@authhero/cloudflare-adapter 3.2.5 → 3.3.0

package/dist/workflows.d.ts

@@ -1,5 +1,5 @@
 import { TenantsDataAdapter, TenantOperation } from '@authhero/adapter-interfaces';
-import { TenantOperationStores, StepConfig, StepRunner, TenantOperationExecutor } from '@authhero/multi-tenancy';
+import { TenantOperationStores, StepConfig, StepRunner, SyncConfigFn, TenantOperationExecutor } from '@authhero/multi-tenancy';
 
 interface CfApiClientOptions {
     accountId: string;
@@ -133,8 +133,8 @@ interface TenantProvisionerSteps {
 interface TenantOperationWorkflowParams {
     operation_id: string;
     tenant_id: string;
-    /** Widened beyond "provision" in later phases (upgrade, backup, …). */
-    kind: "provision";
+    /** Widened beyond these in later phases (upgrade, backup, …). */
+    kind: "provision" | "sync-defaults";
 }
 /**
  * Instance status as reported by the engine. The exact value set has
@@ -220,6 +220,33 @@ interface ProvisionOperationDeps {
  */
 declare function runProvisionOperation(deps: ProvisionOperationDeps, params: TenantOperationWorkflowParams, step: StepRunner): Promise<void>;
 
+type SyncDefaultsStepName = "mark-running" | "sync-defaults" | "mark-succeeded" | "mark-failed";
+interface SyncDefaultsOperationDeps {
+    /** Control-plane operation log stores. */
+    stores: TenantOperationStores;
+    /**
+     * How the tenant's resolved config reaches its database, for example
+     * `createDispatchSyncConfig(...)`.
+     */
+    syncConfig: SyncConfigFn;
+    /** Per-step overrides of the retry/timeout defaults. */
+    stepConfig?: Partial<Record<SyncDefaultsStepName, StepConfig>>;
+}
+/**
+ * Durable `sync-defaults` operation: sync one tenant's resolved parent-chain
+ * config into its database as a Workflows instance, writing to the control-plane
+ * operation log at every step boundary (the same shape as
+ * {@link runProvisionOperation}, and the same step logic as the inline
+ * executor). The operation's `input` (`dry_run`, `force`) is read from its row,
+ * so nothing but ids crosses the Workflows boundary.
+ *
+ * A dry run records its diff in the operation's `result` and writes nothing to
+ * the tenant. Any failure runs `mark-failed` (event + failed row) and rethrows
+ * so the instance ends `errored`; if even that dies, the reconciler copies the
+ * engine's terminal state into the row.
+ */
+declare function runSyncDefaultsOperation(deps: SyncDefaultsOperationDeps, params: TenantOperationWorkflowParams, step: StepRunner): Promise<void>;
+
 interface ProvisionVerifierOptions {
     client: CloudflareApiClient;
     /** Minimum number of signing keys the tenant D1 must hold. Default 1. */
@@ -388,5 +415,5 @@ interface WfpWorkflowProvisioningHookOptions {
  */
 declare function createWfpWorkflowProvisioningHook(options: WfpWorkflowProvisioningHookOptions): WfpTenantProvisioningHook;
 
-export { TENANT_OPERATION_ENGINE, TenantProvisionVerificationError, createCloudflareWorkflowsExecutor, createProvisionVerifier, createWfpWorkflowProvisioningHook, reconcileTenantOperations, runProvisionOperation };
-export type { CloudflareWorkflowsExecutorOptions, ProvisionOperationDeps, ProvisionStepName, ProvisionVerifierOptions, ReconcileTenantOperationsOptions, ReconcileTenantOperationsResult, TenantOperationWorkflowParams, WfpWorkflowProvisioningHookOptions, WorkflowInstanceHandle, WorkflowInstanceStatus, WorkflowsBinding };
+export { TENANT_OPERATION_ENGINE, TenantProvisionVerificationError, createCloudflareWorkflowsExecutor, createProvisionVerifier, createWfpWorkflowProvisioningHook, reconcileTenantOperations, runProvisionOperation, runSyncDefaultsOperation };
+export type { CloudflareWorkflowsExecutorOptions, ProvisionOperationDeps, ProvisionStepName, ProvisionVerifierOptions, ReconcileTenantOperationsOptions, ReconcileTenantOperationsResult, SyncDefaultsOperationDeps, SyncDefaultsStepName, TenantOperationWorkflowParams, WfpWorkflowProvisioningHookOptions, WorkflowInstanceHandle, WorkflowInstanceStatus, WorkflowsBinding };

package/dist/workflows.mjs

@@ -1,14 +1,14 @@
-import { r as e, t } from "./sync-defaults-errors-BlLZh6Gt.mjs";
-import { buildEngineInstanceId as n, createOperationRecorder as r, isTerminalStatus as i } from "@authhero/multi-tenancy";
+import { r as e, t } from "./sync-defaults-errors-CKdx0nzD.mjs";
+import { buildEngineInstanceId as n, createOperationRecorder as r, isTerminalStatus as i, runSyncDefaultsStep as a } from "@authhero/multi-tenancy";
 //#region src/workflows/provision-operation.ts
-var a = {
+var o = {
 	retries: {
 		limit: 5,
 		delay: "5 seconds",
 		backoff: "exponential"
 	},
 	timeout: "2 minutes"
-}, o = {
+}, s = {
 	retries: {
 		limit: 8,
 		delay: "10 seconds",
@@ -16,23 +16,23 @@ var a = {
 	},
 	timeout: "1 minute"
 };
-function s(e) {
+function c(e) {
 	return e instanceof Error ? e.message : String(e);
 }
-async function c(e, n, i) {
-	let c = r(e.stores), l = e.shouldProvision ?? ((e) => e.deployment_type === "wfp"), u = (t) => e.stepConfig?.[t] ?? (t === "verify" ? o : a), d = n.operation_id, f = n.tenant_id, p = await i.do("mark-running", u("mark-running"), async () => {
+async function l(e, n, i) {
+	let a = r(e.stores), l = e.shouldProvision ?? ((e) => e.deployment_type === "wfp"), u = (t) => e.stepConfig?.[t] ?? (t === "verify" ? s : o), d = n.operation_id, f = n.tenant_id, p = await i.do("mark-running", u("mark-running"), async () => {
 		let t = await e.tenants.get(f);
-		if (!t || !l(t)) return await c.appendEvent(d, {
+		if (!t || !l(t)) return await a.appendEvent(d, {
 			step: "mark-running",
 			outcome: "skipped",
 			detail: { reason: t ? "tenant is not WFP-provisioned" : "tenant row missing (rolled back?)" }
-		}), await c.markSucceeded(d), {
+		}), await a.markSucceeded(d), {
 			skipped: !0,
 			scriptName: "",
 			databaseName: ""
 		};
 		let n = e.steps.validate(), r = e.steps.names(f);
-		return await c.markRunning(d, "mark-running"), await c.appendEvent(d, {
+		return await a.markRunning(d, "mark-running"), await a.appendEvent(d, {
 			step: "mark-running",
 			outcome: "succeeded"
 		}), {
@@ -50,9 +50,9 @@ async function c(e, n, i) {
 	};
 	try {
 		let n = await i.do("create-database", u("create-database"), async () => {
-			await c.setCurrentStep(d, "create-database");
+			await a.setCurrentStep(d, "create-database");
 			let { id: t, created: n } = await e.steps.findOrCreateDatabase(p.databaseName);
-			return await c.appendEvent(d, {
+			return await a.appendEvent(d, {
 				step: "create-database",
 				outcome: "succeeded",
 				detail: {
@@ -65,29 +65,29 @@ async function c(e, n, i) {
 			};
 		});
 		if (m.d1_database_id = n.databaseId, await i.do("apply-migrations", u("apply-migrations"), async () => {
-			await c.setCurrentStep(d, "apply-migrations"), await e.steps.applyMigrations(n.databaseId, n.created), await c.appendEvent(d, {
+			await a.setCurrentStep(d, "apply-migrations"), await e.steps.applyMigrations(n.databaseId, n.created), await a.appendEvent(d, {
 				step: "apply-migrations",
 				outcome: "succeeded",
 				detail: { database_version: p.databaseVersion }
 			});
 		}), await i.do("upload-script", u("upload-script"), async () => {
-			await c.setCurrentStep(d, "upload-script"), await e.steps.uploadScript(p.scriptName, n.databaseId), await c.appendEvent(d, {
+			await a.setCurrentStep(d, "upload-script"), await e.steps.uploadScript(p.scriptName, n.databaseId), await a.appendEvent(d, {
 				step: "upload-script",
 				outcome: "succeeded",
 				detail: { worker_version: p.workerVersion }
 			});
 		}), await i.do("upload-secrets", u("upload-secrets"), async () => {
-			await c.setCurrentStep(d, "upload-secrets"), await e.steps.uploadSecrets(p.scriptName, f), await c.appendEvent(d, {
+			await a.setCurrentStep(d, "upload-secrets"), await e.steps.uploadSecrets(p.scriptName, f), await a.appendEvent(d, {
 				step: "upload-secrets",
 				outcome: "succeeded"
 			});
 		}), e.syncDefaults) {
 			let n = e.syncDefaults;
 			await i.do("seed-defaults", u("seed-defaults"), async () => {
-				await c.setCurrentStep(d, "seed-defaults");
+				await a.setCurrentStep(d, "seed-defaults");
 				let e = t(await n(f));
 				if (e.length > 0) throw Error(`sync-defaults seed reported ${e.length} error(s): ${e.join("; ")}`);
-				await c.appendEvent(d, {
+				await a.appendEvent(d, {
 					step: "seed-defaults",
 					outcome: "succeeded"
 				});
@@ -96,26 +96,26 @@ async function c(e, n, i) {
 		if (e.verify) {
 			let t = e.verify;
 			await i.do("verify", u("verify"), async () => {
-				await c.setCurrentStep(d, "verify"), await t(n.databaseId, f), await c.appendEvent(d, {
+				await a.setCurrentStep(d, "verify"), await t(n.databaseId, f), await a.appendEvent(d, {
 					step: "verify",
 					outcome: "succeeded"
 				});
 			});
 		}
 		await i.do("mark-ready", u("mark-ready"), async () => {
-			await c.setCurrentStep(d, "mark-ready"), await e.tenants.update(f, {
+			await a.setCurrentStep(d, "mark-ready"), await e.tenants.update(f, {
 				...m,
 				provisioning_state: "ready",
 				provisioning_error: void 0,
 				provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
-			}), await c.appendEvent(d, {
+			}), await a.appendEvent(d, {
 				step: "mark-ready",
 				outcome: "succeeded"
-			}), await c.markSucceeded(d);
+			}), await a.markSucceeded(d);
 		});
 	} catch (t) {
 		throw await i.do("mark-failed", u("mark-failed"), async () => {
-			let n = s(t);
+			let n = c(t);
 			try {
 				await e.tenants.update(f, {
 					...m,
@@ -126,23 +126,68 @@ async function c(e, n, i) {
 			} catch (t) {
 				e.logger?.warn(`Failed to write provisioning_state="failed" for tenant ${f}:`, t);
 			}
-			await c.appendEvent(d, {
+			await a.appendEvent(d, {
 				step: "mark-failed",
 				outcome: "failed",
 				detail: { message: n }
-			}), await c.markFailed(d, t);
+			}), await a.markFailed(d, t);
 		}), t;
 	}
 }
 //#endregion
+//#region src/workflows/sync-defaults-operation.ts
+var u = {
+	retries: {
+		limit: 3,
+		delay: "5 seconds",
+		backoff: "exponential"
+	},
+	timeout: "2 minutes"
+};
+function d(e) {
+	return e instanceof Error ? e.message : String(e);
+}
+async function f(e, t, n) {
+	let i = r(e.stores), o = (t) => e.stepConfig?.[t] ?? u, s = t.operation_id;
+	try {
+		await n.do("mark-running", o("mark-running"), async () => {
+			await i.markRunning(s, "sync-defaults");
+		}), await n.do("sync-defaults", o("sync-defaults"), async () => {
+			await i.setCurrentStep(s, "sync-defaults");
+			let t = await e.stores.tenantOperations.get(s);
+			if (!t) throw Error(`Operation "${s}" not found`);
+			let n = await a({
+				operation: t,
+				syncConfig: e.syncConfig,
+				recorder: i
+			});
+			await i.appendEvent(s, {
+				step: "sync-defaults",
+				outcome: "succeeded",
+				detail: n
+			});
+		}), await n.do("mark-succeeded", o("mark-succeeded"), async () => {
+			await i.markSucceeded(s);
+		});
+	} catch (e) {
+		throw await n.do("mark-failed", o("mark-failed"), async () => {
+			await i.appendEvent(s, {
+				step: "mark-failed",
+				outcome: "failed",
+				detail: { message: d(e) }
+			}), await i.markFailed(s, e);
+		}), e;
+	}
+}
+//#endregion
 //#region src/workflows/verify.ts
-var l = class extends Error {
+var p = class extends Error {
 	checks;
 	constructor(e, t) {
 		super(e), this.name = "TenantProvisionVerificationError", this.checks = t;
 	}
 };
-function u(e, t) {
+function m(e, t) {
 	for (let n of e) for (let e of n.results ?? []) if (!(!e || typeof e != "object")) {
 		for (let [n, r] of Object.entries(e)) if (n === t) {
 			if (typeof r == "number") return r;
@@ -151,11 +196,11 @@ function u(e, t) {
 	}
 	return 0;
 }
-function d(t) {
+function h(t) {
 	let n = t.minKeys ?? 1;
 	return async (r, i) => {
-		let a = await t.client.execD1(r, `SELECT (SELECT COUNT(*) FROM keys) AS key_count, (SELECT COUNT(*) FROM tenants WHERE id = '${e(i)}') AS tenant_count;`), o = u(a, "key_count"), s = u(a, "tenant_count"), c = [];
-		if (o < n && c.push(`expected at least ${n} signing key(s) in "keys", found ${o}`), s < 1 && c.push(`tenant row "${i}" missing from "tenants"`), c.length > 0) throw new l(`Tenant D1 verification failed for "${i}": ${c.join("; ")}`, {
+		let a = await t.client.execD1(r, `SELECT (SELECT COUNT(*) FROM keys) AS key_count, (SELECT COUNT(*) FROM tenants WHERE id = '${e(i)}') AS tenant_count;`), o = m(a, "key_count"), s = m(a, "tenant_count"), c = [];
+		if (o < n && c.push(`expected at least ${n} signing key(s) in "keys", found ${o}`), s < 1 && c.push(`tenant row "${i}" missing from "tenants"`), c.length > 0) throw new p(`Tenant D1 verification failed for "${i}": ${c.join("; ")}`, {
 			keyCount: o,
 			tenantRowCount: s
 		});
@@ -163,16 +208,16 @@ function d(t) {
 }
 //#endregion
 //#region src/workflows/executor.ts
-function f(e) {
+function g(e) {
 	let t = e instanceof Error ? e.message : String(e ?? "");
 	return /already exists|already been created|duplicate/i.test(t);
 }
-function p(e) {
+function _(e) {
 	return {
 		engine: "cloudflare-workflows",
 		async start(t) {
-			if (t.kind !== "provision") throw Error(`The Cloudflare Workflows executor does not support "${t.kind}" operations yet (phase 2 covers provision only)`);
-			if (!t.tenant_id) throw Error("provision operations require a tenant_id");
+			if (t.kind !== "provision" && t.kind !== "sync-defaults") throw Error(`The Cloudflare Workflows executor does not support "${t.kind}" operations yet (it runs provision and sync-defaults)`);
+			if (!t.tenant_id) throw Error(`${t.kind} operations require a tenant_id`);
 			let r = t.engine_instance_id ?? n(t);
 			try {
 				await e.binding.create({
@@ -184,20 +229,20 @@ function p(e) {
 					}
 				});
 			} catch (e) {
-				if (!f(e)) throw e;
+				if (!g(e)) throw e;
 			}
 		}
 	};
 }
 //#endregion
 //#region src/workflows/types.ts
-var m = "cloudflare-workflows";
+var v = "cloudflare-workflows";
 //#endregion
 //#region src/workflows/reconcile.ts
-async function h(e) {
+async function y(e) {
 	let { stores: t, tenants: a, binding: o } = e, s = r(t), c = e.minAgeMs ?? 600 * 1e3, l = e.limit ?? 100, u = new Date(Date.now() - c).toISOString(), { operations: d } = await t.tenantOperations.list({
 		status: ["pending", "running"],
-		engine: m,
+		engine: v,
 		updated_before: u,
 		per_page: l
 	}), f = {
@@ -209,7 +254,7 @@ async function h(e) {
 		errors: 0
 	};
 	for (let t of d) try {
-		await h(t);
+		await m(t);
 	} catch (n) {
 		f.errors++, e.logger?.warn(`Failed to reconcile tenant operation ${t.id}:`, n);
 	}
@@ -228,7 +273,7 @@ async function h(e) {
 			provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
 		});
 	}
-	async function h(e) {
+	async function m(e) {
 		let r = await t.tenantOperations.get(e.id);
 		if (!r || i(r.status)) return;
 		let c = r.engine_instance_id ?? n(r), l;
@@ -245,6 +290,14 @@ async function h(e) {
 			return;
 		}
 		if (u.status === "complete") {
+			if (r.kind === "sync-defaults") {
+				f.markedSucceeded++, await s.appendEvent(r.id, {
+					step: r.current_step ?? "reconcile",
+					outcome: "reconciled",
+					detail: { resolution: "succeeded" }
+				}), await s.markSucceeded(r.id);
+				return;
+			}
 			(r.tenant_id ? await a.get(r.tenant_id) : null)?.provisioning_state === "ready" ? (f.markedSucceeded++, await s.appendEvent(r.id, {
 				step: r.current_step ?? "reconcile",
 				outcome: "reconciled",
@@ -257,7 +310,7 @@ async function h(e) {
 }
 //#endregion
 //#region src/workflows/enqueue-hook.ts
-function g(e) {
+function b(e) {
 	let t = e.shouldProvision ?? ((e) => e.deployment_type === "wfp");
 	return {
 		async onProvision(n, r) {
@@ -276,4 +329,4 @@ function g(e) {
 	};
 }
 //#endregion
-export { m as TENANT_OPERATION_ENGINE, l as TenantProvisionVerificationError, p as createCloudflareWorkflowsExecutor, d as createProvisionVerifier, g as createWfpWorkflowProvisioningHook, h as reconcileTenantOperations, c as runProvisionOperation };
+export { v as TENANT_OPERATION_ENGINE, p as TenantProvisionVerificationError, _ as createCloudflareWorkflowsExecutor, h as createProvisionVerifier, b as createWfpWorkflowProvisioningHook, y as reconcileTenantOperations, l as runProvisionOperation, f as runSyncDefaultsOperation };

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/sesamyab/authhero"
   },
-  "version": "3.2.5",
+  "version": "3.3.0",
   "files": [
     "dist"
   ],
@@ -47,8 +47,8 @@
     "typescript": "^5.9.3",
     "vite": "^8.0.14",
     "vitest": "^4.1.7",
-    "@authhero/multi-tenancy": "15.2.0",
-    "authhero": "9.25.0"
+    "@authhero/multi-tenancy": "15.3.0",
+    "authhero": "9.26.0"
   },
   "peerDependencies": {
     "@authhero/multi-tenancy": "^14.0.0",
@@ -67,8 +67,8 @@
   "dependencies": {
     "nanoid": "^5.1.11",
     "wretch": "^3.0.8",
-    "@authhero/adapter-interfaces": "4.22.0",
-    "@authhero/kysely-adapter": "12.16.0"
+    "@authhero/kysely-adapter": "12.17.0",
+    "@authhero/adapter-interfaces": "4.23.0"
   },
   "license": "AGPL-3.0-only",
   "scripts": {