@authhero/cloudflare-adapter 3.2.5 → 3.3.0

package/dist/types/wfp/dispatch-sync-config.d.ts

@@ -0,0 +1,37 @@
+import type { DataAdapters } from "@authhero/adapter-interfaces";
+import { type SyncConfigFn } from "@authhero/multi-tenancy";
+import type { DispatchNamespace } from "../code-executor";
+export interface DispatchSyncConfigOptions {
+    /** The dispatch namespace binding the tenant workers live in. */
+    dispatcher: DispatchNamespace;
+    /** Script-name convention. Supports `{tenant_id}`. */
+    scriptNameTemplate?: string;
+    /**
+     * Shared secret the tenant worker checks on `/internal/sync-config`
+     * (`WFP_INTERNAL_SYNC_SECRET`). Sent as a bearer token.
+     */
+    internalSecret: string;
+    /**
+     * The control plane, used as implicit parent for tenants without a
+     * `parent_tenant_id`.
+     */
+    controlPlaneTenantId: string;
+    /**
+     * Adapters for reading the chain. Use the layer that returns secrets as
+     * stored (ciphertext): they are copied without being decrypted.
+     */
+    controlPlaneAdapters: DataAdapters;
+    /** Maximum ancestors, see `resolveTenantChain`. */
+    maxDepth?: number;
+    /** Per-push timeout. Defaults to 30s. */
+    timeoutMs?: number;
+}
+/**
+ * Builds the `sync-defaults` operation's transport for tenants with their own
+ * worker and database: resolve the tenant's chain on the control plane, push
+ * the resolved block to the tenant worker's `/internal/sync-config`, and return
+ * what it applied (or, for a dry run, what it would). The tenant worker never
+ * calls back to the control plane. Rejects when the push fails or the worker
+ * answers non-2xx, which fails the operation.
+ */
+export declare function createDispatchSyncConfig(options: DispatchSyncConfigOptions): SyncConfigFn;

package/dist/types/wfp/index.d.ts

@@ -5,5 +5,6 @@
  * **optional peer dependencies**: install them only if you import this subpath.
  */
 export { createDispatchSyncDefaults, type DispatchSyncDefaultsOptions, } from "./dispatch-sync-defaults";
+export { createDispatchSyncConfig, type DispatchSyncConfigOptions, } from "./dispatch-sync-config";
 export { createDispatchRenewSigningCertificates, type DispatchRenewSigningCertificatesOptions, type DispatchRenewSigningCertificatesResult, } from "./dispatch-renew-signing-certificates";
 export { createWfpTenantApp, type WfpTenantEnv, type WfpTenantAppOptions, type WfpSigningCertificateAuthority, } from "./tenant-app";

package/dist/types/wfp/tenant-app.d.ts

@@ -31,6 +31,15 @@ export interface WfpTenantEnv {
     CONTROL_PLANE_ENCRYPTION_KEY?: string;
     /** Shared secret authenticating control-plane pushes to `/internal/sync-defaults`. */
     WFP_INTERNAL_SYNC_SECRET?: string;
+    /**
+     * The tenant this worker serves, set when the script is provisioned (plain
+     * text binding or secret, next to `ISSUER`). When present,
+     * `/internal/sync-config` refuses a push addressed to any other tenant, so a
+     * misrouted push can never write another tenant's config into this database.
+     * Optional so workers provisioned before it existed keep working; set it from
+     * the provisioner's `secrets` resolver.
+     */
+    TENANT_ID?: string;
     [key: string]: unknown;
 }
 export interface WfpTenantAppOptions<Env extends WfpTenantEnv = WfpTenantEnv> {

package/dist/types/workflows/entrypoint.example.d.ts

@@ -31,6 +31,7 @@
  *   createWfpWorkflowProvisioningHook,
  *   reconcileTenantOperations,
  *   runProvisionOperation,
+ *   runSyncDefaultsOperation,
  *   type ProvisionOperationDeps,
  *   type TenantOperationWorkflowParams,
  * } from "@authhero/cloudflare-adapter/workflows";
@@ -40,7 +41,10 @@
  *   createWfpTenantProvisioningHook,
  *   CloudflareApiClient,
  * } from "@authhero/cloudflare-adapter";
- * import { createDispatchSyncDefaults } from "@authhero/cloudflare-adapter/wfp";
+ * import {
+ *   createDispatchSyncConfig,
+ *   createDispatchSyncDefaults,
+ * } from "@authhero/cloudflare-adapter/wfp";
  *
  * // Host-owned: build every workflow dependency from the worker env. Params
  * // carry only { operation_id, tenant_id, kind } — never secrets.
@@ -69,8 +73,33 @@
  *
  * export class TenantOperationWorkflow extends WorkflowEntrypoint<Env, TenantOperationWorkflowParams> {
  *   async run(event: WorkflowEvent<TenantOperationWorkflowParams>, step: WorkflowStep) {
- *     // CF's WorkflowStep satisfies StepRunner structurally.
- *     await runProvisionOperation(buildProvisionDeps(this.env), event.payload, step);
+ *     // CF's WorkflowStep satisfies StepRunner structurally. One class runs
+ *     // every kind; params carry the kind, never secrets.
+ *     switch (event.payload.kind) {
+ *       case "sync-defaults": {
+ *         const adapters = createControlPlaneAdapters(this.env);
+ *         return runSyncDefaultsOperation(
+ *           {
+ *             stores: {
+ *               tenantOperations: adapters.tenantOperations!,
+ *               tenantOperationEvents: adapters.tenantOperationEvents!,
+ *             },
+ *             // Reads the chain as stored (ciphertext) and pushes the
+ *             // resolved block to the tenant worker's /internal/sync-config.
+ *             syncConfig: createDispatchSyncConfig({
+ *               dispatcher: this.env.DISPATCHER,
+ *               internalSecret: this.env.WFP_INTERNAL_SYNC_SECRET,
+ *               controlPlaneTenantId: this.env.CONTROL_PLANE_TENANT_ID,
+ *               controlPlaneAdapters: adapters,
+ *             }),
+ *           },
+ *           event.payload,
+ *           step,
+ *         );
+ *       }
+ *       default:
+ *         return runProvisionOperation(buildProvisionDeps(this.env), event.payload, step);
+ *     }
  *   }
  * }
  *
@@ -87,6 +116,14 @@
  *       binding: env.TENANT_OPERATIONS_WORKFLOW,
  *     });
  *     console.log("reconcileTenantOperations", result);
+ *
+ *     // Fleet rollouts of synced config (initMultiTenant's `rollouts`):
+ *     // find tenants whose applied config no longer matches what their
+ *     // parents publish (the safety net for lost write triggers), then start
+ *     // the next wave of every open rollout. Pass a Workflows executor as
+ *     // initMultiTenant's `rolloutExecutor` to run the waves durably.
+ *     //   await reconcileConfigDrift(rollouts);
+ *     //   await advanceRollouts(rollouts);
  *   },
  * };
  *

package/dist/types/workflows/index.d.ts

@@ -13,6 +13,7 @@
  * structurally.
  */
 export { runProvisionOperation, type ProvisionOperationDeps, type ProvisionStepName, } from "./provision-operation";
+export { runSyncDefaultsOperation, type SyncDefaultsOperationDeps, type SyncDefaultsStepName, } from "./sync-defaults-operation";
 export { createProvisionVerifier, TenantProvisionVerificationError, type ProvisionVerifierOptions, } from "./verify";
 export { createCloudflareWorkflowsExecutor, type CloudflareWorkflowsExecutorOptions, } from "./executor";
 export { reconcileTenantOperations, type ReconcileTenantOperationsOptions, type ReconcileTenantOperationsResult, } from "./reconcile";

package/dist/types/workflows/sync-defaults-operation.d.ts

@@ -0,0 +1,28 @@
+import { type StepConfig, type StepRunner, type SyncConfigFn, type TenantOperationStores } from "@authhero/multi-tenancy";
+import type { TenantOperationWorkflowParams } from "./types";
+export type SyncDefaultsStepName = "mark-running" | "sync-defaults" | "mark-succeeded" | "mark-failed";
+export interface SyncDefaultsOperationDeps {
+    /** Control-plane operation log stores. */
+    stores: TenantOperationStores;
+    /**
+     * How the tenant's resolved config reaches its database, for example
+     * `createDispatchSyncConfig(...)`.
+     */
+    syncConfig: SyncConfigFn;
+    /** Per-step overrides of the retry/timeout defaults. */
+    stepConfig?: Partial<Record<SyncDefaultsStepName, StepConfig>>;
+}
+/**
+ * Durable `sync-defaults` operation: sync one tenant's resolved parent-chain
+ * config into its database as a Workflows instance, writing to the control-plane
+ * operation log at every step boundary (the same shape as
+ * {@link runProvisionOperation}, and the same step logic as the inline
+ * executor). The operation's `input` (`dry_run`, `force`) is read from its row,
+ * so nothing but ids crosses the Workflows boundary.
+ *
+ * A dry run records its diff in the operation's `result` and writes nothing to
+ * the tenant. Any failure runs `mark-failed` (event + failed row) and rethrows
+ * so the instance ends `errored`; if even that dies, the reconciler copies the
+ * engine's terminal state into the row.
+ */
+export declare function runSyncDefaultsOperation(deps: SyncDefaultsOperationDeps, params: TenantOperationWorkflowParams, step: StepRunner): Promise<void>;

package/dist/types/workflows/types.d.ts

@@ -14,8 +14,8 @@
 export interface TenantOperationWorkflowParams {
     operation_id: string;
     tenant_id: string;
-    /** Widened beyond "provision" in later phases (upgrade, backup, …). */
-    kind: "provision";
+    /** Widened beyond these in later phases (upgrade, backup, …). */
+    kind: "provision" | "sync-defaults";
 }
 /**
  * Instance status as reported by the engine. The exact value set has

package/dist/wfp.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@authhero/multi-tenancy"),t=require("hono"),n=require("authhero");var r=`tenant-{tenant_id}-auth`,i=3e4,a=`/internal/sync-defaults`;function o(e,t){return e.replace(/\{tenant_id\}/g,t)}function s(t){let{dispatcher:n,scriptNameTemplate:s=r,internalSecret:c,controlPlaneTenantId:l,controlPlaneAdapters:u,entities:d,timeoutMs:f=i}=t;return async t=>{let r=await(0,e.buildControlPlaneDefaultsPayload)(u,l,d,t),i=o(s,t),p=new AbortController,m=setTimeout(()=>p.abort(),f),h;try{h=await n.get(i).fetch(`https://tenant.internal${a}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${c}`},body:JSON.stringify(r),signal:p.signal})}finally{clearTimeout(m)}if(!h.ok){let e=await h.text().catch(()=>``),t=h.headers.get(`x-authhero-error`);throw Error(`sync-defaults push to "${i}" failed: ${h.status}${t?` (${t})`:``} ${e.slice(0,256)}`)}return await h.json()}}var c=`/internal/renew-signing-certificates`;function l(e){let{dispatcher:t,scriptNameTemplate:n=r,internalSecret:a,timeoutMs:s=i}=e;return async e=>{let r=o(n,e),i=new AbortController,l=setTimeout(()=>i.abort(),s);try{let e=await t.get(r).fetch(`https://tenant.internal${c}`,{method:`POST`,headers:{authorization:`Bearer ${a}`},signal:i.signal});if(!e.ok){let t=await e.text().catch(()=>``),n=e.headers.get(`x-authhero-error`);throw Error(`signing-certificate renewal for "${r}" failed: ${e.status}${n?` (${n})`:``} ${t.slice(0,512)}`)}let n=await e.json();if(!u(n))throw Error(`signing-certificate renewal for "${r}" returned an unexpected body`);return{renewed:n.renewed,notDue:n.notDue}}finally{clearTimeout(l)}}}function u(e){return typeof e==`object`&&!!e&&`renewed`in e&&`notDue`in e&&Array.isArray(e.renewed)&&e.renewed.every(e=>typeof e==`string`)&&typeof e.notDue==`number`}var d=`cp`,f=`/internal/sync-defaults`,p=`/internal/renew-signing-certificates`;function m(e,t,n,r){console.error(`[wfp-tenant] ${t}:`,n);let i=n instanceof Error?n.message:String(n);return e.header(`X-Authhero-Error`,t),e.json({error:t,detail:i,result:r},500)}function h(e){let t=`${n.TENANT_URI_PREFIX}${e.tenantId}`;return{issuer:e.issuer,validityDays:e.validityDays,subjectUri:()=>t}}function g(e){return({tenant_id:t})=>t===e.CONTROL_PLANE_TENANT_ID?[e.CONTROL_PLANE_ISSUER]:[]}async function _(r,i){let a=r.CONTROL_PLANE_TENANT_ID,o=await(0,n.loadEncryptionKey)(r.ENCRYPTION_KEY),s=r.CONTROL_PLANE_ENCRYPTION_KEY?{default:o,keys:{[d]:await(0,n.loadEncryptionKey)(r.CONTROL_PLANE_ENCRYPTION_KEY)}}:{default:o},c=(0,n.createEncryptedDataAdapterWithKeyRing)(i.createDataAdapter(r),s,{resolveEncryptKeyId:e=>e===a?d:void 0}),l=(0,e.withRuntimeFallback)(c,{controlPlaneTenantId:a}),u=i.signingCertificateAuthority?.(r),_=u?h(u):void 0,v={dataAdapter:l,..._?{signingCertificateAuthority:_}:{},additionalIssuers:(i.additionalIssuers??g)(r)},y=i.configure?i.configure(v,r):v,b=y.signingCertificateAuthority,{app:x}=(0,n.init)(y),S=new t.Hono;return S.post(f,async t=>{let o=r.WFP_INTERNAL_SYNC_SECRET,s=t.req.header(`authorization`);if(!o||s!==`Bearer ${o}`)return t.json({error:`unauthorized`},401);let l;try{l=await t.req.json()}catch{return t.json({error:`invalid JSON`},400)}let u;try{u=await(0,e.applyControlPlaneDefaultsPayload)(l,c,a,{continueOnError:i.continueOnError??!0})}catch(e){return m(t,`sync_defaults_apply_failed`,e)}let d;try{d={created:(await(0,n.ensureSigningKey)(c.keys,{name:r.ISSUER,certificateAuthority:b})).created}}catch(e){return m(t,`sync_defaults_signing_key_failed`,e,u)}if(i.onSyncResult)try{await i.onSyncResult(u,r)}catch(e){return m(t,`sync_defaults_on_result_failed`,e,u)}return t.json({...u,signingKey:d})}),S.post(p,async e=>{let t=r.WFP_INTERNAL_SYNC_SECRET,i=e.req.header(`authorization`);if(!t||i!==`Bearer ${t}`)return e.json({error:`unauthorized`},401);if(!b)return e.json({error:`no signing certificate authority`},404);try{let t=await(0,n.renewSigningCertificates)({dataAdapter:{keys:c.keys},certificateAuthority:b});return e.json({renewed:t.renewed,notDue:t.notDue})}catch(t){return t instanceof n.SigningCertificateRenewalError?(console.error(`[wfp-tenant] signing_certificate_renewal_failed:`,t),e.header(`X-Authhero-Error`,`signing_certificate_renewal_failed`),e.json({error:`signing_certificate_renewal_failed`,renewed:t.result.renewed,notDue:t.result.notDue,failed:t.result.failed.map(({kid:e,error:t})=>({kid:e,detail:t instanceof Error?t.message:String(t)}))},500)):m(e,`signing_certificate_renewal_failed`,t)}}),S.route(`/`,x),S}function v(e){let t=new WeakMap;return{fetch(n,r,i){let a=t.get(r);return a||(a=_(r,e),t.set(r,a)),a.then(e=>e.fetch(n,r,i))}}}exports.createDispatchRenewSigningCertificates=l,exports.createDispatchSyncDefaults=s,exports.createWfpTenantApp=v;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@authhero/multi-tenancy"),t=require("hono"),n=require("authhero");var r=`tenant-{tenant_id}-auth`,i=3e4,a=`/internal/sync-defaults`;function o(e,t){return e.replace(/\{tenant_id\}/g,t)}function s(t){let{dispatcher:n,scriptNameTemplate:s=r,internalSecret:c,controlPlaneTenantId:l,controlPlaneAdapters:u,entities:d,timeoutMs:f=i}=t;return async t=>{let r=await(0,e.buildControlPlaneDefaultsPayload)(u,l,d,t),i=o(s,t),p=new AbortController,m=setTimeout(()=>p.abort(),f),h;try{h=await n.get(i).fetch(`https://tenant.internal${a}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${c}`},body:JSON.stringify(r),signal:p.signal})}finally{clearTimeout(m)}if(!h.ok){let e=await h.text().catch(()=>``),t=h.headers.get(`x-authhero-error`);throw Error(`sync-defaults push to "${i}" failed: ${h.status}${t?` (${t})`:``} ${e.slice(0,256)}`)}return await h.json()}}var c=`/internal/sync-config`;function l(t){let{dispatcher:n,scriptNameTemplate:a=r,internalSecret:s,controlPlaneTenantId:l,controlPlaneAdapters:u,maxDepth:d,timeoutMs:f=i}=t;return async(t,{dryRun:r,force:i})=>{let p=await(0,e.buildResolvedConfigBlock)(u,t,{legacyControlPlane:l,maxDepth:d}),m=o(a,t),h=new AbortController,g=setTimeout(()=>h.abort(),f),_;try{_=await n.get(m).fetch(`https://tenant.internal${c}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${s}`},body:JSON.stringify({tenantId:t,resolved:p,dryRun:r,force:i}),signal:h.signal})}finally{clearTimeout(g)}if(!_.ok){let e=await _.text().catch(()=>``),t=_.headers.get(`x-authhero-error`);throw Error(`sync-config push to "${m}" failed: ${_.status}${t?` (${t})`:``} ${e.slice(0,256)}`)}return await _.json()}}var u=`/internal/renew-signing-certificates`;function d(e){let{dispatcher:t,scriptNameTemplate:n=r,internalSecret:a,timeoutMs:s=i}=e;return async e=>{let r=o(n,e),i=new AbortController,c=setTimeout(()=>i.abort(),s);try{let e=await t.get(r).fetch(`https://tenant.internal${u}`,{method:`POST`,headers:{authorization:`Bearer ${a}`},signal:i.signal});if(!e.ok){let t=await e.text().catch(()=>``),n=e.headers.get(`x-authhero-error`);throw Error(`signing-certificate renewal for "${r}" failed: ${e.status}${n?` (${n})`:``} ${t.slice(0,512)}`)}let n=await e.json();if(!f(n))throw Error(`signing-certificate renewal for "${r}" returned an unexpected body`);return{renewed:n.renewed,notDue:n.notDue}}finally{clearTimeout(c)}}}function f(e){return typeof e==`object`&&!!e&&`renewed`in e&&`notDue`in e&&Array.isArray(e.renewed)&&e.renewed.every(e=>typeof e==`string`)&&typeof e.notDue==`number`}var p=`cp`,m=`/internal/sync-defaults`,h=`/internal/sync-config`,g=`/internal/renew-signing-certificates`;function _(e,t,n,r){console.error(`[wfp-tenant] ${t}:`,n);let i=n instanceof Error?n.message:String(n);return e.header(`X-Authhero-Error`,t),e.json({error:t,detail:i,result:r},500)}function v(e){let t=`${n.TENANT_URI_PREFIX}${e.tenantId}`;return{issuer:e.issuer,validityDays:e.validityDays,subjectUri:()=>t}}function y(e){return({tenant_id:t})=>t===e.CONTROL_PLANE_TENANT_ID?[e.CONTROL_PLANE_ISSUER]:[]}async function b(r,i){let a=r.CONTROL_PLANE_TENANT_ID,o=await(0,n.loadEncryptionKey)(r.ENCRYPTION_KEY),s=r.CONTROL_PLANE_ENCRYPTION_KEY?{default:o,keys:{[p]:await(0,n.loadEncryptionKey)(r.CONTROL_PLANE_ENCRYPTION_KEY)}}:{default:o},c=i.createDataAdapter(r),l=(0,n.createEncryptedDataAdapterWithKeyRing)(c,s,{resolveEncryptKeyId:e=>e===a?p:void 0}),u=(0,e.withRuntimeFallback)(l,{controlPlaneTenantId:a}),d=i.signingCertificateAuthority?.(r),f=d?v(d):void 0,b={dataAdapter:u,...f?{signingCertificateAuthority:f}:{},additionalIssuers:(i.additionalIssuers??y)(r)},x=i.configure?i.configure(b,r):b,S=x.signingCertificateAuthority,{app:C}=(0,n.init)(x),w=new t.Hono;return w.post(m,async t=>{let o=r.WFP_INTERNAL_SYNC_SECRET,s=t.req.header(`authorization`);if(!o||s!==`Bearer ${o}`)return t.json({error:`unauthorized`},401);let c;try{c=await t.req.json()}catch{return t.json({error:`invalid JSON`},400)}let u;try{u=await(0,e.applyControlPlaneDefaultsPayload)(c,l,a,{continueOnError:i.continueOnError??!0})}catch(e){return _(t,`sync_defaults_apply_failed`,e)}let d;try{d={created:(await(0,n.ensureSigningKey)(l.keys,{name:r.ISSUER,certificateAuthority:S})).created}}catch(e){return _(t,`sync_defaults_signing_key_failed`,e,u)}if(i.onSyncResult)try{await i.onSyncResult(u,r)}catch(e){return _(t,`sync_defaults_on_result_failed`,e,u)}return t.json({...u,signingKey:d})}),w.post(h,async t=>{let n=r.WFP_INTERNAL_SYNC_SECRET,a=t.req.header(`authorization`);if(!n||a!==`Bearer ${n}`)return t.json({error:`unauthorized`},401);let o;try{o=await t.req.json()}catch{return t.json({error:`invalid JSON`},400)}if(!o.tenantId||!o.resolved)return t.json({error:`tenantId and resolved are required`},400);if(r.TENANT_ID&&o.tenantId!==r.TENANT_ID)return console.error(`[wfp-tenant] sync_config_tenant_mismatch: push for "${o.tenantId}" reached the worker of "${r.TENANT_ID}"`),t.header(`X-Authhero-Error`,`sync_config_tenant_mismatch`),t.json({error:`sync_config_tenant_mismatch`},403);try{let n=await(0,e.applyResolvedConfigBlock)(o.resolved,c,o.tenantId,{dryRun:o.dryRun===!0,force:o.force===!0,keyRing:s,continueOnError:i.continueOnError??!0});return t.json(n)}catch(e){return e instanceof Error&&/key ring cannot decrypt/.test(e.message)?(console.error(`[wfp-tenant] sync_config_key_ring:`,e),t.header(`X-Authhero-Error`,`sync_config_key_ring`),t.json({error:`sync_config_key_ring`,detail:e.message},422)):_(t,`sync_config_apply_failed`,e)}}),w.post(g,async e=>{let t=r.WFP_INTERNAL_SYNC_SECRET,i=e.req.header(`authorization`);if(!t||i!==`Bearer ${t}`)return e.json({error:`unauthorized`},401);if(!S)return e.json({error:`no signing certificate authority`},404);try{let t=await(0,n.renewSigningCertificates)({dataAdapter:{keys:l.keys},certificateAuthority:S});return e.json({renewed:t.renewed,notDue:t.notDue})}catch(t){return t instanceof n.SigningCertificateRenewalError?(console.error(`[wfp-tenant] signing_certificate_renewal_failed:`,t),e.header(`X-Authhero-Error`,`signing_certificate_renewal_failed`),e.json({error:`signing_certificate_renewal_failed`,renewed:t.result.renewed,notDue:t.result.notDue,failed:t.result.failed.map(({kid:e,error:t})=>({kid:e,detail:t instanceof Error?t.message:String(t)}))},500)):_(e,`signing_certificate_renewal_failed`,t)}}),w.route(`/`,C),w}function x(e){let t=new WeakMap;return{fetch(n,r,i){let a=t.get(r);return a||(a=b(r,e),t.set(r,a)),a.then(e=>e.fetch(n,r,i))}}}exports.createDispatchRenewSigningCertificates=d,exports.createDispatchSyncConfig=l,exports.createDispatchSyncDefaults=s,exports.createWfpTenantApp=x;

package/dist/wfp.d.ts

@@ -1,5 +1,5 @@
 import { DataAdapters } from '@authhero/adapter-interfaces';
-import { DefaultsPayloadEntities, ControlPlaneDefaultsApplyResult } from '@authhero/multi-tenancy';
+import { DefaultsPayloadEntities, ControlPlaneDefaultsApplyResult, SyncConfigFn } from '@authhero/multi-tenancy';
 import { ExecutionContext } from 'hono';
 import { DataAdapters as DataAdapters$1, AuthHeroConfig, IssuerResolver, CertificateIssuer } from 'authhero';
 
@@ -60,6 +60,41 @@ interface DispatchSyncDefaultsOptions {
  */
 declare function createDispatchSyncDefaults(options: DispatchSyncDefaultsOptions): (tenantId: string) => Promise<ControlPlaneDefaultsApplyResult>;
 
+interface DispatchSyncConfigOptions {
+    /** The dispatch namespace binding the tenant workers live in. */
+    dispatcher: DispatchNamespace;
+    /** Script-name convention. Supports `{tenant_id}`. */
+    scriptNameTemplate?: string;
+    /**
+     * Shared secret the tenant worker checks on `/internal/sync-config`
+     * (`WFP_INTERNAL_SYNC_SECRET`). Sent as a bearer token.
+     */
+    internalSecret: string;
+    /**
+     * The control plane, used as implicit parent for tenants without a
+     * `parent_tenant_id`.
+     */
+    controlPlaneTenantId: string;
+    /**
+     * Adapters for reading the chain. Use the layer that returns secrets as
+     * stored (ciphertext): they are copied without being decrypted.
+     */
+    controlPlaneAdapters: DataAdapters;
+    /** Maximum ancestors, see `resolveTenantChain`. */
+    maxDepth?: number;
+    /** Per-push timeout. Defaults to 30s. */
+    timeoutMs?: number;
+}
+/**
+ * Builds the `sync-defaults` operation's transport for tenants with their own
+ * worker and database: resolve the tenant's chain on the control plane, push
+ * the resolved block to the tenant worker's `/internal/sync-config`, and return
+ * what it applied (or, for a dry run, what it would). The tenant worker never
+ * calls back to the control plane. Rejects when the push fails or the worker
+ * answers non-2xx, which fails the operation.
+ */
+declare function createDispatchSyncConfig(options: DispatchSyncConfigOptions): SyncConfigFn;
+
 interface DispatchRenewSigningCertificatesOptions {
     /** The dispatch namespace binding the tenant workers live in. */
     dispatcher: DispatchNamespace;
@@ -117,6 +152,15 @@ interface WfpTenantEnv {
     CONTROL_PLANE_ENCRYPTION_KEY?: string;
     /** Shared secret authenticating control-plane pushes to `/internal/sync-defaults`. */
     WFP_INTERNAL_SYNC_SECRET?: string;
+    /**
+     * The tenant this worker serves, set when the script is provisioned (plain
+     * text binding or secret, next to `ISSUER`). When present,
+     * `/internal/sync-config` refuses a push addressed to any other tenant, so a
+     * misrouted push can never write another tenant's config into this database.
+     * Optional so workers provisioned before it existed keep working; set it from
+     * the provisioner's `secrets` resolver.
+     */
+    TENANT_ID?: string;
     [key: string]: unknown;
 }
 interface WfpTenantAppOptions<Env extends WfpTenantEnv = WfpTenantEnv> {
@@ -193,5 +237,5 @@ declare function createWfpTenantApp<Env extends WfpTenantEnv = WfpTenantEnv>(opt
     fetch: (request: Request, env: Env, ctx: ExecutionContext) => Promise<Response>;
 };
 
-export { createDispatchRenewSigningCertificates, createDispatchSyncDefaults, createWfpTenantApp };
-export type { DispatchRenewSigningCertificatesOptions, DispatchRenewSigningCertificatesResult, DispatchSyncDefaultsOptions, WfpSigningCertificateAuthority, WfpTenantAppOptions, WfpTenantEnv };
+export { createDispatchRenewSigningCertificates, createDispatchSyncConfig, createDispatchSyncDefaults, createWfpTenantApp };
+export type { DispatchRenewSigningCertificatesOptions, DispatchRenewSigningCertificatesResult, DispatchSyncConfigOptions, DispatchSyncDefaultsOptions, WfpSigningCertificateAuthority, WfpTenantAppOptions, WfpTenantEnv };

package/dist/wfp.mjs

@@ -1,17 +1,17 @@
-import { applyControlPlaneDefaultsPayload as e, buildControlPlaneDefaultsPayload as t, withRuntimeFallback as n } from "@authhero/multi-tenancy";
-import { Hono as r } from "hono";
-import { SigningCertificateRenewalError as i, TENANT_URI_PREFIX as a, createEncryptedDataAdapterWithKeyRing as o, ensureSigningKey as s, init as c, loadEncryptionKey as l, renewSigningCertificates as u } from "authhero";
+import { applyControlPlaneDefaultsPayload as e, applyResolvedConfigBlock as t, buildControlPlaneDefaultsPayload as n, buildResolvedConfigBlock as r, withRuntimeFallback as i } from "@authhero/multi-tenancy";
+import { Hono as a } from "hono";
+import { SigningCertificateRenewalError as o, TENANT_URI_PREFIX as s, createEncryptedDataAdapterWithKeyRing as c, ensureSigningKey as l, init as u, loadEncryptionKey as d, renewSigningCertificates as f } from "authhero";
 //#region src/wfp/dispatch-sync-defaults.ts
-var d = "tenant-{tenant_id}-auth", f = 3e4, p = "/internal/sync-defaults";
-function m(e, t) {
+var p = "tenant-{tenant_id}-auth", m = 3e4, h = "/internal/sync-defaults";
+function g(e, t) {
 	return e.replace(/\{tenant_id\}/g, t);
 }
-function h(e) {
-	let { dispatcher: n, scriptNameTemplate: r = d, internalSecret: i, controlPlaneTenantId: a, controlPlaneAdapters: o, entities: s, timeoutMs: c = f } = e;
+function _(e) {
+	let { dispatcher: t, scriptNameTemplate: r = p, internalSecret: i, controlPlaneTenantId: a, controlPlaneAdapters: o, entities: s, timeoutMs: c = m } = e;
 	return async (e) => {
-		let l = await t(o, a, s, e), u = m(r, e), d = new AbortController(), f = setTimeout(() => d.abort(), c), h;
+		let l = await n(o, a, s, e), u = g(r, e), d = new AbortController(), f = setTimeout(() => d.abort(), c), p;
 		try {
-			h = await n.get(u).fetch(`https://tenant.internal${p}`, {
+			p = await t.get(u).fetch(`https://tenant.internal${h}`, {
 				method: "POST",
 				headers: {
 					"content-type": "application/json",
@@ -23,22 +23,57 @@ function h(e) {
 		} finally {
 			clearTimeout(f);
 		}
+		if (!p.ok) {
+			let e = await p.text().catch(() => ""), t = p.headers.get("x-authhero-error");
+			throw Error(`sync-defaults push to "${u}" failed: ${p.status}${t ? ` (${t})` : ""} ${e.slice(0, 256)}`);
+		}
+		return await p.json();
+	};
+}
+//#endregion
+//#region src/wfp/dispatch-sync-config.ts
+var v = "/internal/sync-config";
+function y(e) {
+	let { dispatcher: t, scriptNameTemplate: n = p, internalSecret: i, controlPlaneTenantId: a, controlPlaneAdapters: o, maxDepth: s, timeoutMs: c = m } = e;
+	return async (e, { dryRun: l, force: u }) => {
+		let d = await r(o, e, {
+			legacyControlPlane: a,
+			maxDepth: s
+		}), f = g(n, e), p = new AbortController(), m = setTimeout(() => p.abort(), c), h;
+		try {
+			h = await t.get(f).fetch(`https://tenant.internal${v}`, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					authorization: `Bearer ${i}`
+				},
+				body: JSON.stringify({
+					tenantId: e,
+					resolved: d,
+					dryRun: l,
+					force: u
+				}),
+				signal: p.signal
+			});
+		} finally {
+			clearTimeout(m);
+		}
 		if (!h.ok) {
 			let e = await h.text().catch(() => ""), t = h.headers.get("x-authhero-error");
-			throw Error(`sync-defaults push to "${u}" failed: ${h.status}${t ? ` (${t})` : ""} ${e.slice(0, 256)}`);
+			throw Error(`sync-config push to "${f}" failed: ${h.status}${t ? ` (${t})` : ""} ${e.slice(0, 256)}`);
 		}
 		return await h.json();
 	};
 }
 //#endregion
 //#region src/wfp/dispatch-renew-signing-certificates.ts
-var g = "/internal/renew-signing-certificates";
-function _(e) {
-	let { dispatcher: t, scriptNameTemplate: n = d, internalSecret: r, timeoutMs: i = f } = e;
+var b = "/internal/renew-signing-certificates";
+function x(e) {
+	let { dispatcher: t, scriptNameTemplate: n = p, internalSecret: r, timeoutMs: i = m } = e;
 	return async (e) => {
-		let a = m(n, e), o = new AbortController(), s = setTimeout(() => o.abort(), i);
+		let a = g(n, e), o = new AbortController(), s = setTimeout(() => o.abort(), i);
 		try {
-			let e = await t.get(a).fetch(`https://tenant.internal${g}`, {
+			let e = await t.get(a).fetch(`https://tenant.internal${b}`, {
 				method: "POST",
 				headers: { authorization: `Bearer ${r}` },
 				signal: o.signal
@@ -48,7 +83,7 @@ function _(e) {
 				throw Error(`signing-certificate renewal for "${a}" failed: ${e.status}${n ? ` (${n})` : ""} ${t.slice(0, 512)}`);
 			}
 			let n = await e.json();
-			if (!v(n)) throw Error(`signing-certificate renewal for "${a}" returned an unexpected body`);
+			if (!S(n)) throw Error(`signing-certificate renewal for "${a}" returned an unexpected body`);
 			return {
 				renewed: n.renewed,
 				notDue: n.notDue
@@ -58,13 +93,13 @@ function _(e) {
 		}
 	};
 }
-function v(e) {
+function S(e) {
 	return typeof e == "object" && !!e && "renewed" in e && "notDue" in e && Array.isArray(e.renewed) && e.renewed.every((e) => typeof e == "string") && typeof e.notDue == "number";
 }
 //#endregion
 //#region src/wfp/tenant-app.ts
-var y = "cp", b = "/internal/sync-defaults", x = "/internal/renew-signing-certificates";
-function S(e, t, n, r) {
+var C = "cp", w = "/internal/sync-defaults", T = "/internal/sync-config", E = "/internal/renew-signing-certificates";
+function D(e, t, n, r) {
 	console.error(`[wfp-tenant] ${t}:`, n);
 	let i = n instanceof Error ? n.message : String(n);
 	return e.header("X-Authhero-Error", t), e.json({
@@ -73,74 +108,99 @@ function S(e, t, n, r) {
 		result: r
 	}, 500);
 }
-function C(e) {
-	let t = `${a}${e.tenantId}`;
+function O(e) {
+	let t = `${s}${e.tenantId}`;
 	return {
 		issuer: e.issuer,
 		validityDays: e.validityDays,
 		subjectUri: () => t
 	};
 }
-function w(e) {
+function k(e) {
 	return ({ tenant_id: t }) => t === e.CONTROL_PLANE_TENANT_ID ? [e.CONTROL_PLANE_ISSUER] : [];
 }
-async function T(t, a) {
-	let d = t.CONTROL_PLANE_TENANT_ID, f = await l(t.ENCRYPTION_KEY), p = t.CONTROL_PLANE_ENCRYPTION_KEY ? {
-		default: f,
-		keys: { [y]: await l(t.CONTROL_PLANE_ENCRYPTION_KEY) }
-	} : { default: f }, m = o(a.createDataAdapter(t), p, { resolveEncryptKeyId: (e) => e === d ? y : void 0 }), h = n(m, { controlPlaneTenantId: d }), g = a.signingCertificateAuthority?.(t), _ = g ? C(g) : void 0, v = {
-		dataAdapter: h,
-		..._ ? { signingCertificateAuthority: _ } : {},
-		additionalIssuers: (a.additionalIssuers ?? w)(t)
-	}, T = a.configure ? a.configure(v, t) : v, E = T.signingCertificateAuthority, { app: D } = c(T), O = new r();
-	return O.post(b, async (n) => {
-		let r = t.WFP_INTERNAL_SYNC_SECRET, i = n.req.header("authorization");
-		if (!r || i !== `Bearer ${r}`) return n.json({ error: "unauthorized" }, 401);
+async function A(n, r) {
+	let s = n.CONTROL_PLANE_TENANT_ID, p = await d(n.ENCRYPTION_KEY), m = n.CONTROL_PLANE_ENCRYPTION_KEY ? {
+		default: p,
+		keys: { [C]: await d(n.CONTROL_PLANE_ENCRYPTION_KEY) }
+	} : { default: p }, h = r.createDataAdapter(n), g = c(h, m, { resolveEncryptKeyId: (e) => e === s ? C : void 0 }), _ = i(g, { controlPlaneTenantId: s }), v = r.signingCertificateAuthority?.(n), y = v ? O(v) : void 0, b = {
+		dataAdapter: _,
+		...y ? { signingCertificateAuthority: y } : {},
+		additionalIssuers: (r.additionalIssuers ?? k)(n)
+	}, x = r.configure ? r.configure(b, n) : b, S = x.signingCertificateAuthority, { app: A } = u(x), j = new a();
+	return j.post(w, async (t) => {
+		let i = n.WFP_INTERNAL_SYNC_SECRET, a = t.req.header("authorization");
+		if (!i || a !== `Bearer ${i}`) return t.json({ error: "unauthorized" }, 401);
 		let o;
 		try {
-			o = await n.req.json();
+			o = await t.req.json();
 		} catch {
-			return n.json({ error: "invalid JSON" }, 400);
+			return t.json({ error: "invalid JSON" }, 400);
 		}
 		let c;
 		try {
-			c = await e(o, m, d, { continueOnError: a.continueOnError ?? !0 });
+			c = await e(o, g, s, { continueOnError: r.continueOnError ?? !0 });
 		} catch (e) {
-			return S(n, "sync_defaults_apply_failed", e);
+			return D(t, "sync_defaults_apply_failed", e);
 		}
-		let l;
+		let u;
 		try {
-			l = { created: (await s(m.keys, {
-				name: t.ISSUER,
-				certificateAuthority: E
+			u = { created: (await l(g.keys, {
+				name: n.ISSUER,
+				certificateAuthority: S
 			})).created };
 		} catch (e) {
-			return S(n, "sync_defaults_signing_key_failed", e, c);
+			return D(t, "sync_defaults_signing_key_failed", e, c);
 		}
-		if (a.onSyncResult) try {
-			await a.onSyncResult(c, t);
+		if (r.onSyncResult) try {
+			await r.onSyncResult(c, n);
 		} catch (e) {
-			return S(n, "sync_defaults_on_result_failed", e, c);
+			return D(t, "sync_defaults_on_result_failed", e, c);
 		}
-		return n.json({
+		return t.json({
 			...c,
-			signingKey: l
+			signingKey: u
 		});
-	}), O.post(x, async (e) => {
-		let n = t.WFP_INTERNAL_SYNC_SECRET, r = e.req.header("authorization");
-		if (!n || r !== `Bearer ${n}`) return e.json({ error: "unauthorized" }, 401);
-		if (!E) return e.json({ error: "no signing certificate authority" }, 404);
+	}), j.post(T, async (e) => {
+		let i = n.WFP_INTERNAL_SYNC_SECRET, a = e.req.header("authorization");
+		if (!i || a !== `Bearer ${i}`) return e.json({ error: "unauthorized" }, 401);
+		let o;
+		try {
+			o = await e.req.json();
+		} catch {
+			return e.json({ error: "invalid JSON" }, 400);
+		}
+		if (!o.tenantId || !o.resolved) return e.json({ error: "tenantId and resolved are required" }, 400);
+		if (n.TENANT_ID && o.tenantId !== n.TENANT_ID) return console.error(`[wfp-tenant] sync_config_tenant_mismatch: push for "${o.tenantId}" reached the worker of "${n.TENANT_ID}"`), e.header("X-Authhero-Error", "sync_config_tenant_mismatch"), e.json({ error: "sync_config_tenant_mismatch" }, 403);
+		try {
+			let n = await t(o.resolved, h, o.tenantId, {
+				dryRun: o.dryRun === !0,
+				force: o.force === !0,
+				keyRing: m,
+				continueOnError: r.continueOnError ?? !0
+			});
+			return e.json(n);
+		} catch (t) {
+			return t instanceof Error && /key ring cannot decrypt/.test(t.message) ? (console.error("[wfp-tenant] sync_config_key_ring:", t), e.header("X-Authhero-Error", "sync_config_key_ring"), e.json({
+				error: "sync_config_key_ring",
+				detail: t.message
+			}, 422)) : D(e, "sync_config_apply_failed", t);
+		}
+	}), j.post(E, async (e) => {
+		let t = n.WFP_INTERNAL_SYNC_SECRET, r = e.req.header("authorization");
+		if (!t || r !== `Bearer ${t}`) return e.json({ error: "unauthorized" }, 401);
+		if (!S) return e.json({ error: "no signing certificate authority" }, 404);
 		try {
-			let t = await u({
-				dataAdapter: { keys: m.keys },
-				certificateAuthority: E
+			let t = await f({
+				dataAdapter: { keys: g.keys },
+				certificateAuthority: S
 			});
 			return e.json({
 				renewed: t.renewed,
 				notDue: t.notDue
 			});
 		} catch (t) {
-			return t instanceof i ? (console.error("[wfp-tenant] signing_certificate_renewal_failed:", t), e.header("X-Authhero-Error", "signing_certificate_renewal_failed"), e.json({
+			return t instanceof o ? (console.error("[wfp-tenant] signing_certificate_renewal_failed:", t), e.header("X-Authhero-Error", "signing_certificate_renewal_failed"), e.json({
 				error: "signing_certificate_renewal_failed",
 				renewed: t.result.renewed,
 				notDue: t.result.notDue,
@@ -148,16 +208,16 @@ async function T(t, a) {
 					kid: e,
 					detail: t instanceof Error ? t.message : String(t)
 				}))
-			}, 500)) : S(e, "signing_certificate_renewal_failed", t);
+			}, 500)) : D(e, "signing_certificate_renewal_failed", t);
 		}
-	}), O.route("/", D), O;
+	}), j.route("/", A), j;
 }
-function E(e) {
+function j(e) {
 	let t = /* @__PURE__ */ new WeakMap();
 	return { fetch(n, r, i) {
 		let a = t.get(r);
-		return a || (a = T(r, e), t.set(r, a)), a.then((e) => e.fetch(n, r, i));
+		return a || (a = A(r, e), t.set(r, a)), a.then((e) => e.fetch(n, r, i));
 	} };
 }
 //#endregion
-export { _ as createDispatchRenewSigningCertificates, h as createDispatchSyncDefaults, E as createWfpTenantApp };
+export { x as createDispatchRenewSigningCertificates, y as createDispatchSyncConfig, _ as createDispatchSyncDefaults, j as createWfpTenantApp };

package/dist/workflows.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./sync-defaults-errors-Htp1NWTq.js");let t=require("@authhero/multi-tenancy");var n={retries:{limit:5,delay:`5 seconds`,backoff:`exponential`},timeout:`2 minutes`},r={retries:{limit:8,delay:`10 seconds`,backoff:`exponential`},timeout:`1 minute`};function i(e){return e instanceof Error?e.message:String(e)}async function a(a,o,s){let c=(0,t.createOperationRecorder)(a.stores),l=a.shouldProvision??(e=>e.deployment_type===`wfp`),u=e=>a.stepConfig?.[e]??(e===`verify`?r:n),d=o.operation_id,f=o.tenant_id,p=await s.do(`mark-running`,u(`mark-running`),async()=>{let e=await a.tenants.get(f);if(!e||!l(e))return await c.appendEvent(d,{step:`mark-running`,outcome:`skipped`,detail:{reason:e?`tenant is not WFP-provisioned`:`tenant row missing (rolled back?)`}}),await c.markSucceeded(d),{skipped:!0,scriptName:``,databaseName:``};let t=a.steps.validate(),n=a.steps.names(f);return await c.markRunning(d,`mark-running`),await c.appendEvent(d,{step:`mark-running`,outcome:`succeeded`}),{skipped:!1,...n,...t}});if(p.skipped)return;let m={worker_script_name:p.scriptName,bundle_configuration:p.bundleConfiguration,worker_version:p.workerVersion,database_version:p.databaseVersion};try{let t=await s.do(`create-database`,u(`create-database`),async()=>{await c.setCurrentStep(d,`create-database`);let{id:e,created:t}=await a.steps.findOrCreateDatabase(p.databaseName);return await c.appendEvent(d,{step:`create-database`,outcome:`succeeded`,detail:{database_id:e,created:t}}),{databaseId:e,created:t}});if(m.d1_database_id=t.databaseId,await s.do(`apply-migrations`,u(`apply-migrations`),async()=>{await c.setCurrentStep(d,`apply-migrations`),await a.steps.applyMigrations(t.databaseId,t.created),await c.appendEvent(d,{step:`apply-migrations`,outcome:`succeeded`,detail:{database_version:p.databaseVersion}})}),await s.do(`upload-script`,u(`upload-script`),async()=>{await c.setCurrentStep(d,`upload-script`),await a.steps.uploadScript(p.scriptName,t.databaseId),await c.appendEvent(d,{step:`upload-script`,outcome:`succeeded`,detail:{worker_version:p.workerVersion}})}),await s.do(`upload-secrets`,u(`upload-secrets`),async()=>{await c.setCurrentStep(d,`upload-secrets`),await a.steps.uploadSecrets(p.scriptName,f),await c.appendEvent(d,{step:`upload-secrets`,outcome:`succeeded`})}),a.syncDefaults){let t=a.syncDefaults;await s.do(`seed-defaults`,u(`seed-defaults`),async()=>{await c.setCurrentStep(d,`seed-defaults`);let n=e.t(await t(f));if(n.length>0)throw Error(`sync-defaults seed reported ${n.length} error(s): ${n.join(`; `)}`);await c.appendEvent(d,{step:`seed-defaults`,outcome:`succeeded`})})}if(a.verify){let e=a.verify;await s.do(`verify`,u(`verify`),async()=>{await c.setCurrentStep(d,`verify`),await e(t.databaseId,f),await c.appendEvent(d,{step:`verify`,outcome:`succeeded`})})}await s.do(`mark-ready`,u(`mark-ready`),async()=>{await c.setCurrentStep(d,`mark-ready`),await a.tenants.update(f,{...m,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()}),await c.appendEvent(d,{step:`mark-ready`,outcome:`succeeded`}),await c.markSucceeded(d)})}catch(e){throw await s.do(`mark-failed`,u(`mark-failed`),async()=>{let t=i(e);try{await a.tenants.update(f,{...m,provisioning_state:`failed`,provisioning_error:t.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}catch(e){a.logger?.warn(`Failed to write provisioning_state="failed" for tenant ${f}:`,e)}await c.appendEvent(d,{step:`mark-failed`,outcome:`failed`,detail:{message:t}}),await c.markFailed(d,e)}),e}}var o=class extends Error{checks;constructor(e,t){super(e),this.name=`TenantProvisionVerificationError`,this.checks=t}};function s(e,t){for(let n of e)for(let e of n.results??[])if(!(!e||typeof e!=`object`)){for(let[n,r]of Object.entries(e))if(n===t){if(typeof r==`number`)return r;if(typeof r==`string`&&r!==``&&!isNaN(Number(r)))return Number(r)}}return 0}function c(t){let n=t.minKeys??1;return async(r,i)=>{let a=await t.client.execD1(r,`SELECT (SELECT COUNT(*) FROM keys) AS key_count, (SELECT COUNT(*) FROM tenants WHERE id = '${e.r(i)}') AS tenant_count;`),c=s(a,`key_count`),l=s(a,`tenant_count`),u=[];if(c<n&&u.push(`expected at least ${n} signing key(s) in "keys", found ${c}`),l<1&&u.push(`tenant row "${i}" missing from "tenants"`),u.length>0)throw new o(`Tenant D1 verification failed for "${i}": ${u.join(`; `)}`,{keyCount:c,tenantRowCount:l})}}function l(e){let t=e instanceof Error?e.message:String(e??``);return/already exists|already been created|duplicate/i.test(t)}function u(e){return{engine:`cloudflare-workflows`,async start(n){if(n.kind!==`provision`)throw Error(`The Cloudflare Workflows executor does not support "${n.kind}" operations yet (phase 2 covers provision only)`);if(!n.tenant_id)throw Error(`provision operations require a tenant_id`);let r=n.engine_instance_id??(0,t.buildEngineInstanceId)(n);try{await e.binding.create({id:r,params:{operation_id:n.id,tenant_id:n.tenant_id,kind:n.kind}})}catch(e){if(!l(e))throw e}}}}var d=`cloudflare-workflows`;async function f(e){let{stores:n,tenants:r,binding:i}=e,a=(0,t.createOperationRecorder)(n),o=e.minAgeMs??600*1e3,s=e.limit??100,c=new Date(Date.now()-o).toISOString(),{operations:l}=await n.tenantOperations.list({status:[`pending`,`running`],engine:d,updated_before:c,per_page:s}),u={scanned:l.length,markedFailed:0,markedSucceeded:0,stillRunning:0,instanceMissing:0,errors:0};for(let t of l)try{await p(t)}catch(n){u.errors++,e.logger?.warn(`Failed to reconcile tenant operation ${t.id}:`,n)}return u;async function f(e,t){await a.appendEvent(e.id,{step:e.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`failed`,reason:t}}),await a.markFailed(e.id,t),e.kind===`provision`&&e.tenant_id&&(await r.get(e.tenant_id))?.provisioning_state===`pending`&&await r.update(e.tenant_id,{provisioning_state:`failed`,provisioning_error:t.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}async function p(e){let o=await n.tenantOperations.get(e.id);if(!o||(0,t.isTerminalStatus)(o.status))return;let s=o.engine_instance_id??(0,t.buildEngineInstanceId)(o),c;try{c=await i.get(s)}catch{u.instanceMissing++,u.markedFailed++,await f(o,`engine instance "${s}" not found (expired past retention or never started)`);return}let l=await c.status();if(l.status===`errored`||l.status===`terminated`){let e=typeof l.error==`string`?l.error:l.error?.message??`engine reported ${l.status}`;u.markedFailed++,await f(o,e);return}if(l.status===`complete`){(o.tenant_id?await r.get(o.tenant_id):null)?.provisioning_state===`ready`?(u.markedSucceeded++,await a.appendEvent(o.id,{step:o.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`succeeded`}}),await a.markSucceeded(o.id)):(u.markedFailed++,await f(o,`engine instance completed but the operation was never finalized and the tenant is not ready`));return}u.stillRunning++}}function p(e){let t=e.shouldProvision??(e=>e.deployment_type===`wfp`);return{async onProvision(n,r){let i=await e.tenants.get(n);i&&t(i)&&await e.enqueueOperation({kind:`provision`,tenant_id:n})},async onUpgrade(t,n){await e.inline.onUpgrade(t,n)},async onDeprovision(t){await e.inline.onDeprovision(t)}}}exports.TENANT_OPERATION_ENGINE=d,exports.TenantProvisionVerificationError=o,exports.createCloudflareWorkflowsExecutor=u,exports.createProvisionVerifier=c,exports.createWfpWorkflowProvisioningHook=p,exports.reconcileTenantOperations=f,exports.runProvisionOperation=a;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./sync-defaults-errors-pnzkP88r.js");let t=require("@authhero/multi-tenancy");var n={retries:{limit:5,delay:`5 seconds`,backoff:`exponential`},timeout:`2 minutes`},r={retries:{limit:8,delay:`10 seconds`,backoff:`exponential`},timeout:`1 minute`};function i(e){return e instanceof Error?e.message:String(e)}async function a(a,o,s){let c=(0,t.createOperationRecorder)(a.stores),l=a.shouldProvision??(e=>e.deployment_type===`wfp`),u=e=>a.stepConfig?.[e]??(e===`verify`?r:n),d=o.operation_id,f=o.tenant_id,p=await s.do(`mark-running`,u(`mark-running`),async()=>{let e=await a.tenants.get(f);if(!e||!l(e))return await c.appendEvent(d,{step:`mark-running`,outcome:`skipped`,detail:{reason:e?`tenant is not WFP-provisioned`:`tenant row missing (rolled back?)`}}),await c.markSucceeded(d),{skipped:!0,scriptName:``,databaseName:``};let t=a.steps.validate(),n=a.steps.names(f);return await c.markRunning(d,`mark-running`),await c.appendEvent(d,{step:`mark-running`,outcome:`succeeded`}),{skipped:!1,...n,...t}});if(p.skipped)return;let m={worker_script_name:p.scriptName,bundle_configuration:p.bundleConfiguration,worker_version:p.workerVersion,database_version:p.databaseVersion};try{let t=await s.do(`create-database`,u(`create-database`),async()=>{await c.setCurrentStep(d,`create-database`);let{id:e,created:t}=await a.steps.findOrCreateDatabase(p.databaseName);return await c.appendEvent(d,{step:`create-database`,outcome:`succeeded`,detail:{database_id:e,created:t}}),{databaseId:e,created:t}});if(m.d1_database_id=t.databaseId,await s.do(`apply-migrations`,u(`apply-migrations`),async()=>{await c.setCurrentStep(d,`apply-migrations`),await a.steps.applyMigrations(t.databaseId,t.created),await c.appendEvent(d,{step:`apply-migrations`,outcome:`succeeded`,detail:{database_version:p.databaseVersion}})}),await s.do(`upload-script`,u(`upload-script`),async()=>{await c.setCurrentStep(d,`upload-script`),await a.steps.uploadScript(p.scriptName,t.databaseId),await c.appendEvent(d,{step:`upload-script`,outcome:`succeeded`,detail:{worker_version:p.workerVersion}})}),await s.do(`upload-secrets`,u(`upload-secrets`),async()=>{await c.setCurrentStep(d,`upload-secrets`),await a.steps.uploadSecrets(p.scriptName,f),await c.appendEvent(d,{step:`upload-secrets`,outcome:`succeeded`})}),a.syncDefaults){let t=a.syncDefaults;await s.do(`seed-defaults`,u(`seed-defaults`),async()=>{await c.setCurrentStep(d,`seed-defaults`);let n=e.t(await t(f));if(n.length>0)throw Error(`sync-defaults seed reported ${n.length} error(s): ${n.join(`; `)}`);await c.appendEvent(d,{step:`seed-defaults`,outcome:`succeeded`})})}if(a.verify){let e=a.verify;await s.do(`verify`,u(`verify`),async()=>{await c.setCurrentStep(d,`verify`),await e(t.databaseId,f),await c.appendEvent(d,{step:`verify`,outcome:`succeeded`})})}await s.do(`mark-ready`,u(`mark-ready`),async()=>{await c.setCurrentStep(d,`mark-ready`),await a.tenants.update(f,{...m,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()}),await c.appendEvent(d,{step:`mark-ready`,outcome:`succeeded`}),await c.markSucceeded(d)})}catch(e){throw await s.do(`mark-failed`,u(`mark-failed`),async()=>{let t=i(e);try{await a.tenants.update(f,{...m,provisioning_state:`failed`,provisioning_error:t.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}catch(e){a.logger?.warn(`Failed to write provisioning_state="failed" for tenant ${f}:`,e)}await c.appendEvent(d,{step:`mark-failed`,outcome:`failed`,detail:{message:t}}),await c.markFailed(d,e)}),e}}var o={retries:{limit:3,delay:`5 seconds`,backoff:`exponential`},timeout:`2 minutes`};function s(e){return e instanceof Error?e.message:String(e)}async function c(e,n,r){let i=(0,t.createOperationRecorder)(e.stores),a=t=>e.stepConfig?.[t]??o,c=n.operation_id;try{await r.do(`mark-running`,a(`mark-running`),async()=>{await i.markRunning(c,`sync-defaults`)}),await r.do(`sync-defaults`,a(`sync-defaults`),async()=>{await i.setCurrentStep(c,`sync-defaults`);let n=await e.stores.tenantOperations.get(c);if(!n)throw Error(`Operation "${c}" not found`);let r=await(0,t.runSyncDefaultsStep)({operation:n,syncConfig:e.syncConfig,recorder:i});await i.appendEvent(c,{step:`sync-defaults`,outcome:`succeeded`,detail:r})}),await r.do(`mark-succeeded`,a(`mark-succeeded`),async()=>{await i.markSucceeded(c)})}catch(e){throw await r.do(`mark-failed`,a(`mark-failed`),async()=>{await i.appendEvent(c,{step:`mark-failed`,outcome:`failed`,detail:{message:s(e)}}),await i.markFailed(c,e)}),e}}var l=class extends Error{checks;constructor(e,t){super(e),this.name=`TenantProvisionVerificationError`,this.checks=t}};function u(e,t){for(let n of e)for(let e of n.results??[])if(!(!e||typeof e!=`object`)){for(let[n,r]of Object.entries(e))if(n===t){if(typeof r==`number`)return r;if(typeof r==`string`&&r!==``&&!isNaN(Number(r)))return Number(r)}}return 0}function d(t){let n=t.minKeys??1;return async(r,i)=>{let a=await t.client.execD1(r,`SELECT (SELECT COUNT(*) FROM keys) AS key_count, (SELECT COUNT(*) FROM tenants WHERE id = '${e.r(i)}') AS tenant_count;`),o=u(a,`key_count`),s=u(a,`tenant_count`),c=[];if(o<n&&c.push(`expected at least ${n} signing key(s) in "keys", found ${o}`),s<1&&c.push(`tenant row "${i}" missing from "tenants"`),c.length>0)throw new l(`Tenant D1 verification failed for "${i}": ${c.join(`; `)}`,{keyCount:o,tenantRowCount:s})}}function f(e){let t=e instanceof Error?e.message:String(e??``);return/already exists|already been created|duplicate/i.test(t)}function p(e){return{engine:`cloudflare-workflows`,async start(n){if(n.kind!==`provision`&&n.kind!==`sync-defaults`)throw Error(`The Cloudflare Workflows executor does not support "${n.kind}" operations yet (it runs provision and sync-defaults)`);if(!n.tenant_id)throw Error(`${n.kind} operations require a tenant_id`);let r=n.engine_instance_id??(0,t.buildEngineInstanceId)(n);try{await e.binding.create({id:r,params:{operation_id:n.id,tenant_id:n.tenant_id,kind:n.kind}})}catch(e){if(!f(e))throw e}}}}var m=`cloudflare-workflows`;async function h(e){let{stores:n,tenants:r,binding:i}=e,a=(0,t.createOperationRecorder)(n),o=e.minAgeMs??600*1e3,s=e.limit??100,c=new Date(Date.now()-o).toISOString(),{operations:l}=await n.tenantOperations.list({status:[`pending`,`running`],engine:m,updated_before:c,per_page:s}),u={scanned:l.length,markedFailed:0,markedSucceeded:0,stillRunning:0,instanceMissing:0,errors:0};for(let t of l)try{await f(t)}catch(n){u.errors++,e.logger?.warn(`Failed to reconcile tenant operation ${t.id}:`,n)}return u;async function d(e,t){await a.appendEvent(e.id,{step:e.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`failed`,reason:t}}),await a.markFailed(e.id,t),e.kind===`provision`&&e.tenant_id&&(await r.get(e.tenant_id))?.provisioning_state===`pending`&&await r.update(e.tenant_id,{provisioning_state:`failed`,provisioning_error:t.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}async function f(e){let o=await n.tenantOperations.get(e.id);if(!o||(0,t.isTerminalStatus)(o.status))return;let s=o.engine_instance_id??(0,t.buildEngineInstanceId)(o),c;try{c=await i.get(s)}catch{u.instanceMissing++,u.markedFailed++,await d(o,`engine instance "${s}" not found (expired past retention or never started)`);return}let l=await c.status();if(l.status===`errored`||l.status===`terminated`){let e=typeof l.error==`string`?l.error:l.error?.message??`engine reported ${l.status}`;u.markedFailed++,await d(o,e);return}if(l.status===`complete`){if(o.kind===`sync-defaults`){u.markedSucceeded++,await a.appendEvent(o.id,{step:o.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`succeeded`}}),await a.markSucceeded(o.id);return}(o.tenant_id?await r.get(o.tenant_id):null)?.provisioning_state===`ready`?(u.markedSucceeded++,await a.appendEvent(o.id,{step:o.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`succeeded`}}),await a.markSucceeded(o.id)):(u.markedFailed++,await d(o,`engine instance completed but the operation was never finalized and the tenant is not ready`));return}u.stillRunning++}}function g(e){let t=e.shouldProvision??(e=>e.deployment_type===`wfp`);return{async onProvision(n,r){let i=await e.tenants.get(n);i&&t(i)&&await e.enqueueOperation({kind:`provision`,tenant_id:n})},async onUpgrade(t,n){await e.inline.onUpgrade(t,n)},async onDeprovision(t){await e.inline.onDeprovision(t)}}}exports.TENANT_OPERATION_ENGINE=m,exports.TenantProvisionVerificationError=l,exports.createCloudflareWorkflowsExecutor=p,exports.createProvisionVerifier=d,exports.createWfpWorkflowProvisioningHook=g,exports.reconcileTenantOperations=h,exports.runProvisionOperation=a,exports.runSyncDefaultsOperation=c;