@authhero/multi-tenancy 15.2.0 → 15.4.0

package/dist/multi-tenancy.mjs

@@ -1,9 +1,10 @@
 import { Hono as e } from "hono";
-import { LogTypes as t, MANAGEMENT_API_AUDIENCE as n, MANAGEMENT_API_SCOPES as r, auth0QuerySchema as i, brandingSchema as a, connectionInsertSchema as o, connectionOptionsSchema as s, connectionSchema as c, deepMergePatch as l, emailProviderSchema as u, escapeLuceneValue as d, fetchAll as f, hookInsertSchema as p, init as m, isInteractiveClient as h, listControlPlaneKeys as g, promptSettingSchema as _, provisionDefaultClients as v, resourceServerInsertSchema as y, tenantInsertSchema as b, tenantSchema as x } from "authhero";
-import { OpenAPIHono as S, createRoute as C, z as w } from "@hono/zod-openapi";
-import { HTTPException as T } from "hono/http-exception";
+import { LogTypes as t, MANAGEMENT_API_AUDIENCE as n, MANAGEMENT_API_SCOPES as r, TenantMemberRequestRejected as i, actionInsertSchema as a, auth0QuerySchema as o, brandingSchema as s, canDecrypt as c, connectionInsertSchema as l, connectionOptionsSchema as u, connectionSchema as d, deepMergePatch as f, emailProviderSchema as p, escapeLuceneValue as m, executeTenantMemberRequest as h, fetchAll as g, hookCodeInsertSchema as _, hookInsertSchema as v, init as y, isInteractiveClient as b, isSyncedRowId as x, listControlPlaneKeys as S, promptSettingSchema as C, provisionDefaultClients as w, resourceServerInsertSchema as T, tenantInsertSchema as E, tenantSchema as D } from "authhero";
+import { HTTPException as O } from "hono/http-exception";
+import { OpenAPIHono as k, createRoute as A, z as j } from "@hono/zod-openapi";
+import { escapeLuceneValue as ee } from "@authhero/adapter-interfaces";
 //#region src/hooks/access-control.ts
-function E(e) {
+function M(e) {
 	let { controlPlaneTenantId: t, requireOrganizationMatch: n = !0 } = e;
 	return { async onTenantAccessValidation(e, r) {
 		if (r === t) return !0;
@@ -14,14 +15,14 @@ function E(e) {
 		return !0;
 	} };
 }
-function D(e, t, n, r) {
+function N(e, t, n, r) {
 	if (t === n) return !0;
 	let i = r || e;
 	return i ? i.toLowerCase() === t.toLowerCase() : !1;
 }
 //#endregion
 //#region src/hooks/database.ts
-function ee(e) {
+function te(e) {
 	return { async resolveDataAdapters(t) {
 		try {
 			return await e.getAdapters(t);
@@ -33,18 +34,18 @@ function ee(e) {
 }
 //#endregion
 //#region src/operations/instance-id.ts
-var O = 64;
-function k(e) {
+var P = 64;
+function ne(e) {
 	return e.replace(/[^a-zA-Z0-9_-]/g, "-");
 }
-function A(e) {
-	let t = k(e.id), n = Math.max(0, O - (5 + t.length)), r = k(e.kind).slice(0, n), i = 3 + r.length + 2 + t.length, a = Math.max(0, O - i);
-	return `op-${r}-${k(e.tenant_id ?? "fleet").slice(0, a)}-${t}`.slice(0, O);
+function re(e) {
+	let t = ne(e.id), n = Math.max(0, P - (5 + t.length)), r = ne(e.kind).slice(0, n), i = 3 + r.length + 2 + t.length, a = Math.max(0, P - i);
+	return `op-${r}-${ne(e.tenant_id ?? "fleet").slice(0, a)}-${t}`.slice(0, P);
 }
 //#endregion
 //#region src/operations/recorder.ts
-var te = 2048;
-function j(e) {
+var ie = 2048;
+function F(e) {
 	let t;
 	if (e instanceof Error) t = e.message;
 	else try {
@@ -52,9 +53,9 @@ function j(e) {
 	} catch {
 		t = Object.prototype.toString.call(e);
 	}
-	return t.slice(0, te);
+	return t.slice(0, ie);
 }
-function M(e) {
+function I(e) {
 	let { tenantOperations: t, tenantOperationEvents: n } = e;
 	return {
 		async markRunning(e, n) {
@@ -75,6 +76,9 @@ function M(e) {
 				attempt: t.attempt ?? 1
 			});
 		},
+		async setResult(e, n) {
+			await t.update(e, { result: n });
+		},
 		async markSucceeded(e) {
 			await t.update(e, {
 				status: "succeeded",
@@ -85,24 +89,24 @@ function M(e) {
 		async markFailed(e, n) {
 			await t.update(e, {
 				status: "failed",
-				error: j(n),
+				error: F(n),
 				finished_at: (/* @__PURE__ */ new Date()).toISOString()
 			});
 		}
 	};
 }
-function ne(e) {
+function L(e) {
 	return e === "succeeded" || e === "failed" || e === "cancelled";
 }
 //#endregion
 //#region src/operations/inline-executor.ts
-var re = { async do(e, t, n) {
+var ae = { async do(e, t, n) {
 	let r = typeof t == "function" ? t : n;
 	if (!r) throw Error("StepRunner.do called without a function");
 	return r();
 } };
-function ie(e) {
-	let t = M(e.stores);
+function oe(e) {
+	let t = I(e.stores);
 	return {
 		engine: "inline",
 		async start(n) {
@@ -121,7 +125,7 @@ function ie(e) {
 				try {
 					let r = await e.run({
 						operation: n,
-						step: re
+						step: ae
 					});
 					await t.appendEvent(n.id, {
 						step: e.name,
@@ -132,7 +136,7 @@ function ie(e) {
 					throw await t.appendEvent(n.id, {
 						step: e.name,
 						outcome: "failed",
-						detail: { message: j(r) }
+						detail: { message: F(r) }
 					}), await t.markFailed(n.id, r), r;
 				}
 			}
@@ -142,7 +146,7 @@ function ie(e) {
 }
 //#endregion
 //#region src/operations/enqueue.ts
-async function ae(e, t, n) {
+async function se(e, t, n) {
 	let r = await e.tenantOperations.create({
 		tenant_id: t.tenant_id,
 		rollout_id: t.rollout_id,
@@ -150,13 +154,14 @@ async function ae(e, t, n) {
 		engine: n,
 		initiated_by: t.initiated_by,
 		target_worker_version: t.target_worker_version,
-		target_database_version: t.target_database_version
-	}), i = A(r);
+		target_database_version: t.target_database_version,
+		input: t.input
+	}), i = re(r);
 	try {
 		await e.tenantOperations.update(r.id, { engine_instance_id: i });
 	} catch (t) {
 		try {
-			await M(e).markFailed(r.id, t);
+			await I(e).markFailed(r.id, t);
 		} catch {}
 		throw t;
 	}
@@ -165,713 +170,633 @@ async function ae(e, t, n) {
 		engine_instance_id: i
 	};
 }
-async function oe(e, t, n) {
-	let r = M(e), i = await ae(e, n, t.engine);
+async function ce(e, t, n, r = {}) {
+	let i = I(e), a = await se(e, n, t.engine);
 	try {
-		await t.start(i);
+		await t.start(a);
 	} catch (t) {
+		let n = null;
 		try {
-			let n = await e.tenantOperations.get(i.id);
-			n && !ne(n.status) && await r.markFailed(i.id, t);
+			let r = await e.tenantOperations.get(a.id);
+			r && !L(r.status) && await i.markFailed(a.id, t), n = await e.tenantOperations.get(a.id);
 		} catch (e) {
 			console.warn("Failed to record tenant operation failure:", e);
 		}
+		if (r.returnFailed && n) return n;
 		throw t;
 	}
 	try {
-		return await e.tenantOperations.get(i.id) ?? i;
+		return await e.tenantOperations.get(a.id) ?? a;
 	} catch (e) {
-		return console.warn("Failed to re-fetch tenant operation after start:", e), i;
+		return console.warn("Failed to re-fetch tenant operation after start:", e), a;
 	}
 }
-//#endregion
-//#region src/operations/record-provision.ts
-function se(e) {
-	if (e.tenantOperations && e.tenantOperationEvents) return {
-		tenantOperations: e.tenantOperations,
-		tenantOperationEvents: e.tenantOperationEvents
-	};
-}
-async function ce(e, t, n) {
-	let r = se(e);
-	if (!r) {
-		await n(void 0);
-		return;
+async function le(e) {
+	let { tenantId: t, parentTenantId: n, getTenant: r, getChildren: i } = e, a = e.maxDepth ?? 2;
+	if (!n) return;
+	if (t && n === t) throw new O(400, { message: "A tenant cannot be its own parent" });
+	let o = new Set(t ? [t] : []), s = 0, c = n;
+	for (; c;) {
+		if (o.has(c)) throw new O(400, { message: `Setting parent_tenant_id to '${n}' would create a cycle` });
+		o.add(c);
+		let e = await r(c);
+		if (!e) throw new O(400, { message: `Parent tenant '${c}' not found` });
+		if (s += 1, s > a) throw new O(400, { message: `Tenant tree is limited to ${a} levels above a tenant` });
+		c = e.parent_tenant_id;
 	}
-	let i = M(r), a = async (e) => {
-		try {
-			await e();
-		} catch (e) {
-			console.warn("Failed to record tenant operation progress:", e);
+	if (t && i) {
+		let e = new Set([t]), r = 0, o = [t];
+		for (; o.length > 0;) {
+			let t = [];
+			for (let n of o) for (let r of await i(n)) e.has(r) || (e.add(r), t.push(r));
+			if (t.length > 0 && (r += 1, s + r > a)) throw new O(400, { message: `Moving tenant under '${n}' would make its descendant '${t[0]}' exceed the tenant tree limit of ${a} levels` });
+			o = t;
 		}
-	}, o;
-	if (await a(async () => {
-		let e = await ae(r, t, "inline");
-		o = e.id, await i.markRunning(e.id);
-	}), !o) {
-		await n(void 0);
-		return;
 	}
-	let s = o, c = !1, l = async (e, t, n) => {
-		c = !0, await a(async () => {
-			t === "started" && await i.setCurrentStep(s, e), await i.appendEvent(s, {
-				step: e,
-				outcome: t,
-				detail: n
-			});
-		});
-	};
-	try {
-		await n(l);
-	} catch (e) {
-		throw await a(async () => {
-			c || await i.appendEvent(s, {
-				step: t.kind,
-				outcome: "failed",
-				detail: { message: j(e) }
-			}), await i.markFailed(s, e);
-		}), e;
+}
+//#endregion
+//#region src/inheritance/chain.ts
+async function R(e) {
+	let { tenantId: t, getTenant: n, legacyControlPlane: r } = e, i = e.maxDepth ?? 2, a = await n(t);
+	if (!a?.parent_tenant_id) return r && r !== t ? [r] : [];
+	let o = [], s = new Set([t]), c = a.parent_tenant_id;
+	for (; c;) {
+		if (s.has(c)) throw new O(400, { message: `Tenant chain for '${t}' contains a cycle at '${c}'` });
+		if (s.add(c), o.length >= i) throw new O(400, { message: `Tenant chain for '${t}' is deeper than ${i}` });
+		let e = await n(c);
+		if (!e) break;
+		o.push(c), c = e.parent_tenant_id;
 	}
-	await a(async () => {
-		c || await i.appendEvent(s, {
-			step: t.kind,
-			outcome: "succeeded"
-		}), await i.markSucceeded(s);
-	});
+	return o;
 }
 //#endregion
-//#region src/hooks/provisioning.ts
-function le(e) {
-	return `urn:authhero:tenant:${e.toLowerCase()}`;
+//#region src/inheritance/legacy.ts
+function ue(e) {
+	let t = {};
+	for (let n of e ?? []) n.value !== void 0 && (t[n.name] = n.value);
+	return t;
 }
-function N(e) {
+function de(e, t) {
+	if (!e.inherit) return e;
+	let n = t.find((t) => t.name === e.name && t.is_system);
+	if (!n) return e;
+	let r = {
+		...ue(n.secrets),
+		...ue(e.secrets)
+	};
 	return {
-		async beforeCreate(e, t) {
-			return !t.audience && t.id ? {
-				...t,
-				audience: le(t.id)
-			} : t;
-		},
-		async afterCreate(t, i) {
-			let { accessControl: a, databaseIsolation: o } = e;
-			if (a && t.ctx && await ue(t, i, a), o?.onProvision) {
-				let e = o.onProvision;
-				o.recordProvisionOperations === !1 ? await e(i.id) : await ce(t.adapters, {
-					kind: "provision",
-					tenant_id: i.id,
-					initiated_by: t.ctx?.var.user?.sub
-				}, (t) => e(i.id, t));
-			} else try {
-				await v(t.adapters, i.id, {
-					managementApiIdentifier: n,
-					managementApiScopes: r
-				});
-			} catch (e) {
-				throw console.warn(`Failed to provision default clients for tenant ${i.id}:`, e), e;
-			}
-		},
-		async beforeDelete(t, n) {
-			let { accessControl: r, databaseIsolation: i } = e;
-			if (r) try {
-				let e = (await t.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find((e) => e.name === n);
-				e && await t.adapters.organizations.remove(r.controlPlaneTenantId, e.id);
-			} catch (e) {
-				console.warn(`Failed to remove organization for tenant ${n}:`, e);
-			}
-			if (i?.onDeprovision) try {
-				await i.onDeprovision(n);
-			} catch (e) {
-				console.warn(`Failed to deprovision database for tenant ${n}:`, e);
-			}
-		}
+		...e,
+		code: n.code,
+		secrets: Object.entries(r).map(([e, t]) => ({
+			name: e,
+			value: t
+		}))
 	};
 }
-async function ue(e, t, n) {
-	let { controlPlaneTenantId: r, defaultPermissions: i, defaultRoles: a, issuer: o, adminRoleName: s = "Tenant Admin", adminRoleDescription: c = "Full access to all tenant management operations", addCreatorToOrganization: l = !0 } = n, u = await e.adapters.organizations.create(r, {
-		name: t.id,
-		display_name: t.friendly_name || t.id
-	}), d;
-	if (o && (d = await fe(e, r, s, c)), l && e.ctx) {
-		let t = e.ctx.var.user;
-		if (t?.sub && !await de(e, r, t.sub)) try {
-			await e.adapters.userOrganizations.create(r, {
-				user_id: t.sub,
-				organization_id: u.id
-			}), d && await e.adapters.userRoles.create(r, t.sub, d, u.id);
-		} catch (e) {
-			console.warn(`Failed to add creator ${t.sub} to organization ${u.id}:`, e);
-		}
-	}
-	a && a.length > 0 && console.log(`Would assign roles ${a.join(", ")} to organization ${u.id}`), i && i.length > 0 && console.log(`Would grant permissions ${i.join(", ")} to organization ${u.id}`);
+function fe(e, t) {
+	if (!t) return e;
+	let n = new Set(e.hooks.map((e) => e.hook_id)), r = t.hooks.filter((e) => He(e) && !n.has(e.hook_id));
+	return {
+		connections: e.connections.map((e) => Ne(e, t.connections)),
+		resourceServers: e.resourceServers.map((e) => e.is_system ? Ie(e, t.resourceServers.find((t) => t.id === e.id) ?? null) : e),
+		hooks: [...e.hooks, ...r],
+		hookCode: e.hookCode,
+		actions: e.actions.map((e) => de(e, t.actions)),
+		emailProvider: e.emailProvider ?? t.emailProvider,
+		branding: e.branding,
+		promptSettings: e.promptSettings
+	};
 }
-async function de(e, t, r) {
-	let i = await e.adapters.userRoles.list(t, r, void 0, "");
-	for (let r of i) if ((await e.adapters.rolePermissions.list(t, r.id, { per_page: 1e3 })).some((e) => e.permission_name === "admin:organizations" && e.resource_server_identifier === n)) return !0;
-	return !1;
+//#endregion
+//#region src/rollout/defaults-projection.ts
+function pe(e = {}) {
+	return {
+		connections: e.connections ?? !0,
+		resourceServers: e.resourceServers ?? !0,
+		hooks: e.hooks ?? !0,
+		emailProvider: e.emailProvider ?? !0,
+		branding: e.branding ?? !0,
+		promptSettings: e.promptSettings ?? !0
+	};
 }
-async function fe(e, t, i, a) {
-	let o = (await e.adapters.roles.list(t, {})).roles.find((e) => e.name === i);
-	if (o) return o.id;
-	let s = await e.adapters.roles.create(t, {
-		name: i,
-		description: a
-	}), c = n, l = r.map((e) => ({
-		role_id: s.id,
-		resource_server_identifier: c,
-		permission_name: e.value
-	}));
-	return await e.adapters.rolePermissions.assign(t, s.id, l), s.id;
+function z() {
+	return {
+		upserted: 0,
+		errors: []
+	};
 }
-//#endregion
-//#region src/hooks/sync.ts
-function pe(e, t, n = () => !0) {
-	let { controlPlaneTenantId: r, getChildTenantIds: i, getAdapters: a } = e, o = /* @__PURE__ */ new Map();
-	async function s(e, n, r) {
-		return (await t(e).list(n, {
-			q: `name:${d(r)}`,
-			per_page: 1
-		}))[0] ?? null;
-	}
-	async function c(e) {
-		let n = await i(), o = t(await a(r));
-		await Promise.all(n.map(async (n) => {
-			try {
-				let r = await a(n), i = t(r), c = {
-					...o.transform(e),
-					is_system: !0
-				}, l = await s(r, n, e.name), u = l ? i.getId(l) : void 0;
-				if (l && u) {
-					let e = i.preserveOnUpdate ? i.preserveOnUpdate(l, c) : c;
-					await i.update(n, u, e);
-				} else await i.create(n, c);
-			} catch (t) {
-				console.error(`Failed to sync ${o.listKey} "${e.name}" to tenant "${n}":`, t);
-			}
-		}));
-	}
-	async function l(e) {
-		let n = await i();
-		await Promise.all(n.map(async (n) => {
-			try {
-				let r = await a(n), i = t(r), o = await s(r, n, e), c = o ? i.getId(o) : void 0;
-				o && c && await i.remove(n, c);
-			} catch (t) {
-				console.error(`Failed to delete entity "${e}" from tenant "${n}":`, t);
-			}
-		}));
-	}
+function me(e) {
 	return {
-		afterCreate: async (e, t) => {
-			e.tenantId === r && n(t) && await c(t);
-		},
-		afterUpdate: async (e, t, i) => {
-			e.tenantId === r && n(i) && await c(i);
-		},
-		beforeDelete: async (e, i) => {
-			if (e.tenantId !== r) return;
-			let a = await t(e.adapters).get(e.tenantId, i);
-			a && n(a) && o.set(i, a);
-		},
-		afterDelete: async (e, t) => {
-			if (e.tenantId !== r) return;
-			let n = o.get(t);
-			n && (o.delete(t), await l(n.name));
-		}
+		tenantId: e,
+		connections: z(),
+		resourceServers: z(),
+		hooks: z(),
+		emailProvider: z(),
+		branding: z(),
+		promptSettings: z()
 	};
 }
-function me(e, t, n = () => !0) {
-	let { controlPlaneTenantId: r, getControlPlaneAdapters: i, getAdapters: a } = e;
-	return { async afterCreate(e, o) {
-		if (o.id !== r) try {
-			let e = await i(), s = await a(o.id), c = t(e), l = t(s), u = await f((e) => c.listPaginated(r, e), c.listKey, {
-				cursorField: "id",
-				pageSize: 100
-			});
-			await Promise.all(u.filter((e) => n(e)).map(async (e) => {
-				try {
-					let t = c.transform(e);
-					await l.create(o.id, {
-						...t,
-						is_system: !0
-					});
-				} catch (e) {
-					console.error(`Failed to sync entity to new tenant "${o.id}":`, e);
-				}
-			}));
-		} catch (e) {
-			console.error(`Failed to sync entities to new tenant "${o.id}":`, e);
-		}
-	} };
+function he(e) {
+	let t = e.metadata;
+	return !!(t && t.inheritable === !0);
 }
-var he = (e) => ({
-	list: async (t, n) => (await e.resourceServers.list(t, n)).resource_servers,
-	listPaginated: (t, n) => e.resourceServers.list(t, n),
-	get: (t, n) => e.resourceServers.get(t, n),
-	create: (t, n) => e.resourceServers.create(t, n),
-	update: (t, n, r) => e.resourceServers.update(t, n, r),
-	remove: (t, n) => e.resourceServers.remove(t, n),
-	listKey: "resource_servers",
-	getId: (e) => e.id,
-	transform: (e) => ({
-		id: e.id,
-		name: e.name,
-		identifier: e.identifier,
-		scopes: e.scopes,
-		signing_alg: e.signing_alg,
-		token_lifetime: e.token_lifetime,
-		token_lifetime_for_web: e.token_lifetime_for_web
-	})
-}), ge = (e) => ({
-	list: async (t, n) => (await e.roles.list(t, n)).roles,
-	listPaginated: (t, n) => e.roles.list(t, n),
-	get: (t, n) => e.roles.get(t, n),
-	create: (t, n) => e.roles.create(t, n),
-	update: (t, n, r) => e.roles.update(t, n, r),
-	remove: (t, n) => e.roles.remove(t, n),
-	listKey: "roles",
-	getId: (e) => e.id,
-	transform: (e) => ({
-		id: e.id,
-		name: e.name,
-		description: e.description
-	})
-});
-function _e(e) {
-	return e.metadata?.sync !== !1;
+async function B(e, t, n, r) {
+	try {
+		await r();
+	} catch (r) {
+		let i = `${t}: ${r instanceof Error ? r.message : String(r)}`;
+		if (!n) throw Error(i, { cause: r });
+		e.errors.push(i);
+	}
 }
-function ve(e) {
-	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => _e(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => _e(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? pe(e, he, a) : void 0, c = i ? pe(e, ge, o) : void 0, l = r ? me(e, he, a) : void 0, u = i ? me(e, ge, o) : void 0, p = i ? { async afterCreate(t, r) {
-		if (r.id !== e.controlPlaneTenantId) {
-			await u?.afterCreate?.(t, r);
-			try {
-				let t = await e.getControlPlaneAdapters(), i = await e.getAdapters(r.id), a = await f((n) => t.roles.list(e.controlPlaneTenantId, n), "roles", {
-					cursorField: "id",
-					pageSize: 100
-				}), o = /* @__PURE__ */ new Map();
-				for (let e of a.filter((e) => n.roles?.(e) ?? !0)) {
-					let t = await m(i, r.id, e.name);
-					t && o.set(e.name, t.id);
-				}
-				for (let s of a.filter((e) => n.roles?.(e) ?? !0)) {
-					let n = o.get(s.name);
-					if (n) try {
-						let a = await t.rolePermissions.list(e.controlPlaneTenantId, s.id, {});
-						a.length > 0 && await i.rolePermissions.assign(r.id, n, a.map((e) => ({
-							role_id: n,
-							resource_server_identifier: e.resource_server_identifier,
-							permission_name: e.permission_name
-						})));
-					} catch (e) {
-						console.error(`Failed to sync permissions for role "${s.name}" to tenant "${r.id}":`, e);
-					}
-				}
-			} catch (e) {
-				console.error(`Failed to sync role permissions to tenant "${r.id}":`, e);
-			}
-		}
-	} } : void 0;
-	async function m(e, t, n) {
-		return (await e.roles.list(t, {
-			q: `name:${d(n)}`,
-			per_page: 1
-		})).roles[0] ?? null;
+async function ge(e, t, n) {
+	return {
+		connections: n.connections ? await g((n) => e.connections.list(t, n), "connections", {
+			cursorField: "id",
+			pageSize: 100
+		}) : [],
+		resourceServers: n.resourceServers ? await g((n) => e.resourceServers.list(t, n), "resource_servers", {
+			cursorField: "id",
+			pageSize: 100
+		}) : [],
+		hooks: n.hooks ? await g((n) => e.hooks.list(t, n), "hooks", {
+			cursorField: "hook_id",
+			pageSize: 100
+		}) : [],
+		emailProvider: n.emailProvider ? await e.emailProviders.get(t) ?? null : null,
+		branding: n.branding ? await e.branding.get(t) ?? null : null,
+		promptSettings: n.promptSettings ? await e.promptSettings.get(t) ?? null : null
+	};
+}
+async function _e(e, t, n, r, i, a) {
+	if (r.connections) for (let r of e.connections) {
+		let e = r.id;
+		e && await B(a.connections, `connection ${e}`, i, async () => {
+			let i = l.parse(r);
+			await t.connections.get(n, e) ? await t.connections.update(n, e, i) : await t.connections.create(n, i), a.connections.upserted += 1;
+		});
+	}
+	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await B(a.resourceServers, `resource_server ${r.id}`, i, async () => {
+		let e = T.parse(r);
+		await t.resourceServers.get(n, r.id) ? await t.resourceServers.update(n, r.id, e) : await t.resourceServers.create(n, e), a.resourceServers.upserted += 1;
+	});
+	if (r.hooks) for (let r of e.hooks) !he(r) || !r.hook_id || await B(a.hooks, `hook ${r.hook_id}`, i, async () => {
+		let e = v.parse(r);
+		await t.hooks.get(n, r.hook_id) ? await t.hooks.update(n, r.hook_id, e) : await t.hooks.create(n, e), a.hooks.upserted += 1;
+	});
+	r.emailProvider && e.emailProvider && await B(a.emailProvider, "email_provider", i, async () => {
+		let r = e.emailProvider;
+		await t.emailProviders.get(n) ? await t.emailProviders.update(n, r) : await t.emailProviders.create(n, r), a.emailProvider.upserted += 1;
+	}), r.branding && e.branding && await B(a.branding, "branding", i, async () => {
+		await t.branding.set(n, e.branding), a.branding.upserted += 1;
+	}), r.promptSettings && e.promptSettings && await B(a.promptSettings, "prompt_settings", i, async () => {
+		await t.promptSettings.set(n, e.promptSettings), a.promptSettings.upserted += 1;
+	});
+}
+async function ve(e, t) {
+	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = pe(a), c = await ge(await r(), n, s), l = await i(t), u = me(t);
+	return await _e(c, l, n, s, o, u), u;
+}
+//#endregion
+//#region src/inheritance/read.ts
+async function V(e, t) {
+	let n = await ge(e, t, {
+		connections: !0,
+		resourceServers: !0,
+		hooks: !0,
+		emailProvider: !0,
+		branding: !0,
+		promptSettings: !0
+	}), r = await g((n) => e.actions.list(t, n), "actions", {
+		cursorField: "id",
+		pageSize: 100
+	}), i = new Set(r.map((e) => e.id)), a = /* @__PURE__ */ new Set();
+	for (let e of n.hooks) {
+		let t = e.code_id;
+		t && !i.has(t) && a.add(t);
+	}
+	let o = [];
+	for (let n of a) {
+		let r = await e.hookCode.get(t, n);
+		r && o.push(r);
 	}
 	return {
-		entityHooks: {
-			resourceServers: s,
-			roles: c
-		},
-		tenantHooks: { async afterCreate(e, t) {
-			let n = [l?.afterCreate, p?.afterCreate ?? u?.afterCreate], r = [];
-			for (let i of n) if (i) try {
-				await i(e, t);
-			} catch (e) {
-				r.push(e instanceof Error ? e : Error(String(e)));
-			}
-			if (r.length === 1) throw r[0];
-			if (r.length > 1) throw AggregateError(r, r.map((e) => e.message).join("; "));
-		} }
+		...n,
+		actions: r,
+		hookCode: o
 	};
 }
 //#endregion
-//#region src/middleware/request-data.ts
-function P(e) {
-	return e.var.data ?? e.env.data;
+//#region src/inheritance/shadow.ts
+var ye = /secret|password|private_key|api_key|token/i, be = new Set([
+	"id",
+	"tenant_id",
+	"created_at",
+	"updated_at",
+	"scope",
+	"override",
+	"enforce",
+	"enabled_clients"
+]);
+async function H(e) {
+	let t = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
+	return [...new Uint8Array(t)].map((e) => e.toString(16).padStart(2, "0")).join("").slice(0, 16);
 }
-async function ye(e) {
-	let { tenantId: t, parentTenantId: n, getTenant: r, getChildren: i } = e, a = e.maxDepth ?? 2;
-	if (!n) return;
-	if (t && n === t) throw new T(400, { message: "A tenant cannot be its own parent" });
-	let o = new Set(t ? [t] : []), s = 0, c = n;
-	for (; c;) {
-		if (o.has(c)) throw new T(400, { message: `Setting parent_tenant_id to '${n}' would create a cycle` });
-		o.add(c);
-		let e = await r(c);
-		if (!e) throw new T(400, { message: `Parent tenant '${c}' not found` });
-		if (s += 1, s > a) throw new T(400, { message: `Tenant tree is limited to ${a} levels above a tenant` });
-		c = e.parent_tenant_id;
+async function xe(e, t = "") {
+	if (Array.isArray(e)) {
+		if (t === "secrets") {
+			let t = {};
+			for (let n of e) t[n.name] = n.value === void 0 ? null : `sha256:${await H(n.value)}`;
+			return t;
+		}
+		return Promise.all(e.map((e) => xe(e, t)));
 	}
-	if (t && i) {
-		let e = new Set([t]), r = 0, o = [t];
-		for (; o.length > 0;) {
-			let t = [];
-			for (let n of o) for (let r of await i(n)) e.has(r) || (e.add(r), t.push(r));
-			if (t.length > 0 && (r += 1, s + r > a)) throw new T(400, { message: `Moving tenant under '${n}' would make its descendant '${t[0]}' exceed the tenant tree limit of ${a} levels` });
-			o = t;
+	if (e && typeof e == "object") {
+		let t = {};
+		for (let n of Object.keys(e).sort()) {
+			let r = e[n];
+			r != null && (t[n] = typeof r == "string" && ye.test(n) ? `sha256:${await H(r)}` : await xe(r, n));
 		}
+		return t;
 	}
+	return e;
 }
-//#endregion
-//#region src/routes/tenants.ts
-var be = w.object({
-	sub: w.string(),
-	tenant_id: w.string().optional(),
-	org_id: w.string().optional(),
-	scope: w.string().optional(),
-	permissions: w.array(w.string()).optional()
-}).passthrough();
-function xe(e) {
-	let t = be.safeParse(e);
-	return t.success ? t.data : void 0;
+async function Se(e) {
+	let t = {};
+	for (let [n, r] of Object.entries(e)) be.has(n) || (t[n] = r);
+	return await xe(t);
 }
-function Se(e) {
-	let t = e.permissions ?? [], n = e.scope ? e.scope.split(" ").filter(Boolean) : [], r = new Set([...t, ...n]);
-	return r.has("delete:tenants") || r.has("admin:organizations");
+var Ce = {
+	connection: (e) => `${e.strategy}:${e.name}`,
+	resourceServer: (e) => e.identifier,
+	hook: (e) => e.hook_id,
+	action: (e) => e.name
+}, we = new Set([
+	"connection",
+	"resourceServer",
+	"action",
+	"emailProvider",
+	"branding",
+	"promptSettings"
+]);
+async function Te(e) {
+	let t = /* @__PURE__ */ new Map(), n = async (e, n, r) => {
+		let i = t.get(e) ?? /* @__PURE__ */ new Map();
+		i.set(n, await Se(r)), t.set(e, i);
+	};
+	for (let [t, r] of Object.entries(Ce)) {
+		let i = e[{
+			connection: "connections",
+			resourceServer: "resourceServers",
+			hook: "hooks",
+			action: "actions"
+		}[t]];
+		for (let e of i) await n(t, r(e), e);
+	}
+	for (let t of [
+		"emailProvider",
+		"branding",
+		"promptSettings"
+	]) e[t] && await n(t, "singleton", e[t]);
+	return t;
 }
-function F(e, t) {
-	let n = new S();
-	return n.openapi(C({
-		tags: ["tenants"],
-		method: "get",
-		path: "/",
-		request: { query: i },
-		security: [{ Bearer: [] }],
-		responses: { 200: {
-			content: { "application/json": { schema: w.object({
-				tenants: w.array(x),
-				start: w.number().optional(),
-				limit: w.number().optional(),
-				length: w.number().optional(),
-				total: w.number().optional()
-			}) } },
-			description: "List of tenants"
-		} }
-	}), async (t) => {
-		let { page: n, per_page: r, include_totals: i, q: a } = t.req.valid("query"), o = t.var.user, s = o?.permissions || [];
-		if (!(o?.org_id ?? t.var.organization_id) && s.includes("admin:organizations")) {
-			let e = await P(t).tenants.list({
-				page: n,
-				per_page: r,
-				include_totals: i,
-				q: a
+async function Ee(e, t) {
+	let [n, r] = await Promise.all([Te(e), Te(t)]), i = [], a = new Set([...n.keys(), ...r.keys()]);
+	for (let e of a) {
+		let t = n.get(e) ?? /* @__PURE__ */ new Map(), a = r.get(e) ?? /* @__PURE__ */ new Map();
+		for (let n of new Set([...t.keys(), ...a.keys()])) {
+			let r = t.get(n), o = a.get(n);
+			if (r && !o) i.push({
+				entity: e,
+				key: n,
+				kind: "missing",
+				fields: [],
+				expected: !1
 			});
-			return i ? t.json({
-				tenants: e.tenants,
-				start: e.totals?.start ?? 0,
-				limit: e.totals?.limit ?? r,
-				length: e.tenants.length,
-				total: e.totals?.length
-			}) : t.json({ tenants: e.tenants });
-		}
-		let c = e.accessControl?.controlPlaneTenantId ?? P(t).multiTenancyConfig?.controlPlaneTenantId;
-		if (c && !o?.sub) throw new T(403, { message: "Access denied: token has no subject" });
-		if (c && o?.sub) {
-			let e = (await f((e) => P(t).userOrganizations.listUserOrganizations(c, o.sub, e), "organizations")).map((e) => e.name);
-			if (e.length === 0) return i ? t.json({
-				tenants: [],
-				start: 0,
-				limit: r ?? 50,
-				length: 0,
-				total: 0
-			}) : t.json({ tenants: [] });
-			let s = e.length, l = n ?? 0, u = r ?? 50, d = l * u, p = e.slice(d, d + u);
-			if (p.length === 0) return i ? t.json({
-				tenants: [],
-				start: d,
-				limit: u,
-				length: 0,
-				total: s
-			}) : t.json({ tenants: [] });
-			let m = p.map((e) => `id:${e}`).join(" OR "), h = a ? `(${m}) AND (${a})` : m, g = await P(t).tenants.list({
-				q: h,
-				per_page: u,
-				include_totals: !1
+			else if (!r && o) i.push({
+				entity: e,
+				key: n,
+				kind: "extra",
+				fields: [],
+				expected: we.has(e)
 			});
-			return i ? t.json({
-				tenants: g.tenants,
-				start: d,
-				limit: u,
-				length: g.tenants.length,
-				total: s
-			}) : t.json({ tenants: g.tenants });
-		}
-		let l = await P(t).tenants.list({
-			page: n,
-			per_page: r,
-			include_totals: i,
-			q: a
-		});
-		return i ? t.json({
-			tenants: l.tenants,
-			start: l.totals?.start ?? 0,
-			limit: l.totals?.limit ?? r,
-			length: l.tenants.length,
-			total: l.totals?.length
-		}) : t.json({ tenants: l.tenants });
-	}), n.openapi(C({
-		tags: ["tenants"],
-		method: "post",
-		path: "/",
-		request: { body: { content: { "application/json": { schema: b } } } },
-		security: [{ Bearer: [] }],
-		responses: {
-			201: {
-				content: { "application/json": { schema: x } },
-				description: "Tenant created"
-			},
-			400: { description: "Validation error" },
-			409: { description: "Tenant with this ID already exists" }
-		}
-	}), async (e) => {
-		if (!e.var.user?.sub) throw new T(401, { message: "Authentication required to create tenants" });
-		let n = e.req.valid("json"), r = {
-			adapters: P(e),
-			ctx: e
-		};
-		t.tenants?.beforeCreate && (n = await t.tenants.beforeCreate(r, n)), await ye({
-			tenantId: n.id,
-			parentTenantId: n.parent_tenant_id,
-			getTenant: (t) => P(e).tenants.get(t)
-		});
-		let i = await P(e).tenants.create(n);
-		return t.tenants?.afterCreate && await t.tenants.afterCreate(r, i), e.json(i, 201);
-	}), n.openapi(C({
-		tags: ["tenants"],
-		method: "delete",
-		path: "/{id}",
-		request: { params: w.object({ id: w.string() }) },
-		security: [{ Bearer: ["delete:tenants"] }],
-		responses: {
-			204: { description: "Tenant deleted" },
-			403: { description: "Access denied or cannot delete the control plane" },
-			404: { description: "Tenant not found" }
-		}
-	}), async (n) => {
-		let { id: r } = n.req.valid("param"), i = e.accessControl?.controlPlaneTenantId ?? P(n).multiTenancyConfig?.controlPlaneTenantId;
-		if (i) {
-			let e = xe(n.var.user);
-			if (!e?.sub) throw new T(401, { message: "Authentication required" });
-			if (r === i) throw new T(403, { message: "Cannot delete the control plane" });
-			let t = n.var.org_name, a = r.toLowerCase(), o = !!t && t.toLowerCase() === a;
-			if (!o) {
-				let r = !!(e.org_id ?? n.var.organization_id ?? t), a = !e.tenant_id || e.tenant_id === i;
-				!r && a && Se(e) && (o = !0);
-			}
-			if (o ||= (await f((t) => P(n).userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new T(403, { message: "Access denied to this tenant" });
-		}
-		if (!await P(n).tenants.get(r)) throw new T(404, { message: "Tenant not found" });
-		let a = {
-			adapters: P(n),
-			ctx: n
-		};
-		return t.tenants?.beforeDelete && await t.tenants.beforeDelete(a, r), await P(n).tenants.remove(r), t.tenants?.afterDelete && await t.tenants.afterDelete(a, r), n.body(null, 204);
-	}), n.openapi(C({
-		tags: ["tenants", "settings"],
-		method: "get",
-		path: "/settings",
-		request: { headers: w.object({ "tenant-id": w.string().optional() }) },
-		security: [{ Bearer: ["read:tenants"] }],
-		responses: { 200: {
-			content: { "application/json": { schema: x } },
-			description: "Current tenant settings"
-		} }
-	}), async (e) => {
-		let t = await P(e).tenants.get(e.var.tenant_id);
-		if (!t) throw new T(404, { message: "Tenant not found" });
-		return e.json(t);
-	}), n.openapi(C({
-		tags: ["tenants", "settings"],
-		method: "patch",
-		path: "/settings",
-		request: {
-			headers: w.object({ "tenant-id": w.string().optional() }),
-			body: { content: { "application/json": { schema: w.object(b.shape).partial() } } }
-		},
-		security: [{ Bearer: ["update:tenants"] }],
-		responses: { 200: {
-			content: { "application/json": { schema: x } },
-			description: "Updated tenant settings"
-		} }
-	}), async (e) => {
-		let { id: t, ...n } = e.req.valid("json"), r = await P(e).tenants.get(e.var.tenant_id);
-		if (!r) throw new T(404, { message: "Tenant not found" });
-		if ("default_client_id" in n) {
-			let t = n.default_client_id;
-			if (typeof t == "string" && t.length > 0) {
-				let n = await P(e).clients.get(e.var.tenant_id, t);
-				if (!n) throw new T(400, { message: `Client with id '${t}' not found` });
-				if (!h(n)) throw new T(400, { message: `Client '${t}' is not an interactive client and cannot be used as the default client` });
+			else if (r && o) {
+				let t = JSON.stringify(r), a = JSON.stringify(o);
+				if (t === a) continue;
+				let s = [...new Set([...Object.keys(r), ...Object.keys(o)])].filter((e) => JSON.stringify(r[e]) !== JSON.stringify(o[e])).sort();
+				i.push({
+					entity: e,
+					key: n,
+					kind: "changed",
+					fields: s,
+					expected: !1,
+					legacy_hash: await H(t),
+					new_hash: await H(a)
+				});
 			}
 		}
-		"parent_tenant_id" in n && await ye({
-			tenantId: e.var.tenant_id,
-			parentTenantId: n.parent_tenant_id,
-			getTenant: (t) => P(e).tenants.get(t),
-			getChildren: async (t) => (await f((t) => P(e).tenants.list(t), "tenants")).filter((e) => e.parent_tenant_id === t).map((e) => e.id)
-		});
-		let i = l(r, n);
-		await P(e).tenants.update(e.var.tenant_id, i);
-		let a = await P(e).tenants.get(e.var.tenant_id);
-		if (!a) throw new T(500, { message: "Failed to retrieve updated tenant" });
-		return e.json(a);
-	}), n;
+	}
+	return i;
+}
+async function De(e) {
+	let { adapters: t, tenantId: n, legacyControlPlane: r } = e, i = await R({
+		tenantId: n,
+		getTenant: (e) => t.tenants.get(e),
+		legacyControlPlane: r,
+		maxDepth: e.maxDepth
+	}), a = await V(t, n), o = await Promise.all(i.map((e) => V(t, e))), s = r && r !== n ? await V(t, r) : void 0, { hidden: c, ...l } = $e(o, a), u = new Set(c);
+	return (await Ee(fe(a, s), l)).filter((e) => !u.has(`${e.entity}:${e.key}`));
 }
 //#endregion
-//#region src/middleware/protect-synced.ts
-function Ce(e) {
-	for (let { pattern: t, type: n } of [
-		{
-			pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
-			type: "resource_server"
-		},
-		{
-			pattern: /\/api\/v2\/roles\/([^/]+)$/,
-			type: "role"
-		},
-		{
-			pattern: /\/api\/v2\/connections\/([^/]+)$/,
-			type: "connection"
+//#region src/inheritance/report.ts
+var Oe = 3600 * 1e3, ke = 1e4;
+function Ae(e, t) {
+	let n = t.sample ?? 1, r = t.intervalMs ?? 6e4, i = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Set(), o = /* @__PURE__ */ new Map();
+	async function s(n, r) {
+		let i = await De({
+			adapters: e,
+			tenantId: n,
+			legacyControlPlane: r
+		}), a = Date.now();
+		o.size > ke && o.clear();
+		for (let s of i) {
+			if (s.expected && !t.includeExpected) continue;
+			let i = await H([
+				n,
+				s.entity,
+				s.key,
+				s.kind,
+				s.fields.join(",")
+			].join("|")), c = o.get(i);
+			c !== void 0 && a - c < Oe || (o.set(i, a), await je(e, n, s, r));
 		}
-	]) {
-		let r = e.match(t);
-		if (r && r[1]) return {
-			type: n,
-			id: r[1]
-		};
 	}
-	return null;
+	return { schedule(e, t) {
+		if (a.has(e) || n < 1 && Math.random() >= n) return;
+		let o = Date.now(), c = i.get(e);
+		if (!(c !== void 0 && o - c < r)) return i.set(e, o), a.add(e), s(e, t).catch(() => {}).finally(() => a.delete(e));
+	} };
 }
-async function we(e, t, n) {
-	try {
-		switch (n.type) {
-			case "resource_server": return (await e.resourceServers.get(t, n.id))?.is_system === !0;
-			case "role": return (await e.roles.get(t, n.id))?.is_system === !0;
-			case "connection": return (await e.connections.get(t, n.id))?.is_system === !0;
-			default: return !1;
+async function je(e, n, r, i) {
+	await e.logs.create(n, {
+		type: t.CONFIG_INHERITANCE_DIFF,
+		date: (/* @__PURE__ */ new Date()).toISOString(),
+		isMobile: !1,
+		description: `${r.kind} ${r.entity} ${r.key}`,
+		details: {
+			shadow: "config-inheritance",
+			legacy_control_plane: i,
+			...r
 		}
-	} catch {
-		return !1;
-	}
+	});
 }
-function Te(e) {
+function Me(e) {
+	let { base: t, getTenant: n, controlPlaneTenantId: r } = e, i = e.ttlMs ?? 1e4, a = e.maxEntries ?? 1e3, o = /* @__PURE__ */ new Map();
+	async function s(e) {
+		if (e === r) return !1;
+		let t = o.get(e), s = Date.now();
+		if (t && t.expires > s) return t.synced;
+		try {
+			let t = await n(e), r = t?.config_sync === "synced" || t?.config_sync === "detached";
+			return o.size >= a && o.clear(), o.set(e, {
+				synced: r,
+				expires: s + i
+			}), r;
+		} catch {
+			return !1;
+		}
+	}
 	return {
-		resource_server: "resource server",
-		role: "role",
-		connection: "connection"
-	}[e];
-}
-function Ee() {
-	return async (e, t) => {
-		if (![
-			"PATCH",
-			"PUT",
-			"DELETE"
-		].includes(e.req.method)) return t();
-		let n = Ce(e.req.path);
-		if (!n) return t();
-		let r = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
-		if (!r) return t();
-		if (await we(P(e), r, n)) throw new T(403, { message: `This ${Te(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
-		return t();
+		isSynced: s,
+		invalidate(e) {
+			e ? o.delete(e) : o.clear();
+		},
+		async resolve({ tenant_id: e }) {
+			let n = await t(e);
+			return !n || n.tenantId === e ? n : await s(e) ? void 0 : n;
+		}
 	};
 }
 //#endregion
-//#region src/inheritance/chain.ts
-async function De(e) {
-	let { tenantId: t, getTenant: n, legacyControlPlane: r } = e, i = e.maxDepth ?? 2, a = await n(t);
-	if (!a?.parent_tenant_id) return r && r !== t ? [r] : [];
-	let o = [], s = new Set([t]), c = a.parent_tenant_id;
-	for (; c;) {
-		if (s.has(c)) throw new T(400, { message: `Tenant chain for '${t}' contains a cycle at '${c}'` });
-		if (s.add(c), o.length >= i) throw new T(400, { message: `Tenant chain for '${t}' is deeper than ${i}` });
-		let e = await n(c);
-		if (!e) break;
-		o.push(c), c = e.parent_tenant_id;
-	}
-	return o;
+//#region src/middleware/settings-inheritance.ts
+function Ne(e, t) {
+	let n = t.find((t) => t.strategy === e.strategy);
+	if (!n?.options) return e;
+	let r = d.passthrough().parse({
+		...n,
+		...e
+	});
+	return r.options = u.passthrough().parse({
+		...n.options || {},
+		...e.options
+	}), r;
 }
-//#endregion
-//#region src/inheritance/legacy.ts
-function Oe(e) {
-	let t = {};
-	for (let n of e ?? []) n.value !== void 0 && (t[n.name] = n.value);
-	return t;
+function Pe(e, t) {
+	let n = [...t || [], ...e || []];
+	return [...new Set(n)];
 }
-function ke(e, t) {
-	if (!e.inherit) return e;
-	let n = t.find((t) => t.name === e.name && t.is_system);
-	if (!n) return e;
-	let r = {
-		...Oe(n.secrets),
-		...Oe(e.secrets)
+function Fe(e, t) {
+	if (!t?.length) return e || [];
+	if (!e?.length) return t;
+	let n = /* @__PURE__ */ new Map();
+	for (let e of t) n.set(e.value, e);
+	for (let t of e) n.set(t.value, t);
+	return Array.from(n.values());
+}
+function Ie(e, t) {
+	return t ? {
+		...e,
+		scopes: Fe(e.scopes, t.scopes)
+	} : e;
+}
+function Le(e, t) {
+	return t ? {
+		...e,
+		callbacks: Pe(e.callbacks, t.callbacks),
+		web_origins: Pe(e.web_origins, t.web_origins),
+		allowed_logout_urls: Pe(e.allowed_logout_urls, t.allowed_logout_urls),
+		allowed_origins: Pe(e.allowed_origins, t.allowed_origins)
+	} : e;
+}
+function Re(e) {
+	let { controlPlaneTenantId: t, controlPlaneClientId: n, resolveControlPlane: r } = e;
+	if (r) return async (e) => r({ tenant_id: e });
+	if (!t) return async () => void 0;
+	let i = {
+		tenantId: t,
+		clientId: n
 	};
+	return async () => i;
+}
+function ze(e, t) {
 	return {
-		...e,
-		code: n.code,
-		secrets: Object.entries(r).map(([e, t]) => ({
-			name: e,
-			value: t
-		}))
+		...e.resourceServers,
+		get: async (n, r) => {
+			let i = await e.resourceServers.get(n, r);
+			if (!i) return i;
+			let a = await t(n);
+			return !a || n === a.tenantId || !i.is_system ? i : Ie(i, await e.resourceServers.get(a.tenantId, r));
+		},
+		list: async (n, r) => {
+			let i = await e.resourceServers.list(n, r), a = await t(n);
+			if (!a || n === a.tenantId) return i;
+			let o = a.tenantId, s = i.resource_servers.filter((e) => !!(e.is_system && e.id)).map((e) => e.id);
+			if (s.length === 0) return i;
+			let c = /* @__PURE__ */ new Map();
+			await Promise.all(s.map(async (t) => {
+				let n = await e.resourceServers.get(o, t);
+				n && c.set(t, n);
+			}));
+			let l = i.resource_servers.map((e) => e.is_system && e.id ? Ie(e, c.get(e.id) ?? null) : e);
+			return {
+				...i,
+				resource_servers: l
+			};
+		}
 	};
 }
-function Ae(e, t) {
-	if (!t) return e;
-	let n = new Set(e.hooks.map((e) => e.hook_id)), r = t.hooks.filter((e) => X(e) && !n.has(e.hook_id));
+function Be(e, t) {
+	let n = Re({
+		controlPlaneTenantId: t.controlPlaneTenantId,
+		resolveControlPlane: t.resolveControlPlane
+	});
 	return {
-		connections: e.connections.map((e) => q(e, t.connections)),
-		resourceServers: e.resourceServers.map((e) => e.is_system ? Y(e, t.resourceServers.find((t) => t.id === e.id) ?? null) : e),
-		hooks: [...e.hooks, ...r],
-		actions: e.actions.map((e) => ke(e, t.actions)),
-		emailProvider: e.emailProvider ?? t.emailProvider,
-		branding: e.branding,
-		promptSettings: e.promptSettings
+		...e,
+		resourceServers: ze(e, n)
 	};
 }
-//#endregion
-//#region src/inheritance/types.ts
-var je = () => ({
-	connections: [],
-	resourceServers: [],
-	hooks: [],
-	actions: [],
+function Ve(e, t) {
+	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i, inheritanceShadow: a } = t, o = t.configSync ?? Me({
+		base: Re({
+			controlPlaneTenantId: n,
+			controlPlaneClientId: r,
+			resolveControlPlane: i
+		}),
+		getTenant: async (t) => await e.tenants.get(t) ?? null,
+		controlPlaneTenantId: n
+	}), s = (e) => o.resolve({ tenant_id: e }), c = a ? Ae(e, a === !0 ? {} : a) : void 0, l = c ? async (e) => {
+		let t = await s(e);
+		return await o.isSynced(e) || c.schedule(e, t?.tenantId), t;
+	} : s;
+	return {
+		...e,
+		multiTenancyConfig: {
+			controlPlaneTenantId: n,
+			controlPlaneClientId: r,
+			resolveControlPlane: o.resolve
+		},
+		connections: {
+			...e.connections,
+			get: async (t, n) => {
+				let r = await e.connections.get(t, n);
+				if (!r) return r;
+				let i = await l(t);
+				return !i || t === i.tenantId ? r : Ne(r, (await e.connections.list(i.tenantId)).connections || []);
+			},
+			list: async (t, n) => {
+				let r = await e.connections.list(t, n), i = await l(t);
+				if (!i || t === i.tenantId) return r;
+				let a = await e.connections.list(i.tenantId), o = r.connections.map((e) => Ne(e, a.connections || []));
+				return {
+					...r,
+					connections: o
+				};
+			}
+		},
+		clientConnections: {
+			...e.clientConnections,
+			listByClient: async (t, n) => {
+				let r = await e.clientConnections.listByClient(t, n);
+				r.length === 0 && (r = (await e.connections.list(t)).connections || []);
+				let i = await l(t);
+				if (!i || t === i.tenantId) return r;
+				let a = await e.connections.list(i.tenantId);
+				return r.map((e) => Ne(e, a.connections || []));
+			}
+		},
+		emailProviders: {
+			...e.emailProviders,
+			get: async (t) => {
+				let n = await e.emailProviders.get(t);
+				if (n) return n;
+				let r = await l(t);
+				return !r || t === r.tenantId ? null : e.emailProviders.get(r.tenantId);
+			}
+		},
+		resourceServers: ze(e, l),
+		hooks: Ue(e, l)
+	};
+}
+function He(e) {
+	if (!e || typeof e != "object") return !1;
+	let t = e.metadata;
+	return !t || typeof t != "object" ? !1 : t.inheritable === !0;
+}
+function Ue(e, t) {
+	return {
+		...e.hooks,
+		list: async (n, r) => {
+			let i = await e.hooks.list(n, r), a = await t(n);
+			if (!a || n === a.tenantId) return i;
+			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(He);
+			if (o.length === 0) return i;
+			let s = new Set((i.hooks || []).map((e) => e.hook_id)), c = [];
+			for (let e of o) s.has(e.hook_id) || e.hook_id && s.has(await it("hook", n, e.hook_id)) || c.push(e);
+			return {
+				...i,
+				hooks: [...i.hooks || [], ...c],
+				length: typeof i.length == "number" ? i.length + c.length : i.length
+			};
+		},
+		get: async (n, r) => {
+			let i = await e.hooks.get(n, r);
+			if (i) return i;
+			let a = await t(n);
+			if (!a || n === a.tenantId) return i;
+			let o = await e.hooks.get(a.tenantId, r);
+			return o && He(o) ? o : null;
+		}
+	};
+}
+function We(e, t) {
+	return Ve(e, t);
+}
+//#endregion
+//#region src/inheritance/types.ts
+var Ge = () => ({
+	connections: [],
+	resourceServers: [],
+	hooks: [],
+	hookCode: [],
+	actions: [],
 	emailProvider: null,
 	branding: null,
 	promptSettings: null
 });
 //#endregion
 //#region src/inheritance/merge.ts
-function I(e, t) {
+function U(e, t) {
 	if (t.scope) return t.scope;
 	switch (e) {
 		case "connection":
 		case "emailProvider": return "shared";
 		case "resourceServer":
 		case "action": return t.is_system ? "shared" : "local";
-		case "hook": return X(t) ? "shared" : "local";
+		case "hook": return He(t) ? "shared" : "local";
 		default: return "local";
 	}
 }
-function L(e) {
+function Ke(e) {
 	return e.override ?? "fields";
 }
-var Me = /secret|password|private_key|api_key|token/i;
-function Ne(e, t) {
+var qe = /secret|password|private_key|api_key|token/i;
+function Je(e, t) {
 	let n = { ...e ?? {} };
-	for (let [e, r] of Object.entries(t ?? {})) Me.test(e) && (n[e] = r);
+	for (let [e, r] of Object.entries(t ?? {})) qe.test(e) && (n[e] = r);
 	return n;
 }
-function R(e, t) {
-	switch (L(e)) {
+function Ye(e, t) {
+	switch (Ke(e)) {
 		case "none": return {
 			...e,
 			id: t.id
@@ -879,7 +804,7 @@ function R(e, t) {
 		case "secrets": return {
 			...e,
 			id: t.id,
-			options: Ne(e.options, t.options)
+			options: Je(e.options, t.options)
 		};
 		default: return {
 			...e,
@@ -891,8 +816,8 @@ function R(e, t) {
 		};
 	}
 }
-function Pe(e, t) {
-	switch (L(e)) {
+function Xe(e, t) {
+	switch (Ke(e)) {
 		case "none": return {
 			...e,
 			id: t.id
@@ -904,46 +829,46 @@ function Pe(e, t) {
 		};
 		default: return {
 			...t,
-			scopes: $e(t.scopes, e.scopes)
+			scopes: Fe(t.scopes, e.scopes)
 		};
 	}
 }
-function Fe(e) {
+function Ze(e) {
 	return new Map((e ?? []).map((e) => [e.name, e]));
 }
-function Ie(e, t) {
-	let n = L(e);
+function Qe(e, t) {
+	let n = Ke(e);
 	if (n === "none") return {
 		...e,
 		id: t.id
 	};
-	let r = Fe(e.secrets);
-	if (n === "secrets" || n === "fields") for (let [e, n] of Fe(t.secrets)) r.set(e, n);
+	let r = Ze(e.secrets);
+	if (n === "secrets" || n === "fields") for (let [e, n] of Ze(t.secrets)) r.set(e, n);
 	return {
 		...n === "fields" && !t.inherit ? t : e,
 		id: t.id,
 		secrets: [...r.values()]
 	};
 }
-function Le(e, t) {
+function $e(e, t) {
 	let n = /* @__PURE__ */ new Set(), r = [...e].reverse().concat(t), i = (e, t, r, i) => r ? t : t.filter((t) => {
-		let r = I(e, t);
+		let r = U(e, t);
 		return r === "local" ? !1 : (r === "platform" && n.add(`${e}:${i(t)}`), !0);
-	}), a = je(), o = (e) => `${e.strategy}:${e.name}`, s = (e) => e.identifier, c = (e) => e.hook_id ?? "", l = (e) => e.name, u = /* @__PURE__ */ new Map(), d = [], f = /* @__PURE__ */ new Map(), p = /* @__PURE__ */ new Map(), m = /* @__PURE__ */ new Map();
+	}), a = Ge(), o = (e) => `${e.strategy}:${e.name}`, s = (e) => e.identifier, c = (e) => e.hook_id ?? "", l = (e) => e.name, u = /* @__PURE__ */ new Map(), d = [], f = /* @__PURE__ */ new Map(), p = /* @__PURE__ */ new Map(), m = /* @__PURE__ */ new Map();
 	r.forEach((e, t) => {
 		let h = t === r.length - 1;
 		for (let t of i("connection", e.connections, h, o)) {
 			let e = u.get(t.strategy);
-			h ? d.push(e ? R(e, t) : t) : u.set(t.strategy, e ? R(e, t) : t);
+			h ? d.push(e ? Ye(e, t) : t) : u.set(t.strategy, e ? Ye(e, t) : t);
 		}
 		for (let t of i("resourceServer", e.resourceServers, h, s)) {
 			let e = f.get(s(t));
-			f.set(s(t), e ? Pe(e, t) : t);
+			f.set(s(t), e ? Xe(e, t) : t);
 		}
 		for (let t of i("hook", e.hooks, h, c)) p.set(c(t), t);
 		for (let t of i("action", e.actions, h, l)) {
 			let e = m.get(l(t));
-			m.set(l(t), e ? Ie(e, t) : t);
+			m.set(l(t), e ? Qe(e, t) : t);
 		}
 		for (let t of [
 			"emailProvider",
@@ -951,485 +876,1662 @@ function Le(e, t) {
 			"promptSettings"
 		]) {
 			let r = e[t];
-			r && (h || I(t, r) !== "local") && (!h && I(t, r) === "platform" && n.add(`${t}:singleton`), a[t] = r);
+			r && (h || U(t, r) !== "local") && (!h && U(t, r) === "platform" && n.add(`${t}:singleton`), a[t] = r);
 		}
 	});
 	let h = new Set(r[r.length - 1].connections.map((e) => e.strategy));
-	return a.connections = [...d, ...[...u.values()].filter((e) => !h.has(e.strategy))], a.resourceServers = [...f.values()], a.hooks = [...p.values()], a.actions = [...m.values()], {
+	a.connections = [...d, ...[...u.values()].filter((e) => !h.has(e.strategy))], a.resourceServers = [...f.values()], a.hooks = [...p.values()];
+	let g = new Set(a.hooks.map((e) => e.code_id).filter((e) => !!e)), _ = /* @__PURE__ */ new Map();
+	for (let e of [...r].reverse()) for (let t of e.hookCode) g.has(t.id) && !_.has(t.id) && _.set(t.id, t);
+	return a.hookCode = [..._.values()], a.actions = [...m.values()], {
 		...a,
 		hidden: [...n]
 	};
 }
 //#endregion
-//#region src/rollout/defaults-projection.ts
-function z(e = {}) {
-	return {
-		connections: e.connections ?? !0,
-		resourceServers: e.resourceServers ?? !0,
-		hooks: e.hooks ?? !0,
-		emailProvider: e.emailProvider ?? !0,
-		branding: e.branding ?? !0,
-		promptSettings: e.promptSettings ?? !0
-	};
+//#region src/rollout/resolved-sync.ts
+var et = [
+	"connection",
+	"resourceServer",
+	"hookCode",
+	"action",
+	"hook"
+];
+function tt(e) {
+	return Array.isArray(e) ? `[${e.map(tt).join(",")}]` : e && typeof e == "object" ? `{${Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : 1).map(([e, t]) => `${JSON.stringify(e)}:${tt(t)}`).join(",")}}` : JSON.stringify(e) ?? "null";
+}
+async function nt(e) {
+	let t = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
+	return [...new Uint8Array(t)].map((e) => e.toString(16).padStart(2, "0")).join("");
+}
+var rt = {
+	connection: "con_",
+	resourceServer: "api_",
+	hook: "h_",
+	hookCode: "hc_",
+	action: "act_"
+};
+async function it(e, t, n) {
+	let r = await nt(`${t}|${e}|${n}`);
+	return `${rt[e]}sy${r.slice(0, 15)}`;
+}
+function W(e, t) {
+	let n = t;
+	switch (e) {
+		case "connection": return `${n.strategy}:${n.name}`;
+		case "resourceServer": return n.identifier;
+		case "action": return n.name;
+		case "hookCode": return n.id;
+		case "hook": return n.hook_id;
+	}
 }
-function B() {
+async function at(e, t, n = {}) {
+	let r = await R({
+		tenantId: t,
+		getTenant: (t) => e.tenants.get(t),
+		legacyControlPlane: n.legacyControlPlane,
+		maxDepth: n.maxDepth
+	}), i = $e(await Promise.all(r.map((t) => V(e, t))), Ge()), a = {
+		version: 1,
+		chain: r,
+		connections: i.connections,
+		resourceServers: i.resourceServers,
+		hookCode: i.hookCode,
+		actions: i.actions,
+		hooks: i.hooks,
+		emailProvider: i.emailProvider,
+		branding: i.branding,
+		promptSettings: i.promptSettings,
+		hidden: i.hidden,
+		deletes: n.deletes ?? []
+	};
 	return {
-		upserted: 0,
-		errors: []
+		...a,
+		hash: await nt(tt(a))
 	};
 }
-function Re(e) {
-	return {
-		tenantId: e,
-		connections: B(),
-		resourceServers: B(),
-		hooks: B(),
-		emailProvider: B(),
-		branding: B(),
-		promptSettings: B()
+function ot(e, t) {
+	if (typeof e == "string") e.startsWith("enc:v1:") && t.add(e);
+	else if (Array.isArray(e)) for (let n of e) ot(n, t);
+	else if (e && typeof e == "object") for (let n of Object.values(e)) ot(n, t);
+}
+function st(e) {
+	let t = e.slice(7), n = t.indexOf(":");
+	return n === -1 ? "default" : t.slice(0, n);
+}
+async function ct(e, t) {
+	let n = /* @__PURE__ */ new Set();
+	ot(e, n);
+	let r = /* @__PURE__ */ new Set();
+	for (let e of n) await c(e, t) || r.add(st(e));
+	return [...r].sort();
+}
+var G = () => ({
+	added: 0,
+	changed: 0,
+	unchanged: 0,
+	deleted: 0,
+	errors: []
+}), lt = (e) => tt(e);
+async function ut(e, t, n, r = {}) {
+	let { dryRun: i = !1, continueOnError: o = !0 } = r;
+	if (r.prune && e.chain.length === 0) throw Error(`Cannot prune '${n}': the block resolved no ancestors, so every synced copy would look stale. Nothing was written.`);
+	let c = {
+		status: i ? "dry-run" : "applied",
+		hash: e.hash,
+		entities: {
+			connection: G(),
+			resourceServer: G(),
+			hookCode: G(),
+			action: G(),
+			hook: G(),
+			emailProvider: G(),
+			branding: G(),
+			promptSettings: G()
+		},
+		changes: [],
+		rows: []
+	}, u = await t.tenants.get(n), d = !!r.deletes && e.deletes.length > 0;
+	if (!i && !r.force && !d && !r.prune && u?.config_sync_hash === e.hash) return {
+		...c,
+		status: "up-to-date"
+	};
+	if (r.keyRing) {
+		let t = await ct(e, r.keyRing);
+		if (t.length > 0) throw Error(`Cannot sync config to '${n}': its key ring cannot decrypt key id(s) ${t.map((e) => `"${e}"`).join(", ")} carried by the payload. Nothing was written.`);
+	}
+	let f = await V(t, n), m = (i || r.prune) && e.chain.length > 0 ? f : null, h = {
+		connection: /* @__PURE__ */ new Set(),
+		resourceServer: /* @__PURE__ */ new Set(),
+		action: /* @__PURE__ */ new Set()
+	};
+	for (let e of f.connections) x(e.id) || h.connection.add(W("connection", e));
+	for (let e of f.resourceServers) x(e.id) || h.resourceServer.add(W("resourceServer", e));
+	for (let e of f.actions) x(e.id) || h.action.add(W("action", e));
+	let y = async (e, t, n) => {
+		let r = c.entities[e];
+		try {
+			let i = await n();
+			r[i] += 1, i !== "unchanged" && (c.changes.push(`${e}:${t}`), c.rows.push({
+				entity: e,
+				key: t,
+				action: i
+			}));
+		} catch (n) {
+			let i = `${e} ${t}: ${n instanceof Error ? n.message : String(n)}`;
+			if (!o) throw Error(i, { cause: n });
+			r.errors.push(i);
+		}
+	}, b = async (e) => e.existing ? lt(e.view(e.existing)) === lt(e.view(e.desired)) ? "unchanged" : (i || await e.update(), "changed") : (i || await e.create(), "added"), S = (e, t) => it(e, n, t), w = /* @__PURE__ */ new Map();
+	for (let t of e.hookCode) w.set(t.id, await S("hookCode", W("hookCode", t)));
+	for (let t of e.actions) w.set(t.id, await S("action", W("action", t)));
+	let E, D = async (e) => {
+		if (!E) {
+			E = [];
+			let e = await g((e) => t.clients.list(n, e), "clients", {
+				cursorField: "client_id",
+				pageSize: 100
+			});
+			for (let r of e) (await t.clientConnections.listByClient(n, r.client_id)).length > 0 && E.push(r.client_id);
+		}
+		for (let r of E) await t.clientConnections.addClientToConnection(n, e, r);
+	}, O = (e, t) => h[e].has(t) ? (c.changes.push(`skip ${e}:${t} (the tenant has its own)`), c.rows.push({
+		entity: e,
+		key: t,
+		action: "skipped"
+	}), !0) : !1;
+	for (let r of e.connections) {
+		let e = W("connection", r), i = await S("connection", e);
+		await y("connection", e, async () => {
+			if (O("connection", e)) return "unchanged";
+			let { enabled_clients: a, ...o } = r, s = l.parse({
+				...o,
+				id: i
+			}), c = await t.connections.get(n, i);
+			return b({
+				existing: c ? l.parse(c) : null,
+				desired: s,
+				create: async () => {
+					await t.connections.create(n, s);
+					try {
+						await D(i);
+					} catch (e) {
+						throw await t.connections.remove(n, i).catch(() => {}), e;
+					}
+				},
+				update: () => t.connections.update(n, i, s),
+				view: (e) => e
+			});
+		});
+	}
+	for (let r of e.resourceServers) {
+		let e = W("resourceServer", r), i = await S("resourceServer", e);
+		await y("resourceServer", e, async () => {
+			if (O("resourceServer", e)) return "unchanged";
+			let a = T.parse({
+				...r,
+				id: i
+			}), o = await t.resourceServers.get(n, i);
+			return b({
+				existing: o ? T.parse(o) : null,
+				desired: a,
+				create: () => t.resourceServers.create(n, a),
+				update: () => t.resourceServers.update(n, i, a),
+				view: (e) => e
+			});
+		});
+	}
+	for (let r of e.hookCode) {
+		let e = W("hookCode", r), i = w.get(r.id);
+		await y("hookCode", e, async () => {
+			let e = _.parse(r), a = await t.hookCode.get(n, i);
+			return b({
+				existing: a ? _.parse(a) : null,
+				desired: e,
+				create: () => t.hookCode.create(n, e, { importMetadata: { id: i } }),
+				update: () => t.hookCode.update(n, i, e),
+				view: (e) => e
+			});
+		});
+	}
+	for (let r of e.actions) {
+		let e = W("action", r), i = w.get(r.id);
+		await y("action", e, async () => {
+			if (O("action", e)) return "unchanged";
+			let o = a.parse(r), s = await t.actions.get(n, i);
+			return b({
+				existing: s ? a.parse(s) : null,
+				desired: o,
+				create: () => t.actions.create(n, o, { importMetadata: { id: i } }),
+				update: () => t.actions.update(n, i, o),
+				view: (e) => e
+			});
+		});
+	}
+	for (let r of e.hooks) {
+		let e = W("hook", r), i = await S("hook", e);
+		await y("hook", e, async () => {
+			let e = r.code_id, a = v.parse({
+				...r,
+				hook_id: i,
+				...e ? { code_id: w.get(e) ?? e } : {}
+			}), o = await t.hooks.get(n, i);
+			return b({
+				existing: o ? v.parse(o) : null,
+				desired: a,
+				create: () => t.hooks.create(n, a),
+				update: () => t.hooks.update(n, i, a),
+				view: (e) => e
+			});
+		});
+	}
+	let k = (e) => e.override === "none" || e.enforce === !0, A = (e, t, n) => lt(e.parse(t)) === lt(n), j = (e, t) => {
+		let n = { ...t };
+		for (let [t, r] of Object.entries(e)) r != null && n[t] === void 0 && (n[t] = null);
+		return n;
 	};
+	e.emailProvider && await y("emailProvider", "singleton", async () => {
+		let r = p.parse(e.emailProvider), a = await t.emailProviders.get(n);
+		if (!a) return i || await t.emailProviders.create(n, r), "added";
+		if (!k(r) || A(p, a, r)) return "unchanged";
+		if (!i) {
+			let e = p.parse(a);
+			await t.emailProviders.update(n, j(e, r));
+		}
+		return "changed";
+	}), e.branding && await y("branding", "singleton", async () => {
+		let r = s.parse(e.branding), a = await t.branding.get(n);
+		if (!a) return i || await t.branding.set(n, r), "added";
+		if (!k(r) || A(s, a, r)) return "unchanged";
+		if (!i) {
+			let e = s.parse(a), i = j(e, r);
+			e.colors && !r.colors && (i.colors = { primary: null }), e.font && !r.font && (i.font = { url: null }), await t.branding.set(n, i);
+		}
+		return "changed";
+	}), e.promptSettings && k(e.promptSettings) && await y("promptSettings", "singleton", async () => {
+		let r = C.parse(e.promptSettings);
+		return A(C, await t.promptSettings.get(n), r) ? "unchanged" : (i || await t.promptSettings.set(n, r), "changed");
+	});
+	for (let a of e.deletes) {
+		let e = await S(a.entity, a.key), o = `${a.entity}:${a.key}`;
+		try {
+			if (!await pt(t, n, a.entity, e)) continue;
+			c.changes.push(`delete ${o}`), c.rows.push({
+				entity: a.entity,
+				key: a.key,
+				action: "delete"
+			}), r.deletes && !i && (await mt(t, n, a.entity, e), c.entities[a.entity].deleted += 1);
+		} catch (e) {
+			c.entities[a.entity].errors.push(`delete ${o}: ${e instanceof Error ? e.message : e}`);
+		}
+	}
+	let ee = () => Object.values(c.entities).some((e) => e.errors.length > 0);
+	if (m && !ee()) {
+		let a = /* @__PURE__ */ new Set();
+		for (let t of et) for (let n of dt(e, t)) (t === "connection" || t === "resourceServer" || t === "action") && h[t].has(W(t, n)) || a.add(t === "hookCode" || t === "action" ? w.get(n.id) : await S(t, W(t, n)));
+		for (let e of ft(m, a)) {
+			let a = `${e.entity}:${e.label}`;
+			try {
+				c.changes.push(`delete ${a}`), c.rows.push({
+					entity: e.entity,
+					key: e.label,
+					action: "delete"
+				}), r.prune && !i && (await mt(t, n, e.entity, e.id), c.entities[e.entity].deleted += 1);
+			} catch (t) {
+				c.entities[e.entity].errors.push(`delete ${a}: ${t instanceof Error ? t.message : t}`);
+			}
+		}
+	}
+	let M = ee();
+	return !i && !M && u && await t.tenants.update(n, {
+		config_sync_hash: e.hash,
+		config_synced_at: (/* @__PURE__ */ new Date()).toISOString()
+	}), c;
+}
+function dt(e, t) {
+	switch (t) {
+		case "connection": return e.connections;
+		case "resourceServer": return e.resourceServers;
+		case "hookCode": return e.hookCode;
+		case "action": return e.actions;
+		case "hook": return e.hooks;
+	}
 }
-function ze(e) {
-	let t = e.metadata;
-	return !!(t && t.inheritable === !0);
+function ft(e, t) {
+	let n = (e) => !!e && x(e) && !t.has(e);
+	return [
+		...e.hooks.filter((e) => n(e.hook_id)).map((e) => ({
+			entity: "hook",
+			id: e.hook_id,
+			label: e.hook_id
+		})),
+		...e.actions.filter((e) => n(e.id)).map((e) => ({
+			entity: "action",
+			id: e.id,
+			label: e.name
+		})),
+		...e.hookCode.filter((e) => n(e.id)).map((e) => ({
+			entity: "hookCode",
+			id: e.id,
+			label: e.id
+		})),
+		...e.connections.filter((e) => n(e.id)).map((e) => ({
+			entity: "connection",
+			id: e.id,
+			label: `${e.strategy}:${e.name}`
+		})),
+		...e.resourceServers.filter((e) => n(e.id)).map((e) => ({
+			entity: "resourceServer",
+			id: e.id,
+			label: e.identifier
+		}))
+	];
+}
+async function pt(e, t, n, r) {
+	switch (n) {
+		case "connection": return !!await e.connections.get(t, r);
+		case "resourceServer": return !!await e.resourceServers.get(t, r);
+		case "hookCode": return !!await e.hookCode.get(t, r);
+		case "action": return !!await e.actions.get(t, r);
+		case "hook": return !!await e.hooks.get(t, r);
+	}
 }
-async function V(e, t, n, r) {
-	try {
-		await r();
-	} catch (r) {
-		let i = `${t}: ${r instanceof Error ? r.message : String(r)}`;
-		if (!n) throw Error(i, { cause: r });
-		e.errors.push(i);
+async function mt(e, t, n, r) {
+	switch (n) {
+		case "connection":
+			await e.connections.remove(t, r);
+			return;
+		case "resourceServer":
+			await e.resourceServers.remove(t, r);
+			return;
+		case "hookCode":
+			await e.hookCode.remove(t, r);
+			return;
+		case "action":
+			await e.actions.remove(t, r);
+			return;
+		case "hook":
+			await e.hooks.remove(t, r);
+			return;
 	}
 }
-async function H(e, t, n) {
+//#endregion
+//#region src/operations/sync-defaults.ts
+function ht(e) {
+	let t = e.input ?? {};
 	return {
-		connections: n.connections ? await f((n) => e.connections.list(t, n), "connections", {
-			cursorField: "id",
-			pageSize: 100
-		}) : [],
-		resourceServers: n.resourceServers ? await f((n) => e.resourceServers.list(t, n), "resource_servers", {
-			cursorField: "id",
-			pageSize: 100
-		}) : [],
-		hooks: n.hooks ? await f((n) => e.hooks.list(t, n), "hooks", {
-			cursorField: "hook_id",
-			pageSize: 100
-		}) : [],
-		emailProvider: n.emailProvider ? await e.emailProviders.get(t) ?? null : null,
-		branding: n.branding ? await e.branding.get(t) ?? null : null,
-		promptSettings: n.promptSettings ? await e.promptSettings.get(t) ?? null : null
+		dryRun: t.dry_run === !0,
+		force: t.force === !0,
+		prune: t.prune === !0
 	};
 }
-async function Be(e, t, n, r, i, a) {
-	if (r.connections) for (let r of e.connections) {
-		let e = r.id;
-		e && await V(a.connections, `connection ${e}`, i, async () => {
-			let i = o.parse(r);
-			await t.connections.get(n, e) ? await t.connections.update(n, e, i) : await t.connections.create(n, i), a.connections.upserted += 1;
-		});
+function gt(e) {
+	return Object.values(e.entities).flatMap((e) => e.errors);
+}
+var _t = 20, vt = 300;
+function yt(e, t) {
+	return {
+		dry_run: t.dryRun,
+		prune: t.prune,
+		status: e.status,
+		hash: e.hash,
+		changes: e.changes,
+		rows: e.rows ?? [],
+		error_messages: gt(e).slice(0, _t).map((e) => e.slice(0, vt)),
+		entities: Object.fromEntries(Object.entries(e.entities).map(([e, t]) => [e, {
+			added: t.added,
+			changed: t.changed,
+			unchanged: t.unchanged,
+			deleted: t.deleted,
+			errors: t.errors.length
+		}]))
+	};
+}
+async function bt(e) {
+	let { operation: t, syncConfig: n, recorder: r } = e;
+	if (!t.tenant_id) throw Error("sync-defaults operations require a tenant_id");
+	let i = ht(t), a = await n(t.tenant_id, i), o = yt(a, i);
+	await r.setResult(t.id, o);
+	let s = gt(a);
+	if (s.length > 0) {
+		let e = s.slice(0, 3).join("; ");
+		throw Error(`sync-defaults reported ${s.length} error(s): ${e}${s.length > 3 ? "; ..." : ""}`);
 	}
-	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await V(a.resourceServers, `resource_server ${r.id}`, i, async () => {
-		let e = y.parse(r);
-		await t.resourceServers.get(n, r.id) ? await t.resourceServers.update(n, r.id, e) : await t.resourceServers.create(n, e), a.resourceServers.upserted += 1;
-	});
-	if (r.hooks) for (let r of e.hooks) !ze(r) || !r.hook_id || await V(a.hooks, `hook ${r.hook_id}`, i, async () => {
-		let e = p.parse(r);
-		await t.hooks.get(n, r.hook_id) ? await t.hooks.update(n, r.hook_id, e) : await t.hooks.create(n, e), a.hooks.upserted += 1;
-	});
-	r.emailProvider && e.emailProvider && await V(a.emailProvider, "email_provider", i, async () => {
-		let r = e.emailProvider;
-		await t.emailProviders.get(n) ? await t.emailProviders.update(n, r) : await t.emailProviders.create(n, r), a.emailProvider.upserted += 1;
-	}), r.branding && e.branding && await V(a.branding, "branding", i, async () => {
-		await t.branding.set(n, e.branding), a.branding.upserted += 1;
-	}), r.promptSettings && e.promptSettings && await V(a.promptSettings, "prompt_settings", i, async () => {
-		await t.promptSettings.set(n, e.promptSettings), a.promptSettings.upserted += 1;
-	});
+	return o;
 }
-async function U(e, t) {
-	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = z(a), c = await H(await r(), n, s), l = await i(t), u = Re(t);
-	return await Be(c, l, n, s, o, u), u;
+function xt(e, t) {
+	return async (n, r) => {
+		let i = await e.tenants.get(n);
+		if (!i) throw Error(`Tenant "${n}" not found`);
+		if (i.config_sync === "detached") throw Error(`Tenant "${n}" is detached from its parent: set config_sync back to "inherit-on-read" or "synced" before syncing it`);
+		if (i.deployment_type === "wfp") throw Error(`Tenant "${n}" has its own database: configure a dispatch sync (syncDefaults) for it`);
+		return ut(await at(e, n, {
+			legacyControlPlane: (t.resolveControlPlane ? await t.resolveControlPlane({ tenant_id: n }) : { tenantId: t.controlPlaneTenantId })?.tenantId,
+			maxDepth: t.maxDepth
+		}), e, n, {
+			dryRun: r.dryRun,
+			force: r.force,
+			prune: r.prune
+		});
+	};
 }
 //#endregion
-//#region src/inheritance/read.ts
-async function W(e, t) {
-	let n = await H(e, t, {
-		connections: !0,
-		resourceServers: !0,
-		hooks: !0,
-		emailProvider: !0,
-		branding: !0,
-		promptSettings: !0
-	}), r = await f((n) => e.actions.list(t, n), "actions", {
-		cursorField: "id",
-		pageSize: 100
-	});
+//#region src/operations/detach.ts
+function St(e) {
+	let t = e.input ?? {};
 	return {
-		...n,
-		actions: r
+		dryRun: t.dry_run === !0,
+		clean: t.clean === !0
 	};
 }
-//#endregion
-//#region src/inheritance/shadow.ts
-var Ve = /secret|password|private_key|api_key|token/i, He = new Set([
-	"id",
-	"tenant_id",
-	"created_at",
-	"updated_at",
-	"scope",
-	"override",
-	"enforce",
-	"enabled_clients"
-]);
-async function G(e) {
-	let t = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
-	return [...new Uint8Array(t)].map((e) => e.toString(16).padStart(2, "0")).join("").slice(0, 16);
+var Ct = 20, wt = 300;
+function Tt(e) {
+	return Object.entries(e.entities).flatMap(([e, t]) => t.errors.map((t) => `${e} ${t}`));
 }
-async function K(e, t = "") {
-	if (Array.isArray(e)) {
-		if (t === "secrets") {
-			let t = {};
-			for (let n of e) t[n.name] = n.value === void 0 ? null : `sha256:${await G(n.value)}`;
-			return t;
-		}
-		return Promise.all(e.map((e) => K(e, t)));
+function Et(e, t) {
+	return {
+		dry_run: t.dryRun,
+		clean: t.clean,
+		status: e.status,
+		changes: e.changes,
+		rows: e.rows ?? [],
+		error_messages: Tt(e).slice(0, Ct).map((e) => e.slice(0, wt)),
+		entities: Object.fromEntries(Object.entries(e.entities).map(([e, t]) => [e, {
+			converted: t.converted,
+			removed: t.removed,
+			skipped: t.skipped,
+			errors: t.errors.length
+		}]))
+	};
+}
+async function Dt(e) {
+	let { operation: t, detachTenant: n, recorder: r, onDetached: i } = e;
+	if (!t.tenant_id) throw Error("detach operations require a tenant_id");
+	let a = St(t), o = await n(t.tenant_id, a), s = Et(o, a);
+	await r.setResult(t.id, s);
+	let c = Tt(o);
+	if (c.length === 0 && !a.dryRun && o.status === "detached" && i?.(t.tenant_id), c.length > 0) {
+		let e = c.slice(0, 3).join("; ");
+		throw Error(`detach reported ${c.length} error(s): ${e}${c.length > 3 ? "; ..." : ""}`);
 	}
-	if (e && typeof e == "object") {
-		let t = {};
-		for (let n of Object.keys(e).sort()) {
-			let r = e[n];
-			r != null && (t[n] = typeof r == "string" && Ve.test(n) ? `sha256:${await G(r)}` : await K(r, n));
+	return s;
+}
+var K = () => ({
+	converted: 0,
+	removed: 0,
+	skipped: 0,
+	errors: []
+});
+function q(e) {
+	let { id: t, hook_id: n, scope: r, override: i, enforce: a, ...o } = e;
+	return o;
+}
+function Ot(e) {
+	return {
+		status: e,
+		changes: [],
+		rows: [],
+		entities: {
+			connection: K(),
+			resourceServer: K(),
+			hookCode: K(),
+			action: K(),
+			hook: K()
 		}
-		return t;
-	}
-	return e;
+	};
 }
-async function Ue(e) {
-	let t = {};
-	for (let [n, r] of Object.entries(e)) He.has(n) || (t[n] = r);
-	return await K(t);
+function kt(e, t) {
+	if (t.config_sync !== "synced") throw Error(`Tenant "${e}" is not synced: sync its parent's config into it (config_sync "synced") before detaching, otherwise it would lose what it inherits`);
 }
-var We = {
-	connection: (e) => `${e.strategy}:${e.name}`,
-	resourceServer: (e) => e.identifier,
-	hook: (e) => e.hook_id,
-	action: (e) => e.name
-}, Ge = new Set([
-	"connection",
-	"resourceServer",
-	"action",
-	"emailProvider",
-	"branding",
-	"promptSettings"
-]);
-async function Ke(e) {
-	let t = /* @__PURE__ */ new Map(), n = async (e, n, r) => {
-		let i = t.get(e) ?? /* @__PURE__ */ new Map();
-		i.set(n, await Ue(r)), t.set(e, i);
-	};
-	for (let [t, r] of Object.entries(We)) {
-		let i = e[{
-			connection: "connections",
-			resourceServer: "resourceServers",
-			hook: "hooks",
-			action: "actions"
-		}[t]];
-		for (let e of i) await n(t, r(e), e);
-	}
-	for (let t of [
-		"emailProvider",
-		"branding",
-		"promptSettings"
-	]) e[t] && await n(t, "singleton", e[t]);
-	return t;
+async function At(e, t) {
+	await e.tenants.update(t, {
+		parent_tenant_id: null,
+		config_sync: "detached",
+		config_sync_hash: null,
+		config_synced_at: null
+	});
 }
-async function qe(e, t) {
-	let [n, r] = await Promise.all([Ke(e), Ke(t)]), i = [], a = new Set([...n.keys(), ...r.keys()]);
-	for (let e of a) {
-		let t = n.get(e) ?? /* @__PURE__ */ new Map(), a = r.get(e) ?? /* @__PURE__ */ new Map();
-		for (let n of new Set([...t.keys(), ...a.keys()])) {
-			let r = t.get(n), o = a.get(n);
-			if (r && !o) i.push({
-				entity: e,
-				key: n,
-				kind: "missing",
-				fields: [],
-				expected: !1
+async function jt(e, t, n) {
+	let r = Ot(n.dryRun ? "dry-run" : "detached"), { dryRun: i, clean: o } = n, s = await V(e, t), c = {
+		connection: s.connections.filter((e) => x(e.id)),
+		resourceServer: s.resourceServers.filter((e) => x(e.id)),
+		hookCode: s.hookCode.filter((e) => x(e.id)),
+		action: s.actions.filter((e) => x(e.id)),
+		hook: s.hooks.filter((e) => x(e.hook_id))
+	}, u = (e) => e.scope === "platform", d = /* @__PURE__ */ new Set();
+	for (let e of c.hook) {
+		let t = e.code_id;
+		u(e) && t && d.add(t);
+	}
+	for (let e of c.action) u(e) && d.add(e.id);
+	let f = (e, t, n, i = "") => {
+		r.changes.push(`${t} ${e}:${n}${i}`), r.rows.push({
+			entity: e,
+			key: n,
+			action: t === "convert" ? "converted" : t === "remove" ? "removed" : "kept"
+		});
+	}, p = async (e, t, n) => {
+		try {
+			await n();
+		} catch (n) {
+			r.entities[e].errors.push(`${t}: ${n instanceof Error ? n.message : String(n)}`);
+		}
+	}, m = (e, t) => {
+		r.entities[e].skipped += 1, f(e, "skip", t, " (platform: stays a copy)");
+	}, h = [];
+	if (o) {
+		let n = async (n) => {
+			for (let r of await e.clientConnections.listByConnection(t, n)) await e.clientConnections.removeClientFromConnection(t, n, r);
+		}, a = [
+			...c.hook.map((n) => [
+				"hook",
+				n.hook_id,
+				() => e.hooks.remove(t, n.hook_id)
+			]),
+			...c.action.map((n) => [
+				"action",
+				n.name,
+				() => e.actions.remove(t, n.id)
+			]),
+			...c.hookCode.map((n) => [
+				"hookCode",
+				n.id,
+				() => e.hookCode.remove(t, n.id)
+			]),
+			...c.connection.map((r) => [
+				"connection",
+				`${r.strategy}:${r.name}`,
+				async () => {
+					await n(r.id), await e.connections.remove(t, r.id);
+				}
+			]),
+			...c.resourceServer.map((n) => [
+				"resourceServer",
+				n.identifier,
+				() => e.resourceServers.remove(t, n.id)
+			])
+		];
+		for (let [e, t, n] of a) f(e, "remove", t), await p(e, t, async () => {
+			i || await n(), r.entities[e].removed += 1;
+		});
+	} else {
+		let n = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Set();
+		for (let a of c.hookCode) {
+			if (d.has(a.id)) {
+				m("hookCode", a.id);
+				continue;
+			}
+			f("hookCode", "convert", a.id), o.add(a.id), await p("hookCode", a.id, async () => {
+				if (!i) {
+					let r = await e.hookCode.create(t, _.parse(q(a)));
+					n.set(a.id, r.id), h.push(async () => {
+						await e.hookCode.remove(t, a.id);
+					});
+				}
+				r.entities.hookCode.converted += 1;
 			});
-			else if (!r && o) i.push({
-				entity: e,
-				key: n,
-				kind: "extra",
-				fields: [],
-				expected: Ge.has(e)
+		}
+		for (let s of c.action) {
+			if (u(s)) {
+				m("action", s.name);
+				continue;
+			}
+			f("action", "convert", s.name), o.add(s.id), await p("action", s.name, async () => {
+				if (!i) {
+					let r = await e.actions.create(t, a.parse(q(s)));
+					n.set(s.id, r.id), h.push(async () => {
+						await e.actions.remove(t, s.id);
+					});
+				}
+				r.entities.action.converted += 1;
 			});
-			else if (r && o) {
-				let t = JSON.stringify(r), a = JSON.stringify(o);
-				if (t === a) continue;
-				let s = [...new Set([...Object.keys(r), ...Object.keys(o)])].filter((e) => JSON.stringify(r[e]) !== JSON.stringify(o[e])).sort();
-				i.push({
-					entity: e,
-					key: n,
-					kind: "changed",
-					fields: s,
-					expected: !1,
-					legacy_hash: await G(t),
-					new_hash: await G(a)
-				});
+		}
+		let s = i ? [] : await g((n) => e.organizations.list(t, n), "organizations", {
+			cursorField: "id",
+			pageSize: 100
+		});
+		for (let n of c.connection) {
+			let a = `${n.strategy}:${n.name}`;
+			if (u(n)) {
+				m("connection", a);
+				continue;
+			}
+			f("connection", "convert", a), await p("connection", a, async () => {
+				if (!i) {
+					let { enabled_clients: r, ...i } = q(n), a = await e.connections.create(t, l.parse(i));
+					for (let r of await e.clientConnections.listByConnection(t, n.id)) await e.clientConnections.addClientToConnection(t, a.id, r), await e.clientConnections.removeClientFromConnection(t, n.id, r);
+					for (let r of s) {
+						let i = (await e.organizationConnections.list(t, r.id)).find((e) => e.connection_id === n.id);
+						if (!i) continue;
+						let { connection_id: o, organization_id: s, ...c } = i;
+						await e.organizationConnections.create(t, r.id, {
+							...c,
+							connection_id: a.id
+						}), await e.organizationConnections.remove(t, r.id, n.id);
+					}
+					h.push(async () => {
+						await e.connections.remove(t, n.id);
+					});
+				}
+				r.entities.connection.converted += 1;
+			});
+		}
+		for (let n of c.resourceServer) {
+			if (u(n)) {
+				m("resourceServer", n.identifier);
+				continue;
+			}
+			f("resourceServer", "convert", n.identifier), await p("resourceServer", n.identifier, async () => {
+				if (!i) {
+					await e.resourceServers.remove(t, n.id);
+					try {
+						await e.resourceServers.create(t, T.parse(q(n)));
+					} catch (r) {
+						throw await e.resourceServers.create(t, T.parse(n)), r;
+					}
+				}
+				r.entities.resourceServer.converted += 1;
+			});
+		}
+		let y = [];
+		for (let a of c.hook) {
+			let s = a.hook_id, c = a.code_id;
+			if (u(a)) {
+				m("hook", s);
+				continue;
 			}
+			if (c && !(i ? o.has(c) : n.has(c))) {
+				r.entities.hook.skipped += 1, f("hook", "skip", s, " (its code is not converted)");
+				continue;
+			}
+			f("hook", "convert", s), await p("hook", s, async () => {
+				i || (await e.hooks.create(t, v.parse({
+					...q(a),
+					...c ? { code_id: n.get(c) } : {}
+				})), y.push(async () => {
+					await e.hooks.remove(t, s);
+				})), r.entities.hook.converted += 1;
+			});
 		}
+		h.unshift(...y);
 	}
-	return i;
+	if (Object.values(r.entities).some((e) => e.errors.length > 0)) return {
+		...r,
+		status: "partial"
+	};
+	if (i) return r;
+	for (let e of h) try {
+		await e();
+	} catch (e) {
+		r.entities.hook.errors.push(`remove: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	return Object.values(r.entities).some((e) => e.errors.length > 0) ? {
+		...r,
+		status: "partial"
+	} : r;
 }
-async function Je(e) {
-	let { adapters: t, tenantId: n, legacyControlPlane: r } = e, i = await De({
-		tenantId: n,
-		getTenant: (e) => t.tenants.get(e),
-		legacyControlPlane: r,
-		maxDepth: e.maxDepth
-	}), a = await W(t, n), o = await Promise.all(i.map((e) => W(t, e))), s = r && r !== n ? await W(t, r) : void 0, { hidden: c, ...l } = Le(o, a), u = new Set(c);
-	return (await qe(Ae(a, s), l)).filter((e) => !u.has(`${e.entity}:${e.key}`));
+function Mt(e) {
+	return async (t, n) => {
+		let r = await e.tenants.get(t);
+		if (!r) throw Error(`Tenant "${t}" not found`);
+		if (r.deployment_type === "wfp") throw Error(`Tenant "${t}" has its own database: configure a dispatch detach for it`);
+		if (r.config_sync === "detached") return Ot("already-detached");
+		kt(t, r);
+		let i = await jt(e, t, n);
+		return i.status === "detached" && await At(e, t), i;
+	};
 }
 //#endregion
-//#region src/inheritance/report.ts
-var Ye = 3600 * 1e3, Xe = 1e4;
-function Ze(e, t) {
-	let n = t.sample ?? 1, r = t.intervalMs ?? 6e4, i = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Set(), o = /* @__PURE__ */ new Map();
-	async function s(n, r) {
-		let i = await Je({
-			adapters: e,
-			tenantId: n,
-			legacyControlPlane: r
-		}), a = Date.now();
-		o.size > Xe && o.clear();
-		for (let s of i) {
-			if (s.expected && !t.includeExpected) continue;
-			let i = await G([
-				n,
-				s.entity,
-				s.key,
-				s.kind,
-				s.fields.join(",")
-			].join("|")), c = o.get(i);
-			c !== void 0 && a - c < Ye || (o.set(i, a), await Qe(e, n, s, r));
-		}
-	}
-	return { schedule(e, t) {
-		if (a.has(e) || n < 1 && Math.random() >= n) return;
-		let o = Date.now(), c = i.get(e);
-		c !== void 0 && o - c < r || (i.set(e, o), a.add(e), s(e, t).catch(() => {}).finally(() => a.delete(e)));
-	} };
+//#region src/operations/record-provision.ts
+function Nt(e) {
+	if (e.tenantOperations && e.tenantOperationEvents) return {
+		tenantOperations: e.tenantOperations,
+		tenantOperationEvents: e.tenantOperationEvents
+	};
 }
-async function Qe(e, n, r, i) {
-	await e.logs.create(n, {
-		type: t.CONFIG_INHERITANCE_DIFF,
-		date: (/* @__PURE__ */ new Date()).toISOString(),
-		isMobile: !1,
-		description: `${r.kind} ${r.entity} ${r.key}`,
-		details: {
-			shadow: "config-inheritance",
-			legacy_control_plane: i,
-			...r
+async function Pt(e, t, n) {
+	let r = Nt(e);
+	if (!r) {
+		await n(void 0);
+		return;
+	}
+	let i = I(r), a = async (e) => {
+		try {
+			await e();
+		} catch (e) {
+			console.warn("Failed to record tenant operation progress:", e);
 		}
+	}, o;
+	if (await a(async () => {
+		let e = await se(r, t, "inline");
+		o = e.id, await i.markRunning(e.id);
+	}), !o) {
+		await n(void 0);
+		return;
+	}
+	let s = o, c = !1, l = async (e, t, n) => {
+		c = !0, await a(async () => {
+			t === "started" && await i.setCurrentStep(s, e), await i.appendEvent(s, {
+				step: e,
+				outcome: t,
+				detail: n
+			});
+		});
+	};
+	try {
+		await n(l);
+	} catch (e) {
+		throw await a(async () => {
+			c || await i.appendEvent(s, {
+				step: t.kind,
+				outcome: "failed",
+				detail: { message: F(e) }
+			}), await i.markFailed(s, e);
+		}), e;
+	}
+	await a(async () => {
+		c || await i.appendEvent(s, {
+			step: t.kind,
+			outcome: "succeeded"
+		}), await i.markSucceeded(s);
 	});
 }
 //#endregion
-//#region src/middleware/settings-inheritance.ts
-function q(e, t) {
-	let n = t.find((t) => t.strategy === e.strategy);
-	if (!n?.options) return e;
-	let r = c.passthrough().parse({
-		...n,
-		...e
-	});
-	return r.options = s.passthrough().parse({
-		...n.options || {},
-		...e.options
-	}), r;
-}
-function J(e, t) {
-	let n = [...t || [], ...e || []];
-	return [...new Set(n)];
-}
-function $e(e, t) {
-	if (!t?.length) return e || [];
-	if (!e?.length) return t;
-	let n = /* @__PURE__ */ new Map();
-	for (let e of t) n.set(e.value, e);
-	for (let t of e) n.set(t.value, t);
-	return Array.from(n.values());
-}
-function Y(e, t) {
-	return t ? {
-		...e,
-		scopes: $e(e.scopes, t.scopes)
-	} : e;
-}
-function et(e, t) {
-	return t ? {
-		...e,
-		callbacks: J(e.callbacks, t.callbacks),
-		web_origins: J(e.web_origins, t.web_origins),
-		allowed_logout_urls: J(e.allowed_logout_urls, t.allowed_logout_urls),
-		allowed_origins: J(e.allowed_origins, t.allowed_origins)
-	} : e;
-}
-function tt(e) {
-	let { controlPlaneTenantId: t, controlPlaneClientId: n, resolveControlPlane: r } = e;
-	if (r) return async (e) => r({ tenant_id: e });
-	if (!t) return async () => void 0;
-	let i = {
-		tenantId: t,
-		clientId: n
+//#region src/operations/tenant-members-request.ts
+function Ft(e) {
+	let t = () => {
+		if (!e.tenantMemberRequests) throw Error("The data adapter has no tenantMemberRequests adapter");
+		return e.tenantMemberRequests;
 	};
-	return async () => i;
-}
-function nt(e, t) {
 	return {
-		...e.resourceServers,
-		get: async (n, r) => {
-			let i = await e.resourceServers.get(n, r);
-			if (!i) return i;
-			let a = await t(n);
-			return !a || n === a.tenantId || !i.is_system ? i : Y(i, await e.resourceServers.get(a.tenantId, r));
+		get: (e, n) => t().get(e, n),
+		async report(e, n, r) {
+			return t().update(e, n, {
+				status: r.status,
+				result: r.result ?? null,
+				error: r.error ?? null,
+				finished_at: (/* @__PURE__ */ new Date()).toISOString()
+			}, "pending");
 		},
-		list: async (n, r) => {
-			let i = await e.resourceServers.list(n, r), a = await t(n);
-			if (!a || n === a.tenantId) return i;
-			let o = a.tenantId, s = i.resource_servers.filter((e) => !!(e.is_system && e.id)).map((e) => e.id);
-			if (s.length === 0) return i;
-			let c = /* @__PURE__ */ new Map();
-			await Promise.all(s.map(async (t) => {
-				let n = await e.resourceServers.get(o, t);
-				n && c.set(t, n);
-			}));
-			let l = i.resource_servers.map((e) => e.is_system && e.id ? Y(e, c.get(e.id) ?? null) : e);
-			return {
-				...i,
-				resource_servers: l
-			};
+		async listPending(e, { olderThan: n }) {
+			return (await t().list(e, {
+				status: "pending",
+				created_before: n,
+				per_page: 100
+			})).requests;
 		}
 	};
 }
-function rt(e, t) {
-	let n = tt({
-		controlPlaneTenantId: t.controlPlaneTenantId,
-		resolveControlPlane: t.resolveControlPlane
+function It(e) {
+	let t = e.input?.request_id;
+	return typeof t == "string" && t ? t : void 0;
+}
+var Lt = 300;
+async function Rt(e) {
+	let { operation: t, store: n, getBackend: r, recorder: a } = e, o = t.tenant_id, s = It(t);
+	if (!o || !s) throw Error("tenant-members-request operations require a tenant_id and a request_id");
+	let c = await n.get(o, s);
+	if (!c) throw Error(`Request ${s} was not found for tenant ${o}`);
+	if (c.status !== "pending") {
+		let e = {
+			request_id: s,
+			outcome: "already_finished",
+			status: c.status
+		};
+		return await a.setResult(t.id, e), e;
+	}
+	let l;
+	try {
+		l = {
+			status: "succeeded",
+			result: await h(await r(), o, c, e.executeOptions)
+		};
+	} catch (e) {
+		if (!(e instanceof i)) throw e;
+		l = {
+			status: "failed",
+			error: F(e).slice(0, Lt)
+		};
+	}
+	let u = await n.report(o, s, l), d = {
+		request_id: s,
+		outcome: l.status,
+		reported: u,
+		...l.status === "failed" ? { reason: l.error } : {}
+	};
+	return await a.setResult(t.id, d), d;
+}
+var zt = 5;
+async function Bt(e, t, n, r = {}) {
+	let { operations: i } = await e.stores.tenantOperations.list({
+		tenant_id: t,
+		kind: "tenant-members-request",
+		per_page: 100
 	});
+	return i.find((e) => It(e) === n && (e.status === "pending" || e.status === "running" || e.status === "succeeded")) || ce(e.stores, e.executor, {
+		kind: "tenant-members-request",
+		tenant_id: t,
+		initiated_by: r.initiatedBy,
+		input: { request_id: n }
+	}, { returnFailed: !0 });
+}
+async function Vt(e) {
+	let t = e.now?.() ?? /* @__PURE__ */ new Date(), n = new Date(t.getTime() - (e.graceMs ?? 5 * 6e4)).toISOString(), r = e.maxAttempts ?? 5, i = {
+		checked: 0,
+		enqueued: 0,
+		gaveUp: 0,
+		unreachable: []
+	};
+	for (let t of await e.tenantIds()) {
+		let a;
+		try {
+			a = await e.store.listPending(t, { olderThan: n });
+		} catch (e) {
+			console.warn(`[tenant-members] could not read the requests of ${t}:`, e), i.unreachable.push(t);
+			continue;
+		}
+		if (a.length === 0) continue;
+		let { operations: o } = await e.stores.tenantOperations.list({
+			tenant_id: t,
+			kind: "tenant-members-request",
+			per_page: 100
+		});
+		for (let n of a) {
+			i.checked += 1;
+			let a = o.filter((e) => It(e) === n.id);
+			if (!a.some((e) => e.status === "pending" || e.status === "running")) {
+				if (a.filter((e) => e.status === "failed").length >= r) {
+					try {
+						await e.store.report(t, n.id, {
+							status: "failed",
+							error: "The control plane could not carry out this request"
+						}) && (i.gaveUp += 1);
+					} catch (e) {
+						console.warn(`[tenant-members] could not report request ${n.id} as failed:`, e);
+					}
+					continue;
+				}
+				try {
+					await Bt(e, t, n.id), i.enqueued += 1;
+				} catch (e) {
+					console.warn(`[tenant-members] could not enqueue request ${n.id}:`, e);
+				}
+			}
+		}
+	}
+	return i;
+}
+//#endregion
+//#region src/hooks/provisioning.ts
+function Ht(e) {
+	return `urn:authhero:tenant:${e.toLowerCase()}`;
+}
+function Ut(e) {
 	return {
-		...e,
-		resourceServers: nt(e, n)
-	};
-}
-function it(e, t) {
-	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i, inheritanceShadow: a } = t, o = tt({
-		controlPlaneTenantId: n,
-		controlPlaneClientId: r,
-		resolveControlPlane: i
-	}), s = a ? Ze(e, a === !0 ? {} : a) : void 0, c = s ? async (e) => {
-		let t = await o(e);
-		return s.schedule(e, t?.tenantId), t;
-	} : o;
-	return {
-		...e,
-		multiTenancyConfig: {
-			controlPlaneTenantId: n,
-			controlPlaneClientId: r,
-			resolveControlPlane: i
+		async beforeCreate(e, t) {
+			return !t.audience && t.id ? {
+				...t,
+				audience: Ht(t.id)
+			} : t;
 		},
-		connections: {
-			...e.connections,
-			get: async (t, n) => {
-				let r = await e.connections.get(t, n);
-				if (!r) return r;
-				let i = await c(t);
-				return !i || t === i.tenantId ? r : q(r, (await e.connections.list(i.tenantId)).connections || []);
-			},
-			list: async (t, n) => {
-				let r = await e.connections.list(t, n), i = await c(t);
-				if (!i || t === i.tenantId) return r;
-				let a = await e.connections.list(i.tenantId), o = r.connections.map((e) => q(e, a.connections || []));
-				return {
-					...r,
-					connections: o
-				};
+		async afterCreate(t, i) {
+			let { accessControl: a, databaseIsolation: o } = e;
+			if (a && t.ctx && await Wt(t, i, a), o?.onProvision) {
+				let e = o.onProvision;
+				o.recordProvisionOperations === !1 ? await e(i.id) : await Pt(t.adapters, {
+					kind: "provision",
+					tenant_id: i.id,
+					initiated_by: t.ctx?.var.user?.sub
+				}, (t) => e(i.id, t));
+			} else try {
+				await w(t.adapters, i.id, {
+					managementApiIdentifier: n,
+					managementApiScopes: r
+				});
+			} catch (e) {
+				throw console.warn(`Failed to provision default clients for tenant ${i.id}:`, e), e;
 			}
 		},
-		clientConnections: {
-			...e.clientConnections,
-			listByClient: async (t, n) => {
-				let r = await e.clientConnections.listByClient(t, n);
-				r.length === 0 && (r = (await e.connections.list(t)).connections || []);
-				let i = await c(t);
-				if (!i || t === i.tenantId) return r;
-				let a = await e.connections.list(i.tenantId);
-				return r.map((e) => q(e, a.connections || []));
+		async beforeDelete(t, n) {
+			let { accessControl: r, databaseIsolation: i } = e;
+			if (r) try {
+				let e = (await t.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find((e) => e.name === n);
+				e && await t.adapters.organizations.remove(r.controlPlaneTenantId, e.id);
+			} catch (e) {
+				console.warn(`Failed to remove organization for tenant ${n}:`, e);
+			}
+			if (i?.onDeprovision) try {
+				await i.onDeprovision(n);
+			} catch (e) {
+				console.warn(`Failed to deprovision database for tenant ${n}:`, e);
+			}
+		}
+	};
+}
+async function Wt(e, t, n) {
+	let { controlPlaneTenantId: r, defaultPermissions: i, defaultRoles: a, issuer: o, adminRoleName: s = "Tenant Admin", adminRoleDescription: c = "Full access to all tenant management operations", addCreatorToOrganization: l = !0 } = n, u = await e.adapters.organizations.create(r, {
+		name: t.id,
+		display_name: t.friendly_name || t.id
+	}), d;
+	if (o && (d = await Kt(e, r, s, c)), l && e.ctx) {
+		let t = e.ctx.var.user;
+		if (t?.sub && !await Gt(e, r, t.sub)) try {
+			await e.adapters.userOrganizations.create(r, {
+				user_id: t.sub,
+				organization_id: u.id
+			}), d && await e.adapters.userRoles.create(r, t.sub, d, u.id);
+		} catch (e) {
+			console.warn(`Failed to add creator ${t.sub} to organization ${u.id}:`, e);
+		}
+	}
+	a && a.length > 0 && console.log(`Would assign roles ${a.join(", ")} to organization ${u.id}`), i && i.length > 0 && console.log(`Would grant permissions ${i.join(", ")} to organization ${u.id}`);
+}
+async function Gt(e, t, r) {
+	let i = await e.adapters.userRoles.list(t, r, void 0, "");
+	for (let r of i) if ((await e.adapters.rolePermissions.list(t, r.id, { per_page: 1e3 })).some((e) => e.permission_name === "admin:organizations" && e.resource_server_identifier === n)) return !0;
+	return !1;
+}
+async function Kt(e, t, i, a) {
+	let o = (await e.adapters.roles.list(t, {})).roles.find((e) => e.name === i);
+	if (o) return o.id;
+	let s = await e.adapters.roles.create(t, {
+		name: i,
+		description: a
+	}), c = n, l = r.map((e) => ({
+		role_id: s.id,
+		resource_server_identifier: c,
+		permission_name: e.value
+	}));
+	return await e.adapters.rolePermissions.assign(t, s.id, l), s.id;
+}
+//#endregion
+//#region src/hooks/sync.ts
+function qt(e, t, n = () => !0) {
+	let { controlPlaneTenantId: r, getChildTenantIds: i, getAdapters: a } = e, o = /* @__PURE__ */ new Map();
+	async function s(e, n, r) {
+		return (await t(e).list(n, {
+			q: `name:${m(r)}`,
+			per_page: 1
+		}))[0] ?? null;
+	}
+	async function c(e) {
+		let n = await i(), o = t(await a(r));
+		await Promise.all(n.map(async (n) => {
+			try {
+				let r = await a(n), i = t(r), c = {
+					...o.transform(e),
+					is_system: !0
+				}, l = await s(r, n, e.name), u = l ? i.getId(l) : void 0;
+				if (l && u) {
+					let e = i.preserveOnUpdate ? i.preserveOnUpdate(l, c) : c;
+					await i.update(n, u, e);
+				} else await i.create(n, c);
+			} catch (t) {
+				console.error(`Failed to sync ${o.listKey} "${e.name}" to tenant "${n}":`, t);
 			}
+		}));
+	}
+	async function l(e) {
+		let n = await i();
+		await Promise.all(n.map(async (n) => {
+			try {
+				let r = await a(n), i = t(r), o = await s(r, n, e), c = o ? i.getId(o) : void 0;
+				o && c && await i.remove(n, c);
+			} catch (t) {
+				console.error(`Failed to delete entity "${e}" from tenant "${n}":`, t);
+			}
+		}));
+	}
+	return {
+		afterCreate: async (e, t) => {
+			e.tenantId === r && n(t) && await c(t);
 		},
-		emailProviders: {
-			...e.emailProviders,
-			get: async (t) => {
-				let n = await e.emailProviders.get(t);
-				if (n) return n;
-				let r = await c(t);
-				return !r || t === r.tenantId ? null : e.emailProviders.get(r.tenantId);
+		afterUpdate: async (e, t, i) => {
+			e.tenantId === r && n(i) && await c(i);
+		},
+		beforeDelete: async (e, i) => {
+			if (e.tenantId !== r) return;
+			let a = await t(e.adapters).get(e.tenantId, i);
+			a && n(a) && o.set(i, a);
+		},
+		afterDelete: async (e, t) => {
+			if (e.tenantId !== r) return;
+			let n = o.get(t);
+			n && (o.delete(t), await l(n.name));
+		}
+	};
+}
+function Jt(e, t, n = () => !0) {
+	let { controlPlaneTenantId: r, getControlPlaneAdapters: i, getAdapters: a } = e;
+	return { async afterCreate(e, o) {
+		if (o.id !== r) try {
+			let e = await i(), s = await a(o.id), c = t(e), l = t(s), u = await g((e) => c.listPaginated(r, e), c.listKey, {
+				cursorField: "id",
+				pageSize: 100
+			});
+			await Promise.all(u.filter((e) => n(e)).map(async (e) => {
+				try {
+					let t = c.transform(e);
+					await l.create(o.id, {
+						...t,
+						is_system: !0
+					});
+				} catch (e) {
+					console.error(`Failed to sync entity to new tenant "${o.id}":`, e);
+				}
+			}));
+		} catch (e) {
+			console.error(`Failed to sync entities to new tenant "${o.id}":`, e);
+		}
+	} };
+}
+var Yt = (e) => ({
+	list: async (t, n) => (await e.resourceServers.list(t, n)).resource_servers,
+	listPaginated: (t, n) => e.resourceServers.list(t, n),
+	get: (t, n) => e.resourceServers.get(t, n),
+	create: (t, n) => e.resourceServers.create(t, n),
+	update: (t, n, r) => e.resourceServers.update(t, n, r),
+	remove: (t, n) => e.resourceServers.remove(t, n),
+	listKey: "resource_servers",
+	getId: (e) => e.id,
+	transform: (e) => ({
+		id: e.id,
+		name: e.name,
+		identifier: e.identifier,
+		scopes: e.scopes,
+		signing_alg: e.signing_alg,
+		token_lifetime: e.token_lifetime,
+		token_lifetime_for_web: e.token_lifetime_for_web
+	})
+}), Xt = (e) => ({
+	list: async (t, n) => (await e.roles.list(t, n)).roles,
+	listPaginated: (t, n) => e.roles.list(t, n),
+	get: (t, n) => e.roles.get(t, n),
+	create: (t, n) => e.roles.create(t, n),
+	update: (t, n, r) => e.roles.update(t, n, r),
+	remove: (t, n) => e.roles.remove(t, n),
+	listKey: "roles",
+	getId: (e) => e.id,
+	transform: (e) => ({
+		id: e.id,
+		name: e.name,
+		description: e.description
+	})
+});
+function Zt(e) {
+	return e.metadata?.sync !== !1;
+}
+function Qt(e) {
+	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => Zt(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => Zt(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? qt(e, Yt, a) : void 0, c = i ? qt(e, Xt, o) : void 0, l = r ? Jt(e, Yt, a) : void 0, u = i ? Jt(e, Xt, o) : void 0, d = i ? { async afterCreate(t, r) {
+		if (r.id !== e.controlPlaneTenantId) {
+			await u?.afterCreate?.(t, r);
+			try {
+				let t = await e.getControlPlaneAdapters(), i = await e.getAdapters(r.id), a = await g((n) => t.roles.list(e.controlPlaneTenantId, n), "roles", {
+					cursorField: "id",
+					pageSize: 100
+				}), o = /* @__PURE__ */ new Map();
+				for (let e of a.filter((e) => n.roles?.(e) ?? !0)) {
+					let t = await f(i, r.id, e.name);
+					t && o.set(e.name, t.id);
+				}
+				for (let s of a.filter((e) => n.roles?.(e) ?? !0)) {
+					let n = o.get(s.name);
+					if (n) try {
+						let a = await t.rolePermissions.list(e.controlPlaneTenantId, s.id, {});
+						a.length > 0 && await i.rolePermissions.assign(r.id, n, a.map((e) => ({
+							role_id: n,
+							resource_server_identifier: e.resource_server_identifier,
+							permission_name: e.permission_name
+						})));
+					} catch (e) {
+						console.error(`Failed to sync permissions for role "${s.name}" to tenant "${r.id}":`, e);
+					}
+				}
+			} catch (e) {
+				console.error(`Failed to sync role permissions to tenant "${r.id}":`, e);
+			}
+		}
+	} } : void 0;
+	async function f(e, t, n) {
+		return (await e.roles.list(t, {
+			q: `name:${m(n)}`,
+			per_page: 1
+		})).roles[0] ?? null;
+	}
+	return {
+		entityHooks: {
+			resourceServers: s,
+			roles: c
+		},
+		tenantHooks: { async afterCreate(e, t) {
+			let n = [l?.afterCreate, d?.afterCreate ?? u?.afterCreate], r = [];
+			for (let i of n) if (i) try {
+				await i(e, t);
+			} catch (e) {
+				r.push(e instanceof Error ? e : Error(String(e)));
 			}
+			if (r.length === 1) throw r[0];
+			if (r.length > 1) throw AggregateError(r, r.map((e) => e.message).join("; "));
+		} }
+	};
+}
+//#endregion
+//#region src/middleware/request-data.ts
+function J(e) {
+	return e.var.data ?? e.env.data;
+}
+//#endregion
+//#region src/utils/tenant-settings.ts
+async function $t(e, t, n) {
+	let r = !n || n === t, { totals: i } = await e.list({
+		per_page: 1,
+		include_totals: !0,
+		...r ? {} : { q: `parent_tenant_id:${ee(t)}` }
+	});
+	return {
+		is_control_plane: r,
+		has_children: (i?.length ?? 0) > +!!r
+	};
+}
+//#endregion
+//#region src/routes/tenants.ts
+var en = j.object({
+	sub: j.string(),
+	tenant_id: j.string().optional(),
+	org_id: j.string().optional(),
+	scope: j.string().optional(),
+	permissions: j.array(j.string()).optional()
+}).passthrough();
+function tn(e) {
+	let t = en.safeParse(e);
+	return t.success ? t.data : void 0;
+}
+function nn(e, t, n) {
+	return t ? !e || n ? !1 : e.tenant_id === t : !0;
+}
+function rn(e) {
+	let t = e.permissions ?? [], n = e.scope ? e.scope.split(" ").filter(Boolean) : [], r = new Set([...t, ...n]);
+	return r.has("delete:tenants") || r.has("admin:organizations");
+}
+function an(e, t) {
+	let n = new k(), r = (t) => {
+		let n = tn(t.var.user);
+		return nn(n, e.accessControl?.controlPlaneTenantId ?? J(t).multiTenancyConfig?.controlPlaneTenantId, !!(n?.org_id ?? t.var.organization_id ?? t.var.org_name));
+	}, i = (t, n) => $t(J(t).tenants, n, e.accessControl?.controlPlaneTenantId ?? J(t).multiTenancyConfig?.controlPlaneTenantId);
+	if (n.openapi(A({
+		tags: ["tenants"],
+		method: "get",
+		path: "/",
+		request: { query: o },
+		security: [{ Bearer: [] }],
+		responses: { 200: {
+			content: { "application/json": { schema: j.object({
+				tenants: j.array(D),
+				start: j.number().optional(),
+				limit: j.number().optional(),
+				length: j.number().optional(),
+				total: j.number().optional()
+			}) } },
+			description: "List of tenants"
+		} }
+	}), async (t) => {
+		let { page: n, per_page: r, include_totals: i, q: a } = t.req.valid("query"), o = t.var.user, s = o?.permissions || [];
+		if (!(o?.org_id ?? t.var.organization_id) && s.includes("admin:organizations")) {
+			let e = await J(t).tenants.list({
+				page: n,
+				per_page: r,
+				include_totals: i,
+				q: a
+			});
+			return i ? t.json({
+				tenants: e.tenants,
+				start: e.totals?.start ?? 0,
+				limit: e.totals?.limit ?? r,
+				length: e.tenants.length,
+				total: e.totals?.length
+			}) : t.json({ tenants: e.tenants });
+		}
+		let c = e.accessControl?.controlPlaneTenantId ?? J(t).multiTenancyConfig?.controlPlaneTenantId;
+		if (c && !o?.sub) throw new O(403, { message: "Access denied: token has no subject" });
+		if (c && o?.sub) {
+			let e = (await g((e) => J(t).userOrganizations.listUserOrganizations(c, o.sub, e), "organizations")).map((e) => e.name);
+			if (e.length === 0) return i ? t.json({
+				tenants: [],
+				start: 0,
+				limit: r ?? 50,
+				length: 0,
+				total: 0
+			}) : t.json({ tenants: [] });
+			let s = e.length, l = n ?? 0, u = r ?? 50, d = l * u, f = e.slice(d, d + u);
+			if (f.length === 0) return i ? t.json({
+				tenants: [],
+				start: d,
+				limit: u,
+				length: 0,
+				total: s
+			}) : t.json({ tenants: [] });
+			let p = f.map((e) => `id:${e}`).join(" OR "), m = a ? `(${p}) AND (${a})` : p, h = await J(t).tenants.list({
+				q: m,
+				per_page: u,
+				include_totals: !1
+			});
+			return i ? t.json({
+				tenants: h.tenants,
+				start: d,
+				limit: u,
+				length: h.tenants.length,
+				total: s
+			}) : t.json({ tenants: h.tenants });
+		}
+		let l = await J(t).tenants.list({
+			page: n,
+			per_page: r,
+			include_totals: i,
+			q: a
+		});
+		return i ? t.json({
+			tenants: l.tenants,
+			start: l.totals?.start ?? 0,
+			limit: l.totals?.limit ?? r,
+			length: l.tenants.length,
+			total: l.totals?.length
+		}) : t.json({ tenants: l.tenants });
+	}), n.openapi(A({
+		tags: ["tenants"],
+		method: "post",
+		path: "/",
+		request: { body: { content: { "application/json": { schema: E } } } },
+		security: [{ Bearer: [] }],
+		responses: {
+			201: {
+				content: { "application/json": { schema: D } },
+				description: "Tenant created"
+			},
+			400: { description: "Validation error" },
+			409: { description: "Tenant with this ID already exists" }
+		}
+	}), async (n) => {
+		if (!n.var.user?.sub) throw new O(401, { message: "Authentication required to create tenants" });
+		let { config_sync_hash: i, config_synced_at: a, config_sync: o, ...s } = n.req.valid("json"), c = s;
+		if (c.parent_tenant_id && !r(n)) throw new O(403, { message: "Only the control plane can set a tenant's parent" });
+		o !== void 0 && r(n) && (c = {
+			...c,
+			config_sync: o
+		});
+		let l = {
+			adapters: J(n),
+			ctx: n
+		};
+		t.tenants?.beforeCreate && (c = await t.tenants.beforeCreate(l, c)), await le({
+			tenantId: c.id,
+			parentTenantId: c.parent_tenant_id,
+			getTenant: (e) => J(n).tenants.get(e)
+		});
+		let u = await J(n).tenants.create(c);
+		return t.tenants?.afterCreate && await t.tenants.afterCreate(l, u), e.onConfigSyncChange?.(u.id), n.json(u, 201);
+	}), n.openapi(A({
+		tags: ["tenants"],
+		method: "delete",
+		path: "/{id}",
+		request: { params: j.object({ id: j.string() }) },
+		security: [{ Bearer: ["delete:tenants"] }],
+		responses: {
+			204: { description: "Tenant deleted" },
+			403: { description: "Access denied or cannot delete the control plane" },
+			404: { description: "Tenant not found" }
+		}
+	}), async (n) => {
+		let { id: r } = n.req.valid("param"), i = e.accessControl?.controlPlaneTenantId ?? J(n).multiTenancyConfig?.controlPlaneTenantId;
+		if (i) {
+			let e = tn(n.var.user);
+			if (!e?.sub) throw new O(401, { message: "Authentication required" });
+			if (r === i) throw new O(403, { message: "Cannot delete the control plane" });
+			let t = n.var.org_name, a = r.toLowerCase(), o = !!t && t.toLowerCase() === a;
+			if (!o) {
+				let r = !!(e.org_id ?? n.var.organization_id ?? t), a = !e.tenant_id || e.tenant_id === i;
+				!r && a && rn(e) && (o = !0);
+			}
+			if (o ||= (await g((t) => J(n).userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new O(403, { message: "Access denied to this tenant" });
+		}
+		if (!await J(n).tenants.get(r)) throw new O(404, { message: "Tenant not found" });
+		let a = {
+			adapters: J(n),
+			ctx: n
+		};
+		return t.tenants?.beforeDelete && await t.tenants.beforeDelete(a, r), await J(n).tenants.remove(r), t.tenants?.afterDelete && await t.tenants.afterDelete(a, r), n.body(null, 204);
+	}), e.verifyConfigSync) {
+		let t = e.verifyConfigSync;
+		n.openapi(A({
+			tags: ["tenants"],
+			method: "get",
+			path: "/{id}/config-sync/verify",
+			request: { params: j.object({ id: j.string() }) },
+			security: [{ Bearer: ["read:tenants"] }],
+			responses: {
+				200: {
+					content: { "application/json": { schema: j.object({
+						tenant_id: j.string(),
+						config_sync: j.enum([
+							"inherit-on-read",
+							"synced",
+							"detached"
+						]),
+						method: j.enum([
+							"read-time",
+							"sync-dry-run",
+							"not-applicable"
+						]),
+						ok: j.boolean(),
+						differences: j.array(j.object({
+							entity: j.string(),
+							key: j.string(),
+							kind: j.enum([
+								"missing",
+								"extra",
+								"changed",
+								"stale"
+							]),
+							fields: j.array(j.string()).optional()
+						})),
+						errors: j.array(j.string())
+					}) } },
+					description: "The tenant's config compared with what its parents publish"
+				},
+				403: { description: "Not allowed to verify this tenant" },
+				404: { description: "Tenant not found" },
+				502: { description: "The tenant's database could not be reached" }
+			}
+		}), async (e) => {
+			let { id: n } = e.req.valid("param");
+			if (n !== e.var.tenant_id && !r(e)) throw new O(403, { message: "Config can only be verified for your own tenant" });
+			let i;
+			try {
+				i = await t(n);
+			} catch (e) {
+				throw console.error(`[multi-tenancy] config verify failed for "${n}":`, e), new O(502, { message: "Could not verify: the tenant's config could not be checked" });
+			}
+			if (!i) throw new O(404, { message: "Tenant not found" });
+			return e.json(i);
+		});
+	}
+	if (e.configSyncStatus) {
+		let t = e.configSyncStatus;
+		n.openapi(A({
+			tags: ["tenants"],
+			method: "get",
+			path: "/{id}/config-sync",
+			request: { params: j.object({ id: j.string() }) },
+			security: [{ Bearer: ["read:tenants"] }],
+			responses: {
+				200: {
+					content: { "application/json": { schema: j.object({
+						tenant_id: j.string(),
+						parent_tenant_id: j.string().nullable(),
+						config_sync: j.enum([
+							"inherit-on-read",
+							"synced",
+							"detached"
+						]),
+						config_sync_hash: j.string().nullable(),
+						config_synced_at: j.string().nullable(),
+						expected_hash: j.string().nullable(),
+						drifted: j.boolean(),
+						chain: j.array(j.string()),
+						inherited: j.record(j.string(), j.string())
+					}) } },
+					description: "Config sync status of the tenant"
+				},
+				403: { description: "Not allowed to read this tenant" },
+				404: { description: "Tenant not found" }
+			}
+		}), async (e) => {
+			let { id: n } = e.req.valid("param");
+			if (n !== e.var.tenant_id && !r(e)) throw new O(403, { message: "Config sync status is only readable for your own tenant" });
+			let i = await t(n);
+			if (!i) throw new O(404, { message: "Tenant not found" });
+			return e.json(i);
+		});
+	}
+	return n.openapi(A({
+		tags: ["tenants", "settings"],
+		method: "get",
+		path: "/settings",
+		request: { headers: j.object({ "tenant-id": j.string().optional() }) },
+		security: [{ Bearer: ["read:tenants"] }],
+		responses: { 200: {
+			content: { "application/json": { schema: D } },
+			description: "Current tenant settings"
+		} }
+	}), async (e) => {
+		let t = await J(e).tenants.get(e.var.tenant_id);
+		if (!t) throw new O(404, { message: "Tenant not found" });
+		return e.json({
+			...t,
+			...await i(e, t.id)
+		});
+	}), n.openapi(A({
+		tags: ["tenants", "settings"],
+		method: "patch",
+		path: "/settings",
+		request: {
+			headers: j.object({ "tenant-id": j.string().optional() }),
+			body: { content: { "application/json": { schema: j.object(E.shape).partial() } } }
+		},
+		security: [{ Bearer: ["update:tenants"] }],
+		responses: { 200: {
+			content: { "application/json": { schema: D } },
+			description: "Updated tenant settings"
+		} }
+	}), async (t) => {
+		let { id: n, config_sync_hash: a, config_synced_at: o, ...s } = t.req.valid("json"), c = await J(t).tenants.get(t.var.tenant_id);
+		if (!c) throw new O(404, { message: "Tenant not found" });
+		if ("config_sync" in s && (s.config_sync ?? "inherit-on-read") !== (c.config_sync ?? "inherit-on-read") && !r(t)) throw new O(403, { message: "Only the control plane can change a tenant's config_sync mode" });
+		if ("default_client_id" in s) {
+			let e = s.default_client_id;
+			if (typeof e == "string" && e.length > 0) {
+				let n = await J(t).clients.get(t.var.tenant_id, e);
+				if (!n) throw new O(400, { message: `Client with id '${e}' not found` });
+				if (!b(n)) throw new O(400, { message: `Client '${e}' is not an interactive client and cannot be used as the default client` });
+			}
+		}
+		if ("parent_tenant_id" in s) {
+			if ((s.parent_tenant_id ?? null) !== (c.parent_tenant_id ?? null) && !r(t)) throw new O(403, { message: "Only the control plane can change a tenant's parent" });
+			await le({
+				tenantId: t.var.tenant_id,
+				parentTenantId: s.parent_tenant_id,
+				getTenant: (e) => J(t).tenants.get(e),
+				getChildren: async (e) => (await g((e) => J(t).tenants.list(e), "tenants")).filter((t) => t.parent_tenant_id === e).map((e) => e.id)
+			});
+		}
+		let l = f(c, s);
+		await J(t).tenants.update(t.var.tenant_id, l), "config_sync" in s && e.onConfigSyncChange?.(t.var.tenant_id);
+		let u = await J(t).tenants.get(t.var.tenant_id);
+		if (!u) throw new O(500, { message: "Failed to retrieve updated tenant" });
+		return t.json({
+			...u,
+			...await i(t, u.id)
+		});
+	}), n;
+}
+//#endregion
+//#region src/middleware/protect-synced.ts
+function on(e) {
+	for (let { pattern: t, type: n } of [
+		{
+			pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
+			type: "resource_server"
+		},
+		{
+			pattern: /\/api\/v2\/roles\/([^/]+)$/,
+			type: "role"
 		},
-		resourceServers: nt(e, c),
-		hooks: at(e, c)
-	};
+		{
+			pattern: /\/api\/v2\/connections\/([^/]+)$/,
+			type: "connection"
+		}
+	]) {
+		let r = e.match(t);
+		if (r && r[1]) return {
+			type: n,
+			id: r[1]
+		};
+	}
+	return null;
 }
-function X(e) {
-	if (!e || typeof e != "object") return !1;
-	let t = e.metadata;
-	return !t || typeof t != "object" ? !1 : t.inheritable === !0;
+async function sn(e, t, n) {
+	try {
+		switch (n.type) {
+			case "resource_server": return (await e.resourceServers.get(t, n.id))?.is_system === !0;
+			case "role": return (await e.roles.get(t, n.id))?.is_system === !0;
+			case "connection": return (await e.connections.get(t, n.id))?.is_system === !0;
+			default: return !1;
+		}
+	} catch {
+		return !1;
+	}
 }
-function at(e, t) {
+function cn(e) {
 	return {
-		...e.hooks,
-		list: async (n, r) => {
-			let i = await e.hooks.list(n, r), a = await t(n);
-			if (!a || n === a.tenantId) return i;
-			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(X);
-			if (o.length === 0) return i;
-			let s = new Set((i.hooks || []).map((e) => e.hook_id)), c = o.filter((e) => !s.has(e.hook_id));
-			return {
-				...i,
-				hooks: [...i.hooks || [], ...c],
-				length: typeof i.length == "number" ? i.length + c.length : i.length
-			};
+		resource_server: "resource server",
+		role: "role",
+		connection: "connection"
+	}[e];
+}
+function ln(e) {
+	for (let { pattern: t, type: n } of [
+		{
+			pattern: /\/api\/v2\/connections\/([^/]+)$/,
+			type: "connection"
 		},
-		get: async (n, r) => {
-			let i = await e.hooks.get(n, r);
-			if (i) return i;
-			let a = await t(n);
-			if (!a || n === a.tenantId) return i;
-			let o = await e.hooks.get(a.tenantId, r);
-			return o && X(o) ? o : null;
+		{
+			pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
+			type: "resource_server"
+		},
+		{
+			pattern: /\/api\/v2\/actions\/actions\/([^/]+)$/,
+			type: "action"
+		},
+		{
+			pattern: /\/api\/v2\/hooks\/([^/]+)$/,
+			type: "hook"
+		},
+		{
+			pattern: /\/api\/v2\/hook-code\/([^/]+)$/,
+			type: "hook_code"
+		}
+	]) {
+		let r = e.match(t);
+		if (r?.[1]) return {
+			type: n,
+			id: r[1]
+		};
+	}
+	return null;
+}
+async function un(e, t, n) {
+	try {
+		switch (n.type) {
+			case "connection": return await e.connections.get(t, n.id);
+			case "resource_server": return await e.resourceServers.get(t, n.id);
+			case "action": return await e.actions.get(t, n.id);
+			case "hook": return await e.hooks.get(t, n.id);
+			case "hook_code": return await e.hookCode.get(t, n.id);
 		}
+	} catch {
+		return null;
+	}
+}
+var dn = {
+	connection: ["options"],
+	resource_server: ["signing_secret"],
+	action: ["secrets"],
+	hook: [],
+	hook_code: []
+}, fn = new Set([
+	"client_secret",
+	"app_secret",
+	"twilio_token"
+]);
+function pn(e, t) {
+	let n = (e) => {
+		let { client_secret: t, ...n } = e ?? {};
+		return n;
 	};
+	return mn(n(e), n(t));
+}
+var mn = (e, t) => JSON.stringify(e) === JSON.stringify(t);
+function Y(e, t) {
+	return new O(403, { message: `This ${e.type.replace("_", " ")} is synced from a parent tenant and ${t}. Make changes in the parent tenant instead.` });
+}
+async function hn(e, t, n) {
+	let r = await un(J(e), t, n);
+	if (!r) return;
+	if (n.type === "hook_code") throw Y(n, "cannot be modified");
+	if (e.req.method === "DELETE") {
+		if (r.enforce === !0) throw Y(n, "cannot be deleted");
+		return;
+	}
+	let i = r.override ?? "fields";
+	if (i === "none") throw Y(n, "cannot be edited");
+	let a = {};
+	try {
+		let t = await e.req.raw.clone().json();
+		t && typeof t == "object" && (a = t);
+	} catch {}
+	for (let e of [
+		"scope",
+		"override",
+		"enforce"
+	]) if (e in a && !mn(a[e] ?? null, r[e] ?? null)) throw Y(n, `has a locked ${e}`);
+	if (r.enforce === !0 && a.enabled === !1) throw Y(n, "cannot be disabled");
+	if (i === "secrets") {
+		let e = dn[n.type];
+		for (let [t, i] of Object.entries(a)) if (![
+			"scope",
+			"override",
+			"enforce"
+		].includes(t) && !mn(i, r[t])) {
+			if (!e.includes(t)) throw Y(n, `only allows its secrets to be changed (not ${t})`);
+			if (t === "options" && i && typeof i == "object") {
+				let e = r.options ?? {};
+				for (let [t, r] of Object.entries(i)) if (!mn(r, e[t]) && !t.endsWith("_hint") && !(fn.has(t) || t === "configuration" && pn(r, e[t]))) throw Y(n, `only allows its secrets to be changed (not options.${t})`);
+			}
+		}
+	}
 }
-function Z(e, t) {
-	return it(e, t);
+function gn() {
+	return async (e, t) => {
+		if (![
+			"PATCH",
+			"PUT",
+			"DELETE"
+		].includes(e.req.method)) return t();
+		let n = on(e.req.path), r = ln(e.req.path);
+		if (!n && !r) return t();
+		let i = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
+		if (!i) return t();
+		if (n && await sn(J(e), i, n)) throw new O(403, { message: `This ${cn(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
+		return r && x(r.id) && await hn(e, i, r), t();
+	};
 }
 //#endregion
 //#region src/middleware/index.ts
-function ot(e) {
+function _n(e) {
 	return async (t, n) => {
 		let r = t.var.user;
 		return r?.tenant_id === e && r.org_name && t.set("tenant_id", r.org_name), n();
 	};
 }
-function st(e) {
+function vn(e) {
 	return async (t, r) => {
 		if (!e.accessControl) return r();
 		let { controlPlaneTenantId: i } = e.accessControl, a = t.var.org_name, o = t.var.organization_id, s = a || o, c = t.var.tenant_id, l = t.var.user, u = (l?.aud ? Array.isArray(l.aud) ? l.aud : [l.aud] : []).includes(n);
-		if (!c && s && u && (t.set("tenant_id", s), c = s), !c) throw new T(400, { message: "Tenant ID not found in request" });
-		if (!D(o, c, i, a)) throw new T(403, { message: `Access denied to tenant ${c}` });
+		if (!c && s && u && (t.set("tenant_id", s), c = s), !c) throw new O(400, { message: "Tenant ID not found in request" });
+		if (!N(o, c, i, a)) throw new O(403, { message: `Access denied to tenant ${c}` });
 		return r();
 	};
 }
-function ct(e) {
+function yn(e) {
 	return async (t, n) => {
 		if (!e.subdomainRouting) return n();
 		let { baseDomain: r, reservedSubdomains: i = [], resolveSubdomain: a } = e.subdomainRouting, o = t.req.header("x-forwarded-host") || t.req.header("host") || "", s = null;
@@ -1441,18 +2543,18 @@ function ct(e) {
 		let c = null;
 		if (a) c = await a(s);
 		else if (e.subdomainRouting.useOrganizations !== !1 && e.accessControl) try {
-			let n = await P(t).organizations.get(e.accessControl.controlPlaneTenantId, s);
+			let n = await J(t).organizations.get(e.accessControl.controlPlaneTenantId, s);
 			n && (c = n.id);
 		} catch {}
-		if (!c) throw new T(404, { message: `Tenant not found for subdomain: ${s}` });
+		if (!c) throw new O(404, { message: `Tenant not found for subdomain: ${s}` });
 		return t.set("tenant_id", c), n();
 	};
 }
-function lt(e) {
+function bn(e) {
 	return async (t, n) => {
 		if (!e.databaseIsolation) return n();
 		let r = t.var.tenant_id;
-		if (!r) throw new T(400, { message: "Tenant ID not found in request" });
+		if (!r) throw new O(400, { message: "Tenant ID not found in request" });
 		try {
 			let n = await e.databaseIsolation.getAdapters(r);
 			t.set("baseData", n), t.env = {
@@ -1460,131 +2562,817 @@ function lt(e) {
 				data: n
 			};
 		} catch (e) {
-			throw console.error(`Failed to resolve database for tenant ${r}:`, e), new T(500, { message: "Failed to resolve tenant database" });
+			throw console.error(`Failed to resolve database for tenant ${r}:`, e), new O(500, { message: "Failed to resolve tenant database" });
 		}
 		return n();
 	};
 }
-function Q(e) {
-	let t = ct(e), n = st(e), r = lt(e);
+function xn(e) {
+	let t = yn(e), n = vn(e), r = bn(e);
 	return async (e, i) => (await t(e, async () => {}), await n(e, async () => {}), await r(e, async () => {}), i());
 }
 //#endregion
+//#region src/rollouts/config.ts
+var Sn = [
+	10,
+	50,
+	100
+], X = {
+	canary: 1,
+	waves: Sn,
+	failure_threshold: .1,
+	max_concurrent: 25,
+	debounce_ms: 6e4
+};
+function Z(e) {
+	let t = e.config ?? {};
+	return {
+		...X,
+		trigger: "manual",
+		root_tenant_id: "",
+		...t,
+		waves: Array.isArray(t.waves) && t.waves.length > 0 ? t.waves : [...Sn]
+	};
+}
+function Cn(e, t, n) {
+	let r = Array(e).fill(0);
+	if (e === 0) return r;
+	let i = Math.min(Math.max(t, 0), e), a = [], o = i;
+	for (let t of n) {
+		let n = Math.min(e, Math.max(o, Math.ceil(e * t / 100)));
+		n > o && (a.push(n), o = n);
+	}
+	o < e && a.push(e);
+	let s = +(i > 0), c = i;
+	for (let e of a) {
+		for (; c < e; c++) r[c] = s;
+		s++;
+	}
+	return r;
+}
+//#endregion
+//#region src/rollouts/enumerate.ts
+async function wn(e, t, n) {
+	let r = n.maxDepth ?? 8, i = await g((t) => e.tenants.list(t), "tenants", {
+		cursorField: "id",
+		pageSize: 100
+	}), a = new Map(i.map((e) => [e.id, e])), o = async (e) => e.parent_tenant_id ?? (e.id === t ? void 0 : await n.resolveLegacyParent(e.id)), s = [];
+	for (let e of i) {
+		if (e.id === t || e.config_sync !== "synced") continue;
+		let n = 0, i = e, c = !1;
+		for (; i && n <= r;) {
+			let e = await o(i);
+			if (!e) break;
+			if (n++, e === t) {
+				c = !0;
+				break;
+			}
+			i = a.get(e);
+		}
+		c && s.push({
+			tenantId: e.id,
+			depth: n,
+			appliedHash: e.config_sync_hash ?? null
+		});
+	}
+	return s.sort((e, t) => e.depth - t.depth || (e.tenantId < t.tenantId ? -1 : 1));
+}
+//#endregion
+//#region src/rollouts/hashes.ts
+async function Q(e, t) {
+	return e.resolveControlPlane ? (await e.resolveControlPlane({ tenant_id: t }))?.tenantId : e.controlPlaneTenantId;
+}
+function Tn(e) {
+	let t = /* @__PURE__ */ new Map();
+	return async (n) => {
+		let r = await Q(e, n), i = (await R({
+			tenantId: n,
+			getTenant: (t) => e.adapters.tenants.get(t),
+			legacyControlPlane: r,
+			maxDepth: e.maxDepth
+		})).join(">"), a = t.get(i);
+		return a || (a = at(e.adapters, n, {
+			legacyControlPlane: r,
+			maxDepth: e.maxDepth
+		}).then((e) => e.hash), t.set(i, a)), a;
+	};
+}
+//#endregion
+//#region src/rollouts/plan.ts
+var En = [
+	"pending",
+	"canary",
+	"rolling",
+	"paused"
+];
+function Dn(e) {
+	let { tenantOperations: t, tenantOperationEvents: n } = e.adapters;
+	if (!t || !n) throw Error("Fleet rollouts need the tenant operations adapters");
+	return {
+		tenantOperations: t,
+		tenantOperationEvents: n
+	};
+}
+function $(e) {
+	if (!e.adapters.rollouts) throw Error("Fleet rollouts need the rollouts adapter");
+	return e.adapters.rollouts;
+}
+async function On(e, t, n = {}) {
+	let r = $(e), i = Dn(e), a = Z(t), o = await wn(e.adapters, a.root_tenant_id, {
+		resolveLegacyParent: (t) => Q(e, t),
+		maxDepth: e.maxDepth
+	});
+	if (n.tenantIds) {
+		let e = new Set(n.tenantIds);
+		o = o.filter((t) => e.has(t.tenantId));
+	}
+	let s = Tn(e), c = [];
+	for (let e of o) (a.force || e.appliedHash !== await s(e.tenantId)) && c.push(e);
+	let l = o.length - c.length;
+	if (c.length === 0) return a.trigger === "write" ? await r.remove(t.id) : await r.update(t.id, {
+		status: "done",
+		finished_at: new Date(e.now?.() ?? Date.now()).toISOString(),
+		config: {
+			...a,
+			planned: !0,
+			tenant_count: 0
+		}
+	}), {
+		planned: 0,
+		upToDate: l
+	};
+	let u = new Set((await kn(e, t.id)).map((e) => e.tenant_id)), d = Cn(c.length, a.canary, a.waves);
+	for (let [n, r] of c.entries()) u.has(r.tenantId) || await se(i, {
+		kind: "sync-defaults",
+		tenant_id: r.tenantId,
+		rollout_id: t.id,
+		initiated_by: `rollout:${t.id}`,
+		input: {
+			wave: d[n],
+			...a.dry_run ? { dry_run: !0 } : {},
+			...a.force ? { force: !0 } : {}
+		}
+	}, e.executor.engine);
+	return await r.update(t.id, {
+		status: "canary",
+		config: {
+			...a,
+			planned: !0,
+			tenant_count: c.length
+		}
+	}), {
+		planned: c.length,
+		upToDate: l
+	};
+}
+async function kn(e, t) {
+	let { tenantOperations: n } = Dn(e), r = [];
+	for (let e = 0;; e++) {
+		let { operations: i } = await n.list({
+			rollout_id: t,
+			page: e,
+			per_page: 200
+		});
+		if (r.push(...i), i.length < 200) break;
+	}
+	return r.sort((e, t) => e.created_at === t.created_at ? e.id < t.id ? -1 : 1 : e.created_at < t.created_at ? -1 : 1);
+}
+//#endregion
+//#region src/rollouts/advance.ts
+var An = (e) => {
+	let t = e.input?.wave;
+	return typeof t == "number" ? t : 0;
+}, jn = (e) => e.status === "failed" || e.status === "cancelled";
+function Mn(e, t, n) {
+	let r = t.filter((e) => An(e) === n), i = r.filter(jn).length, a = n === 0 && e.canary > 0, o = a ? 0 : e.failure_threshold;
+	return r.length === 0 || i === 0 || i / r.length <= o ? null : `${a ? "canary" : `wave ${n}`} failed for ${i} of ${r.length} tenant(s)`;
+}
+async function Nn(e, t) {
+	let n = $(e), r = e.now?.() ?? Date.now(), i = typeof t == "string" ? await n.get(t) : t;
+	if (!i || i.kind !== "config-sync") return {
+		rolloutId: String(i?.id ?? t),
+		outcome: "skipped",
+		started: 0
+	};
+	let a = i.id;
+	if (!En.includes(i.status) || i.status === "paused") return {
+		rolloutId: a,
+		outcome: "skipped",
+		started: 0
+	};
+	let o = Z(i);
+	if (!o.planned) {
+		if (r - Date.parse(i.updated_at) < o.debounce_ms) return {
+			rolloutId: a,
+			outcome: "waiting",
+			started: 0
+		};
+		let { planned: t } = await On(e, i);
+		if (t === 0) return {
+			rolloutId: a,
+			outcome: "planned-empty",
+			started: 0
+		};
+		i = await n.get(a) ?? i, o = Z(i);
+	}
+	let s = await kn(e, a), c = s.filter((e) => !L(e.status));
+	if (c.length === 0) {
+		let e = Math.max(0, ...s.map(An)), t = s.length > 0 && e > (o.accepted_through ?? -1) ? Mn(o, s, e) : null;
+		return await n.update(a, {
+			status: t ? "failed" : "done",
+			...t ? { paused_reason: t } : {},
+			finished_at: new Date(r).toISOString()
+		}), {
+			rolloutId: a,
+			outcome: "done",
+			started: 0
+		};
+	}
+	let l = Math.min(...c.map(An)), u = l - 1;
+	if (u >= 0 && u > (o.accepted_through ?? -1)) {
+		let e = Mn(o, s, u);
+		if (e) return await n.update(a, {
+			status: "paused",
+			paused_reason: e
+		}), {
+			rolloutId: a,
+			outcome: "paused",
+			started: 0,
+			wave: l
+		};
+	}
+	let d = l === 0 ? "canary" : "rolling";
+	i.status !== d && await n.update(a, { status: d });
+	let f = c.filter((e) => An(e) === l), p = f.filter((e) => e.status === "running").length, m = Math.max(0, o.max_concurrent - p), { tenantOperations: h, tenantOperationEvents: g } = Dn(e), _ = I({
+		tenantOperations: h,
+		tenantOperationEvents: g
+	}), v = 0;
+	for (let t of f.filter((e) => e.status === "pending").slice(0, m)) {
+		try {
+			await _.markRunning(t.id), await e.executor.start(t);
+		} catch (e) {
+			try {
+				let n = await h.get(t.id);
+				n && !L(n.status) && await _.markFailed(t.id, e);
+			} catch {}
+		}
+		v++;
+	}
+	return {
+		rolloutId: a,
+		outcome: v > 0 ? "started" : "running",
+		started: v,
+		wave: l
+	};
+}
+async function Pn(e, t = {}) {
+	let { rollouts: n } = await $(e).list({
+		kind: "config-sync",
+		status: [
+			"pending",
+			"canary",
+			"rolling"
+		],
+		per_page: t.limit ?? 20
+	}), r = [];
+	for (let i of n) try {
+		r.push(await Nn(e, i));
+	} catch (e) {
+		t.logger?.warn(`Advancing rollout ${i.id} failed:`, e);
+	}
+	return r;
+}
+async function Fn(e, t, n = "paused by an operator") {
+	let r = $(e), i = await r.get(t);
+	return !i || i.kind !== "config-sync" ? null : i.status === "done" || i.status === "failed" ? i : (await r.update(t, {
+		status: "paused",
+		paused_reason: n
+	}), r.get(t));
+}
+async function In(e, t) {
+	let n = $(e), r = await n.get(t);
+	if (!r || r.kind !== "config-sync") return null;
+	if (r.status !== "paused") return r;
+	let i = Z(r), a = (await kn(e, t)).filter((e) => !L(e.status)), o = a.length > 0 ? Math.min(...a.map(An)) : 0;
+	return await n.update(t, {
+		status: o === 0 ? "canary" : "rolling",
+		paused_reason: null,
+		config: {
+			...i,
+			accepted_through: Math.max(i.accepted_through ?? -1, o - 1)
+		}
+	}), n.get(t);
+}
+//#endregion
+//#region src/rollouts/verify.ts
+var Ln = {
+	added: "missing",
+	changed: "changed",
+	delete: "stale"
+};
+function Rn(e) {
+	return (e.rows ?? e.changes.flatMap((e) => {
+		if (e.startsWith("skip ")) return [];
+		let t = /^delete ([^:\s]+):(.*)$/.exec(e);
+		if (t) return [{
+			entity: t[1],
+			key: t[2],
+			action: "delete"
+		}];
+		let n = /^([^:\s]+):(.*)$/.exec(e);
+		return n ? [{
+			entity: n[1],
+			key: n[2],
+			action: "changed"
+		}] : [];
+	})).flatMap((e) => {
+		let t = Ln[e.action];
+		return t ? [{
+			entity: e.entity,
+			key: e.key,
+			kind: t
+		}] : [];
+	});
+}
+async function zn(e, t) {
+	let n = await e.adapters.tenants.get(t);
+	if (!n) return null;
+	let r = n.config_sync ?? "inherit-on-read", i = {
+		tenant_id: t,
+		config_sync: r,
+		errors: []
+	};
+	if (r === "detached") return {
+		...i,
+		method: "not-applicable",
+		ok: !0,
+		differences: []
+	};
+	if (r === "inherit-on-read") {
+		let n = (await De({
+			adapters: e.adapters,
+			tenantId: t,
+			legacyControlPlane: await Q(e, t),
+			maxDepth: e.maxDepth
+		})).filter((e) => !e.expected).map((e) => ({
+			entity: e.entity,
+			key: e.key,
+			kind: e.kind,
+			...e.fields.length > 0 ? { fields: e.fields } : {}
+		}));
+		return {
+			...i,
+			method: "read-time",
+			ok: n.length === 0,
+			differences: n
+		};
+	}
+	let a = await e.syncConfig(t, {
+		dryRun: !0,
+		force: !1,
+		prune: !1
+	}), o = Rn(a), s = Object.entries(a.entities).filter(([, e]) => e.errors.length > 0).map(([e, t]) => `${e}: the sync dry run reported ${t.errors.length} error(s)`);
+	return {
+		...i,
+		method: "sync-dry-run",
+		ok: o.length === 0 && s.length === 0,
+		differences: o,
+		errors: s.slice(0, 20)
+	};
+}
+//#endregion
+//#region src/rollouts/status.ts
+async function Bn(e, t) {
+	let n = await e.adapters.tenants.get(t);
+	if (!n) return null;
+	if (n.config_sync === "detached") return {
+		tenant_id: t,
+		parent_tenant_id: null,
+		config_sync: "detached",
+		config_sync_hash: null,
+		config_synced_at: null,
+		expected_hash: null,
+		drifted: !1,
+		chain: [],
+		inherited: {}
+	};
+	let r = n.config_sync === "synced", i = await R({
+		tenantId: t,
+		getTenant: (t) => e.adapters.tenants.get(t),
+		legacyControlPlane: await Q(e, t),
+		maxDepth: e.maxDepth
+	}), a = r ? await Tn(e)(t) : null, o = n.config_sync_hash ?? null, s = {};
+	for (let n of [...i].reverse()) {
+		let r = await V(e.adapters, n), i = (e, t) => U(e, t) === "shared", a = async (e, r, a) => {
+			for (let o of r) {
+				if (!i(a, o)) continue;
+				let r = await it(e, t, W(e, o)), c = o.id ?? o.hook_id;
+				c && x(c) && s[r] || (s[r] = n);
+			}
+		};
+		await a("connection", r.connections, "connection"), await a("resourceServer", r.resourceServers, "resourceServer"), await a("action", r.actions, "action"), await a("hook", r.hooks, "hook"), r.emailProvider && i("emailProvider", r.emailProvider) && (s.emailProvider = n), r.branding && i("branding", r.branding) && (s.branding = n), r.promptSettings && i("promptSettings", r.promptSettings) && (s.promptSettings = n);
+	}
+	return {
+		tenant_id: t,
+		parent_tenant_id: n.parent_tenant_id ?? null,
+		config_sync: r ? "synced" : "inherit-on-read",
+		config_sync_hash: o,
+		config_synced_at: n.config_synced_at ?? null,
+		expected_hash: a,
+		drifted: r && a !== o,
+		chain: i,
+		inherited: s
+	};
+}
+//#endregion
+//#region src/rollouts/reconcile.ts
+async function Vn(e, n = {}) {
+	let r = $(e), i = n.rootTenantId ?? e.controlPlaneTenantId, a = n.limit ?? 500, o = await wn(e.adapters, i, {
+		resolveLegacyParent: (t) => Q(e, t),
+		maxDepth: e.maxDepth
+	}), s = Tn(e), c = [];
+	for (let e of o) {
+		if (c.length >= a) break;
+		try {
+			let t = await s(e.tenantId);
+			e.appliedHash !== t && c.push({
+				tenantId: e.tenantId,
+				expected: t,
+				applied: e.appliedHash
+			});
+		} catch (t) {
+			n.logger?.warn(`Could not compute the expected hash of ${e.tenantId}:`, t);
+		}
+	}
+	let l = {
+		checked: o.length,
+		drifted: c.length,
+		alreadyCovered: 0,
+		recentlyFailed: 0
+	};
+	if (c.length === 0) return l;
+	let u = /* @__PURE__ */ new Set(), { rollouts: d } = await r.list({
+		kind: "config-sync",
+		status: [...En],
+		per_page: 100
+	});
+	for (let t of d) for (let n of await kn(e, t.id)) n.tenant_id && !L(n.status) && u.add(n.tenant_id);
+	for (let r of c) try {
+		await e.adapters.logs.create(r.tenantId, {
+			type: t.CONFIG_DRIFT,
+			date: new Date(e.now?.() ?? Date.now()).toISOString(),
+			isMobile: !1,
+			description: r.applied ? "hash-mismatch: applied config differs from what the parent chain publishes" : "never-synced: no config has been applied to this synced tenant",
+			details: {
+				reason: r.applied ? "hash-mismatch" : "never-synced",
+				applied_hash: r.applied,
+				expected_hash: r.expected,
+				covered_by_open_rollout: u.has(r.tenantId),
+				trigger: "reconcile"
+			}
+		});
+	} catch (e) {
+		n.logger?.warn(`Could not record drift for ${r.tenantId}:`, e);
+	}
+	let f = c.filter((e) => !u.has(e.tenantId));
+	l.alreadyCovered = c.length - f.length;
+	let { tenantOperations: p } = Dn(e), m = e.now?.() ?? Date.now(), h = n.retryAfterMs ?? 36e5, g = [];
+	for (let e of f) {
+		try {
+			let { operations: t } = await p.list({
+				tenant_id: e.tenantId,
+				kind: "sync-defaults",
+				per_page: 5
+			}), n = t.sort((e, t) => e.created_at === t.created_at ? e.id < t.id ? 1 : -1 : e.created_at < t.created_at ? 1 : -1)[0];
+			if (n?.status === "failed" && m - Date.parse(n.updated_at) < h) {
+				l.recentlyFailed++;
+				continue;
+			}
+		} catch (t) {
+			n.logger?.warn(`Could not read the latest sync of ${e.tenantId}:`, t);
+		}
+		g.push(e);
+	}
+	if (g.length === 0) return l;
+	let _ = await r.create({
+		kind: "config-sync",
+		initiated_by: "reconcile",
+		config: {
+			...X,
+			trigger: "reconcile",
+			root_tenant_id: i,
+			planned: !1
+		}
+	});
+	return await On(e, _, { tenantIds: g.map((e) => e.tenantId) }), l.rolloutId = _.id, l;
+}
+//#endregion
+//#region src/rollouts/trigger.ts
+function Hn(e, t) {
+	return e === "hookCode" ? !0 : !t || typeof t != "object" ? !1 : U(e, t) !== "local";
+}
+async function Un(e, t, n) {
+	let r = $(e), { rollouts: i } = await r.list({
+		kind: "config-sync",
+		status: "pending",
+		per_page: 100
+	}), a = i.find((e) => {
+		let n = Z(e);
+		return n.trigger === "write" && n.planned !== !0 && n.origin_tenant_id === t;
+	});
+	return a ? (await r.update(a.id, {}), await r.get(a.id) ?? a) : r.create({
+		kind: "config-sync",
+		initiated_by: n ?? `write:${t}`,
+		config: {
+			...X,
+			trigger: "write",
+			root_tenant_id: t,
+			origin_tenant_id: t,
+			planned: !1
+		}
+	});
+}
+async function Wn(e, t) {
+	if (t === e.controlPlaneTenantId) return !0;
+	try {
+		let { tenants: n } = await e.adapters.tenants.list({
+			q: `parent_tenant_id:${t}`,
+			per_page: 1
+		});
+		return n.some((e) => e.parent_tenant_id === t);
+	} catch {
+		return !0;
+	}
+}
+function Gn(e, t = {}) {
+	let n = async (n) => {
+		try {
+			await Wn(e, n) && await Un(e, n);
+		} catch (e) {
+			t.logger?.warn(`Could not record a config change for ${n}:`, e);
+		}
+	}, r = (e) => ({
+		afterCreate: async (t, r) => {
+			Hn(e, r) && await n(t.tenantId);
+		},
+		afterUpdate: async (t, r, i) => {
+			Hn(e, i) && await n(t.tenantId);
+		},
+		afterDelete: async (e) => n(e.tenantId)
+	});
+	return {
+		actions: r("action"),
+		hooks: r("hook"),
+		hookCode: r("hookCode"),
+		connections: r("connection"),
+		resourceServers: r("resourceServer")
+	};
+}
+//#endregion
+//#region src/rollouts/controller.ts
+function Kn(e) {
+	return {
+		async create(t) {
+			let n = {
+				...X,
+				waves: t.waves ?? [...X.waves],
+				canary: t.canary ?? X.canary,
+				failure_threshold: t.failureThreshold ?? X.failure_threshold,
+				max_concurrent: t.maxConcurrent ?? X.max_concurrent,
+				trigger: "manual",
+				root_tenant_id: t.rootTenantId ?? e.controlPlaneTenantId,
+				dry_run: t.dryRun,
+				force: t.force,
+				planned: !1
+			}, r = $(e), i = await r.create({
+				kind: "config-sync",
+				initiated_by: t.initiatedBy,
+				config: n
+			});
+			return await On(e, i, { tenantIds: t.tenantIds }), await Nn(e, i.id), await r.get(i.id) ?? i;
+		},
+		pause: (t, n) => Fn(e, t, n),
+		resume: (t) => In(e, t)
+	};
+}
+//#endregion
 //#region src/init.ts
-function ut(e) {
-	let { dataAdapter: t, controlPlane: n, controlPlane: { tenantId: r = "control_plane", clientId: i } = {}, resolveControlPlane: a, inheritanceShadow: o, sync: s = {
+function qn(e) {
+	let { dataAdapter: t, controlPlane: n, controlPlane: { tenantId: r = "control_plane", clientId: i } = {}, resolveControlPlane: a, inheritanceShadow: o, syncDefaults: s, detachTenant: c, tenantMemberRequests: l, rolloutExecutor: u, sync: d = {
 		resourceServers: !0,
 		roles: !0
-	}, defaultPermissions: c = ["tenant:admin"], requireOrganizationMatch: l = !1, managementApiExtensions: u = [], entityHooks: d, getChildTenantIds: p, getAdapters: h, ...g } = e;
+	}, defaultPermissions: f = ["tenant:admin"], requireOrganizationMatch: p = !1, managementApiExtensions: m = [], entityHooks: h, getChildTenantIds: _, getAdapters: v, ...b } = e;
 	if (a && !n) throw Error("initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it.");
-	let _ = t, v = t;
-	n && (_ = Z(t, {
-		controlPlaneTenantId: r,
-		controlPlaneClientId: i,
-		resolveControlPlane: a,
-		inheritanceShadow: o
-	}), v = {
-		...rt(t, {
+	let x = t, S = t, C;
+	if (n) {
+		let n = Me({
+			base: Re({
+				controlPlaneTenantId: r,
+				controlPlaneClientId: i,
+				resolveControlPlane: a
+			}),
+			getTenant: async (e) => await t.tenants.get(e) ?? null,
 			controlPlaneTenantId: r,
-			resolveControlPlane: a
-		}),
-		multiTenancyConfig: {
+			ttlMs: e.configSyncCacheTtlMs
+		});
+		C = (e) => n.invalidate(e), x = We(t, {
 			controlPlaneTenantId: r,
 			controlPlaneClientId: i,
-			resolveControlPlane: a
-		}
-	});
-	let y = g.tenantOperationExecutor;
-	if (!y && t.tenantOperations && t.tenantOperationEvents && g.tenantUpgrade) {
+			resolveControlPlane: a,
+			inheritanceShadow: o,
+			configSync: n
+		}), S = {
+			...Be(t, {
+				controlPlaneTenantId: r,
+				resolveControlPlane: n.resolve
+			}),
+			multiTenancyConfig: {
+				controlPlaneTenantId: r,
+				controlPlaneClientId: i,
+				resolveControlPlane: n.resolve
+			}
+		};
+	}
+	let w = b.tenantOperationExecutor, T, E;
+	if (t.tenantOperations && t.tenantOperationEvents) {
 		let e = {
 			tenantOperations: t.tenantOperations,
 			tenantOperationEvents: t.tenantOperationEvents
-		}, n = g.tenantUpgrade, r = ie({
+		}, n = b.tenantUpgrade, i = I(e), o = s ?? xt(t, {
+			controlPlaneTenantId: r,
+			resolveControlPlane: a
+		}), u = c ?? Mt(t), d = l ? l.store ?? Ft(t) : void 0, f = oe({
 			stores: e,
-			definitions: { upgrade: (e) => [{
-				name: "upgrade",
-				async run() {
-					if (!e.tenant_id) throw Error("upgrade operations require a tenant_id");
-					await n(e.tenant_id);
-				}
-			}] }
+			definitions: {
+				detach: (e) => [{
+					name: "detach",
+					run: () => Dt({
+						operation: e,
+						detachTenant: u,
+						recorder: i,
+						onDetached: (e) => C?.(e)
+					})
+				}],
+				...n ? { upgrade: (e) => [{
+					name: "upgrade",
+					async run() {
+						if (!e.tenant_id) throw Error("upgrade operations require a tenant_id");
+						await n(e.tenant_id);
+					}
+				}] } : {},
+				"sync-defaults": (e) => [{
+					name: "sync-defaults",
+					run: () => bt({
+						operation: e,
+						syncConfig: o,
+						recorder: i
+					})
+				}],
+				...d && l ? { "tenant-members-request": (e) => [{
+					name: "tenant-members-request",
+					run: () => Rt({
+						operation: e,
+						store: d,
+						getBackend: l.getBackend,
+						recorder: i,
+						executeOptions: { isRequesterAllowed: l.isRequesterAllowed }
+					})
+				}] } : {}
+			}
 		});
-		y = {
-			engine: r.engine,
-			enqueue: (t) => oe(e, r, {
+		if (T = f, d) {
+			let n = {
+				stores: e,
+				executor: f
+			};
+			E = {
+				enqueue: (e, t) => Bt(n, e, t),
+				reconcile: (e = {}) => Vt({
+					...n,
+					store: d,
+					tenantIds: e.tenantIds ?? (async () => (await g((e) => t.tenants.list(e), "tenants", {
+						cursorField: "id",
+						pageSize: 100
+					})).map((e) => e.id).filter((e) => e !== r)),
+					graceMs: e.graceMs,
+					maxAttempts: e.maxAttempts
+				})
+			};
+		}
+		w ??= {
+			engine: f.engine,
+			kinds: n ? [
+				"upgrade",
+				"sync-defaults",
+				"detach"
+			] : ["sync-defaults", "detach"],
+			enqueue: (t) => ce(e, f, {
 				...t,
 				tenant_id: t.tenant_id
-			})
+			}, { returnFailed: t.kind === "sync-defaults" || t.kind === "detach" })
 		};
 	}
-	let b = s !== !1, x = b ? {
-		resourceServers: s.resourceServers ?? !0,
-		roles: s.roles ?? !0
+	if (l && !E) throw Error("initMultiTenant: `tenantMemberRequests` requires the `tenantOperations` and `tenantOperationEvents` adapters on the data adapter, which run the `tenant-members-request` operation.");
+	let D = u ?? T, O = D && t.rollouts && t.tenantOperations && t.tenantOperationEvents ? {
+		adapters: t,
+		executor: D,
+		controlPlaneTenantId: r,
+		resolveControlPlane: a
+	} : void 0, k = O ? Kn(O) : void 0, A = O ? Gn(O, { logger: console }) : void 0, j = d !== !1, ee = j ? {
+		resourceServers: d.resourceServers ?? !0,
+		roles: d.roles ?? !0
 	} : {
 		resourceServers: !1,
 		roles: !1
-	}, { entityHooks: S, tenantHooks: C } = ve({
+	}, { entityHooks: M, tenantHooks: N } = Qt({
 		controlPlaneTenantId: r,
-		getChildTenantIds: p ?? (async () => (await f((e) => _.tenants.list(e), "tenants", {
+		getChildTenantIds: _ ?? (async () => (await g((e) => x.tenants.list(e), "tenants", {
 			cursorField: "id",
 			pageSize: 100
 		})).filter((e) => e.id !== r).map((e) => e.id)),
-		getAdapters: h ?? (async () => _),
-		getControlPlaneAdapters: async () => _,
-		sync: x
-	}), w = {
-		resourceServers: [S.resourceServers, ...d?.resourceServers ?? []],
-		roles: [S.roles, ...d?.roles ?? []],
-		connections: d?.connections ?? [],
-		tenants: d?.tenants ?? [],
-		rolePermissions: d?.rolePermissions ?? []
-	}, T = N({ accessControl: {
+		getAdapters: v ?? (async () => x),
+		getControlPlaneAdapters: async () => x,
+		sync: ee
+	}), te = {
+		resourceServers: [
+			M.resourceServers,
+			A?.resourceServers,
+			...h?.resourceServers ?? []
+		],
+		roles: [M.roles, ...h?.roles ?? []],
+		connections: [A?.connections, ...h?.connections ?? []],
+		tenants: h?.tenants ?? [],
+		rolePermissions: h?.rolePermissions ?? [],
+		actions: [A?.actions, ...h?.actions ?? []],
+		hooks: [A?.hooks, ...h?.hooks ?? []],
+		hookCode: [A?.hookCode, ...h?.hookCode ?? []]
+	}, P = Ut({ accessControl: {
 		controlPlaneTenantId: r,
-		requireOrganizationMatch: l,
-		defaultPermissions: c
-	} }), E = F({ accessControl: {
-		controlPlaneTenantId: r,
-		requireOrganizationMatch: l,
-		defaultPermissions: c
-	} }, { tenants: {
+		requireOrganizationMatch: p,
+		defaultPermissions: f
+	} }), ne = an({
+		accessControl: {
+			controlPlaneTenantId: r,
+			requireOrganizationMatch: p,
+			defaultPermissions: f
+		},
+		onConfigSyncChange: (e) => C?.(e),
+		configSyncStatus: (e) => Bn({
+			adapters: t,
+			controlPlaneTenantId: r,
+			resolveControlPlane: a
+		}, e),
+		verifyConfigSync: (e) => zn({
+			adapters: t,
+			controlPlaneTenantId: r,
+			resolveControlPlane: a,
+			syncConfig: s ?? xt(t, {
+				controlPlaneTenantId: r,
+				resolveControlPlane: a
+			})
+		}, e)
+	}, { tenants: {
 		async beforeCreate(e, t) {
-			return T.beforeCreate && (t = await T.beforeCreate(e, t)), C.beforeCreate && (t = await C.beforeCreate(e, t)), t;
+			return P.beforeCreate && (t = await P.beforeCreate(e, t)), N.beforeCreate && (t = await N.beforeCreate(e, t)), t;
 		},
 		async afterCreate(e, t) {
-			await T.afterCreate?.(e, t), await C.afterCreate?.(e, t);
+			await P.afterCreate?.(e, t), await N.afterCreate?.(e, t);
 		},
 		async beforeDelete(e, t) {
-			await T.beforeDelete?.(e, t), await C.beforeDelete?.(e, t);
-		}
-	} }), { app: D } = m({
-		dataAdapter: _,
-		managementDataAdapter: v,
-		...g,
-		tenantOperationExecutor: y,
-		entityHooks: w,
-		managementApiExtensions: [...u, {
+			await P.beforeDelete?.(e, t), await N.beforeDelete?.(e, t);
+		}
+	} }), { app: re } = y({
+		dataAdapter: x,
+		managementDataAdapter: S,
+		...b,
+		tenantOperationExecutor: w,
+		...k ? { rolloutController: k } : {},
+		entityHooks: te,
+		managementApiExtensions: [...m, {
 			path: "/tenants",
-			router: E
+			router: ne
 		}],
-		managementApiMiddleware: [...g.managementApiMiddleware ?? [], ...b ? [Ee()] : []]
+		managementApiMiddleware: [...b.managementApiMiddleware ?? [], ...j ? [gn()] : []]
 	});
 	return {
-		app: D,
-		controlPlaneTenantId: r
+		app: re,
+		controlPlaneTenantId: r,
+		rollouts: O,
+		memberRequests: E
 	};
 }
 //#endregion
 //#region src/rollout/payload.ts
-function dt(e) {
+function Jn(e) {
 	let { pkcs7: t, tenant_id: n, ...r } = e;
 	return r;
 }
-async function ft(e, t, n = {}, r) {
-	let i = z(n), a = n.signingKeys ?? !0, o = n.tenants ?? !0, s = await H(e, t, i), c = a ? (await g(e.keys)).map(dt) : [], l = o ? await pt(e, t, r) : [];
+async function Yn(e, t, n = {}, r) {
+	let i = pe(n), a = n.signingKeys ?? !0, o = n.tenants ?? !0, s = await ge(e, t, i), c = a ? (await S(e.keys)).map(Jn) : [], l = o ? await Xn(e, t, r) : [];
 	return {
 		connections: s.connections,
 		resourceServers: s.resourceServers.filter((e) => e.is_system),
-		hooks: s.hooks.filter(ze),
+		hooks: s.hooks.filter(he),
 		emailProvider: s.emailProvider,
 		branding: s.branding,
 		promptSettings: s.promptSettings,
@@ -1592,7 +3380,7 @@ async function ft(e, t, n = {}, r) {
 		tenants: l
 	};
 }
-async function pt(e, t, n) {
+async function Xn(e, t, n) {
 	let r = n && n !== t ? [t, n] : [t], i = [];
 	for (let t of r) {
 		let n = await e.tenants.get(t);
@@ -1603,19 +3391,19 @@ async function pt(e, t, n) {
 	}
 	return i;
 }
-async function mt(e, t, n) {
-	let r = B();
+async function Zn(e, t, n) {
+	let r = z();
 	if (e.length === 0) return r;
-	let i = await g(t.keys), a = new Set(i.map((e) => e.kid));
-	for (let i of e) await V(r, `signing_key ${i.kid}`, n, async () => {
-		let e = dt(i);
+	let i = await S(t.keys), a = new Set(i.map((e) => e.kid));
+	for (let i of e) await B(r, `signing_key ${i.kid}`, n, async () => {
+		let e = Jn(i);
 		a.has(e.kid) || (await t.keys.create(e), a.add(e.kid), r.upserted += 1);
 	});
 	return r;
 }
-async function ht(e, t, n) {
-	let r = B();
-	for (let i of e) await V(r, `tenant ${i.id}`, n, async () => {
+async function Qn(e, t, n) {
+	let r = z();
+	for (let i of e) await B(r, `tenant ${i.id}`, n, async () => {
 		await t.tenants.get(i.id) || (await t.tenants.create({
 			id: i.id,
 			friendly_name: i.friendly_name
@@ -1623,46 +3411,50 @@ async function ht(e, t, n) {
 	});
 	return r;
 }
-async function gt(e, t, n, r = {}) {
-	let i = r.continueOnError ?? !1, o = z(r.entities), s = r.entities?.signingKeys ?? !0, c = r.entities?.tenants ?? !0, l = {
+async function $n(e, t, n, r = {}) {
+	let i = r.continueOnError ?? !1, a = pe(r.entities), o = r.entities?.signingKeys ?? !0, c = r.entities?.tenants ?? !0, l = {
 		connections: e.connections,
 		resourceServers: e.resourceServers,
 		hooks: e.hooks,
-		emailProvider: e.emailProvider ? u.parse(e.emailProvider) : null,
-		branding: e.branding ? a.parse(e.branding) : null,
-		promptSettings: e.promptSettings ? _.parse(e.promptSettings) : null
-	}, d = c ? await ht(e.tenants ?? [], t, i) : B(), f = Re(n);
-	await Be(l, t, n, o, i, f);
-	let p = s ? await mt(e.signingKeys, t, i) : B();
+		emailProvider: e.emailProvider ? p.parse(e.emailProvider) : null,
+		branding: e.branding ? s.parse(e.branding) : null,
+		promptSettings: e.promptSettings ? C.parse(e.promptSettings) : null
+	}, u = c ? await Qn(e.tenants ?? [], t, i) : z(), d = me(n);
+	await _e(l, t, n, a, i, d);
+	let f = o ? await Zn(e.signingKeys, t, i) : z(), m = e.resolved && r.resolved ? await ut(e.resolved, t, r.resolved.tenantId, {
+		continueOnError: i,
+		...r.resolved
+	}) : void 0;
 	return {
-		...f,
-		signingKeys: p,
-		tenants: d
+		...d,
+		signingKeys: f,
+		tenants: u,
+		...m ? { resolved: m } : {}
 	};
 }
 //#endregion
 //#region src/rollout/index.ts
-function _t(e) {
+function er(e) {
 	return {
-		syncDefaults: (t) => U(e, t),
+		syncDefaults: (t) => ve(e, t),
 		syncDefaultsToTenants: async (t) => {
 			let n = [];
-			for (let r of t) n.push(await U(e, r));
+			for (let r of t) n.push(await ve(e, r));
 			return n;
 		}
 	};
 }
 //#endregion
 //#region src/plugin.ts
-function vt(e) {
-	let t = $(e);
+function tr(e) {
+	let t = nr(e);
 	return {
 		name: "multi-tenancy",
-		middleware: Q(e),
+		middleware: xn(e),
 		hooks: t,
 		routes: [{
 			path: "/management",
-			handler: F(e, t)
+			handler: an(e, t)
 		}],
 		onRegister: async () => {
 			console.log("Multi-tenancy plugin registered"), e.accessControl && console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`), e.subdomainRouting && console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`), e.databaseIsolation && console.log("  - Database isolation enabled");
@@ -1671,29 +3463,29 @@ function vt(e) {
 }
 //#endregion
 //#region src/index.ts
-function $(e) {
-	let t = e.accessControl ? E(e.accessControl) : {}, n = e.databaseIsolation ? ee(e.databaseIsolation) : {}, r = N(e);
+function nr(e) {
+	let t = e.accessControl ? M(e.accessControl) : {}, n = e.databaseIsolation ? te(e.databaseIsolation) : {}, r = Ut(e);
 	return {
 		...t,
 		...n,
 		tenants: r
 	};
 }
-function yt(t) {
-	let n = new e(), r = $(t);
-	return n.route("/tenants", F(t, r)), n;
+function rr(t) {
+	let n = new e(), r = nr(t);
+	return n.route("/tenants", an(t, r)), n;
 }
-function bt(e) {
+function ir(e) {
 	return {
-		hooks: $(e),
-		middleware: Q(e),
-		app: yt(e),
+		hooks: nr(e),
+		middleware: xn(e),
+		app: rr(e),
 		config: e,
-		wrapAdapters: (t, n) => Z(t, {
+		wrapAdapters: (t, n) => We(t, {
 			controlPlaneTenantId: e.accessControl?.controlPlaneTenantId,
 			controlPlaneClientId: n?.controlPlaneClientId
 		})
 	};
 }
 //#endregion
-export { gt as applyControlPlaneDefaultsPayload, ft as buildControlPlaneDefaultsPayload, A as buildEngineInstanceId, Je as compareShadow, Ae as computeLegacyConfig, E as createAccessControlHooks, st as createAccessControlMiddleware, ot as createControlPlaneTenantMiddleware, ee as createDatabaseHooks, lt as createDatabaseMiddleware, _t as createDirectRolloutAdapter, ie as createInlineExecutor, yt as createMultiTenancy, $ as createMultiTenancyHooks, Q as createMultiTenancyMiddleware, vt as createMultiTenancyPlugin, M as createOperationRecorder, Ee as createProtectSyncedMiddleware, N as createProvisioningHooks, it as createRuntimeFallbackAdapter, Ze as createShadowReporter, ct as createSubdomainMiddleware, ve as createSyncHooks, F as createTenantsOpenAPIRouter, qe as diffConfig, L as effectiveOverride, I as effectiveScope, oe as enqueueTenantOperation, j as errorToMessage, ut as initMultiTenant, re as inlineStepRunner, ne as isTerminalStatus, et as mergeClientWithFallback, Le as mergeConfig, U as projectControlPlaneDefaults, W as readConfigRows, De as resolveTenantChain, ce as runRecordedTenantOperation, bt as setupMultiTenancy, D as validateTenantAccess, Z as withRuntimeFallback, rt as withSystemResourceServerInheritance };
+export { X as DEFAULT_ROLLOUT_SETTINGS, Sn as DEFAULT_ROLLOUT_WAVES, zt as MAX_MEMBER_REQUEST_ATTEMPTS, Nn as advanceRollout, Pn as advanceRollouts, $n as applyControlPlaneDefaultsPayload, ut as applyResolvedConfigBlock, kt as assertDetachEligible, Cn as assignWaves, Yn as buildControlPlaneDefaultsPayload, re as buildEngineInstanceId, at as buildResolvedConfigBlock, De as compareShadow, fe as computeLegacyConfig, M as createAccessControlHooks, vn as createAccessControlMiddleware, Me as createConfigSyncResolver, _n as createControlPlaneTenantMiddleware, te as createDatabaseHooks, bn as createDatabaseMiddleware, er as createDirectRolloutAdapter, Tn as createExpectedHash, Mt as createInProcessDetach, Ft as createInProcessMemberRequestStore, xt as createInProcessSyncConfig, oe as createInlineExecutor, rr as createMultiTenancy, nr as createMultiTenancyHooks, xn as createMultiTenancyMiddleware, tr as createMultiTenancyPlugin, I as createOperationRecorder, se as createOperationRow, gn as createProtectSyncedMiddleware, Ut as createProvisioningHooks, Kn as createRolloutController, Gn as createRolloutWriteHooks, Ve as createRuntimeFallbackAdapter, Ae as createShadowReporter, yn as createSubdomainMiddleware, Qt as createSyncHooks, an as createTenantsOpenAPIRouter, Tt as detachErrors, St as detachOptionsOf, jt as detachTenantRows, Ee as diffConfig, Ke as effectiveOverride, U as effectiveScope, Ot as emptyDetachResult, Bt as enqueueTenantMemberRequest, ce as enqueueTenantOperation, F as errorToMessage, ct as findUndecryptableKeyIds, Bn as getConfigSyncStatus, qn as initMultiTenant, ae as inlineStepRunner, Hn as isPublishedRow, L as isTerminalStatus, kn as listRolloutOperations, wn as listSyncedDescendants, At as markTenantDetached, It as memberRequestIdOf, Le as mergeClientWithFallback, $e as mergeConfig, Fn as pauseRollout, On as planRollout, ve as projectControlPlaneDefaults, V as readConfigRows, Z as readRolloutConfig, Vn as reconcileConfigDrift, Vt as reconcileTenantMemberRequests, Un as requestRollout, R as resolveTenantChain, In as resumeRollout, Dt as runDetachStep, Pt as runRecordedTenantOperation, bt as runSyncDefaultsStep, Rt as runTenantMembersRequestStep, ir as setupMultiTenancy, Et as summarizeDetachResult, yt as summarizeSyncResult, gt as syncErrors, ht as syncOptionsOf, it as syncedRowId, N as validateTenantAccess, zn as verifyTenantConfig, We as withRuntimeFallback, Be as withSystemResourceServerInheritance };