@authhero/cloudflare-adapter 3.3.0 → 4.0.0

package/dist/types/index.d.ts

@@ -23,7 +23,7 @@ export { createAnalyticsEngineOutboxMetricsSink } from "./analytics-engine-outbo
 export type { AnalyticsEngineOutboxMetricsConfig, OutboxMetricRecord, } from "./analytics-engine-outbox-metrics";
 export { createR2SQLLogsAdapter } from "./r2-sql-logs";
 export { createR2SQLStatsAdapter } from "./r2-sql-logs";
-export { createCloudflareWfpD1Provisioner, createWfpProvisionerSteps, createWfpTenantProvisioningHook, createWfpForwardMiddleware, CloudflareApiClient, CloudflareApiError, } from "./wfp-provisioner";
+export { createCloudflareWfpD1Provisioner, createWfpProvisionerSteps, createWfpTenantProvisioningHook, createWfpForwardMiddleware, DEFAULT_LOCAL_PATHS, CloudflareApiClient, CloudflareApiError, } from "./wfp-provisioner";
 export type { CloudflareWfpD1Provisioner, CloudflareWfpD1ProvisionerOptions, TenantProvisionerSteps, TenantProvisionNames, WfpProvisionerSteps, ProvisionResult, ProvisionerMigration, TenantSecretsResolver, WfpTenantProvisioningHook, WfpTenantProvisioningHookOptions, CfApiClientOptions, D1Database, D1QueryResult, ScriptBinding, ScriptUploadOptions, WfpForwardOptions, } from "./wfp-provisioner";
 export interface CloudflareAdapters {
     customDomains: CustomDomainsAdapter;

package/dist/types/wfp/dispatch-detach.d.ts

@@ -0,0 +1,31 @@
+import type { DataAdapters } from "@authhero/adapter-interfaces";
+import { type DetachConfigFn } from "@authhero/multi-tenancy";
+import type { DispatchNamespace } from "../code-executor";
+export interface DispatchDetachOptions {
+    /** The dispatch namespace binding the tenant workers live in. */
+    dispatcher: DispatchNamespace;
+    /** Script-name convention. Supports `{tenant_id}`. */
+    scriptNameTemplate?: string;
+    /**
+     * Shared secret the tenant worker checks on `/internal/detach`
+     * (`WFP_INTERNAL_SYNC_SECRET`). Sent as a bearer token.
+     */
+    internalSecret: string;
+    /**
+     * The control plane's adapters, where the tenant row that decides lives. Use
+     * the raw layer.
+     */
+    controlPlaneAdapters: DataAdapters;
+    /** Per-push timeout. Defaults to 120s. */
+    timeoutMs?: number;
+}
+/**
+ * Builds the `detach` operation's transport for tenants with their own worker
+ * and database. The control plane checks that the tenant can be detached from
+ * its own tenant row, asks the tenant worker to convert (or remove) the copies
+ * in its database, and only when that went through marks its own tenant row
+ * detached. A preview or a partial result leaves the row as it was, so a retry
+ * can finish the job. Rejects when the push fails or the worker answers non-2xx,
+ * which fails the operation.
+ */
+export declare function createDispatchDetach(options: DispatchDetachOptions): DetachConfigFn;

package/dist/types/wfp/dispatch-tenant-member-requests.d.ts

@@ -0,0 +1,23 @@
+import type { TenantMemberRequestStore } from "@authhero/multi-tenancy";
+import type { DispatchNamespace } from "../code-executor";
+export declare const TENANT_MEMBER_REQUESTS_PATH = "/internal/tenant-member-requests";
+export interface DispatchTenantMemberRequestStoreOptions {
+    /** The dispatch namespace binding the tenant workers live in. */
+    dispatcher: DispatchNamespace;
+    /** Script-name convention. Supports `{tenant_id}`. */
+    scriptNameTemplate?: string;
+    /**
+     * Shared secret the tenant worker checks on `/internal/*`
+     * (`WFP_INTERNAL_SYNC_SECRET`). Sent as a bearer token.
+     */
+    internalSecret: string;
+    /** Per-call timeout. Defaults to 15s. */
+    timeoutMs?: number;
+}
+/**
+ * Reaches the team-change requests in a tenant worker's own database, for the
+ * `tenant-members-request` operation and its reconcile sweep (issue #1550):
+ * read a request, answer it, and list the ones still pending. One endpoint,
+ * `POST /internal/tenant-member-requests`, takes the action in its body.
+ */
+export declare function createDispatchTenantMemberRequestStore(options: DispatchTenantMemberRequestStoreOptions): TenantMemberRequestStore;

package/dist/types/wfp/index.d.ts

@@ -6,5 +6,7 @@
  */
 export { createDispatchSyncDefaults, type DispatchSyncDefaultsOptions, } from "./dispatch-sync-defaults";
 export { createDispatchSyncConfig, type DispatchSyncConfigOptions, } from "./dispatch-sync-config";
+export { createDispatchDetach, type DispatchDetachOptions, } from "./dispatch-detach";
+export { createDispatchTenantMemberRequestStore, TENANT_MEMBER_REQUESTS_PATH, type DispatchTenantMemberRequestStoreOptions, } from "./dispatch-tenant-member-requests";
 export { createDispatchRenewSigningCertificates, type DispatchRenewSigningCertificatesOptions, type DispatchRenewSigningCertificatesResult, } from "./dispatch-renew-signing-certificates";
 export { createWfpTenantApp, type WfpTenantEnv, type WfpTenantAppOptions, type WfpSigningCertificateAuthority, } from "./tenant-app";

package/dist/types/wfp/tenant-app.d.ts

@@ -1,6 +1,6 @@
 import { type ExecutionContext } from "hono";
 import { type AuthHeroConfig, type CertificateIssuer, type DataAdapters, type IssuerResolver } from "authhero";
-import { type ControlPlaneDefaultsApplyResult } from "@authhero/multi-tenancy";
+import { type ControlPlaneDefaultsApplyResult, type InheritanceShadowOptions } from "@authhero/multi-tenancy";
 /**
  * Env contract for a WFP tenant worker — the bindings + secrets
  * `createCloudflareWfpD1Provisioner` (and the host's `secrets` resolver) set on
@@ -93,6 +93,22 @@ export interface WfpTenantAppOptions<Env extends WfpTenantEnv = WfpTenantEnv> {
      * control plane via `createDispatchRenewSigningCertificates`.
      */
     signingCertificateAuthority?: (env: Env) => WfpSigningCertificateAuthority | undefined;
+    /**
+     * Shadow mode for config inheritance, run in this worker: after a request is
+     * answered, compare what the projected control-plane rows give this tenant
+     * (the runtime fallback) with what its parent chain resolves to, and log the
+     * differences as `cfgdiff` in this tenant's own logs
+     * (`GET /api/v2/logs?q=type:cfgdiff`, forwarded here). Never changes a
+     * response. The comparison runs under `ctx.waitUntil`, so the Worker keeps
+     * it alive after the response; it is sampled and rate-limited like the
+     * colocated shadow mode. `true` uses the defaults.
+     *
+     * The worker only knows the control plane's rows (the ones projected into its
+     * database) and the tenant's own, so it compares against those. If the
+     * tenant's row names a parent this database lacks, the comparison is skipped;
+     * a deeper chain is checked by _Verify_ on the control plane.
+     */
+    inheritanceShadow?: boolean | InheritanceShadowOptions;
 }
 export interface WfpSigningCertificateAuthority {
     issuer: CertificateIssuer;

package/dist/types/wfp-provisioner/index.d.ts

@@ -5,7 +5,7 @@ export { collectSyncDefaultsErrors } from "./sync-defaults-errors";
 export type { CloudflareWfpD1Provisioner, CloudflareWfpD1ProvisionerOptions, ProvisionResult, ProvisionerMigration, TenantSecretsResolver, } from "./types";
 export { createWfpTenantProvisioningHook } from "./tenant-hook";
 export type { WfpTenantProvisioningHook, WfpTenantProvisioningHookOptions, } from "./tenant-hook";
-export { createWfpForwardMiddleware } from "./wfp-forward";
+export { createWfpForwardMiddleware, DEFAULT_LOCAL_PATHS } from "./wfp-forward";
 export type { WfpForwardOptions } from "./wfp-forward";
 export { CloudflareApiClient, CloudflareApiError } from "./cf-api";
 export type { CfApiClientOptions, D1Database, D1QueryResult, ScriptBinding, ScriptUploadOptions, } from "./cf-api";

package/dist/types/wfp-provisioner/wfp-forward.d.ts

@@ -1,5 +1,18 @@
 import type { Context, MiddlewareHandler } from "hono";
 import type { TenantsDataAdapter } from "@authhero/adapter-interfaces";
+/**
+ * Path prefixes served from the control plane rather than dispatched to a
+ * tenant worker. These are shared static assets that are byte-identical across
+ * tenants and only exist on the control plane's deployment.
+ *
+ * `/u/widget/` is the universal-login (u2) widget bundle. It's a multi-file
+ * Stencil bundle the SSR'd pages load as an ES module to hydrate the form. A
+ * per-tenant dispatch worker has no static-assets binding and no configured
+ * `widgetHandler`, so forwarding these requests 404s and the u2 buttons render
+ * inert. Serving them from the control plane — where the assets live — keeps
+ * zero per-tenant weight.
+ */
+export declare const DEFAULT_LOCAL_PATHS: readonly string[];
 export interface WfpForwardOptions {
     /** Tenants adapter, used to look up the resolved tenant's `deployment_type`. */
     tenants: TenantsDataAdapter;
@@ -29,11 +42,16 @@ export interface WfpForwardOptions {
      * handlers.
      *
      * Use this for shared static assets that only the control plane can serve —
-     * a per-tenant dispatch worker has no static-assets binding. Defaults to
-     * `["/u/widget/"]` (the universal-login widget bundle); pass `[]` to disable
-     * the carve-out entirely, or extend the list for other shared assets.
+     * a per-tenant dispatch worker has no static-assets binding. These are added
+     * to `DEFAULT_LOCAL_PATHS` (the universal-login widget bundle), so a default
+     * added later is not lost by anyone who passes their own list.
      */
     localPaths?: string[];
+    /**
+     * Whether `DEFAULT_LOCAL_PATHS` apply. Defaults to `true`; pass `false` to
+     * dispatch even the default paths and carve out only `localPaths`.
+     */
+    includeDefaultLocalPaths?: boolean;
 }
 /**
  * Hono middleware that forwards a request to its tenant's WFP worker over a
@@ -49,8 +67,8 @@ export interface WfpForwardOptions {
  * The tenant worker receives the original request verbatim and owns the full
  * response.
  *
- * Requests whose path matches `localPaths` (default `["/u/widget/"]`) are also
- * never dispatched — they are shared static assets that only the control plane
- * can serve, so a per-tenant worker would 404 them. See `DEFAULT_LOCAL_PATHS`.
+ * Requests whose path matches `DEFAULT_LOCAL_PATHS` (`["/u/widget/"]`) or the
+ * extra `localPaths` are also never dispatched — they are shared static assets
+ * that only the control plane can serve, so a per-tenant worker would 404 them.
  */
 export declare function createWfpForwardMiddleware(options: WfpForwardOptions): MiddlewareHandler;

package/dist/types/workflows/detach-operation.d.ts

@@ -0,0 +1,31 @@
+import { type StepConfig, type StepRunner, type DetachConfigFn, type TenantOperationStores } from "@authhero/multi-tenancy";
+import type { TenantOperationWorkflowParams } from "./types";
+export type DetachStepName = "mark-running" | "detach" | "mark-succeeded" | "mark-failed";
+export interface DetachOperationDeps {
+    /** Control-plane operation log stores. */
+    stores: TenantOperationStores;
+    /**
+     * How the detach reaches the tenant's database, for example
+     * `createDispatchDetach(...)`.
+     */
+    detachTenant: DetachConfigFn;
+    /**
+     * Per-step overrides of the retry/timeout defaults. The `detach` step has no
+     * automatic retries unless a host sets them.
+     */
+    stepConfig?: Partial<Record<DetachStepName, StepConfig>>;
+}
+/**
+ * Durable `detach` operation: a synced tenant leaves its parent, as a Workflows
+ * instance that writes to the control-plane operation log at every step
+ * boundary (the same shape as {@link runSyncDefaultsOperation}, and the same
+ * step logic as the inline executor). The operation's `input` (`dry_run`,
+ * `clean`) is read from its row, so nothing but ids crosses the Workflows
+ * boundary.
+ *
+ * A dry run records what would change in the operation's `result` and writes
+ * nothing. Any failure runs `mark-failed` (event + failed row) and rethrows
+ * so the instance ends `errored`; if even that dies, the reconciler copies the
+ * engine's terminal state into the row.
+ */
+export declare function runDetachOperation(deps: DetachOperationDeps, params: TenantOperationWorkflowParams, step: StepRunner): Promise<void>;

package/dist/types/workflows/entrypoint.example.d.ts

@@ -32,6 +32,7 @@
  *   reconcileTenantOperations,
  *   runProvisionOperation,
  *   runSyncDefaultsOperation,
+ *   runDetachOperation,
  *   type ProvisionOperationDeps,
  *   type TenantOperationWorkflowParams,
  * } from "@authhero/cloudflare-adapter/workflows";
@@ -43,6 +44,7 @@
  * } from "@authhero/cloudflare-adapter";
  * import {
  *   createDispatchSyncConfig,
+ *   createDispatchDetach,
  *   createDispatchSyncDefaults,
  * } from "@authhero/cloudflare-adapter/wfp";
  *
@@ -76,6 +78,27 @@
  *     // CF's WorkflowStep satisfies StepRunner structurally. One class runs
  *     // every kind; params carry the kind, never secrets.
  *     switch (event.payload.kind) {
+ *       case "detach": {
+ *         const adapters = createControlPlaneAdapters(this.env);
+ *         return runDetachOperation(
+ *           {
+ *             stores: {
+ *               tenantOperations: adapters.tenantOperations!,
+ *               tenantOperationEvents: adapters.tenantOperationEvents!,
+ *             },
+ *             // Checks the tenant row on the control plane, asks the tenant
+ *             // worker's /internal/detach to convert its rows, then marks the
+ *             // control-plane row detached.
+ *             detachTenant: createDispatchDetach({
+ *               dispatcher: this.env.DISPATCHER,
+ *               internalSecret: this.env.WFP_INTERNAL_SYNC_SECRET,
+ *               controlPlaneAdapters: adapters,
+ *             }),
+ *           },
+ *           event.payload,
+ *           step,
+ *         );
+ *       }
  *       case "sync-defaults": {
  *         const adapters = createControlPlaneAdapters(this.env);
  *         return runSyncDefaultsOperation(

package/dist/types/workflows/index.d.ts

@@ -14,6 +14,7 @@
  */
 export { runProvisionOperation, type ProvisionOperationDeps, type ProvisionStepName, } from "./provision-operation";
 export { runSyncDefaultsOperation, type SyncDefaultsOperationDeps, type SyncDefaultsStepName, } from "./sync-defaults-operation";
+export { runDetachOperation, type DetachOperationDeps, type DetachStepName, } from "./detach-operation";
 export { createProvisionVerifier, TenantProvisionVerificationError, type ProvisionVerifierOptions, } from "./verify";
 export { createCloudflareWorkflowsExecutor, type CloudflareWorkflowsExecutorOptions, } from "./executor";
 export { reconcileTenantOperations, type ReconcileTenantOperationsOptions, type ReconcileTenantOperationsResult, } from "./reconcile";

package/dist/types/workflows/types.d.ts

@@ -15,7 +15,7 @@ export interface TenantOperationWorkflowParams {
     operation_id: string;
     tenant_id: string;
     /** Widened beyond these in later phases (upgrade, backup, …). */
-    kind: "provision" | "sync-defaults";
+    kind: "provision" | "sync-defaults" | "detach";
 }
 /**
  * Instance status as reported by the engine. The exact value set has

package/dist/wfp.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@authhero/multi-tenancy"),t=require("hono"),n=require("authhero");var r=`tenant-{tenant_id}-auth`,i=3e4,a=`/internal/sync-defaults`;function o(e,t){return e.replace(/\{tenant_id\}/g,t)}function s(t){let{dispatcher:n,scriptNameTemplate:s=r,internalSecret:c,controlPlaneTenantId:l,controlPlaneAdapters:u,entities:d,timeoutMs:f=i}=t;return async t=>{let r=await(0,e.buildControlPlaneDefaultsPayload)(u,l,d,t),i=o(s,t),p=new AbortController,m=setTimeout(()=>p.abort(),f),h;try{h=await n.get(i).fetch(`https://tenant.internal${a}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${c}`},body:JSON.stringify(r),signal:p.signal})}finally{clearTimeout(m)}if(!h.ok){let e=await h.text().catch(()=>``),t=h.headers.get(`x-authhero-error`);throw Error(`sync-defaults push to "${i}" failed: ${h.status}${t?` (${t})`:``} ${e.slice(0,256)}`)}return await h.json()}}var c=`/internal/sync-config`;function l(t){let{dispatcher:n,scriptNameTemplate:a=r,internalSecret:s,controlPlaneTenantId:l,controlPlaneAdapters:u,maxDepth:d,timeoutMs:f=i}=t;return async(t,{dryRun:r,force:i})=>{let p=await(0,e.buildResolvedConfigBlock)(u,t,{legacyControlPlane:l,maxDepth:d}),m=o(a,t),h=new AbortController,g=setTimeout(()=>h.abort(),f),_;try{_=await n.get(m).fetch(`https://tenant.internal${c}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${s}`},body:JSON.stringify({tenantId:t,resolved:p,dryRun:r,force:i}),signal:h.signal})}finally{clearTimeout(g)}if(!_.ok){let e=await _.text().catch(()=>``),t=_.headers.get(`x-authhero-error`);throw Error(`sync-config push to "${m}" failed: ${_.status}${t?` (${t})`:``} ${e.slice(0,256)}`)}return await _.json()}}var u=`/internal/renew-signing-certificates`;function d(e){let{dispatcher:t,scriptNameTemplate:n=r,internalSecret:a,timeoutMs:s=i}=e;return async e=>{let r=o(n,e),i=new AbortController,c=setTimeout(()=>i.abort(),s);try{let e=await t.get(r).fetch(`https://tenant.internal${u}`,{method:`POST`,headers:{authorization:`Bearer ${a}`},signal:i.signal});if(!e.ok){let t=await e.text().catch(()=>``),n=e.headers.get(`x-authhero-error`);throw Error(`signing-certificate renewal for "${r}" failed: ${e.status}${n?` (${n})`:``} ${t.slice(0,512)}`)}let n=await e.json();if(!f(n))throw Error(`signing-certificate renewal for "${r}" returned an unexpected body`);return{renewed:n.renewed,notDue:n.notDue}}finally{clearTimeout(c)}}}function f(e){return typeof e==`object`&&!!e&&`renewed`in e&&`notDue`in e&&Array.isArray(e.renewed)&&e.renewed.every(e=>typeof e==`string`)&&typeof e.notDue==`number`}var p=`cp`,m=`/internal/sync-defaults`,h=`/internal/sync-config`,g=`/internal/renew-signing-certificates`;function _(e,t,n,r){console.error(`[wfp-tenant] ${t}:`,n);let i=n instanceof Error?n.message:String(n);return e.header(`X-Authhero-Error`,t),e.json({error:t,detail:i,result:r},500)}function v(e){let t=`${n.TENANT_URI_PREFIX}${e.tenantId}`;return{issuer:e.issuer,validityDays:e.validityDays,subjectUri:()=>t}}function y(e){return({tenant_id:t})=>t===e.CONTROL_PLANE_TENANT_ID?[e.CONTROL_PLANE_ISSUER]:[]}async function b(r,i){let a=r.CONTROL_PLANE_TENANT_ID,o=await(0,n.loadEncryptionKey)(r.ENCRYPTION_KEY),s=r.CONTROL_PLANE_ENCRYPTION_KEY?{default:o,keys:{[p]:await(0,n.loadEncryptionKey)(r.CONTROL_PLANE_ENCRYPTION_KEY)}}:{default:o},c=i.createDataAdapter(r),l=(0,n.createEncryptedDataAdapterWithKeyRing)(c,s,{resolveEncryptKeyId:e=>e===a?p:void 0}),u=(0,e.withRuntimeFallback)(l,{controlPlaneTenantId:a}),d=i.signingCertificateAuthority?.(r),f=d?v(d):void 0,b={dataAdapter:u,...f?{signingCertificateAuthority:f}:{},additionalIssuers:(i.additionalIssuers??y)(r)},x=i.configure?i.configure(b,r):b,S=x.signingCertificateAuthority,{app:C}=(0,n.init)(x),w=new t.Hono;return w.post(m,async t=>{let o=r.WFP_INTERNAL_SYNC_SECRET,s=t.req.header(`authorization`);if(!o||s!==`Bearer ${o}`)return t.json({error:`unauthorized`},401);let c;try{c=await t.req.json()}catch{return t.json({error:`invalid JSON`},400)}let u;try{u=await(0,e.applyControlPlaneDefaultsPayload)(c,l,a,{continueOnError:i.continueOnError??!0})}catch(e){return _(t,`sync_defaults_apply_failed`,e)}let d;try{d={created:(await(0,n.ensureSigningKey)(l.keys,{name:r.ISSUER,certificateAuthority:S})).created}}catch(e){return _(t,`sync_defaults_signing_key_failed`,e,u)}if(i.onSyncResult)try{await i.onSyncResult(u,r)}catch(e){return _(t,`sync_defaults_on_result_failed`,e,u)}return t.json({...u,signingKey:d})}),w.post(h,async t=>{let n=r.WFP_INTERNAL_SYNC_SECRET,a=t.req.header(`authorization`);if(!n||a!==`Bearer ${n}`)return t.json({error:`unauthorized`},401);let o;try{o=await t.req.json()}catch{return t.json({error:`invalid JSON`},400)}if(!o.tenantId||!o.resolved)return t.json({error:`tenantId and resolved are required`},400);if(r.TENANT_ID&&o.tenantId!==r.TENANT_ID)return console.error(`[wfp-tenant] sync_config_tenant_mismatch: push for "${o.tenantId}" reached the worker of "${r.TENANT_ID}"`),t.header(`X-Authhero-Error`,`sync_config_tenant_mismatch`),t.json({error:`sync_config_tenant_mismatch`},403);try{let n=await(0,e.applyResolvedConfigBlock)(o.resolved,c,o.tenantId,{dryRun:o.dryRun===!0,force:o.force===!0,keyRing:s,continueOnError:i.continueOnError??!0});return t.json(n)}catch(e){return e instanceof Error&&/key ring cannot decrypt/.test(e.message)?(console.error(`[wfp-tenant] sync_config_key_ring:`,e),t.header(`X-Authhero-Error`,`sync_config_key_ring`),t.json({error:`sync_config_key_ring`,detail:e.message},422)):_(t,`sync_config_apply_failed`,e)}}),w.post(g,async e=>{let t=r.WFP_INTERNAL_SYNC_SECRET,i=e.req.header(`authorization`);if(!t||i!==`Bearer ${t}`)return e.json({error:`unauthorized`},401);if(!S)return e.json({error:`no signing certificate authority`},404);try{let t=await(0,n.renewSigningCertificates)({dataAdapter:{keys:l.keys},certificateAuthority:S});return e.json({renewed:t.renewed,notDue:t.notDue})}catch(t){return t instanceof n.SigningCertificateRenewalError?(console.error(`[wfp-tenant] signing_certificate_renewal_failed:`,t),e.header(`X-Authhero-Error`,`signing_certificate_renewal_failed`),e.json({error:`signing_certificate_renewal_failed`,renewed:t.result.renewed,notDue:t.result.notDue,failed:t.result.failed.map(({kid:e,error:t})=>({kid:e,detail:t instanceof Error?t.message:String(t)}))},500)):_(e,`signing_certificate_renewal_failed`,t)}}),w.route(`/`,C),w}function x(e){let t=new WeakMap;return{fetch(n,r,i){let a=t.get(r);return a||(a=b(r,e),t.set(r,a)),a.then(e=>e.fetch(n,r,i))}}}exports.createDispatchRenewSigningCertificates=d,exports.createDispatchSyncConfig=l,exports.createDispatchSyncDefaults=s,exports.createWfpTenantApp=x;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@authhero/multi-tenancy"),t=require("hono"),n=require("authhero");var r=`tenant-{tenant_id}-auth`,i=3e4,a=`/internal/sync-defaults`;function o(e,t){return e.replace(/\{tenant_id\}/g,t)}function s(t){let{dispatcher:n,scriptNameTemplate:s=r,internalSecret:c,controlPlaneTenantId:l,controlPlaneAdapters:u,entities:d,timeoutMs:f=i}=t;return async t=>{let r=await(0,e.buildControlPlaneDefaultsPayload)(u,l,d,t),i=o(s,t),p=new AbortController,m=setTimeout(()=>p.abort(),f),h;try{h=await n.get(i).fetch(`https://tenant.internal${a}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${c}`},body:JSON.stringify(r),signal:p.signal})}finally{clearTimeout(m)}if(!h.ok){let e=await h.text().catch(()=>``),t=h.headers.get(`x-authhero-error`);throw Error(`sync-defaults push to "${i}" failed: ${h.status}${t?` (${t})`:``} ${e.slice(0,256)}`)}return await h.json()}}var c=`/internal/sync-config`;function l(t){let{dispatcher:n,scriptNameTemplate:a=r,internalSecret:s,controlPlaneTenantId:l,controlPlaneAdapters:u,maxDepth:d,timeoutMs:f=i}=t;return async(t,{dryRun:r,force:i,prune:p})=>{if((await u.tenants.get(t))?.config_sync===`detached`)throw Error(`Tenant "${t}" is detached from its parent: set config_sync back to "inherit-on-read" or "synced" before syncing it`);let m=await(0,e.buildResolvedConfigBlock)(u,t,{legacyControlPlane:l,maxDepth:d}),h=o(a,t),g=new AbortController,_=setTimeout(()=>g.abort(),f),v;try{v=await n.get(h).fetch(`https://tenant.internal${c}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${s}`},body:JSON.stringify({tenantId:t,resolved:m,dryRun:r,force:i,prune:p}),signal:g.signal})}finally{clearTimeout(_)}if(!v.ok){let e=await v.text().catch(()=>``),t=v.headers.get(`x-authhero-error`);throw Error(`sync-config push to "${h}" failed: ${v.status}${t?` (${t})`:``} ${e.slice(0,256)}`)}return await v.json()}}var u=`/internal/detach`,d=12e4;function f(t){let{dispatcher:n,scriptNameTemplate:i=r,internalSecret:a,controlPlaneAdapters:s,timeoutMs:c=d}=t;return async(t,{dryRun:r,clean:l})=>{let d=await s.tenants.get(t);if(!d)throw Error(`Tenant "${t}" not found`);if(d.config_sync===`detached`)return(0,e.emptyDetachResult)(`already-detached`);(0,e.assertDetachEligible)(t,d);let f=o(i,t),p=new AbortController,m=setTimeout(()=>p.abort(),c),h;try{h=await n.get(f).fetch(`https://tenant.internal${u}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${a}`},body:JSON.stringify({tenantId:t,dryRun:r,clean:l}),signal:p.signal})}finally{clearTimeout(m)}if(!h.ok){let e=await h.text().catch(()=>``),t=h.headers.get(`x-authhero-error`);throw Error(`detach push to "${f}" failed: ${h.status}${t?` (${t})`:``} ${e.slice(0,256)}`)}let g=await h.json();return!r&&g.status===`detached`&&await(0,e.markTenantDetached)(s,t),g}}var p=`/internal/tenant-member-requests`,m=15e3;function h(e){let{dispatcher:t,scriptNameTemplate:n=r,internalSecret:i,timeoutMs:a=m}=e;async function s(e,r){let s=o(n,e),c=new AbortController,l=setTimeout(()=>c.abort(),a);try{return await t.get(s).fetch(`https://tenant.internal${p}`,{method:`POST`,headers:{"content-type":`application/json`,authorization:`Bearer ${i}`},body:JSON.stringify({tenantId:e,...r}),signal:c.signal})}finally{clearTimeout(l)}}async function c(e,t){let n=await t.text().catch(()=>``),r=t.headers.get(`x-authhero-error`);return Error(`tenant member requests of "${e}" answered ${t.status}${r?` (${r})`:``} ${n.slice(0,256)}`)}return{async get(e,t){let n=await s(e,{action:`get`,id:t});if(n.status===404)return null;if(!n.ok)throw await c(e,n);return await n.json()},async report(e,t,n){let r=await s(e,{action:`report`,id:t,outcome:n});if(!r.ok)throw await c(e,r);return(await r.json()).updated},async listPending(e,{olderThan:t}){let n=await s(e,{action:`list_pending`,olderThan:t});if(!n.ok)throw await c(e,n);return(await n.json()).requests}}}var g=`/internal/renew-signing-certificates`;function _(e){let{dispatcher:t,scriptNameTemplate:n=r,internalSecret:a,timeoutMs:s=i}=e;return async e=>{let r=o(n,e),i=new AbortController,c=setTimeout(()=>i.abort(),s);try{let e=await t.get(r).fetch(`https://tenant.internal${g}`,{method:`POST`,headers:{authorization:`Bearer ${a}`},signal:i.signal});if(!e.ok){let t=await e.text().catch(()=>``),n=e.headers.get(`x-authhero-error`);throw Error(`signing-certificate renewal for "${r}" failed: ${e.status}${n?` (${n})`:``} ${t.slice(0,512)}`)}let n=await e.json();if(!v(n))throw Error(`signing-certificate renewal for "${r}" returned an unexpected body`);return{renewed:n.renewed,notDue:n.notDue}}finally{clearTimeout(c)}}}function v(e){return typeof e==`object`&&!!e&&`renewed`in e&&`notDue`in e&&Array.isArray(e.renewed)&&e.renewed.every(e=>typeof e==`string`)&&typeof e.notDue==`number`}var y=`cp`,b=`/internal/sync-defaults`,x=`/internal/sync-config`,S=`/internal/detach`,C=`/internal/tenant-member-requests`,w=`/internal/renew-signing-certificates`;function T(e,t,n,r){console.error(`[wfp-tenant] ${t}:`,n);let i=n instanceof Error?n.message:String(n);return e.header(`X-Authhero-Error`,t),e.json({error:t,detail:i,result:r},500)}function E(e){let t=`${n.TENANT_URI_PREFIX}${e.tenantId}`;return{issuer:e.issuer,validityDays:e.validityDays,subjectUri:()=>t}}function D(e){return({tenant_id:t})=>t===e.CONTROL_PLANE_TENANT_ID?[e.CONTROL_PLANE_ISSUER]:[]}async function O(r,i){let a=r.CONTROL_PLANE_TENANT_ID,o=await(0,n.loadEncryptionKey)(r.ENCRYPTION_KEY),s=r.CONTROL_PLANE_ENCRYPTION_KEY?{default:o,keys:{[y]:await(0,n.loadEncryptionKey)(r.CONTROL_PLANE_ENCRYPTION_KEY)}}:{default:o},c=i.createDataAdapter(r),l=(0,n.createEncryptedDataAdapterWithKeyRing)(c,s,{resolveEncryptKeyId:e=>e===a?y:void 0}),u=(0,e.withRuntimeFallback)(l,{controlPlaneTenantId:a}),d=i.signingCertificateAuthority?.(r),f=d?E(d):void 0,p={dataAdapter:u,...f?{signingCertificateAuthority:f}:{},additionalIssuers:(i.additionalIssuers??D)(r)},m=i.configure?i.configure(p,r):p,h=m.signingCertificateAuthority,{app:g}=(0,n.init)(m),_=new t.Hono;if(_.post(b,async t=>{let o=r.WFP_INTERNAL_SYNC_SECRET,s=t.req.header(`authorization`);if(!o||s!==`Bearer ${o}`)return t.json({error:`unauthorized`},401);let c;try{c=await t.req.json()}catch{return t.json({error:`invalid JSON`},400)}let u;try{u=await(0,e.applyControlPlaneDefaultsPayload)(c,l,a,{continueOnError:i.continueOnError??!0})}catch(e){return T(t,`sync_defaults_apply_failed`,e)}let d;try{d={created:(await(0,n.ensureSigningKey)(l.keys,{name:r.ISSUER,certificateAuthority:h})).created}}catch(e){return T(t,`sync_defaults_signing_key_failed`,e,u)}if(i.onSyncResult)try{await i.onSyncResult(u,r)}catch(e){return T(t,`sync_defaults_on_result_failed`,e,u)}return t.json({...u,signingKey:d})}),_.post(x,async t=>{let n=r.WFP_INTERNAL_SYNC_SECRET,a=t.req.header(`authorization`);if(!n||a!==`Bearer ${n}`)return t.json({error:`unauthorized`},401);let o;try{o=await t.req.json()}catch{return t.json({error:`invalid JSON`},400)}if(!o.tenantId||!o.resolved)return t.json({error:`tenantId and resolved are required`},400);if(r.TENANT_ID&&o.tenantId!==r.TENANT_ID)return console.error(`[wfp-tenant] sync_config_tenant_mismatch: push for "${o.tenantId}" reached the worker of "${r.TENANT_ID}"`),t.header(`X-Authhero-Error`,`sync_config_tenant_mismatch`),t.json({error:`sync_config_tenant_mismatch`},403);try{let n=await(0,e.applyResolvedConfigBlock)(o.resolved,c,o.tenantId,{dryRun:o.dryRun===!0,force:o.force===!0,prune:o.prune===!0,keyRing:s,continueOnError:i.continueOnError??!0});return t.json(n)}catch(e){return e instanceof Error&&/key ring cannot decrypt/.test(e.message)?(console.error(`[wfp-tenant] sync_config_key_ring:`,e),t.header(`X-Authhero-Error`,`sync_config_key_ring`),t.json({error:`sync_config_key_ring`,detail:e.message},422)):T(t,`sync_config_apply_failed`,e)}}),_.post(S,async t=>{let n=r.WFP_INTERNAL_SYNC_SECRET,i=t.req.header(`authorization`);if(!n||i!==`Bearer ${n}`)return t.json({error:`unauthorized`},401);let a;try{a=await t.req.json()}catch{return t.json({error:`invalid JSON`},400)}if(!a.tenantId)return t.json({error:`tenantId is required`},400);if(r.TENANT_ID&&a.tenantId!==r.TENANT_ID)return console.error(`[wfp-tenant] detach_tenant_mismatch: detach for "${a.tenantId}" reached the worker of "${r.TENANT_ID}"`),t.header(`X-Authhero-Error`,`detach_tenant_mismatch`),t.json({error:`detach_tenant_mismatch`},403);try{let n=await(0,e.detachTenantRows)(c,a.tenantId,{dryRun:a.dryRun===!0,clean:a.clean===!0});return n.status===`detached`&&await(0,e.markTenantDetached)(c,a.tenantId),t.json(n)}catch(e){return T(t,`detach_failed`,e)}}),_.post(C,async e=>{let t=r.WFP_INTERNAL_SYNC_SECRET,n=e.req.header(`authorization`);if(!t||n!==`Bearer ${t}`)return e.json({error:`unauthorized`},401);let i;try{i=await e.req.json()}catch{return e.json({error:`invalid JSON`},400)}if(!i.tenantId)return e.json({error:`tenantId is required`},400);if(r.TENANT_ID&&i.tenantId!==r.TENANT_ID)return console.error(`[wfp-tenant] member_requests_tenant_mismatch: a request for "${i.tenantId}" reached the worker of "${r.TENANT_ID}"`),e.header(`X-Authhero-Error`,`member_requests_tenant_mismatch`),e.json({error:`member_requests_tenant_mismatch`},403);let a=c.tenantMemberRequests;if(!a)return e.json({error:`tenant member requests are not available`},501);try{switch(i.action){case`get`:{if(!i.id)return e.json({error:`id is required`},400);let t=await a.get(i.tenantId,i.id);return t?e.json(t):e.json({error:`not_found`},404)}case`report`:{let{status:t,result:n,error:r}=i.outcome??{};if(!i.id||t!==`succeeded`&&t!==`failed`)return e.json({error:`id and a final status are required`},400);let o=await a.update(i.tenantId,i.id,{status:t,result:n??null,error:r??null,finished_at:new Date().toISOString()},`pending`);return e.json({updated:o})}case`list_pending`:{let t=await a.list(i.tenantId,{status:`pending`,created_before:i.olderThan,per_page:100});return e.json({requests:t.requests})}default:return e.json({error:`unknown action`},400)}}catch(t){return T(e,`member_requests_failed`,t)}}),_.post(w,async e=>{let t=r.WFP_INTERNAL_SYNC_SECRET,i=e.req.header(`authorization`);if(!t||i!==`Bearer ${t}`)return e.json({error:`unauthorized`},401);if(!h)return e.json({error:`no signing certificate authority`},404);try{let t=await(0,n.renewSigningCertificates)({dataAdapter:{keys:l.keys},certificateAuthority:h});return e.json({renewed:t.renewed,notDue:t.notDue})}catch(t){return t instanceof n.SigningCertificateRenewalError?(console.error(`[wfp-tenant] signing_certificate_renewal_failed:`,t),e.header(`X-Authhero-Error`,`signing_certificate_renewal_failed`),e.json({error:`signing_certificate_renewal_failed`,renewed:t.result.renewed,notDue:t.result.notDue,failed:t.result.failed.map(({kid:e,error:t})=>({kid:e,detail:t instanceof Error?t.message:String(t)}))},500)):T(e,`signing_certificate_renewal_failed`,t)}}),_.route(`/`,g),i.inheritanceShadow){let t=(0,e.createShadowReporter)(l,i.inheritanceShadow===!0?{}:i.inheritanceShadow),n=r.TENANT_ID||new URL(r.ISSUER).hostname.split(`.`)[0],o,s=async()=>{let e=await l.tenants.get(n);for(let t=0;t<5;t++){let t=e?.parent_tenant_id;if(!t||t===a)return!0;if(e=await l.tenants.get(t),!e)return!1}return!1};k.set(_,e=>{if(!new URL(e.url).pathname.startsWith(`/internal/`)&&n!==a)return(async()=>{if(!await(o??=s()))return;let e=t.schedule(n,a);e&&await e})()})}return _}var k=new WeakMap;function A(e){let t=new WeakMap;return{fetch(n,r,i){let a=t.get(r);return a||(a=O(r,e),t.set(r,a)),a.then(async e=>{let t=await e.fetch(n,r,i),a=k.get(e)?.(n);return a&&i.waitUntil(a),t})}}}exports.TENANT_MEMBER_REQUESTS_PATH=p,exports.createDispatchDetach=f,exports.createDispatchRenewSigningCertificates=_,exports.createDispatchSyncConfig=l,exports.createDispatchSyncDefaults=s,exports.createDispatchTenantMemberRequestStore=h,exports.createWfpTenantApp=A;

package/dist/wfp.d.ts

@@ -1,5 +1,5 @@
 import { DataAdapters } from '@authhero/adapter-interfaces';
-import { DefaultsPayloadEntities, ControlPlaneDefaultsApplyResult, SyncConfigFn } from '@authhero/multi-tenancy';
+import { DefaultsPayloadEntities, ControlPlaneDefaultsApplyResult, SyncConfigFn, DetachConfigFn, TenantMemberRequestStore, InheritanceShadowOptions } from '@authhero/multi-tenancy';
 import { ExecutionContext } from 'hono';
 import { DataAdapters as DataAdapters$1, AuthHeroConfig, IssuerResolver, CertificateIssuer } from 'authhero';
 
@@ -95,6 +95,57 @@ interface DispatchSyncConfigOptions {
  */
 declare function createDispatchSyncConfig(options: DispatchSyncConfigOptions): SyncConfigFn;
 
+interface DispatchDetachOptions {
+    /** The dispatch namespace binding the tenant workers live in. */
+    dispatcher: DispatchNamespace;
+    /** Script-name convention. Supports `{tenant_id}`. */
+    scriptNameTemplate?: string;
+    /**
+     * Shared secret the tenant worker checks on `/internal/detach`
+     * (`WFP_INTERNAL_SYNC_SECRET`). Sent as a bearer token.
+     */
+    internalSecret: string;
+    /**
+     * The control plane's adapters, where the tenant row that decides lives. Use
+     * the raw layer.
+     */
+    controlPlaneAdapters: DataAdapters;
+    /** Per-push timeout. Defaults to 120s. */
+    timeoutMs?: number;
+}
+/**
+ * Builds the `detach` operation's transport for tenants with their own worker
+ * and database. The control plane checks that the tenant can be detached from
+ * its own tenant row, asks the tenant worker to convert (or remove) the copies
+ * in its database, and only when that went through marks its own tenant row
+ * detached. A preview or a partial result leaves the row as it was, so a retry
+ * can finish the job. Rejects when the push fails or the worker answers non-2xx,
+ * which fails the operation.
+ */
+declare function createDispatchDetach(options: DispatchDetachOptions): DetachConfigFn;
+
+declare const TENANT_MEMBER_REQUESTS_PATH = "/internal/tenant-member-requests";
+interface DispatchTenantMemberRequestStoreOptions {
+    /** The dispatch namespace binding the tenant workers live in. */
+    dispatcher: DispatchNamespace;
+    /** Script-name convention. Supports `{tenant_id}`. */
+    scriptNameTemplate?: string;
+    /**
+     * Shared secret the tenant worker checks on `/internal/*`
+     * (`WFP_INTERNAL_SYNC_SECRET`). Sent as a bearer token.
+     */
+    internalSecret: string;
+    /** Per-call timeout. Defaults to 15s. */
+    timeoutMs?: number;
+}
+/**
+ * Reaches the team-change requests in a tenant worker's own database, for the
+ * `tenant-members-request` operation and its reconcile sweep (issue #1550):
+ * read a request, answer it, and list the ones still pending. One endpoint,
+ * `POST /internal/tenant-member-requests`, takes the action in its body.
+ */
+declare function createDispatchTenantMemberRequestStore(options: DispatchTenantMemberRequestStoreOptions): TenantMemberRequestStore;
+
 interface DispatchRenewSigningCertificatesOptions {
     /** The dispatch namespace binding the tenant workers live in. */
     dispatcher: DispatchNamespace;
@@ -214,6 +265,22 @@ interface WfpTenantAppOptions<Env extends WfpTenantEnv = WfpTenantEnv> {
      * control plane via `createDispatchRenewSigningCertificates`.
      */
     signingCertificateAuthority?: (env: Env) => WfpSigningCertificateAuthority | undefined;
+    /**
+     * Shadow mode for config inheritance, run in this worker: after a request is
+     * answered, compare what the projected control-plane rows give this tenant
+     * (the runtime fallback) with what its parent chain resolves to, and log the
+     * differences as `cfgdiff` in this tenant's own logs
+     * (`GET /api/v2/logs?q=type:cfgdiff`, forwarded here). Never changes a
+     * response. The comparison runs under `ctx.waitUntil`, so the Worker keeps
+     * it alive after the response; it is sampled and rate-limited like the
+     * colocated shadow mode. `true` uses the defaults.
+     *
+     * The worker only knows the control plane's rows (the ones projected into its
+     * database) and the tenant's own, so it compares against those. If the
+     * tenant's row names a parent this database lacks, the comparison is skipped;
+     * a deeper chain is checked by _Verify_ on the control plane.
+     */
+    inheritanceShadow?: boolean | InheritanceShadowOptions;
 }
 interface WfpSigningCertificateAuthority {
     issuer: CertificateIssuer;
@@ -237,5 +304,5 @@ declare function createWfpTenantApp<Env extends WfpTenantEnv = WfpTenantEnv>(opt
     fetch: (request: Request, env: Env, ctx: ExecutionContext) => Promise<Response>;
 };
 
-export { createDispatchRenewSigningCertificates, createDispatchSyncConfig, createDispatchSyncDefaults, createWfpTenantApp };
-export type { DispatchRenewSigningCertificatesOptions, DispatchRenewSigningCertificatesResult, DispatchSyncConfigOptions, DispatchSyncDefaultsOptions, WfpSigningCertificateAuthority, WfpTenantAppOptions, WfpTenantEnv };
+export { TENANT_MEMBER_REQUESTS_PATH, createDispatchDetach, createDispatchRenewSigningCertificates, createDispatchSyncConfig, createDispatchSyncDefaults, createDispatchTenantMemberRequestStore, createWfpTenantApp };
+export type { DispatchDetachOptions, DispatchRenewSigningCertificatesOptions, DispatchRenewSigningCertificatesResult, DispatchSyncConfigOptions, DispatchSyncDefaultsOptions, DispatchTenantMemberRequestStoreOptions, WfpSigningCertificateAuthority, WfpTenantAppOptions, WfpTenantEnv };