@authhero/cloudflare-adapter 3.2.5 → 3.4.0

package/dist/types/wfp/dispatch-detach.d.ts

@@ -0,0 +1,31 @@
+import type { DataAdapters } from "@authhero/adapter-interfaces";
+import { type DetachConfigFn } from "@authhero/multi-tenancy";
+import type { DispatchNamespace } from "../code-executor";
+export interface DispatchDetachOptions {
+    /** The dispatch namespace binding the tenant workers live in. */
+    dispatcher: DispatchNamespace;
+    /** Script-name convention. Supports `{tenant_id}`. */
+    scriptNameTemplate?: string;
+    /**
+     * Shared secret the tenant worker checks on `/internal/detach`
+     * (`WFP_INTERNAL_SYNC_SECRET`). Sent as a bearer token.
+     */
+    internalSecret: string;
+    /**
+     * The control plane's adapters, where the tenant row that decides lives. Use
+     * the raw layer.
+     */
+    controlPlaneAdapters: DataAdapters;
+    /** Per-push timeout. Defaults to 120s. */
+    timeoutMs?: number;
+}
+/**
+ * Builds the `detach` operation's transport for tenants with their own worker
+ * and database. The control plane checks that the tenant can be detached from
+ * its own tenant row, asks the tenant worker to convert (or remove) the copies
+ * in its database, and only when that went through marks its own tenant row
+ * detached. A preview or a partial result leaves the row as it was, so a retry
+ * can finish the job. Rejects when the push fails or the worker answers non-2xx,
+ * which fails the operation.
+ */
+export declare function createDispatchDetach(options: DispatchDetachOptions): DetachConfigFn;

package/dist/types/wfp/dispatch-sync-config.d.ts

@@ -0,0 +1,37 @@
+import type { DataAdapters } from "@authhero/adapter-interfaces";
+import { type SyncConfigFn } from "@authhero/multi-tenancy";
+import type { DispatchNamespace } from "../code-executor";
+export interface DispatchSyncConfigOptions {
+    /** The dispatch namespace binding the tenant workers live in. */
+    dispatcher: DispatchNamespace;
+    /** Script-name convention. Supports `{tenant_id}`. */
+    scriptNameTemplate?: string;
+    /**
+     * Shared secret the tenant worker checks on `/internal/sync-config`
+     * (`WFP_INTERNAL_SYNC_SECRET`). Sent as a bearer token.
+     */
+    internalSecret: string;
+    /**
+     * The control plane, used as implicit parent for tenants without a
+     * `parent_tenant_id`.
+     */
+    controlPlaneTenantId: string;
+    /**
+     * Adapters for reading the chain. Use the layer that returns secrets as
+     * stored (ciphertext): they are copied without being decrypted.
+     */
+    controlPlaneAdapters: DataAdapters;
+    /** Maximum ancestors, see `resolveTenantChain`. */
+    maxDepth?: number;
+    /** Per-push timeout. Defaults to 30s. */
+    timeoutMs?: number;
+}
+/**
+ * Builds the `sync-defaults` operation's transport for tenants with their own
+ * worker and database: resolve the tenant's chain on the control plane, push
+ * the resolved block to the tenant worker's `/internal/sync-config`, and return
+ * what it applied (or, for a dry run, what it would). The tenant worker never
+ * calls back to the control plane. Rejects when the push fails or the worker
+ * answers non-2xx, which fails the operation.
+ */
+export declare function createDispatchSyncConfig(options: DispatchSyncConfigOptions): SyncConfigFn;

package/dist/types/wfp/dispatch-tenant-member-requests.d.ts

@@ -0,0 +1,23 @@
+import type { TenantMemberRequestStore } from "@authhero/multi-tenancy";
+import type { DispatchNamespace } from "../code-executor";
+export declare const TENANT_MEMBER_REQUESTS_PATH = "/internal/tenant-member-requests";
+export interface DispatchTenantMemberRequestStoreOptions {
+    /** The dispatch namespace binding the tenant workers live in. */
+    dispatcher: DispatchNamespace;
+    /** Script-name convention. Supports `{tenant_id}`. */
+    scriptNameTemplate?: string;
+    /**
+     * Shared secret the tenant worker checks on `/internal/*`
+     * (`WFP_INTERNAL_SYNC_SECRET`). Sent as a bearer token.
+     */
+    internalSecret: string;
+    /** Per-call timeout. Defaults to 15s. */
+    timeoutMs?: number;
+}
+/**
+ * Reaches the team-change requests in a tenant worker's own database, for the
+ * `tenant-members-request` operation and its reconcile sweep (issue #1550):
+ * read a request, answer it, and list the ones still pending. One endpoint,
+ * `POST /internal/tenant-member-requests`, takes the action in its body.
+ */
+export declare function createDispatchTenantMemberRequestStore(options: DispatchTenantMemberRequestStoreOptions): TenantMemberRequestStore;

package/dist/types/wfp/index.d.ts

@@ -5,5 +5,8 @@
  * **optional peer dependencies**: install them only if you import this subpath.
  */
 export { createDispatchSyncDefaults, type DispatchSyncDefaultsOptions, } from "./dispatch-sync-defaults";
+export { createDispatchSyncConfig, type DispatchSyncConfigOptions, } from "./dispatch-sync-config";
+export { createDispatchDetach, type DispatchDetachOptions, } from "./dispatch-detach";
+export { createDispatchTenantMemberRequestStore, TENANT_MEMBER_REQUESTS_PATH, type DispatchTenantMemberRequestStoreOptions, } from "./dispatch-tenant-member-requests";
 export { createDispatchRenewSigningCertificates, type DispatchRenewSigningCertificatesOptions, type DispatchRenewSigningCertificatesResult, } from "./dispatch-renew-signing-certificates";
 export { createWfpTenantApp, type WfpTenantEnv, type WfpTenantAppOptions, type WfpSigningCertificateAuthority, } from "./tenant-app";

package/dist/types/wfp/tenant-app.d.ts

@@ -1,6 +1,6 @@
 import { type ExecutionContext } from "hono";
 import { type AuthHeroConfig, type CertificateIssuer, type DataAdapters, type IssuerResolver } from "authhero";
-import { type ControlPlaneDefaultsApplyResult } from "@authhero/multi-tenancy";
+import { type ControlPlaneDefaultsApplyResult, type InheritanceShadowOptions } from "@authhero/multi-tenancy";
 /**
  * Env contract for a WFP tenant worker — the bindings + secrets
  * `createCloudflareWfpD1Provisioner` (and the host's `secrets` resolver) set on
@@ -31,6 +31,15 @@ export interface WfpTenantEnv {
     CONTROL_PLANE_ENCRYPTION_KEY?: string;
     /** Shared secret authenticating control-plane pushes to `/internal/sync-defaults`. */
     WFP_INTERNAL_SYNC_SECRET?: string;
+    /**
+     * The tenant this worker serves, set when the script is provisioned (plain
+     * text binding or secret, next to `ISSUER`). When present,
+     * `/internal/sync-config` refuses a push addressed to any other tenant, so a
+     * misrouted push can never write another tenant's config into this database.
+     * Optional so workers provisioned before it existed keep working; set it from
+     * the provisioner's `secrets` resolver.
+     */
+    TENANT_ID?: string;
     [key: string]: unknown;
 }
 export interface WfpTenantAppOptions<Env extends WfpTenantEnv = WfpTenantEnv> {
@@ -84,6 +93,22 @@ export interface WfpTenantAppOptions<Env extends WfpTenantEnv = WfpTenantEnv> {
      * control plane via `createDispatchRenewSigningCertificates`.
      */
     signingCertificateAuthority?: (env: Env) => WfpSigningCertificateAuthority | undefined;
+    /**
+     * Shadow mode for config inheritance, run in this worker: after a request is
+     * answered, compare what the projected control-plane rows give this tenant
+     * (the runtime fallback) with what its parent chain resolves to, and log the
+     * differences as `cfgdiff` in this tenant's own logs
+     * (`GET /api/v2/logs?q=type:cfgdiff`, forwarded here). Never changes a
+     * response. The comparison runs under `ctx.waitUntil`, so the Worker keeps
+     * it alive after the response; it is sampled and rate-limited like the
+     * colocated shadow mode. `true` uses the defaults.
+     *
+     * The worker only knows the control plane's rows (the ones projected into its
+     * database) and the tenant's own, so it compares against those. If the
+     * tenant's row names a parent this database lacks, the comparison is skipped;
+     * a deeper chain is checked by _Verify_ on the control plane.
+     */
+    inheritanceShadow?: boolean | InheritanceShadowOptions;
 }
 export interface WfpSigningCertificateAuthority {
     issuer: CertificateIssuer;

package/dist/types/workflows/detach-operation.d.ts

@@ -0,0 +1,31 @@
+import { type StepConfig, type StepRunner, type DetachConfigFn, type TenantOperationStores } from "@authhero/multi-tenancy";
+import type { TenantOperationWorkflowParams } from "./types";
+export type DetachStepName = "mark-running" | "detach" | "mark-succeeded" | "mark-failed";
+export interface DetachOperationDeps {
+    /** Control-plane operation log stores. */
+    stores: TenantOperationStores;
+    /**
+     * How the detach reaches the tenant's database, for example
+     * `createDispatchDetach(...)`.
+     */
+    detachTenant: DetachConfigFn;
+    /**
+     * Per-step overrides of the retry/timeout defaults. The `detach` step has no
+     * automatic retries unless a host sets them.
+     */
+    stepConfig?: Partial<Record<DetachStepName, StepConfig>>;
+}
+/**
+ * Durable `detach` operation: a synced tenant leaves its parent, as a Workflows
+ * instance that writes to the control-plane operation log at every step
+ * boundary (the same shape as {@link runSyncDefaultsOperation}, and the same
+ * step logic as the inline executor). The operation's `input` (`dry_run`,
+ * `clean`) is read from its row, so nothing but ids crosses the Workflows
+ * boundary.
+ *
+ * A dry run records what would change in the operation's `result` and writes
+ * nothing. Any failure runs `mark-failed` (event + failed row) and rethrows
+ * so the instance ends `errored`; if even that dies, the reconciler copies the
+ * engine's terminal state into the row.
+ */
+export declare function runDetachOperation(deps: DetachOperationDeps, params: TenantOperationWorkflowParams, step: StepRunner): Promise<void>;

package/dist/types/workflows/entrypoint.example.d.ts

@@ -31,6 +31,8 @@
  *   createWfpWorkflowProvisioningHook,
  *   reconcileTenantOperations,
  *   runProvisionOperation,
+ *   runSyncDefaultsOperation,
+ *   runDetachOperation,
  *   type ProvisionOperationDeps,
  *   type TenantOperationWorkflowParams,
  * } from "@authhero/cloudflare-adapter/workflows";
@@ -40,7 +42,11 @@
  *   createWfpTenantProvisioningHook,
  *   CloudflareApiClient,
  * } from "@authhero/cloudflare-adapter";
- * import { createDispatchSyncDefaults } from "@authhero/cloudflare-adapter/wfp";
+ * import {
+ *   createDispatchSyncConfig,
+ *   createDispatchDetach,
+ *   createDispatchSyncDefaults,
+ * } from "@authhero/cloudflare-adapter/wfp";
  *
  * // Host-owned: build every workflow dependency from the worker env. Params
  * // carry only { operation_id, tenant_id, kind } — never secrets.
@@ -69,8 +75,54 @@
  *
  * export class TenantOperationWorkflow extends WorkflowEntrypoint<Env, TenantOperationWorkflowParams> {
  *   async run(event: WorkflowEvent<TenantOperationWorkflowParams>, step: WorkflowStep) {
- *     // CF's WorkflowStep satisfies StepRunner structurally.
- *     await runProvisionOperation(buildProvisionDeps(this.env), event.payload, step);
+ *     // CF's WorkflowStep satisfies StepRunner structurally. One class runs
+ *     // every kind; params carry the kind, never secrets.
+ *     switch (event.payload.kind) {
+ *       case "detach": {
+ *         const adapters = createControlPlaneAdapters(this.env);
+ *         return runDetachOperation(
+ *           {
+ *             stores: {
+ *               tenantOperations: adapters.tenantOperations!,
+ *               tenantOperationEvents: adapters.tenantOperationEvents!,
+ *             },
+ *             // Checks the tenant row on the control plane, asks the tenant
+ *             // worker's /internal/detach to convert its rows, then marks the
+ *             // control-plane row detached.
+ *             detachTenant: createDispatchDetach({
+ *               dispatcher: this.env.DISPATCHER,
+ *               internalSecret: this.env.WFP_INTERNAL_SYNC_SECRET,
+ *               controlPlaneAdapters: adapters,
+ *             }),
+ *           },
+ *           event.payload,
+ *           step,
+ *         );
+ *       }
+ *       case "sync-defaults": {
+ *         const adapters = createControlPlaneAdapters(this.env);
+ *         return runSyncDefaultsOperation(
+ *           {
+ *             stores: {
+ *               tenantOperations: adapters.tenantOperations!,
+ *               tenantOperationEvents: adapters.tenantOperationEvents!,
+ *             },
+ *             // Reads the chain as stored (ciphertext) and pushes the
+ *             // resolved block to the tenant worker's /internal/sync-config.
+ *             syncConfig: createDispatchSyncConfig({
+ *               dispatcher: this.env.DISPATCHER,
+ *               internalSecret: this.env.WFP_INTERNAL_SYNC_SECRET,
+ *               controlPlaneTenantId: this.env.CONTROL_PLANE_TENANT_ID,
+ *               controlPlaneAdapters: adapters,
+ *             }),
+ *           },
+ *           event.payload,
+ *           step,
+ *         );
+ *       }
+ *       default:
+ *         return runProvisionOperation(buildProvisionDeps(this.env), event.payload, step);
+ *     }
  *   }
  * }
  *
@@ -87,6 +139,14 @@
  *       binding: env.TENANT_OPERATIONS_WORKFLOW,
  *     });
  *     console.log("reconcileTenantOperations", result);
+ *
+ *     // Fleet rollouts of synced config (initMultiTenant's `rollouts`):
+ *     // find tenants whose applied config no longer matches what their
+ *     // parents publish (the safety net for lost write triggers), then start
+ *     // the next wave of every open rollout. Pass a Workflows executor as
+ *     // initMultiTenant's `rolloutExecutor` to run the waves durably.
+ *     //   await reconcileConfigDrift(rollouts);
+ *     //   await advanceRollouts(rollouts);
  *   },
  * };
  *

package/dist/types/workflows/index.d.ts

@@ -13,6 +13,8 @@
  * structurally.
  */
 export { runProvisionOperation, type ProvisionOperationDeps, type ProvisionStepName, } from "./provision-operation";
+export { runSyncDefaultsOperation, type SyncDefaultsOperationDeps, type SyncDefaultsStepName, } from "./sync-defaults-operation";
+export { runDetachOperation, type DetachOperationDeps, type DetachStepName, } from "./detach-operation";
 export { createProvisionVerifier, TenantProvisionVerificationError, type ProvisionVerifierOptions, } from "./verify";
 export { createCloudflareWorkflowsExecutor, type CloudflareWorkflowsExecutorOptions, } from "./executor";
 export { reconcileTenantOperations, type ReconcileTenantOperationsOptions, type ReconcileTenantOperationsResult, } from "./reconcile";

package/dist/types/workflows/sync-defaults-operation.d.ts

@@ -0,0 +1,28 @@
+import { type StepConfig, type StepRunner, type SyncConfigFn, type TenantOperationStores } from "@authhero/multi-tenancy";
+import type { TenantOperationWorkflowParams } from "./types";
+export type SyncDefaultsStepName = "mark-running" | "sync-defaults" | "mark-succeeded" | "mark-failed";
+export interface SyncDefaultsOperationDeps {
+    /** Control-plane operation log stores. */
+    stores: TenantOperationStores;
+    /**
+     * How the tenant's resolved config reaches its database, for example
+     * `createDispatchSyncConfig(...)`.
+     */
+    syncConfig: SyncConfigFn;
+    /** Per-step overrides of the retry/timeout defaults. */
+    stepConfig?: Partial<Record<SyncDefaultsStepName, StepConfig>>;
+}
+/**
+ * Durable `sync-defaults` operation: sync one tenant's resolved parent-chain
+ * config into its database as a Workflows instance, writing to the control-plane
+ * operation log at every step boundary (the same shape as
+ * {@link runProvisionOperation}, and the same step logic as the inline
+ * executor). The operation's `input` (`dry_run`, `force`) is read from its row,
+ * so nothing but ids crosses the Workflows boundary.
+ *
+ * A dry run records its diff in the operation's `result` and writes nothing to
+ * the tenant. Any failure runs `mark-failed` (event + failed row) and rethrows
+ * so the instance ends `errored`; if even that dies, the reconciler copies the
+ * engine's terminal state into the row.
+ */
+export declare function runSyncDefaultsOperation(deps: SyncDefaultsOperationDeps, params: TenantOperationWorkflowParams, step: StepRunner): Promise<void>;

package/dist/types/workflows/types.d.ts

@@ -14,8 +14,8 @@
 export interface TenantOperationWorkflowParams {
     operation_id: string;
     tenant_id: string;
-    /** Widened beyond "provision" in later phases (upgrade, backup, …). */
-    kind: "provision";
+    /** Widened beyond these in later phases (upgrade, backup, …). */
+    kind: "provision" | "sync-defaults" | "detach";
 }
 /**
  * Instance status as reported by the engine. The exact value set has

package/dist/wfp.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@authhero/multi-tenancy"),t=require("hono"),n=require("authhero");var r=`tenant-{tenant_id}-auth`,i=3e4,a=`/internal/sync-defaults`;function o(e,t){return e.replace(/\{tenant_id\}/g,t)}function s(t){let{dispatcher:n,scriptNameTemplate:s=r,internalSecret:c,controlPlaneTenantId:l,controlPlaneAdapters:u,entities:d,timeoutMs:f=i}=t;return async t=>{let r=await(0,e.buildControlPlaneDefaultsPayload)(u,l,d,t),i=o(s,t),p=new AbortController,m=setTimeout(()=>p.abort(),f),h;try{h=await n.get(i).fetch(`https://tenant.internal${a}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${c}`},body:JSON.stringify(r),signal:p.signal})}finally{clearTimeout(m)}if(!h.ok){let e=await h.text().catch(()=>``),t=h.headers.get(`x-authhero-error`);throw Error(`sync-defaults push to "${i}" failed: ${h.status}${t?` (${t})`:``} ${e.slice(0,256)}`)}return await h.json()}}var c=`/internal/renew-signing-certificates`;function l(e){let{dispatcher:t,scriptNameTemplate:n=r,internalSecret:a,timeoutMs:s=i}=e;return async e=>{let r=o(n,e),i=new AbortController,l=setTimeout(()=>i.abort(),s);try{let e=await t.get(r).fetch(`https://tenant.internal${c}`,{method:`POST`,headers:{authorization:`Bearer ${a}`},signal:i.signal});if(!e.ok){let t=await e.text().catch(()=>``),n=e.headers.get(`x-authhero-error`);throw Error(`signing-certificate renewal for "${r}" failed: ${e.status}${n?` (${n})`:``} ${t.slice(0,512)}`)}let n=await e.json();if(!u(n))throw Error(`signing-certificate renewal for "${r}" returned an unexpected body`);return{renewed:n.renewed,notDue:n.notDue}}finally{clearTimeout(l)}}}function u(e){return typeof e==`object`&&!!e&&`renewed`in e&&`notDue`in e&&Array.isArray(e.renewed)&&e.renewed.every(e=>typeof e==`string`)&&typeof e.notDue==`number`}var d=`cp`,f=`/internal/sync-defaults`,p=`/internal/renew-signing-certificates`;function m(e,t,n,r){console.error(`[wfp-tenant] ${t}:`,n);let i=n instanceof Error?n.message:String(n);return e.header(`X-Authhero-Error`,t),e.json({error:t,detail:i,result:r},500)}function h(e){let t=`${n.TENANT_URI_PREFIX}${e.tenantId}`;return{issuer:e.issuer,validityDays:e.validityDays,subjectUri:()=>t}}function g(e){return({tenant_id:t})=>t===e.CONTROL_PLANE_TENANT_ID?[e.CONTROL_PLANE_ISSUER]:[]}async function _(r,i){let a=r.CONTROL_PLANE_TENANT_ID,o=await(0,n.loadEncryptionKey)(r.ENCRYPTION_KEY),s=r.CONTROL_PLANE_ENCRYPTION_KEY?{default:o,keys:{[d]:await(0,n.loadEncryptionKey)(r.CONTROL_PLANE_ENCRYPTION_KEY)}}:{default:o},c=(0,n.createEncryptedDataAdapterWithKeyRing)(i.createDataAdapter(r),s,{resolveEncryptKeyId:e=>e===a?d:void 0}),l=(0,e.withRuntimeFallback)(c,{controlPlaneTenantId:a}),u=i.signingCertificateAuthority?.(r),_=u?h(u):void 0,v={dataAdapter:l,..._?{signingCertificateAuthority:_}:{},additionalIssuers:(i.additionalIssuers??g)(r)},y=i.configure?i.configure(v,r):v,b=y.signingCertificateAuthority,{app:x}=(0,n.init)(y),S=new t.Hono;return S.post(f,async t=>{let o=r.WFP_INTERNAL_SYNC_SECRET,s=t.req.header(`authorization`);if(!o||s!==`Bearer ${o}`)return t.json({error:`unauthorized`},401);let l;try{l=await t.req.json()}catch{return t.json({error:`invalid JSON`},400)}let u;try{u=await(0,e.applyControlPlaneDefaultsPayload)(l,c,a,{continueOnError:i.continueOnError??!0})}catch(e){return m(t,`sync_defaults_apply_failed`,e)}let d;try{d={created:(await(0,n.ensureSigningKey)(c.keys,{name:r.ISSUER,certificateAuthority:b})).created}}catch(e){return m(t,`sync_defaults_signing_key_failed`,e,u)}if(i.onSyncResult)try{await i.onSyncResult(u,r)}catch(e){return m(t,`sync_defaults_on_result_failed`,e,u)}return t.json({...u,signingKey:d})}),S.post(p,async e=>{let t=r.WFP_INTERNAL_SYNC_SECRET,i=e.req.header(`authorization`);if(!t||i!==`Bearer ${t}`)return e.json({error:`unauthorized`},401);if(!b)return e.json({error:`no signing certificate authority`},404);try{let t=await(0,n.renewSigningCertificates)({dataAdapter:{keys:c.keys},certificateAuthority:b});return e.json({renewed:t.renewed,notDue:t.notDue})}catch(t){return t instanceof n.SigningCertificateRenewalError?(console.error(`[wfp-tenant] signing_certificate_renewal_failed:`,t),e.header(`X-Authhero-Error`,`signing_certificate_renewal_failed`),e.json({error:`signing_certificate_renewal_failed`,renewed:t.result.renewed,notDue:t.result.notDue,failed:t.result.failed.map(({kid:e,error:t})=>({kid:e,detail:t instanceof Error?t.message:String(t)}))},500)):m(e,`signing_certificate_renewal_failed`,t)}}),S.route(`/`,x),S}function v(e){let t=new WeakMap;return{fetch(n,r,i){let a=t.get(r);return a||(a=_(r,e),t.set(r,a)),a.then(e=>e.fetch(n,r,i))}}}exports.createDispatchRenewSigningCertificates=l,exports.createDispatchSyncDefaults=s,exports.createWfpTenantApp=v;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@authhero/multi-tenancy"),t=require("hono"),n=require("authhero");var r=`tenant-{tenant_id}-auth`,i=3e4,a=`/internal/sync-defaults`;function o(e,t){return e.replace(/\{tenant_id\}/g,t)}function s(t){let{dispatcher:n,scriptNameTemplate:s=r,internalSecret:c,controlPlaneTenantId:l,controlPlaneAdapters:u,entities:d,timeoutMs:f=i}=t;return async t=>{let r=await(0,e.buildControlPlaneDefaultsPayload)(u,l,d,t),i=o(s,t),p=new AbortController,m=setTimeout(()=>p.abort(),f),h;try{h=await n.get(i).fetch(`https://tenant.internal${a}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${c}`},body:JSON.stringify(r),signal:p.signal})}finally{clearTimeout(m)}if(!h.ok){let e=await h.text().catch(()=>``),t=h.headers.get(`x-authhero-error`);throw Error(`sync-defaults push to "${i}" failed: ${h.status}${t?` (${t})`:``} ${e.slice(0,256)}`)}return await h.json()}}var c=`/internal/sync-config`;function l(t){let{dispatcher:n,scriptNameTemplate:a=r,internalSecret:s,controlPlaneTenantId:l,controlPlaneAdapters:u,maxDepth:d,timeoutMs:f=i}=t;return async(t,{dryRun:r,force:i,prune:p})=>{if((await u.tenants.get(t))?.config_sync===`detached`)throw Error(`Tenant "${t}" is detached from its parent: set config_sync back to "inherit-on-read" or "synced" before syncing it`);let m=await(0,e.buildResolvedConfigBlock)(u,t,{legacyControlPlane:l,maxDepth:d}),h=o(a,t),g=new AbortController,_=setTimeout(()=>g.abort(),f),v;try{v=await n.get(h).fetch(`https://tenant.internal${c}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${s}`},body:JSON.stringify({tenantId:t,resolved:m,dryRun:r,force:i,prune:p}),signal:g.signal})}finally{clearTimeout(_)}if(!v.ok){let e=await v.text().catch(()=>``),t=v.headers.get(`x-authhero-error`);throw Error(`sync-config push to "${h}" failed: ${v.status}${t?` (${t})`:``} ${e.slice(0,256)}`)}return await v.json()}}var u=`/internal/detach`,d=12e4;function f(t){let{dispatcher:n,scriptNameTemplate:i=r,internalSecret:a,controlPlaneAdapters:s,timeoutMs:c=d}=t;return async(t,{dryRun:r,clean:l})=>{let d=await s.tenants.get(t);if(!d)throw Error(`Tenant "${t}" not found`);if(d.config_sync===`detached`)return(0,e.emptyDetachResult)(`already-detached`);(0,e.assertDetachEligible)(t,d);let f=o(i,t),p=new AbortController,m=setTimeout(()=>p.abort(),c),h;try{h=await n.get(f).fetch(`https://tenant.internal${u}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${a}`},body:JSON.stringify({tenantId:t,dryRun:r,clean:l}),signal:p.signal})}finally{clearTimeout(m)}if(!h.ok){let e=await h.text().catch(()=>``),t=h.headers.get(`x-authhero-error`);throw Error(`detach push to "${f}" failed: ${h.status}${t?` (${t})`:``} ${e.slice(0,256)}`)}let g=await h.json();return!r&&g.status===`detached`&&await(0,e.markTenantDetached)(s,t),g}}var p=`/internal/tenant-member-requests`,m=15e3;function h(e){let{dispatcher:t,scriptNameTemplate:n=r,internalSecret:i,timeoutMs:a=m}=e;async function s(e,r){let s=o(n,e),c=new AbortController,l=setTimeout(()=>c.abort(),a);try{return await t.get(s).fetch(`https://tenant.internal${p}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${i}`},body:JSON.stringify({tenantId:e,...r}),signal:c.signal})}finally{clearTimeout(l)}}async function c(e,t){let n=await t.text().catch(()=>``),r=t.headers.get(`x-authhero-error`);return Error(`tenant member requests of "${e}" answered ${t.status}${r?` (${r})`:``} ${n.slice(0,256)}`)}return{async get(e,t){let n=await s(e,{action:`get`,id:t});if(n.status===404)return null;if(!n.ok)throw await c(e,n);return await n.json()},async report(e,t,n){let r=await s(e,{action:`report`,id:t,outcome:n});if(!r.ok)throw await c(e,r);return(await r.json()).updated},async listPending(e,{olderThan:t}){let n=await s(e,{action:`list_pending`,olderThan:t});if(!n.ok)throw await c(e,n);return(await n.json()).requests}}}var g=`/internal/renew-signing-certificates`;function _(e){let{dispatcher:t,scriptNameTemplate:n=r,internalSecret:a,timeoutMs:s=i}=e;return async e=>{let r=o(n,e),i=new AbortController,c=setTimeout(()=>i.abort(),s);try{let e=await t.get(r).fetch(`https://tenant.internal${g}`,{method:`POST`,headers:{authorization:`Bearer ${a}`},signal:i.signal});if(!e.ok){let t=await e.text().catch(()=>``),n=e.headers.get(`x-authhero-error`);throw Error(`signing-certificate renewal for "${r}" failed: ${e.status}${n?` (${n})`:``} ${t.slice(0,512)}`)}let n=await e.json();if(!v(n))throw Error(`signing-certificate renewal for "${r}" returned an unexpected body`);return{renewed:n.renewed,notDue:n.notDue}}finally{clearTimeout(c)}}}function v(e){return typeof e==`object`&&!!e&&`renewed`in e&&`notDue`in e&&Array.isArray(e.renewed)&&e.renewed.every(e=>typeof e==`string`)&&typeof e.notDue==`number`}var y=`cp`,b=`/internal/sync-defaults`,x=`/internal/sync-config`,S=`/internal/detach`,C=`/internal/tenant-member-requests`,w=`/internal/renew-signing-certificates`;function T(e,t,n,r){console.error(`[wfp-tenant] ${t}:`,n);let i=n instanceof Error?n.message:String(n);return e.header(`X-Authhero-Error`,t),e.json({error:t,detail:i,result:r},500)}function E(e){let t=`${n.TENANT_URI_PREFIX}${e.tenantId}`;return{issuer:e.issuer,validityDays:e.validityDays,subjectUri:()=>t}}function D(e){return({tenant_id:t})=>t===e.CONTROL_PLANE_TENANT_ID?[e.CONTROL_PLANE_ISSUER]:[]}async function O(r,i){let a=r.CONTROL_PLANE_TENANT_ID,o=await(0,n.loadEncryptionKey)(r.ENCRYPTION_KEY),s=r.CONTROL_PLANE_ENCRYPTION_KEY?{default:o,keys:{[y]:await(0,n.loadEncryptionKey)(r.CONTROL_PLANE_ENCRYPTION_KEY)}}:{default:o},c=i.createDataAdapter(r),l=(0,n.createEncryptedDataAdapterWithKeyRing)(c,s,{resolveEncryptKeyId:e=>e===a?y:void 0}),u=(0,e.withRuntimeFallback)(l,{controlPlaneTenantId:a}),d=i.signingCertificateAuthority?.(r),f=d?E(d):void 0,p={dataAdapter:u,...f?{signingCertificateAuthority:f}:{},additionalIssuers:(i.additionalIssuers??D)(r)},m=i.configure?i.configure(p,r):p,h=m.signingCertificateAuthority,{app:g}=(0,n.init)(m),_=new t.Hono;if(_.post(b,async t=>{let o=r.WFP_INTERNAL_SYNC_SECRET,s=t.req.header(`authorization`);if(!o||s!==`Bearer ${o}`)return t.json({error:`unauthorized`},401);let c;try{c=await t.req.json()}catch{return t.json({error:`invalid JSON`},400)}let u;try{u=await(0,e.applyControlPlaneDefaultsPayload)(c,l,a,{continueOnError:i.continueOnError??!0})}catch(e){return T(t,`sync_defaults_apply_failed`,e)}let d;try{d={created:(await(0,n.ensureSigningKey)(l.keys,{name:r.ISSUER,certificateAuthority:h})).created}}catch(e){return T(t,`sync_defaults_signing_key_failed`,e,u)}if(i.onSyncResult)try{await i.onSyncResult(u,r)}catch(e){return T(t,`sync_defaults_on_result_failed`,e,u)}return t.json({...u,signingKey:d})}),_.post(x,async t=>{let n=r.WFP_INTERNAL_SYNC_SECRET,a=t.req.header(`authorization`);if(!n||a!==`Bearer ${n}`)return t.json({error:`unauthorized`},401);let o;try{o=await t.req.json()}catch{return t.json({error:`invalid JSON`},400)}if(!o.tenantId||!o.resolved)return t.json({error:`tenantId and resolved are required`},400);if(r.TENANT_ID&&o.tenantId!==r.TENANT_ID)return console.error(`[wfp-tenant] sync_config_tenant_mismatch: push for "${o.tenantId}" reached the worker of "${r.TENANT_ID}"`),t.header(`X-Authhero-Error`,`sync_config_tenant_mismatch`),t.json({error:`sync_config_tenant_mismatch`},403);try{let n=await(0,e.applyResolvedConfigBlock)(o.resolved,c,o.tenantId,{dryRun:o.dryRun===!0,force:o.force===!0,prune:o.prune===!0,keyRing:s,continueOnError:i.continueOnError??!0});return t.json(n)}catch(e){return e instanceof Error&&/key ring cannot decrypt/.test(e.message)?(console.error(`[wfp-tenant] sync_config_key_ring:`,e),t.header(`X-Authhero-Error`,`sync_config_key_ring`),t.json({error:`sync_config_key_ring`,detail:e.message},422)):T(t,`sync_config_apply_failed`,e)}}),_.post(S,async t=>{let n=r.WFP_INTERNAL_SYNC_SECRET,i=t.req.header(`authorization`);if(!n||i!==`Bearer ${n}`)return t.json({error:`unauthorized`},401);let a;try{a=await t.req.json()}catch{return t.json({error:`invalid JSON`},400)}if(!a.tenantId)return t.json({error:`tenantId is required`},400);if(r.TENANT_ID&&a.tenantId!==r.TENANT_ID)return console.error(`[wfp-tenant] detach_tenant_mismatch: detach for "${a.tenantId}" reached the worker of "${r.TENANT_ID}"`),t.header(`X-Authhero-Error`,`detach_tenant_mismatch`),t.json({error:`detach_tenant_mismatch`},403);try{let n=await(0,e.detachTenantRows)(c,a.tenantId,{dryRun:a.dryRun===!0,clean:a.clean===!0});return n.status===`detached`&&await(0,e.markTenantDetached)(c,a.tenantId),t.json(n)}catch(e){return T(t,`detach_failed`,e)}}),_.post(C,async e=>{let t=r.WFP_INTERNAL_SYNC_SECRET,n=e.req.header(`authorization`);if(!t||n!==`Bearer ${t}`)return e.json({error:`unauthorized`},401);let i;try{i=await e.req.json()}catch{return e.json({error:`invalid JSON`},400)}if(!i.tenantId)return e.json({error:`tenantId is required`},400);if(r.TENANT_ID&&i.tenantId!==r.TENANT_ID)return console.error(`[wfp-tenant] member_requests_tenant_mismatch: a request for "${i.tenantId}" reached the worker of "${r.TENANT_ID}"`),e.header(`X-Authhero-Error`,`member_requests_tenant_mismatch`),e.json({error:`member_requests_tenant_mismatch`},403);let a=c.tenantMemberRequests;if(!a)return e.json({error:`tenant member requests are not available`},501);try{switch(i.action){case`get`:{if(!i.id)return e.json({error:`id is required`},400);let t=await a.get(i.tenantId,i.id);return t?e.json(t):e.json({error:`not_found`},404)}case`report`:{let{status:t,result:n,error:r}=i.outcome??{};if(!i.id||t!==`succeeded`&&t!==`failed`)return e.json({error:`id and a final status are required`},400);let o=await a.update(i.tenantId,i.id,{status:t,result:n??null,error:r??null,finished_at:new Date().toISOString()},`pending`);return e.json({updated:o})}case`list_pending`:{let t=await a.list(i.tenantId,{status:`pending`,created_before:i.olderThan,per_page:100});return e.json({requests:t.requests})}default:return e.json({error:`unknown action`},400)}}catch(t){return T(e,`member_requests_failed`,t)}}),_.post(w,async e=>{let t=r.WFP_INTERNAL_SYNC_SECRET,i=e.req.header(`authorization`);if(!t||i!==`Bearer ${t}`)return e.json({error:`unauthorized`},401);if(!h)return e.json({error:`no signing certificate authority`},404);try{let t=await(0,n.renewSigningCertificates)({dataAdapter:{keys:l.keys},certificateAuthority:h});return e.json({renewed:t.renewed,notDue:t.notDue})}catch(t){return t instanceof n.SigningCertificateRenewalError?(console.error(`[wfp-tenant] signing_certificate_renewal_failed:`,t),e.header(`X-Authhero-Error`,`signing_certificate_renewal_failed`),e.json({error:`signing_certificate_renewal_failed`,renewed:t.result.renewed,notDue:t.result.notDue,failed:t.result.failed.map(({kid:e,error:t})=>({kid:e,detail:t instanceof Error?t.message:String(t)}))},500)):T(e,`signing_certificate_renewal_failed`,t)}}),_.route(`/`,g),i.inheritanceShadow){let t=(0,e.createShadowReporter)(l,i.inheritanceShadow===!0?{}:i.inheritanceShadow),n=r.TENANT_ID||new URL(r.ISSUER).hostname.split(`.`)[0],o,s=async()=>{let e=await l.tenants.get(n);for(let t=0;t<5;t++){let t=e?.parent_tenant_id;if(!t||t===a)return!0;if(e=await l.tenants.get(t),!e)return!1}return!1};k.set(_,e=>{if(!new URL(e.url).pathname.startsWith(`/internal/`)&&n!==a)return(async()=>{if(!await(o??=s()))return;let e=t.schedule(n,a);e&&await e})()})}return _}var k=new WeakMap;function A(e){let t=new WeakMap;return{fetch(n,r,i){let a=t.get(r);return a||(a=O(r,e),t.set(r,a)),a.then(async e=>{let t=await e.fetch(n,r,i),a=k.get(e)?.(n);return a&&i.waitUntil(a),t})}}}exports.TENANT_MEMBER_REQUESTS_PATH=p,exports.createDispatchDetach=f,exports.createDispatchRenewSigningCertificates=_,exports.createDispatchSyncConfig=l,exports.createDispatchSyncDefaults=s,exports.createDispatchTenantMemberRequestStore=h,exports.createWfpTenantApp=A;

package/dist/wfp.d.ts

@@ -1,5 +1,5 @@
 import { DataAdapters } from '@authhero/adapter-interfaces';
-import { DefaultsPayloadEntities, ControlPlaneDefaultsApplyResult } from '@authhero/multi-tenancy';
+import { DefaultsPayloadEntities, ControlPlaneDefaultsApplyResult, SyncConfigFn, DetachConfigFn, TenantMemberRequestStore, InheritanceShadowOptions } from '@authhero/multi-tenancy';
 import { ExecutionContext } from 'hono';
 import { DataAdapters as DataAdapters$1, AuthHeroConfig, IssuerResolver, CertificateIssuer } from 'authhero';
 
@@ -60,6 +60,92 @@ interface DispatchSyncDefaultsOptions {
  */
 declare function createDispatchSyncDefaults(options: DispatchSyncDefaultsOptions): (tenantId: string) => Promise<ControlPlaneDefaultsApplyResult>;
 
+interface DispatchSyncConfigOptions {
+    /** The dispatch namespace binding the tenant workers live in. */
+    dispatcher: DispatchNamespace;
+    /** Script-name convention. Supports `{tenant_id}`. */
+    scriptNameTemplate?: string;
+    /**
+     * Shared secret the tenant worker checks on `/internal/sync-config`
+     * (`WFP_INTERNAL_SYNC_SECRET`). Sent as a bearer token.
+     */
+    internalSecret: string;
+    /**
+     * The control plane, used as implicit parent for tenants without a
+     * `parent_tenant_id`.
+     */
+    controlPlaneTenantId: string;
+    /**
+     * Adapters for reading the chain. Use the layer that returns secrets as
+     * stored (ciphertext): they are copied without being decrypted.
+     */
+    controlPlaneAdapters: DataAdapters;
+    /** Maximum ancestors, see `resolveTenantChain`. */
+    maxDepth?: number;
+    /** Per-push timeout. Defaults to 30s. */
+    timeoutMs?: number;
+}
+/**
+ * Builds the `sync-defaults` operation's transport for tenants with their own
+ * worker and database: resolve the tenant's chain on the control plane, push
+ * the resolved block to the tenant worker's `/internal/sync-config`, and return
+ * what it applied (or, for a dry run, what it would). The tenant worker never
+ * calls back to the control plane. Rejects when the push fails or the worker
+ * answers non-2xx, which fails the operation.
+ */
+declare function createDispatchSyncConfig(options: DispatchSyncConfigOptions): SyncConfigFn;
+
+interface DispatchDetachOptions {
+    /** The dispatch namespace binding the tenant workers live in. */
+    dispatcher: DispatchNamespace;
+    /** Script-name convention. Supports `{tenant_id}`. */
+    scriptNameTemplate?: string;
+    /**
+     * Shared secret the tenant worker checks on `/internal/detach`
+     * (`WFP_INTERNAL_SYNC_SECRET`). Sent as a bearer token.
+     */
+    internalSecret: string;
+    /**
+     * The control plane's adapters, where the tenant row that decides lives. Use
+     * the raw layer.
+     */
+    controlPlaneAdapters: DataAdapters;
+    /** Per-push timeout. Defaults to 120s. */
+    timeoutMs?: number;
+}
+/**
+ * Builds the `detach` operation's transport for tenants with their own worker
+ * and database. The control plane checks that the tenant can be detached from
+ * its own tenant row, asks the tenant worker to convert (or remove) the copies
+ * in its database, and only when that went through marks its own tenant row
+ * detached. A preview or a partial result leaves the row as it was, so a retry
+ * can finish the job. Rejects when the push fails or the worker answers non-2xx,
+ * which fails the operation.
+ */
+declare function createDispatchDetach(options: DispatchDetachOptions): DetachConfigFn;
+
+declare const TENANT_MEMBER_REQUESTS_PATH = "/internal/tenant-member-requests";
+interface DispatchTenantMemberRequestStoreOptions {
+    /** The dispatch namespace binding the tenant workers live in. */
+    dispatcher: DispatchNamespace;
+    /** Script-name convention. Supports `{tenant_id}`. */
+    scriptNameTemplate?: string;
+    /**
+     * Shared secret the tenant worker checks on `/internal/*`
+     * (`WFP_INTERNAL_SYNC_SECRET`). Sent as a bearer token.
+     */
+    internalSecret: string;
+    /** Per-call timeout. Defaults to 15s. */
+    timeoutMs?: number;
+}
+/**
+ * Reaches the team-change requests in a tenant worker's own database, for the
+ * `tenant-members-request` operation and its reconcile sweep (issue #1550):
+ * read a request, answer it, and list the ones still pending. One endpoint,
+ * `POST /internal/tenant-member-requests`, takes the action in its body.
+ */
+declare function createDispatchTenantMemberRequestStore(options: DispatchTenantMemberRequestStoreOptions): TenantMemberRequestStore;
+
 interface DispatchRenewSigningCertificatesOptions {
     /** The dispatch namespace binding the tenant workers live in. */
     dispatcher: DispatchNamespace;
@@ -117,6 +203,15 @@ interface WfpTenantEnv {
     CONTROL_PLANE_ENCRYPTION_KEY?: string;
     /** Shared secret authenticating control-plane pushes to `/internal/sync-defaults`. */
     WFP_INTERNAL_SYNC_SECRET?: string;
+    /**
+     * The tenant this worker serves, set when the script is provisioned (plain
+     * text binding or secret, next to `ISSUER`). When present,
+     * `/internal/sync-config` refuses a push addressed to any other tenant, so a
+     * misrouted push can never write another tenant's config into this database.
+     * Optional so workers provisioned before it existed keep working; set it from
+     * the provisioner's `secrets` resolver.
+     */
+    TENANT_ID?: string;
     [key: string]: unknown;
 }
 interface WfpTenantAppOptions<Env extends WfpTenantEnv = WfpTenantEnv> {
@@ -170,6 +265,22 @@ interface WfpTenantAppOptions<Env extends WfpTenantEnv = WfpTenantEnv> {
      * control plane via `createDispatchRenewSigningCertificates`.
      */
     signingCertificateAuthority?: (env: Env) => WfpSigningCertificateAuthority | undefined;
+    /**
+     * Shadow mode for config inheritance, run in this worker: after a request is
+     * answered, compare what the projected control-plane rows give this tenant
+     * (the runtime fallback) with what its parent chain resolves to, and log the
+     * differences as `cfgdiff` in this tenant's own logs
+     * (`GET /api/v2/logs?q=type:cfgdiff`, forwarded here). Never changes a
+     * response. The comparison runs under `ctx.waitUntil`, so the Worker keeps
+     * it alive after the response; it is sampled and rate-limited like the
+     * colocated shadow mode. `true` uses the defaults.
+     *
+     * The worker only knows the control plane's rows (the ones projected into its
+     * database) and the tenant's own, so it compares against those. If the
+     * tenant's row names a parent this database lacks, the comparison is skipped;
+     * a deeper chain is checked by _Verify_ on the control plane.
+     */
+    inheritanceShadow?: boolean | InheritanceShadowOptions;
 }
 interface WfpSigningCertificateAuthority {
     issuer: CertificateIssuer;
@@ -193,5 +304,5 @@ declare function createWfpTenantApp<Env extends WfpTenantEnv = WfpTenantEnv>(opt
     fetch: (request: Request, env: Env, ctx: ExecutionContext) => Promise<Response>;
 };
 
-export { createDispatchRenewSigningCertificates, createDispatchSyncDefaults, createWfpTenantApp };
-export type { DispatchRenewSigningCertificatesOptions, DispatchRenewSigningCertificatesResult, DispatchSyncDefaultsOptions, WfpSigningCertificateAuthority, WfpTenantAppOptions, WfpTenantEnv };
+export { TENANT_MEMBER_REQUESTS_PATH, createDispatchDetach, createDispatchRenewSigningCertificates, createDispatchSyncConfig, createDispatchSyncDefaults, createDispatchTenantMemberRequestStore, createWfpTenantApp };
+export type { DispatchDetachOptions, DispatchRenewSigningCertificatesOptions, DispatchRenewSigningCertificatesResult, DispatchSyncConfigOptions, DispatchSyncDefaultsOptions, DispatchTenantMemberRequestStoreOptions, WfpSigningCertificateAuthority, WfpTenantAppOptions, WfpTenantEnv };