
-			let a = await t(n);
-			return !a || n === a.tenantId || !i.is_system ? i : Y(i, await e.resourceServers.get(a.tenantId, r));
-		},
-		list: async (n, r) => {
-			let i = await e.resourceServers.list(n, r), a = await t(n);
-			if (!a || n === a.tenantId) return i;
-			let o = a.tenantId, s = i.resource_servers.filter((e) => !!(e.is_system && e.id)).map((e) => e.id);
-			if (s.length === 0) return i;
-			let c = /* @__PURE__ */ new Map();
-			await Promise.all(s.map(async (t) => {
-				let n = await e.resourceServers.get(o, t);
-				n && c.set(t, n);
-			}));
-			let l = i.resource_servers.map((e) => e.is_system && e.id ? Y(e, c.get(e.id) ?? null) : e);
-			return {
-				...i,
-				resource_servers: l
-			};
+//#endregion
+//#region src/hooks/sync.ts
+function bt(e, t, n = () => !0) {
+	let { controlPlaneTenantId: r, getChildTenantIds: i, getAdapters: a } = e, o = /* @__PURE__ */ new Map();
+	async function s(e, n, r) {
+		return (await t(e).list(n, {
+			q: `name:${p(r)}`,
+			per_page: 1
+		}))[0] ?? null;
+	}
+	async function c(e) {
+		let n = await i(), o = t(await a(r));
+		await Promise.all(n.map(async (n) => {
+			try {
+				let r = await a(n), i = t(r), c = {
+					...o.transform(e),
+					is_system: !0
+				}, l = await s(r, n, e.name), u = l ? i.getId(l) : void 0;
+				if (l && u) {
+					let e = i.preserveOnUpdate ? i.preserveOnUpdate(l, c) : c;
+					await i.update(n, u, e);
+				} else await i.create(n, c);
+			} catch (t) {
+				console.error(`Failed to sync ${o.listKey} "${e.name}" to tenant "${n}":`, t);
+			}
+		}));
+	}
+	async function l(e) {
+		let n = await i();
+		await Promise.all(n.map(async (n) => {
+			try {
+				let r = await a(n), i = t(r), o = await s(r, n, e), c = o ? i.getId(o) : void 0;
+				o && c && await i.remove(n, c);
+			} catch (t) {
+				console.error(`Failed to delete entity "${e}" from tenant "${n}":`, t);
+			}
+		}));
+	}
+	return {
+		afterCreate: async (e, t) => {
+			e.tenantId === r && n(t) && await c(t);
+		},
+		afterUpdate: async (e, t, i) => {
+			e.tenantId === r && n(i) && await c(i);
+		},
+		beforeDelete: async (e, i) => {
+			if (e.tenantId !== r) return;
+			let a = await t(e.adapters).get(e.tenantId, i);
+			a && n(a) && o.set(i, a);
+		},
+		afterDelete: async (e, t) => {
+			if (e.tenantId !== r) return;
+			let n = o.get(t);
+			n && (o.delete(t), await l(n.name));
+		}
+	};
+}
+function xt(e, t, n = () => !0) {
+	let { controlPlaneTenantId: r, getControlPlaneAdapters: i, getAdapters: a } = e;
+	return { async afterCreate(e, o) {
+		if (o.id !== r) try {
+			let e = await i(), s = await a(o.id), c = t(e), l = t(s), u = await m((e) => c.listPaginated(r, e), c.listKey, {
+				cursorField: "id",
+				pageSize: 100
+			});
+			await Promise.all(u.filter((e) => n(e)).map(async (e) => {
+				try {
+					let t = c.transform(e);
+					await l.create(o.id, {
+						...t,
+						is_system: !0
+					});
+				} catch (e) {
+					console.error(`Failed to sync entity to new tenant "${o.id}":`, e);
+				}
+			}));
+		} catch (e) {
+			console.error(`Failed to sync entities to new tenant "${o.id}":`, e);
+		}
+	} };
+}
+var St = (e) => ({
+	list: async (t, n) => (await e.resourceServers.list(t, n)).resource_servers,
+	listPaginated: (t, n) => e.resourceServers.list(t, n),
+	get: (t, n) => e.resourceServers.get(t, n),
+	create: (t, n) => e.resourceServers.create(t, n),
+	update: (t, n, r) => e.resourceServers.update(t, n, r),
+	remove: (t, n) => e.resourceServers.remove(t, n),
+	listKey: "resource_servers",
+	getId: (e) => e.id,
+	transform: (e) => ({
+		id: e.id,
+		name: e.name,
+		identifier: e.identifier,
+		scopes: e.scopes,
+		signing_alg: e.signing_alg,
+		token_lifetime: e.token_lifetime,
+		token_lifetime_for_web: e.token_lifetime_for_web
+	})
+}), Ct = (e) => ({
+	list: async (t, n) => (await e.roles.list(t, n)).roles,
+	listPaginated: (t, n) => e.roles.list(t, n),
+	get: (t, n) => e.roles.get(t, n),
+	create: (t, n) => e.roles.create(t, n),
+	update: (t, n, r) => e.roles.update(t, n, r),
+	remove: (t, n) => e.roles.remove(t, n),
+	listKey: "roles",
+	getId: (e) => e.id,
+	transform: (e) => ({
+		id: e.id,
+		name: e.name,
+		description: e.description
+	})
+});
+function wt(e) {
+	return e.metadata?.sync !== !1;
+}
+function Tt(e) {
+	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => wt(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => wt(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? bt(e, St, a) : void 0, c = i ? bt(e, Ct, o) : void 0, l = r ? xt(e, St, a) : void 0, u = i ? xt(e, Ct, o) : void 0, d = i ? { async afterCreate(t, r) {
+		if (r.id !== e.controlPlaneTenantId) {
+			await u?.afterCreate?.(t, r);
+			try {
+				let t = await e.getControlPlaneAdapters(), i = await e.getAdapters(r.id), a = await m((n) => t.roles.list(e.controlPlaneTenantId, n), "roles", {
+					cursorField: "id",
+					pageSize: 100
+				}), o = /* @__PURE__ */ new Map();
+				for (let e of a.filter((e) => n.roles?.(e) ?? !0)) {
+					let t = await f(i, r.id, e.name);
+					t && o.set(e.name, t.id);
+				}
+				for (let s of a.filter((e) => n.roles?.(e) ?? !0)) {
+					let n = o.get(s.name);
+					if (n) try {
+						let a = await t.rolePermissions.list(e.controlPlaneTenantId, s.id, {});
+						a.length > 0 && await i.rolePermissions.assign(r.id, n, a.map((e) => ({
+							role_id: n,
+							resource_server_identifier: e.resource_server_identifier,
+							permission_name: e.permission_name
+						})));
+					} catch (e) {
+						console.error(`Failed to sync permissions for role "${s.name}" to tenant "${r.id}":`, e);
+					}
+				}
+			} catch (e) {
+				console.error(`Failed to sync role permissions to tenant "${r.id}":`, e);
+			}
+		}
+	} } : void 0;
+	async function f(e, t, n) {
+		return (await e.roles.list(t, {
+			q: `name:${p(n)}`,
+			per_page: 1
+		})).roles[0] ?? null;
+	}
+	return {
+		entityHooks: {
+			resourceServers: s,
+			roles: c
+		},
+		tenantHooks: { async afterCreate(e, t) {
+			let n = [l?.afterCreate, d?.afterCreate ?? u?.afterCreate], r = [];
+			for (let i of n) if (i) try {
+				await i(e, t);
+			} catch (e) {
+				r.push(e instanceof Error ? e : Error(String(e)));
+			}
+			if (r.length === 1) throw r[0];
+			if (r.length > 1) throw AggregateError(r, r.map((e) => e.message).join("; "));
+		} }
+	};
+}
+//#endregion
+//#region src/middleware/request-data.ts
+function q(e) {
+	return e.var.data ?? e.env.data;
+}
+//#endregion
+//#region src/routes/tenants.ts
+var Et = D.object({
+	sub: D.string(),
+	tenant_id: D.string().optional(),
+	org_id: D.string().optional(),
+	scope: D.string().optional(),
+	permissions: D.array(D.string()).optional()
+}).passthrough();
+function Dt(e) {
+	let t = Et.safeParse(e);
+	return t.success ? t.data : void 0;
+}
+function Ot(e, t, n) {
+	return t ? !e || n ? !1 : e.tenant_id === t : !0;
+}
+function kt(e) {
+	let t = e.permissions ?? [], n = e.scope ? e.scope.split(" ").filter(Boolean) : [], r = new Set([...t, ...n]);
+	return r.has("delete:tenants") || r.has("admin:organizations");
+}
+function At(e, t) {
+	let n = new T(), r = (t) => {
+		let n = Dt(t.var.user);
+		return Ot(n, e.accessControl?.controlPlaneTenantId ?? q(t).multiTenancyConfig?.controlPlaneTenantId, !!(n?.org_id ?? t.var.organization_id ?? t.var.org_name));
+	};
+	if (n.openapi(E({
+		tags: ["tenants"],
+		method: "get",
+		path: "/",
+		request: { query: a },
+		security: [{ Bearer: [] }],
+		responses: { 200: {
+			content: { "application/json": { schema: D.object({
+				tenants: D.array(C),
+				start: D.number().optional(),
+				limit: D.number().optional(),
+				length: D.number().optional(),
+				total: D.number().optional()
+			}) } },
+			description: "List of tenants"
+		} }
+	}), async (t) => {
+		let { page: n, per_page: r, include_totals: i, q: a } = t.req.valid("query"), o = t.var.user, s = o?.permissions || [];
+		if (!(o?.org_id ?? t.var.organization_id) && s.includes("admin:organizations")) {
+			let e = await q(t).tenants.list({
+				page: n,
+				per_page: r,
+				include_totals: i,
+				q: a
+			});
+			return i ? t.json({
+				tenants: e.tenants,
+				start: e.totals?.start ?? 0,
+				limit: e.totals?.limit ?? r,
+				length: e.tenants.length,
+				total: e.totals?.length
+			}) : t.json({ tenants: e.tenants });
+		}
+		let c = e.accessControl?.controlPlaneTenantId ?? q(t).multiTenancyConfig?.controlPlaneTenantId;
+		if (c && !o?.sub) throw new w(403, { message: "Access denied: token has no subject" });
+		if (c && o?.sub) {
+			let e = (await m((e) => q(t).userOrganizations.listUserOrganizations(c, o.sub, e), "organizations")).map((e) => e.name);
+			if (e.length === 0) return i ? t.json({
+				tenants: [],
+				start: 0,
+				limit: r ?? 50,
+				length: 0,
+				total: 0
+			}) : t.json({ tenants: [] });
+			let s = e.length, l = n ?? 0, u = r ?? 50, d = l * u, f = e.slice(d, d + u);
+			if (f.length === 0) return i ? t.json({
+				tenants: [],
+				start: d,
+				limit: u,
+				length: 0,
+				total: s
+			}) : t.json({ tenants: [] });
+			let p = f.map((e) => `id:${e}`).join(" OR "), h = a ? `(${p}) AND (${a})` : p, g = await q(t).tenants.list({
+				q: h,
+				per_page: u,
+				include_totals: !1
+			});
+			return i ? t.json({
+				tenants: g.tenants,
+				start: d,
+				limit: u,
+				length: g.tenants.length,
+				total: s
+			}) : t.json({ tenants: g.tenants });
+		}
+		let l = await q(t).tenants.list({
+			page: n,
+			per_page: r,
+			include_totals: i,
+			q: a
+		});
+		return i ? t.json({
+			tenants: l.tenants,
+			start: l.totals?.start ?? 0,
+			limit: l.totals?.limit ?? r,
+			length: l.tenants.length,
+			total: l.totals?.length
+		}) : t.json({ tenants: l.tenants });
+	}), n.openapi(E({
+		tags: ["tenants"],
+		method: "post",
+		path: "/",
+		request: { body: { content: { "application/json": { schema: S } } } },
+		security: [{ Bearer: [] }],
+		responses: {
+			201: {
+				content: { "application/json": { schema: C } },
+				description: "Tenant created"
+			},
+			400: { description: "Validation error" },
+			409: { description: "Tenant with this ID already exists" }
+		}
+	}), async (n) => {
+		if (!n.var.user?.sub) throw new w(401, { message: "Authentication required to create tenants" });
+		let { config_sync_hash: i, config_synced_at: a, config_sync: o, ...s } = n.req.valid("json"), c = s;
+		if (c.parent_tenant_id && !r(n)) throw new w(403, { message: "Only the control plane can set a tenant's parent" });
+		o !== void 0 && r(n) && (c = {
+			...c,
+			config_sync: o
+		});
+		let l = {
+			adapters: q(n),
+			ctx: n
+		};
+		t.tenants?.beforeCreate && (c = await t.tenants.beforeCreate(l, c)), await de({
+			tenantId: c.id,
+			parentTenantId: c.parent_tenant_id,
+			getTenant: (e) => q(n).tenants.get(e)
+		});
+		let u = await q(n).tenants.create(c);
+		return t.tenants?.afterCreate && await t.tenants.afterCreate(l, u), e.onConfigSyncChange?.(u.id), n.json(u, 201);
+	}), n.openapi(E({
+		tags: ["tenants"],
+		method: "delete",
+		path: "/{id}",
+		request: { params: D.object({ id: D.string() }) },
+		security: [{ Bearer: ["delete:tenants"] }],
+		responses: {
+			204: { description: "Tenant deleted" },
+			403: { description: "Access denied or cannot delete the control plane" },
+			404: { description: "Tenant not found" }
+		}
+	}), async (n) => {
+		let { id: r } = n.req.valid("param"), i = e.accessControl?.controlPlaneTenantId ?? q(n).multiTenancyConfig?.controlPlaneTenantId;
+		if (i) {
+			let e = Dt(n.var.user);
+			if (!e?.sub) throw new w(401, { message: "Authentication required" });
+			if (r === i) throw new w(403, { message: "Cannot delete the control plane" });
+			let t = n.var.org_name, a = r.toLowerCase(), o = !!t && t.toLowerCase() === a;
+			if (!o) {
+				let r = !!(e.org_id ?? n.var.organization_id ?? t), a = !e.tenant_id || e.tenant_id === i;
+				!r && a && kt(e) && (o = !0);
+			}
+			if (o ||= (await m((t) => q(n).userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new w(403, { message: "Access denied to this tenant" });
+		}
+		if (!await q(n).tenants.get(r)) throw new w(404, { message: "Tenant not found" });
+		let a = {
+			adapters: q(n),
+			ctx: n
+		};
+		return t.tenants?.beforeDelete && await t.tenants.beforeDelete(a, r), await q(n).tenants.remove(r), t.tenants?.afterDelete && await t.tenants.afterDelete(a, r), n.body(null, 204);
+	}), e.configSyncStatus) {
+		let t = e.configSyncStatus;
+		n.openapi(E({
+			tags: ["tenants"],
+			method: "get",
+			path: "/{id}/config-sync",
+			request: { params: D.object({ id: D.string() }) },
+			security: [{ Bearer: ["read:tenants"] }],
+			responses: {
+				200: {
+					content: { "application/json": { schema: D.object({
+						tenant_id: D.string(),
+						parent_tenant_id: D.string().nullable(),
+						config_sync: D.enum(["inherit-on-read", "synced"]),
+						config_sync_hash: D.string().nullable(),
+						config_synced_at: D.string().nullable(),
+						expected_hash: D.string().nullable(),
+						drifted: D.boolean(),
+						chain: D.array(D.string()),
+						inherited: D.record(D.string(), D.string())
+					}) } },
+					description: "Config sync status of the tenant"
+				},
+				403: { description: "Not allowed to read this tenant" },
+				404: { description: "Tenant not found" }
+			}
+		}), async (e) => {
+			let { id: n } = e.req.valid("param");
+			if (n !== e.var.tenant_id && !r(e)) throw new w(403, { message: "Config sync status is only readable for your own tenant" });
+			let i = await t(n);
+			if (!i) throw new w(404, { message: "Tenant not found" });
+			return e.json(i);
+		});
+	}
+	return n.openapi(E({
+		tags: ["tenants", "settings"],
+		method: "get",
+		path: "/settings",
+		request: { headers: D.object({ "tenant-id": D.string().optional() }) },
+		security: [{ Bearer: ["read:tenants"] }],
+		responses: { 200: {
+			content: { "application/json": { schema: C } },
+			description: "Current tenant settings"
+		} }
+	}), async (e) => {
+		let t = await q(e).tenants.get(e.var.tenant_id);
+		if (!t) throw new w(404, { message: "Tenant not found" });
+		return e.json(t);
+	}), n.openapi(E({
+		tags: ["tenants", "settings"],
+		method: "patch",
+		path: "/settings",
+		request: {
+			headers: D.object({ "tenant-id": D.string().optional() }),
+			body: { content: { "application/json": { schema: D.object(S.shape).partial() } } }
+		},
+		security: [{ Bearer: ["update:tenants"] }],
+		responses: { 200: {
+			content: { "application/json": { schema: C } },
+			description: "Updated tenant settings"
+		} }
+	}), async (t) => {
+		let { id: n, config_sync_hash: i, config_synced_at: a, ...o } = t.req.valid("json"), s = await q(t).tenants.get(t.var.tenant_id);
+		if (!s) throw new w(404, { message: "Tenant not found" });
+		if ("config_sync" in o && (o.config_sync ?? "inherit-on-read") !== (s.config_sync ?? "inherit-on-read") && !r(t)) throw new w(403, { message: "Only the control plane can change a tenant's config_sync mode" });
+		if ("default_client_id" in o) {
+			let e = o.default_client_id;
+			if (typeof e == "string" && e.length > 0) {
+				let n = await q(t).clients.get(t.var.tenant_id, e);
+				if (!n) throw new w(400, { message: `Client with id '${e}' not found` });
+				if (!v(n)) throw new w(400, { message: `Client '${e}' is not an interactive client and cannot be used as the default client` });
+			}
+		}
+		if ("parent_tenant_id" in o) {
+			if ((o.parent_tenant_id ?? null) !== (s.parent_tenant_id ?? null) && !r(t)) throw new w(403, { message: "Only the control plane can change a tenant's parent" });
+			await de({
+				tenantId: t.var.tenant_id,
+				parentTenantId: o.parent_tenant_id,
+				getTenant: (e) => q(t).tenants.get(e),
+				getChildren: async (e) => (await m((e) => q(t).tenants.list(e), "tenants")).filter((t) => t.parent_tenant_id === e).map((e) => e.id)
+			});
+		}
+		let c = d(s, o);
+		await q(t).tenants.update(t.var.tenant_id, c), "config_sync" in o && e.onConfigSyncChange?.(t.var.tenant_id);
+		let l = await q(t).tenants.get(t.var.tenant_id);
+		if (!l) throw new w(500, { message: "Failed to retrieve updated tenant" });
+		return t.json(l);
+	}), n;
+}
+//#endregion
+//#region src/middleware/protect-synced.ts
+function jt(e) {
+	for (let { pattern: t, type: n } of [
+		{
+			pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
+			type: "resource_server"
+		},
+		{
+			pattern: /\/api\/v2\/roles\/([^/]+)$/,
+			type: "role"
+		},
+		{
+			pattern: /\/api\/v2\/connections\/([^/]+)$/,
+			type: "connection"
+		}
+	]) {
+		let r = e.match(t);
+		if (r && r[1]) return {
+			type: n,
+			id: r[1]
+		};
+	}
+	return null;
+}
+async function Mt(e, t, n) {
+	try {
+		switch (n.type) {
+			case "resource_server": return (await e.resourceServers.get(t, n.id))?.is_system === !0;
+			case "role": return (await e.roles.get(t, n.id))?.is_system === !0;
+			case "connection": return (await e.connections.get(t, n.id))?.is_system === !0;
+			default: return !1;
 		}
-	};
+	} catch {
+		return !1;
+	}
 }
-function rt(e, t) {
-	let n = tt({
-		controlPlaneTenantId: t.controlPlaneTenantId,
-		resolveControlPlane: t.resolveControlPlane
-	});
+function Nt(e) {
 	return {
-		...e,
-		resourceServers: nt(e, n)
-	};
+		resource_server: "resource server",
+		role: "role",
+		connection: "connection"
+	}[e];
 }
-function it(e, t) {
-	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i, inheritanceShadow: a } = t, o = tt({
-		controlPlaneTenantId: n,
-		controlPlaneClientId: r,
-		resolveControlPlane: i
-	}), s = a ? Ze(e, a === !0 ? {} : a) : void 0, c = s ? async (e) => {
-		let t = await o(e);
-		return s.schedule(e, t?.tenantId), t;
-	} : o;
-	return {
-		...e,
-		multiTenancyConfig: {
-			controlPlaneTenantId: n,
-			controlPlaneClientId: r,
-			resolveControlPlane: i
+function Pt(e) {
+	for (let { pattern: t, type: n } of [
+		{
+			pattern: /\/api\/v2\/connections\/([^/]+)$/,
+			type: "connection"
 		},
-		connections: {
-			...e.connections,
-			get: async (t, n) => {
-				let r = await e.connections.get(t, n);
-				if (!r) return r;
-				let i = await c(t);
-				return !i || t === i.tenantId ? r : q(r, (await e.connections.list(i.tenantId)).connections || []);
-			},
-			list: async (t, n) => {
-				let r = await e.connections.list(t, n), i = await c(t);
-				if (!i || t === i.tenantId) return r;
-				let a = await e.connections.list(i.tenantId), o = r.connections.map((e) => q(e, a.connections || []));
-				return {
-					...r,
-					connections: o
-				};
-			}
+		{
+			pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
+			type: "resource_server"
 		},
-		clientConnections: {
-			...e.clientConnections,
-			listByClient: async (t, n) => {
-				let r = await e.clientConnections.listByClient(t, n);
-				r.length === 0 && (r = (await e.connections.list(t)).connections || []);
-				let i = await c(t);
-				if (!i || t === i.tenantId) return r;
-				let a = await e.connections.list(i.tenantId);
-				return r.map((e) => q(e, a.connections || []));
-			}
+		{
+			pattern: /\/api\/v2\/actions\/actions\/([^/]+)$/,
+			type: "action"
 		},
-		emailProviders: {
-			...e.emailProviders,
-			get: async (t) => {
-				let n = await e.emailProviders.get(t);
-				if (n) return n;
-				let r = await c(t);
-				return !r || t === r.tenantId ? null : e.emailProviders.get(r.tenantId);
-			}
+		{
+			pattern: /\/api\/v2\/hooks\/([^/]+)$/,
+			type: "hook"
 		},
-		resourceServers: nt(e, c),
-		hooks: at(e, c)
-	};
-}
-function X(e) {
-	if (!e || typeof e != "object") return !1;
-	let t = e.metadata;
-	return !t || typeof t != "object" ? !1 : t.inheritable === !0;
+		{
+			pattern: /\/api\/v2\/hook-code\/([^/]+)$/,
+			type: "hook_code"
+		}
+	]) {
+		let r = e.match(t);
+		if (r?.[1]) return {
+			type: n,
+			id: r[1]
+		};
+	}
+	return null;
 }
-function at(e, t) {
-	return {
-		...e.hooks,
-		list: async (n, r) => {
-			let i = await e.hooks.list(n, r), a = await t(n);
-			if (!a || n === a.tenantId) return i;
-			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(X);
-			if (o.length === 0) return i;
-			let s = new Set((i.hooks || []).map((e) => e.hook_id)), c = o.filter((e) => !s.has(e.hook_id));
-			return {
-				...i,
-				hooks: [...i.hooks || [], ...c],
-				length: typeof i.length == "number" ? i.length + c.length : i.length
-			};
-		},
-		get: async (n, r) => {
-			let i = await e.hooks.get(n, r);
-			if (i) return i;
-			let a = await t(n);
-			if (!a || n === a.tenantId) return i;
-			let o = await e.hooks.get(a.tenantId, r);
-			return o && X(o) ? o : null;
+async function Ft(e, t, n) {
+	try {
+		switch (n.type) {
+			case "connection": return await e.connections.get(t, n.id);
+			case "resource_server": return await e.resourceServers.get(t, n.id);
+			case "action": return await e.actions.get(t, n.id);
+			case "hook": return await e.hooks.get(t, n.id);
+			case "hook_code": return await e.hookCode.get(t, n.id);
 		}
+	} catch {
+		return null;
+	}
+}
+var It = {
+	connection: ["options"],
+	resource_server: ["signing_secret"],
+	action: ["secrets"],
+	hook: [],
+	hook_code: []
+}, Lt = new Set([
+	"client_secret",
+	"app_secret",
+	"twilio_token"
+]);
+function Rt(e, t) {
+	let n = (e) => {
+		let { client_secret: t, ...n } = e ?? {};
+		return n;
 	};
+	return zt(n(e), n(t));
+}
+var zt = (e, t) => JSON.stringify(e) === JSON.stringify(t);
+function J(e, t) {
+	return new w(403, { message: `This ${e.type.replace("_", " ")} is synced from a parent tenant and ${t}. Make changes in the parent tenant instead.` });
+}
+async function Bt(e, t, n) {
+	let r = await Ft(q(e), t, n);
+	if (!r) return;
+	if (n.type === "hook_code") throw J(n, "cannot be modified");
+	if (e.req.method === "DELETE") {
+		if (r.enforce === !0) throw J(n, "cannot be deleted");
+		return;
+	}
+	let i = r.override ?? "fields";
+	if (i === "none") throw J(n, "cannot be edited");
+	let a = {};
+	try {
+		let t = await e.req.raw.clone().json();
+		t && typeof t == "object" && (a = t);
+	} catch {}
+	for (let e of [
+		"scope",
+		"override",
+		"enforce"
+	]) if (e in a && !zt(a[e] ?? null, r[e] ?? null)) throw J(n, `has a locked ${e}`);
+	if (r.enforce === !0 && a.enabled === !1) throw J(n, "cannot be disabled");
+	if (i === "secrets") {
+		let e = It[n.type];
+		for (let [t, i] of Object.entries(a)) if (![
+			"scope",
+			"override",
+			"enforce"
+		].includes(t) && !zt(i, r[t])) {
+			if (!e.includes(t)) throw J(n, `only allows its secrets to be changed (not ${t})`);
+			if (t === "options" && i && typeof i == "object") {
+				let e = r.options ?? {};
+				for (let [t, r] of Object.entries(i)) if (!zt(r, e[t]) && !t.endsWith("_hint") && !(Lt.has(t) || t === "configuration" && Rt(r, e[t]))) throw J(n, `only allows its secrets to be changed (not options.${t})`);
+			}
+		}
+	}
 }
-function Z(e, t) {
-	return it(e, t);
+function Vt() {
+	return async (e, t) => {
+		if (![
+			"PATCH",
+			"PUT",
+			"DELETE"
+		].includes(e.req.method)) return t();
+		let n = jt(e.req.path), r = Pt(e.req.path);
+		if (!n && !r) return t();
+		let i = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
+		if (!i) return t();
+		if (n && await Mt(q(e), i, n)) throw new w(403, { message: `This ${Nt(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
+		return r && y(r.id) && await Bt(e, i, r), t();
+	};
 }
 //#endregion
 //#region src/middleware/index.ts
-function ot(e) {
+function Ht(e) {
 	return async (t, n) => {
 		let r = t.var.user;
 		return r?.tenant_id === e && r.org_name && t.set("tenant_id", r.org_name), n();
 	};
 }
-function st(e) {
+function Ut(e) {
 	return async (t, r) => {
 		if (!e.accessControl) return r();
 		let { controlPlaneTenantId: i } = e.accessControl, a = t.var.org_name, o = t.var.organization_id, s = a || o, c = t.var.tenant_id, l = t.var.user, u = (l?.aud ? Array.isArray(l.aud) ? l.aud : [l.aud] : []).includes(n);
-		if (!c && s && u && (t.set("tenant_id", s), c = s), !c) throw new T(400, { message: "Tenant ID not found in request" });
-		if (!D(o, c, i, a)) throw new T(403, { message: `Access denied to tenant ${c}` });
+		if (!c && s && u && (t.set("tenant_id", s), c = s), !c) throw new w(400, { message: "Tenant ID not found in request" });
+		if (!O(o, c, i, a)) throw new w(403, { message: `Access denied to tenant ${c}` });
 		return r();
 	};
 }
-function ct(e) {
+function Wt(e) {
 	return async (t, n) => {
 		if (!e.subdomainRouting) return n();
 		let { baseDomain: r, reservedSubdomains: i = [], resolveSubdomain: a } = e.subdomainRouting, o = t.req.header("x-forwarded-host") || t.req.header("host") || "", s = null;
@@ -1441,18 +1941,18 @@ function ct(e) {
 		let c = null;
 		if (a) c = await a(s);
 		else if (e.subdomainRouting.useOrganizations !== !1 && e.accessControl) try {
-			let n = await P(t).organizations.get(e.accessControl.controlPlaneTenantId, s);
+			let n = await q(t).organizations.get(e.accessControl.controlPlaneTenantId, s);
 			n && (c = n.id);
 		} catch {}
-		if (!c) throw new T(404, { message: `Tenant not found for subdomain: ${s}` });
+		if (!c) throw new w(404, { message: `Tenant not found for subdomain: ${s}` });
 		return t.set("tenant_id", c), n();
 	};
 }
-function lt(e) {
+function Gt(e) {
 	return async (t, n) => {
 		if (!e.databaseIsolation) return n();
 		let r = t.var.tenant_id;
-		if (!r) throw new T(400, { message: "Tenant ID not found in request" });
+		if (!r) throw new w(400, { message: "Tenant ID not found in request" });
 		try {
 			let n = await e.databaseIsolation.getAdapters(r);
 			t.set("baseData", n), t.env = {
@@ -1460,131 +1960,674 @@ function lt(e) {
 				data: n
 			};
 		} catch (e) {
-			throw console.error(`Failed to resolve database for tenant ${r}:`, e), new T(500, { message: "Failed to resolve tenant database" });
+			throw console.error(`Failed to resolve database for tenant ${r}:`, e), new w(500, { message: "Failed to resolve tenant database" });
 		}
 		return n();
 	};
 }
-function Q(e) {
-	let t = ct(e), n = st(e), r = lt(e);
+function Kt(e) {
+	let t = Wt(e), n = Ut(e), r = Gt(e);
 	return async (e, i) => (await t(e, async () => {}), await n(e, async () => {}), await r(e, async () => {}), i());
 }
 //#endregion
+//#region src/rollouts/config.ts
+var qt = [
+	10,
+	50,
+	100
+], Y = {
+	canary: 1,
+	waves: qt,
+	failure_threshold: .1,
+	max_concurrent: 25,
+	debounce_ms: 6e4
+};
+function X(e) {
+	let t = e.config ?? {};
+	return {
+		...Y,
+		trigger: "manual",
+		root_tenant_id: "",
+		...t,
+		waves: Array.isArray(t.waves) && t.waves.length > 0 ? t.waves : [...qt]
+	};
+}
+function Jt(e, t, n) {
+	let r = Array(e).fill(0);
+	if (e === 0) return r;
+	let i = Math.min(Math.max(t, 0), e), a = [], o = i;
+	for (let t of n) {
+		let n = Math.min(e, Math.max(o, Math.ceil(e * t / 100)));
+		n > o && (a.push(n), o = n);
+	}
+	o < e && a.push(e);
+	let s = +(i > 0), c = i;
+	for (let e of a) {
+		for (; c < e; c++) r[c] = s;
+		s++;
+	}
+	return r;
+}
+//#endregion
+//#region src/rollouts/enumerate.ts
+async function Yt(e, t, n) {
+	let r = n.maxDepth ?? 8, i = await m((t) => e.tenants.list(t), "tenants", {
+		cursorField: "id",
+		pageSize: 100
+	}), a = new Map(i.map((e) => [e.id, e])), o = async (e) => e.parent_tenant_id ?? (e.id === t ? void 0 : await n.resolveLegacyParent(e.id)), s = [];
+	for (let e of i) {
+		if (e.id === t || e.config_sync !== "synced") continue;
+		let n = 0, i = e, c = !1;
+		for (; i && n <= r;) {
+			let e = await o(i);
+			if (!e) break;
+			if (n++, e === t) {
+				c = !0;
+				break;
+			}
+			i = a.get(e);
+		}
+		c && s.push({
+			tenantId: e.id,
+			depth: n,
+			appliedHash: e.config_sync_hash ?? null
+		});
+	}
+	return s.sort((e, t) => e.depth - t.depth || (e.tenantId < t.tenantId ? -1 : 1));
+}
+//#endregion
+//#region src/rollouts/hashes.ts
+async function Xt(e, t) {
+	return e.resolveControlPlane ? (await e.resolveControlPlane({ tenant_id: t }))?.tenantId : e.controlPlaneTenantId;
+}
+function Zt(e) {
+	let t = /* @__PURE__ */ new Map();
+	return async (n) => {
+		let r = await Xt(e, n), i = (await N({
+			tenantId: n,
+			getTenant: (t) => e.adapters.tenants.get(t),
+			legacyControlPlane: r,
+			maxDepth: e.maxDepth
+		})).join(">"), a = t.get(i);
+		return a || (a = et(e.adapters, n, {
+			legacyControlPlane: r,
+			maxDepth: e.maxDepth
+		}).then((e) => e.hash), t.set(i, a)), a;
+	};
+}
+//#endregion
+//#region src/rollouts/plan.ts
+var Qt = [
+	"pending",
+	"canary",
+	"rolling",
+	"paused"
+];
+function $t(e) {
+	let { tenantOperations: t, tenantOperationEvents: n } = e.adapters;
+	if (!t || !n) throw Error("Fleet rollouts need the tenant operations adapters");
+	return {
+		tenantOperations: t,
+		tenantOperationEvents: n
+	};
+}
+function Z(e) {
+	if (!e.adapters.rollouts) throw Error("Fleet rollouts need the rollouts adapter");
+	return e.adapters.rollouts;
+}
+async function en(e, t, n = {}) {
+	let r = Z(e), i = $t(e), a = X(t), o = await Yt(e.adapters, a.root_tenant_id, {
+		resolveLegacyParent: (t) => Xt(e, t),
+		maxDepth: e.maxDepth
+	});
+	if (n.tenantIds) {
+		let e = new Set(n.tenantIds);
+		o = o.filter((t) => e.has(t.tenantId));
+	}
+	let s = Zt(e), c = [];
+	for (let e of o) (a.force || e.appliedHash !== await s(e.tenantId)) && c.push(e);
+	let l = o.length - c.length;
+	if (c.length === 0) return a.trigger === "write" ? await r.remove(t.id) : await r.update(t.id, {
+		status: "done",
+		finished_at: new Date(e.now?.() ?? Date.now()).toISOString(),
+		config: {
+			...a,
+			planned: !0,
+			tenant_count: 0
+		}
+	}), {
+		planned: 0,
+		upToDate: l
+	};
+	let u = new Set((await Q(e, t.id)).map((e) => e.tenant_id)), d = Jt(c.length, a.canary, a.waves);
+	for (let [n, r] of c.entries()) u.has(r.tenantId) || await M(i, {
+		kind: "sync-defaults",
+		tenant_id: r.tenantId,
+		rollout_id: t.id,
+		initiated_by: `rollout:${t.id}`,
+		input: {
+			wave: d[n],
+			...a.dry_run ? { dry_run: !0 } : {},
+			...a.force ? { force: !0 } : {}
+		}
+	}, e.executor.engine);
+	return await r.update(t.id, {
+		status: "canary",
+		config: {
+			...a,
+			planned: !0,
+			tenant_count: c.length
+		}
+	}), {
+		planned: c.length,
+		upToDate: l
+	};
+}
+async function Q(e, t) {
+	let { tenantOperations: n } = $t(e), r = [];
+	for (let e = 0;; e++) {
+		let { operations: i } = await n.list({
+			rollout_id: t,
+			page: e,
+			per_page: 200
+		});
+		if (r.push(...i), i.length < 200) break;
+	}
+	return r.sort((e, t) => e.created_at === t.created_at ? e.id < t.id ? -1 : 1 : e.created_at < t.created_at ? -1 : 1);
+}
+//#endregion
+//#region src/rollouts/advance.ts
+var $ = (e) => {
+	let t = e.input?.wave;
+	return typeof t == "number" ? t : 0;
+}, tn = (e) => e.status === "failed" || e.status === "cancelled";
+function nn(e, t, n) {
+	let r = t.filter((e) => $(e) === n), i = r.filter(tn).length, a = n === 0 && e.canary > 0, o = a ? 0 : e.failure_threshold;
+	return r.length === 0 || i === 0 || i / r.length <= o ? null : `${a ? "canary" : `wave ${n}`} failed for ${i} of ${r.length} tenant(s)`;
+}
+async function rn(e, t) {
+	let n = Z(e), r = e.now?.() ?? Date.now(), i = typeof t == "string" ? await n.get(t) : t;
+	if (!i || i.kind !== "config-sync") return {
+		rolloutId: String(i?.id ?? t),
+		outcome: "skipped",
+		started: 0
+	};
+	let a = i.id;
+	if (!Qt.includes(i.status) || i.status === "paused") return {
+		rolloutId: a,
+		outcome: "skipped",
+		started: 0
+	};
+	let o = X(i);
+	if (!o.planned) {
+		if (r - Date.parse(i.updated_at) < o.debounce_ms) return {
+			rolloutId: a,
+			outcome: "waiting",
+			started: 0
+		};
+		let { planned: t } = await en(e, i);
+		if (t === 0) return {
+			rolloutId: a,
+			outcome: "planned-empty",
+			started: 0
+		};
+		i = await n.get(a) ?? i, o = X(i);
+	}
+	let s = await Q(e, a), c = s.filter((e) => !j(e.status));
+	if (c.length === 0) {
+		let e = Math.max(0, ...s.map($)), t = s.length > 0 && e > (o.accepted_through ?? -1) ? nn(o, s, e) : null;
+		return await n.update(a, {
+			status: t ? "failed" : "done",
+			...t ? { paused_reason: t } : {},
+			finished_at: new Date(r).toISOString()
+		}), {
+			rolloutId: a,
+			outcome: "done",
+			started: 0
+		};
+	}
+	let l = Math.min(...c.map($)), u = l - 1;
+	if (u >= 0 && u > (o.accepted_through ?? -1)) {
+		let e = nn(o, s, u);
+		if (e) return await n.update(a, {
+			status: "paused",
+			paused_reason: e
+		}), {
+			rolloutId: a,
+			outcome: "paused",
+			started: 0,
+			wave: l
+		};
+	}
+	let d = l === 0 ? "canary" : "rolling";
+	i.status !== d && await n.update(a, { status: d });
+	let f = c.filter((e) => $(e) === l), p = f.filter((e) => e.status === "running").length, m = Math.max(0, o.max_concurrent - p), { tenantOperations: h, tenantOperationEvents: g } = $t(e), _ = A({
+		tenantOperations: h,
+		tenantOperationEvents: g
+	}), v = 0;
+	for (let t of f.filter((e) => e.status === "pending").slice(0, m)) {
+		try {
+			await _.markRunning(t.id), await e.executor.start(t);
+		} catch (e) {
+			try {
+				let n = await h.get(t.id);
+				n && !j(n.status) && await _.markFailed(t.id, e);
+			} catch {}
+		}
+		v++;
+	}
+	return {
+		rolloutId: a,
+		outcome: v > 0 ? "started" : "running",
+		started: v,
+		wave: l
+	};
+}
+async function an(e, t = {}) {
+	let { rollouts: n } = await Z(e).list({
+		kind: "config-sync",
+		status: [
+			"pending",
+			"canary",
+			"rolling"
+		],
+		per_page: t.limit ?? 20
+	}), r = [];
+	for (let i of n) try {
+		r.push(await rn(e, i));
+	} catch (e) {
+		t.logger?.warn(`Advancing rollout ${i.id} failed:`, e);
+	}
+	return r;
+}
+async function on(e, t, n = "paused by an operator") {
+	let r = Z(e), i = await r.get(t);
+	return !i || i.kind !== "config-sync" ? null : i.status === "done" || i.status === "failed" ? i : (await r.update(t, {
+		status: "paused",
+		paused_reason: n
+	}), r.get(t));
+}
+async function sn(e, t) {
+	let n = Z(e), r = await n.get(t);
+	if (!r || r.kind !== "config-sync") return null;
+	if (r.status !== "paused") return r;
+	let i = X(r), a = (await Q(e, t)).filter((e) => !j(e.status)), o = a.length > 0 ? Math.min(...a.map($)) : 0;
+	return await n.update(t, {
+		status: o === 0 ? "canary" : "rolling",
+		paused_reason: null,
+		config: {
+			...i,
+			accepted_through: Math.max(i.accepted_through ?? -1, o - 1)
+		}
+	}), n.get(t);
+}
+//#endregion
+//#region src/rollouts/status.ts
+async function cn(e, t) {
+	let n = await e.adapters.tenants.get(t);
+	if (!n) return null;
+	let r = n.config_sync === "synced", i = await N({
+		tenantId: t,
+		getTenant: (t) => e.adapters.tenants.get(t),
+		legacyControlPlane: await Xt(e, t),
+		maxDepth: e.maxDepth
+	}), a = r ? await Zt(e)(t) : null, o = n.config_sync_hash ?? null, s = {};
+	for (let n of [...i].reverse()) {
+		let r = await I(e.adapters, n), i = (e, t) => V(e, t) === "shared", a = async (e, r, a) => {
+			for (let o of r) {
+				let r = o.id ?? o.hook_id;
+				r && y(r) || i(a, o) && (s[await W(e, t, G(e, o))] = n);
+			}
+		};
+		await a("connection", r.connections, "connection"), await a("resourceServer", r.resourceServers, "resourceServer"), await a("action", r.actions, "action"), await a("hook", r.hooks, "hook"), r.emailProvider && i("emailProvider", r.emailProvider) && (s.emailProvider = n), r.branding && i("branding", r.branding) && (s.branding = n), r.promptSettings && i("promptSettings", r.promptSettings) && (s.promptSettings = n);
+	}
+	return {
+		tenant_id: t,
+		parent_tenant_id: n.parent_tenant_id ?? null,
+		config_sync: r ? "synced" : "inherit-on-read",
+		config_sync_hash: o,
+		config_synced_at: n.config_synced_at ?? null,
+		expected_hash: a,
+		drifted: r && a !== o,
+		chain: i,
+		inherited: s
+	};
+}
+//#endregion
+//#region src/rollouts/reconcile.ts
+async function ln(e, n = {}) {
+	let r = Z(e), i = n.rootTenantId ?? e.controlPlaneTenantId, a = n.limit ?? 500, o = await Yt(e.adapters, i, {
+		resolveLegacyParent: (t) => Xt(e, t),
+		maxDepth: e.maxDepth
+	}), s = Zt(e), c = [];
+	for (let e of o) {
+		if (c.length >= a) break;
+		try {
+			let t = await s(e.tenantId);
+			e.appliedHash !== t && c.push({
+				tenantId: e.tenantId,
+				expected: t,
+				applied: e.appliedHash
+			});
+		} catch (t) {
+			n.logger?.warn(`Could not compute the expected hash of ${e.tenantId}:`, t);
+		}
+	}
+	let l = {
+		checked: o.length,
+		drifted: c.length,
+		alreadyCovered: 0,
+		recentlyFailed: 0
+	};
+	if (c.length === 0) return l;
+	let u = /* @__PURE__ */ new Set(), { rollouts: d } = await r.list({
+		kind: "config-sync",
+		status: [...Qt],
+		per_page: 100
+	});
+	for (let t of d) for (let n of await Q(e, t.id)) n.tenant_id && !j(n.status) && u.add(n.tenant_id);
+	for (let r of c) try {
+		await e.adapters.logs.create(r.tenantId, {
+			type: t.CONFIG_DRIFT,
+			date: new Date(e.now?.() ?? Date.now()).toISOString(),
+			isMobile: !1,
+			description: r.applied ? "hash-mismatch: applied config differs from what the parent chain publishes" : "never-synced: no config has been applied to this synced tenant",
+			details: {
+				reason: r.applied ? "hash-mismatch" : "never-synced",
+				applied_hash: r.applied,
+				expected_hash: r.expected,
+				covered_by_open_rollout: u.has(r.tenantId),
+				trigger: "reconcile"
+			}
+		});
+	} catch (e) {
+		n.logger?.warn(`Could not record drift for ${r.tenantId}:`, e);
+	}
+	let f = c.filter((e) => !u.has(e.tenantId));
+	l.alreadyCovered = c.length - f.length;
+	let { tenantOperations: p } = $t(e), m = e.now?.() ?? Date.now(), h = n.retryAfterMs ?? 36e5, g = [];
+	for (let e of f) {
+		try {
+			let { operations: t } = await p.list({
+				tenant_id: e.tenantId,
+				kind: "sync-defaults",
+				per_page: 5
+			}), n = t.sort((e, t) => e.created_at === t.created_at ? e.id < t.id ? 1 : -1 : e.created_at < t.created_at ? 1 : -1)[0];
+			if (n?.status === "failed" && m - Date.parse(n.updated_at) < h) {
+				l.recentlyFailed++;
+				continue;
+			}
+		} catch (t) {
+			n.logger?.warn(`Could not read the latest sync of ${e.tenantId}:`, t);
+		}
+		g.push(e);
+	}
+	if (g.length === 0) return l;
+	let _ = await r.create({
+		kind: "config-sync",
+		initiated_by: "reconcile",
+		config: {
+			...Y,
+			trigger: "reconcile",
+			root_tenant_id: i,
+			planned: !1
+		}
+	});
+	return await en(e, _, { tenantIds: g.map((e) => e.tenantId) }), l.rolloutId = _.id, l;
+}
+//#endregion
+//#region src/rollouts/trigger.ts
+function un(e, t) {
+	return e === "hookCode" ? !0 : !t || typeof t != "object" ? !1 : V(e, t) !== "local";
+}
+async function dn(e, t, n) {
+	let r = Z(e), { rollouts: i } = await r.list({
+		kind: "config-sync",
+		status: "pending",
+		per_page: 100
+	}), a = i.find((e) => {
+		let n = X(e);
+		return n.trigger === "write" && n.planned !== !0 && n.origin_tenant_id === t;
+	});
+	return a ? (await r.update(a.id, {}), await r.get(a.id) ?? a) : r.create({
+		kind: "config-sync",
+		initiated_by: n ?? `write:${t}`,
+		config: {
+			...Y,
+			trigger: "write",
+			root_tenant_id: t,
+			origin_tenant_id: t,
+			planned: !1
+		}
+	});
+}
+async function fn(e, t) {
+	if (t === e.controlPlaneTenantId) return !0;
+	try {
+		let { tenants: n } = await e.adapters.tenants.list({
+			q: `parent_tenant_id:${t}`,
+			per_page: 1
+		});
+		return n.some((e) => e.parent_tenant_id === t);
+	} catch {
+		return !0;
+	}
+}
+function pn(e, t = {}) {
+	let n = async (n) => {
+		try {
+			await fn(e, n) && await dn(e, n);
+		} catch (e) {
+			t.logger?.warn(`Could not record a config change for ${n}:`, e);
+		}
+	}, r = (e) => ({
+		afterCreate: async (t, r) => {
+			un(e, r) && await n(t.tenantId);
+		},
+		afterUpdate: async (t, r, i) => {
+			un(e, i) && await n(t.tenantId);
+		},
+		afterDelete: async (e) => n(e.tenantId)
+	});
+	return {
+		actions: r("action"),
+		hooks: r("hook"),
+		hookCode: r("hookCode"),
+		connections: r("connection"),
+		resourceServers: r("resourceServer")
+	};
+}
+//#endregion
+//#region src/rollouts/controller.ts
+function mn(e) {
+	return {
+		async create(t) {
+			let n = {
+				...Y,
+				waves: t.waves ?? [...Y.waves],
+				canary: t.canary ?? Y.canary,
+				failure_threshold: t.failureThreshold ?? Y.failure_threshold,
+				max_concurrent: t.maxConcurrent ?? Y.max_concurrent,
+				trigger: "manual",
+				root_tenant_id: t.rootTenantId ?? e.controlPlaneTenantId,
+				dry_run: t.dryRun,
+				force: t.force,
+				planned: !1
+			}, r = Z(e), i = await r.create({
+				kind: "config-sync",
+				initiated_by: t.initiatedBy,
+				config: n
+			});
+			return await en(e, i, { tenantIds: t.tenantIds }), await rn(e, i.id), await r.get(i.id) ?? i;
+		},
+		pause: (t, n) => on(e, t, n),
+		resume: (t) => sn(e, t)
+	};
+}
+//#endregion
 //#region src/init.ts
-function ut(e) {
-	let { dataAdapter: t, controlPlane: n, controlPlane: { tenantId: r = "control_plane", clientId: i } = {}, resolveControlPlane: a, inheritanceShadow: o, sync: s = {
+function hn(e) {
+	let { dataAdapter: t, controlPlane: n, controlPlane: { tenantId: r = "control_plane", clientId: i } = {}, resolveControlPlane: a, inheritanceShadow: o, syncDefaults: s, rolloutExecutor: c, sync: l = {
 		resourceServers: !0,
 		roles: !0
-	}, defaultPermissions: c = ["tenant:admin"], requireOrganizationMatch: l = !1, managementApiExtensions: u = [], entityHooks: d, getChildTenantIds: p, getAdapters: h, ...g } = e;
+	}, defaultPermissions: u = ["tenant:admin"], requireOrganizationMatch: d = !1, managementApiExtensions: f = [], entityHooks: p, getChildTenantIds: h, getAdapters: g, ...v } = e;
 	if (a && !n) throw Error("initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it.");
-	let _ = t, v = t;
-	n && (_ = Z(t, {
-		controlPlaneTenantId: r,
-		controlPlaneClientId: i,
-		resolveControlPlane: a,
-		inheritanceShadow: o
-	}), v = {
-		...rt(t, {
-			controlPlaneTenantId: r,
-			resolveControlPlane: a
-		}),
-		multiTenancyConfig: {
+	let y = t, b = t, ee;
+	if (n) {
+		let e = Pe({
+			base: Re({
+				controlPlaneTenantId: r,
+				controlPlaneClientId: i,
+				resolveControlPlane: a
+			}),
+			getTenant: async (e) => await t.tenants.get(e) ?? null,
+			controlPlaneTenantId: r
+		});
+		ee = (t) => e.invalidate(t), y = Ue(t, {
 			controlPlaneTenantId: r,
 			controlPlaneClientId: i,
-			resolveControlPlane: a
-		}
-	});
-	let y = g.tenantOperationExecutor;
-	if (!y && t.tenantOperations && t.tenantOperationEvents && g.tenantUpgrade) {
+			resolveControlPlane: a,
+			inheritanceShadow: o,
+			configSync: e
+		}), b = {
+			...Be(t, {
+				controlPlaneTenantId: r,
+				resolveControlPlane: e.resolve
+			}),
+			multiTenancyConfig: {
+				controlPlaneTenantId: r,
+				controlPlaneClientId: i,
+				resolveControlPlane: e.resolve
+			}
+		};
+	}
+	let te = v.tenantOperationExecutor, x;
+	if (t.tenantOperations && t.tenantOperationEvents) {
 		let e = {
 			tenantOperations: t.tenantOperations,
 			tenantOperationEvents: t.tenantOperationEvents
-		}, n = g.tenantUpgrade, r = ie({
+		}, n = v.tenantUpgrade, i = A(e), o = s ?? ft(t, {
+			controlPlaneTenantId: r,
+			resolveControlPlane: a
+		}), c = le({
 			stores: e,
-			definitions: { upgrade: (e) => [{
-				name: "upgrade",
-				async run() {
-					if (!e.tenant_id) throw Error("upgrade operations require a tenant_id");
-					await n(e.tenant_id);
-				}
-			}] }
+			definitions: {
+				...n ? { upgrade: (e) => [{
+					name: "upgrade",
+					async run() {
+						if (!e.tenant_id) throw Error("upgrade operations require a tenant_id");
+						await n(e.tenant_id);
+					}
+				}] } : {},
+				"sync-defaults": (e) => [{
+					name: "sync-defaults",
+					run: () => dt({
+						operation: e,
+						syncConfig: o,
+						recorder: i
+					})
+				}]
+			}
 		});
-		y = {
-			engine: r.engine,
-			enqueue: (t) => oe(e, r, {
+		x = c, te ??= {
+			engine: c.engine,
+			kinds: n ? ["upgrade", "sync-defaults"] : ["sync-defaults"],
+			enqueue: (t) => ue(e, c, {
 				...t,
 				tenant_id: t.tenant_id
-			})
+			}, { returnFailed: t.kind === "sync-defaults" })
 		};
 	}
-	let b = s !== !1, x = b ? {
-		resourceServers: s.resourceServers ?? !0,
-		roles: s.roles ?? !0
+	let S = c ?? x, C = S && t.rollouts && t.tenantOperations && t.tenantOperationEvents ? {
+		adapters: t,
+		executor: S,
+		controlPlaneTenantId: r,
+		resolveControlPlane: a
+	} : void 0, w = C ? mn(C) : void 0, T = C ? pn(C, { logger: console }) : void 0, E = l !== !1, D = E ? {
+		resourceServers: l.resourceServers ?? !0,
+		roles: l.roles ?? !0
 	} : {
 		resourceServers: !1,
 		roles: !1
-	}, { entityHooks: S, tenantHooks: C } = ve({
+	}, { entityHooks: ne, tenantHooks: O } = Tt({
 		controlPlaneTenantId: r,
-		getChildTenantIds: p ?? (async () => (await f((e) => _.tenants.list(e), "tenants", {
+		getChildTenantIds: h ?? (async () => (await m((e) => y.tenants.list(e), "tenants", {
 			cursorField: "id",
 			pageSize: 100
 		})).filter((e) => e.id !== r).map((e) => e.id)),
-		getAdapters: h ?? (async () => _),
-		getControlPlaneAdapters: async () => _,
-		sync: x
-	}), w = {
-		resourceServers: [S.resourceServers, ...d?.resourceServers ?? []],
-		roles: [S.roles, ...d?.roles ?? []],
-		connections: d?.connections ?? [],
-		tenants: d?.tenants ?? [],
-		rolePermissions: d?.rolePermissions ?? []
-	}, T = N({ accessControl: {
-		controlPlaneTenantId: r,
-		requireOrganizationMatch: l,
-		defaultPermissions: c
-	} }), E = F({ accessControl: {
+		getAdapters: g ?? (async () => y),
+		getControlPlaneAdapters: async () => y,
+		sync: D
+	}), re = {
+		resourceServers: [
+			ne.resourceServers,
+			T?.resourceServers,
+			...p?.resourceServers ?? []
+		],
+		roles: [ne.roles, ...p?.roles ?? []],
+		connections: [T?.connections, ...p?.connections ?? []],
+		tenants: p?.tenants ?? [],
+		rolePermissions: p?.rolePermissions ?? [],
+		actions: [T?.actions, ...p?.actions ?? []],
+		hooks: [T?.hooks, ...p?.hooks ?? []],
+		hookCode: [T?.hookCode, ...p?.hookCode ?? []]
+	}, k = gt({ accessControl: {
 		controlPlaneTenantId: r,
-		requireOrganizationMatch: l,
-		defaultPermissions: c
-	} }, { tenants: {
+		requireOrganizationMatch: d,
+		defaultPermissions: u
+	} }), ie = At({
+		accessControl: {
+			controlPlaneTenantId: r,
+			requireOrganizationMatch: d,
+			defaultPermissions: u
+		},
+		onConfigSyncChange: (e) => ee?.(e),
+		configSyncStatus: (e) => cn({
+			adapters: t,
+			controlPlaneTenantId: r,
+			resolveControlPlane: a
+		}, e)
+	}, { tenants: {
 		async beforeCreate(e, t) {
-			return T.beforeCreate && (t = await T.beforeCreate(e, t)), C.beforeCreate && (t = await C.beforeCreate(e, t)), t;
+			return k.beforeCreate && (t = await k.beforeCreate(e, t)), O.beforeCreate && (t = await O.beforeCreate(e, t)), t;
 		},
 		async afterCreate(e, t) {
-			await T.afterCreate?.(e, t), await C.afterCreate?.(e, t);
+			await k.afterCreate?.(e, t), await O.afterCreate?.(e, t);
 		},
 		async beforeDelete(e, t) {
-			await T.beforeDelete?.(e, t), await C.beforeDelete?.(e, t);
+			await k.beforeDelete?.(e, t), await O.beforeDelete?.(e, t);
 		}
-	} }), { app: D } = m({
-		dataAdapter: _,
-		managementDataAdapter: v,
-		...g,
-		tenantOperationExecutor: y,
-		entityHooks: w,
-		managementApiExtensions: [...u, {
+	} }), { app: ae } = _({
+		dataAdapter: y,
+		managementDataAdapter: b,
+		...v,
+		tenantOperationExecutor: te,
+		...w ? { rolloutController: w } : {},
+		entityHooks: re,
+		managementApiExtensions: [...f, {
 			path: "/tenants",
-			router: E
+			router: ie
 		}],
-		managementApiMiddleware: [...g.managementApiMiddleware ?? [], ...b ? [Ee()] : []]
+		managementApiMiddleware: [...v.managementApiMiddleware ?? [], ...E ? [Vt()] : []]
 	});
 	return {
-		app: D,
-		controlPlaneTenantId: r
+		app: ae,
+		controlPlaneTenantId: r,
+		rollouts: C
 	};
 }
 //#endregion
 //#region src/rollout/payload.ts
-function dt(e) {
+function gn(e) {
 	let { pkcs7: t, tenant_id: n, ...r } = e;
 	return r;
 }
-async function ft(e, t, n = {}, r) {
-	let i = z(n), a = n.signingKeys ?? !0, o = n.tenants ?? !0, s = await H(e, t, i), c = a ? (await g(e.keys)).map(dt) : [], l = o ? await pt(e, t, r) : [];
+async function _n(e, t, n = {}, r) {
+	let i = he(n), a = n.signingKeys ?? !0, o = n.tenants ?? !0, s = await ve(e, t, i), c = a ? (await b(e.keys)).map(gn) : [], l = o ? await vn(e, t, r) : [];
 	return {
 		connections: s.connections,
 		resourceServers: s.resourceServers.filter((e) => e.is_system),
-		hooks: s.hooks.filter(ze),
+		hooks: s.hooks.filter(_e),
 		emailProvider: s.emailProvider,
 		branding: s.branding,
 		promptSettings: s.promptSettings,
@@ -1592,7 +2635,7 @@ async function ft(e, t, n = {}, r) {
 		tenants: l
 	};
 }
-async function pt(e, t, n) {
+async function vn(e, t, n) {
 	let r = n && n !== t ? [t, n] : [t], i = [];
 	for (let t of r) {
 		let n = await e.tenants.get(t);
@@ -1603,19 +2646,19 @@ async function pt(e, t, n) {
 	}
 	return i;
 }
-async function mt(e, t, n) {
-	let r = B();
+async function yn(e, t, n) {
+	let r = P();
 	if (e.length === 0) return r;
-	let i = await g(t.keys), a = new Set(i.map((e) => e.kid));
-	for (let i of e) await V(r, `signing_key ${i.kid}`, n, async () => {
-		let e = dt(i);
+	let i = await b(t.keys), a = new Set(i.map((e) => e.kid));
+	for (let i of e) await F(r, `signing_key ${i.kid}`, n, async () => {
+		let e = gn(i);
 		a.has(e.kid) || (await t.keys.create(e), a.add(e.kid), r.upserted += 1);
 	});
 	return r;
 }
-async function ht(e, t, n) {
-	let r = B();
-	for (let i of e) await V(r, `tenant ${i.id}`, n, async () => {
+async function bn(e, t, n) {
+	let r = P();
+	for (let i of e) await F(r, `tenant ${i.id}`, n, async () => {
 		await t.tenants.get(i.id) || (await t.tenants.create({
 			id: i.id,
 			friendly_name: i.friendly_name
@@ -1623,46 +2666,50 @@ async function ht(e, t, n) {
 	});
 	return r;
 }
-async function gt(e, t, n, r = {}) {
-	let i = r.continueOnError ?? !1, o = z(r.entities), s = r.entities?.signingKeys ?? !0, c = r.entities?.tenants ?? !0, l = {
+async function xn(e, t, n, r = {}) {
+	let i = r.continueOnError ?? !1, a = he(r.entities), s = r.entities?.signingKeys ?? !0, c = r.entities?.tenants ?? !0, l = {
 		connections: e.connections,
 		resourceServers: e.resourceServers,
 		hooks: e.hooks,
-		emailProvider: e.emailProvider ? u.parse(e.emailProvider) : null,
-		branding: e.branding ? a.parse(e.branding) : null,
-		promptSettings: e.promptSettings ? _.parse(e.promptSettings) : null
-	}, d = c ? await ht(e.tenants ?? [], t, i) : B(), f = Re(n);
-	await Be(l, t, n, o, i, f);
-	let p = s ? await mt(e.signingKeys, t, i) : B();
+		emailProvider: e.emailProvider ? f.parse(e.emailProvider) : null,
+		branding: e.branding ? o.parse(e.branding) : null,
+		promptSettings: e.promptSettings ? ee.parse(e.promptSettings) : null
+	}, u = c ? await bn(e.tenants ?? [], t, i) : P(), d = ge(n);
+	await ye(l, t, n, a, i, d);
+	let p = s ? await yn(e.signingKeys, t, i) : P(), m = e.resolved && r.resolved ? await at(e.resolved, t, r.resolved.tenantId, {
+		continueOnError: i,
+		...r.resolved
+	}) : void 0;
 	return {
-		...f,
+		...d,
 		signingKeys: p,
-		tenants: d
+		tenants: u,
+		...m ? { resolved: m } : {}
 	};
 }
 //#endregion
 //#region src/rollout/index.ts
-function _t(e) {
+function Sn(e) {
 	return {
-		syncDefaults: (t) => U(e, t),
+		syncDefaults: (t) => be(e, t),
 		syncDefaultsToTenants: async (t) => {
 			let n = [];
-			for (let r of t) n.push(await U(e, r));
+			for (let r of t) n.push(await be(e, r));
 			return n;
 		}
 	};
 }
 //#endregion
 //#region src/plugin.ts
-function vt(e) {
-	let t = $(e);
+function Cn(e) {
+	let t = wn(e);
 	return {
 		name: "multi-tenancy",
-		middleware: Q(e),
+		middleware: Kt(e),
 		hooks: t,
 		routes: [{
 			path: "/management",
-			handler: F(e, t)
+			handler: At(e, t)
 		}],
 		onRegister: async () => {
 			console.log("Multi-tenancy plugin registered"), e.accessControl && console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`), e.subdomainRouting && console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`), e.databaseIsolation && console.log("  - Database isolation enabled");
@@ -1671,29 +2718,29 @@ function vt(e) {
 }
 //#endregion
 //#region src/index.ts
-function $(e) {
-	let t = e.accessControl ? E(e.accessControl) : {}, n = e.databaseIsolation ? ee(e.databaseIsolation) : {}, r = N(e);
+function wn(e) {
+	let t = e.accessControl ? ne(e.accessControl) : {}, n = e.databaseIsolation ? re(e.databaseIsolation) : {}, r = gt(e);
 	return {
 		...t,
 		...n,
 		tenants: r
 	};
 }
-function yt(t) {
-	let n = new e(), r = $(t);
-	return n.route("/tenants", F(t, r)), n;
+function Tn(t) {
+	let n = new e(), r = wn(t);
+	return n.route("/tenants", At(t, r)), n;
 }
-function bt(e) {
+function En(e) {
 	return {
-		hooks: $(e),
-		middleware: Q(e),
-		app: yt(e),
+		hooks: wn(e),
+		middleware: Kt(e),
+		app: Tn(e),
 		config: e,
-		wrapAdapters: (t, n) => Z(t, {
+		wrapAdapters: (t, n) => Ue(t, {
 			controlPlaneTenantId: e.accessControl?.controlPlaneTenantId,
 			controlPlaneClientId: n?.controlPlaneClientId
 		})
 	};
 }
 //#endregion
-export { gt as applyControlPlaneDefaultsPayload, ft as buildControlPlaneDefaultsPayload, A as buildEngineInstanceId, Je as compareShadow, Ae as computeLegacyConfig, E as createAccessControlHooks, st as createAccessControlMiddleware, ot as createControlPlaneTenantMiddleware, ee as createDatabaseHooks, lt as createDatabaseMiddleware, _t as createDirectRolloutAdapter, ie as createInlineExecutor, yt as createMultiTenancy, $ as createMultiTenancyHooks, Q as createMultiTenancyMiddleware, vt as createMultiTenancyPlugin, M as createOperationRecorder, Ee as createProtectSyncedMiddleware, N as createProvisioningHooks, it as createRuntimeFallbackAdapter, Ze as createShadowReporter, ct as createSubdomainMiddleware, ve as createSyncHooks, F as createTenantsOpenAPIRouter, qe as diffConfig, L as effectiveOverride, I as effectiveScope, oe as enqueueTenantOperation, j as errorToMessage, ut as initMultiTenant, re as inlineStepRunner, ne as isTerminalStatus, et as mergeClientWithFallback, Le as mergeConfig, U as projectControlPlaneDefaults, W as readConfigRows, De as resolveTenantChain, ce as runRecordedTenantOperation, bt as setupMultiTenancy, D as validateTenantAccess, Z as withRuntimeFallback, rt as withSystemResourceServerInheritance };
+export { Y as DEFAULT_ROLLOUT_SETTINGS, qt as DEFAULT_ROLLOUT_WAVES, rn as advanceRollout, an as advanceRollouts, xn as applyControlPlaneDefaultsPayload, at as applyResolvedConfigBlock, Jt as assignWaves, _n as buildControlPlaneDefaultsPayload, ae as buildEngineInstanceId, et as buildResolvedConfigBlock, ke as compareShadow, me as computeLegacyConfig, ne as createAccessControlHooks, Ut as createAccessControlMiddleware, Pe as createConfigSyncResolver, Ht as createControlPlaneTenantMiddleware, re as createDatabaseHooks, Gt as createDatabaseMiddleware, Sn as createDirectRolloutAdapter, Zt as createExpectedHash, ft as createInProcessSyncConfig, le as createInlineExecutor, Tn as createMultiTenancy, wn as createMultiTenancyHooks, Kt as createMultiTenancyMiddleware, Cn as createMultiTenancyPlugin, A as createOperationRecorder, M as createOperationRow, Vt as createProtectSyncedMiddleware, gt as createProvisioningHooks, mn as createRolloutController, pn as createRolloutWriteHooks, Ve as createRuntimeFallbackAdapter, Me as createShadowReporter, Wt as createSubdomainMiddleware, Tt as createSyncHooks, At as createTenantsOpenAPIRouter, Oe as diffConfig, H as effectiveOverride, V as effectiveScope, ue as enqueueTenantOperation, se as errorToMessage, rt as findUndecryptableKeyIds, cn as getConfigSyncStatus, hn as initMultiTenant, ce as inlineStepRunner, un as isPublishedRow, j as isTerminalStatus, Q as listRolloutOperations, Yt as listSyncedDescendants, Le as mergeClientWithFallback, Ze as mergeConfig, on as pauseRollout, en as planRollout, be as projectControlPlaneDefaults, I as readConfigRows, X as readRolloutConfig, ln as reconcileConfigDrift, dn as requestRollout, N as resolveTenantChain, sn as resumeRollout, mt as runRecordedTenantOperation, dt as runSyncDefaultsStep, En as setupMultiTenancy, ut as summarizeSyncResult, lt as syncErrors, ct as syncOptionsOf, W as syncedRowId, O as validateTenantAccess, Ue as withRuntimeFallback, Be as withSystemResourceServerInheritance };