@twin.org/node-core 0.0.3-next.51 → 0.0.3-next.53

package/dist/types/commands/removeTenantOrgAlias.d.ts

@@ -0,0 +1,22 @@
+import type { IEngineCore } from "@twin.org/engine-models";
+import type { ICliCommandDefinition } from "../models/ICliCommandDefinition.js";
+import type { INodeEnvironmentVariables } from "../models/INodeEnvironmentVariables.js";
+/**
+ * Get the command definition parameters.
+ * @param commandDefinitions The registered command definitions.
+ */
+export declare function getCommandDefinitionRemoveTenantOrgAlias(commandDefinitions: {
+    [id: string]: ICliCommandDefinition;
+}): void;
+/**
+ * Command for removing an alias from the tenant organization ID legacy list.
+ * @param engineCore The engine core.
+ * @param envVars The environment variables for the node.
+ * @param params The parameters for the command.
+ * @param params.tenantId The tenant ID to update.
+ * @param params.alias The alias to remove from the legacy list.
+ */
+export declare function removeTenantOrgAlias(engineCore: IEngineCore, envVars: INodeEnvironmentVariables, params: {
+    tenantId?: string;
+    alias?: string;
+}): Promise<void>;

package/dist/types/commands/setNodeOrgId.d.ts

@@ -0,0 +1,22 @@
+import type { IEngineCore } from "@twin.org/engine-models";
+import type { ICliCommandDefinition } from "../models/ICliCommandDefinition.js";
+import type { INodeEngineConfig } from "../models/INodeEngineConfig.js";
+import type { INodeEngineState } from "../models/INodeEngineState.js";
+import type { INodeEnvironmentVariables } from "../models/INodeEnvironmentVariables.js";
+/**
+ * Get the command definition parameters.
+ * @param commandDefinitions The registered command definitions.
+ */
+export declare function getCommandDefinitionSetNodeOrgId(commandDefinitions: {
+    [id: string]: ICliCommandDefinition;
+}): void;
+/**
+ * Command for setting the node organization ID.
+ * @param engineCore The engine core.
+ * @param envVars The environment variables for the node.
+ * @param params The parameters for the command.
+ * @param params.organizationId The organization ID to set.
+ */
+export declare function setNodeOrgId(engineCore: IEngineCore<INodeEngineConfig, INodeEngineState>, envVars: INodeEnvironmentVariables, params: {
+    organizationId?: string;
+}): Promise<void>;

package/dist/types/commands/setTenantOrgId.d.ts

@@ -0,0 +1,55 @@
+import type { ITenantAdminComponent } from "@twin.org/api-models";
+import type { IEngineCore } from "@twin.org/engine-models";
+import type { ICliCommandDefinition } from "../models/ICliCommandDefinition.js";
+import type { INodeEnvironmentVariables } from "../models/INodeEnvironmentVariables.js";
+/**
+ * Get the command definition parameters.
+ * @param commandDefinitions The registered command definitions.
+ */
+export declare function getCommandDefinitionSetTenantOrgId(commandDefinitions: {
+    [id: string]: ICliCommandDefinition;
+}): void;
+/**
+ * Command for setting the organization ID on a tenant.
+ * @param engineCore The engine core.
+ * @param envVars The environment variables for the node.
+ * @param params The parameters for the command.
+ * @param params.tenantId The tenant ID to update.
+ * @param params.organizationId The organization ID to set.
+ */
+export declare function setTenantOrgId(engineCore: IEngineCore, envVars: INodeEnvironmentVariables, params: {
+    tenantId?: string;
+    organizationId?: string;
+}): Promise<void>;
+/**
+ * Assert that no other tenant already holds the given organization ID.
+ * @param tenantAdminComponent The tenant admin component to query.
+ * @param newOrganizationId The organization DID to check.
+ * @param excludeTenantId When set, the tenant with this ID is excluded from the check (used when updating an existing tenant).
+ */
+export declare function assertOrganizationIdUnique(tenantAdminComponent: ITenantAdminComponent, newOrganizationId: string, excludeTenantId?: string): Promise<void>;
+/**
+ * Look up the tenant admin component, apply a new organization ID (moving the existing value to the
+ * legacy list), and save. Optionally wraps the operation with a CLI section header and done marker.
+ * @param engineCore The engine core used to look up the tenantAdminComponent.
+ * @param tenantId The ID of the tenant to update.
+ * @param newOrganizationId The new organization DID to set.
+ * @param options Optional display and behaviour overrides.
+ * @param options.sectionLabel When set, emits CLIDisplay.break+section before and CLIDisplay.done after.
+ * @param options.required When false, returns silently when the component is not registered (default true).
+ */
+export declare function applyOrganizationIdToTenant(engineCore: IEngineCore, tenantId: string, newOrganizationId: string, options?: {
+    sectionLabel?: string;
+    required?: boolean;
+}): Promise<void>;
+/**
+ * Update an organization ID, moving the current value to the legacy list.
+ * @param currentId The current organization ID.
+ * @param legacyIds The current list of legacy organization IDs.
+ * @param newId The new organization ID to set.
+ * @returns The updated id and legacy list.
+ */
+export declare function updateLegacyOrganizationId(currentId: string | undefined, legacyIds: string[] | undefined, newId: string): {
+    id: string;
+    legacy: string[];
+};

package/dist/types/commands/tenantCreate.d.ts

@@ -15,6 +15,7 @@ export declare function getCommandDefinitionTenantCreate(commandDefinitions: {
  * @param params The parameters for the command.
  * @param params.apiKey The api key to add.
  * @param params.tenantId The tenant ID to add the api key to.
+ * @param params.organizationId The organization DID to associate with the tenant.
  * @param params.label The label for the api key.
  * @param params.publicOrigin The public URL origin for the tenant.
  * @param params.outputJson The output .json file to store the command output.
@@ -25,6 +26,7 @@ export declare function getCommandDefinitionTenantCreate(commandDefinitions: {
 export declare function tenantCreate(engineCore: IEngineCore, envVars: INodeEnvironmentVariables, params: {
     apiKey?: string;
     tenantId?: string;
+    organizationId?: string;
     label?: string;
     publicOrigin?: string;
     outputJson?: string;
@@ -33,6 +35,7 @@ export declare function tenantCreate(engineCore: IEngineCore, envVars: INodeEnvi
 }): Promise<{
     apiKey: string;
     tenantId: string;
+    organizationId?: string;
     label: string;
     publicOrigin: string;
 }>;

package/dist/types/defaults.d.ts

@@ -3,7 +3,6 @@ export declare const IMMUTABLE_PROOF_VERIFICATION_METHOD_ID = "immutable-proof-a
 export declare const BLOB_STORAGE_ENCRYPTION_KEY_ID = "blob-encryption";
 export declare const TRUST_VERIFICATION_METHOD_ID = "trust-assertion";
 export declare const AUTH_SIGNING_KEY_ID = "auth-signing";
-export declare const URL_TRANSFORMER_ENCRYPTION_KEY_ID = "param-encryption";
 export declare const CONTEXT_ID_HANDLER_FEATURE_DID = "did";
 export declare const CONTEXT_ID_HANDLER_FEATURE_TENANT = "tenant";
 /**

package/dist/types/models/ICliCommandDefinition.d.ts

@@ -38,4 +38,9 @@ export interface ICliCommandDefinition {
      * @default true
      */
     requiresNodeIdentity?: boolean;
+    /**
+     * Indicates whether the engine needs the organization identity to be set.
+     * @default true
+     */
+    requiresOrgIdentity?: boolean;
 }

package/dist/types/models/IEngineEnvironmentVariables.d.ts

@@ -288,6 +288,10 @@ export interface IEngineEnvironmentVariables {
      * The batch flush interval in seconds for the logging task, how often to flush the logs when using batching, defaults to 5 seconds.
      */
     loggingBatchFlushIntervalSeconds?: string;
+    /**
+     * A list of components to exclude from logging, can be a comma separated list of component Class names e.g. "ComponentA,ComponentB".
+     */
+    loggingSilentComponents?: string;
     /**
      * The type of event bus connector: local.
      */
@@ -464,6 +468,10 @@ export interface IEngineEnvironmentVariables {
      * The type of the default data extractor, can be a comma separated list: json-path.
      */
     dataExtractorConnectors?: string;
+    /**
+     * Enable the task scheduler regardless of which other components are active, defaults to false.
+     */
+    taskSchedulerEnabled?: string;
     /**
      * Is the auditable item graph enabled, defaults to false.
      */
@@ -587,10 +595,6 @@ export interface IEngineEnvironmentVariables {
      * This allows components that take a long time to initialize to be healthy before the first health check is performed.
      */
     healthStartupIntervalSeconds?: string;
-    /**
-     * The id of the key in the vault to use for encrypting parameters in url transformer.
-     */
-    urlTransformerEncryptionKeyId?: string;
     /**
      * The type of the automation action to create, comma separate for more than one connector.
      * values: fetch

package/dist/types/models/INodeEngineState.d.ts

@@ -7,4 +7,9 @@ export interface INodeEngineState extends IEngineState {
      * The identity for the node.
      */
     nodeId?: string;
+    /**
+     * This is the default organization used in the context ids when a user is not authenticated.
+     * It is not used in multi-tenant mode, which gets the organization from the tenant table.
+     */
+    nodeOrganizationId?: string;
 }

package/docs/changelog.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.0.3-next.53](https://github.com/iotaledger/twin-node/compare/node-core-v0.0.3-next.52...node-core-v0.0.3-next.53) (2026-06-11)
+
+
+### Features
+
+* organization identifiers ([#203](https://github.com/iotaledger/twin-node/issues/203)) ([1a6b176](https://github.com/iotaledger/twin-node/commit/1a6b1760d9f8e43a769407668426c70e1c8e1aa8))
+
+## [0.0.3-next.52](https://github.com/iotaledger/twin-node/compare/node-core-v0.0.3-next.51...node-core-v0.0.3-next.52) (2026-06-09)
+
+
+### Bug Fixes
+
+* recover tenant id on bootstrap-legacy restart when TENANT_ID is unset ([#198](https://github.com/iotaledger/twin-node/issues/198)) ([d9451e1](https://github.com/iotaledger/twin-node/commit/d9451e188fe4fd20d5cfd0408b0dc226ddf25cd8))
+
 ## [0.0.3-next.51](https://github.com/iotaledger/twin-node/compare/node-core-v0.0.3-next.50...node-core-v0.0.3-next.51) (2026-06-09)
 
 

package/docs/reference/functions/buildEngineConfiguration.md

@@ -1,6 +1,6 @@
 # Function: buildEngineConfiguration()
 
-> **buildEngineConfiguration**(`envVars`, `contextIdKeys`): `Promise`\<`IEngineConfig`\>
+> **buildEngineConfiguration**(`envVars`): `Promise`\<`IEngineConfig`\>
 
 Build the engine core configuration from environment variables.
 
@@ -12,12 +12,6 @@ Build the engine core configuration from environment variables.
 
 The environment variables.
 
-### contextIdKeys
-
-`object`[]
-
-The context ID keys.
-
 ## Returns
 
 `Promise`\<`IEngineConfig`\>

package/docs/reference/index.md

@@ -32,7 +32,6 @@
 - [BLOB\_STORAGE\_ENCRYPTION\_KEY\_ID](variables/BLOB_STORAGE_ENCRYPTION_KEY_ID.md)
 - [TRUST\_VERIFICATION\_METHOD\_ID](variables/TRUST_VERIFICATION_METHOD_ID.md)
 - [AUTH\_SIGNING\_KEY\_ID](variables/AUTH_SIGNING_KEY_ID.md)
-- [URL\_TRANSFORMER\_ENCRYPTION\_KEY\_ID](variables/URL_TRANSFORMER_ENCRYPTION_KEY_ID.md)
 - [CONTEXT\_ID\_HANDLER\_FEATURE\_DID](variables/CONTEXT_ID_HANDLER_FEATURE_DID.md)
 - [CONTEXT\_ID\_HANDLER\_FEATURE\_TENANT](variables/CONTEXT_ID_HANDLER_FEATURE_TENANT.md)
 - [ModuleProtocol](variables/ModuleProtocol.md)
@@ -41,7 +40,6 @@
 
 - [buildEngineConfiguration](functions/buildEngineConfiguration.md)
 - [isTrustRequired](functions/isTrustRequired.md)
-- [isUrlTransformerRequired](functions/isUrlTransformerRequired.md)
 - [isBackgroundTasksRequired](functions/isBackgroundTasksRequired.md)
 - [isImmutableProofRequired](functions/isImmutableProofRequired.md)
 - [isFederatedCatalogueRequired](functions/isFederatedCatalogueRequired.md)

package/docs/reference/interfaces/ICliCommandDefinition.md

@@ -85,3 +85,17 @@ Indicates whether the engine needs the node identity to be set if configured to
 ```ts
 true
 ```
+
+***
+
+### requiresOrgIdentity? {#requiresorgidentity}
+
+> `optional` **requiresOrgIdentity?**: `boolean`
+
+Indicates whether the engine needs the organization identity to be set.
+
+#### Default
+
+```ts
+true
+```

package/docs/reference/interfaces/IEngineEnvironmentVariables.md

@@ -578,6 +578,14 @@ The batch flush interval in seconds for the logging task, how often to flush the
 
 ***
 
+### loggingSilentComponents? {#loggingsilentcomponents}
+
+> `optional` **loggingSilentComponents?**: `string`
+
+A list of components to exclude from logging, can be a comma separated list of component Class names e.g. "ComponentA,ComponentB".
+
+***
+
 ### eventBusConnector? {#eventbusconnector}
 
 > `optional` **eventBusConnector?**: `string`
@@ -930,6 +938,14 @@ The type of the default data extractor, can be a comma separated list: json-path
 
 ***
 
+### taskSchedulerEnabled? {#taskschedulerenabled}
+
+> `optional` **taskSchedulerEnabled?**: `string`
+
+Enable the task scheduler regardless of which other components are active, defaults to false.
+
+***
+
 ### auditableItemGraphEnabled? {#auditableitemgraphenabled}
 
 > `optional` **auditableItemGraphEnabled?**: `string`
@@ -1171,14 +1187,6 @@ This allows components that take a long time to initialize to be healthy before
 
 ***
 
-### urlTransformerEncryptionKeyId? {#urltransformerencryptionkeyid}
-
-> `optional` **urlTransformerEncryptionKeyId?**: `string`
-
-The id of the key in the vault to use for encrypting parameters in url transformer.
-
-***
-
 ### automationActionTypes? {#automationactiontypes}
 
 > `optional` **automationActionTypes?**: `string`

package/docs/reference/interfaces/IEngineServerEnvironmentVariables.md

@@ -866,6 +866,18 @@ The batch flush interval in seconds for the logging task, how often to flush the
 
 ***
 
+### loggingSilentComponents? {#loggingsilentcomponents}
+
+> `optional` **loggingSilentComponents?**: `string`
+
+A list of components to exclude from logging, can be a comma separated list of component Class names e.g. "ComponentA,ComponentB".
+
+#### Inherited from
+
+[`IEngineEnvironmentVariables`](IEngineEnvironmentVariables.md).[`loggingSilentComponents`](IEngineEnvironmentVariables.md#loggingsilentcomponents)
+
+***
+
 ### eventBusConnector? {#eventbusconnector}
 
 > `optional` **eventBusConnector?**: `string`
@@ -1394,6 +1406,18 @@ The type of the default data extractor, can be a comma separated list: json-path
 
 ***
 
+### taskSchedulerEnabled? {#taskschedulerenabled}
+
+> `optional` **taskSchedulerEnabled?**: `string`
+
+Enable the task scheduler regardless of which other components are active, defaults to false.
+
+#### Inherited from
+
+[`IEngineEnvironmentVariables`](IEngineEnvironmentVariables.md).[`taskSchedulerEnabled`](IEngineEnvironmentVariables.md#taskschedulerenabled)
+
+***
+
 ### auditableItemGraphEnabled? {#auditableitemgraphenabled}
 
 > `optional` **auditableItemGraphEnabled?**: `string`
@@ -1743,18 +1767,6 @@ This allows components that take a long time to initialize to be healthy before
 
 ***
 
-### urlTransformerEncryptionKeyId? {#urltransformerencryptionkeyid}
-
-> `optional` **urlTransformerEncryptionKeyId?**: `string`
-
-The id of the key in the vault to use for encrypting parameters in url transformer.
-
-#### Inherited from
-
-[`IEngineEnvironmentVariables`](IEngineEnvironmentVariables.md).[`urlTransformerEncryptionKeyId`](IEngineEnvironmentVariables.md#urltransformerencryptionkeyid)
-
-***
-
 ### automationActionTypes? {#automationactiontypes}
 
 > `optional` **automationActionTypes?**: `string`

package/docs/reference/interfaces/INodeEngineState.md

@@ -13,3 +13,12 @@ The engine state for the node.
 > `optional` **nodeId?**: `string`
 
 The identity for the node.
+
+***
+
+### nodeOrganizationId? {#nodeorganizationid}
+
+> `optional` **nodeOrganizationId?**: `string`
+
+This is the default organization used in the context ids when a user is not authenticated.
+It is not used in multi-tenant mode, which gets the organization from the tenant table.

package/docs/reference/interfaces/INodeEnvironmentVariables.md

@@ -862,6 +862,18 @@ The batch flush interval in seconds for the logging task, how often to flush the
 
 ***
 
+### loggingSilentComponents? {#loggingsilentcomponents}
+
+> `optional` **loggingSilentComponents?**: `string`
+
+A list of components to exclude from logging, can be a comma separated list of component Class names e.g. "ComponentA,ComponentB".
+
+#### Inherited from
+
+[`IEngineServerEnvironmentVariables`](IEngineServerEnvironmentVariables.md).[`loggingSilentComponents`](IEngineServerEnvironmentVariables.md#loggingsilentcomponents)
+
+***
+
 ### eventBusConnector? {#eventbusconnector}
 
 > `optional` **eventBusConnector?**: `string`
@@ -1390,6 +1402,18 @@ The type of the default data extractor, can be a comma separated list: json-path
 
 ***
 
+### taskSchedulerEnabled? {#taskschedulerenabled}
+
+> `optional` **taskSchedulerEnabled?**: `string`
+
+Enable the task scheduler regardless of which other components are active, defaults to false.
+
+#### Inherited from
+
+[`IEngineServerEnvironmentVariables`](IEngineServerEnvironmentVariables.md).[`taskSchedulerEnabled`](IEngineServerEnvironmentVariables.md#taskschedulerenabled)
+
+***
+
 ### auditableItemGraphEnabled? {#auditableitemgraphenabled}
 
 > `optional` **auditableItemGraphEnabled?**: `string`
@@ -1739,18 +1763,6 @@ This allows components that take a long time to initialize to be healthy before
 
 ***
 
-### urlTransformerEncryptionKeyId? {#urltransformerencryptionkeyid}
-
-> `optional` **urlTransformerEncryptionKeyId?**: `string`
-
-The id of the key in the vault to use for encrypting parameters in url transformer.
-
-#### Inherited from
-
-[`IEngineServerEnvironmentVariables`](IEngineServerEnvironmentVariables.md).[`urlTransformerEncryptionKeyId`](IEngineServerEnvironmentVariables.md#urltransformerencryptionkeyid)
-
-***
-
 ### automationActionTypes? {#automationactiontypes}
 
 > `optional` **automationActionTypes?**: `string`

package/locales/en.json

@@ -2,6 +2,8 @@
 	"error": {
 		"node": {
 			"nodeIdentityNotSet": "The node identity is enabled in config but is not set, please set it using the \"node-set-identity\" CLI command.",
+			"nodeOrganizationIdNotSet": "The node organization is not set, please set it using the \"set-node-org-id\".",
+			"tenantsWithoutOrganizationId": "The following tenants have no organization ID assigned. Use the \"set-tenant-org-id\" command to assign one before starting the node: {tenantIds}",
 			"storageFileRootNotSet": "{storageFileRoot} is not set, the server will not start without it, please set it in the shell or create a .env file",
 			"extensionLoadingError": "Failed to load extension \"{extension}\"",
 			"insecureProtocol": "Cannot load extension from insecure protocol: {protocol}. Only HTTPS is allowed for remote extensions.",
@@ -15,10 +17,12 @@
 			"invalidPublicOrigin": "The public origin \"{publicOrigin}\" is not a valid origin URL, it should be in the format \"protocol://host[:port]\"."
 		},
 		"bootstrapLegacy": {
-			"noFeaturesEnabled": "No features are enabled in legacy bootstrap mode, at least one feature must be enabled."
+			"noFeaturesEnabled": "No features are enabled in legacy bootstrap mode, at least one feature must be enabled.",
+			"organizationNotSet": "The organisation identity has not been set. Run bootstrap with the \"node-identity\" feature first."
 		},
 		"identityCreate": {
-			"invalidMnemonic": "The mnemonic is invalid, it should be 24 words from the standard wordlist."
+			"invalidMnemonic": "The mnemonic is invalid, it should be 24 words from the standard wordlist.",
+			"nodeOrganizationIdNotAvailableInMultiTenantMode": "The node-organization-id option is not available in multi-tenant mode, use tenant-organization-id instead."
 		},
 		"identityImport": {
 			"identityNotFound": "The identity was not found, it must be created on-chain already.",
@@ -33,11 +37,6 @@
 		"tenantCreate": {
 			"tenantAdminComponentNotRegistered": "Multi-tenant support must be enabled to use this command."
 		},
-		"tenantToken": {
-			"tenantIdOrApiKeyRequired": "Either a tenant ID or an API key must be provided.",
-			"urlTransformerComponentNotRegistered": "The URL transformer component is not registered, ensure the node is configured correctly.",
-			"tenantAdminComponentNotRegistered": "Multi-tenant support must be enabled to use this command."
-		},
 		"tenantImport": {
 			"tenantAdminComponentNotRegistered": "Multi-tenant support must be enabled to use this command."
 		},
@@ -57,6 +56,17 @@
 		},
 		"nodeSetIdentity": {
 			"identityNotFound": "The identity with DID \"{notFoundId}\" was not found in the system."
+		},
+		"setNodeOrgId": {
+			"notAvailableInMultiTenantMode": "The set-node-org-id command is not available in multi-tenant mode, use set-tenant-org-id instead."
+		},
+		"applyOrganizationIdToTenant": {
+			"tenantAdminComponentNotRegistered": "Multi-tenant support must be enabled to use this command.",
+			"organizationIdAlreadyInUse": "The organization ID \"{organizationId}\" is already assigned to tenant \"{conflictingTenantId}\"."
+		},
+		"removeTenantOrgAlias": {
+			"tenantAdminComponentNotRegistered": "Multi-tenant support must be enabled to use this command.",
+			"aliasNotFound": "The alias \"{alias}\" was not found in the tenant organization legacy list."
 		}
 	},
 	"node": {
@@ -71,6 +81,7 @@
 		"extensionHttpsDownloading": "Downloading HTTPS extension",
 		"extensionCacheExpired": "Cache expired for extension: {url}",
 		"extensionForceRefresh": "Force refresh enabled for extension: {url}",
+		"tenantOrganizationIdAutoAssigned": "Legacy migration: automatically assigned organization ID \"{organizationId}\" to tenant \"{tenantId}\".",
 		"cli": {
 			"commands": {
 				"command": "Command",
@@ -99,16 +110,18 @@
 					"labels": {
 						"nodeIdentityCreate": "Creating node identity",
 						"nodeAuthKeyCreate": "Creating node auth key",
-						"trustVerificationMethodCreate": "Creating trust verification method for node identity",
+						"trustVerificationMethodCreate": "Creating trust verification method for organisation identity",
 						"nodeIdentitySet": "Setting node identity",
 						"nodeTenantCreate": "Creating node tenant",
 						"organisationCreate": "Creating organisation identity",
 						"blobStorageKeyCreate": "Creating blob storage encryption key for organisation identity",
 						"attestationMethodCreate": "Creating attestation method for organisation identity",
 						"immutableProofMethodCreate": "Creating immutable proof method for organisation identity",
+						"nodeOrganizationIdSet": "Setting node organisation ID",
+						"tenantOrganizationIdSet": "Setting tenant organisation ID",
 						"adminIdentityCreate": "Creating admin user identity",
 						"adminUserCreate": "Creating admin user",
-						"urlTransformParamKeyAdd": "Adding URL transform parameter encryption key"
+						"tenantFallback": "No Node-labelled tenant found; using first available tenant"
 					}
 				},
 				"identity-create": {
@@ -141,6 +154,12 @@
 						},
 						"output-env-prefix": {
 							"description": "Prefix to use for variables in the output .env file."
+						},
+						"node-organization-id": {
+							"description": "If true, set the created identity DID as the node organization ID (not available in multi-tenant mode)."
+						},
+						"tenant-organization-id": {
+							"description": "The tenant ID to set the created identity DID as the organization ID for (requires multi-tenant mode)."
 						}
 					},
 					"labels": {
@@ -335,7 +354,7 @@
 				},
 				"tenant-create": {
 					"description": "Create a tenant with associated api key",
-					"example": "tenant-create --tenant-id=\"0011..aabb\" --api-key=\"aabb..0099\" --label=\"My Tenant\" --public-origin=\"https://example.com:1234\"",
+					"example": "tenant-create --tenant-id=\"0011..aabb\" --api-key=\"aabb..0099\" --organization-id=\"did:iota:...\" --label=\"My Tenant\" --public-origin=\"https://example.com:1234\"",
 					"params": {
 						"env-prefix": {
 							"description": "Prefix to use for standard .env files e.g. TWIN_."
@@ -346,6 +365,9 @@
 						"api-key": {
 							"description": "The API key to associate with the tenant id. If not provided, a random key will be generated."
 						},
+						"organization-id": {
+							"description": "The organization DID to associate with the tenant."
+						},
 						"label": {
 							"description": "A descriptive label for the tenant."
 						},
@@ -369,6 +391,7 @@
 						"creating": "Creating tenant",
 						"tenantId": "Tenant ID",
 						"apiKey": "API Key",
+						"organizationId": "Organization ID",
 						"label": "Label",
 						"publicOrigin": "Public Origin"
 					}
@@ -429,30 +452,6 @@
 						"updated": "Updated tenant"
 					}
 				},
-				"tenant-token": {
-					"description": "Generate the x-enc-tenant-token token value for a tenant",
-					"example": "tenant-token --tenant-id=\"0011..aabb\"",
-					"params": {
-						"tenant-id": {
-							"description": "The tenant ID to generate the token for."
-						},
-						"api-key": {
-							"description": "The API key to look up the tenant ID from."
-						},
-						"load-env": {
-							"description": "Comma separated list of paths to .env files to read input parameters from."
-						},
-						"output-json": {
-							"description": "Path to a .json file to store the command output."
-						}
-					},
-					"labels": {
-						"lookingUp": "Looking up tenant",
-						"generating": "Generating tenant token",
-						"tenantId": "Tenant ID",
-						"token": "Token"
-					}
-				},
 				"user-create": {
 					"description": "Create a user",
 					"example": "user-create --user-identity=\"did:iota:....\" --organization-identity=\"did:iota:....\" --email=\"bob@examples.com\" --password=\"pass1234\" --scope=\"tenant-admin\" --givenName=\"Bob\" --familyName=\"Smith\"",
@@ -595,6 +594,69 @@
 						"publicKeyHex": "Public Key Hex"
 					}
 				},
+				"set-node-org-id": {
+					"description": "Set the node organization ID",
+					"example": "set-node-org-id --organization-id=\"did:iota:...\"",
+					"params": {
+						"env-prefix": {
+							"description": "Prefix to use for standard .env files e.g. TWIN_."
+						},
+						"organization-id": {
+							"description": "The organization DID to set as the node organization ID."
+						},
+						"load-env": {
+							"description": "Comma separated list of paths to .env files to read input parameters from."
+						}
+					},
+					"labels": {
+						"stored": "The node organization ID has been stored"
+					}
+				},
+				"set-tenant-org-id": {
+					"description": "Set the organization ID for a tenant",
+					"example": "set-tenant-org-id --tenant-id=\"0011..aabb\" --organization-id=\"did:iota:...\"",
+					"params": {
+						"env-prefix": {
+							"description": "Prefix to use for standard .env files e.g. TWIN_."
+						},
+						"tenant-id": {
+							"description": "The tenant ID to update."
+						},
+						"organization-id": {
+							"description": "The organization DID to set as the tenant organization ID."
+						},
+						"load-env": {
+							"description": "Comma separated list of paths to .env files to read input parameters from."
+						}
+					},
+					"labels": {
+						"updating": "Updating tenant organization ID",
+						"stored": "The tenant organization ID has been stored"
+					}
+				},
+				"remove-tenant-org-alias": {
+					"description": "Remove an alias from the tenant organization ID legacy list",
+					"example": "remove-tenant-org-alias --tenant-id=\"0011..aabb\" --alias=\"did:iota:...\"",
+					"params": {
+						"env-prefix": {
+							"description": "Prefix to use for standard .env files e.g. TWIN_."
+						},
+						"tenant-id": {
+							"description": "The tenant ID to update."
+						},
+						"alias": {
+							"description": "The organization DID alias to remove from the legacy list."
+						},
+						"load-env": {
+							"description": "Comma separated list of paths to .env files to read input parameters from."
+						}
+					},
+					"labels": {
+						"reading": "Reading tenant",
+						"updating": "Removing alias from tenant organization legacy list",
+						"removed": "The alias has been removed from the tenant organization legacy list"
+					}
+				},
 				"vault-key-import": {
 					"description": "Import a vault key for an identity",
 					"example": "vault-key-import --identity=\"did:iota:....\" --key-id=\"my-key\" --key-type=Ed25519 --private-key-hex=\"15...a2\"",