@authhero/multi-tenancy 15.3.0 → 15.4.0

package/dist/multi-tenancy.mjs

@@ -1,9 +1,10 @@
 import { Hono as e } from "hono";
-import { LogTypes as t, MANAGEMENT_API_AUDIENCE as n, MANAGEMENT_API_SCOPES as r, actionInsertSchema as i, auth0QuerySchema as a, brandingSchema as o, canDecrypt as s, connectionInsertSchema as c, connectionOptionsSchema as l, connectionSchema as u, deepMergePatch as d, emailProviderSchema as f, escapeLuceneValue as p, fetchAll as m, hookCodeInsertSchema as h, hookInsertSchema as g, init as _, isInteractiveClient as v, isSyncedRowId as y, listControlPlaneKeys as b, promptSettingSchema as ee, provisionDefaultClients as te, resourceServerInsertSchema as x, tenantInsertSchema as S, tenantSchema as C } from "authhero";
-import { HTTPException as w } from "hono/http-exception";
-import { OpenAPIHono as T, createRoute as E, z as D } from "@hono/zod-openapi";
+import { LogTypes as t, MANAGEMENT_API_AUDIENCE as n, MANAGEMENT_API_SCOPES as r, TenantMemberRequestRejected as i, actionInsertSchema as a, auth0QuerySchema as o, brandingSchema as s, canDecrypt as c, connectionInsertSchema as l, connectionOptionsSchema as u, connectionSchema as d, deepMergePatch as f, emailProviderSchema as p, escapeLuceneValue as m, executeTenantMemberRequest as h, fetchAll as g, hookCodeInsertSchema as _, hookInsertSchema as v, init as y, isInteractiveClient as b, isSyncedRowId as x, listControlPlaneKeys as S, promptSettingSchema as C, provisionDefaultClients as w, resourceServerInsertSchema as T, tenantInsertSchema as E, tenantSchema as D } from "authhero";
+import { HTTPException as O } from "hono/http-exception";
+import { OpenAPIHono as k, createRoute as A, z as j } from "@hono/zod-openapi";
+import { escapeLuceneValue as ee } from "@authhero/adapter-interfaces";
 //#region src/hooks/access-control.ts
-function ne(e) {
+function M(e) {
 	let { controlPlaneTenantId: t, requireOrganizationMatch: n = !0 } = e;
 	return { async onTenantAccessValidation(e, r) {
 		if (r === t) return !0;
@@ -14,14 +15,14 @@ function ne(e) {
 		return !0;
 	} };
 }
-function O(e, t, n, r) {
+function N(e, t, n, r) {
 	if (t === n) return !0;
 	let i = r || e;
 	return i ? i.toLowerCase() === t.toLowerCase() : !1;
 }
 //#endregion
 //#region src/hooks/database.ts
-function re(e) {
+function te(e) {
 	return { async resolveDataAdapters(t) {
 		try {
 			return await e.getAdapters(t);
@@ -33,18 +34,18 @@ function re(e) {
 }
 //#endregion
 //#region src/operations/instance-id.ts
-var k = 64;
-function ie(e) {
+var P = 64;
+function ne(e) {
 	return e.replace(/[^a-zA-Z0-9_-]/g, "-");
 }
-function ae(e) {
-	let t = ie(e.id), n = Math.max(0, k - (5 + t.length)), r = ie(e.kind).slice(0, n), i = 3 + r.length + 2 + t.length, a = Math.max(0, k - i);
-	return `op-${r}-${ie(e.tenant_id ?? "fleet").slice(0, a)}-${t}`.slice(0, k);
+function re(e) {
+	let t = ne(e.id), n = Math.max(0, P - (5 + t.length)), r = ne(e.kind).slice(0, n), i = 3 + r.length + 2 + t.length, a = Math.max(0, P - i);
+	return `op-${r}-${ne(e.tenant_id ?? "fleet").slice(0, a)}-${t}`.slice(0, P);
 }
 //#endregion
 //#region src/operations/recorder.ts
-var oe = 2048;
-function se(e) {
+var ie = 2048;
+function F(e) {
 	let t;
 	if (e instanceof Error) t = e.message;
 	else try {
@@ -52,9 +53,9 @@ function se(e) {
 	} catch {
 		t = Object.prototype.toString.call(e);
 	}
-	return t.slice(0, oe);
+	return t.slice(0, ie);
 }
-function A(e) {
+function I(e) {
 	let { tenantOperations: t, tenantOperationEvents: n } = e;
 	return {
 		async markRunning(e, n) {
@@ -88,24 +89,24 @@ function A(e) {
 		async markFailed(e, n) {
 			await t.update(e, {
 				status: "failed",
-				error: se(n),
+				error: F(n),
 				finished_at: (/* @__PURE__ */ new Date()).toISOString()
 			});
 		}
 	};
 }
-function j(e) {
+function L(e) {
 	return e === "succeeded" || e === "failed" || e === "cancelled";
 }
 //#endregion
 //#region src/operations/inline-executor.ts
-var ce = { async do(e, t, n) {
+var ae = { async do(e, t, n) {
 	let r = typeof t == "function" ? t : n;
 	if (!r) throw Error("StepRunner.do called without a function");
 	return r();
 } };
-function le(e) {
-	let t = A(e.stores);
+function oe(e) {
+	let t = I(e.stores);
 	return {
 		engine: "inline",
 		async start(n) {
@@ -124,7 +125,7 @@ function le(e) {
 				try {
 					let r = await e.run({
 						operation: n,
-						step: ce
+						step: ae
 					});
 					await t.appendEvent(n.id, {
 						step: e.name,
@@ -135,7 +136,7 @@ function le(e) {
 					throw await t.appendEvent(n.id, {
 						step: e.name,
 						outcome: "failed",
-						detail: { message: se(r) }
+						detail: { message: F(r) }
 					}), await t.markFailed(n.id, r), r;
 				}
 			}
@@ -145,7 +146,7 @@ function le(e) {
 }
 //#endregion
 //#region src/operations/enqueue.ts
-async function M(e, t, n) {
+async function se(e, t, n) {
 	let r = await e.tenantOperations.create({
 		tenant_id: t.tenant_id,
 		rollout_id: t.rollout_id,
@@ -155,12 +156,12 @@ async function M(e, t, n) {
 		target_worker_version: t.target_worker_version,
 		target_database_version: t.target_database_version,
 		input: t.input
-	}), i = ae(r);
+	}), i = re(r);
 	try {
 		await e.tenantOperations.update(r.id, { engine_instance_id: i });
 	} catch (t) {
 		try {
-			await A(e).markFailed(r.id, t);
+			await I(e).markFailed(r.id, t);
 		} catch {}
 		throw t;
 	}
@@ -169,15 +170,15 @@ async function M(e, t, n) {
 		engine_instance_id: i
 	};
 }
-async function ue(e, t, n, r = {}) {
-	let i = A(e), a = await M(e, n, t.engine);
+async function ce(e, t, n, r = {}) {
+	let i = I(e), a = await se(e, n, t.engine);
 	try {
 		await t.start(a);
 	} catch (t) {
 		let n = null;
 		try {
 			let r = await e.tenantOperations.get(a.id);
-			r && !j(r.status) && await i.markFailed(a.id, t), n = await e.tenantOperations.get(a.id);
+			r && !L(r.status) && await i.markFailed(a.id, t), n = await e.tenantOperations.get(a.id);
 		} catch (e) {
 			console.warn("Failed to record tenant operation failure:", e);
 		}
@@ -190,17 +191,17 @@ async function ue(e, t, n, r = {}) {
 		return console.warn("Failed to re-fetch tenant operation after start:", e), a;
 	}
 }
-async function de(e) {
+async function le(e) {
 	let { tenantId: t, parentTenantId: n, getTenant: r, getChildren: i } = e, a = e.maxDepth ?? 2;
 	if (!n) return;
-	if (t && n === t) throw new w(400, { message: "A tenant cannot be its own parent" });
+	if (t && n === t) throw new O(400, { message: "A tenant cannot be its own parent" });
 	let o = new Set(t ? [t] : []), s = 0, c = n;
 	for (; c;) {
-		if (o.has(c)) throw new w(400, { message: `Setting parent_tenant_id to '${n}' would create a cycle` });
+		if (o.has(c)) throw new O(400, { message: `Setting parent_tenant_id to '${n}' would create a cycle` });
 		o.add(c);
 		let e = await r(c);
-		if (!e) throw new w(400, { message: `Parent tenant '${c}' not found` });
-		if (s += 1, s > a) throw new w(400, { message: `Tenant tree is limited to ${a} levels above a tenant` });
+		if (!e) throw new O(400, { message: `Parent tenant '${c}' not found` });
+		if (s += 1, s > a) throw new O(400, { message: `Tenant tree is limited to ${a} levels above a tenant` });
 		c = e.parent_tenant_id;
 	}
 	if (t && i) {
@@ -208,20 +209,20 @@ async function de(e) {
 		for (; o.length > 0;) {
 			let t = [];
 			for (let n of o) for (let r of await i(n)) e.has(r) || (e.add(r), t.push(r));
-			if (t.length > 0 && (r += 1, s + r > a)) throw new w(400, { message: `Moving tenant under '${n}' would make its descendant '${t[0]}' exceed the tenant tree limit of ${a} levels` });
+			if (t.length > 0 && (r += 1, s + r > a)) throw new O(400, { message: `Moving tenant under '${n}' would make its descendant '${t[0]}' exceed the tenant tree limit of ${a} levels` });
 			o = t;
 		}
 	}
 }
 //#endregion
 //#region src/inheritance/chain.ts
-async function N(e) {
+async function R(e) {
 	let { tenantId: t, getTenant: n, legacyControlPlane: r } = e, i = e.maxDepth ?? 2, a = await n(t);
 	if (!a?.parent_tenant_id) return r && r !== t ? [r] : [];
 	let o = [], s = new Set([t]), c = a.parent_tenant_id;
 	for (; c;) {
-		if (s.has(c)) throw new w(400, { message: `Tenant chain for '${t}' contains a cycle at '${c}'` });
-		if (s.add(c), o.length >= i) throw new w(400, { message: `Tenant chain for '${t}' is deeper than ${i}` });
+		if (s.has(c)) throw new O(400, { message: `Tenant chain for '${t}' contains a cycle at '${c}'` });
+		if (s.add(c), o.length >= i) throw new O(400, { message: `Tenant chain for '${t}' is deeper than ${i}` });
 		let e = await n(c);
 		if (!e) break;
 		o.push(c), c = e.parent_tenant_id;
@@ -230,18 +231,18 @@ async function N(e) {
 }
 //#endregion
 //#region src/inheritance/legacy.ts
-function fe(e) {
+function ue(e) {
 	let t = {};
 	for (let n of e ?? []) n.value !== void 0 && (t[n.name] = n.value);
 	return t;
 }
-function pe(e, t) {
+function de(e, t) {
 	if (!e.inherit) return e;
 	let n = t.find((t) => t.name === e.name && t.is_system);
 	if (!n) return e;
 	let r = {
-		...fe(n.secrets),
-		...fe(e.secrets)
+		...ue(n.secrets),
+		...ue(e.secrets)
 	};
 	return {
 		...e,
@@ -252,15 +253,15 @@ function pe(e, t) {
 		}))
 	};
 }
-function me(e, t) {
+function fe(e, t) {
 	if (!t) return e;
-	let n = new Set(e.hooks.map((e) => e.hook_id)), r = t.hooks.filter((e) => B(e) && !n.has(e.hook_id));
+	let n = new Set(e.hooks.map((e) => e.hook_id)), r = t.hooks.filter((e) => He(e) && !n.has(e.hook_id));
 	return {
-		connections: e.connections.map((e) => R(e, t.connections)),
+		connections: e.connections.map((e) => Ne(e, t.connections)),
 		resourceServers: e.resourceServers.map((e) => e.is_system ? Ie(e, t.resourceServers.find((t) => t.id === e.id) ?? null) : e),
 		hooks: [...e.hooks, ...r],
 		hookCode: e.hookCode,
-		actions: e.actions.map((e) => pe(e, t.actions)),
+		actions: e.actions.map((e) => de(e, t.actions)),
 		emailProvider: e.emailProvider ?? t.emailProvider,
 		branding: e.branding,
 		promptSettings: e.promptSettings
@@ -268,7 +269,7 @@ function me(e, t) {
 }
 //#endregion
 //#region src/rollout/defaults-projection.ts
-function he(e = {}) {
+function pe(e = {}) {
 	return {
 		connections: e.connections ?? !0,
 		resourceServers: e.resourceServers ?? !0,
@@ -278,28 +279,28 @@ function he(e = {}) {
 		promptSettings: e.promptSettings ?? !0
 	};
 }
-function P() {
+function z() {
 	return {
 		upserted: 0,
 		errors: []
 	};
 }
-function ge(e) {
+function me(e) {
 	return {
 		tenantId: e,
-		connections: P(),
-		resourceServers: P(),
-		hooks: P(),
-		emailProvider: P(),
-		branding: P(),
-		promptSettings: P()
+		connections: z(),
+		resourceServers: z(),
+		hooks: z(),
+		emailProvider: z(),
+		branding: z(),
+		promptSettings: z()
 	};
 }
-function _e(e) {
+function he(e) {
 	let t = e.metadata;
 	return !!(t && t.inheritable === !0);
 }
-async function F(e, t, n, r) {
+async function B(e, t, n, r) {
 	try {
 		await r();
 	} catch (r) {
@@ -308,17 +309,17 @@ async function F(e, t, n, r) {
 		e.errors.push(i);
 	}
 }
-async function ve(e, t, n) {
+async function ge(e, t, n) {
 	return {
-		connections: n.connections ? await m((n) => e.connections.list(t, n), "connections", {
+		connections: n.connections ? await g((n) => e.connections.list(t, n), "connections", {
 			cursorField: "id",
 			pageSize: 100
 		}) : [],
-		resourceServers: n.resourceServers ? await m((n) => e.resourceServers.list(t, n), "resource_servers", {
+		resourceServers: n.resourceServers ? await g((n) => e.resourceServers.list(t, n), "resource_servers", {
 			cursorField: "id",
 			pageSize: 100
 		}) : [],
-		hooks: n.hooks ? await m((n) => e.hooks.list(t, n), "hooks", {
+		hooks: n.hooks ? await g((n) => e.hooks.list(t, n), "hooks", {
 			cursorField: "hook_id",
 			pageSize: 100
 		}) : [],
@@ -327,46 +328,46 @@ async function ve(e, t, n) {
 		promptSettings: n.promptSettings ? await e.promptSettings.get(t) ?? null : null
 	};
 }
-async function ye(e, t, n, r, i, a) {
+async function _e(e, t, n, r, i, a) {
 	if (r.connections) for (let r of e.connections) {
 		let e = r.id;
-		e && await F(a.connections, `connection ${e}`, i, async () => {
-			let i = c.parse(r);
+		e && await B(a.connections, `connection ${e}`, i, async () => {
+			let i = l.parse(r);
 			await t.connections.get(n, e) ? await t.connections.update(n, e, i) : await t.connections.create(n, i), a.connections.upserted += 1;
 		});
 	}
-	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await F(a.resourceServers, `resource_server ${r.id}`, i, async () => {
-		let e = x.parse(r);
+	if (r.resourceServers) for (let r of e.resourceServers) !r.is_system || !r.id || await B(a.resourceServers, `resource_server ${r.id}`, i, async () => {
+		let e = T.parse(r);
 		await t.resourceServers.get(n, r.id) ? await t.resourceServers.update(n, r.id, e) : await t.resourceServers.create(n, e), a.resourceServers.upserted += 1;
 	});
-	if (r.hooks) for (let r of e.hooks) !_e(r) || !r.hook_id || await F(a.hooks, `hook ${r.hook_id}`, i, async () => {
-		let e = g.parse(r);
+	if (r.hooks) for (let r of e.hooks) !he(r) || !r.hook_id || await B(a.hooks, `hook ${r.hook_id}`, i, async () => {
+		let e = v.parse(r);
 		await t.hooks.get(n, r.hook_id) ? await t.hooks.update(n, r.hook_id, e) : await t.hooks.create(n, e), a.hooks.upserted += 1;
 	});
-	r.emailProvider && e.emailProvider && await F(a.emailProvider, "email_provider", i, async () => {
+	r.emailProvider && e.emailProvider && await B(a.emailProvider, "email_provider", i, async () => {
 		let r = e.emailProvider;
 		await t.emailProviders.get(n) ? await t.emailProviders.update(n, r) : await t.emailProviders.create(n, r), a.emailProvider.upserted += 1;
-	}), r.branding && e.branding && await F(a.branding, "branding", i, async () => {
+	}), r.branding && e.branding && await B(a.branding, "branding", i, async () => {
 		await t.branding.set(n, e.branding), a.branding.upserted += 1;
-	}), r.promptSettings && e.promptSettings && await F(a.promptSettings, "prompt_settings", i, async () => {
+	}), r.promptSettings && e.promptSettings && await B(a.promptSettings, "prompt_settings", i, async () => {
 		await t.promptSettings.set(n, e.promptSettings), a.promptSettings.upserted += 1;
 	});
 }
-async function be(e, t) {
-	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = he(a), c = await ve(await r(), n, s), l = await i(t), u = ge(t);
-	return await ye(c, l, n, s, o, u), u;
+async function ve(e, t) {
+	let { controlPlaneTenantId: n, getControlPlaneAdapters: r, getAdapters: i, entities: a, continueOnError: o = !1 } = e, s = pe(a), c = await ge(await r(), n, s), l = await i(t), u = me(t);
+	return await _e(c, l, n, s, o, u), u;
 }
 //#endregion
 //#region src/inheritance/read.ts
-async function I(e, t) {
-	let n = await ve(e, t, {
+async function V(e, t) {
+	let n = await ge(e, t, {
 		connections: !0,
 		resourceServers: !0,
 		hooks: !0,
 		emailProvider: !0,
 		branding: !0,
 		promptSettings: !0
-	}), r = await m((n) => e.actions.list(t, n), "actions", {
+	}), r = await g((n) => e.actions.list(t, n), "actions", {
 		cursorField: "id",
 		pageSize: 100
 	}), i = new Set(r.map((e) => e.id)), a = /* @__PURE__ */ new Set();
@@ -387,7 +388,7 @@ async function I(e, t) {
 }
 //#endregion
 //#region src/inheritance/shadow.ts
-var xe = /secret|password|private_key|api_key|token/i, Se = new Set([
+var ye = /secret|password|private_key|api_key|token/i, be = new Set([
 	"id",
 	"tenant_id",
 	"created_at",
@@ -397,40 +398,40 @@ var xe = /secret|password|private_key|api_key|token/i, Se = new Set([
 	"enforce",
 	"enabled_clients"
 ]);
-async function L(e) {
+async function H(e) {
 	let t = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
 	return [...new Uint8Array(t)].map((e) => e.toString(16).padStart(2, "0")).join("").slice(0, 16);
 }
-async function Ce(e, t = "") {
+async function xe(e, t = "") {
 	if (Array.isArray(e)) {
 		if (t === "secrets") {
 			let t = {};
-			for (let n of e) t[n.name] = n.value === void 0 ? null : `sha256:${await L(n.value)}`;
+			for (let n of e) t[n.name] = n.value === void 0 ? null : `sha256:${await H(n.value)}`;
 			return t;
 		}
-		return Promise.all(e.map((e) => Ce(e, t)));
+		return Promise.all(e.map((e) => xe(e, t)));
 	}
 	if (e && typeof e == "object") {
 		let t = {};
 		for (let n of Object.keys(e).sort()) {
 			let r = e[n];
-			r != null && (t[n] = typeof r == "string" && xe.test(n) ? `sha256:${await L(r)}` : await Ce(r, n));
+			r != null && (t[n] = typeof r == "string" && ye.test(n) ? `sha256:${await H(r)}` : await xe(r, n));
 		}
 		return t;
 	}
 	return e;
 }
-async function we(e) {
+async function Se(e) {
 	let t = {};
-	for (let [n, r] of Object.entries(e)) Se.has(n) || (t[n] = r);
-	return await Ce(t);
+	for (let [n, r] of Object.entries(e)) be.has(n) || (t[n] = r);
+	return await xe(t);
 }
-var Te = {
+var Ce = {
 	connection: (e) => `${e.strategy}:${e.name}`,
 	resourceServer: (e) => e.identifier,
 	hook: (e) => e.hook_id,
 	action: (e) => e.name
-}, Ee = new Set([
+}, we = new Set([
 	"connection",
 	"resourceServer",
 	"action",
@@ -438,12 +439,12 @@ var Te = {
 	"branding",
 	"promptSettings"
 ]);
-async function De(e) {
+async function Te(e) {
 	let t = /* @__PURE__ */ new Map(), n = async (e, n, r) => {
 		let i = t.get(e) ?? /* @__PURE__ */ new Map();
-		i.set(n, await we(r)), t.set(e, i);
+		i.set(n, await Se(r)), t.set(e, i);
 	};
-	for (let [t, r] of Object.entries(Te)) {
+	for (let [t, r] of Object.entries(Ce)) {
 		let i = e[{
 			connection: "connections",
 			resourceServer: "resourceServers",
@@ -459,8 +460,8 @@ async function De(e) {
 	]) e[t] && await n(t, "singleton", e[t]);
 	return t;
 }
-async function Oe(e, t) {
-	let [n, r] = await Promise.all([De(e), De(t)]), i = [], a = new Set([...n.keys(), ...r.keys()]);
+async function Ee(e, t) {
+	let [n, r] = await Promise.all([Te(e), Te(t)]), i = [], a = new Set([...n.keys(), ...r.keys()]);
 	for (let e of a) {
 		let t = n.get(e) ?? /* @__PURE__ */ new Map(), a = r.get(e) ?? /* @__PURE__ */ new Map();
 		for (let n of new Set([...t.keys(), ...a.keys()])) {
@@ -477,7 +478,7 @@ async function Oe(e, t) {
 				key: n,
 				kind: "extra",
 				fields: [],
-				expected: Ee.has(e)
+				expected: we.has(e)
 			});
 			else if (r && o) {
 				let t = JSON.stringify(r), a = JSON.stringify(o);
@@ -489,54 +490,54 @@ async function Oe(e, t) {
 					kind: "changed",
 					fields: s,
 					expected: !1,
-					legacy_hash: await L(t),
-					new_hash: await L(a)
+					legacy_hash: await H(t),
+					new_hash: await H(a)
 				});
 			}
 		}
 	}
 	return i;
 }
-async function ke(e) {
-	let { adapters: t, tenantId: n, legacyControlPlane: r } = e, i = await N({
+async function De(e) {
+	let { adapters: t, tenantId: n, legacyControlPlane: r } = e, i = await R({
 		tenantId: n,
 		getTenant: (e) => t.tenants.get(e),
 		legacyControlPlane: r,
 		maxDepth: e.maxDepth
-	}), a = await I(t, n), o = await Promise.all(i.map((e) => I(t, e))), s = r && r !== n ? await I(t, r) : void 0, { hidden: c, ...l } = Ze(o, a), u = new Set(c);
-	return (await Oe(me(a, s), l)).filter((e) => !u.has(`${e.entity}:${e.key}`));
+	}), a = await V(t, n), o = await Promise.all(i.map((e) => V(t, e))), s = r && r !== n ? await V(t, r) : void 0, { hidden: c, ...l } = $e(o, a), u = new Set(c);
+	return (await Ee(fe(a, s), l)).filter((e) => !u.has(`${e.entity}:${e.key}`));
 }
 //#endregion
 //#region src/inheritance/report.ts
-var Ae = 3600 * 1e3, je = 1e4;
-function Me(e, t) {
+var Oe = 3600 * 1e3, ke = 1e4;
+function Ae(e, t) {
 	let n = t.sample ?? 1, r = t.intervalMs ?? 6e4, i = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Set(), o = /* @__PURE__ */ new Map();
 	async function s(n, r) {
-		let i = await ke({
+		let i = await De({
 			adapters: e,
 			tenantId: n,
 			legacyControlPlane: r
 		}), a = Date.now();
-		o.size > je && o.clear();
+		o.size > ke && o.clear();
 		for (let s of i) {
 			if (s.expected && !t.includeExpected) continue;
-			let i = await L([
+			let i = await H([
 				n,
 				s.entity,
 				s.key,
 				s.kind,
 				s.fields.join(",")
 			].join("|")), c = o.get(i);
-			c !== void 0 && a - c < Ae || (o.set(i, a), await Ne(e, n, s, r));
+			c !== void 0 && a - c < Oe || (o.set(i, a), await je(e, n, s, r));
 		}
 	}
 	return { schedule(e, t) {
 		if (a.has(e) || n < 1 && Math.random() >= n) return;
 		let o = Date.now(), c = i.get(e);
-		c !== void 0 && o - c < r || (i.set(e, o), a.add(e), s(e, t).catch(() => {}).finally(() => a.delete(e)));
+		if (!(c !== void 0 && o - c < r)) return i.set(e, o), a.add(e), s(e, t).catch(() => {}).finally(() => a.delete(e));
 	} };
 }
-async function Ne(e, n, r, i) {
+async function je(e, n, r, i) {
 	await e.logs.create(n, {
 		type: t.CONFIG_INHERITANCE_DIFF,
 		date: (/* @__PURE__ */ new Date()).toISOString(),
@@ -549,20 +550,18 @@ async function Ne(e, n, r, i) {
 		}
 	});
 }
-//#endregion
-//#region src/middleware/config-sync-mode.ts
-function Pe(e) {
-	let { base: t, getTenant: n, controlPlaneTenantId: r } = e, i = e.ttlMs ?? 3e4, a = e.maxEntries ?? 1e3, o = /* @__PURE__ */ new Map();
+function Me(e) {
+	let { base: t, getTenant: n, controlPlaneTenantId: r } = e, i = e.ttlMs ?? 1e4, a = e.maxEntries ?? 1e3, o = /* @__PURE__ */ new Map();
 	async function s(e) {
 		if (e === r) return !1;
 		let t = o.get(e), s = Date.now();
 		if (t && t.expires > s) return t.synced;
 		try {
-			let t = (await n(e))?.config_sync === "synced";
+			let t = await n(e), r = t?.config_sync === "synced" || t?.config_sync === "detached";
 			return o.size >= a && o.clear(), o.set(e, {
-				synced: t,
+				synced: r,
 				expires: s + i
-			}), t;
+			}), r;
 		} catch {
 			return !1;
 		}
@@ -580,19 +579,19 @@ function Pe(e) {
 }
 //#endregion
 //#region src/middleware/settings-inheritance.ts
-function R(e, t) {
+function Ne(e, t) {
 	let n = t.find((t) => t.strategy === e.strategy);
 	if (!n?.options) return e;
-	let r = u.passthrough().parse({
+	let r = d.passthrough().parse({
 		...n,
 		...e
 	});
-	return r.options = l.passthrough().parse({
+	return r.options = u.passthrough().parse({
 		...n.options || {},
 		...e.options
 	}), r;
 }
-function z(e, t) {
+function Pe(e, t) {
 	let n = [...t || [], ...e || []];
 	return [...new Set(n)];
 }
@@ -613,10 +612,10 @@ function Ie(e, t) {
 function Le(e, t) {
 	return t ? {
 		...e,
-		callbacks: z(e.callbacks, t.callbacks),
-		web_origins: z(e.web_origins, t.web_origins),
-		allowed_logout_urls: z(e.allowed_logout_urls, t.allowed_logout_urls),
-		allowed_origins: z(e.allowed_origins, t.allowed_origins)
+		callbacks: Pe(e.callbacks, t.callbacks),
+		web_origins: Pe(e.web_origins, t.web_origins),
+		allowed_logout_urls: Pe(e.allowed_logout_urls, t.allowed_logout_urls),
+		allowed_origins: Pe(e.allowed_origins, t.allowed_origins)
 	} : e;
 }
 function Re(e) {
@@ -667,7 +666,7 @@ function Be(e, t) {
 	};
 }
 function Ve(e, t) {
-	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i, inheritanceShadow: a } = t, o = t.configSync ?? Pe({
+	let { controlPlaneTenantId: n, controlPlaneClientId: r, resolveControlPlane: i, inheritanceShadow: a } = t, o = t.configSync ?? Me({
 		base: Re({
 			controlPlaneTenantId: n,
 			controlPlaneClientId: r,
@@ -675,7 +674,7 @@ function Ve(e, t) {
 		}),
 		getTenant: async (t) => await e.tenants.get(t) ?? null,
 		controlPlaneTenantId: n
-	}), s = (e) => o.resolve({ tenant_id: e }), c = a ? Me(e, a === !0 ? {} : a) : void 0, l = c ? async (e) => {
+	}), s = (e) => o.resolve({ tenant_id: e }), c = a ? Ae(e, a === !0 ? {} : a) : void 0, l = c ? async (e) => {
 		let t = await s(e);
 		return await o.isSynced(e) || c.schedule(e, t?.tenantId), t;
 	} : s;
@@ -692,12 +691,12 @@ function Ve(e, t) {
 				let r = await e.connections.get(t, n);
 				if (!r) return r;
 				let i = await l(t);
-				return !i || t === i.tenantId ? r : R(r, (await e.connections.list(i.tenantId)).connections || []);
+				return !i || t === i.tenantId ? r : Ne(r, (await e.connections.list(i.tenantId)).connections || []);
 			},
 			list: async (t, n) => {
 				let r = await e.connections.list(t, n), i = await l(t);
 				if (!i || t === i.tenantId) return r;
-				let a = await e.connections.list(i.tenantId), o = r.connections.map((e) => R(e, a.connections || []));
+				let a = await e.connections.list(i.tenantId), o = r.connections.map((e) => Ne(e, a.connections || []));
 				return {
 					...r,
 					connections: o
@@ -712,7 +711,7 @@ function Ve(e, t) {
 				let i = await l(t);
 				if (!i || t === i.tenantId) return r;
 				let a = await e.connections.list(i.tenantId);
-				return r.map((e) => R(e, a.connections || []));
+				return r.map((e) => Ne(e, a.connections || []));
 			}
 		},
 		emailProviders: {
@@ -725,24 +724,24 @@ function Ve(e, t) {
 			}
 		},
 		resourceServers: ze(e, l),
-		hooks: He(e, l)
+		hooks: Ue(e, l)
 	};
 }
-function B(e) {
+function He(e) {
 	if (!e || typeof e != "object") return !1;
 	let t = e.metadata;
 	return !t || typeof t != "object" ? !1 : t.inheritable === !0;
 }
-function He(e, t) {
+function Ue(e, t) {
 	return {
 		...e.hooks,
 		list: async (n, r) => {
 			let i = await e.hooks.list(n, r), a = await t(n);
 			if (!a || n === a.tenantId) return i;
-			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(B);
+			let o = ((await e.hooks.list(a.tenantId, r)).hooks || []).filter(He);
 			if (o.length === 0) return i;
 			let s = new Set((i.hooks || []).map((e) => e.hook_id)), c = [];
-			for (let e of o) s.has(e.hook_id) || e.hook_id && s.has(await W("hook", n, e.hook_id)) || c.push(e);
+			for (let e of o) s.has(e.hook_id) || e.hook_id && s.has(await it("hook", n, e.hook_id)) || c.push(e);
 			return {
 				...i,
 				hooks: [...i.hooks || [], ...c],
@@ -755,16 +754,16 @@ function He(e, t) {
 			let a = await t(n);
 			if (!a || n === a.tenantId) return i;
 			let o = await e.hooks.get(a.tenantId, r);
-			return o && B(o) ? o : null;
+			return o && He(o) ? o : null;
 		}
 	};
 }
-function Ue(e, t) {
+function We(e, t) {
 	return Ve(e, t);
 }
 //#endregion
 //#region src/inheritance/types.ts
-var We = () => ({
+var Ge = () => ({
 	connections: [],
 	resourceServers: [],
 	hooks: [],
@@ -776,28 +775,28 @@ var We = () => ({
 });
 //#endregion
 //#region src/inheritance/merge.ts
-function V(e, t) {
+function U(e, t) {
 	if (t.scope) return t.scope;
 	switch (e) {
 		case "connection":
 		case "emailProvider": return "shared";
 		case "resourceServer":
 		case "action": return t.is_system ? "shared" : "local";
-		case "hook": return B(t) ? "shared" : "local";
+		case "hook": return He(t) ? "shared" : "local";
 		default: return "local";
 	}
 }
-function H(e) {
+function Ke(e) {
 	return e.override ?? "fields";
 }
-var Ge = /secret|password|private_key|api_key|token/i;
-function Ke(e, t) {
+var qe = /secret|password|private_key|api_key|token/i;
+function Je(e, t) {
 	let n = { ...e ?? {} };
-	for (let [e, r] of Object.entries(t ?? {})) Ge.test(e) && (n[e] = r);
+	for (let [e, r] of Object.entries(t ?? {})) qe.test(e) && (n[e] = r);
 	return n;
 }
-function qe(e, t) {
-	switch (H(e)) {
+function Ye(e, t) {
+	switch (Ke(e)) {
 		case "none": return {
 			...e,
 			id: t.id
@@ -805,7 +804,7 @@ function qe(e, t) {
 		case "secrets": return {
 			...e,
 			id: t.id,
-			options: Ke(e.options, t.options)
+			options: Je(e.options, t.options)
 		};
 		default: return {
 			...e,
@@ -817,8 +816,8 @@ function qe(e, t) {
 		};
 	}
 }
-function Je(e, t) {
-	switch (H(e)) {
+function Xe(e, t) {
+	switch (Ke(e)) {
 		case "none": return {
 			...e,
 			id: t.id
@@ -834,42 +833,42 @@ function Je(e, t) {
 		};
 	}
 }
-function Ye(e) {
+function Ze(e) {
 	return new Map((e ?? []).map((e) => [e.name, e]));
 }
-function Xe(e, t) {
-	let n = H(e);
+function Qe(e, t) {
+	let n = Ke(e);
 	if (n === "none") return {
 		...e,
 		id: t.id
 	};
-	let r = Ye(e.secrets);
-	if (n === "secrets" || n === "fields") for (let [e, n] of Ye(t.secrets)) r.set(e, n);
+	let r = Ze(e.secrets);
+	if (n === "secrets" || n === "fields") for (let [e, n] of Ze(t.secrets)) r.set(e, n);
 	return {
 		...n === "fields" && !t.inherit ? t : e,
 		id: t.id,
 		secrets: [...r.values()]
 	};
 }
-function Ze(e, t) {
+function $e(e, t) {
 	let n = /* @__PURE__ */ new Set(), r = [...e].reverse().concat(t), i = (e, t, r, i) => r ? t : t.filter((t) => {
-		let r = V(e, t);
+		let r = U(e, t);
 		return r === "local" ? !1 : (r === "platform" && n.add(`${e}:${i(t)}`), !0);
-	}), a = We(), o = (e) => `${e.strategy}:${e.name}`, s = (e) => e.identifier, c = (e) => e.hook_id ?? "", l = (e) => e.name, u = /* @__PURE__ */ new Map(), d = [], f = /* @__PURE__ */ new Map(), p = /* @__PURE__ */ new Map(), m = /* @__PURE__ */ new Map();
+	}), a = Ge(), o = (e) => `${e.strategy}:${e.name}`, s = (e) => e.identifier, c = (e) => e.hook_id ?? "", l = (e) => e.name, u = /* @__PURE__ */ new Map(), d = [], f = /* @__PURE__ */ new Map(), p = /* @__PURE__ */ new Map(), m = /* @__PURE__ */ new Map();
 	r.forEach((e, t) => {
 		let h = t === r.length - 1;
 		for (let t of i("connection", e.connections, h, o)) {
 			let e = u.get(t.strategy);
-			h ? d.push(e ? qe(e, t) : t) : u.set(t.strategy, e ? qe(e, t) : t);
+			h ? d.push(e ? Ye(e, t) : t) : u.set(t.strategy, e ? Ye(e, t) : t);
 		}
 		for (let t of i("resourceServer", e.resourceServers, h, s)) {
 			let e = f.get(s(t));
-			f.set(s(t), e ? Je(e, t) : t);
+			f.set(s(t), e ? Xe(e, t) : t);
 		}
 		for (let t of i("hook", e.hooks, h, c)) p.set(c(t), t);
 		for (let t of i("action", e.actions, h, l)) {
 			let e = m.get(l(t));
-			m.set(l(t), e ? Xe(e, t) : t);
+			m.set(l(t), e ? Qe(e, t) : t);
 		}
 		for (let t of [
 			"emailProvider",
@@ -877,7 +876,7 @@ function Ze(e, t) {
 			"promptSettings"
 		]) {
 			let r = e[t];
-			r && (h || V(t, r) !== "local") && (!h && V(t, r) === "platform" && n.add(`${t}:singleton`), a[t] = r);
+			r && (h || U(t, r) !== "local") && (!h && U(t, r) === "platform" && n.add(`${t}:singleton`), a[t] = r);
 		}
 	});
 	let h = new Set(r[r.length - 1].connections.map((e) => e.strategy));
@@ -891,25 +890,32 @@ function Ze(e, t) {
 }
 //#endregion
 //#region src/rollout/resolved-sync.ts
-function U(e) {
-	return Array.isArray(e) ? `[${e.map(U).join(",")}]` : e && typeof e == "object" ? `{${Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : 1).map(([e, t]) => `${JSON.stringify(e)}:${U(t)}`).join(",")}}` : JSON.stringify(e) ?? "null";
+var et = [
+	"connection",
+	"resourceServer",
+	"hookCode",
+	"action",
+	"hook"
+];
+function tt(e) {
+	return Array.isArray(e) ? `[${e.map(tt).join(",")}]` : e && typeof e == "object" ? `{${Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : 1).map(([e, t]) => `${JSON.stringify(e)}:${tt(t)}`).join(",")}}` : JSON.stringify(e) ?? "null";
 }
-async function Qe(e) {
+async function nt(e) {
 	let t = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
 	return [...new Uint8Array(t)].map((e) => e.toString(16).padStart(2, "0")).join("");
 }
-var $e = {
+var rt = {
 	connection: "con_",
 	resourceServer: "api_",
 	hook: "h_",
 	hookCode: "hc_",
 	action: "act_"
 };
-async function W(e, t, n) {
-	let r = await Qe(`${t}|${e}|${n}`);
-	return `${$e[e]}sy${r.slice(0, 15)}`;
+async function it(e, t, n) {
+	let r = await nt(`${t}|${e}|${n}`);
+	return `${rt[e]}sy${r.slice(0, 15)}`;
 }
-function G(e, t) {
+function W(e, t) {
 	let n = t;
 	switch (e) {
 		case "connection": return `${n.strategy}:${n.name}`;
@@ -919,13 +925,13 @@ function G(e, t) {
 		case "hook": return n.hook_id;
 	}
 }
-async function et(e, t, n = {}) {
-	let r = await N({
+async function at(e, t, n = {}) {
+	let r = await R({
 		tenantId: t,
 		getTenant: (t) => e.tenants.get(t),
 		legacyControlPlane: n.legacyControlPlane,
 		maxDepth: n.maxDepth
-	}), i = Ze(await Promise.all(r.map((t) => I(e, t))), We()), a = {
+	}), i = $e(await Promise.all(r.map((t) => V(e, t))), Ge()), a = {
 		version: 1,
 		chain: r,
 		connections: i.connections,
@@ -941,107 +947,146 @@ async function et(e, t, n = {}) {
 	};
 	return {
 		...a,
-		hash: await Qe(U(a))
+		hash: await nt(tt(a))
 	};
 }
-function tt(e, t) {
+function ot(e, t) {
 	if (typeof e == "string") e.startsWith("enc:v1:") && t.add(e);
-	else if (Array.isArray(e)) for (let n of e) tt(n, t);
-	else if (e && typeof e == "object") for (let n of Object.values(e)) tt(n, t);
+	else if (Array.isArray(e)) for (let n of e) ot(n, t);
+	else if (e && typeof e == "object") for (let n of Object.values(e)) ot(n, t);
 }
-function nt(e) {
+function st(e) {
 	let t = e.slice(7), n = t.indexOf(":");
 	return n === -1 ? "default" : t.slice(0, n);
 }
-async function rt(e, t) {
+async function ct(e, t) {
 	let n = /* @__PURE__ */ new Set();
-	tt(e, n);
+	ot(e, n);
 	let r = /* @__PURE__ */ new Set();
-	for (let e of n) await s(e, t) || r.add(nt(e));
+	for (let e of n) await c(e, t) || r.add(st(e));
 	return [...r].sort();
 }
-var K = () => ({
+var G = () => ({
 	added: 0,
 	changed: 0,
 	unchanged: 0,
 	deleted: 0,
 	errors: []
-}), it = (e) => U(e);
-async function at(e, t, n, r = {}) {
-	let { dryRun: a = !1, continueOnError: s = !0 } = r, l = {
-		status: a ? "dry-run" : "applied",
+}), lt = (e) => tt(e);
+async function ut(e, t, n, r = {}) {
+	let { dryRun: i = !1, continueOnError: o = !0 } = r;
+	if (r.prune && e.chain.length === 0) throw Error(`Cannot prune '${n}': the block resolved no ancestors, so every synced copy would look stale. Nothing was written.`);
+	let c = {
+		status: i ? "dry-run" : "applied",
 		hash: e.hash,
 		entities: {
-			connection: K(),
-			resourceServer: K(),
-			hookCode: K(),
-			action: K(),
-			hook: K(),
-			emailProvider: K(),
-			branding: K(),
-			promptSettings: K()
+			connection: G(),
+			resourceServer: G(),
+			hookCode: G(),
+			action: G(),
+			hook: G(),
+			emailProvider: G(),
+			branding: G(),
+			promptSettings: G()
 		},
-		changes: []
+		changes: [],
+		rows: []
 	}, u = await t.tenants.get(n), d = !!r.deletes && e.deletes.length > 0;
-	if (!a && !r.force && !d && u?.config_sync_hash === e.hash) return {
-		...l,
+	if (!i && !r.force && !d && !r.prune && u?.config_sync_hash === e.hash) return {
+		...c,
 		status: "up-to-date"
 	};
 	if (r.keyRing) {
-		let t = await rt(e, r.keyRing);
+		let t = await ct(e, r.keyRing);
 		if (t.length > 0) throw Error(`Cannot sync config to '${n}': its key ring cannot decrypt key id(s) ${t.map((e) => `"${e}"`).join(", ")} carried by the payload. Nothing was written.`);
 	}
-	let p = async (e, t, n) => {
-		let r = l.entities[e];
+	let f = await V(t, n), m = (i || r.prune) && e.chain.length > 0 ? f : null, h = {
+		connection: /* @__PURE__ */ new Set(),
+		resourceServer: /* @__PURE__ */ new Set(),
+		action: /* @__PURE__ */ new Set()
+	};
+	for (let e of f.connections) x(e.id) || h.connection.add(W("connection", e));
+	for (let e of f.resourceServers) x(e.id) || h.resourceServer.add(W("resourceServer", e));
+	for (let e of f.actions) x(e.id) || h.action.add(W("action", e));
+	let y = async (e, t, n) => {
+		let r = c.entities[e];
 		try {
 			let i = await n();
-			r[i] += 1, i !== "unchanged" && l.changes.push(`${e}:${t}`);
+			r[i] += 1, i !== "unchanged" && (c.changes.push(`${e}:${t}`), c.rows.push({
+				entity: e,
+				key: t,
+				action: i
+			}));
 		} catch (n) {
 			let i = `${e} ${t}: ${n instanceof Error ? n.message : String(n)}`;
-			if (!s) throw Error(i, { cause: n });
+			if (!o) throw Error(i, { cause: n });
 			r.errors.push(i);
 		}
-	}, m = async (e) => e.existing ? it(e.view(e.existing)) === it(e.view(e.desired)) ? "unchanged" : (a || await e.update(), "changed") : (a || await e.create(), "added"), _ = (e, t) => W(e, n, t), v = /* @__PURE__ */ new Map();
-	for (let t of e.hookCode) v.set(t.id, await _("hookCode", G("hookCode", t)));
-	for (let t of e.actions) v.set(t.id, await _("action", G("action", t)));
+	}, b = async (e) => e.existing ? lt(e.view(e.existing)) === lt(e.view(e.desired)) ? "unchanged" : (i || await e.update(), "changed") : (i || await e.create(), "added"), S = (e, t) => it(e, n, t), w = /* @__PURE__ */ new Map();
+	for (let t of e.hookCode) w.set(t.id, await S("hookCode", W("hookCode", t)));
+	for (let t of e.actions) w.set(t.id, await S("action", W("action", t)));
+	let E, D = async (e) => {
+		if (!E) {
+			E = [];
+			let e = await g((e) => t.clients.list(n, e), "clients", {
+				cursorField: "client_id",
+				pageSize: 100
+			});
+			for (let r of e) (await t.clientConnections.listByClient(n, r.client_id)).length > 0 && E.push(r.client_id);
+		}
+		for (let r of E) await t.clientConnections.addClientToConnection(n, e, r);
+	}, O = (e, t) => h[e].has(t) ? (c.changes.push(`skip ${e}:${t} (the tenant has its own)`), c.rows.push({
+		entity: e,
+		key: t,
+		action: "skipped"
+	}), !0) : !1;
 	for (let r of e.connections) {
-		let e = G("connection", r), i = await _("connection", e);
-		await p("connection", e, async () => {
-			let { enabled_clients: e, ...a } = r, o = c.parse({
-				...a,
+		let e = W("connection", r), i = await S("connection", e);
+		await y("connection", e, async () => {
+			if (O("connection", e)) return "unchanged";
+			let { enabled_clients: a, ...o } = r, s = l.parse({
+				...o,
 				id: i
-			}), s = await t.connections.get(n, i);
-			return m({
-				existing: s ? c.parse(s) : null,
-				desired: o,
-				create: () => t.connections.create(n, o),
-				update: () => t.connections.update(n, i, o),
+			}), c = await t.connections.get(n, i);
+			return b({
+				existing: c ? l.parse(c) : null,
+				desired: s,
+				create: async () => {
+					await t.connections.create(n, s);
+					try {
+						await D(i);
+					} catch (e) {
+						throw await t.connections.remove(n, i).catch(() => {}), e;
+					}
+				},
+				update: () => t.connections.update(n, i, s),
 				view: (e) => e
 			});
 		});
 	}
 	for (let r of e.resourceServers) {
-		let e = G("resourceServer", r), i = await _("resourceServer", e);
-		await p("resourceServer", e, async () => {
-			let e = x.parse({
+		let e = W("resourceServer", r), i = await S("resourceServer", e);
+		await y("resourceServer", e, async () => {
+			if (O("resourceServer", e)) return "unchanged";
+			let a = T.parse({
 				...r,
 				id: i
-			}), a = await t.resourceServers.get(n, i);
-			return m({
-				existing: a ? x.parse(a) : null,
-				desired: e,
-				create: () => t.resourceServers.create(n, e),
-				update: () => t.resourceServers.update(n, i, e),
+			}), o = await t.resourceServers.get(n, i);
+			return b({
+				existing: o ? T.parse(o) : null,
+				desired: a,
+				create: () => t.resourceServers.create(n, a),
+				update: () => t.resourceServers.update(n, i, a),
 				view: (e) => e
 			});
 		});
 	}
 	for (let r of e.hookCode) {
-		let e = G("hookCode", r), i = v.get(r.id);
-		await p("hookCode", e, async () => {
-			let e = h.parse(r), a = await t.hookCode.get(n, i);
-			return m({
-				existing: a ? h.parse(a) : null,
+		let e = W("hookCode", r), i = w.get(r.id);
+		await y("hookCode", e, async () => {
+			let e = _.parse(r), a = await t.hookCode.get(n, i);
+			return b({
+				existing: a ? _.parse(a) : null,
 				desired: e,
 				create: () => t.hookCode.create(n, e, { importMetadata: { id: i } }),
 				update: () => t.hookCode.update(n, i, e),
@@ -1050,28 +1095,29 @@ async function at(e, t, n, r = {}) {
 		});
 	}
 	for (let r of e.actions) {
-		let e = G("action", r), a = v.get(r.id);
-		await p("action", e, async () => {
-			let e = i.parse(r), o = await t.actions.get(n, a);
-			return m({
-				existing: o ? i.parse(o) : null,
-				desired: e,
-				create: () => t.actions.create(n, e, { importMetadata: { id: a } }),
-				update: () => t.actions.update(n, a, e),
+		let e = W("action", r), i = w.get(r.id);
+		await y("action", e, async () => {
+			if (O("action", e)) return "unchanged";
+			let o = a.parse(r), s = await t.actions.get(n, i);
+			return b({
+				existing: s ? a.parse(s) : null,
+				desired: o,
+				create: () => t.actions.create(n, o, { importMetadata: { id: i } }),
+				update: () => t.actions.update(n, i, o),
 				view: (e) => e
 			});
 		});
 	}
 	for (let r of e.hooks) {
-		let e = G("hook", r), i = await _("hook", e);
-		await p("hook", e, async () => {
-			let e = r.code_id, a = g.parse({
+		let e = W("hook", r), i = await S("hook", e);
+		await y("hook", e, async () => {
+			let e = r.code_id, a = v.parse({
 				...r,
 				hook_id: i,
-				...e ? { code_id: v.get(e) ?? e } : {}
+				...e ? { code_id: w.get(e) ?? e } : {}
 			}), o = await t.hooks.get(n, i);
-			return m({
-				existing: o ? g.parse(o) : null,
+			return b({
+				existing: o ? v.parse(o) : null,
 				desired: a,
 				create: () => t.hooks.create(n, a),
 				update: () => t.hooks.update(n, i, a),
@@ -1079,29 +1125,109 @@ async function at(e, t, n, r = {}) {
 			});
 		});
 	}
-	e.emailProvider && await p("emailProvider", "singleton", async () => {
-		let r = f.parse(e.emailProvider);
-		return await t.emailProviders.get(n) ? "unchanged" : (a || await t.emailProviders.create(n, r), "added");
-	}), e.branding && await p("branding", "singleton", async () => {
-		let r = o.parse(e.branding);
-		return await t.branding.get(n) ? "unchanged" : (a || await t.branding.set(n, r), "added");
+	let k = (e) => e.override === "none" || e.enforce === !0, A = (e, t, n) => lt(e.parse(t)) === lt(n), j = (e, t) => {
+		let n = { ...t };
+		for (let [t, r] of Object.entries(e)) r != null && n[t] === void 0 && (n[t] = null);
+		return n;
+	};
+	e.emailProvider && await y("emailProvider", "singleton", async () => {
+		let r = p.parse(e.emailProvider), a = await t.emailProviders.get(n);
+		if (!a) return i || await t.emailProviders.create(n, r), "added";
+		if (!k(r) || A(p, a, r)) return "unchanged";
+		if (!i) {
+			let e = p.parse(a);
+			await t.emailProviders.update(n, j(e, r));
+		}
+		return "changed";
+	}), e.branding && await y("branding", "singleton", async () => {
+		let r = s.parse(e.branding), a = await t.branding.get(n);
+		if (!a) return i || await t.branding.set(n, r), "added";
+		if (!k(r) || A(s, a, r)) return "unchanged";
+		if (!i) {
+			let e = s.parse(a), i = j(e, r);
+			e.colors && !r.colors && (i.colors = { primary: null }), e.font && !r.font && (i.font = { url: null }), await t.branding.set(n, i);
+		}
+		return "changed";
+	}), e.promptSettings && k(e.promptSettings) && await y("promptSettings", "singleton", async () => {
+		let r = C.parse(e.promptSettings);
+		return A(C, await t.promptSettings.get(n), r) ? "unchanged" : (i || await t.promptSettings.set(n, r), "changed");
 	});
-	for (let i of e.deletes) {
-		let e = await _(i.entity, i.key), o = `${i.entity}:${i.key}`;
+	for (let a of e.deletes) {
+		let e = await S(a.entity, a.key), o = `${a.entity}:${a.key}`;
 		try {
-			if (!await ot(t, n, i.entity, e)) continue;
-			l.changes.push(`delete ${o}`), r.deletes && !a && (await st(t, n, i.entity, e), l.entities[i.entity].deleted += 1);
+			if (!await pt(t, n, a.entity, e)) continue;
+			c.changes.push(`delete ${o}`), c.rows.push({
+				entity: a.entity,
+				key: a.key,
+				action: "delete"
+			}), r.deletes && !i && (await mt(t, n, a.entity, e), c.entities[a.entity].deleted += 1);
 		} catch (e) {
-			l.entities[i.entity].errors.push(`delete ${o}: ${e instanceof Error ? e.message : e}`);
+			c.entities[a.entity].errors.push(`delete ${o}: ${e instanceof Error ? e.message : e}`);
+		}
+	}
+	let ee = () => Object.values(c.entities).some((e) => e.errors.length > 0);
+	if (m && !ee()) {
+		let a = /* @__PURE__ */ new Set();
+		for (let t of et) for (let n of dt(e, t)) (t === "connection" || t === "resourceServer" || t === "action") && h[t].has(W(t, n)) || a.add(t === "hookCode" || t === "action" ? w.get(n.id) : await S(t, W(t, n)));
+		for (let e of ft(m, a)) {
+			let a = `${e.entity}:${e.label}`;
+			try {
+				c.changes.push(`delete ${a}`), c.rows.push({
+					entity: e.entity,
+					key: e.label,
+					action: "delete"
+				}), r.prune && !i && (await mt(t, n, e.entity, e.id), c.entities[e.entity].deleted += 1);
+			} catch (t) {
+				c.entities[e.entity].errors.push(`delete ${a}: ${t instanceof Error ? t.message : t}`);
+			}
 		}
 	}
-	let y = Object.values(l.entities).some((e) => e.errors.length > 0);
-	return !a && !y && u && await t.tenants.update(n, {
+	let M = ee();
+	return !i && !M && u && await t.tenants.update(n, {
 		config_sync_hash: e.hash,
 		config_synced_at: (/* @__PURE__ */ new Date()).toISOString()
-	}), l;
+	}), c;
+}
+function dt(e, t) {
+	switch (t) {
+		case "connection": return e.connections;
+		case "resourceServer": return e.resourceServers;
+		case "hookCode": return e.hookCode;
+		case "action": return e.actions;
+		case "hook": return e.hooks;
+	}
+}
+function ft(e, t) {
+	let n = (e) => !!e && x(e) && !t.has(e);
+	return [
+		...e.hooks.filter((e) => n(e.hook_id)).map((e) => ({
+			entity: "hook",
+			id: e.hook_id,
+			label: e.hook_id
+		})),
+		...e.actions.filter((e) => n(e.id)).map((e) => ({
+			entity: "action",
+			id: e.id,
+			label: e.name
+		})),
+		...e.hookCode.filter((e) => n(e.id)).map((e) => ({
+			entity: "hookCode",
+			id: e.id,
+			label: e.id
+		})),
+		...e.connections.filter((e) => n(e.id)).map((e) => ({
+			entity: "connection",
+			id: e.id,
+			label: `${e.strategy}:${e.name}`
+		})),
+		...e.resourceServers.filter((e) => n(e.id)).map((e) => ({
+			entity: "resourceServer",
+			id: e.id,
+			label: e.identifier
+		}))
+	];
 }
-async function ot(e, t, n, r) {
+async function pt(e, t, n, r) {
 	switch (n) {
 		case "connection": return !!await e.connections.get(t, r);
 		case "resourceServer": return !!await e.resourceServers.get(t, r);
@@ -1110,7 +1236,7 @@ async function ot(e, t, n, r) {
 		case "hook": return !!await e.hooks.get(t, r);
 	}
 }
-async function st(e, t, n, r) {
+async function mt(e, t, n, r) {
 	switch (n) {
 		case "connection":
 			await e.connections.remove(t, r);
@@ -1131,22 +1257,27 @@ async function st(e, t, n, r) {
 }
 //#endregion
 //#region src/operations/sync-defaults.ts
-function ct(e) {
+function ht(e) {
 	let t = e.input ?? {};
 	return {
 		dryRun: t.dry_run === !0,
-		force: t.force === !0
+		force: t.force === !0,
+		prune: t.prune === !0
 	};
 }
-function lt(e) {
+function gt(e) {
 	return Object.values(e.entities).flatMap((e) => e.errors);
 }
-function ut(e, t) {
+var _t = 20, vt = 300;
+function yt(e, t) {
 	return {
 		dry_run: t.dryRun,
+		prune: t.prune,
 		status: e.status,
 		hash: e.hash,
 		changes: e.changes,
+		rows: e.rows ?? [],
+		error_messages: gt(e).slice(0, _t).map((e) => e.slice(0, vt)),
 		entities: Object.fromEntries(Object.entries(e.entities).map(([e, t]) => [e, {
 			added: t.added,
 			changed: t.changed,
@@ -1156,47 +1287,315 @@ function ut(e, t) {
 		}]))
 	};
 }
-async function dt(e) {
+async function bt(e) {
 	let { operation: t, syncConfig: n, recorder: r } = e;
 	if (!t.tenant_id) throw Error("sync-defaults operations require a tenant_id");
-	let i = ct(t), a = await n(t.tenant_id, i), o = ut(a, i);
+	let i = ht(t), a = await n(t.tenant_id, i), o = yt(a, i);
 	await r.setResult(t.id, o);
-	let s = lt(a);
+	let s = gt(a);
 	if (s.length > 0) {
 		let e = s.slice(0, 3).join("; ");
 		throw Error(`sync-defaults reported ${s.length} error(s): ${e}${s.length > 3 ? "; ..." : ""}`);
 	}
 	return o;
 }
-function ft(e, t) {
+function xt(e, t) {
 	return async (n, r) => {
 		let i = await e.tenants.get(n);
 		if (!i) throw Error(`Tenant "${n}" not found`);
+		if (i.config_sync === "detached") throw Error(`Tenant "${n}" is detached from its parent: set config_sync back to "inherit-on-read" or "synced" before syncing it`);
 		if (i.deployment_type === "wfp") throw Error(`Tenant "${n}" has its own database: configure a dispatch sync (syncDefaults) for it`);
-		return at(await et(e, n, {
+		return ut(await at(e, n, {
 			legacyControlPlane: (t.resolveControlPlane ? await t.resolveControlPlane({ tenant_id: n }) : { tenantId: t.controlPlaneTenantId })?.tenantId,
 			maxDepth: t.maxDepth
 		}), e, n, {
 			dryRun: r.dryRun,
-			force: r.force
+			force: r.force,
+			prune: r.prune
 		});
 	};
 }
 //#endregion
+//#region src/operations/detach.ts
+function St(e) {
+	let t = e.input ?? {};
+	return {
+		dryRun: t.dry_run === !0,
+		clean: t.clean === !0
+	};
+}
+var Ct = 20, wt = 300;
+function Tt(e) {
+	return Object.entries(e.entities).flatMap(([e, t]) => t.errors.map((t) => `${e} ${t}`));
+}
+function Et(e, t) {
+	return {
+		dry_run: t.dryRun,
+		clean: t.clean,
+		status: e.status,
+		changes: e.changes,
+		rows: e.rows ?? [],
+		error_messages: Tt(e).slice(0, Ct).map((e) => e.slice(0, wt)),
+		entities: Object.fromEntries(Object.entries(e.entities).map(([e, t]) => [e, {
+			converted: t.converted,
+			removed: t.removed,
+			skipped: t.skipped,
+			errors: t.errors.length
+		}]))
+	};
+}
+async function Dt(e) {
+	let { operation: t, detachTenant: n, recorder: r, onDetached: i } = e;
+	if (!t.tenant_id) throw Error("detach operations require a tenant_id");
+	let a = St(t), o = await n(t.tenant_id, a), s = Et(o, a);
+	await r.setResult(t.id, s);
+	let c = Tt(o);
+	if (c.length === 0 && !a.dryRun && o.status === "detached" && i?.(t.tenant_id), c.length > 0) {
+		let e = c.slice(0, 3).join("; ");
+		throw Error(`detach reported ${c.length} error(s): ${e}${c.length > 3 ? "; ..." : ""}`);
+	}
+	return s;
+}
+var K = () => ({
+	converted: 0,
+	removed: 0,
+	skipped: 0,
+	errors: []
+});
+function q(e) {
+	let { id: t, hook_id: n, scope: r, override: i, enforce: a, ...o } = e;
+	return o;
+}
+function Ot(e) {
+	return {
+		status: e,
+		changes: [],
+		rows: [],
+		entities: {
+			connection: K(),
+			resourceServer: K(),
+			hookCode: K(),
+			action: K(),
+			hook: K()
+		}
+	};
+}
+function kt(e, t) {
+	if (t.config_sync !== "synced") throw Error(`Tenant "${e}" is not synced: sync its parent's config into it (config_sync "synced") before detaching, otherwise it would lose what it inherits`);
+}
+async function At(e, t) {
+	await e.tenants.update(t, {
+		parent_tenant_id: null,
+		config_sync: "detached",
+		config_sync_hash: null,
+		config_synced_at: null
+	});
+}
+async function jt(e, t, n) {
+	let r = Ot(n.dryRun ? "dry-run" : "detached"), { dryRun: i, clean: o } = n, s = await V(e, t), c = {
+		connection: s.connections.filter((e) => x(e.id)),
+		resourceServer: s.resourceServers.filter((e) => x(e.id)),
+		hookCode: s.hookCode.filter((e) => x(e.id)),
+		action: s.actions.filter((e) => x(e.id)),
+		hook: s.hooks.filter((e) => x(e.hook_id))
+	}, u = (e) => e.scope === "platform", d = /* @__PURE__ */ new Set();
+	for (let e of c.hook) {
+		let t = e.code_id;
+		u(e) && t && d.add(t);
+	}
+	for (let e of c.action) u(e) && d.add(e.id);
+	let f = (e, t, n, i = "") => {
+		r.changes.push(`${t} ${e}:${n}${i}`), r.rows.push({
+			entity: e,
+			key: n,
+			action: t === "convert" ? "converted" : t === "remove" ? "removed" : "kept"
+		});
+	}, p = async (e, t, n) => {
+		try {
+			await n();
+		} catch (n) {
+			r.entities[e].errors.push(`${t}: ${n instanceof Error ? n.message : String(n)}`);
+		}
+	}, m = (e, t) => {
+		r.entities[e].skipped += 1, f(e, "skip", t, " (platform: stays a copy)");
+	}, h = [];
+	if (o) {
+		let n = async (n) => {
+			for (let r of await e.clientConnections.listByConnection(t, n)) await e.clientConnections.removeClientFromConnection(t, n, r);
+		}, a = [
+			...c.hook.map((n) => [
+				"hook",
+				n.hook_id,
+				() => e.hooks.remove(t, n.hook_id)
+			]),
+			...c.action.map((n) => [
+				"action",
+				n.name,
+				() => e.actions.remove(t, n.id)
+			]),
+			...c.hookCode.map((n) => [
+				"hookCode",
+				n.id,
+				() => e.hookCode.remove(t, n.id)
+			]),
+			...c.connection.map((r) => [
+				"connection",
+				`${r.strategy}:${r.name}`,
+				async () => {
+					await n(r.id), await e.connections.remove(t, r.id);
+				}
+			]),
+			...c.resourceServer.map((n) => [
+				"resourceServer",
+				n.identifier,
+				() => e.resourceServers.remove(t, n.id)
+			])
+		];
+		for (let [e, t, n] of a) f(e, "remove", t), await p(e, t, async () => {
+			i || await n(), r.entities[e].removed += 1;
+		});
+	} else {
+		let n = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Set();
+		for (let a of c.hookCode) {
+			if (d.has(a.id)) {
+				m("hookCode", a.id);
+				continue;
+			}
+			f("hookCode", "convert", a.id), o.add(a.id), await p("hookCode", a.id, async () => {
+				if (!i) {
+					let r = await e.hookCode.create(t, _.parse(q(a)));
+					n.set(a.id, r.id), h.push(async () => {
+						await e.hookCode.remove(t, a.id);
+					});
+				}
+				r.entities.hookCode.converted += 1;
+			});
+		}
+		for (let s of c.action) {
+			if (u(s)) {
+				m("action", s.name);
+				continue;
+			}
+			f("action", "convert", s.name), o.add(s.id), await p("action", s.name, async () => {
+				if (!i) {
+					let r = await e.actions.create(t, a.parse(q(s)));
+					n.set(s.id, r.id), h.push(async () => {
+						await e.actions.remove(t, s.id);
+					});
+				}
+				r.entities.action.converted += 1;
+			});
+		}
+		let s = i ? [] : await g((n) => e.organizations.list(t, n), "organizations", {
+			cursorField: "id",
+			pageSize: 100
+		});
+		for (let n of c.connection) {
+			let a = `${n.strategy}:${n.name}`;
+			if (u(n)) {
+				m("connection", a);
+				continue;
+			}
+			f("connection", "convert", a), await p("connection", a, async () => {
+				if (!i) {
+					let { enabled_clients: r, ...i } = q(n), a = await e.connections.create(t, l.parse(i));
+					for (let r of await e.clientConnections.listByConnection(t, n.id)) await e.clientConnections.addClientToConnection(t, a.id, r), await e.clientConnections.removeClientFromConnection(t, n.id, r);
+					for (let r of s) {
+						let i = (await e.organizationConnections.list(t, r.id)).find((e) => e.connection_id === n.id);
+						if (!i) continue;
+						let { connection_id: o, organization_id: s, ...c } = i;
+						await e.organizationConnections.create(t, r.id, {
+							...c,
+							connection_id: a.id
+						}), await e.organizationConnections.remove(t, r.id, n.id);
+					}
+					h.push(async () => {
+						await e.connections.remove(t, n.id);
+					});
+				}
+				r.entities.connection.converted += 1;
+			});
+		}
+		for (let n of c.resourceServer) {
+			if (u(n)) {
+				m("resourceServer", n.identifier);
+				continue;
+			}
+			f("resourceServer", "convert", n.identifier), await p("resourceServer", n.identifier, async () => {
+				if (!i) {
+					await e.resourceServers.remove(t, n.id);
+					try {
+						await e.resourceServers.create(t, T.parse(q(n)));
+					} catch (r) {
+						throw await e.resourceServers.create(t, T.parse(n)), r;
+					}
+				}
+				r.entities.resourceServer.converted += 1;
+			});
+		}
+		let y = [];
+		for (let a of c.hook) {
+			let s = a.hook_id, c = a.code_id;
+			if (u(a)) {
+				m("hook", s);
+				continue;
+			}
+			if (c && !(i ? o.has(c) : n.has(c))) {
+				r.entities.hook.skipped += 1, f("hook", "skip", s, " (its code is not converted)");
+				continue;
+			}
+			f("hook", "convert", s), await p("hook", s, async () => {
+				i || (await e.hooks.create(t, v.parse({
+					...q(a),
+					...c ? { code_id: n.get(c) } : {}
+				})), y.push(async () => {
+					await e.hooks.remove(t, s);
+				})), r.entities.hook.converted += 1;
+			});
+		}
+		h.unshift(...y);
+	}
+	if (Object.values(r.entities).some((e) => e.errors.length > 0)) return {
+		...r,
+		status: "partial"
+	};
+	if (i) return r;
+	for (let e of h) try {
+		await e();
+	} catch (e) {
+		r.entities.hook.errors.push(`remove: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	return Object.values(r.entities).some((e) => e.errors.length > 0) ? {
+		...r,
+		status: "partial"
+	} : r;
+}
+function Mt(e) {
+	return async (t, n) => {
+		let r = await e.tenants.get(t);
+		if (!r) throw Error(`Tenant "${t}" not found`);
+		if (r.deployment_type === "wfp") throw Error(`Tenant "${t}" has its own database: configure a dispatch detach for it`);
+		if (r.config_sync === "detached") return Ot("already-detached");
+		kt(t, r);
+		let i = await jt(e, t, n);
+		return i.status === "detached" && await At(e, t), i;
+	};
+}
+//#endregion
 //#region src/operations/record-provision.ts
-function pt(e) {
+function Nt(e) {
 	if (e.tenantOperations && e.tenantOperationEvents) return {
 		tenantOperations: e.tenantOperations,
 		tenantOperationEvents: e.tenantOperationEvents
 	};
 }
-async function mt(e, t, n) {
-	let r = pt(e);
+async function Pt(e, t, n) {
+	let r = Nt(e);
 	if (!r) {
 		await n(void 0);
 		return;
 	}
-	let i = A(r), a = async (e) => {
+	let i = I(r), a = async (e) => {
 		try {
 			await e();
 		} catch (e) {
@@ -1204,7 +1603,7 @@ async function mt(e, t, n) {
 		}
 	}, o;
 	if (await a(async () => {
-		let e = await M(r, t, "inline");
+		let e = await se(r, t, "inline");
 		o = e.id, await i.markRunning(e.id);
 	}), !o) {
 		await n(void 0);
@@ -1226,7 +1625,7 @@ async function mt(e, t, n) {
 			c || await i.appendEvent(s, {
 				step: t.kind,
 				outcome: "failed",
-				detail: { message: se(e) }
+				detail: { message: F(e) }
 			}), await i.markFailed(s, e);
 		}), e;
 	}
@@ -1238,29 +1637,154 @@ async function mt(e, t, n) {
 	});
 }
 //#endregion
+//#region src/operations/tenant-members-request.ts
+function Ft(e) {
+	let t = () => {
+		if (!e.tenantMemberRequests) throw Error("The data adapter has no tenantMemberRequests adapter");
+		return e.tenantMemberRequests;
+	};
+	return {
+		get: (e, n) => t().get(e, n),
+		async report(e, n, r) {
+			return t().update(e, n, {
+				status: r.status,
+				result: r.result ?? null,
+				error: r.error ?? null,
+				finished_at: (/* @__PURE__ */ new Date()).toISOString()
+			}, "pending");
+		},
+		async listPending(e, { olderThan: n }) {
+			return (await t().list(e, {
+				status: "pending",
+				created_before: n,
+				per_page: 100
+			})).requests;
+		}
+	};
+}
+function It(e) {
+	let t = e.input?.request_id;
+	return typeof t == "string" && t ? t : void 0;
+}
+var Lt = 300;
+async function Rt(e) {
+	let { operation: t, store: n, getBackend: r, recorder: a } = e, o = t.tenant_id, s = It(t);
+	if (!o || !s) throw Error("tenant-members-request operations require a tenant_id and a request_id");
+	let c = await n.get(o, s);
+	if (!c) throw Error(`Request ${s} was not found for tenant ${o}`);
+	if (c.status !== "pending") {
+		let e = {
+			request_id: s,
+			outcome: "already_finished",
+			status: c.status
+		};
+		return await a.setResult(t.id, e), e;
+	}
+	let l;
+	try {
+		l = {
+			status: "succeeded",
+			result: await h(await r(), o, c, e.executeOptions)
+		};
+	} catch (e) {
+		if (!(e instanceof i)) throw e;
+		l = {
+			status: "failed",
+			error: F(e).slice(0, Lt)
+		};
+	}
+	let u = await n.report(o, s, l), d = {
+		request_id: s,
+		outcome: l.status,
+		reported: u,
+		...l.status === "failed" ? { reason: l.error } : {}
+	};
+	return await a.setResult(t.id, d), d;
+}
+var zt = 5;
+async function Bt(e, t, n, r = {}) {
+	let { operations: i } = await e.stores.tenantOperations.list({
+		tenant_id: t,
+		kind: "tenant-members-request",
+		per_page: 100
+	});
+	return i.find((e) => It(e) === n && (e.status === "pending" || e.status === "running" || e.status === "succeeded")) || ce(e.stores, e.executor, {
+		kind: "tenant-members-request",
+		tenant_id: t,
+		initiated_by: r.initiatedBy,
+		input: { request_id: n }
+	}, { returnFailed: !0 });
+}
+async function Vt(e) {
+	let t = e.now?.() ?? /* @__PURE__ */ new Date(), n = new Date(t.getTime() - (e.graceMs ?? 5 * 6e4)).toISOString(), r = e.maxAttempts ?? 5, i = {
+		checked: 0,
+		enqueued: 0,
+		gaveUp: 0,
+		unreachable: []
+	};
+	for (let t of await e.tenantIds()) {
+		let a;
+		try {
+			a = await e.store.listPending(t, { olderThan: n });
+		} catch (e) {
+			console.warn(`[tenant-members] could not read the requests of ${t}:`, e), i.unreachable.push(t);
+			continue;
+		}
+		if (a.length === 0) continue;
+		let { operations: o } = await e.stores.tenantOperations.list({
+			tenant_id: t,
+			kind: "tenant-members-request",
+			per_page: 100
+		});
+		for (let n of a) {
+			i.checked += 1;
+			let a = o.filter((e) => It(e) === n.id);
+			if (!a.some((e) => e.status === "pending" || e.status === "running")) {
+				if (a.filter((e) => e.status === "failed").length >= r) {
+					try {
+						await e.store.report(t, n.id, {
+							status: "failed",
+							error: "The control plane could not carry out this request"
+						}) && (i.gaveUp += 1);
+					} catch (e) {
+						console.warn(`[tenant-members] could not report request ${n.id} as failed:`, e);
+					}
+					continue;
+				}
+				try {
+					await Bt(e, t, n.id), i.enqueued += 1;
+				} catch (e) {
+					console.warn(`[tenant-members] could not enqueue request ${n.id}:`, e);
+				}
+			}
+		}
+	}
+	return i;
+}
+//#endregion
 //#region src/hooks/provisioning.ts
-function ht(e) {
+function Ht(e) {
 	return `urn:authhero:tenant:${e.toLowerCase()}`;
 }
-function gt(e) {
+function Ut(e) {
 	return {
 		async beforeCreate(e, t) {
 			return !t.audience && t.id ? {
 				...t,
-				audience: ht(t.id)
+				audience: Ht(t.id)
 			} : t;
 		},
 		async afterCreate(t, i) {
 			let { accessControl: a, databaseIsolation: o } = e;
-			if (a && t.ctx && await _t(t, i, a), o?.onProvision) {
+			if (a && t.ctx && await Wt(t, i, a), o?.onProvision) {
 				let e = o.onProvision;
-				o.recordProvisionOperations === !1 ? await e(i.id) : await mt(t.adapters, {
+				o.recordProvisionOperations === !1 ? await e(i.id) : await Pt(t.adapters, {
 					kind: "provision",
 					tenant_id: i.id,
 					initiated_by: t.ctx?.var.user?.sub
 				}, (t) => e(i.id, t));
 			} else try {
-				await te(t.adapters, i.id, {
+				await w(t.adapters, i.id, {
 					managementApiIdentifier: n,
 					managementApiScopes: r
 				});
@@ -1284,14 +1808,14 @@ function gt(e) {
 		}
 	};
 }
-async function _t(e, t, n) {
+async function Wt(e, t, n) {
 	let { controlPlaneTenantId: r, defaultPermissions: i, defaultRoles: a, issuer: o, adminRoleName: s = "Tenant Admin", adminRoleDescription: c = "Full access to all tenant management operations", addCreatorToOrganization: l = !0 } = n, u = await e.adapters.organizations.create(r, {
 		name: t.id,
 		display_name: t.friendly_name || t.id
 	}), d;
-	if (o && (d = await yt(e, r, s, c)), l && e.ctx) {
+	if (o && (d = await Kt(e, r, s, c)), l && e.ctx) {
 		let t = e.ctx.var.user;
-		if (t?.sub && !await vt(e, r, t.sub)) try {
+		if (t?.sub && !await Gt(e, r, t.sub)) try {
 			await e.adapters.userOrganizations.create(r, {
 				user_id: t.sub,
 				organization_id: u.id
@@ -1302,12 +1826,12 @@ async function _t(e, t, n) {
 	}
 	a && a.length > 0 && console.log(`Would assign roles ${a.join(", ")} to organization ${u.id}`), i && i.length > 0 && console.log(`Would grant permissions ${i.join(", ")} to organization ${u.id}`);
 }
-async function vt(e, t, r) {
+async function Gt(e, t, r) {
 	let i = await e.adapters.userRoles.list(t, r, void 0, "");
 	for (let r of i) if ((await e.adapters.rolePermissions.list(t, r.id, { per_page: 1e3 })).some((e) => e.permission_name === "admin:organizations" && e.resource_server_identifier === n)) return !0;
 	return !1;
 }
-async function yt(e, t, i, a) {
+async function Kt(e, t, i, a) {
 	let o = (await e.adapters.roles.list(t, {})).roles.find((e) => e.name === i);
 	if (o) return o.id;
 	let s = await e.adapters.roles.create(t, {
@@ -1322,11 +1846,11 @@ async function yt(e, t, i, a) {
 }
 //#endregion
 //#region src/hooks/sync.ts
-function bt(e, t, n = () => !0) {
+function qt(e, t, n = () => !0) {
 	let { controlPlaneTenantId: r, getChildTenantIds: i, getAdapters: a } = e, o = /* @__PURE__ */ new Map();
 	async function s(e, n, r) {
 		return (await t(e).list(n, {
-			q: `name:${p(r)}`,
+			q: `name:${m(r)}`,
 			per_page: 1
 		}))[0] ?? null;
 	}
@@ -1377,11 +1901,11 @@ function bt(e, t, n = () => !0) {
 		}
 	};
 }
-function xt(e, t, n = () => !0) {
+function Jt(e, t, n = () => !0) {
 	let { controlPlaneTenantId: r, getControlPlaneAdapters: i, getAdapters: a } = e;
 	return { async afterCreate(e, o) {
 		if (o.id !== r) try {
-			let e = await i(), s = await a(o.id), c = t(e), l = t(s), u = await m((e) => c.listPaginated(r, e), c.listKey, {
+			let e = await i(), s = await a(o.id), c = t(e), l = t(s), u = await g((e) => c.listPaginated(r, e), c.listKey, {
 				cursorField: "id",
 				pageSize: 100
 			});
@@ -1401,7 +1925,7 @@ function xt(e, t, n = () => !0) {
 		}
 	} };
 }
-var St = (e) => ({
+var Yt = (e) => ({
 	list: async (t, n) => (await e.resourceServers.list(t, n)).resource_servers,
 	listPaginated: (t, n) => e.resourceServers.list(t, n),
 	get: (t, n) => e.resourceServers.get(t, n),
@@ -1419,7 +1943,7 @@ var St = (e) => ({
 		token_lifetime: e.token_lifetime,
 		token_lifetime_for_web: e.token_lifetime_for_web
 	})
-}), Ct = (e) => ({
+}), Xt = (e) => ({
 	list: async (t, n) => (await e.roles.list(t, n)).roles,
 	listPaginated: (t, n) => e.roles.list(t, n),
 	get: (t, n) => e.roles.get(t, n),
@@ -1434,15 +1958,15 @@ var St = (e) => ({
 		description: e.description
 	})
 });
-function wt(e) {
+function Zt(e) {
 	return e.metadata?.sync !== !1;
 }
-function Tt(e) {
-	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => wt(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => wt(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? bt(e, St, a) : void 0, c = i ? bt(e, Ct, o) : void 0, l = r ? xt(e, St, a) : void 0, u = i ? xt(e, Ct, o) : void 0, d = i ? { async afterCreate(t, r) {
+function Qt(e) {
+	let { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, i = t.roles ?? !0, a = (e) => Zt(e) ? n.resourceServers ? n.resourceServers(e) : !0 : !1, o = (e) => Zt(e) ? n.roles ? n.roles(e) : !0 : !1, s = r ? qt(e, Yt, a) : void 0, c = i ? qt(e, Xt, o) : void 0, l = r ? Jt(e, Yt, a) : void 0, u = i ? Jt(e, Xt, o) : void 0, d = i ? { async afterCreate(t, r) {
 		if (r.id !== e.controlPlaneTenantId) {
 			await u?.afterCreate?.(t, r);
 			try {
-				let t = await e.getControlPlaneAdapters(), i = await e.getAdapters(r.id), a = await m((n) => t.roles.list(e.controlPlaneTenantId, n), "roles", {
+				let t = await e.getControlPlaneAdapters(), i = await e.getAdapters(r.id), a = await g((n) => t.roles.list(e.controlPlaneTenantId, n), "roles", {
 					cursorField: "id",
 					pageSize: 100
 				}), o = /* @__PURE__ */ new Map();
@@ -1470,7 +1994,7 @@ function Tt(e) {
 	} } : void 0;
 	async function f(e, t, n) {
 		return (await e.roles.list(t, {
-			q: `name:${p(n)}`,
+			q: `name:${m(n)}`,
 			per_page: 1
 		})).roles[0] ?? null;
 	}
@@ -1493,54 +2017,67 @@ function Tt(e) {
 }
 //#endregion
 //#region src/middleware/request-data.ts
-function q(e) {
+function J(e) {
 	return e.var.data ?? e.env.data;
 }
 //#endregion
+//#region src/utils/tenant-settings.ts
+async function $t(e, t, n) {
+	let r = !n || n === t, { totals: i } = await e.list({
+		per_page: 1,
+		include_totals: !0,
+		...r ? {} : { q: `parent_tenant_id:${ee(t)}` }
+	});
+	return {
+		is_control_plane: r,
+		has_children: (i?.length ?? 0) > +!!r
+	};
+}
+//#endregion
 //#region src/routes/tenants.ts
-var Et = D.object({
-	sub: D.string(),
-	tenant_id: D.string().optional(),
-	org_id: D.string().optional(),
-	scope: D.string().optional(),
-	permissions: D.array(D.string()).optional()
+var en = j.object({
+	sub: j.string(),
+	tenant_id: j.string().optional(),
+	org_id: j.string().optional(),
+	scope: j.string().optional(),
+	permissions: j.array(j.string()).optional()
 }).passthrough();
-function Dt(e) {
-	let t = Et.safeParse(e);
+function tn(e) {
+	let t = en.safeParse(e);
 	return t.success ? t.data : void 0;
 }
-function Ot(e, t, n) {
+function nn(e, t, n) {
 	return t ? !e || n ? !1 : e.tenant_id === t : !0;
 }
-function kt(e) {
+function rn(e) {
 	let t = e.permissions ?? [], n = e.scope ? e.scope.split(" ").filter(Boolean) : [], r = new Set([...t, ...n]);
 	return r.has("delete:tenants") || r.has("admin:organizations");
 }
-function At(e, t) {
-	let n = new T(), r = (t) => {
-		let n = Dt(t.var.user);
-		return Ot(n, e.accessControl?.controlPlaneTenantId ?? q(t).multiTenancyConfig?.controlPlaneTenantId, !!(n?.org_id ?? t.var.organization_id ?? t.var.org_name));
-	};
-	if (n.openapi(E({
+function an(e, t) {
+	let n = new k(), r = (t) => {
+		let n = tn(t.var.user);
+		return nn(n, e.accessControl?.controlPlaneTenantId ?? J(t).multiTenancyConfig?.controlPlaneTenantId, !!(n?.org_id ?? t.var.organization_id ?? t.var.org_name));
+	}, i = (t, n) => $t(J(t).tenants, n, e.accessControl?.controlPlaneTenantId ?? J(t).multiTenancyConfig?.controlPlaneTenantId);
+	if (n.openapi(A({
 		tags: ["tenants"],
 		method: "get",
 		path: "/",
-		request: { query: a },
+		request: { query: o },
 		security: [{ Bearer: [] }],
 		responses: { 200: {
-			content: { "application/json": { schema: D.object({
-				tenants: D.array(C),
-				start: D.number().optional(),
-				limit: D.number().optional(),
-				length: D.number().optional(),
-				total: D.number().optional()
+			content: { "application/json": { schema: j.object({
+				tenants: j.array(D),
+				start: j.number().optional(),
+				limit: j.number().optional(),
+				length: j.number().optional(),
+				total: j.number().optional()
 			}) } },
 			description: "List of tenants"
 		} }
 	}), async (t) => {
 		let { page: n, per_page: r, include_totals: i, q: a } = t.req.valid("query"), o = t.var.user, s = o?.permissions || [];
 		if (!(o?.org_id ?? t.var.organization_id) && s.includes("admin:organizations")) {
-			let e = await q(t).tenants.list({
+			let e = await J(t).tenants.list({
 				page: n,
 				per_page: r,
 				include_totals: i,
@@ -1554,10 +2091,10 @@ function At(e, t) {
 				total: e.totals?.length
 			}) : t.json({ tenants: e.tenants });
 		}
-		let c = e.accessControl?.controlPlaneTenantId ?? q(t).multiTenancyConfig?.controlPlaneTenantId;
-		if (c && !o?.sub) throw new w(403, { message: "Access denied: token has no subject" });
+		let c = e.accessControl?.controlPlaneTenantId ?? J(t).multiTenancyConfig?.controlPlaneTenantId;
+		if (c && !o?.sub) throw new O(403, { message: "Access denied: token has no subject" });
 		if (c && o?.sub) {
-			let e = (await m((e) => q(t).userOrganizations.listUserOrganizations(c, o.sub, e), "organizations")).map((e) => e.name);
+			let e = (await g((e) => J(t).userOrganizations.listUserOrganizations(c, o.sub, e), "organizations")).map((e) => e.name);
 			if (e.length === 0) return i ? t.json({
 				tenants: [],
 				start: 0,
@@ -1573,20 +2110,20 @@ function At(e, t) {
 				length: 0,
 				total: s
 			}) : t.json({ tenants: [] });
-			let p = f.map((e) => `id:${e}`).join(" OR "), h = a ? `(${p}) AND (${a})` : p, g = await q(t).tenants.list({
-				q: h,
+			let p = f.map((e) => `id:${e}`).join(" OR "), m = a ? `(${p}) AND (${a})` : p, h = await J(t).tenants.list({
+				q: m,
 				per_page: u,
 				include_totals: !1
 			});
 			return i ? t.json({
-				tenants: g.tenants,
+				tenants: h.tenants,
 				start: d,
 				limit: u,
-				length: g.tenants.length,
+				length: h.tenants.length,
 				total: s
-			}) : t.json({ tenants: g.tenants });
+			}) : t.json({ tenants: h.tenants });
 		}
-		let l = await q(t).tenants.list({
+		let l = await J(t).tenants.list({
 			page: n,
 			per_page: r,
 			include_totals: i,
@@ -1599,44 +2136,44 @@ function At(e, t) {
 			length: l.tenants.length,
 			total: l.totals?.length
 		}) : t.json({ tenants: l.tenants });
-	}), n.openapi(E({
+	}), n.openapi(A({
 		tags: ["tenants"],
 		method: "post",
 		path: "/",
-		request: { body: { content: { "application/json": { schema: S } } } },
+		request: { body: { content: { "application/json": { schema: E } } } },
 		security: [{ Bearer: [] }],
 		responses: {
 			201: {
-				content: { "application/json": { schema: C } },
+				content: { "application/json": { schema: D } },
 				description: "Tenant created"
 			},
 			400: { description: "Validation error" },
 			409: { description: "Tenant with this ID already exists" }
 		}
 	}), async (n) => {
-		if (!n.var.user?.sub) throw new w(401, { message: "Authentication required to create tenants" });
+		if (!n.var.user?.sub) throw new O(401, { message: "Authentication required to create tenants" });
 		let { config_sync_hash: i, config_synced_at: a, config_sync: o, ...s } = n.req.valid("json"), c = s;
-		if (c.parent_tenant_id && !r(n)) throw new w(403, { message: "Only the control plane can set a tenant's parent" });
+		if (c.parent_tenant_id && !r(n)) throw new O(403, { message: "Only the control plane can set a tenant's parent" });
 		o !== void 0 && r(n) && (c = {
 			...c,
 			config_sync: o
 		});
 		let l = {
-			adapters: q(n),
+			adapters: J(n),
 			ctx: n
 		};
-		t.tenants?.beforeCreate && (c = await t.tenants.beforeCreate(l, c)), await de({
+		t.tenants?.beforeCreate && (c = await t.tenants.beforeCreate(l, c)), await le({
 			tenantId: c.id,
 			parentTenantId: c.parent_tenant_id,
-			getTenant: (e) => q(n).tenants.get(e)
+			getTenant: (e) => J(n).tenants.get(e)
 		});
-		let u = await q(n).tenants.create(c);
+		let u = await J(n).tenants.create(c);
 		return t.tenants?.afterCreate && await t.tenants.afterCreate(l, u), e.onConfigSyncChange?.(u.id), n.json(u, 201);
-	}), n.openapi(E({
+	}), n.openapi(A({
 		tags: ["tenants"],
 		method: "delete",
 		path: "/{id}",
-		request: { params: D.object({ id: D.string() }) },
+		request: { params: j.object({ id: j.string() }) },
 		security: [{ Bearer: ["delete:tenants"] }],
 		responses: {
 			204: { description: "Tenant deleted" },
@@ -1644,44 +2181,103 @@ function At(e, t) {
 			404: { description: "Tenant not found" }
 		}
 	}), async (n) => {
-		let { id: r } = n.req.valid("param"), i = e.accessControl?.controlPlaneTenantId ?? q(n).multiTenancyConfig?.controlPlaneTenantId;
+		let { id: r } = n.req.valid("param"), i = e.accessControl?.controlPlaneTenantId ?? J(n).multiTenancyConfig?.controlPlaneTenantId;
 		if (i) {
-			let e = Dt(n.var.user);
-			if (!e?.sub) throw new w(401, { message: "Authentication required" });
-			if (r === i) throw new w(403, { message: "Cannot delete the control plane" });
+			let e = tn(n.var.user);
+			if (!e?.sub) throw new O(401, { message: "Authentication required" });
+			if (r === i) throw new O(403, { message: "Cannot delete the control plane" });
 			let t = n.var.org_name, a = r.toLowerCase(), o = !!t && t.toLowerCase() === a;
 			if (!o) {
 				let r = !!(e.org_id ?? n.var.organization_id ?? t), a = !e.tenant_id || e.tenant_id === i;
-				!r && a && kt(e) && (o = !0);
+				!r && a && rn(e) && (o = !0);
 			}
-			if (o ||= (await m((t) => q(n).userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new w(403, { message: "Access denied to this tenant" });
+			if (o ||= (await g((t) => J(n).userOrganizations.listUserOrganizations(i, e.sub, t), "organizations")).some((e) => e.name?.toLowerCase() === a), !o) throw new O(403, { message: "Access denied to this tenant" });
 		}
-		if (!await q(n).tenants.get(r)) throw new w(404, { message: "Tenant not found" });
+		if (!await J(n).tenants.get(r)) throw new O(404, { message: "Tenant not found" });
 		let a = {
-			adapters: q(n),
+			adapters: J(n),
 			ctx: n
 		};
-		return t.tenants?.beforeDelete && await t.tenants.beforeDelete(a, r), await q(n).tenants.remove(r), t.tenants?.afterDelete && await t.tenants.afterDelete(a, r), n.body(null, 204);
-	}), e.configSyncStatus) {
+		return t.tenants?.beforeDelete && await t.tenants.beforeDelete(a, r), await J(n).tenants.remove(r), t.tenants?.afterDelete && await t.tenants.afterDelete(a, r), n.body(null, 204);
+	}), e.verifyConfigSync) {
+		let t = e.verifyConfigSync;
+		n.openapi(A({
+			tags: ["tenants"],
+			method: "get",
+			path: "/{id}/config-sync/verify",
+			request: { params: j.object({ id: j.string() }) },
+			security: [{ Bearer: ["read:tenants"] }],
+			responses: {
+				200: {
+					content: { "application/json": { schema: j.object({
+						tenant_id: j.string(),
+						config_sync: j.enum([
+							"inherit-on-read",
+							"synced",
+							"detached"
+						]),
+						method: j.enum([
+							"read-time",
+							"sync-dry-run",
+							"not-applicable"
+						]),
+						ok: j.boolean(),
+						differences: j.array(j.object({
+							entity: j.string(),
+							key: j.string(),
+							kind: j.enum([
+								"missing",
+								"extra",
+								"changed",
+								"stale"
+							]),
+							fields: j.array(j.string()).optional()
+						})),
+						errors: j.array(j.string())
+					}) } },
+					description: "The tenant's config compared with what its parents publish"
+				},
+				403: { description: "Not allowed to verify this tenant" },
+				404: { description: "Tenant not found" },
+				502: { description: "The tenant's database could not be reached" }
+			}
+		}), async (e) => {
+			let { id: n } = e.req.valid("param");
+			if (n !== e.var.tenant_id && !r(e)) throw new O(403, { message: "Config can only be verified for your own tenant" });
+			let i;
+			try {
+				i = await t(n);
+			} catch (e) {
+				throw console.error(`[multi-tenancy] config verify failed for "${n}":`, e), new O(502, { message: "Could not verify: the tenant's config could not be checked" });
+			}
+			if (!i) throw new O(404, { message: "Tenant not found" });
+			return e.json(i);
+		});
+	}
+	if (e.configSyncStatus) {
 		let t = e.configSyncStatus;
-		n.openapi(E({
+		n.openapi(A({
 			tags: ["tenants"],
 			method: "get",
 			path: "/{id}/config-sync",
-			request: { params: D.object({ id: D.string() }) },
+			request: { params: j.object({ id: j.string() }) },
 			security: [{ Bearer: ["read:tenants"] }],
 			responses: {
 				200: {
-					content: { "application/json": { schema: D.object({
-						tenant_id: D.string(),
-						parent_tenant_id: D.string().nullable(),
-						config_sync: D.enum(["inherit-on-read", "synced"]),
-						config_sync_hash: D.string().nullable(),
-						config_synced_at: D.string().nullable(),
-						expected_hash: D.string().nullable(),
-						drifted: D.boolean(),
-						chain: D.array(D.string()),
-						inherited: D.record(D.string(), D.string())
+					content: { "application/json": { schema: j.object({
+						tenant_id: j.string(),
+						parent_tenant_id: j.string().nullable(),
+						config_sync: j.enum([
+							"inherit-on-read",
+							"synced",
+							"detached"
+						]),
+						config_sync_hash: j.string().nullable(),
+						config_synced_at: j.string().nullable(),
+						expected_hash: j.string().nullable(),
+						drifted: j.boolean(),
+						chain: j.array(j.string()),
+						inherited: j.record(j.string(), j.string())
 					}) } },
 					description: "Config sync status of the tenant"
 				},
@@ -1690,70 +2286,76 @@ function At(e, t) {
 			}
 		}), async (e) => {
 			let { id: n } = e.req.valid("param");
-			if (n !== e.var.tenant_id && !r(e)) throw new w(403, { message: "Config sync status is only readable for your own tenant" });
+			if (n !== e.var.tenant_id && !r(e)) throw new O(403, { message: "Config sync status is only readable for your own tenant" });
 			let i = await t(n);
-			if (!i) throw new w(404, { message: "Tenant not found" });
+			if (!i) throw new O(404, { message: "Tenant not found" });
 			return e.json(i);
 		});
 	}
-	return n.openapi(E({
+	return n.openapi(A({
 		tags: ["tenants", "settings"],
 		method: "get",
 		path: "/settings",
-		request: { headers: D.object({ "tenant-id": D.string().optional() }) },
+		request: { headers: j.object({ "tenant-id": j.string().optional() }) },
 		security: [{ Bearer: ["read:tenants"] }],
 		responses: { 200: {
-			content: { "application/json": { schema: C } },
+			content: { "application/json": { schema: D } },
 			description: "Current tenant settings"
 		} }
 	}), async (e) => {
-		let t = await q(e).tenants.get(e.var.tenant_id);
-		if (!t) throw new w(404, { message: "Tenant not found" });
-		return e.json(t);
-	}), n.openapi(E({
+		let t = await J(e).tenants.get(e.var.tenant_id);
+		if (!t) throw new O(404, { message: "Tenant not found" });
+		return e.json({
+			...t,
+			...await i(e, t.id)
+		});
+	}), n.openapi(A({
 		tags: ["tenants", "settings"],
 		method: "patch",
 		path: "/settings",
 		request: {
-			headers: D.object({ "tenant-id": D.string().optional() }),
-			body: { content: { "application/json": { schema: D.object(S.shape).partial() } } }
+			headers: j.object({ "tenant-id": j.string().optional() }),
+			body: { content: { "application/json": { schema: j.object(E.shape).partial() } } }
 		},
 		security: [{ Bearer: ["update:tenants"] }],
 		responses: { 200: {
-			content: { "application/json": { schema: C } },
+			content: { "application/json": { schema: D } },
 			description: "Updated tenant settings"
 		} }
 	}), async (t) => {
-		let { id: n, config_sync_hash: i, config_synced_at: a, ...o } = t.req.valid("json"), s = await q(t).tenants.get(t.var.tenant_id);
-		if (!s) throw new w(404, { message: "Tenant not found" });
-		if ("config_sync" in o && (o.config_sync ?? "inherit-on-read") !== (s.config_sync ?? "inherit-on-read") && !r(t)) throw new w(403, { message: "Only the control plane can change a tenant's config_sync mode" });
-		if ("default_client_id" in o) {
-			let e = o.default_client_id;
+		let { id: n, config_sync_hash: a, config_synced_at: o, ...s } = t.req.valid("json"), c = await J(t).tenants.get(t.var.tenant_id);
+		if (!c) throw new O(404, { message: "Tenant not found" });
+		if ("config_sync" in s && (s.config_sync ?? "inherit-on-read") !== (c.config_sync ?? "inherit-on-read") && !r(t)) throw new O(403, { message: "Only the control plane can change a tenant's config_sync mode" });
+		if ("default_client_id" in s) {
+			let e = s.default_client_id;
 			if (typeof e == "string" && e.length > 0) {
-				let n = await q(t).clients.get(t.var.tenant_id, e);
-				if (!n) throw new w(400, { message: `Client with id '${e}' not found` });
-				if (!v(n)) throw new w(400, { message: `Client '${e}' is not an interactive client and cannot be used as the default client` });
+				let n = await J(t).clients.get(t.var.tenant_id, e);
+				if (!n) throw new O(400, { message: `Client with id '${e}' not found` });
+				if (!b(n)) throw new O(400, { message: `Client '${e}' is not an interactive client and cannot be used as the default client` });
 			}
 		}
-		if ("parent_tenant_id" in o) {
-			if ((o.parent_tenant_id ?? null) !== (s.parent_tenant_id ?? null) && !r(t)) throw new w(403, { message: "Only the control plane can change a tenant's parent" });
-			await de({
+		if ("parent_tenant_id" in s) {
+			if ((s.parent_tenant_id ?? null) !== (c.parent_tenant_id ?? null) && !r(t)) throw new O(403, { message: "Only the control plane can change a tenant's parent" });
+			await le({
 				tenantId: t.var.tenant_id,
-				parentTenantId: o.parent_tenant_id,
-				getTenant: (e) => q(t).tenants.get(e),
-				getChildren: async (e) => (await m((e) => q(t).tenants.list(e), "tenants")).filter((t) => t.parent_tenant_id === e).map((e) => e.id)
+				parentTenantId: s.parent_tenant_id,
+				getTenant: (e) => J(t).tenants.get(e),
+				getChildren: async (e) => (await g((e) => J(t).tenants.list(e), "tenants")).filter((t) => t.parent_tenant_id === e).map((e) => e.id)
 			});
 		}
-		let c = d(s, o);
-		await q(t).tenants.update(t.var.tenant_id, c), "config_sync" in o && e.onConfigSyncChange?.(t.var.tenant_id);
-		let l = await q(t).tenants.get(t.var.tenant_id);
-		if (!l) throw new w(500, { message: "Failed to retrieve updated tenant" });
-		return t.json(l);
+		let l = f(c, s);
+		await J(t).tenants.update(t.var.tenant_id, l), "config_sync" in s && e.onConfigSyncChange?.(t.var.tenant_id);
+		let u = await J(t).tenants.get(t.var.tenant_id);
+		if (!u) throw new O(500, { message: "Failed to retrieve updated tenant" });
+		return t.json({
+			...u,
+			...await i(t, u.id)
+		});
 	}), n;
 }
 //#endregion
 //#region src/middleware/protect-synced.ts
-function jt(e) {
+function on(e) {
 	for (let { pattern: t, type: n } of [
 		{
 			pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
@@ -1776,7 +2378,7 @@ function jt(e) {
 	}
 	return null;
 }
-async function Mt(e, t, n) {
+async function sn(e, t, n) {
 	try {
 		switch (n.type) {
 			case "resource_server": return (await e.resourceServers.get(t, n.id))?.is_system === !0;
@@ -1788,14 +2390,14 @@ async function Mt(e, t, n) {
 		return !1;
 	}
 }
-function Nt(e) {
+function cn(e) {
 	return {
 		resource_server: "resource server",
 		role: "role",
 		connection: "connection"
 	}[e];
 }
-function Pt(e) {
+function ln(e) {
 	for (let { pattern: t, type: n } of [
 		{
 			pattern: /\/api\/v2\/connections\/([^/]+)$/,
@@ -1826,7 +2428,7 @@ function Pt(e) {
 	}
 	return null;
 }
-async function Ft(e, t, n) {
+async function un(e, t, n) {
 	try {
 		switch (n.type) {
 			case "connection": return await e.connections.get(t, n.id);
@@ -1839,38 +2441,38 @@ async function Ft(e, t, n) {
 		return null;
 	}
 }
-var It = {
+var dn = {
 	connection: ["options"],
 	resource_server: ["signing_secret"],
 	action: ["secrets"],
 	hook: [],
 	hook_code: []
-}, Lt = new Set([
+}, fn = new Set([
 	"client_secret",
 	"app_secret",
 	"twilio_token"
 ]);
-function Rt(e, t) {
+function pn(e, t) {
 	let n = (e) => {
 		let { client_secret: t, ...n } = e ?? {};
 		return n;
 	};
-	return zt(n(e), n(t));
+	return mn(n(e), n(t));
 }
-var zt = (e, t) => JSON.stringify(e) === JSON.stringify(t);
-function J(e, t) {
-	return new w(403, { message: `This ${e.type.replace("_", " ")} is synced from a parent tenant and ${t}. Make changes in the parent tenant instead.` });
+var mn = (e, t) => JSON.stringify(e) === JSON.stringify(t);
+function Y(e, t) {
+	return new O(403, { message: `This ${e.type.replace("_", " ")} is synced from a parent tenant and ${t}. Make changes in the parent tenant instead.` });
 }
-async function Bt(e, t, n) {
-	let r = await Ft(q(e), t, n);
+async function hn(e, t, n) {
+	let r = await un(J(e), t, n);
 	if (!r) return;
-	if (n.type === "hook_code") throw J(n, "cannot be modified");
+	if (n.type === "hook_code") throw Y(n, "cannot be modified");
 	if (e.req.method === "DELETE") {
-		if (r.enforce === !0) throw J(n, "cannot be deleted");
+		if (r.enforce === !0) throw Y(n, "cannot be deleted");
 		return;
 	}
 	let i = r.override ?? "fields";
-	if (i === "none") throw J(n, "cannot be edited");
+	if (i === "none") throw Y(n, "cannot be edited");
 	let a = {};
 	try {
 		let t = await e.req.raw.clone().json();
@@ -1880,56 +2482,56 @@ async function Bt(e, t, n) {
 		"scope",
 		"override",
 		"enforce"
-	]) if (e in a && !zt(a[e] ?? null, r[e] ?? null)) throw J(n, `has a locked ${e}`);
-	if (r.enforce === !0 && a.enabled === !1) throw J(n, "cannot be disabled");
+	]) if (e in a && !mn(a[e] ?? null, r[e] ?? null)) throw Y(n, `has a locked ${e}`);
+	if (r.enforce === !0 && a.enabled === !1) throw Y(n, "cannot be disabled");
 	if (i === "secrets") {
-		let e = It[n.type];
+		let e = dn[n.type];
 		for (let [t, i] of Object.entries(a)) if (![
 			"scope",
 			"override",
 			"enforce"
-		].includes(t) && !zt(i, r[t])) {
-			if (!e.includes(t)) throw J(n, `only allows its secrets to be changed (not ${t})`);
+		].includes(t) && !mn(i, r[t])) {
+			if (!e.includes(t)) throw Y(n, `only allows its secrets to be changed (not ${t})`);
 			if (t === "options" && i && typeof i == "object") {
 				let e = r.options ?? {};
-				for (let [t, r] of Object.entries(i)) if (!zt(r, e[t]) && !t.endsWith("_hint") && !(Lt.has(t) || t === "configuration" && Rt(r, e[t]))) throw J(n, `only allows its secrets to be changed (not options.${t})`);
+				for (let [t, r] of Object.entries(i)) if (!mn(r, e[t]) && !t.endsWith("_hint") && !(fn.has(t) || t === "configuration" && pn(r, e[t]))) throw Y(n, `only allows its secrets to be changed (not options.${t})`);
 			}
 		}
 	}
 }
-function Vt() {
+function gn() {
 	return async (e, t) => {
 		if (![
 			"PATCH",
 			"PUT",
 			"DELETE"
 		].includes(e.req.method)) return t();
-		let n = jt(e.req.path), r = Pt(e.req.path);
+		let n = on(e.req.path), r = ln(e.req.path);
 		if (!n && !r) return t();
 		let i = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
 		if (!i) return t();
-		if (n && await Mt(q(e), i, n)) throw new w(403, { message: `This ${Nt(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
-		return r && y(r.id) && await Bt(e, i, r), t();
+		if (n && await sn(J(e), i, n)) throw new O(403, { message: `This ${cn(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.` });
+		return r && x(r.id) && await hn(e, i, r), t();
 	};
 }
 //#endregion
 //#region src/middleware/index.ts
-function Ht(e) {
+function _n(e) {
 	return async (t, n) => {
 		let r = t.var.user;
 		return r?.tenant_id === e && r.org_name && t.set("tenant_id", r.org_name), n();
 	};
 }
-function Ut(e) {
+function vn(e) {
 	return async (t, r) => {
 		if (!e.accessControl) return r();
 		let { controlPlaneTenantId: i } = e.accessControl, a = t.var.org_name, o = t.var.organization_id, s = a || o, c = t.var.tenant_id, l = t.var.user, u = (l?.aud ? Array.isArray(l.aud) ? l.aud : [l.aud] : []).includes(n);
-		if (!c && s && u && (t.set("tenant_id", s), c = s), !c) throw new w(400, { message: "Tenant ID not found in request" });
-		if (!O(o, c, i, a)) throw new w(403, { message: `Access denied to tenant ${c}` });
+		if (!c && s && u && (t.set("tenant_id", s), c = s), !c) throw new O(400, { message: "Tenant ID not found in request" });
+		if (!N(o, c, i, a)) throw new O(403, { message: `Access denied to tenant ${c}` });
 		return r();
 	};
 }
-function Wt(e) {
+function yn(e) {
 	return async (t, n) => {
 		if (!e.subdomainRouting) return n();
 		let { baseDomain: r, reservedSubdomains: i = [], resolveSubdomain: a } = e.subdomainRouting, o = t.req.header("x-forwarded-host") || t.req.header("host") || "", s = null;
@@ -1941,18 +2543,18 @@ function Wt(e) {
 		let c = null;
 		if (a) c = await a(s);
 		else if (e.subdomainRouting.useOrganizations !== !1 && e.accessControl) try {
-			let n = await q(t).organizations.get(e.accessControl.controlPlaneTenantId, s);
+			let n = await J(t).organizations.get(e.accessControl.controlPlaneTenantId, s);
 			n && (c = n.id);
 		} catch {}
-		if (!c) throw new w(404, { message: `Tenant not found for subdomain: ${s}` });
+		if (!c) throw new O(404, { message: `Tenant not found for subdomain: ${s}` });
 		return t.set("tenant_id", c), n();
 	};
 }
-function Gt(e) {
+function bn(e) {
 	return async (t, n) => {
 		if (!e.databaseIsolation) return n();
 		let r = t.var.tenant_id;
-		if (!r) throw new w(400, { message: "Tenant ID not found in request" });
+		if (!r) throw new O(400, { message: "Tenant ID not found in request" });
 		try {
 			let n = await e.databaseIsolation.getAdapters(r);
 			t.set("baseData", n), t.env = {
@@ -1960,39 +2562,39 @@ function Gt(e) {
 				data: n
 			};
 		} catch (e) {
-			throw console.error(`Failed to resolve database for tenant ${r}:`, e), new w(500, { message: "Failed to resolve tenant database" });
+			throw console.error(`Failed to resolve database for tenant ${r}:`, e), new O(500, { message: "Failed to resolve tenant database" });
 		}
 		return n();
 	};
 }
-function Kt(e) {
-	let t = Wt(e), n = Ut(e), r = Gt(e);
+function xn(e) {
+	let t = yn(e), n = vn(e), r = bn(e);
 	return async (e, i) => (await t(e, async () => {}), await n(e, async () => {}), await r(e, async () => {}), i());
 }
 //#endregion
 //#region src/rollouts/config.ts
-var qt = [
+var Sn = [
 	10,
 	50,
 	100
-], Y = {
+], X = {
 	canary: 1,
-	waves: qt,
+	waves: Sn,
 	failure_threshold: .1,
 	max_concurrent: 25,
 	debounce_ms: 6e4
 };
-function X(e) {
+function Z(e) {
 	let t = e.config ?? {};
 	return {
-		...Y,
+		...X,
 		trigger: "manual",
 		root_tenant_id: "",
 		...t,
-		waves: Array.isArray(t.waves) && t.waves.length > 0 ? t.waves : [...qt]
+		waves: Array.isArray(t.waves) && t.waves.length > 0 ? t.waves : [...Sn]
 	};
 }
-function Jt(e, t, n) {
+function Cn(e, t, n) {
 	let r = Array(e).fill(0);
 	if (e === 0) return r;
 	let i = Math.min(Math.max(t, 0), e), a = [], o = i;
@@ -2010,8 +2612,8 @@ function Jt(e, t, n) {
 }
 //#endregion
 //#region src/rollouts/enumerate.ts
-async function Yt(e, t, n) {
-	let r = n.maxDepth ?? 8, i = await m((t) => e.tenants.list(t), "tenants", {
+async function wn(e, t, n) {
+	let r = n.maxDepth ?? 8, i = await g((t) => e.tenants.list(t), "tenants", {
 		cursorField: "id",
 		pageSize: 100
 	}), a = new Map(i.map((e) => [e.id, e])), o = async (e) => e.parent_tenant_id ?? (e.id === t ? void 0 : await n.resolveLegacyParent(e.id)), s = [];
@@ -2037,19 +2639,19 @@ async function Yt(e, t, n) {
 }
 //#endregion
 //#region src/rollouts/hashes.ts
-async function Xt(e, t) {
+async function Q(e, t) {
 	return e.resolveControlPlane ? (await e.resolveControlPlane({ tenant_id: t }))?.tenantId : e.controlPlaneTenantId;
 }
-function Zt(e) {
+function Tn(e) {
 	let t = /* @__PURE__ */ new Map();
 	return async (n) => {
-		let r = await Xt(e, n), i = (await N({
+		let r = await Q(e, n), i = (await R({
 			tenantId: n,
 			getTenant: (t) => e.adapters.tenants.get(t),
 			legacyControlPlane: r,
 			maxDepth: e.maxDepth
 		})).join(">"), a = t.get(i);
-		return a || (a = et(e.adapters, n, {
+		return a || (a = at(e.adapters, n, {
 			legacyControlPlane: r,
 			maxDepth: e.maxDepth
 		}).then((e) => e.hash), t.set(i, a)), a;
@@ -2057,13 +2659,13 @@ function Zt(e) {
 }
 //#endregion
 //#region src/rollouts/plan.ts
-var Qt = [
+var En = [
 	"pending",
 	"canary",
 	"rolling",
 	"paused"
 ];
-function $t(e) {
+function Dn(e) {
 	let { tenantOperations: t, tenantOperationEvents: n } = e.adapters;
 	if (!t || !n) throw Error("Fleet rollouts need the tenant operations adapters");
 	return {
@@ -2071,20 +2673,20 @@ function $t(e) {
 		tenantOperationEvents: n
 	};
 }
-function Z(e) {
+function $(e) {
 	if (!e.adapters.rollouts) throw Error("Fleet rollouts need the rollouts adapter");
 	return e.adapters.rollouts;
 }
-async function en(e, t, n = {}) {
-	let r = Z(e), i = $t(e), a = X(t), o = await Yt(e.adapters, a.root_tenant_id, {
-		resolveLegacyParent: (t) => Xt(e, t),
+async function On(e, t, n = {}) {
+	let r = $(e), i = Dn(e), a = Z(t), o = await wn(e.adapters, a.root_tenant_id, {
+		resolveLegacyParent: (t) => Q(e, t),
 		maxDepth: e.maxDepth
 	});
 	if (n.tenantIds) {
 		let e = new Set(n.tenantIds);
 		o = o.filter((t) => e.has(t.tenantId));
 	}
-	let s = Zt(e), c = [];
+	let s = Tn(e), c = [];
 	for (let e of o) (a.force || e.appliedHash !== await s(e.tenantId)) && c.push(e);
 	let l = o.length - c.length;
 	if (c.length === 0) return a.trigger === "write" ? await r.remove(t.id) : await r.update(t.id, {
@@ -2099,8 +2701,8 @@ async function en(e, t, n = {}) {
 		planned: 0,
 		upToDate: l
 	};
-	let u = new Set((await Q(e, t.id)).map((e) => e.tenant_id)), d = Jt(c.length, a.canary, a.waves);
-	for (let [n, r] of c.entries()) u.has(r.tenantId) || await M(i, {
+	let u = new Set((await kn(e, t.id)).map((e) => e.tenant_id)), d = Cn(c.length, a.canary, a.waves);
+	for (let [n, r] of c.entries()) u.has(r.tenantId) || await se(i, {
 		kind: "sync-defaults",
 		tenant_id: r.tenantId,
 		rollout_id: t.id,
@@ -2123,8 +2725,8 @@ async function en(e, t, n = {}) {
 		upToDate: l
 	};
 }
-async function Q(e, t) {
-	let { tenantOperations: n } = $t(e), r = [];
+async function kn(e, t) {
+	let { tenantOperations: n } = Dn(e), r = [];
 	for (let e = 0;; e++) {
 		let { operations: i } = await n.list({
 			rollout_id: t,
@@ -2137,45 +2739,45 @@ async function Q(e, t) {
 }
 //#endregion
 //#region src/rollouts/advance.ts
-var $ = (e) => {
+var An = (e) => {
 	let t = e.input?.wave;
 	return typeof t == "number" ? t : 0;
-}, tn = (e) => e.status === "failed" || e.status === "cancelled";
-function nn(e, t, n) {
-	let r = t.filter((e) => $(e) === n), i = r.filter(tn).length, a = n === 0 && e.canary > 0, o = a ? 0 : e.failure_threshold;
+}, jn = (e) => e.status === "failed" || e.status === "cancelled";
+function Mn(e, t, n) {
+	let r = t.filter((e) => An(e) === n), i = r.filter(jn).length, a = n === 0 && e.canary > 0, o = a ? 0 : e.failure_threshold;
 	return r.length === 0 || i === 0 || i / r.length <= o ? null : `${a ? "canary" : `wave ${n}`} failed for ${i} of ${r.length} tenant(s)`;
 }
-async function rn(e, t) {
-	let n = Z(e), r = e.now?.() ?? Date.now(), i = typeof t == "string" ? await n.get(t) : t;
+async function Nn(e, t) {
+	let n = $(e), r = e.now?.() ?? Date.now(), i = typeof t == "string" ? await n.get(t) : t;
 	if (!i || i.kind !== "config-sync") return {
 		rolloutId: String(i?.id ?? t),
 		outcome: "skipped",
 		started: 0
 	};
 	let a = i.id;
-	if (!Qt.includes(i.status) || i.status === "paused") return {
+	if (!En.includes(i.status) || i.status === "paused") return {
 		rolloutId: a,
 		outcome: "skipped",
 		started: 0
 	};
-	let o = X(i);
+	let o = Z(i);
 	if (!o.planned) {
 		if (r - Date.parse(i.updated_at) < o.debounce_ms) return {
 			rolloutId: a,
 			outcome: "waiting",
 			started: 0
 		};
-		let { planned: t } = await en(e, i);
+		let { planned: t } = await On(e, i);
 		if (t === 0) return {
 			rolloutId: a,
 			outcome: "planned-empty",
 			started: 0
 		};
-		i = await n.get(a) ?? i, o = X(i);
+		i = await n.get(a) ?? i, o = Z(i);
 	}
-	let s = await Q(e, a), c = s.filter((e) => !j(e.status));
+	let s = await kn(e, a), c = s.filter((e) => !L(e.status));
 	if (c.length === 0) {
-		let e = Math.max(0, ...s.map($)), t = s.length > 0 && e > (o.accepted_through ?? -1) ? nn(o, s, e) : null;
+		let e = Math.max(0, ...s.map(An)), t = s.length > 0 && e > (o.accepted_through ?? -1) ? Mn(o, s, e) : null;
 		return await n.update(a, {
 			status: t ? "failed" : "done",
 			...t ? { paused_reason: t } : {},
@@ -2186,9 +2788,9 @@ async function rn(e, t) {
 			started: 0
 		};
 	}
-	let l = Math.min(...c.map($)), u = l - 1;
+	let l = Math.min(...c.map(An)), u = l - 1;
 	if (u >= 0 && u > (o.accepted_through ?? -1)) {
-		let e = nn(o, s, u);
+		let e = Mn(o, s, u);
 		if (e) return await n.update(a, {
 			status: "paused",
 			paused_reason: e
@@ -2201,7 +2803,7 @@ async function rn(e, t) {
 	}
 	let d = l === 0 ? "canary" : "rolling";
 	i.status !== d && await n.update(a, { status: d });
-	let f = c.filter((e) => $(e) === l), p = f.filter((e) => e.status === "running").length, m = Math.max(0, o.max_concurrent - p), { tenantOperations: h, tenantOperationEvents: g } = $t(e), _ = A({
+	let f = c.filter((e) => An(e) === l), p = f.filter((e) => e.status === "running").length, m = Math.max(0, o.max_concurrent - p), { tenantOperations: h, tenantOperationEvents: g } = Dn(e), _ = I({
 		tenantOperations: h,
 		tenantOperationEvents: g
 	}), v = 0;
@@ -2211,7 +2813,7 @@ async function rn(e, t) {
 		} catch (e) {
 			try {
 				let n = await h.get(t.id);
-				n && !j(n.status) && await _.markFailed(t.id, e);
+				n && !L(n.status) && await _.markFailed(t.id, e);
 			} catch {}
 		}
 		v++;
@@ -2223,8 +2825,8 @@ async function rn(e, t) {
 		wave: l
 	};
 }
-async function an(e, t = {}) {
-	let { rollouts: n } = await Z(e).list({
+async function Pn(e, t = {}) {
+	let { rollouts: n } = await $(e).list({
 		kind: "config-sync",
 		status: [
 			"pending",
@@ -2234,24 +2836,24 @@ async function an(e, t = {}) {
 		per_page: t.limit ?? 20
 	}), r = [];
 	for (let i of n) try {
-		r.push(await rn(e, i));
+		r.push(await Nn(e, i));
 	} catch (e) {
 		t.logger?.warn(`Advancing rollout ${i.id} failed:`, e);
 	}
 	return r;
 }
-async function on(e, t, n = "paused by an operator") {
-	let r = Z(e), i = await r.get(t);
+async function Fn(e, t, n = "paused by an operator") {
+	let r = $(e), i = await r.get(t);
 	return !i || i.kind !== "config-sync" ? null : i.status === "done" || i.status === "failed" ? i : (await r.update(t, {
 		status: "paused",
 		paused_reason: n
 	}), r.get(t));
 }
-async function sn(e, t) {
-	let n = Z(e), r = await n.get(t);
+async function In(e, t) {
+	let n = $(e), r = await n.get(t);
 	if (!r || r.kind !== "config-sync") return null;
 	if (r.status !== "paused") return r;
-	let i = X(r), a = (await Q(e, t)).filter((e) => !j(e.status)), o = a.length > 0 ? Math.min(...a.map($)) : 0;
+	let i = Z(r), a = (await kn(e, t)).filter((e) => !L(e.status)), o = a.length > 0 ? Math.min(...a.map(An)) : 0;
 	return await n.update(t, {
 		status: o === 0 ? "canary" : "rolling",
 		paused_reason: null,
@@ -2262,21 +2864,110 @@ async function sn(e, t) {
 	}), n.get(t);
 }
 //#endregion
+//#region src/rollouts/verify.ts
+var Ln = {
+	added: "missing",
+	changed: "changed",
+	delete: "stale"
+};
+function Rn(e) {
+	return (e.rows ?? e.changes.flatMap((e) => {
+		if (e.startsWith("skip ")) return [];
+		let t = /^delete ([^:\s]+):(.*)$/.exec(e);
+		if (t) return [{
+			entity: t[1],
+			key: t[2],
+			action: "delete"
+		}];
+		let n = /^([^:\s]+):(.*)$/.exec(e);
+		return n ? [{
+			entity: n[1],
+			key: n[2],
+			action: "changed"
+		}] : [];
+	})).flatMap((e) => {
+		let t = Ln[e.action];
+		return t ? [{
+			entity: e.entity,
+			key: e.key,
+			kind: t
+		}] : [];
+	});
+}
+async function zn(e, t) {
+	let n = await e.adapters.tenants.get(t);
+	if (!n) return null;
+	let r = n.config_sync ?? "inherit-on-read", i = {
+		tenant_id: t,
+		config_sync: r,
+		errors: []
+	};
+	if (r === "detached") return {
+		...i,
+		method: "not-applicable",
+		ok: !0,
+		differences: []
+	};
+	if (r === "inherit-on-read") {
+		let n = (await De({
+			adapters: e.adapters,
+			tenantId: t,
+			legacyControlPlane: await Q(e, t),
+			maxDepth: e.maxDepth
+		})).filter((e) => !e.expected).map((e) => ({
+			entity: e.entity,
+			key: e.key,
+			kind: e.kind,
+			...e.fields.length > 0 ? { fields: e.fields } : {}
+		}));
+		return {
+			...i,
+			method: "read-time",
+			ok: n.length === 0,
+			differences: n
+		};
+	}
+	let a = await e.syncConfig(t, {
+		dryRun: !0,
+		force: !1,
+		prune: !1
+	}), o = Rn(a), s = Object.entries(a.entities).filter(([, e]) => e.errors.length > 0).map(([e, t]) => `${e}: the sync dry run reported ${t.errors.length} error(s)`);
+	return {
+		...i,
+		method: "sync-dry-run",
+		ok: o.length === 0 && s.length === 0,
+		differences: o,
+		errors: s.slice(0, 20)
+	};
+}
+//#endregion
 //#region src/rollouts/status.ts
-async function cn(e, t) {
+async function Bn(e, t) {
 	let n = await e.adapters.tenants.get(t);
 	if (!n) return null;
-	let r = n.config_sync === "synced", i = await N({
+	if (n.config_sync === "detached") return {
+		tenant_id: t,
+		parent_tenant_id: null,
+		config_sync: "detached",
+		config_sync_hash: null,
+		config_synced_at: null,
+		expected_hash: null,
+		drifted: !1,
+		chain: [],
+		inherited: {}
+	};
+	let r = n.config_sync === "synced", i = await R({
 		tenantId: t,
 		getTenant: (t) => e.adapters.tenants.get(t),
-		legacyControlPlane: await Xt(e, t),
+		legacyControlPlane: await Q(e, t),
 		maxDepth: e.maxDepth
-	}), a = r ? await Zt(e)(t) : null, o = n.config_sync_hash ?? null, s = {};
+	}), a = r ? await Tn(e)(t) : null, o = n.config_sync_hash ?? null, s = {};
 	for (let n of [...i].reverse()) {
-		let r = await I(e.adapters, n), i = (e, t) => V(e, t) === "shared", a = async (e, r, a) => {
+		let r = await V(e.adapters, n), i = (e, t) => U(e, t) === "shared", a = async (e, r, a) => {
 			for (let o of r) {
-				let r = o.id ?? o.hook_id;
-				r && y(r) || i(a, o) && (s[await W(e, t, G(e, o))] = n);
+				if (!i(a, o)) continue;
+				let r = await it(e, t, W(e, o)), c = o.id ?? o.hook_id;
+				c && x(c) && s[r] || (s[r] = n);
 			}
 		};
 		await a("connection", r.connections, "connection"), await a("resourceServer", r.resourceServers, "resourceServer"), await a("action", r.actions, "action"), await a("hook", r.hooks, "hook"), r.emailProvider && i("emailProvider", r.emailProvider) && (s.emailProvider = n), r.branding && i("branding", r.branding) && (s.branding = n), r.promptSettings && i("promptSettings", r.promptSettings) && (s.promptSettings = n);
@@ -2295,11 +2986,11 @@ async function cn(e, t) {
 }
 //#endregion
 //#region src/rollouts/reconcile.ts
-async function ln(e, n = {}) {
-	let r = Z(e), i = n.rootTenantId ?? e.controlPlaneTenantId, a = n.limit ?? 500, o = await Yt(e.adapters, i, {
-		resolveLegacyParent: (t) => Xt(e, t),
+async function Vn(e, n = {}) {
+	let r = $(e), i = n.rootTenantId ?? e.controlPlaneTenantId, a = n.limit ?? 500, o = await wn(e.adapters, i, {
+		resolveLegacyParent: (t) => Q(e, t),
 		maxDepth: e.maxDepth
-	}), s = Zt(e), c = [];
+	}), s = Tn(e), c = [];
 	for (let e of o) {
 		if (c.length >= a) break;
 		try {
@@ -2322,10 +3013,10 @@ async function ln(e, n = {}) {
 	if (c.length === 0) return l;
 	let u = /* @__PURE__ */ new Set(), { rollouts: d } = await r.list({
 		kind: "config-sync",
-		status: [...Qt],
+		status: [...En],
 		per_page: 100
 	});
-	for (let t of d) for (let n of await Q(e, t.id)) n.tenant_id && !j(n.status) && u.add(n.tenant_id);
+	for (let t of d) for (let n of await kn(e, t.id)) n.tenant_id && !L(n.status) && u.add(n.tenant_id);
 	for (let r of c) try {
 		await e.adapters.logs.create(r.tenantId, {
 			type: t.CONFIG_DRIFT,
@@ -2345,7 +3036,7 @@ async function ln(e, n = {}) {
 	}
 	let f = c.filter((e) => !u.has(e.tenantId));
 	l.alreadyCovered = c.length - f.length;
-	let { tenantOperations: p } = $t(e), m = e.now?.() ?? Date.now(), h = n.retryAfterMs ?? 36e5, g = [];
+	let { tenantOperations: p } = Dn(e), m = e.now?.() ?? Date.now(), h = n.retryAfterMs ?? 36e5, g = [];
 	for (let e of f) {
 		try {
 			let { operations: t } = await p.list({
@@ -2367,33 +3058,33 @@ async function ln(e, n = {}) {
 		kind: "config-sync",
 		initiated_by: "reconcile",
 		config: {
-			...Y,
+			...X,
 			trigger: "reconcile",
 			root_tenant_id: i,
 			planned: !1
 		}
 	});
-	return await en(e, _, { tenantIds: g.map((e) => e.tenantId) }), l.rolloutId = _.id, l;
+	return await On(e, _, { tenantIds: g.map((e) => e.tenantId) }), l.rolloutId = _.id, l;
 }
 //#endregion
 //#region src/rollouts/trigger.ts
-function un(e, t) {
-	return e === "hookCode" ? !0 : !t || typeof t != "object" ? !1 : V(e, t) !== "local";
+function Hn(e, t) {
+	return e === "hookCode" ? !0 : !t || typeof t != "object" ? !1 : U(e, t) !== "local";
 }
-async function dn(e, t, n) {
-	let r = Z(e), { rollouts: i } = await r.list({
+async function Un(e, t, n) {
+	let r = $(e), { rollouts: i } = await r.list({
 		kind: "config-sync",
 		status: "pending",
 		per_page: 100
 	}), a = i.find((e) => {
-		let n = X(e);
+		let n = Z(e);
 		return n.trigger === "write" && n.planned !== !0 && n.origin_tenant_id === t;
 	});
 	return a ? (await r.update(a.id, {}), await r.get(a.id) ?? a) : r.create({
 		kind: "config-sync",
 		initiated_by: n ?? `write:${t}`,
 		config: {
-			...Y,
+			...X,
 			trigger: "write",
 			root_tenant_id: t,
 			origin_tenant_id: t,
@@ -2401,7 +3092,7 @@ async function dn(e, t, n) {
 		}
 	});
 }
-async function fn(e, t) {
+async function Wn(e, t) {
 	if (t === e.controlPlaneTenantId) return !0;
 	try {
 		let { tenants: n } = await e.adapters.tenants.list({
@@ -2413,19 +3104,19 @@ async function fn(e, t) {
 		return !0;
 	}
 }
-function pn(e, t = {}) {
+function Gn(e, t = {}) {
 	let n = async (n) => {
 		try {
-			await fn(e, n) && await dn(e, n);
+			await Wn(e, n) && await Un(e, n);
 		} catch (e) {
 			t.logger?.warn(`Could not record a config change for ${n}:`, e);
 		}
 	}, r = (e) => ({
 		afterCreate: async (t, r) => {
-			un(e, r) && await n(t.tenantId);
+			Hn(e, r) && await n(t.tenantId);
 		},
 		afterUpdate: async (t, r, i) => {
-			un(e, i) && await n(t.tenantId);
+			Hn(e, i) && await n(t.tenantId);
 		},
 		afterDelete: async (e) => n(e.tenantId)
 	});
@@ -2439,79 +3130,89 @@ function pn(e, t = {}) {
 }
 //#endregion
 //#region src/rollouts/controller.ts
-function mn(e) {
+function Kn(e) {
 	return {
 		async create(t) {
 			let n = {
-				...Y,
-				waves: t.waves ?? [...Y.waves],
-				canary: t.canary ?? Y.canary,
-				failure_threshold: t.failureThreshold ?? Y.failure_threshold,
-				max_concurrent: t.maxConcurrent ?? Y.max_concurrent,
+				...X,
+				waves: t.waves ?? [...X.waves],
+				canary: t.canary ?? X.canary,
+				failure_threshold: t.failureThreshold ?? X.failure_threshold,
+				max_concurrent: t.maxConcurrent ?? X.max_concurrent,
 				trigger: "manual",
 				root_tenant_id: t.rootTenantId ?? e.controlPlaneTenantId,
 				dry_run: t.dryRun,
 				force: t.force,
 				planned: !1
-			}, r = Z(e), i = await r.create({
+			}, r = $(e), i = await r.create({
 				kind: "config-sync",
 				initiated_by: t.initiatedBy,
 				config: n
 			});
-			return await en(e, i, { tenantIds: t.tenantIds }), await rn(e, i.id), await r.get(i.id) ?? i;
+			return await On(e, i, { tenantIds: t.tenantIds }), await Nn(e, i.id), await r.get(i.id) ?? i;
 		},
-		pause: (t, n) => on(e, t, n),
-		resume: (t) => sn(e, t)
+		pause: (t, n) => Fn(e, t, n),
+		resume: (t) => In(e, t)
 	};
 }
 //#endregion
 //#region src/init.ts
-function hn(e) {
-	let { dataAdapter: t, controlPlane: n, controlPlane: { tenantId: r = "control_plane", clientId: i } = {}, resolveControlPlane: a, inheritanceShadow: o, syncDefaults: s, rolloutExecutor: c, sync: l = {
+function qn(e) {
+	let { dataAdapter: t, controlPlane: n, controlPlane: { tenantId: r = "control_plane", clientId: i } = {}, resolveControlPlane: a, inheritanceShadow: o, syncDefaults: s, detachTenant: c, tenantMemberRequests: l, rolloutExecutor: u, sync: d = {
 		resourceServers: !0,
 		roles: !0
-	}, defaultPermissions: u = ["tenant:admin"], requireOrganizationMatch: d = !1, managementApiExtensions: f = [], entityHooks: p, getChildTenantIds: h, getAdapters: g, ...v } = e;
+	}, defaultPermissions: f = ["tenant:admin"], requireOrganizationMatch: p = !1, managementApiExtensions: m = [], entityHooks: h, getChildTenantIds: _, getAdapters: v, ...b } = e;
 	if (a && !n) throw Error("initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it.");
-	let y = t, b = t, ee;
+	let x = t, S = t, C;
 	if (n) {
-		let e = Pe({
+		let n = Me({
 			base: Re({
 				controlPlaneTenantId: r,
 				controlPlaneClientId: i,
 				resolveControlPlane: a
 			}),
 			getTenant: async (e) => await t.tenants.get(e) ?? null,
-			controlPlaneTenantId: r
+			controlPlaneTenantId: r,
+			ttlMs: e.configSyncCacheTtlMs
 		});
-		ee = (t) => e.invalidate(t), y = Ue(t, {
+		C = (e) => n.invalidate(e), x = We(t, {
 			controlPlaneTenantId: r,
 			controlPlaneClientId: i,
 			resolveControlPlane: a,
 			inheritanceShadow: o,
-			configSync: e
-		}), b = {
+			configSync: n
+		}), S = {
 			...Be(t, {
 				controlPlaneTenantId: r,
-				resolveControlPlane: e.resolve
+				resolveControlPlane: n.resolve
 			}),
 			multiTenancyConfig: {
 				controlPlaneTenantId: r,
 				controlPlaneClientId: i,
-				resolveControlPlane: e.resolve
+				resolveControlPlane: n.resolve
 			}
 		};
 	}
-	let te = v.tenantOperationExecutor, x;
+	let w = b.tenantOperationExecutor, T, E;
 	if (t.tenantOperations && t.tenantOperationEvents) {
 		let e = {
 			tenantOperations: t.tenantOperations,
 			tenantOperationEvents: t.tenantOperationEvents
-		}, n = v.tenantUpgrade, i = A(e), o = s ?? ft(t, {
+		}, n = b.tenantUpgrade, i = I(e), o = s ?? xt(t, {
 			controlPlaneTenantId: r,
 			resolveControlPlane: a
-		}), c = le({
+		}), u = c ?? Mt(t), d = l ? l.store ?? Ft(t) : void 0, f = oe({
 			stores: e,
 			definitions: {
+				detach: (e) => [{
+					name: "detach",
+					run: () => Dt({
+						operation: e,
+						detachTenant: u,
+						recorder: i,
+						onDetached: (e) => C?.(e)
+					})
+				}],
 				...n ? { upgrade: (e) => [{
 					name: "upgrade",
 					async run() {
@@ -2521,113 +3222,157 @@ function hn(e) {
 				}] } : {},
 				"sync-defaults": (e) => [{
 					name: "sync-defaults",
-					run: () => dt({
+					run: () => bt({
 						operation: e,
 						syncConfig: o,
 						recorder: i
 					})
-				}]
+				}],
+				...d && l ? { "tenant-members-request": (e) => [{
+					name: "tenant-members-request",
+					run: () => Rt({
+						operation: e,
+						store: d,
+						getBackend: l.getBackend,
+						recorder: i,
+						executeOptions: { isRequesterAllowed: l.isRequesterAllowed }
+					})
+				}] } : {}
 			}
 		});
-		x = c, te ??= {
-			engine: c.engine,
-			kinds: n ? ["upgrade", "sync-defaults"] : ["sync-defaults"],
-			enqueue: (t) => ue(e, c, {
+		if (T = f, d) {
+			let n = {
+				stores: e,
+				executor: f
+			};
+			E = {
+				enqueue: (e, t) => Bt(n, e, t),
+				reconcile: (e = {}) => Vt({
+					...n,
+					store: d,
+					tenantIds: e.tenantIds ?? (async () => (await g((e) => t.tenants.list(e), "tenants", {
+						cursorField: "id",
+						pageSize: 100
+					})).map((e) => e.id).filter((e) => e !== r)),
+					graceMs: e.graceMs,
+					maxAttempts: e.maxAttempts
+				})
+			};
+		}
+		w ??= {
+			engine: f.engine,
+			kinds: n ? [
+				"upgrade",
+				"sync-defaults",
+				"detach"
+			] : ["sync-defaults", "detach"],
+			enqueue: (t) => ce(e, f, {
 				...t,
 				tenant_id: t.tenant_id
-			}, { returnFailed: t.kind === "sync-defaults" })
+			}, { returnFailed: t.kind === "sync-defaults" || t.kind === "detach" })
 		};
 	}
-	let S = c ?? x, C = S && t.rollouts && t.tenantOperations && t.tenantOperationEvents ? {
+	if (l && !E) throw Error("initMultiTenant: `tenantMemberRequests` requires the `tenantOperations` and `tenantOperationEvents` adapters on the data adapter, which run the `tenant-members-request` operation.");
+	let D = u ?? T, O = D && t.rollouts && t.tenantOperations && t.tenantOperationEvents ? {
 		adapters: t,
-		executor: S,
+		executor: D,
 		controlPlaneTenantId: r,
 		resolveControlPlane: a
-	} : void 0, w = C ? mn(C) : void 0, T = C ? pn(C, { logger: console }) : void 0, E = l !== !1, D = E ? {
-		resourceServers: l.resourceServers ?? !0,
-		roles: l.roles ?? !0
+	} : void 0, k = O ? Kn(O) : void 0, A = O ? Gn(O, { logger: console }) : void 0, j = d !== !1, ee = j ? {
+		resourceServers: d.resourceServers ?? !0,
+		roles: d.roles ?? !0
 	} : {
 		resourceServers: !1,
 		roles: !1
-	}, { entityHooks: ne, tenantHooks: O } = Tt({
+	}, { entityHooks: M, tenantHooks: N } = Qt({
 		controlPlaneTenantId: r,
-		getChildTenantIds: h ?? (async () => (await m((e) => y.tenants.list(e), "tenants", {
+		getChildTenantIds: _ ?? (async () => (await g((e) => x.tenants.list(e), "tenants", {
 			cursorField: "id",
 			pageSize: 100
 		})).filter((e) => e.id !== r).map((e) => e.id)),
-		getAdapters: g ?? (async () => y),
-		getControlPlaneAdapters: async () => y,
-		sync: D
-	}), re = {
+		getAdapters: v ?? (async () => x),
+		getControlPlaneAdapters: async () => x,
+		sync: ee
+	}), te = {
 		resourceServers: [
-			ne.resourceServers,
-			T?.resourceServers,
-			...p?.resourceServers ?? []
+			M.resourceServers,
+			A?.resourceServers,
+			...h?.resourceServers ?? []
 		],
-		roles: [ne.roles, ...p?.roles ?? []],
-		connections: [T?.connections, ...p?.connections ?? []],
-		tenants: p?.tenants ?? [],
-		rolePermissions: p?.rolePermissions ?? [],
-		actions: [T?.actions, ...p?.actions ?? []],
-		hooks: [T?.hooks, ...p?.hooks ?? []],
-		hookCode: [T?.hookCode, ...p?.hookCode ?? []]
-	}, k = gt({ accessControl: {
+		roles: [M.roles, ...h?.roles ?? []],
+		connections: [A?.connections, ...h?.connections ?? []],
+		tenants: h?.tenants ?? [],
+		rolePermissions: h?.rolePermissions ?? [],
+		actions: [A?.actions, ...h?.actions ?? []],
+		hooks: [A?.hooks, ...h?.hooks ?? []],
+		hookCode: [A?.hookCode, ...h?.hookCode ?? []]
+	}, P = Ut({ accessControl: {
 		controlPlaneTenantId: r,
-		requireOrganizationMatch: d,
-		defaultPermissions: u
-	} }), ie = At({
+		requireOrganizationMatch: p,
+		defaultPermissions: f
+	} }), ne = an({
 		accessControl: {
 			controlPlaneTenantId: r,
-			requireOrganizationMatch: d,
-			defaultPermissions: u
+			requireOrganizationMatch: p,
+			defaultPermissions: f
 		},
-		onConfigSyncChange: (e) => ee?.(e),
-		configSyncStatus: (e) => cn({
+		onConfigSyncChange: (e) => C?.(e),
+		configSyncStatus: (e) => Bn({
 			adapters: t,
 			controlPlaneTenantId: r,
 			resolveControlPlane: a
+		}, e),
+		verifyConfigSync: (e) => zn({
+			adapters: t,
+			controlPlaneTenantId: r,
+			resolveControlPlane: a,
+			syncConfig: s ?? xt(t, {
+				controlPlaneTenantId: r,
+				resolveControlPlane: a
+			})
 		}, e)
 	}, { tenants: {
 		async beforeCreate(e, t) {
-			return k.beforeCreate && (t = await k.beforeCreate(e, t)), O.beforeCreate && (t = await O.beforeCreate(e, t)), t;
+			return P.beforeCreate && (t = await P.beforeCreate(e, t)), N.beforeCreate && (t = await N.beforeCreate(e, t)), t;
 		},
 		async afterCreate(e, t) {
-			await k.afterCreate?.(e, t), await O.afterCreate?.(e, t);
+			await P.afterCreate?.(e, t), await N.afterCreate?.(e, t);
 		},
 		async beforeDelete(e, t) {
-			await k.beforeDelete?.(e, t), await O.beforeDelete?.(e, t);
-		}
-	} }), { app: ae } = _({
-		dataAdapter: y,
-		managementDataAdapter: b,
-		...v,
-		tenantOperationExecutor: te,
-		...w ? { rolloutController: w } : {},
-		entityHooks: re,
-		managementApiExtensions: [...f, {
+			await P.beforeDelete?.(e, t), await N.beforeDelete?.(e, t);
+		}
+	} }), { app: re } = y({
+		dataAdapter: x,
+		managementDataAdapter: S,
+		...b,
+		tenantOperationExecutor: w,
+		...k ? { rolloutController: k } : {},
+		entityHooks: te,
+		managementApiExtensions: [...m, {
 			path: "/tenants",
-			router: ie
+			router: ne
 		}],
-		managementApiMiddleware: [...v.managementApiMiddleware ?? [], ...E ? [Vt()] : []]
+		managementApiMiddleware: [...b.managementApiMiddleware ?? [], ...j ? [gn()] : []]
 	});
 	return {
-		app: ae,
+		app: re,
 		controlPlaneTenantId: r,
-		rollouts: C
+		rollouts: O,
+		memberRequests: E
 	};
 }
 //#endregion
 //#region src/rollout/payload.ts
-function gn(e) {
+function Jn(e) {
 	let { pkcs7: t, tenant_id: n, ...r } = e;
 	return r;
 }
-async function _n(e, t, n = {}, r) {
-	let i = he(n), a = n.signingKeys ?? !0, o = n.tenants ?? !0, s = await ve(e, t, i), c = a ? (await b(e.keys)).map(gn) : [], l = o ? await vn(e, t, r) : [];
+async function Yn(e, t, n = {}, r) {
+	let i = pe(n), a = n.signingKeys ?? !0, o = n.tenants ?? !0, s = await ge(e, t, i), c = a ? (await S(e.keys)).map(Jn) : [], l = o ? await Xn(e, t, r) : [];
 	return {
 		connections: s.connections,
 		resourceServers: s.resourceServers.filter((e) => e.is_system),
-		hooks: s.hooks.filter(_e),
+		hooks: s.hooks.filter(he),
 		emailProvider: s.emailProvider,
 		branding: s.branding,
 		promptSettings: s.promptSettings,
@@ -2635,7 +3380,7 @@ async function _n(e, t, n = {}, r) {
 		tenants: l
 	};
 }
-async function vn(e, t, n) {
+async function Xn(e, t, n) {
 	let r = n && n !== t ? [t, n] : [t], i = [];
 	for (let t of r) {
 		let n = await e.tenants.get(t);
@@ -2646,19 +3391,19 @@ async function vn(e, t, n) {
 	}
 	return i;
 }
-async function yn(e, t, n) {
-	let r = P();
+async function Zn(e, t, n) {
+	let r = z();
 	if (e.length === 0) return r;
-	let i = await b(t.keys), a = new Set(i.map((e) => e.kid));
-	for (let i of e) await F(r, `signing_key ${i.kid}`, n, async () => {
-		let e = gn(i);
+	let i = await S(t.keys), a = new Set(i.map((e) => e.kid));
+	for (let i of e) await B(r, `signing_key ${i.kid}`, n, async () => {
+		let e = Jn(i);
 		a.has(e.kid) || (await t.keys.create(e), a.add(e.kid), r.upserted += 1);
 	});
 	return r;
 }
-async function bn(e, t, n) {
-	let r = P();
-	for (let i of e) await F(r, `tenant ${i.id}`, n, async () => {
+async function Qn(e, t, n) {
+	let r = z();
+	for (let i of e) await B(r, `tenant ${i.id}`, n, async () => {
 		await t.tenants.get(i.id) || (await t.tenants.create({
 			id: i.id,
 			friendly_name: i.friendly_name
@@ -2666,50 +3411,50 @@ async function bn(e, t, n) {
 	});
 	return r;
 }
-async function xn(e, t, n, r = {}) {
-	let i = r.continueOnError ?? !1, a = he(r.entities), s = r.entities?.signingKeys ?? !0, c = r.entities?.tenants ?? !0, l = {
+async function $n(e, t, n, r = {}) {
+	let i = r.continueOnError ?? !1, a = pe(r.entities), o = r.entities?.signingKeys ?? !0, c = r.entities?.tenants ?? !0, l = {
 		connections: e.connections,
 		resourceServers: e.resourceServers,
 		hooks: e.hooks,
-		emailProvider: e.emailProvider ? f.parse(e.emailProvider) : null,
-		branding: e.branding ? o.parse(e.branding) : null,
-		promptSettings: e.promptSettings ? ee.parse(e.promptSettings) : null
-	}, u = c ? await bn(e.tenants ?? [], t, i) : P(), d = ge(n);
-	await ye(l, t, n, a, i, d);
-	let p = s ? await yn(e.signingKeys, t, i) : P(), m = e.resolved && r.resolved ? await at(e.resolved, t, r.resolved.tenantId, {
+		emailProvider: e.emailProvider ? p.parse(e.emailProvider) : null,
+		branding: e.branding ? s.parse(e.branding) : null,
+		promptSettings: e.promptSettings ? C.parse(e.promptSettings) : null
+	}, u = c ? await Qn(e.tenants ?? [], t, i) : z(), d = me(n);
+	await _e(l, t, n, a, i, d);
+	let f = o ? await Zn(e.signingKeys, t, i) : z(), m = e.resolved && r.resolved ? await ut(e.resolved, t, r.resolved.tenantId, {
 		continueOnError: i,
 		...r.resolved
 	}) : void 0;
 	return {
 		...d,
-		signingKeys: p,
+		signingKeys: f,
 		tenants: u,
 		...m ? { resolved: m } : {}
 	};
 }
 //#endregion
 //#region src/rollout/index.ts
-function Sn(e) {
+function er(e) {
 	return {
-		syncDefaults: (t) => be(e, t),
+		syncDefaults: (t) => ve(e, t),
 		syncDefaultsToTenants: async (t) => {
 			let n = [];
-			for (let r of t) n.push(await be(e, r));
+			for (let r of t) n.push(await ve(e, r));
 			return n;
 		}
 	};
 }
 //#endregion
 //#region src/plugin.ts
-function Cn(e) {
-	let t = wn(e);
+function tr(e) {
+	let t = nr(e);
 	return {
 		name: "multi-tenancy",
-		middleware: Kt(e),
+		middleware: xn(e),
 		hooks: t,
 		routes: [{
 			path: "/management",
-			handler: At(e, t)
+			handler: an(e, t)
 		}],
 		onRegister: async () => {
 			console.log("Multi-tenancy plugin registered"), e.accessControl && console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`), e.subdomainRouting && console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`), e.databaseIsolation && console.log("  - Database isolation enabled");
@@ -2718,29 +3463,29 @@ function Cn(e) {
 }
 //#endregion
 //#region src/index.ts
-function wn(e) {
-	let t = e.accessControl ? ne(e.accessControl) : {}, n = e.databaseIsolation ? re(e.databaseIsolation) : {}, r = gt(e);
+function nr(e) {
+	let t = e.accessControl ? M(e.accessControl) : {}, n = e.databaseIsolation ? te(e.databaseIsolation) : {}, r = Ut(e);
 	return {
 		...t,
 		...n,
 		tenants: r
 	};
 }
-function Tn(t) {
-	let n = new e(), r = wn(t);
-	return n.route("/tenants", At(t, r)), n;
+function rr(t) {
+	let n = new e(), r = nr(t);
+	return n.route("/tenants", an(t, r)), n;
 }
-function En(e) {
+function ir(e) {
 	return {
-		hooks: wn(e),
-		middleware: Kt(e),
-		app: Tn(e),
+		hooks: nr(e),
+		middleware: xn(e),
+		app: rr(e),
 		config: e,
-		wrapAdapters: (t, n) => Ue(t, {
+		wrapAdapters: (t, n) => We(t, {
 			controlPlaneTenantId: e.accessControl?.controlPlaneTenantId,
 			controlPlaneClientId: n?.controlPlaneClientId
 		})
 	};
 }
 //#endregion
-export { Y as DEFAULT_ROLLOUT_SETTINGS, qt as DEFAULT_ROLLOUT_WAVES, rn as advanceRollout, an as advanceRollouts, xn as applyControlPlaneDefaultsPayload, at as applyResolvedConfigBlock, Jt as assignWaves, _n as buildControlPlaneDefaultsPayload, ae as buildEngineInstanceId, et as buildResolvedConfigBlock, ke as compareShadow, me as computeLegacyConfig, ne as createAccessControlHooks, Ut as createAccessControlMiddleware, Pe as createConfigSyncResolver, Ht as createControlPlaneTenantMiddleware, re as createDatabaseHooks, Gt as createDatabaseMiddleware, Sn as createDirectRolloutAdapter, Zt as createExpectedHash, ft as createInProcessSyncConfig, le as createInlineExecutor, Tn as createMultiTenancy, wn as createMultiTenancyHooks, Kt as createMultiTenancyMiddleware, Cn as createMultiTenancyPlugin, A as createOperationRecorder, M as createOperationRow, Vt as createProtectSyncedMiddleware, gt as createProvisioningHooks, mn as createRolloutController, pn as createRolloutWriteHooks, Ve as createRuntimeFallbackAdapter, Me as createShadowReporter, Wt as createSubdomainMiddleware, Tt as createSyncHooks, At as createTenantsOpenAPIRouter, Oe as diffConfig, H as effectiveOverride, V as effectiveScope, ue as enqueueTenantOperation, se as errorToMessage, rt as findUndecryptableKeyIds, cn as getConfigSyncStatus, hn as initMultiTenant, ce as inlineStepRunner, un as isPublishedRow, j as isTerminalStatus, Q as listRolloutOperations, Yt as listSyncedDescendants, Le as mergeClientWithFallback, Ze as mergeConfig, on as pauseRollout, en as planRollout, be as projectControlPlaneDefaults, I as readConfigRows, X as readRolloutConfig, ln as reconcileConfigDrift, dn as requestRollout, N as resolveTenantChain, sn as resumeRollout, mt as runRecordedTenantOperation, dt as runSyncDefaultsStep, En as setupMultiTenancy, ut as summarizeSyncResult, lt as syncErrors, ct as syncOptionsOf, W as syncedRowId, O as validateTenantAccess, Ue as withRuntimeFallback, Be as withSystemResourceServerInheritance };
+export { X as DEFAULT_ROLLOUT_SETTINGS, Sn as DEFAULT_ROLLOUT_WAVES, zt as MAX_MEMBER_REQUEST_ATTEMPTS, Nn as advanceRollout, Pn as advanceRollouts, $n as applyControlPlaneDefaultsPayload, ut as applyResolvedConfigBlock, kt as assertDetachEligible, Cn as assignWaves, Yn as buildControlPlaneDefaultsPayload, re as buildEngineInstanceId, at as buildResolvedConfigBlock, De as compareShadow, fe as computeLegacyConfig, M as createAccessControlHooks, vn as createAccessControlMiddleware, Me as createConfigSyncResolver, _n as createControlPlaneTenantMiddleware, te as createDatabaseHooks, bn as createDatabaseMiddleware, er as createDirectRolloutAdapter, Tn as createExpectedHash, Mt as createInProcessDetach, Ft as createInProcessMemberRequestStore, xt as createInProcessSyncConfig, oe as createInlineExecutor, rr as createMultiTenancy, nr as createMultiTenancyHooks, xn as createMultiTenancyMiddleware, tr as createMultiTenancyPlugin, I as createOperationRecorder, se as createOperationRow, gn as createProtectSyncedMiddleware, Ut as createProvisioningHooks, Kn as createRolloutController, Gn as createRolloutWriteHooks, Ve as createRuntimeFallbackAdapter, Ae as createShadowReporter, yn as createSubdomainMiddleware, Qt as createSyncHooks, an as createTenantsOpenAPIRouter, Tt as detachErrors, St as detachOptionsOf, jt as detachTenantRows, Ee as diffConfig, Ke as effectiveOverride, U as effectiveScope, Ot as emptyDetachResult, Bt as enqueueTenantMemberRequest, ce as enqueueTenantOperation, F as errorToMessage, ct as findUndecryptableKeyIds, Bn as getConfigSyncStatus, qn as initMultiTenant, ae as inlineStepRunner, Hn as isPublishedRow, L as isTerminalStatus, kn as listRolloutOperations, wn as listSyncedDescendants, At as markTenantDetached, It as memberRequestIdOf, Le as mergeClientWithFallback, $e as mergeConfig, Fn as pauseRollout, On as planRollout, ve as projectControlPlaneDefaults, V as readConfigRows, Z as readRolloutConfig, Vn as reconcileConfigDrift, Vt as reconcileTenantMemberRequests, Un as requestRollout, R as resolveTenantChain, In as resumeRollout, Dt as runDetachStep, Pt as runRecordedTenantOperation, bt as runSyncDefaultsStep, Rt as runTenantMembersRequestStep, ir as setupMultiTenancy, Et as summarizeDetachResult, yt as summarizeSyncResult, gt as syncErrors, ht as syncOptionsOf, it as syncedRowId, N as validateTenantAccess, zn as verifyTenantConfig, We as withRuntimeFallback, Be as withSystemResourceServerInheritance };