@authhero/cloudflare-adapter 3.2.5 → 3.4.0

package/dist/wfp.mjs

@@ -1,17 +1,17 @@
-import { applyControlPlaneDefaultsPayload as e, buildControlPlaneDefaultsPayload as t, withRuntimeFallback as n } from "@authhero/multi-tenancy";
-import { Hono as r } from "hono";
-import { SigningCertificateRenewalError as i, TENANT_URI_PREFIX as a, createEncryptedDataAdapterWithKeyRing as o, ensureSigningKey as s, init as c, loadEncryptionKey as l, renewSigningCertificates as u } from "authhero";
+import { applyControlPlaneDefaultsPayload as e, applyResolvedConfigBlock as t, assertDetachEligible as n, buildControlPlaneDefaultsPayload as r, buildResolvedConfigBlock as i, createShadowReporter as a, detachTenantRows as o, emptyDetachResult as s, markTenantDetached as c, withRuntimeFallback as l } from "@authhero/multi-tenancy";
+import { Hono as u } from "hono";
+import { SigningCertificateRenewalError as d, TENANT_URI_PREFIX as f, createEncryptedDataAdapterWithKeyRing as p, ensureSigningKey as m, init as h, loadEncryptionKey as g, renewSigningCertificates as _ } from "authhero";
 //#region src/wfp/dispatch-sync-defaults.ts
-var d = "tenant-{tenant_id}-auth", f = 3e4, p = "/internal/sync-defaults";
-function m(e, t) {
+var v = "tenant-{tenant_id}-auth", y = 3e4, b = "/internal/sync-defaults";
+function x(e, t) {
 	return e.replace(/\{tenant_id\}/g, t);
 }
-function h(e) {
-	let { dispatcher: n, scriptNameTemplate: r = d, internalSecret: i, controlPlaneTenantId: a, controlPlaneAdapters: o, entities: s, timeoutMs: c = f } = e;
+function S(e) {
+	let { dispatcher: t, scriptNameTemplate: n = v, internalSecret: i, controlPlaneTenantId: a, controlPlaneAdapters: o, entities: s, timeoutMs: c = y } = e;
 	return async (e) => {
-		let l = await t(o, a, s, e), u = m(r, e), d = new AbortController(), f = setTimeout(() => d.abort(), c), h;
+		let l = await r(o, a, s, e), u = x(n, e), d = new AbortController(), f = setTimeout(() => d.abort(), c), p;
 		try {
-			h = await n.get(u).fetch(`https://tenant.internal${p}`, {
+			p = await t.get(u).fetch(`https://tenant.internal${b}`, {
 				method: "POST",
 				headers: {
 					"content-type": "application/json",
@@ -23,22 +23,152 @@ function h(e) {
 		} finally {
 			clearTimeout(f);
 		}
+		if (!p.ok) {
+			let e = await p.text().catch(() => ""), t = p.headers.get("x-authhero-error");
+			throw Error(`sync-defaults push to "${u}" failed: ${p.status}${t ? ` (${t})` : ""} ${e.slice(0, 256)}`);
+		}
+		return await p.json();
+	};
+}
+//#endregion
+//#region src/wfp/dispatch-sync-config.ts
+var C = "/internal/sync-config";
+function w(e) {
+	let { dispatcher: t, scriptNameTemplate: n = v, internalSecret: r, controlPlaneTenantId: a, controlPlaneAdapters: o, maxDepth: s, timeoutMs: c = y } = e;
+	return async (e, { dryRun: l, force: u, prune: d }) => {
+		if ((await o.tenants.get(e))?.config_sync === "detached") throw Error(`Tenant "${e}" is detached from its parent: set config_sync back to "inherit-on-read" or "synced" before syncing it`);
+		let f = await i(o, e, {
+			legacyControlPlane: a,
+			maxDepth: s
+		}), p = x(n, e), m = new AbortController(), h = setTimeout(() => m.abort(), c), g;
+		try {
+			g = await t.get(p).fetch(`https://tenant.internal${C}`, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					authorization: `Bearer ${r}`
+				},
+				body: JSON.stringify({
+					tenantId: e,
+					resolved: f,
+					dryRun: l,
+					force: u,
+					prune: d
+				}),
+				signal: m.signal
+			});
+		} finally {
+			clearTimeout(h);
+		}
+		if (!g.ok) {
+			let e = await g.text().catch(() => ""), t = g.headers.get("x-authhero-error");
+			throw Error(`sync-config push to "${p}" failed: ${g.status}${t ? ` (${t})` : ""} ${e.slice(0, 256)}`);
+		}
+		return await g.json();
+	};
+}
+//#endregion
+//#region src/wfp/dispatch-detach.ts
+var T = "/internal/detach", E = 12e4;
+function D(e) {
+	let { dispatcher: t, scriptNameTemplate: r = v, internalSecret: i, controlPlaneAdapters: a, timeoutMs: o = E } = e;
+	return async (e, { dryRun: l, clean: u }) => {
+		let d = await a.tenants.get(e);
+		if (!d) throw Error(`Tenant "${e}" not found`);
+		if (d.config_sync === "detached") return s("already-detached");
+		n(e, d);
+		let f = x(r, e), p = new AbortController(), m = setTimeout(() => p.abort(), o), h;
+		try {
+			h = await t.get(f).fetch(`https://tenant.internal${T}`, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					authorization: `Bearer ${i}`
+				},
+				body: JSON.stringify({
+					tenantId: e,
+					dryRun: l,
+					clean: u
+				}),
+				signal: p.signal
+			});
+		} finally {
+			clearTimeout(m);
+		}
 		if (!h.ok) {
 			let e = await h.text().catch(() => ""), t = h.headers.get("x-authhero-error");
-			throw Error(`sync-defaults push to "${u}" failed: ${h.status}${t ? ` (${t})` : ""} ${e.slice(0, 256)}`);
+			throw Error(`detach push to "${f}" failed: ${h.status}${t ? ` (${t})` : ""} ${e.slice(0, 256)}`);
+		}
+		let g = await h.json();
+		return !l && g.status === "detached" && await c(a, e), g;
+	};
+}
+//#endregion
+//#region src/wfp/dispatch-tenant-member-requests.ts
+var O = "/internal/tenant-member-requests", k = 15e3;
+function A(e) {
+	let { dispatcher: t, scriptNameTemplate: n = v, internalSecret: r, timeoutMs: i = k } = e;
+	async function a(e, a) {
+		let o = x(n, e), s = new AbortController(), c = setTimeout(() => s.abort(), i);
+		try {
+			return await t.get(o).fetch(`https://tenant.internal${O}`, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					authorization: `Bearer ${r}`
+				},
+				body: JSON.stringify({
+					tenantId: e,
+					...a
+				}),
+				signal: s.signal
+			});
+		} finally {
+			clearTimeout(c);
+		}
+	}
+	async function o(e, t) {
+		let n = await t.text().catch(() => ""), r = t.headers.get("x-authhero-error");
+		return /* @__PURE__ */ Error(`tenant member requests of "${e}" answered ${t.status}${r ? ` (${r})` : ""} ${n.slice(0, 256)}`);
+	}
+	return {
+		async get(e, t) {
+			let n = await a(e, {
+				action: "get",
+				id: t
+			});
+			if (n.status === 404) return null;
+			if (!n.ok) throw await o(e, n);
+			return await n.json();
+		},
+		async report(e, t, n) {
+			let r = await a(e, {
+				action: "report",
+				id: t,
+				outcome: n
+			});
+			if (!r.ok) throw await o(e, r);
+			return (await r.json()).updated;
+		},
+		async listPending(e, { olderThan: t }) {
+			let n = await a(e, {
+				action: "list_pending",
+				olderThan: t
+			});
+			if (!n.ok) throw await o(e, n);
+			return (await n.json()).requests;
 		}
-		return await h.json();
 	};
 }
 //#endregion
 //#region src/wfp/dispatch-renew-signing-certificates.ts
-var g = "/internal/renew-signing-certificates";
-function _(e) {
-	let { dispatcher: t, scriptNameTemplate: n = d, internalSecret: r, timeoutMs: i = f } = e;
+var j = "/internal/renew-signing-certificates";
+function M(e) {
+	let { dispatcher: t, scriptNameTemplate: n = v, internalSecret: r, timeoutMs: i = y } = e;
 	return async (e) => {
-		let a = m(n, e), o = new AbortController(), s = setTimeout(() => o.abort(), i);
+		let a = x(n, e), o = new AbortController(), s = setTimeout(() => o.abort(), i);
 		try {
-			let e = await t.get(a).fetch(`https://tenant.internal${g}`, {
+			let e = await t.get(a).fetch(`https://tenant.internal${j}`, {
 				method: "POST",
 				headers: { authorization: `Bearer ${r}` },
 				signal: o.signal
@@ -48,7 +178,7 @@ function _(e) {
 				throw Error(`signing-certificate renewal for "${a}" failed: ${e.status}${n ? ` (${n})` : ""} ${t.slice(0, 512)}`);
 			}
 			let n = await e.json();
-			if (!v(n)) throw Error(`signing-certificate renewal for "${a}" returned an unexpected body`);
+			if (!N(n)) throw Error(`signing-certificate renewal for "${a}" returned an unexpected body`);
 			return {
 				renewed: n.renewed,
 				notDue: n.notDue
@@ -58,13 +188,13 @@ function _(e) {
 		}
 	};
 }
-function v(e) {
+function N(e) {
 	return typeof e == "object" && !!e && "renewed" in e && "notDue" in e && Array.isArray(e.renewed) && e.renewed.every((e) => typeof e == "string") && typeof e.notDue == "number";
 }
 //#endregion
 //#region src/wfp/tenant-app.ts
-var y = "cp", b = "/internal/sync-defaults", x = "/internal/renew-signing-certificates";
-function S(e, t, n, r) {
+var P = "cp", F = "/internal/sync-defaults", I = "/internal/sync-config", L = "/internal/detach", R = "/internal/tenant-member-requests", z = "/internal/renew-signing-certificates";
+function B(e, t, n, r) {
 	console.error(`[wfp-tenant] ${t}:`, n);
 	let i = n instanceof Error ? n.message : String(n);
 	return e.header("X-Authhero-Error", t), e.json({
@@ -73,74 +203,164 @@ function S(e, t, n, r) {
 		result: r
 	}, 500);
 }
-function C(e) {
-	let t = `${a}${e.tenantId}`;
+function V(e) {
+	let t = `${f}${e.tenantId}`;
 	return {
 		issuer: e.issuer,
 		validityDays: e.validityDays,
 		subjectUri: () => t
 	};
 }
-function w(e) {
+function H(e) {
 	return ({ tenant_id: t }) => t === e.CONTROL_PLANE_TENANT_ID ? [e.CONTROL_PLANE_ISSUER] : [];
 }
-async function T(t, a) {
-	let d = t.CONTROL_PLANE_TENANT_ID, f = await l(t.ENCRYPTION_KEY), p = t.CONTROL_PLANE_ENCRYPTION_KEY ? {
-		default: f,
-		keys: { [y]: await l(t.CONTROL_PLANE_ENCRYPTION_KEY) }
-	} : { default: f }, m = o(a.createDataAdapter(t), p, { resolveEncryptKeyId: (e) => e === d ? y : void 0 }), h = n(m, { controlPlaneTenantId: d }), g = a.signingCertificateAuthority?.(t), _ = g ? C(g) : void 0, v = {
-		dataAdapter: h,
-		..._ ? { signingCertificateAuthority: _ } : {},
-		additionalIssuers: (a.additionalIssuers ?? w)(t)
-	}, T = a.configure ? a.configure(v, t) : v, E = T.signingCertificateAuthority, { app: D } = c(T), O = new r();
-	return O.post(b, async (n) => {
-		let r = t.WFP_INTERNAL_SYNC_SECRET, i = n.req.header("authorization");
-		if (!r || i !== `Bearer ${r}`) return n.json({ error: "unauthorized" }, 401);
-		let o;
+async function U(n, r) {
+	let i = n.CONTROL_PLANE_TENANT_ID, s = await g(n.ENCRYPTION_KEY), f = n.CONTROL_PLANE_ENCRYPTION_KEY ? {
+		default: s,
+		keys: { [P]: await g(n.CONTROL_PLANE_ENCRYPTION_KEY) }
+	} : { default: s }, v = r.createDataAdapter(n), y = p(v, f, { resolveEncryptKeyId: (e) => e === i ? P : void 0 }), b = l(y, { controlPlaneTenantId: i }), x = r.signingCertificateAuthority?.(n), S = x ? V(x) : void 0, C = {
+		dataAdapter: b,
+		...S ? { signingCertificateAuthority: S } : {},
+		additionalIssuers: (r.additionalIssuers ?? H)(n)
+	}, w = r.configure ? r.configure(C, n) : C, T = w.signingCertificateAuthority, { app: E } = h(w), D = new u();
+	if (D.post(F, async (t) => {
+		let a = n.WFP_INTERNAL_SYNC_SECRET, o = t.req.header("authorization");
+		if (!a || o !== `Bearer ${a}`) return t.json({ error: "unauthorized" }, 401);
+		let s;
 		try {
-			o = await n.req.json();
+			s = await t.req.json();
 		} catch {
-			return n.json({ error: "invalid JSON" }, 400);
+			return t.json({ error: "invalid JSON" }, 400);
 		}
 		let c;
 		try {
-			c = await e(o, m, d, { continueOnError: a.continueOnError ?? !0 });
+			c = await e(s, y, i, { continueOnError: r.continueOnError ?? !0 });
 		} catch (e) {
-			return S(n, "sync_defaults_apply_failed", e);
+			return B(t, "sync_defaults_apply_failed", e);
 		}
 		let l;
 		try {
-			l = { created: (await s(m.keys, {
-				name: t.ISSUER,
-				certificateAuthority: E
+			l = { created: (await m(y.keys, {
+				name: n.ISSUER,
+				certificateAuthority: T
 			})).created };
 		} catch (e) {
-			return S(n, "sync_defaults_signing_key_failed", e, c);
+			return B(t, "sync_defaults_signing_key_failed", e, c);
 		}
-		if (a.onSyncResult) try {
-			await a.onSyncResult(c, t);
+		if (r.onSyncResult) try {
+			await r.onSyncResult(c, n);
 		} catch (e) {
-			return S(n, "sync_defaults_on_result_failed", e, c);
+			return B(t, "sync_defaults_on_result_failed", e, c);
 		}
-		return n.json({
+		return t.json({
 			...c,
 			signingKey: l
 		});
-	}), O.post(x, async (e) => {
-		let n = t.WFP_INTERNAL_SYNC_SECRET, r = e.req.header("authorization");
-		if (!n || r !== `Bearer ${n}`) return e.json({ error: "unauthorized" }, 401);
-		if (!E) return e.json({ error: "no signing certificate authority" }, 404);
+	}), D.post(I, async (e) => {
+		let i = n.WFP_INTERNAL_SYNC_SECRET, a = e.req.header("authorization");
+		if (!i || a !== `Bearer ${i}`) return e.json({ error: "unauthorized" }, 401);
+		let o;
+		try {
+			o = await e.req.json();
+		} catch {
+			return e.json({ error: "invalid JSON" }, 400);
+		}
+		if (!o.tenantId || !o.resolved) return e.json({ error: "tenantId and resolved are required" }, 400);
+		if (n.TENANT_ID && o.tenantId !== n.TENANT_ID) return console.error(`[wfp-tenant] sync_config_tenant_mismatch: push for "${o.tenantId}" reached the worker of "${n.TENANT_ID}"`), e.header("X-Authhero-Error", "sync_config_tenant_mismatch"), e.json({ error: "sync_config_tenant_mismatch" }, 403);
+		try {
+			let n = await t(o.resolved, v, o.tenantId, {
+				dryRun: o.dryRun === !0,
+				force: o.force === !0,
+				prune: o.prune === !0,
+				keyRing: f,
+				continueOnError: r.continueOnError ?? !0
+			});
+			return e.json(n);
+		} catch (t) {
+			return t instanceof Error && /key ring cannot decrypt/.test(t.message) ? (console.error("[wfp-tenant] sync_config_key_ring:", t), e.header("X-Authhero-Error", "sync_config_key_ring"), e.json({
+				error: "sync_config_key_ring",
+				detail: t.message
+			}, 422)) : B(e, "sync_config_apply_failed", t);
+		}
+	}), D.post(L, async (e) => {
+		let t = n.WFP_INTERNAL_SYNC_SECRET, r = e.req.header("authorization");
+		if (!t || r !== `Bearer ${t}`) return e.json({ error: "unauthorized" }, 401);
+		let i;
 		try {
-			let t = await u({
-				dataAdapter: { keys: m.keys },
-				certificateAuthority: E
+			i = await e.req.json();
+		} catch {
+			return e.json({ error: "invalid JSON" }, 400);
+		}
+		if (!i.tenantId) return e.json({ error: "tenantId is required" }, 400);
+		if (n.TENANT_ID && i.tenantId !== n.TENANT_ID) return console.error(`[wfp-tenant] detach_tenant_mismatch: detach for "${i.tenantId}" reached the worker of "${n.TENANT_ID}"`), e.header("X-Authhero-Error", "detach_tenant_mismatch"), e.json({ error: "detach_tenant_mismatch" }, 403);
+		try {
+			let t = await o(v, i.tenantId, {
+				dryRun: i.dryRun === !0,
+				clean: i.clean === !0
+			});
+			return t.status === "detached" && await c(v, i.tenantId), e.json(t);
+		} catch (t) {
+			return B(e, "detach_failed", t);
+		}
+	}), D.post(R, async (e) => {
+		let t = n.WFP_INTERNAL_SYNC_SECRET, r = e.req.header("authorization");
+		if (!t || r !== `Bearer ${t}`) return e.json({ error: "unauthorized" }, 401);
+		let i;
+		try {
+			i = await e.req.json();
+		} catch {
+			return e.json({ error: "invalid JSON" }, 400);
+		}
+		if (!i.tenantId) return e.json({ error: "tenantId is required" }, 400);
+		if (n.TENANT_ID && i.tenantId !== n.TENANT_ID) return console.error(`[wfp-tenant] member_requests_tenant_mismatch: a request for "${i.tenantId}" reached the worker of "${n.TENANT_ID}"`), e.header("X-Authhero-Error", "member_requests_tenant_mismatch"), e.json({ error: "member_requests_tenant_mismatch" }, 403);
+		let a = v.tenantMemberRequests;
+		if (!a) return e.json({ error: "tenant member requests are not available" }, 501);
+		try {
+			switch (i.action) {
+				case "get": {
+					if (!i.id) return e.json({ error: "id is required" }, 400);
+					let t = await a.get(i.tenantId, i.id);
+					return t ? e.json(t) : e.json({ error: "not_found" }, 404);
+				}
+				case "report": {
+					let { status: t, result: n, error: r } = i.outcome ?? {};
+					if (!i.id || t !== "succeeded" && t !== "failed") return e.json({ error: "id and a final status are required" }, 400);
+					let o = await a.update(i.tenantId, i.id, {
+						status: t,
+						result: n ?? null,
+						error: r ?? null,
+						finished_at: (/* @__PURE__ */ new Date()).toISOString()
+					}, "pending");
+					return e.json({ updated: o });
+				}
+				case "list_pending": {
+					let t = await a.list(i.tenantId, {
+						status: "pending",
+						created_before: i.olderThan,
+						per_page: 100
+					});
+					return e.json({ requests: t.requests });
+				}
+				default: return e.json({ error: "unknown action" }, 400);
+			}
+		} catch (t) {
+			return B(e, "member_requests_failed", t);
+		}
+	}), D.post(z, async (e) => {
+		let t = n.WFP_INTERNAL_SYNC_SECRET, r = e.req.header("authorization");
+		if (!t || r !== `Bearer ${t}`) return e.json({ error: "unauthorized" }, 401);
+		if (!T) return e.json({ error: "no signing certificate authority" }, 404);
+		try {
+			let t = await _({
+				dataAdapter: { keys: y.keys },
+				certificateAuthority: T
 			});
 			return e.json({
 				renewed: t.renewed,
 				notDue: t.notDue
 			});
 		} catch (t) {
-			return t instanceof i ? (console.error("[wfp-tenant] signing_certificate_renewal_failed:", t), e.header("X-Authhero-Error", "signing_certificate_renewal_failed"), e.json({
+			return t instanceof d ? (console.error("[wfp-tenant] signing_certificate_renewal_failed:", t), e.header("X-Authhero-Error", "signing_certificate_renewal_failed"), e.json({
 				error: "signing_certificate_renewal_failed",
 				renewed: t.result.renewed,
 				notDue: t.result.notDue,
@@ -148,16 +368,38 @@ async function T(t, a) {
 					kid: e,
 					detail: t instanceof Error ? t.message : String(t)
 				}))
-			}, 500)) : S(e, "signing_certificate_renewal_failed", t);
+			}, 500)) : B(e, "signing_certificate_renewal_failed", t);
 		}
-	}), O.route("/", D), O;
+	}), D.route("/", E), r.inheritanceShadow) {
+		let e = a(y, r.inheritanceShadow === !0 ? {} : r.inheritanceShadow), t = n.TENANT_ID || new URL(n.ISSUER).hostname.split(".")[0], o, s = async () => {
+			let e = await y.tenants.get(t);
+			for (let t = 0; t < 5; t++) {
+				let t = e?.parent_tenant_id;
+				if (!t || t === i) return !0;
+				if (e = await y.tenants.get(t), !e) return !1;
+			}
+			return !1;
+		};
+		W.set(D, (n) => {
+			if (!new URL(n.url).pathname.startsWith("/internal/") && t !== i) return (async () => {
+				if (!await (o ??= s())) return;
+				let n = e.schedule(t, i);
+				n && await n;
+			})();
+		});
+	}
+	return D;
 }
-function E(e) {
+var W = /* @__PURE__ */ new WeakMap();
+function G(e) {
 	let t = /* @__PURE__ */ new WeakMap();
 	return { fetch(n, r, i) {
 		let a = t.get(r);
-		return a || (a = T(r, e), t.set(r, a)), a.then((e) => e.fetch(n, r, i));
+		return a || (a = U(r, e), t.set(r, a)), a.then(async (e) => {
+			let t = await e.fetch(n, r, i), a = W.get(e)?.(n);
+			return a && i.waitUntil(a), t;
+		});
 	} };
 }
 //#endregion
-export { _ as createDispatchRenewSigningCertificates, h as createDispatchSyncDefaults, E as createWfpTenantApp };
+export { O as TENANT_MEMBER_REQUESTS_PATH, D as createDispatchDetach, M as createDispatchRenewSigningCertificates, w as createDispatchSyncConfig, S as createDispatchSyncDefaults, A as createDispatchTenantMemberRequestStore, G as createWfpTenantApp };

package/dist/workflows.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./sync-defaults-errors-Htp1NWTq.js");let t=require("@authhero/multi-tenancy");var n={retries:{limit:5,delay:`5 seconds`,backoff:`exponential`},timeout:`2 minutes`},r={retries:{limit:8,delay:`10 seconds`,backoff:`exponential`},timeout:`1 minute`};function i(e){return e instanceof Error?e.message:String(e)}async function a(a,o,s){let c=(0,t.createOperationRecorder)(a.stores),l=a.shouldProvision??(e=>e.deployment_type===`wfp`),u=e=>a.stepConfig?.[e]??(e===`verify`?r:n),d=o.operation_id,f=o.tenant_id,p=await s.do(`mark-running`,u(`mark-running`),async()=>{let e=await a.tenants.get(f);if(!e||!l(e))return await c.appendEvent(d,{step:`mark-running`,outcome:`skipped`,detail:{reason:e?`tenant is not WFP-provisioned`:`tenant row missing (rolled back?)`}}),await c.markSucceeded(d),{skipped:!0,scriptName:``,databaseName:``};let t=a.steps.validate(),n=a.steps.names(f);return await c.markRunning(d,`mark-running`),await c.appendEvent(d,{step:`mark-running`,outcome:`succeeded`}),{skipped:!1,...n,...t}});if(p.skipped)return;let m={worker_script_name:p.scriptName,bundle_configuration:p.bundleConfiguration,worker_version:p.workerVersion,database_version:p.databaseVersion};try{let t=await s.do(`create-database`,u(`create-database`),async()=>{await c.setCurrentStep(d,`create-database`);let{id:e,created:t}=await a.steps.findOrCreateDatabase(p.databaseName);return await c.appendEvent(d,{step:`create-database`,outcome:`succeeded`,detail:{database_id:e,created:t}}),{databaseId:e,created:t}});if(m.d1_database_id=t.databaseId,await s.do(`apply-migrations`,u(`apply-migrations`),async()=>{await c.setCurrentStep(d,`apply-migrations`),await a.steps.applyMigrations(t.databaseId,t.created),await c.appendEvent(d,{step:`apply-migrations`,outcome:`succeeded`,detail:{database_version:p.databaseVersion}})}),await s.do(`upload-script`,u(`upload-script`),async()=>{await c.setCurrentStep(d,`upload-script`),await a.steps.uploadScript(p.scriptName,t.databaseId),await c.appendEvent(d,{step:`upload-script`,outcome:`succeeded`,detail:{worker_version:p.workerVersion}})}),await s.do(`upload-secrets`,u(`upload-secrets`),async()=>{await c.setCurrentStep(d,`upload-secrets`),await a.steps.uploadSecrets(p.scriptName,f),await c.appendEvent(d,{step:`upload-secrets`,outcome:`succeeded`})}),a.syncDefaults){let t=a.syncDefaults;await s.do(`seed-defaults`,u(`seed-defaults`),async()=>{await c.setCurrentStep(d,`seed-defaults`);let n=e.t(await t(f));if(n.length>0)throw Error(`sync-defaults seed reported ${n.length} error(s): ${n.join(`; `)}`);await c.appendEvent(d,{step:`seed-defaults`,outcome:`succeeded`})})}if(a.verify){let e=a.verify;await s.do(`verify`,u(`verify`),async()=>{await c.setCurrentStep(d,`verify`),await e(t.databaseId,f),await c.appendEvent(d,{step:`verify`,outcome:`succeeded`})})}await s.do(`mark-ready`,u(`mark-ready`),async()=>{await c.setCurrentStep(d,`mark-ready`),await a.tenants.update(f,{...m,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()}),await c.appendEvent(d,{step:`mark-ready`,outcome:`succeeded`}),await c.markSucceeded(d)})}catch(e){throw await s.do(`mark-failed`,u(`mark-failed`),async()=>{let t=i(e);try{await a.tenants.update(f,{...m,provisioning_state:`failed`,provisioning_error:t.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}catch(e){a.logger?.warn(`Failed to write provisioning_state="failed" for tenant ${f}:`,e)}await c.appendEvent(d,{step:`mark-failed`,outcome:`failed`,detail:{message:t}}),await c.markFailed(d,e)}),e}}var o=class extends Error{checks;constructor(e,t){super(e),this.name=`TenantProvisionVerificationError`,this.checks=t}};function s(e,t){for(let n of e)for(let e of n.results??[])if(!(!e||typeof e!=`object`)){for(let[n,r]of Object.entries(e))if(n===t){if(typeof r==`number`)return r;if(typeof r==`string`&&r!==``&&!isNaN(Number(r)))return Number(r)}}return 0}function c(t){let n=t.minKeys??1;return async(r,i)=>{let a=await t.client.execD1(r,`SELECT (SELECT COUNT(*) FROM keys) AS key_count, (SELECT COUNT(*) FROM tenants WHERE id = '${e.r(i)}') AS tenant_count;`),c=s(a,`key_count`),l=s(a,`tenant_count`),u=[];if(c<n&&u.push(`expected at least ${n} signing key(s) in "keys", found ${c}`),l<1&&u.push(`tenant row "${i}" missing from "tenants"`),u.length>0)throw new o(`Tenant D1 verification failed for "${i}": ${u.join(`; `)}`,{keyCount:c,tenantRowCount:l})}}function l(e){let t=e instanceof Error?e.message:String(e??``);return/already exists|already been created|duplicate/i.test(t)}function u(e){return{engine:`cloudflare-workflows`,async start(n){if(n.kind!==`provision`)throw Error(`The Cloudflare Workflows executor does not support "${n.kind}" operations yet (phase 2 covers provision only)`);if(!n.tenant_id)throw Error(`provision operations require a tenant_id`);let r=n.engine_instance_id??(0,t.buildEngineInstanceId)(n);try{await e.binding.create({id:r,params:{operation_id:n.id,tenant_id:n.tenant_id,kind:n.kind}})}catch(e){if(!l(e))throw e}}}}var d=`cloudflare-workflows`;async function f(e){let{stores:n,tenants:r,binding:i}=e,a=(0,t.createOperationRecorder)(n),o=e.minAgeMs??600*1e3,s=e.limit??100,c=new Date(Date.now()-o).toISOString(),{operations:l}=await n.tenantOperations.list({status:[`pending`,`running`],engine:d,updated_before:c,per_page:s}),u={scanned:l.length,markedFailed:0,markedSucceeded:0,stillRunning:0,instanceMissing:0,errors:0};for(let t of l)try{await p(t)}catch(n){u.errors++,e.logger?.warn(`Failed to reconcile tenant operation ${t.id}:`,n)}return u;async function f(e,t){await a.appendEvent(e.id,{step:e.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`failed`,reason:t}}),await a.markFailed(e.id,t),e.kind===`provision`&&e.tenant_id&&(await r.get(e.tenant_id))?.provisioning_state===`pending`&&await r.update(e.tenant_id,{provisioning_state:`failed`,provisioning_error:t.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}async function p(e){let o=await n.tenantOperations.get(e.id);if(!o||(0,t.isTerminalStatus)(o.status))return;let s=o.engine_instance_id??(0,t.buildEngineInstanceId)(o),c;try{c=await i.get(s)}catch{u.instanceMissing++,u.markedFailed++,await f(o,`engine instance "${s}" not found (expired past retention or never started)`);return}let l=await c.status();if(l.status===`errored`||l.status===`terminated`){let e=typeof l.error==`string`?l.error:l.error?.message??`engine reported ${l.status}`;u.markedFailed++,await f(o,e);return}if(l.status===`complete`){(o.tenant_id?await r.get(o.tenant_id):null)?.provisioning_state===`ready`?(u.markedSucceeded++,await a.appendEvent(o.id,{step:o.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`succeeded`}}),await a.markSucceeded(o.id)):(u.markedFailed++,await f(o,`engine instance completed but the operation was never finalized and the tenant is not ready`));return}u.stillRunning++}}function p(e){let t=e.shouldProvision??(e=>e.deployment_type===`wfp`);return{async onProvision(n,r){let i=await e.tenants.get(n);i&&t(i)&&await e.enqueueOperation({kind:`provision`,tenant_id:n})},async onUpgrade(t,n){await e.inline.onUpgrade(t,n)},async onDeprovision(t){await e.inline.onDeprovision(t)}}}exports.TENANT_OPERATION_ENGINE=d,exports.TenantProvisionVerificationError=o,exports.createCloudflareWorkflowsExecutor=u,exports.createProvisionVerifier=c,exports.createWfpWorkflowProvisioningHook=p,exports.reconcileTenantOperations=f,exports.runProvisionOperation=a;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./sync-defaults-errors-pnzkP88r.js");let t=require("@authhero/multi-tenancy");var n={retries:{limit:5,delay:`5 seconds`,backoff:`exponential`},timeout:`2 minutes`},r={retries:{limit:8,delay:`10 seconds`,backoff:`exponential`},timeout:`1 minute`};function i(e){return e instanceof Error?e.message:String(e)}async function a(a,o,s){let c=(0,t.createOperationRecorder)(a.stores),l=a.shouldProvision??(e=>e.deployment_type===`wfp`),u=e=>a.stepConfig?.[e]??(e===`verify`?r:n),d=o.operation_id,f=o.tenant_id,p=await s.do(`mark-running`,u(`mark-running`),async()=>{let e=await a.tenants.get(f);if(!e||!l(e))return await c.appendEvent(d,{step:`mark-running`,outcome:`skipped`,detail:{reason:e?`tenant is not WFP-provisioned`:`tenant row missing (rolled back?)`}}),await c.markSucceeded(d),{skipped:!0,scriptName:``,databaseName:``};let t=a.steps.validate(),n=a.steps.names(f);return await c.markRunning(d,`mark-running`),await c.appendEvent(d,{step:`mark-running`,outcome:`succeeded`}),{skipped:!1,...n,...t}});if(p.skipped)return;let m={worker_script_name:p.scriptName,bundle_configuration:p.bundleConfiguration,worker_version:p.workerVersion,database_version:p.databaseVersion};try{let t=await s.do(`create-database`,u(`create-database`),async()=>{await c.setCurrentStep(d,`create-database`);let{id:e,created:t}=await a.steps.findOrCreateDatabase(p.databaseName);return await c.appendEvent(d,{step:`create-database`,outcome:`succeeded`,detail:{database_id:e,created:t}}),{databaseId:e,created:t}});if(m.d1_database_id=t.databaseId,await s.do(`apply-migrations`,u(`apply-migrations`),async()=>{await c.setCurrentStep(d,`apply-migrations`),await a.steps.applyMigrations(t.databaseId,t.created),await c.appendEvent(d,{step:`apply-migrations`,outcome:`succeeded`,detail:{database_version:p.databaseVersion}})}),await s.do(`upload-script`,u(`upload-script`),async()=>{await c.setCurrentStep(d,`upload-script`),await a.steps.uploadScript(p.scriptName,t.databaseId),await c.appendEvent(d,{step:`upload-script`,outcome:`succeeded`,detail:{worker_version:p.workerVersion}})}),await s.do(`upload-secrets`,u(`upload-secrets`),async()=>{await c.setCurrentStep(d,`upload-secrets`),await a.steps.uploadSecrets(p.scriptName,f),await c.appendEvent(d,{step:`upload-secrets`,outcome:`succeeded`})}),a.syncDefaults){let t=a.syncDefaults;await s.do(`seed-defaults`,u(`seed-defaults`),async()=>{await c.setCurrentStep(d,`seed-defaults`);let n=e.t(await t(f));if(n.length>0)throw Error(`sync-defaults seed reported ${n.length} error(s): ${n.join(`; `)}`);await c.appendEvent(d,{step:`seed-defaults`,outcome:`succeeded`})})}if(a.verify){let e=a.verify;await s.do(`verify`,u(`verify`),async()=>{await c.setCurrentStep(d,`verify`),await e(t.databaseId,f),await c.appendEvent(d,{step:`verify`,outcome:`succeeded`})})}await s.do(`mark-ready`,u(`mark-ready`),async()=>{await c.setCurrentStep(d,`mark-ready`),await a.tenants.update(f,{...m,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()}),await c.appendEvent(d,{step:`mark-ready`,outcome:`succeeded`}),await c.markSucceeded(d)})}catch(e){throw await s.do(`mark-failed`,u(`mark-failed`),async()=>{let t=i(e);try{await a.tenants.update(f,{...m,provisioning_state:`failed`,provisioning_error:t.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}catch(e){a.logger?.warn(`Failed to write provisioning_state="failed" for tenant ${f}:`,e)}await c.appendEvent(d,{step:`mark-failed`,outcome:`failed`,detail:{message:t}}),await c.markFailed(d,e)}),e}}var o={retries:{limit:3,delay:`5 seconds`,backoff:`exponential`},timeout:`2 minutes`};function s(e){return e instanceof Error?e.message:String(e)}async function c(e,n,r){let i=(0,t.createOperationRecorder)(e.stores),a=t=>e.stepConfig?.[t]??o,c=n.operation_id;try{await r.do(`mark-running`,a(`mark-running`),async()=>{await i.markRunning(c,`sync-defaults`)}),await r.do(`sync-defaults`,a(`sync-defaults`),async()=>{await i.setCurrentStep(c,`sync-defaults`);let n=await e.stores.tenantOperations.get(c);if(!n)throw Error(`Operation "${c}" not found`);let r=await(0,t.runSyncDefaultsStep)({operation:n,syncConfig:e.syncConfig,recorder:i});await i.appendEvent(c,{step:`sync-defaults`,outcome:`succeeded`,detail:r})}),await r.do(`mark-succeeded`,a(`mark-succeeded`),async()=>{await i.markSucceeded(c)})}catch(e){throw await r.do(`mark-failed`,a(`mark-failed`),async()=>{await i.appendEvent(c,{step:`mark-failed`,outcome:`failed`,detail:{message:s(e)}}),await i.markFailed(c,e)}),e}}var l={retries:{limit:3,delay:`5 seconds`,backoff:`exponential`},timeout:`2 minutes`},u={retries:{limit:0,delay:`5 seconds`},timeout:`5 minutes`};function d(e){return e instanceof Error?e.message:String(e)}async function f(e,n,r){let i=(0,t.createOperationRecorder)(e.stores),a=t=>e.stepConfig?.[t]??(t===`detach`?u:l),o=n.operation_id;try{await r.do(`mark-running`,a(`mark-running`),async()=>{await i.markRunning(o,`detach`)}),await r.do(`detach`,a(`detach`),async()=>{await i.setCurrentStep(o,`detach`);let n=await e.stores.tenantOperations.get(o);if(!n)throw Error(`Operation "${o}" not found`);let r=await(0,t.runDetachStep)({operation:n,detachTenant:e.detachTenant,recorder:i});await i.appendEvent(o,{step:`detach`,outcome:`succeeded`,detail:r})}),await r.do(`mark-succeeded`,a(`mark-succeeded`),async()=>{await i.markSucceeded(o)})}catch(e){throw await r.do(`mark-failed`,a(`mark-failed`),async()=>{await i.appendEvent(o,{step:`mark-failed`,outcome:`failed`,detail:{message:d(e)}}),await i.markFailed(o,e)}),e}}var p=class extends Error{checks;constructor(e,t){super(e),this.name=`TenantProvisionVerificationError`,this.checks=t}};function m(e,t){for(let n of e)for(let e of n.results??[])if(!(!e||typeof e!=`object`)){for(let[n,r]of Object.entries(e))if(n===t){if(typeof r==`number`)return r;if(typeof r==`string`&&r!==``&&!isNaN(Number(r)))return Number(r)}}return 0}function h(t){let n=t.minKeys??1;return async(r,i)=>{let a=await t.client.execD1(r,`SELECT (SELECT COUNT(*) FROM keys) AS key_count, (SELECT COUNT(*) FROM tenants WHERE id = '${e.r(i)}') AS tenant_count;`),o=m(a,`key_count`),s=m(a,`tenant_count`),c=[];if(o<n&&c.push(`expected at least ${n} signing key(s) in "keys", found ${o}`),s<1&&c.push(`tenant row "${i}" missing from "tenants"`),c.length>0)throw new p(`Tenant D1 verification failed for "${i}": ${c.join(`; `)}`,{keyCount:o,tenantRowCount:s})}}function g(e){let t=e instanceof Error?e.message:String(e??``);return/already exists|already been created|duplicate/i.test(t)}function _(e){return{engine:`cloudflare-workflows`,async start(n){if(n.kind!==`provision`&&n.kind!==`sync-defaults`&&n.kind!==`detach`)throw Error(`The Cloudflare Workflows executor does not support "${n.kind}" operations yet (it runs provision, sync-defaults and detach)`);if(!n.tenant_id)throw Error(`${n.kind} operations require a tenant_id`);let r=n.engine_instance_id??(0,t.buildEngineInstanceId)(n);try{await e.binding.create({id:r,params:{operation_id:n.id,tenant_id:n.tenant_id,kind:n.kind}})}catch(e){if(!g(e))throw e}}}}var v=`cloudflare-workflows`;async function y(e){let{stores:n,tenants:r,binding:i}=e,a=(0,t.createOperationRecorder)(n),o=e.minAgeMs??600*1e3,s=e.limit??100,c=new Date(Date.now()-o).toISOString(),{operations:l}=await n.tenantOperations.list({status:[`pending`,`running`],engine:v,updated_before:c,per_page:s}),u={scanned:l.length,markedFailed:0,markedSucceeded:0,stillRunning:0,instanceMissing:0,errors:0};for(let t of l)try{await f(t)}catch(n){u.errors++,e.logger?.warn(`Failed to reconcile tenant operation ${t.id}:`,n)}return u;async function d(e,t){await a.appendEvent(e.id,{step:e.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`failed`,reason:t}}),await a.markFailed(e.id,t),e.kind===`provision`&&e.tenant_id&&(await r.get(e.tenant_id))?.provisioning_state===`pending`&&await r.update(e.tenant_id,{provisioning_state:`failed`,provisioning_error:t.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}async function f(e){let o=await n.tenantOperations.get(e.id);if(!o||(0,t.isTerminalStatus)(o.status))return;let s=o.engine_instance_id??(0,t.buildEngineInstanceId)(o),c;try{c=await i.get(s)}catch{u.instanceMissing++,u.markedFailed++,await d(o,`engine instance "${s}" not found (expired past retention or never started)`);return}let l=await c.status();if(l.status===`errored`||l.status===`terminated`){let e=typeof l.error==`string`?l.error:l.error?.message??`engine reported ${l.status}`;u.markedFailed++,await d(o,e);return}if(l.status===`complete`){if(o.kind===`sync-defaults`||o.kind===`detach`){u.markedSucceeded++,await a.appendEvent(o.id,{step:o.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`succeeded`}}),await a.markSucceeded(o.id);return}(o.tenant_id?await r.get(o.tenant_id):null)?.provisioning_state===`ready`?(u.markedSucceeded++,await a.appendEvent(o.id,{step:o.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`succeeded`}}),await a.markSucceeded(o.id)):(u.markedFailed++,await d(o,`engine instance completed but the operation was never finalized and the tenant is not ready`));return}u.stillRunning++}}function b(e){let t=e.shouldProvision??(e=>e.deployment_type===`wfp`);return{async onProvision(n,r){let i=await e.tenants.get(n);i&&t(i)&&await e.enqueueOperation({kind:`provision`,tenant_id:n})},async onUpgrade(t,n){await e.inline.onUpgrade(t,n)},async onDeprovision(t){await e.inline.onDeprovision(t)}}}exports.TENANT_OPERATION_ENGINE=v,exports.TenantProvisionVerificationError=p,exports.createCloudflareWorkflowsExecutor=_,exports.createProvisionVerifier=h,exports.createWfpWorkflowProvisioningHook=b,exports.reconcileTenantOperations=y,exports.runDetachOperation=f,exports.runProvisionOperation=a,exports.runSyncDefaultsOperation=c;

package/dist/workflows.d.ts

@@ -1,5 +1,5 @@
 import { TenantsDataAdapter, TenantOperation } from '@authhero/adapter-interfaces';
-import { TenantOperationStores, StepConfig, StepRunner, TenantOperationExecutor } from '@authhero/multi-tenancy';
+import { TenantOperationStores, StepConfig, StepRunner, SyncConfigFn, DetachConfigFn, TenantOperationExecutor } from '@authhero/multi-tenancy';
 
 interface CfApiClientOptions {
     accountId: string;
@@ -133,8 +133,8 @@ interface TenantProvisionerSteps {
 interface TenantOperationWorkflowParams {
     operation_id: string;
     tenant_id: string;
-    /** Widened beyond "provision" in later phases (upgrade, backup, …). */
-    kind: "provision";
+    /** Widened beyond these in later phases (upgrade, backup, …). */
+    kind: "provision" | "sync-defaults" | "detach";
 }
 /**
  * Instance status as reported by the engine. The exact value set has
@@ -220,6 +220,63 @@ interface ProvisionOperationDeps {
  */
 declare function runProvisionOperation(deps: ProvisionOperationDeps, params: TenantOperationWorkflowParams, step: StepRunner): Promise<void>;
 
+type SyncDefaultsStepName = "mark-running" | "sync-defaults" | "mark-succeeded" | "mark-failed";
+interface SyncDefaultsOperationDeps {
+    /** Control-plane operation log stores. */
+    stores: TenantOperationStores;
+    /**
+     * How the tenant's resolved config reaches its database, for example
+     * `createDispatchSyncConfig(...)`.
+     */
+    syncConfig: SyncConfigFn;
+    /** Per-step overrides of the retry/timeout defaults. */
+    stepConfig?: Partial<Record<SyncDefaultsStepName, StepConfig>>;
+}
+/**
+ * Durable `sync-defaults` operation: sync one tenant's resolved parent-chain
+ * config into its database as a Workflows instance, writing to the control-plane
+ * operation log at every step boundary (the same shape as
+ * {@link runProvisionOperation}, and the same step logic as the inline
+ * executor). The operation's `input` (`dry_run`, `force`) is read from its row,
+ * so nothing but ids crosses the Workflows boundary.
+ *
+ * A dry run records its diff in the operation's `result` and writes nothing to
+ * the tenant. Any failure runs `mark-failed` (event + failed row) and rethrows
+ * so the instance ends `errored`; if even that dies, the reconciler copies the
+ * engine's terminal state into the row.
+ */
+declare function runSyncDefaultsOperation(deps: SyncDefaultsOperationDeps, params: TenantOperationWorkflowParams, step: StepRunner): Promise<void>;
+
+type DetachStepName = "mark-running" | "detach" | "mark-succeeded" | "mark-failed";
+interface DetachOperationDeps {
+    /** Control-plane operation log stores. */
+    stores: TenantOperationStores;
+    /**
+     * How the detach reaches the tenant's database, for example
+     * `createDispatchDetach(...)`.
+     */
+    detachTenant: DetachConfigFn;
+    /**
+     * Per-step overrides of the retry/timeout defaults. The `detach` step has no
+     * automatic retries unless a host sets them.
+     */
+    stepConfig?: Partial<Record<DetachStepName, StepConfig>>;
+}
+/**
+ * Durable `detach` operation: a synced tenant leaves its parent, as a Workflows
+ * instance that writes to the control-plane operation log at every step
+ * boundary (the same shape as {@link runSyncDefaultsOperation}, and the same
+ * step logic as the inline executor). The operation's `input` (`dry_run`,
+ * `clean`) is read from its row, so nothing but ids crosses the Workflows
+ * boundary.
+ *
+ * A dry run records what would change in the operation's `result` and writes
+ * nothing. Any failure runs `mark-failed` (event + failed row) and rethrows
+ * so the instance ends `errored`; if even that dies, the reconciler copies the
+ * engine's terminal state into the row.
+ */
+declare function runDetachOperation(deps: DetachOperationDeps, params: TenantOperationWorkflowParams, step: StepRunner): Promise<void>;
+
 interface ProvisionVerifierOptions {
     client: CloudflareApiClient;
     /** Minimum number of signing keys the tenant D1 must hold. Default 1. */
@@ -388,5 +445,5 @@ interface WfpWorkflowProvisioningHookOptions {
  */
 declare function createWfpWorkflowProvisioningHook(options: WfpWorkflowProvisioningHookOptions): WfpTenantProvisioningHook;
 
-export { TENANT_OPERATION_ENGINE, TenantProvisionVerificationError, createCloudflareWorkflowsExecutor, createProvisionVerifier, createWfpWorkflowProvisioningHook, reconcileTenantOperations, runProvisionOperation };
-export type { CloudflareWorkflowsExecutorOptions, ProvisionOperationDeps, ProvisionStepName, ProvisionVerifierOptions, ReconcileTenantOperationsOptions, ReconcileTenantOperationsResult, TenantOperationWorkflowParams, WfpWorkflowProvisioningHookOptions, WorkflowInstanceHandle, WorkflowInstanceStatus, WorkflowsBinding };
+export { TENANT_OPERATION_ENGINE, TenantProvisionVerificationError, createCloudflareWorkflowsExecutor, createProvisionVerifier, createWfpWorkflowProvisioningHook, reconcileTenantOperations, runDetachOperation, runProvisionOperation, runSyncDefaultsOperation };
+export type { CloudflareWorkflowsExecutorOptions, DetachOperationDeps, DetachStepName, ProvisionOperationDeps, ProvisionStepName, ProvisionVerifierOptions, ReconcileTenantOperationsOptions, ReconcileTenantOperationsResult, SyncDefaultsOperationDeps, SyncDefaultsStepName, TenantOperationWorkflowParams, WfpWorkflowProvisioningHookOptions, WorkflowInstanceHandle, WorkflowInstanceStatus, WorkflowsBinding };