@authhero/multi-tenancy 15.2.0 → 15.4.0

package/dist/types/index.d.ts

@@ -3,14 +3,17 @@ import { MultiTenancyConfig, MultiTenancyHooks, MultiTenancyBindings, MultiTenan
 export * from "./types";
 export { initMultiTenant } from "./init";
 export type { MultiTenantConfig, MultiTenantResult, ControlPlaneConfig, } from "./init";
-export { createDirectRolloutAdapter, projectControlPlaneDefaults, buildControlPlaneDefaultsPayload, applyControlPlaneDefaultsPayload, } from "./rollout";
-export type { ControlPlaneRolloutAdapter, DefaultsProjectionConfig, DefaultsProjectionEntities, DefaultsProjectionResult, EntityProjectionOutcome, ProjectableDefaults, ControlPlaneDefaultsPayload, ControlPlaneDefaultsApplyResult, ControlPlaneTenantSeed, DefaultsPayloadEntities, } from "./rollout";
+export { createDirectRolloutAdapter, projectControlPlaneDefaults, buildControlPlaneDefaultsPayload, applyControlPlaneDefaultsPayload, applyResolvedConfigBlock, buildResolvedConfigBlock, findUndecryptableKeyIds, syncedRowId, } from "./rollout";
+export type { ControlPlaneRolloutAdapter, DefaultsProjectionConfig, DefaultsProjectionEntities, DefaultsProjectionResult, EntityProjectionOutcome, ProjectableDefaults, ControlPlaneDefaultsPayload, ControlPlaneDefaultsApplyResult, ControlPlaneTenantSeed, DefaultsPayloadEntities, ApplyResolvedBlockOptions, ApplyResolvedBlockResult, BuildResolvedBlockOptions, ResolvedConfigBlock, SyncEntity, SyncEntityOutcome, } from "./rollout";
 export * from "./operations";
+export * from "./rollouts";
 export { createSyncHooks } from "./hooks/sync";
 export type { EntitySyncConfig, SyncHooksResult } from "./hooks/sync";
 export { createTenantsOpenAPIRouter } from "./routes";
 export { createMultiTenancyMiddleware, createAccessControlMiddleware, createControlPlaneTenantMiddleware, createSubdomainMiddleware, createDatabaseMiddleware, createProtectSyncedMiddleware, createRuntimeFallbackAdapter, withRuntimeFallback, withSystemResourceServerInheritance, mergeClientWithFallback, } from "./middleware";
 export type { RuntimeFallbackConfig, ControlPlaneResolver } from "./middleware";
+export { createConfigSyncResolver } from "./middleware";
+export type { ConfigSyncResolver, ConfigSyncResolverOptions, } from "./middleware";
 export * from "./inheritance";
 export { createMultiTenancyPlugin } from "./plugin";
 export type { AuthHeroPlugin } from "./plugin";

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAajB,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAKhB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAMnB,cAAc,cAAc,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,kCAAkC,EAClC,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAChF,cAAc,eAAe,CAAC;AAE9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAgBnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB;cAE/C,oBAAoB;eACnB,qBAAqB;0CASnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB;;;;;;;kBAnD9C,oBAAoB;mBACnB,qBAAqB;;;IAwDhC;;;;;;;OAOG;6BAES,OAAO,UAAU,EAAE,YAAY,qBACtB;QAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE;EAOzD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAajB,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAKhB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,gCAAgC,EAChC,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,WAAW,GACZ,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,UAAU,EACV,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAMnB,cAAc,cAAc,CAAC;AAI7B,cAAc,YAAY,CAAC;AAG3B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,kCAAkC,EAClC,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,YAAY,EACV,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,cAAc,eAAe,CAAC;AAE9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAgBnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB;cAE/C,oBAAoB;eACnB,qBAAqB;0CASnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB;;;;;;;kBAnD9C,oBAAoB;mBACnB,qBAAqB;;;IAwDhC;;;;;;;OAOG;6BAES,OAAO,UAAU,EAAE,YAAY,qBACtB;QAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE;EAOzD"}

package/dist/types/inheritance/legacy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"legacy.d.ts","sourceRoot":"","sources":["../../../src/inheritance/legacy.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiCrC;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,YAAY,EAAE,UAAU,GAAG,SAAS,GACnC,UAAU,CAiCZ"}
+{"version":3,"file":"legacy.d.ts","sourceRoot":"","sources":["../../../src/inheritance/legacy.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiCrC;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,YAAY,EAAE,UAAU,GAAG,SAAS,GACnC,UAAU,CAkCZ"}

package/dist/types/inheritance/merge.d.ts

@@ -17,6 +17,7 @@ export declare function effectiveScope(entity: ConfigEntity, row: Publishable):
  * legacy merge behaves: the tenant's values win.
  */
 export declare function effectiveOverride(row: Publishable): ConfigOverride;
+export declare const SECRET_KEY: RegExp;
 type Layer = ConfigRows;
 /**
  * Merges the config of a parent chain with the tenant's own, with no I/O.

package/dist/types/inheritance/merge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../../src/inheritance/merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,cAAc,EACd,WAAW,EAIZ,MAAM,UAAU,CAAC;AAKlB,OAAO,EACL,YAAY,EACZ,UAAU,EACV,cAAc,EAEf,MAAM,SAAS,CAAC;AAEjB,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,WAAW,GACf,WAAW,CAcb;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAElE;AA4ED,KAAK,KAAK,GAAG,UAAU,CAAC;AAExB;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,GAAG,cAAc,CA0GzE"}
+{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../../src/inheritance/merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,cAAc,EACd,WAAW,EAKZ,MAAM,UAAU,CAAC;AAKlB,OAAO,EACL,YAAY,EACZ,UAAU,EACV,cAAc,EAEf,MAAM,SAAS,CAAC;AAEjB,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,WAAW,GACf,WAAW,CAcb;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAElE;AAED,eAAO,MAAM,UAAU,QAA+C,CAAC;AA0EvE,KAAK,KAAK,GAAG,UAAU,CAAC;AAExB;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,GAAG,cAAc,CA0HzE"}

package/dist/types/inheritance/read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/inheritance/read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAoB,MAAM,UAAU,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,6DAA6D;AAC7D,wBAAsB,cAAc,CAClC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CAerB"}
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/inheritance/read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA8B,MAAM,UAAU,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,6DAA6D;AAC7D,wBAAsB,cAAc,CAClC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CA8BrB"}

package/dist/types/inheritance/report.d.ts

@@ -13,8 +13,12 @@ export interface InheritanceShadowOptions {
     includeExpected?: boolean;
 }
 export interface ShadowReporter {
-    /** Starts a comparison for `tenantId` in the background, if due. */
-    schedule(tenantId: string, legacyControlPlane: string | undefined): void;
+    /**
+     * Starts a comparison for `tenantId` in the background, if due, and returns
+     * it (never rejecting) so a host that must keep the work alive, such as a
+     * Worker with `ctx.waitUntil`, can wait for it. Undefined when none started.
+     */
+    schedule(tenantId: string, legacyControlPlane: string | undefined): Promise<void> | undefined;
 }
 export declare function createShadowReporter(adapters: DataAdapters, options: InheritanceShadowOptions): ShadowReporter;
 //# sourceMappingURL=report.d.ts.map

package/dist/types/inheritance/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../../src/inheritance/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAY,MAAM,UAAU,CAAC;AAGlD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAKD,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;CAC1E;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,wBAAwB,GAChC,cAAc,CAiDhB"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../../src/inheritance/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAY,MAAM,UAAU,CAAC;AAGlD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAKD,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,kBAAkB,EAAE,MAAM,GAAG,SAAS,GACrC,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;CAC9B;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,wBAAwB,GAChC,cAAc,CAiDhB"}

package/dist/types/inheritance/types.d.ts

@@ -1,9 +1,11 @@
-import type { Action, Branding, Connection, EmailProvider, Hook, PromptSetting, ResourceServer } from "authhero";
+import type { Action, Branding, Connection, EmailProvider, Hook, HookCode, PromptSetting, ResourceServer } from "authhero";
 /** Plain config rows for one tenant. Singletons are `null` when unset. */
 export interface ConfigRows {
     connections: Connection[];
     resourceServers: ResourceServer[];
     hooks: Hook[];
+    /** Code referenced by `code_id` of the code hooks in `hooks`. */
+    hookCode: HookCode[];
     actions: Action[];
     emailProvider: EmailProvider | null;
     branding: Branding | null;

package/dist/types/inheritance/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/inheritance/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EACR,UAAU,EACV,aAAa,EACb,IAAI,EACJ,aAAa,EACb,cAAc,EACf,MAAM,UAAU,CAAC;AAElB,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,aAAa,GAAG,IAAI,CAAC;CACtC;AAED,eAAO,MAAM,eAAe,QAAO,UAQjC,CAAC;AAEH,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,gBAAgB,GAChB,MAAM,GACN,QAAQ,GACR,eAAe,GACf,UAAU,GACV,gBAAgB,CAAC;AAErB,iEAAiE;AACjE,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/inheritance/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EACR,UAAU,EACV,aAAa,EACb,IAAI,EACJ,QAAQ,EACR,aAAa,EACb,cAAc,EACf,MAAM,UAAU,CAAC;AAElB,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,iEAAiE;IACjE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,aAAa,GAAG,IAAI,CAAC;CACtC;AAED,eAAO,MAAM,eAAe,QAAO,UASjC,CAAC;AAEH,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,gBAAgB,GAChB,MAAM,GACN,QAAQ,GACR,eAAe,GACf,UAAU,GACV,gBAAgB,CAAC;AAErB,iEAAiE;AACjE,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB"}

package/dist/types/init.d.ts

@@ -1,4 +1,7 @@
-import { init, AuthHeroConfig, DataAdapters } from "authhero";
+import { init, AuthHeroConfig, DataAdapters, type ExecuteTenantMemberRequestOptions, type TenantMembersBackend } from "authhero";
+import { enqueueTenantMemberRequest } from "./operations";
+import type { DetachConfigFn, ReconcileTenantMemberRequestsDeps, ReconcileTenantMemberRequestsResult, SyncConfigFn, TenantMemberRequestStore, TenantOperationExecutor } from "./operations";
+import { type RolloutDeps } from "./rollouts";
 import type { ControlPlaneResolver } from "./middleware";
 import type { InheritanceShadowOptions } from "./inheritance";
 /**
@@ -63,6 +66,55 @@ export interface MultiTenantConfig extends Omit<AuthHeroConfig, "entityHooks" |
      * @default false
      */
     inheritanceShadow?: boolean | InheritanceShadowOptions;
+    /**
+     * How the `sync-defaults` tenant operation reaches a tenant's database. The
+     * default syncs tenants that share the control plane's database in-process
+     * and refuses tenants with their own worker and database; pass a transport
+     * (for example a dispatch push to the tenant worker) to reach those.
+     */
+    syncDefaults?: SyncConfigFn;
+    /**
+     * How the `detach` tenant operation reaches a tenant's database. The default
+     * works on tenants that share the control plane's database, in-process, and
+     * refuses tenants with their own worker and database.
+     */
+    detachTenant?: DetachConfigFn;
+    /**
+     * Carries out the team changes that tenants register as requests (issue
+     * #1550) as `tenant-members-request` tenant operations, and answers the
+     * request with the outcome. Needs the tenant operations adapters, and
+     * returns `memberRequests` for the notify endpoint and the scheduled sweep.
+     */
+    tenantMemberRequests?: {
+        /**
+         * The control-plane team backend, built without a request in hand
+         * (`createLocalTenantMembersBackend` bound to the control-plane database).
+         */
+        getBackend: () => TenantMembersBackend | Promise<TenantMembersBackend>;
+        /**
+         * How the requests are read and answered. The default reaches tenants that
+         * share the control plane's database; pass a transport (for example a
+         * dispatch push to the tenant worker) for tenants with their own database.
+         */
+        store?: TenantMemberRequestStore;
+        /** Who may still ask. See `executeTenantMemberRequest`. */
+        isRequesterAllowed?: ExecuteTenantMemberRequestOptions["isRequesterAllowed"];
+    };
+    /**
+     * How long each isolate remembers a tenant's `config_sync` mode. The
+     * isolates that did not handle the `PATCH` notice a flip within this time.
+     * It does not cover a cached client bundle, which can keep serving what was
+     * read under the old mode for up to 15 minutes. Lower it for a faster flip at the cost of
+     * one more `tenants.get` per isolate and tenant per period.
+     * @default 10000
+     */
+    configSyncCacheTtlMs?: number;
+    /**
+     * Starts the per-tenant operations of a fleet rollout. Defaults to the same
+     * inline executor as `sync-defaults` requests; Workflows deployments pass
+     * `createCloudflareWorkflowsExecutor(...)` so waves run durably.
+     */
+    rolloutExecutor?: TenantOperationExecutor;
     /**
      * Control which entities to sync from control plane to child tenants.
      * Set to `false` to disable all syncing.
@@ -112,6 +164,37 @@ export interface MultiTenantResult {
     app: ReturnType<typeof init>["app"];
     /** The control plane tenant ID */
     controlPlaneTenantId: string;
+    /**
+     * What a scheduled handler needs to keep fleet rollouts moving, present when
+     * the control plane carries the rollouts and tenant operations adapters:
+     *
+     * ```typescript
+     * async scheduled(_event, env) {
+     *   if (!rollouts) return;
+     *   await reconcileConfigDrift(rollouts); // catches lost triggers
+     *   await advanceRollouts(rollouts);      // starts the next wave
+     * }
+     * ```
+     */
+    rollouts?: RolloutDeps;
+    /**
+     * Present when `tenantMemberRequests` is configured and the control plane
+     * carries the tenant operations adapters.
+     *
+     * ```typescript
+     * // proxyControlPlane.tenantMembers.requests
+     * onNotify: (_c, tenantId, requestId) =>
+     *   memberRequests.enqueue(tenantId, requestId).then(() => {}),
+     * // and in a scheduled handler, because a tenant worker cannot run a cron
+     * await memberRequests.reconcile();
+     * ```
+     */
+    memberRequests?: {
+        /** Runs the request for a tenant, once however often it is called. */
+        enqueue(tenantId: string, requestId: string): ReturnType<typeof enqueueTenantMemberRequest>;
+        /** Finds requests that were never run, or whose run failed, and runs them. */
+        reconcile(options?: Partial<Pick<ReconcileTenantMemberRequestsDeps, "tenantIds" | "graceMs" | "maxAttempts">>): Promise<ReconcileTenantMemberRequestsResult>;
+    };
 }
 /**
  * Initialize a multi-tenant AuthHero application with sensible defaults.

package/dist/types/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,cAAc,EAEd,YAAY,EAGb,MAAM,UAAU,CAAC;AAUlB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,cAAc,EACd,aAAa,GAAG,yBAAyB,CAC1C;IACC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAC;IAEvD;;;;OAIG;IACH,IAAI,CAAC,EACD;QACE,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACD,KAAK,CAAC;IAEV;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE9B;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,cAAc,CAAC,yBAAyB,CAAC,CAAC;IAEpE;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAE5C;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5C;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,GAAG,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,kCAAkC;IAClC,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CA8N5E"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,cAAc,EAEd,YAAY,EAGZ,KAAK,iCAAiC,EACtC,KAAK,oBAAoB,EAC1B,MAAM,UAAU,CAAC;AAGlB,OAAO,EAML,0BAA0B,EAM3B,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EACV,cAAc,EACd,iCAAiC,EACjC,mCAAmC,EACnC,YAAY,EACZ,wBAAwB,EACxB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AASpB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,cAAc,EACd,aAAa,GAAG,yBAAyB,CAC1C;IACC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAC;IAEvD;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAE5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,cAAc,CAAC;IAE9B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE;QACrB;;;WAGG;QACH,UAAU,EAAE,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACvE;;;;WAIG;QACH,KAAK,CAAC,EAAE,wBAAwB,CAAC;QACjC,2DAA2D;QAC3D,kBAAkB,CAAC,EAAE,iCAAiC,CAAC,oBAAoB,CAAC,CAAC;KAC9E,CAAC;IAEF;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAE1C;;;;OAIG;IACH,IAAI,CAAC,EACD;QACE,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACD,KAAK,CAAC;IAEV;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE9B;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,cAAc,CAAC,yBAAyB,CAAC,CAAC;IAEpE;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAE5C;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5C;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,GAAG,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,kCAAkC;IAClC,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE;QACf,sEAAsE;QACtE,OAAO,CACL,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC;QACjD,8EAA8E;QAC9E,SAAS,CACP,OAAO,CAAC,EAAE,OAAO,CACf,IAAI,CACF,iCAAiC,EACjC,WAAW,GAAG,SAAS,GAAG,aAAa,CACxC,CACF,GACA,OAAO,CAAC,mCAAmC,CAAC,CAAC;KACjD,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CA+Z5E"}

package/dist/types/middleware/config-sync-mode.d.ts

@@ -0,0 +1,39 @@
+import type { ResolvedControlPlane } from "./settings-inheritance";
+/**
+ * Per-tenant config sync mode (docs/design/tenant-config-inheritance.md,
+ * section 5 step 3). A tenant in `synced` mode reads only its own database:
+ * the resolver below answers `undefined` ("do not inherit") for it, which every
+ * read-time inheritance path already understands.
+ */
+export interface ConfigSyncResolver {
+    /** The control plane to inherit from, or `undefined` for opted-out and synced tenants. */
+    resolve(params: {
+        tenant_id: string;
+    }): Promise<ResolvedControlPlane>;
+    /** Whether the tenant is in `synced` mode. Cached; never throws. */
+    isSynced(tenantId: string): Promise<boolean>;
+    /** Forget a tenant's cached mode (or all of them). */
+    invalidate(tenantId?: string): void;
+}
+export interface ConfigSyncResolverOptions {
+    /** The inheritance target for a tenant before the mode is considered. */
+    base: (tenantId: string) => Promise<ResolvedControlPlane>;
+    /** Reads the tenant row, from the raw (uncached) adapter. */
+    getTenant: (tenantId: string) => Promise<{
+        config_sync?: string | null;
+    } | null>;
+    /** The control plane tenant, which is never treated as synced. */
+    controlPlaneTenantId?: string;
+    /**
+     * How long a tenant's mode is remembered, per isolate. A mode change reaches
+     * other isolates within this time, so it is also how long to wait after a flip
+     * before judging the result. @default 10000
+     */
+    ttlMs?: number;
+    /** Upper bound on remembered tenants. @default 1000 */
+    maxEntries?: number;
+}
+/** How long an isolate remembers a tenant's `config_sync` mode. */
+export declare const DEFAULT_CONFIG_SYNC_TTL_MS = 10000;
+export declare function createConfigSyncResolver(options: ConfigSyncResolverOptions): ConfigSyncResolver;
+//# sourceMappingURL=config-sync-mode.d.ts.map

package/dist/types/middleware/config-sync-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-sync-mode.d.ts","sourceRoot":"","sources":["../../../src/middleware/config-sync-mode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;;;;GAKG;AAEH,MAAM,WAAW,kBAAkB;IACjC,0FAA0F;IAC1F,OAAO,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACtE,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,sDAAsD;IACtD,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,yEAAyE;IACzE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1D,6DAA6D;IAC7D,SAAS,EAAE,CACT,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACrD,kEAAkE;IAClE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mEAAmE;AACnE,eAAO,MAAM,0BAA0B,QAAS,CAAC;AAEjD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,GACjC,kBAAkB,CA2CpB"}

package/dist/types/middleware/index.d.ts

@@ -109,6 +109,8 @@ export declare function createMultiTenancyMiddleware(config: MultiTenancyConfig)
     Variables: MultiTenancyVariables;
 }>;
 export { createProtectSyncedMiddleware } from "./protect-synced";
-export { createRuntimeFallbackAdapter, withRuntimeFallback, withSystemResourceServerInheritance, mergeClientWithFallback, } from "./settings-inheritance";
+export { createRuntimeFallbackAdapter, withRuntimeFallback, withSystemResourceServerInheritance, mergeClientWithFallback, buildResolver, } from "./settings-inheritance";
+export { createConfigSyncResolver } from "./config-sync-mode";
+export type { ConfigSyncResolver, ConfigSyncResolverOptions, } from "./config-sync-mode";
 export type { RuntimeFallbackConfig, ControlPlaneResolver, } from "./settings-inheritance";
 //# sourceMappingURL=index.d.ts.map

package/dist/types/middleware/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGzC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,UAAU,CAAC;AAIlB;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kCAAkC,CAChD,oBAAoB,EAAE,MAAM,GAC3B,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAUD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAsDD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAsED;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAiCD;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAiBD;AAGD,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAGjE,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGzC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,UAAU,CAAC;AAIlB;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kCAAkC,CAChD,oBAAoB,EAAE,MAAM,GAC3B,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAUD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAsDD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAsED;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAiCD;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;CAClC,CAAC,CAiBD;AAGD,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAGjE,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,uBAAuB,EACvB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,YAAY,EACV,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC"}

package/dist/types/middleware/protect-synced.d.ts

@@ -1,5 +1,5 @@
 import { MiddlewareHandler } from "hono";
-import type { DataAdapters } from "authhero";
+import { type DataAdapters } from "authhero";
 /**
  * Bindings for the protect system middleware
  */

package/dist/types/middleware/protect-synced.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protect-synced.d.ts","sourceRoot":"","sources":["../../../src/middleware/protect-synced.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAG7C;;GAEG;AACH,UAAU,qBAAqB;IAC7B,IAAI,EAAE,YAAY,CAAC;CACpB;AAED;;GAEG;AACH,UAAU,sBAAsB;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AA4FD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,IAAI,iBAAiB,CAAC;IACjE,QAAQ,EAAE,qBAAqB,CAAC;IAChC,SAAS,EAAE,sBAAsB,CAAC;CACnC,CAAC,CAmCD"}
+{"version":3,"file":"protect-synced.d.ts","sourceRoot":"","sources":["../../../src/middleware/protect-synced.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEzC,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAG5D;;GAEG;AACH,UAAU,qBAAqB;IAC7B,IAAI,EAAE,YAAY,CAAC;CACpB;AAED;;GAEG;AACH,UAAU,sBAAsB;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAoRD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,IAAI,iBAAiB,CAAC;IACjE,QAAQ,EAAE,qBAAqB,CAAC;IAChC,SAAS,EAAE,sBAAsB,CAAC;CACnC,CAAC,CA0CD"}

package/dist/types/middleware/settings-inheritance.d.ts

@@ -1,5 +1,6 @@
 import { DataAdapters, Connection, Client, ResourceServer, ResourceServerScope } from "authhero";
 import { InheritanceShadowOptions } from "../inheritance/report";
+import { ConfigSyncResolver } from "./config-sync-mode";
 /**
  * Merges a connection with control plane fallback options.
  */
@@ -30,7 +31,7 @@ export declare function mergeClientWithFallback(client: Client, controlPlaneClie
  * Resolved inheritance target for a single tenant. `undefined` means the
  * tenant opts out of inheritance entirely.
  */
-type ResolvedControlPlane = {
+export type ResolvedControlPlane = {
     tenantId: string;
     clientId?: string;
 } | undefined;
@@ -45,6 +46,17 @@ type ResolvedControlPlane = {
 export type ControlPlaneResolver = (params: {
     tenant_id: string;
 }) => ResolvedControlPlane | Promise<ResolvedControlPlane>;
+/**
+ * Builds a single resolver from either a static `{tenantId, clientId}` pair
+ * or a user-supplied resolver. The user-supplied resolver, when present,
+ * fully replaces the static fallback — that's the lever a caller uses to
+ * disable inheritance for individual tenants by returning `undefined`.
+ */
+export declare function buildResolver(config: {
+    controlPlaneTenantId?: string;
+    controlPlaneClientId?: string;
+    resolveControlPlane?: ControlPlaneResolver;
+}): (tenantId: string) => Promise<ResolvedControlPlane>;
 /**
  * Wraps data adapters with is_system-gated resource server scope inheritance
  * from a control plane tenant.
@@ -98,6 +110,13 @@ export interface RuntimeFallbackConfig {
      * @default false
      */
     inheritanceShadow?: boolean | InheritanceShadowOptions;
+    /**
+     * Per-tenant `config_sync` mode support. Tenants in `synced` mode read only
+     * their own database. Pass a resolver to share its cache with other adapters
+     * (the management adapter); omit it and one is created. Failed lookups fall
+     * back to inheriting.
+     */
+    configSync?: ConfigSyncResolver;
 }
 /**
  * Creates a data adapter wrapper that provides runtime settings fallback from a control plane tenant.
@@ -162,5 +181,4 @@ export declare function isInheritableHook(hook: unknown): boolean;
  * ```
  */
 export declare function withRuntimeFallback(baseAdapters: DataAdapters, config: RuntimeFallbackConfig): DataAdapters;
-export {};
 //# sourceMappingURL=settings-inheritance.d.ts.map

package/dist/types/middleware/settings-inheritance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,UAAU,EACV,MAAM,EACN,cAAc,EACd,mBAAmB,EAGpB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAE/B;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,UAAU,EACtB,uBAAuB,EAAE,UAAU,EAAE,GACpC,UAAU,CAwBZ;AAcD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,mBAAmB,EAAE,GAAG,SAAS,EAC/C,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,SAAS,GACpD,mBAAmB,EAAE,CAmBvB;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,cAAc,EAAE,cAAc,EAC9B,0BAA0B,EAAE,cAAc,GAAG,IAAI,GAChD,cAAc,CAYhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAChC,MAAM,CAqBR;AAED;;;GAGG;AACH,KAAK,oBAAoB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB,KAAK,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAyH3D;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE;IACN,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C,GACA,YAAY,CAYd;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAC;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CA8Kd;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAKxD;AA8ED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}
+{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,UAAU,EACV,MAAM,EACN,cAAc,EACd,mBAAmB,EAGpB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,kBAAkB,EAEnB,MAAM,oBAAoB,CAAC;AAE5B;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,UAAU,EACtB,uBAAuB,EAAE,UAAU,EAAE,GACpC,UAAU,CAwBZ;AAcD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,mBAAmB,EAAE,GAAG,SAAS,EAC/C,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,SAAS,GACpD,mBAAmB,EAAE,CAmBvB;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,cAAc,EAAE,cAAc,EAC9B,0BAA0B,EAAE,cAAc,GAAG,IAAI,GAChD,cAAc,CAYhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAChC,MAAM,CAqBR;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC,SAAS,CAAC;AAEd;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB,KAAK,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAiBtD;AA4FD;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE;IACN,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C,GACA,YAAY,CAYd;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAC;IAEvD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CA6Ld;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAKxD;AA2FD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}

package/dist/types/operations/detach.d.ts

@@ -0,0 +1,85 @@
+import { DataAdapters, TenantOperation } from "authhero";
+import type { OperationRecorder } from "./recorder";
+/**
+ * `detach`: a synced tenant leaves its parent (docs/design/tenant-config-
+ * inheritance.md, open question 1). The copies a sync delivered (`sy` ids) are
+ * either turned into the tenant's own rows (a snapshot: the content is kept,
+ * the ids are normal, and `scope`, `override` and `enforce` are dropped, so
+ * nothing locks them), or with `clean` removed. The tenant row then gets
+ * `config_sync: "detached"` and no parent, so nothing inherits or syncs into it
+ * again.
+ *
+ * Platform rows (`scope: "platform"`) run for the tenant but are hidden from
+ * its admins, so converting them would expose code and secrets. They are kept
+ * as copies and reported; only `clean` removes them.
+ */
+export type DetachEntity = "connection" | "resourceServer" | "hookCode" | "action" | "hook";
+export interface DetachOptions {
+    /** Report what would happen; write nothing. */
+    dryRun: boolean;
+    /** Remove the copies instead of turning them into the tenant's own rows. */
+    clean: boolean;
+}
+export interface DetachEntityOutcome {
+    converted: number;
+    removed: number;
+    skipped: number;
+    errors: string[];
+}
+export interface DetachRow {
+    entity: DetachEntity;
+    key: string;
+    /** `kept`: a platform row that stays as a copy (or code it runs). */
+    action: "converted" | "removed" | "kept";
+}
+export interface DetachResult {
+    status: "detached" | "dry-run" | "already-detached" | "partial";
+    /** `convert|remove|skip <entity>:<key>` for every row looked at. */
+    changes: string[];
+    /** The same rows, structured. */
+    rows: DetachRow[];
+    entities: Record<DetachEntity, DetachEntityOutcome>;
+}
+export type DetachConfigFn = (tenantId: string, options: DetachOptions) => Promise<DetachResult>;
+/** Reads the operation's `input` (fixed at creation, never secrets). */
+export declare function detachOptionsOf(operation: Pick<TenantOperation, "input">): DetachOptions;
+/** Every per-entity error message the detach reported. */
+export declare function detachErrors(result: DetachResult): string[];
+/** The JSON-serialisable outcome stored in the operation's `result`. */
+export declare function summarizeDetachResult(result: DetachResult, options: DetachOptions): Record<string, unknown>;
+/** The step the executors run: detach, record the outcome, fail on errors. */
+export declare function runDetachStep(params: {
+    operation: Pick<TenantOperation, "id" | "tenant_id" | "input">;
+    detachTenant: DetachConfigFn;
+    recorder: Pick<OperationRecorder, "setResult">;
+    /** Called after a run that really detached the tenant (not a preview). */
+    onDetached?: (tenantId: string) => void;
+}): Promise<Record<string, unknown>>;
+/** An empty result with the given status, for when nothing is looked at. */
+export declare function emptyDetachResult(status: DetachResult["status"]): DetachResult;
+/**
+ * Throws unless a tenant can be detached. Detaching keeps what the tenant
+ * holds, so the inherited config has to be in its database: a tenant that
+ * inherits on read has none of it there, and would lose it silently.
+ */
+export declare function assertDetachEligible(tenantId: string, tenant: {
+    config_sync?: string | null;
+}): void;
+/** The tenant row of a detached tenant: no parent and no sync state. */
+export declare function markTenantDetached(adapters: Pick<DataAdapters, "tenants">, tenantId: string): Promise<void>;
+/**
+ * The row work of a detach, in the database `adapters` reads and writes (the
+ * raw layer, so secrets are copied as stored). It does not look at the tenant
+ * row or change it: the caller checks eligibility and, when the status comes
+ * back `detached`, marks the tenant. A tenant worker runs this on its own
+ * database while the control plane holds the tenant row that decides.
+ * Rows are created before the copies they replace are removed.
+ */
+export declare function detachTenantRows(adapters: DataAdapters, tenantId: string, options: DetachOptions): Promise<DetachResult>;
+/**
+ * Detaches `tenantId` from its parent in the database `adapters` reads and
+ * writes, which should be the raw layer so secrets are copied as stored
+ * (ciphertext).
+ */
+export declare function createInProcessDetach(adapters: DataAdapters): DetachConfigFn;
+//# sourceMappingURL=detach.d.ts.map

package/dist/types/operations/detach.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detach.d.ts","sourceRoot":"","sources":["../../../src/operations/detach.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,eAAe,EAQhB,MAAM,UAAU,CAAC;AAElB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,gBAAgB,GAChB,UAAU,GACV,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,MAAM,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;CAC1C;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,kBAAkB,GAAG,SAAS,CAAC;IAChE,oEAAoE;IACpE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iCAAiC;IACjC,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;CACrD;AAED,MAAM,MAAM,cAAc,GAAG,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,KACnB,OAAO,CAAC,YAAY,CAAC,CAAC;AAE3B,wEAAwE;AACxE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,GACxC,aAAa,CAGf;AAKD,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,CAI3D;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,aAAa,GACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsBzB;AAED,8EAA8E;AAC9E,wBAAsB,aAAa,CAAC,MAAM,EAAE;IAC1C,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,CAAC,CAAC;IAC/D,YAAY,EAAE,cAAc,CAAC;IAC7B,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAC/C,0EAA0E;IAC1E,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CACzC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAwBnC;AA4BD,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,GAC7B,YAAY,CAad;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACtC,IAAI,CAMN;AAED,wEAAwE;AACxE,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,EACvC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,YAAY,CAAC,CAwUvB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,YAAY,GAAG,cAAc,CAoB5E"}

package/dist/types/operations/enqueue.d.ts

@@ -13,5 +13,12 @@ export declare function createOperationRow(stores: TenantOperationStores, params
  * finalized it) and the error is rethrown so callers keep their existing
  * failure semantics.
  */
-export declare function enqueueTenantOperation(stores: TenantOperationStores, executor: TenantOperationExecutor, params: EnqueueTenantOperationParams): Promise<TenantOperation>;
+export declare function enqueueTenantOperation(stores: TenantOperationStores, executor: TenantOperationExecutor, params: EnqueueTenantOperationParams, options?: {
+    /**
+     * Resolve with the failed operation row instead of rethrowing when the
+     * executor's run fails. For operations whose row is the deliverable
+     * (a sync reports its outcome there), not for callers that need the error.
+     */
+    returnFailed?: boolean;
+}): Promise<TenantOperation>;
 //# sourceMappingURL=enqueue.d.ts.map

package/dist/types/operations/enqueue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enqueue.d.ts","sourceRoot":"","sources":["../../../src/operations/enqueue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAIjB;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,4BAA4B,EACpC,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,GACxC,OAAO,CAAC,eAAe,CAAC,CAyB1B;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,uBAAuB,EACjC,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,eAAe,CAAC,CAgC1B"}
+{"version":3,"file":"enqueue.d.ts","sourceRoot":"","sources":["../../../src/operations/enqueue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAIjB;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,4BAA4B,EACpC,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,GACxC,OAAO,CAAC,eAAe,CAAC,CA0B1B;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,uBAAuB,EACjC,MAAM,EAAE,4BAA4B,EACpC,OAAO,GAAE;IACP;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACnB,GACL,OAAO,CAAC,eAAe,CAAC,CAmC1B"}

package/dist/types/operations/index.d.ts

@@ -4,6 +4,12 @@ export { createOperationRecorder, errorToMessage, isTerminalStatus, } from "./re
 export type { OperationRecorder } from "./recorder";
 export { createInlineExecutor, inlineStepRunner } from "./inline-executor";
 export type { InlineExecutorConfig, TenantOperationDefinitions, TenantOperationStep, TenantOperationStepContext, } from "./inline-executor";
-export { enqueueTenantOperation } from "./enqueue";
+export { createOperationRow, enqueueTenantOperation } from "./enqueue";
+export { createInProcessSyncConfig, runSyncDefaultsStep, summarizeSyncResult, syncErrors, syncOptionsOf, } from "./sync-defaults";
+export type { SyncConfigFn, SyncConfigOptions } from "./sync-defaults";
+export { assertDetachEligible, createInProcessDetach, detachTenantRows, emptyDetachResult, markTenantDetached, detachErrors, detachOptionsOf, runDetachStep, summarizeDetachResult, } from "./detach";
+export type { DetachConfigFn, DetachOptions, DetachResult } from "./detach";
 export { runRecordedTenantOperation } from "./record-provision";
+export { MAX_MEMBER_REQUEST_ATTEMPTS, createInProcessMemberRequestStore, enqueueTenantMemberRequest, memberRequestIdOf, reconcileTenantMemberRequests, runTenantMembersRequestStep, } from "./tenant-members-request";
+export type { ReconcileTenantMemberRequestsDeps, ReconcileTenantMemberRequestsResult, RunTenantMembersRequestParams, TenantMemberRequestStore, } from "./tenant-members-request";
 //# sourceMappingURL=index.d.ts.map

package/dist/types/operations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/operations/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/operations/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EACjC,0BAA0B,EAC1B,iBAAiB,EACjB,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,iCAAiC,EACjC,mCAAmC,EACnC,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,0BAA0B,CAAC"}

package/dist/types/operations/recorder.d.ts

@@ -20,6 +20,8 @@ export declare function createOperationRecorder(stores: TenantOperationStores):
         detail?: Record<string, unknown>;
         attempt?: number;
     }): Promise<void>;
+    /** Stores the operation's outcome (e.g. a dry-run diff). Idempotent. */
+    setResult(operationId: string, result: Record<string, unknown>): Promise<void>;
     markSucceeded(operationId: string): Promise<void>;
     markFailed(operationId: string, error: unknown): Promise<void>;
 };

package/dist/types/operations/recorder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recorder.d.ts","sourceRoot":"","sources":["../../../src/operations/recorder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAIhD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAcrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB;6BAIlC,MAAM,gBAAgB,MAAM;gCAOzB,MAAM,QAAQ,MAAM;6BAKvC,MAAM,SACZ;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EACH,SAAS,GACT,WAAW,GACX,QAAQ,GACR,SAAS,GACT,SAAS,GACT,YAAY,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;+BAW8B,MAAM;4BAQT,MAAM,SAAS,OAAO;EAQvD;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE3E,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,OAAO,CAI3E"}
+{"version":3,"file":"recorder.d.ts","sourceRoot":"","sources":["../../../src/operations/recorder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAIhD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAcrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB;6BAIlC,MAAM,gBAAgB,MAAM;gCAOzB,MAAM,QAAQ,MAAM;6BAKvC,MAAM,SACZ;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EACH,SAAS,GACT,WAAW,GACX,QAAQ,GACR,SAAS,GACT,SAAS,GACT,YAAY,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;IAWH,wEAAwE;2BAC3C,MAAM,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;+BAInC,MAAM;4BAQT,MAAM,SAAS,OAAO;EAQvD;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE3E,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,OAAO,CAI3E"}

package/dist/types/operations/sync-defaults.d.ts

@@ -0,0 +1,58 @@
+import type { DataAdapters, TenantOperation } from "authhero";
+import { ApplyResolvedBlockResult } from "../rollout/resolved-sync";
+import type { ControlPlaneResolver } from "../middleware";
+import type { OperationRecorder } from "./recorder";
+/**
+ * The `sync-defaults` tenant operation (docs/design/tenant-config-inheritance.md
+ * sections 4.1 and 5 step 4): sync one tenant's resolved parent-chain config
+ * into its own database, as a tracked operation with history.
+ *
+ * Execution is split from transport. The steps below are shared by the inline
+ * and the Cloudflare Workflows executor; how the block reaches the tenant's
+ * database (in-process, or pushed to a tenant worker) is a `SyncConfigFn`.
+ */
+export interface SyncConfigOptions {
+    /** Compute and report the diff; write nothing. */
+    dryRun: boolean;
+    /** Apply even when the tenant's stored hash equals the block's. */
+    force: boolean;
+    /** Remove synced copies the parent no longer shares. */
+    prune?: boolean;
+}
+/** Syncs one tenant and returns what happened (or, for a dry run, what would). */
+export type SyncConfigFn = (tenantId: string, options: SyncConfigOptions) => Promise<ApplyResolvedBlockResult>;
+/** Reads the operation's `input` (fixed at creation, never secrets). */
+export declare function syncOptionsOf(operation: Pick<TenantOperation, "input">): SyncConfigOptions;
+/** Every per-entity error message the sync reported. */
+export declare function syncErrors(result: ApplyResolvedBlockResult): string[];
+/**
+ * The JSON-serialisable outcome stored in the operation's `result`: the status,
+ * hash, per-entity counts, the changed `entity:key` list, the same changes as
+ * structured `rows`, and a capped list of the error messages. Never row content
+ * or secrets.
+ */
+export declare function summarizeSyncResult(result: ApplyResolvedBlockResult, options: SyncConfigOptions): Record<string, unknown>;
+/**
+ * The step both executors run: sync, record the outcome on the operation row,
+ * and fail the step when any row reported an error. The result is written
+ * before the failure is raised so a failed run still shows what it did.
+ */
+export declare function runSyncDefaultsStep(params: {
+    operation: Pick<TenantOperation, "id" | "tenant_id" | "input">;
+    syncConfig: SyncConfigFn;
+    recorder: Pick<OperationRecorder, "setResult">;
+}): Promise<Record<string, unknown>>;
+/**
+ * Sync for tenants whose database is the control plane's own (shared
+ * deployments). Reads the chain from, and applies the block to, `adapters`,
+ * which should be the layer that returns secrets as stored (ciphertext) so they
+ * are copied without being decrypted. A tenant with its own worker and database
+ * (`deployment_type: "wfp"`) is not reachable this way: use a dispatch
+ * transport.
+ */
+export declare function createInProcessSyncConfig(adapters: DataAdapters, config: {
+    controlPlaneTenantId: string;
+    resolveControlPlane?: ControlPlaneResolver;
+    maxDepth?: number;
+}): SyncConfigFn;
+//# sourceMappingURL=sync-defaults.d.ts.map

package/dist/types/operations/sync-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-defaults.d.ts","sourceRoot":"","sources":["../../../src/operations/sync-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC9D,OAAO,EACL,wBAAwB,EAGzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;;;GAQG;AAEH,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,MAAM,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,KAAK,EAAE,OAAO,CAAC;IACf,wDAAwD;IACxD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,kFAAkF;AAClF,MAAM,MAAM,YAAY,GAAG,CACzB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,KACvB,OAAO,CAAC,wBAAwB,CAAC,CAAC;AAEvC,wEAAwE;AACxE,wBAAgB,aAAa,CAC3B,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,GACxC,iBAAiB,CAOnB;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,EAAE,CAErE;AAOD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,wBAAwB,EAChC,OAAO,EAAE,iBAAiB,GACzB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwBzB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,CAAC,CAAC;IAC/D,UAAU,EAAE,YAAY,CAAC;IACzB,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;CAChD,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAqBnC;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE;IACN,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,YAAY,CA8Bd"}