@authhero/cloudflare-adapter 2.35.2 → 2.36.0

package/dist/types/wfp/dispatch-sync-defaults.d.ts

@@ -1,5 +1,5 @@
 import type { DataAdapters } from "@authhero/adapter-interfaces";
-import { type DefaultsPayloadEntities } from "@authhero/multi-tenancy";
+import { type ControlPlaneDefaultsApplyResult, type DefaultsPayloadEntities } from "@authhero/multi-tenancy";
 import type { DispatchNamespace } from "../code-executor";
 export interface DispatchSyncDefaultsOptions {
     /** The dispatch namespace binding the tenant workers live in. */
@@ -29,5 +29,10 @@ export interface DispatchSyncDefaultsOptions {
  * `/internal/sync-defaults` route (which applies it). The tenant worker never
  * calls back to the control plane. Use the returned function as the
  * provision-time seed and for on-change / rotation re-syncs.
+ *
+ * Resolves with the tenant worker's {@link ControlPlaneDefaultsApplyResult} so
+ * the caller can act on what actually landed — warn when an entity's `received`
+ * is `0`, surface per-entity `errors`, or assert the signing keys projected.
+ * Rejects (does not resolve) when the push fails or the worker returns non-2xx.
  */
-export declare function createDispatchSyncDefaults(options: DispatchSyncDefaultsOptions): (tenantId: string) => Promise<void>;
+export declare function createDispatchSyncDefaults(options: DispatchSyncDefaultsOptions): (tenantId: string) => Promise<ControlPlaneDefaultsApplyResult>;

package/dist/types/wfp/tenant-app.d.ts

@@ -1,5 +1,6 @@
 import { type ExecutionContext } from "hono";
-import { type AuthHeroConfig, type DataAdapters } from "authhero";
+import { type AuthHeroConfig, type DataAdapters, type IssuerResolver } from "authhero";
+import { type ControlPlaneDefaultsApplyResult } from "@authhero/multi-tenancy";
 /**
  * Env contract for a WFP tenant worker — the bindings + secrets
  * `createCloudflareWfpD1Provisioner` (and the host's `secrets` resolver) set on
@@ -45,6 +46,31 @@ export interface WfpTenantAppOptions<Env extends WfpTenantEnv = WfpTenantEnv> {
      * scaffold's base config and the env.
      */
     configure?: (base: AuthHeroConfig, env: Env) => AuthHeroConfig;
+    /**
+     * Resolver for the issuers accepted *in addition to* this tenant's own
+     * `ISSUER`. Defaults to a **gated** resolver that accepts
+     * `env.CONTROL_PLANE_ISSUER` **only** for control-plane-minted tokens
+     * (`tenant_id === env.CONTROL_PLANE_TENANT_ID`) and `[]` otherwise — so a
+     * tenant token can never assert the control-plane issuer. Provide your own
+     * resolver to widen or narrow this; it fully replaces the default.
+     */
+    additionalIssuers?: (env: Env) => IssuerResolver;
+    /**
+     * When applying a `/internal/sync-defaults` push, keep going past a failing
+     * row and collect per-entity errors in the result rather than aborting the
+     * whole projection on the first failure. Defaults to `true` — a single bad
+     * inherited row shouldn't sink the entire sync into an opaque 500. Set
+     * `false` to restore fail-fast.
+     */
+    continueOnError?: boolean;
+    /**
+     * Called after a `/internal/sync-defaults` push is applied, with the result
+     * that is also returned to the control plane. Use it to log what landed
+     * (per-entity `received` / `upserted` / `errors`) without re-implementing the
+     * route. A throw here is caught and turns into a structured 500 — the apply
+     * has already committed, so treat it as best-effort logging.
+     */
+    onSyncResult?: (result: ControlPlaneDefaultsApplyResult, env: Env) => void | Promise<void>;
 }
 /**
  * Builds a WFP tenant worker `{ fetch }` handler: key-ring encryption over the

package/dist/types/wfp-provisioner/tenant-hook.d.ts

@@ -60,6 +60,23 @@ export interface WfpTenantProvisioningHookOptions {
      * a silent no-op so this module stays test-quiet.
      */
     logger?: Pick<Console, "warn">;
+    /**
+     * Optional post-provision seed run *after* the CF resources exist but
+     * *before* the tenant is marked `ready` — typically
+     * `createDispatchSyncDefaults(...)`, which projects the control plane's
+     * defaults (and the FK-target tenant rows) into the fresh D1.
+     *
+     * Folding the seed into provisioning closes the "ready but empty D1" gap: a
+     * best-effort seed fired separately after this hook can be lost, leaving a
+     * tenant marked `ready` whose D1 has no tenant row and no projected defaults.
+     * Here, if the seed throws — or resolves with collected per-entity errors
+     * (the seed applies with `continueOnError`, so failures surface in the
+     * result rather than as a rejection) — the tenant is marked `failed`
+     * (resource ids are still persisted so a re-provision can find them) and the
+     * error is re-thrown. Leave unset to mark `ready` as soon as the resources
+     * exist.
+     */
+    syncDefaults?: (tenantId: string) => Promise<unknown>;
 }
 export interface WfpTenantProvisioningHook {
     onProvision(tenantId: string): Promise<void>;

package/dist/types/wfp-provisioner/types.d.ts

@@ -127,6 +127,12 @@ export interface CloudflareWfpD1ProvisionerOptions {
      * tenant bundle also takes a noticeable chunk of that.
      */
     timeoutMs?: number;
+    /**
+     * Optional `console`-compatible logger. Used to note non-fatal recovery
+     * decisions — e.g. skipping migrations while re-provisioning to heal an
+     * orphaned worker over an existing D1. Defaults to silent.
+     */
+    logger?: Pick<Console, "warn">;
 }
 /**
  * Outcome of a successful `onProvision` — returned so the caller can persist

package/dist/wfp.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@authhero/multi-tenancy"),t=require("hono"),n=require("authhero");var r=`tenant-{tenant_id}-auth`,i=3e4,a=`/internal/sync-defaults`;function o(e,t){return e.replace(/\{tenant_id\}/g,t)}function s(t){let{dispatcher:n,scriptNameTemplate:s=r,internalSecret:c,controlPlaneTenantId:l,controlPlaneAdapters:u,entities:d,timeoutMs:f=i}=t;return async t=>{let r=await(0,e.buildControlPlaneDefaultsPayload)(u,l,d,t),i=o(s,t),p=new AbortController,m=setTimeout(()=>p.abort(),f),h;try{h=await n.get(i).fetch(`https://tenant.internal${a}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${c}`},body:JSON.stringify(r),signal:p.signal})}finally{clearTimeout(m)}if(!h.ok){let e=await h.text().catch(()=>``);throw Error(`sync-defaults push to "${i}" failed: ${h.status} ${e.slice(0,256)}`)}}}var c=`cp`,l=`/internal/sync-defaults`;async function u(r,i){let a=r.CONTROL_PLANE_TENANT_ID,o=await(0,n.loadEncryptionKey)(r.ENCRYPTION_KEY),s=r.CONTROL_PLANE_ENCRYPTION_KEY?{default:o,keys:{[c]:await(0,n.loadEncryptionKey)(r.CONTROL_PLANE_ENCRYPTION_KEY)}}:{default:o},u=(0,n.createEncryptedDataAdapterWithKeyRing)(i.createDataAdapter(r),s,{resolveEncryptKeyId:e=>e===a?c:void 0}),d={dataAdapter:(0,e.withRuntimeFallback)(u,{controlPlaneTenantId:a}),additionalIssuers:()=>[r.CONTROL_PLANE_ISSUER]},{app:f}=(0,n.init)(i.configure?i.configure(d,r):d),p=new t.Hono;return p.post(l,async t=>{let n=r.WFP_INTERNAL_SYNC_SECRET,i=t.req.header(`authorization`);if(!n||i!==`Bearer ${n}`)return t.json({error:`unauthorized`},401);let o;try{o=await t.req.json()}catch{return t.json({error:`invalid JSON`},400)}let s=await(0,e.applyControlPlaneDefaultsPayload)(o,u,a);return t.json(s)}),p.route(`/`,f),p}function d(e){let t=new WeakMap;return{fetch(n,r,i){let a=t.get(r);return a||(a=u(r,e),t.set(r,a)),a.then(e=>e.fetch(n,r,i))}}}exports.createDispatchSyncDefaults=s,exports.createWfpTenantApp=d;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@authhero/multi-tenancy"),t=require("hono"),n=require("authhero");var r=`tenant-{tenant_id}-auth`,i=3e4,a=`/internal/sync-defaults`;function o(e,t){return e.replace(/\{tenant_id\}/g,t)}function s(t){let{dispatcher:n,scriptNameTemplate:s=r,internalSecret:c,controlPlaneTenantId:l,controlPlaneAdapters:u,entities:d,timeoutMs:f=i}=t;return async t=>{let r=await(0,e.buildControlPlaneDefaultsPayload)(u,l,d,t),i=o(s,t),p=new AbortController,m=setTimeout(()=>p.abort(),f),h;try{h=await n.get(i).fetch(`https://tenant.internal${a}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${c}`},body:JSON.stringify(r),signal:p.signal})}finally{clearTimeout(m)}if(!h.ok){let e=await h.text().catch(()=>``),t=h.headers.get(`x-authhero-error`);throw Error(`sync-defaults push to "${i}" failed: ${h.status}${t?` (${t})`:``} ${e.slice(0,256)}`)}return await h.json()}}var c=`cp`,l=`/internal/sync-defaults`;function u(e,t,n,r){console.error(`[wfp-tenant] ${t}:`,n);let i=n instanceof Error?n.message:String(n);return e.header(`X-Authhero-Error`,t),e.json({error:t,detail:i,result:r},500)}function d(e){return({tenant_id:t})=>t===e.CONTROL_PLANE_TENANT_ID?[e.CONTROL_PLANE_ISSUER]:[]}async function f(r,i){let a=r.CONTROL_PLANE_TENANT_ID,o=await(0,n.loadEncryptionKey)(r.ENCRYPTION_KEY),s=r.CONTROL_PLANE_ENCRYPTION_KEY?{default:o,keys:{[c]:await(0,n.loadEncryptionKey)(r.CONTROL_PLANE_ENCRYPTION_KEY)}}:{default:o},f=(0,n.createEncryptedDataAdapterWithKeyRing)(i.createDataAdapter(r),s,{resolveEncryptKeyId:e=>e===a?c:void 0}),p={dataAdapter:(0,e.withRuntimeFallback)(f,{controlPlaneTenantId:a}),additionalIssuers:(i.additionalIssuers??d)(r)},{app:m}=(0,n.init)(i.configure?i.configure(p,r):p),h=new t.Hono;return h.post(l,async t=>{let n=r.WFP_INTERNAL_SYNC_SECRET,o=t.req.header(`authorization`);if(!n||o!==`Bearer ${n}`)return t.json({error:`unauthorized`},401);let s;try{s=await t.req.json()}catch{return t.json({error:`invalid JSON`},400)}let c;try{c=await(0,e.applyControlPlaneDefaultsPayload)(s,f,a,{continueOnError:i.continueOnError??!0})}catch(e){return u(t,`sync_defaults_apply_failed`,e)}if(i.onSyncResult)try{await i.onSyncResult(c,r)}catch(e){return u(t,`sync_defaults_on_result_failed`,e,c)}return t.json(c)}),h.route(`/`,m),h}function p(e){let t=new WeakMap;return{fetch(n,r,i){let a=t.get(r);return a||(a=f(r,e),t.set(r,a)),a.then(e=>e.fetch(n,r,i))}}}exports.createDispatchSyncDefaults=s,exports.createWfpTenantApp=p;

package/dist/wfp.d.ts

@@ -1,7 +1,7 @@
 import { DataAdapters } from '@authhero/adapter-interfaces';
-import { DefaultsPayloadEntities } from '@authhero/multi-tenancy';
+import { DefaultsPayloadEntities, ControlPlaneDefaultsApplyResult } from '@authhero/multi-tenancy';
 import { ExecutionContext } from 'hono';
-import { DataAdapters as DataAdapters$1, AuthHeroConfig } from 'authhero';
+import { DataAdapters as DataAdapters$1, AuthHeroConfig, IssuerResolver } from 'authhero';
 
 /**
  * Cloudflare Workers for Platforms dispatch namespace binding type.
@@ -52,8 +52,13 @@ interface DispatchSyncDefaultsOptions {
  * `/internal/sync-defaults` route (which applies it). The tenant worker never
  * calls back to the control plane. Use the returned function as the
  * provision-time seed and for on-change / rotation re-syncs.
+ *
+ * Resolves with the tenant worker's {@link ControlPlaneDefaultsApplyResult} so
+ * the caller can act on what actually landed — warn when an entity's `received`
+ * is `0`, surface per-entity `errors`, or assert the signing keys projected.
+ * Rejects (does not resolve) when the push fails or the worker returns non-2xx.
  */
-declare function createDispatchSyncDefaults(options: DispatchSyncDefaultsOptions): (tenantId: string) => Promise<void>;
+declare function createDispatchSyncDefaults(options: DispatchSyncDefaultsOptions): (tenantId: string) => Promise<ControlPlaneDefaultsApplyResult>;
 
 /**
  * Env contract for a WFP tenant worker — the bindings + secrets
@@ -100,6 +105,31 @@ interface WfpTenantAppOptions<Env extends WfpTenantEnv = WfpTenantEnv> {
      * scaffold's base config and the env.
      */
     configure?: (base: AuthHeroConfig, env: Env) => AuthHeroConfig;
+    /**
+     * Resolver for the issuers accepted *in addition to* this tenant's own
+     * `ISSUER`. Defaults to a **gated** resolver that accepts
+     * `env.CONTROL_PLANE_ISSUER` **only** for control-plane-minted tokens
+     * (`tenant_id === env.CONTROL_PLANE_TENANT_ID`) and `[]` otherwise — so a
+     * tenant token can never assert the control-plane issuer. Provide your own
+     * resolver to widen or narrow this; it fully replaces the default.
+     */
+    additionalIssuers?: (env: Env) => IssuerResolver;
+    /**
+     * When applying a `/internal/sync-defaults` push, keep going past a failing
+     * row and collect per-entity errors in the result rather than aborting the
+     * whole projection on the first failure. Defaults to `true` — a single bad
+     * inherited row shouldn't sink the entire sync into an opaque 500. Set
+     * `false` to restore fail-fast.
+     */
+    continueOnError?: boolean;
+    /**
+     * Called after a `/internal/sync-defaults` push is applied, with the result
+     * that is also returned to the control plane. Use it to log what landed
+     * (per-entity `received` / `upserted` / `errors`) without re-implementing the
+     * route. A throw here is caught and turns into a structured 500 — the apply
+     * has already committed, so treat it as best-effort logging.
+     */
+    onSyncResult?: (result: ControlPlaneDefaultsApplyResult, env: Env) => void | Promise<void>;
 }
 /**
  * Builds a WFP tenant worker `{ fetch }` handler: key-ring encryption over the

package/dist/wfp.mjs

@@ -24,23 +24,36 @@ function d(e) {
 			clearTimeout(m);
 		}
 		if (!h.ok) {
-			let e = await h.text().catch(() => "");
-			throw Error(`sync-defaults push to "${c}" failed: ${h.status} ${e.slice(0, 256)}`);
+			let e = await h.text().catch(() => ""), t = h.headers.get("x-authhero-error");
+			throw Error(`sync-defaults push to "${c}" failed: ${h.status}${t ? ` (${t})` : ""} ${e.slice(0, 256)}`);
 		}
+		return await h.json();
 	};
 }
 //#endregion
 //#region src/wfp/tenant-app.ts
 var f = "cp", p = "/internal/sync-defaults";
-async function m(t, s) {
+function m(e, t, n, r) {
+	console.error(`[wfp-tenant] ${t}:`, n);
+	let i = n instanceof Error ? n.message : String(n);
+	return e.header("X-Authhero-Error", t), e.json({
+		error: t,
+		detail: i,
+		result: r
+	}, 500);
+}
+function h(e) {
+	return ({ tenant_id: t }) => t === e.CONTROL_PLANE_TENANT_ID ? [e.CONTROL_PLANE_ISSUER] : [];
+}
+async function g(t, s) {
 	let c = t.CONTROL_PLANE_TENANT_ID, l = await o(t.ENCRYPTION_KEY), u = t.CONTROL_PLANE_ENCRYPTION_KEY ? {
 		default: l,
 		keys: { [f]: await o(t.CONTROL_PLANE_ENCRYPTION_KEY) }
-	} : { default: l }, d = i(s.createDataAdapter(t), u, { resolveEncryptKeyId: (e) => e === c ? f : void 0 }), m = {
+	} : { default: l }, d = i(s.createDataAdapter(t), u, { resolveEncryptKeyId: (e) => e === c ? f : void 0 }), g = {
 		dataAdapter: n(d, { controlPlaneTenantId: c }),
-		additionalIssuers: () => [t.CONTROL_PLANE_ISSUER]
-	}, { app: h } = a(s.configure ? s.configure(m, t) : m), g = new r();
-	return g.post(p, async (n) => {
+		additionalIssuers: (s.additionalIssuers ?? h)(t)
+	}, { app: _ } = a(s.configure ? s.configure(g, t) : g), v = new r();
+	return v.post(p, async (n) => {
 		let r = t.WFP_INTERNAL_SYNC_SECRET, i = n.req.header("authorization");
 		if (!r || i !== `Bearer ${r}`) return n.json({ error: "unauthorized" }, 401);
 		let a;
@@ -49,16 +62,26 @@ async function m(t, s) {
 		} catch {
 			return n.json({ error: "invalid JSON" }, 400);
 		}
-		let o = await e(a, d, c);
+		let o;
+		try {
+			o = await e(a, d, c, { continueOnError: s.continueOnError ?? !0 });
+		} catch (e) {
+			return m(n, "sync_defaults_apply_failed", e);
+		}
+		if (s.onSyncResult) try {
+			await s.onSyncResult(o, t);
+		} catch (e) {
+			return m(n, "sync_defaults_on_result_failed", e, o);
+		}
 		return n.json(o);
-	}), g.route("/", h), g;
+	}), v.route("/", _), v;
 }
-function h(e) {
+function _(e) {
 	let t = /* @__PURE__ */ new WeakMap();
 	return { fetch(n, r, i) {
 		let a = t.get(r);
-		return a || (a = m(r, e), t.set(r, a)), a.then((e) => e.fetch(n, r, i));
+		return a || (a = g(r, e), t.set(r, a)), a.then((e) => e.fetch(n, r, i));
 	} };
 }
 //#endregion
-export { d as createDispatchSyncDefaults, h as createWfpTenantApp };
+export { d as createDispatchSyncDefaults, _ as createWfpTenantApp };

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "2.35.2",
+  "version": "2.36.0",
   "files": [
     "dist"
   ],
@@ -43,7 +43,7 @@
     "vite": "^8.0.14",
     "vitest": "^4.1.7",
     "@authhero/multi-tenancy": "14.25.1",
-    "authhero": "8.7.0"
+    "authhero": "8.7.1"
   },
   "peerDependencies": {
     "@authhero/multi-tenancy": "^14.0.0",
@@ -62,8 +62,8 @@
   "dependencies": {
     "nanoid": "^5.1.11",
     "wretch": "^3.0.8",
-    "@authhero/adapter-interfaces": "3.1.1",
-    "@authhero/kysely-adapter": "11.8.9"
+    "@authhero/kysely-adapter": "11.8.10",
+    "@authhero/adapter-interfaces": "3.2.0"
   },
   "scripts": {
     "build": "vite build && tsc -p tsconfig.types.json && rollup -c rollup.dts.config.mjs",