@authhero/multi-tenancy 15.1.2 → 15.3.0

package/dist/types/index.d.ts

@@ -3,14 +3,18 @@ import { MultiTenancyConfig, MultiTenancyHooks, MultiTenancyBindings, MultiTenan
 export * from "./types";
 export { initMultiTenant } from "./init";
 export type { MultiTenantConfig, MultiTenantResult, ControlPlaneConfig, } from "./init";
-export { createDirectRolloutAdapter, projectControlPlaneDefaults, buildControlPlaneDefaultsPayload, applyControlPlaneDefaultsPayload, } from "./rollout";
-export type { ControlPlaneRolloutAdapter, DefaultsProjectionConfig, DefaultsProjectionEntities, DefaultsProjectionResult, EntityProjectionOutcome, ProjectableDefaults, ControlPlaneDefaultsPayload, ControlPlaneDefaultsApplyResult, ControlPlaneTenantSeed, DefaultsPayloadEntities, } from "./rollout";
+export { createDirectRolloutAdapter, projectControlPlaneDefaults, buildControlPlaneDefaultsPayload, applyControlPlaneDefaultsPayload, applyResolvedConfigBlock, buildResolvedConfigBlock, findUndecryptableKeyIds, syncedRowId, } from "./rollout";
+export type { ControlPlaneRolloutAdapter, DefaultsProjectionConfig, DefaultsProjectionEntities, DefaultsProjectionResult, EntityProjectionOutcome, ProjectableDefaults, ControlPlaneDefaultsPayload, ControlPlaneDefaultsApplyResult, ControlPlaneTenantSeed, DefaultsPayloadEntities, ApplyResolvedBlockOptions, ApplyResolvedBlockResult, BuildResolvedBlockOptions, ResolvedConfigBlock, SyncEntity, SyncEntityOutcome, } from "./rollout";
 export * from "./operations";
+export * from "./rollouts";
 export { createSyncHooks } from "./hooks/sync";
 export type { EntitySyncConfig, SyncHooksResult } from "./hooks/sync";
 export { createTenantsOpenAPIRouter } from "./routes";
 export { createMultiTenancyMiddleware, createAccessControlMiddleware, createControlPlaneTenantMiddleware, createSubdomainMiddleware, createDatabaseMiddleware, createProtectSyncedMiddleware, createRuntimeFallbackAdapter, withRuntimeFallback, withSystemResourceServerInheritance, mergeClientWithFallback, } from "./middleware";
 export type { RuntimeFallbackConfig, ControlPlaneResolver } from "./middleware";
+export { createConfigSyncResolver } from "./middleware";
+export type { ConfigSyncResolver, ConfigSyncResolverOptions, } from "./middleware";
+export * from "./inheritance";
 export { createMultiTenancyPlugin } from "./plugin";
 export type { AuthHeroPlugin } from "./plugin";
 export { createAccessControlHooks, createDatabaseHooks, createProvisioningHooks, } from "./hooks";

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAajB,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAKhB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAMnB,cAAc,cAAc,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,kCAAkC,EAClC,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEhF,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAgBnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB;cAE/C,oBAAoB;eACnB,qBAAqB;0CASnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB;;;;;;;kBAnD9C,oBAAoB;mBACnB,qBAAqB;;;IAwDhC;;;;;;;OAOG;6BAES,OAAO,UAAU,EAAE,YAAY,qBACtB;QAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE;EAOzD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAajB,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAKhB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,gCAAgC,EAChC,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,WAAW,GACZ,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,UAAU,EACV,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAMnB,cAAc,cAAc,CAAC;AAI7B,cAAc,YAAY,CAAC;AAG3B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,kCAAkC,EAClC,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,YAAY,EACV,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,cAAc,eAAe,CAAC;AAE9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAgBnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB;cAE/C,oBAAoB;eACnB,qBAAqB;0CASnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB;;;;;;;kBAnD9C,oBAAoB;mBACnB,qBAAqB;;;IAwDhC;;;;;;;OAOG;6BAES,OAAO,UAAU,EAAE,YAAY,qBACtB;QAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE;EAOzD"}

package/dist/types/inheritance/chain.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Resolves a tenant's ancestors, nearest first.
+ *
+ * A tenant with `parent_tenant_id` follows that chain. A tenant without one
+ * falls back to the legacy control plane as an implicit single parent, so the
+ * result matches what read-time inheritance does today. `legacyControlPlane`
+ * is `undefined` when the tenant opts out of inheritance.
+ */
+export declare function resolveTenantChain(params: {
+    tenantId: string;
+    getTenant: (id: string) => Promise<{
+        id: string;
+        parent_tenant_id?: string | null;
+    } | null>;
+    legacyControlPlane?: string;
+    maxDepth?: number;
+}): Promise<string[]>;
+//# sourceMappingURL=chain.d.ts.map

package/dist/types/inheritance/chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../../src/inheritance/chain.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,CACT,EAAE,EAAE,MAAM,KACP,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACtE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAgCpB"}

package/dist/types/inheritance/index.d.ts

@@ -0,0 +1,10 @@
+export { resolveTenantChain } from "./chain";
+export { effectiveOverride, effectiveScope, mergeConfig } from "./merge";
+export { computeLegacyConfig } from "./legacy";
+export { readConfigRows } from "./read";
+export { compareShadow, diffConfig } from "./shadow";
+export type { ShadowDiff } from "./shadow";
+export { createShadowReporter } from "./report";
+export type { InheritanceShadowOptions, ShadowReporter } from "./report";
+export type { ConfigRows, ConfigEntity, ResolvedConfig } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/inheritance/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/inheritance/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACrD,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,YAAY,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACzE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC"}

package/dist/types/inheritance/legacy.d.ts

@@ -0,0 +1,7 @@
+import { ConfigRows } from "./types";
+/**
+ * What read-time inheritance returns for a tenant today, computed from plain
+ * rows with the very helpers the runtime fallback adapter uses.
+ */
+export declare function computeLegacyConfig(tenant: ConfigRows, controlPlane: ConfigRows | undefined): ConfigRows;
+//# sourceMappingURL=legacy.d.ts.map

package/dist/types/inheritance/legacy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy.d.ts","sourceRoot":"","sources":["../../../src/inheritance/legacy.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiCrC;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,YAAY,EAAE,UAAU,GAAG,SAAS,GACnC,UAAU,CAkCZ"}

package/dist/types/inheritance/merge.d.ts

@@ -0,0 +1,40 @@
+import type { ConfigOverride, ConfigScope } from "authhero";
+import { ConfigEntity, ConfigRows, ResolvedConfig } from "./types";
+type Publishable = {
+    scope?: ConfigScope | null;
+    override?: ConfigOverride | null;
+    is_system?: boolean;
+    metadata?: unknown;
+};
+/**
+ * Scope of a row. An explicit `scope` wins. Unset falls back to what
+ * read-time inheritance does today for that entity, so rows nobody has
+ * annotated behave as before.
+ */
+export declare function effectiveScope(entity: ConfigEntity, row: Publishable): ConfigScope;
+/**
+ * What a child may change on a row. Unset is "fields" because that is how the
+ * legacy merge behaves: the tenant's values win.
+ */
+export declare function effectiveOverride(row: Publishable): ConfigOverride;
+export declare const SECRET_KEY: RegExp;
+type Layer = ConfigRows;
+/**
+ * Merges the config of a parent chain with the tenant's own, with no I/O.
+ *
+ * `chain` is the ancestors' rows **nearest first** (the same order as
+ * `resolveTenantChain`); `tenant` is the tenant's own rows. Rules
+ * (docs/design/tenant-config-inheritance.md, 3.3):
+ * - rows merge by a stable key and the nearest layer wins, limited by the
+ *   `override` of the layer above;
+ * - hooks and actions add up: an ancestor's shared rows appear in addition to
+ *   the tenant's own;
+ * - `local` rows of an ancestor are not visible; `platform` rows are merged
+ *   but listed in `hidden`.
+ *
+ * `enforce` does not affect the merged result yet; it constrains edits and
+ * deletes, which come with the management API changes.
+ */
+export declare function mergeConfig(chain: Layer[], tenant: Layer): ResolvedConfig;
+export {};
+//# sourceMappingURL=merge.d.ts.map

package/dist/types/inheritance/merge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../../src/inheritance/merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,cAAc,EACd,WAAW,EAKZ,MAAM,UAAU,CAAC;AAKlB,OAAO,EACL,YAAY,EACZ,UAAU,EACV,cAAc,EAEf,MAAM,SAAS,CAAC;AAEjB,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,WAAW,GACf,WAAW,CAcb;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAElE;AAED,eAAO,MAAM,UAAU,QAA+C,CAAC;AA0EvE,KAAK,KAAK,GAAG,UAAU,CAAC;AAExB;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,GAAG,cAAc,CA0HzE"}

package/dist/types/inheritance/read.d.ts

@@ -0,0 +1,5 @@
+import { DataAdapters } from "authhero";
+import { ConfigRows } from "./types";
+/** Reads every config entity of one tenant as plain rows. */
+export declare function readConfigRows(adapters: DataAdapters, tenantId: string): Promise<ConfigRows>;
+//# sourceMappingURL=read.d.ts.map

package/dist/types/inheritance/read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/inheritance/read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA8B,MAAM,UAAU,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,6DAA6D;AAC7D,wBAAsB,cAAc,CAClC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CA8BrB"}

package/dist/types/inheritance/report.d.ts

@@ -0,0 +1,20 @@
+import { DataAdapters } from "authhero";
+/**
+ * Options for config inheritance shadow mode. Shadow mode compares the parent
+ * chain resolver with read-time inheritance and logs differences; it never
+ * changes what a request sees.
+ */
+export interface InheritanceShadowOptions {
+    /** Fraction of reads (0..1) that may start a comparison. @default 1 */
+    sample?: number;
+    /** Minimum time between comparisons of the same tenant. @default 60000 */
+    intervalMs?: number;
+    /** Also log differences that are expected (inherited rows the tenant lacks). @default false */
+    includeExpected?: boolean;
+}
+export interface ShadowReporter {
+    /** Starts a comparison for `tenantId` in the background, if due. */
+    schedule(tenantId: string, legacyControlPlane: string | undefined): void;
+}
+export declare function createShadowReporter(adapters: DataAdapters, options: InheritanceShadowOptions): ShadowReporter;
+//# sourceMappingURL=report.d.ts.map

package/dist/types/inheritance/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../../src/inheritance/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAY,MAAM,UAAU,CAAC;AAGlD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAKD,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;CAC1E;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,wBAAwB,GAChC,cAAc,CAiDhB"}

package/dist/types/inheritance/shadow.d.ts

@@ -0,0 +1,30 @@
+import type { DataAdapters } from "authhero";
+import { ConfigEntity, ConfigRows } from "./types";
+export interface ShadowDiff {
+    entity: ConfigEntity;
+    key: string;
+    kind: "missing" | "extra" | "changed";
+    /** Top-level fields that differ (`changed` only). Values are never logged. */
+    fields: string[];
+    /**
+     * The new model materialises inherited rows into the tenant, where
+     * read-time inheritance only overlays rows the tenant already has. A row
+     * that is `extra` for that reason is expected and not a bug.
+     */
+    expected: boolean;
+    legacy_hash?: string;
+    new_hash?: string;
+}
+export declare function sha256(input: string): Promise<string>;
+export declare function diffConfig(legacy: ConfigRows, next: ConfigRows): Promise<ShadowDiff[]>;
+/**
+ * Computes the new resolver's result and the legacy result for a tenant and
+ * returns their differences. Reads only; the resolver result is never used.
+ */
+export declare function compareShadow(params: {
+    adapters: DataAdapters;
+    tenantId: string;
+    legacyControlPlane?: string;
+    maxDepth?: number;
+}): Promise<ShadowDiff[]>;
+//# sourceMappingURL=shadow.d.ts.map

package/dist/types/inheritance/shadow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shadow.d.ts","sourceRoot":"","sources":["../../../src/inheritance/shadow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAK7C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEnD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACtC,8EAA8E;IAC9E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAgBD,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS3D;AA2FD,wBAAsB,UAAU,CAC9B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,EAAE,CAAC,CA+CvB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE;IAC1C,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CA0BxB"}

package/dist/types/inheritance/types.d.ts

@@ -0,0 +1,24 @@
+import type { Action, Branding, Connection, EmailProvider, Hook, HookCode, PromptSetting, ResourceServer } from "authhero";
+/** Plain config rows for one tenant. Singletons are `null` when unset. */
+export interface ConfigRows {
+    connections: Connection[];
+    resourceServers: ResourceServer[];
+    hooks: Hook[];
+    /** Code referenced by `code_id` of the code hooks in `hooks`. */
+    hookCode: HookCode[];
+    actions: Action[];
+    emailProvider: EmailProvider | null;
+    branding: Branding | null;
+    promptSettings: PromptSetting | null;
+}
+export declare const emptyConfigRows: () => ConfigRows;
+export type ConfigEntity = "connection" | "resourceServer" | "hook" | "action" | "emailProvider" | "branding" | "promptSettings";
+/** Result of merging a parent chain into one tenant's config. */
+export interface ResolvedConfig extends ConfigRows {
+    /**
+     * Keys (`<entity>:<key>`) of rows that came from a `platform`-scoped
+     * ancestor row: merged so they can run, but hidden from the tenant.
+     */
+    hidden: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types/inheritance/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/inheritance/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EACR,UAAU,EACV,aAAa,EACb,IAAI,EACJ,QAAQ,EACR,aAAa,EACb,cAAc,EACf,MAAM,UAAU,CAAC;AAElB,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,iEAAiE;IACjE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,aAAa,GAAG,IAAI,CAAC;CACtC;AAED,eAAO,MAAM,eAAe,QAAO,UASjC,CAAC;AAEH,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,gBAAgB,GAChB,MAAM,GACN,QAAQ,GACR,eAAe,GACf,UAAU,GACV,gBAAgB,CAAC;AAErB,iEAAiE;AACjE,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB"}

package/dist/types/init.d.ts

@@ -1,5 +1,8 @@
 import { init, AuthHeroConfig, DataAdapters } from "authhero";
+import type { SyncConfigFn, TenantOperationExecutor } from "./operations";
+import { type RolloutDeps } from "./rollouts";
 import type { ControlPlaneResolver } from "./middleware";
+import type { InheritanceShadowOptions } from "./inheritance";
 /**
  * Control plane configuration for multi-tenancy.
  */
@@ -53,6 +56,28 @@ export interface MultiTenantConfig extends Omit<AuthHeroConfig, "entityHooks" |
      * ```
      */
     resolveControlPlane?: ControlPlaneResolver;
+    /**
+     * Shadow mode for config inheritance: compares the parent chain resolver
+     * with read-time inheritance in the background and logs differences as log
+     * type `cfgdiff`, queryable per tenant. Never affects a response.
+     * `true` uses the defaults.
+     *
+     * @default false
+     */
+    inheritanceShadow?: boolean | InheritanceShadowOptions;
+    /**
+     * How the `sync-defaults` tenant operation reaches a tenant's database. The
+     * default syncs tenants that share the control plane's database in-process
+     * and refuses tenants with their own worker and database; pass a transport
+     * (for example a dispatch push to the tenant worker) to reach those.
+     */
+    syncDefaults?: SyncConfigFn;
+    /**
+     * Starts the per-tenant operations of a fleet rollout. Defaults to the same
+     * inline executor as `sync-defaults` requests; Workflows deployments pass
+     * `createCloudflareWorkflowsExecutor(...)` so waves run durably.
+     */
+    rolloutExecutor?: TenantOperationExecutor;
     /**
      * Control which entities to sync from control plane to child tenants.
      * Set to `false` to disable all syncing.
@@ -102,6 +127,19 @@ export interface MultiTenantResult {
     app: ReturnType<typeof init>["app"];
     /** The control plane tenant ID */
     controlPlaneTenantId: string;
+    /**
+     * What a scheduled handler needs to keep fleet rollouts moving, present when
+     * the control plane carries the rollouts and tenant operations adapters:
+     *
+     * ```typescript
+     * async scheduled(_event, env) {
+     *   if (!rollouts) return;
+     *   await reconcileConfigDrift(rollouts); // catches lost triggers
+     *   await advanceRollouts(rollouts);      // starts the next wave
+     * }
+     * ```
+     */
+    rollouts?: RolloutDeps;
 }
 /**
  * Initialize a multi-tenant AuthHero application with sensible defaults.

package/dist/types/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,cAAc,EAEd,YAAY,EAGb,MAAM,UAAU,CAAC;AAUlB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGzD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,cAAc,EACd,aAAa,GAAG,yBAAyB,CAC1C;IACC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;OAIG;IACH,IAAI,CAAC,EACD;QACE,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACD,KAAK,CAAC;IAEV;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE9B;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,cAAc,CAAC,yBAAyB,CAAC,CAAC;IAEpE;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAE5C;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5C;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,GAAG,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,kCAAkC;IAClC,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CA4N5E"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,cAAc,EAEd,YAAY,EAGb,MAAM,UAAU,CAAC;AAUlB,OAAO,KAAK,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AASpB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,cAAc,EACd,aAAa,GAAG,yBAAyB,CAC1C;IACC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAC;IAEvD;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAE5B;;;;OAIG;IACH,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAE1C;;;;OAIG;IACH,IAAI,CAAC,EACD;QACE,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACD,KAAK,CAAC;IAEV;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE9B;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,cAAc,CAAC,yBAAyB,CAAC,CAAC;IAEpE;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAE5C;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5C;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,GAAG,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,kCAAkC;IAClC,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,WAAW,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAoT5E"}

package/dist/types/middleware/config-sync-mode.d.ts

@@ -0,0 +1,36 @@
+import type { ResolvedControlPlane } from "./settings-inheritance";
+/**
+ * Per-tenant config sync mode (docs/design/tenant-config-inheritance.md,
+ * section 5 step 3). A tenant in `synced` mode reads only its own database:
+ * the resolver below answers `undefined` ("do not inherit") for it, which every
+ * read-time inheritance path already understands.
+ */
+export interface ConfigSyncResolver {
+    /** The control plane to inherit from, or `undefined` for opted-out and synced tenants. */
+    resolve(params: {
+        tenant_id: string;
+    }): Promise<ResolvedControlPlane>;
+    /** Whether the tenant is in `synced` mode. Cached; never throws. */
+    isSynced(tenantId: string): Promise<boolean>;
+    /** Forget a tenant's cached mode (or all of them). */
+    invalidate(tenantId?: string): void;
+}
+export interface ConfigSyncResolverOptions {
+    /** The inheritance target for a tenant before the mode is considered. */
+    base: (tenantId: string) => Promise<ResolvedControlPlane>;
+    /** Reads the tenant row, from the raw (uncached) adapter. */
+    getTenant: (tenantId: string) => Promise<{
+        config_sync?: string | null;
+    } | null>;
+    /** The control plane tenant, which is never treated as synced. */
+    controlPlaneTenantId?: string;
+    /**
+     * How long a tenant's mode is remembered, per isolate. A mode change reaches
+     * other isolates within this time. @default 30000
+     */
+    ttlMs?: number;
+    /** Upper bound on remembered tenants. @default 1000 */
+    maxEntries?: number;
+}
+export declare function createConfigSyncResolver(options: ConfigSyncResolverOptions): ConfigSyncResolver;
+//# sourceMappingURL=config-sync-mode.d.ts.map

package/dist/types/middleware/config-sync-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-sync-mode.d.ts","sourceRoot":"","sources":["../../../src/middleware/config-sync-mode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;;;;GAKG;AAEH,MAAM,WAAW,kBAAkB;IACjC,0FAA0F;IAC1F,OAAO,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACtE,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,sDAAsD;IACtD,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,yEAAyE;IACzE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1D,6DAA6D;IAC7D,SAAS,EAAE,CACT,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACrD,kEAAkE;IAClE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,GACjC,kBAAkB,CAwCpB"}

package/dist/types/middleware/index.d.ts

@@ -109,6 +109,8 @@ export declare function createMultiTenancyMiddleware(config: MultiTenancyConfig)
     Variables: MultiTenancyVariables;
 }>;
 export { createProtectSyncedMiddleware } from "./protect-synced";
-export { createRuntimeFallbackAdapter, withRuntimeFallback, withSystemResourceServerInheritance, mergeClientWithFallback, } from "./settings-inheritance";
+export { createRuntimeFallbackAdapter, withRuntimeFallback, withSystemResourceServerInheritance, mergeClientWithFallback, buildResolver, } from "./settings-inheritance";
+export { createConfigSyncResolver } from "./config-sync-mode";
+export type { ConfigSyncResolver, ConfigSyncResolverOptions, } from "./config-sync-mode";
 export type { RuntimeFallbackConfig, ControlPlaneResolver, } from "./settings-inheritance";
 //# sourceMappingURL=index.d.ts.map

package/dist/types/middleware/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGzC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,UAAU,CAAC;AAIlB;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kCAAkC,CAChD,oBAAoB,EAAE,MAAM,GAC3B,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAUD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAsDD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAsED;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAiCD;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAiBD;AAGD,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAGjE,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGzC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,UAAU,CAAC;AAIlB;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kCAAkC,CAChD,oBAAoB,EAAE,MAAM,GAC3B,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAUD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAsDD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAsED;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAiCD;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAiBD;AAGD,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAGjE,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,EACvB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,YAAY,EACV,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC"}

package/dist/types/middleware/protect-synced.d.ts

@@ -1,5 +1,5 @@
 import { MiddlewareHandler } from "hono";
-import type { DataAdapters } from "authhero";
+import { type DataAdapters } from "authhero";
 /**
  * Bindings for the protect system middleware
  */

package/dist/types/middleware/protect-synced.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protect-synced.d.ts","sourceRoot":"","sources":["../../../src/middleware/protect-synced.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAG7C;;GAEG;AACH,UAAU,qBAAqB;IAC7B,IAAI,EAAE,YAAY,CAAC;CACpB;AAED;;GAEG;AACH,UAAU,sBAAsB;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AA4FD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,IAAI,iBAAiB,CAAC;IACjE,QAAQ,EAAE,qBAAqB,CAAC;IAChC,SAAS,EAAE,sBAAsB,CAAC;CACnC,CAAC,CAmCD"}
+{"version":3,"file":"protect-synced.d.ts","sourceRoot":"","sources":["../../../src/middleware/protect-synced.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEzC,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAG5D;;GAEG;AACH,UAAU,qBAAqB;IAC7B,IAAI,EAAE,YAAY,CAAC;CACpB;AAED;;GAEG;AACH,UAAU,sBAAsB;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAoRD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,IAAI,iBAAiB,CAAC;IACjE,QAAQ,EAAE,qBAAqB,CAAC;IAChC,SAAS,EAAE,sBAAsB,CAAC;CACnC,CAAC,CA0CD"}

package/dist/types/middleware/settings-inheritance.d.ts

@@ -1,4 +1,19 @@
-import { DataAdapters, Client } from "authhero";
+import { DataAdapters, Connection, Client, ResourceServer, ResourceServerScope } from "authhero";
+import { InheritanceShadowOptions } from "../inheritance/report";
+import { ConfigSyncResolver } from "./config-sync-mode";
+/**
+ * Merges a connection with control plane fallback options.
+ */
+export declare function mergeConnectionWithFallback(connection: Connection, controlPlaneConnections: Connection[]): Connection;
+/**
+ * Merges resource server scopes with control plane fallback.
+ * Tenant-specific scopes override control plane scopes with the same value.
+ */
+export declare function mergeResourceServerScopes(tenantScopes: ResourceServerScope[] | undefined, controlPlaneScopes: ResourceServerScope[] | undefined): ResourceServerScope[];
+/**
+ * Merges a resource server with control plane fallback scopes.
+ */
+export declare function mergeResourceServerWithFallback(resourceServer: ResourceServer, controlPlaneResourceServer: ResourceServer | null): ResourceServer;
 /**
  * Merges a client with control plane fallback URLs.
  *
@@ -16,7 +31,7 @@ export declare function mergeClientWithFallback(client: Client, controlPlaneClie
  * Resolved inheritance target for a single tenant. `undefined` means the
  * tenant opts out of inheritance entirely.
  */
-type ResolvedControlPlane = {
+export type ResolvedControlPlane = {
     tenantId: string;
     clientId?: string;
 } | undefined;
@@ -31,6 +46,17 @@ type ResolvedControlPlane = {
 export type ControlPlaneResolver = (params: {
     tenant_id: string;
 }) => ResolvedControlPlane | Promise<ResolvedControlPlane>;
+/**
+ * Builds a single resolver from either a static `{tenantId, clientId}` pair
+ * or a user-supplied resolver. The user-supplied resolver, when present,
+ * fully replaces the static fallback — that's the lever a caller uses to
+ * disable inheritance for individual tenants by returning `undefined`.
+ */
+export declare function buildResolver(config: {
+    controlPlaneTenantId?: string;
+    controlPlaneClientId?: string;
+    resolveControlPlane?: ControlPlaneResolver;
+}): (tenantId: string) => Promise<ResolvedControlPlane>;
 /**
  * Wraps data adapters with is_system-gated resource server scope inheritance
  * from a control plane tenant.
@@ -75,6 +101,22 @@ export interface RuntimeFallbackConfig {
      * control plane id.
      */
     resolveControlPlane?: ControlPlaneResolver;
+    /**
+     * Shadow mode for config inheritance. When set, reads also start a
+     * background comparison of the parent chain resolver against the result of
+     * this adapter and log differences with log type `cfgdiff`. The comparison
+     * never changes what a request sees. `true` uses the defaults.
+     *
+     * @default false
+     */
+    inheritanceShadow?: boolean | InheritanceShadowOptions;
+    /**
+     * Per-tenant `config_sync` mode support. Tenants in `synced` mode read only
+     * their own database. Pass a resolver to share its cache with other adapters
+     * (the management adapter); omit it and one is created. Failed lookups fall
+     * back to inheriting.
+     */
+    configSync?: ConfigSyncResolver;
 }
 /**
  * Creates a data adapter wrapper that provides runtime settings fallback from a control plane tenant.
@@ -112,6 +154,13 @@ export interface RuntimeFallbackConfig {
  * ```
  */
 export declare function createRuntimeFallbackAdapter(baseAdapters: DataAdapters, config: RuntimeFallbackConfig): DataAdapters;
+/**
+ * Returns true when a hook is marked as inheritable by the control plane.
+ * Inheritable hooks surface on every sub-tenant's `hooks.list` so a single
+ * control-plane row drives behaviour fleet-wide. Reads `metadata.inheritable`
+ * on any hook variant (web/form/template/code).
+ */
+export declare function isInheritableHook(hook: unknown): boolean;
 /**
  * Helper function to wrap data adapters with runtime fallback from control plane.
  *
@@ -132,5 +181,4 @@ export declare function createRuntimeFallbackAdapter(baseAdapters: DataAdapters,
  * ```
  */
 export declare function withRuntimeFallback(baseAdapters: DataAdapters, config: RuntimeFallbackConfig): DataAdapters;
-export {};
 //# sourceMappingURL=settings-inheritance.d.ts.map

package/dist/types/middleware/settings-inheritance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAEZ,MAAM,EAKP,MAAM,UAAU,CAAC;AA8FlB;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAChC,MAAM,CAqBR;AAED;;;GAGG;AACH,KAAK,oBAAoB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB,KAAK,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAyH3D;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE;IACN,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C,GACA,YAAY,CAYd;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CA6Jd;AA2FD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}
+{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,UAAU,EACV,MAAM,EACN,cAAc,EACd,mBAAmB,EAGpB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,kBAAkB,EAEnB,MAAM,oBAAoB,CAAC;AAE5B;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,UAAU,EACtB,uBAAuB,EAAE,UAAU,EAAE,GACpC,UAAU,CAwBZ;AAcD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,mBAAmB,EAAE,GAAG,SAAS,EAC/C,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,SAAS,GACpD,mBAAmB,EAAE,CAmBvB;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,cAAc,EAAE,cAAc,EAC9B,0BAA0B,EAAE,cAAc,GAAG,IAAI,GAChD,cAAc,CAYhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAChC,MAAM,CAqBR;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC,SAAS,CAAC;AAEd;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB,KAAK,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAiBtD;AA4FD;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE;IACN,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C,GACA,YAAY,CAYd;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAC;IAEvD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CA6Ld;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAKxD;AA2FD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}

package/dist/types/operations/enqueue.d.ts

@@ -13,5 +13,12 @@ export declare function createOperationRow(stores: TenantOperationStores, params
  * finalized it) and the error is rethrown so callers keep their existing
  * failure semantics.
  */
-export declare function enqueueTenantOperation(stores: TenantOperationStores, executor: TenantOperationExecutor, params: EnqueueTenantOperationParams): Promise<TenantOperation>;
+export declare function enqueueTenantOperation(stores: TenantOperationStores, executor: TenantOperationExecutor, params: EnqueueTenantOperationParams, options?: {
+    /**
+     * Resolve with the failed operation row instead of rethrowing when the
+     * executor's run fails. For operations whose row is the deliverable
+     * (a sync reports its outcome there), not for callers that need the error.
+     */
+    returnFailed?: boolean;
+}): Promise<TenantOperation>;
 //# sourceMappingURL=enqueue.d.ts.map

package/dist/types/operations/enqueue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enqueue.d.ts","sourceRoot":"","sources":["../../../src/operations/enqueue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAIjB;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,4BAA4B,EACpC,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,GACxC,OAAO,CAAC,eAAe,CAAC,CAyB1B;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,uBAAuB,EACjC,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,eAAe,CAAC,CAgC1B"}
+{"version":3,"file":"enqueue.d.ts","sourceRoot":"","sources":["../../../src/operations/enqueue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAIjB;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,4BAA4B,EACpC,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,GACxC,OAAO,CAAC,eAAe,CAAC,CA0B1B;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,uBAAuB,EACjC,MAAM,EAAE,4BAA4B,EACpC,OAAO,GAAE;IACP;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACnB,GACL,OAAO,CAAC,eAAe,CAAC,CAmC1B"}

package/dist/types/operations/index.d.ts

@@ -4,6 +4,8 @@ export { createOperationRecorder, errorToMessage, isTerminalStatus, } from "./re
 export type { OperationRecorder } from "./recorder";
 export { createInlineExecutor, inlineStepRunner } from "./inline-executor";
 export type { InlineExecutorConfig, TenantOperationDefinitions, TenantOperationStep, TenantOperationStepContext, } from "./inline-executor";
-export { enqueueTenantOperation } from "./enqueue";
+export { createOperationRow, enqueueTenantOperation } from "./enqueue";
+export { createInProcessSyncConfig, runSyncDefaultsStep, summarizeSyncResult, syncErrors, syncOptionsOf, } from "./sync-defaults";
+export type { SyncConfigFn, SyncConfigOptions } from "./sync-defaults";
 export { runRecordedTenantOperation } from "./record-provision";
 //# sourceMappingURL=index.d.ts.map

package/dist/types/operations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/operations/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/operations/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/types/operations/recorder.d.ts

@@ -20,6 +20,8 @@ export declare function createOperationRecorder(stores: TenantOperationStores):
         detail?: Record<string, unknown>;
         attempt?: number;
     }): Promise<void>;
+    /** Stores the operation's outcome (e.g. a dry-run diff). Idempotent. */
+    setResult(operationId: string, result: Record<string, unknown>): Promise<void>;
     markSucceeded(operationId: string): Promise<void>;
     markFailed(operationId: string, error: unknown): Promise<void>;
 };

package/dist/types/operations/recorder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recorder.d.ts","sourceRoot":"","sources":["../../../src/operations/recorder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAIhD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAcrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB;6BAIlC,MAAM,gBAAgB,MAAM;gCAOzB,MAAM,QAAQ,MAAM;6BAKvC,MAAM,SACZ;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EACH,SAAS,GACT,WAAW,GACX,QAAQ,GACR,SAAS,GACT,SAAS,GACT,YAAY,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;+BAW8B,MAAM;4BAQT,MAAM,SAAS,OAAO;EAQvD;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE3E,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,OAAO,CAI3E"}
+{"version":3,"file":"recorder.d.ts","sourceRoot":"","sources":["../../../src/operations/recorder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAIhD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAcrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB;6BAIlC,MAAM,gBAAgB,MAAM;gCAOzB,MAAM,QAAQ,MAAM;6BAKvC,MAAM,SACZ;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EACH,SAAS,GACT,WAAW,GACX,QAAQ,GACR,SAAS,GACT,SAAS,GACT,YAAY,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;IAWH,wEAAwE;2BAC3C,MAAM,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;+BAInC,MAAM;4BAQT,MAAM,SAAS,OAAO;EAQvD;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE3E,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,OAAO,CAI3E"}

package/dist/types/operations/sync-defaults.d.ts

@@ -0,0 +1,55 @@
+import type { DataAdapters, TenantOperation } from "authhero";
+import { ApplyResolvedBlockResult } from "../rollout/resolved-sync";
+import type { ControlPlaneResolver } from "../middleware";
+import type { OperationRecorder } from "./recorder";
+/**
+ * The `sync-defaults` tenant operation (docs/design/tenant-config-inheritance.md
+ * sections 4.1 and 5 step 4): sync one tenant's resolved parent-chain config
+ * into its own database, as a tracked operation with history.
+ *
+ * Execution is split from transport. The steps below are shared by the inline
+ * and the Cloudflare Workflows executor; how the block reaches the tenant's
+ * database (in-process, or pushed to a tenant worker) is a `SyncConfigFn`.
+ */
+export interface SyncConfigOptions {
+    /** Compute and report the diff; write nothing. */
+    dryRun: boolean;
+    /** Apply even when the tenant's stored hash equals the block's. */
+    force: boolean;
+}
+/** Syncs one tenant and returns what happened (or, for a dry run, what would). */
+export type SyncConfigFn = (tenantId: string, options: SyncConfigOptions) => Promise<ApplyResolvedBlockResult>;
+/** Reads the operation's `input` (fixed at creation, never secrets). */
+export declare function syncOptionsOf(operation: Pick<TenantOperation, "input">): SyncConfigOptions;
+/** Every per-entity error message the sync reported. */
+export declare function syncErrors(result: ApplyResolvedBlockResult): string[];
+/**
+ * The JSON-serialisable outcome stored in the operation's `result`: the status,
+ * hash, per-entity counts and the changed `entity:key` list. Never row content
+ * or secrets.
+ */
+export declare function summarizeSyncResult(result: ApplyResolvedBlockResult, options: SyncConfigOptions): Record<string, unknown>;
+/**
+ * The step both executors run: sync, record the outcome on the operation row,
+ * and fail the step when any row reported an error. The result is written
+ * before the failure is raised so a failed run still shows what it did.
+ */
+export declare function runSyncDefaultsStep(params: {
+    operation: Pick<TenantOperation, "id" | "tenant_id" | "input">;
+    syncConfig: SyncConfigFn;
+    recorder: Pick<OperationRecorder, "setResult">;
+}): Promise<Record<string, unknown>>;
+/**
+ * Sync for tenants whose database is the control plane's own (shared
+ * deployments). Reads the chain from, and applies the block to, `adapters`,
+ * which should be the layer that returns secrets as stored (ciphertext) so they
+ * are copied without being decrypted. A tenant with its own worker and database
+ * (`deployment_type: "wfp"`) is not reachable this way: use a dispatch
+ * transport.
+ */
+export declare function createInProcessSyncConfig(adapters: DataAdapters, config: {
+    controlPlaneTenantId: string;
+    resolveControlPlane?: ControlPlaneResolver;
+    maxDepth?: number;
+}): SyncConfigFn;
+//# sourceMappingURL=sync-defaults.d.ts.map

package/dist/types/operations/sync-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-defaults.d.ts","sourceRoot":"","sources":["../../../src/operations/sync-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC9D,OAAO,EACL,wBAAwB,EAGzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;;;GAQG;AAEH,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,MAAM,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,kFAAkF;AAClF,MAAM,MAAM,YAAY,GAAG,CACzB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,KACvB,OAAO,CAAC,wBAAwB,CAAC,CAAC;AAEvC,wEAAwE;AACxE,wBAAgB,aAAa,CAC3B,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,GACxC,iBAAiB,CAGnB;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,EAAE,CAErE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,wBAAwB,EAChC,OAAO,EAAE,iBAAiB,GACzB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmBzB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,CAAC,CAAC;IAC/D,UAAU,EAAE,YAAY,CAAC;IACzB,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;CAChD,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAqBnC;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE;IACN,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,YAAY,CAwBd"}

package/dist/types/operations/types.d.ts

@@ -34,6 +34,8 @@ export interface EnqueueTenantOperationParams {
     initiated_by?: string;
     target_worker_version?: string;
     target_database_version?: string;
+    /** Kind-specific parameters, fixed at creation. Never contains secrets. */
+    input?: Record<string, unknown>;
 }
 /**
  * Executes an already-persisted operation row. Row-first contract: the