@authhero/multi-tenancy 15.2.0 → 15.4.0

package/dist/types/operations/tenant-members-request.d.ts

@@ -0,0 +1,97 @@
+import { type DataAdapters, type ExecuteTenantMemberRequestOptions, type TenantMemberRequest, type TenantMembersBackend, type TenantOperation } from "authhero";
+import type { OperationRecorder } from "./recorder";
+import type { TenantOperationExecutor, TenantOperationStores } from "./types";
+/**
+ * The `tenant-members-request` tenant operation (issue #1550): carries out a
+ * team change that a tenant registered as a request in its own database.
+ *
+ * The request lives on the tenant's side, so the operation reaches it through
+ * a {@link TenantMemberRequestStore}: in-process for tenants that share the
+ * control plane's database, a dispatch push for tenants with their own. The
+ * operation's `input` is only `{ request_id }`: what was asked (addresses,
+ * ids) stays on the request row, because anyone who can read operations can
+ * read `input`.
+ */
+/** How the control plane reads and answers a tenant's requests. */
+export interface TenantMemberRequestStore {
+    get(tenantId: string, id: string): Promise<TenantMemberRequest | null>;
+    /**
+     * Writes the outcome, only while the request is still `pending`. Returns
+     * false when it was already finished, which makes a re-run harmless.
+     */
+    report(tenantId: string, id: string, outcome: {
+        status: "succeeded" | "failed";
+        result?: Record<string, unknown> | null;
+        error?: string | null;
+    }): Promise<boolean>;
+    /** Requests still `pending` and created before `olderThan` (ISO 8601). */
+    listPending(tenantId: string, options: {
+        olderThan: string;
+    }): Promise<TenantMemberRequest[]>;
+}
+/** For tenants whose database is the control plane's own. */
+export declare function createInProcessMemberRequestStore(adapters: Pick<DataAdapters, "tenantMemberRequests">): TenantMemberRequestStore;
+/** The request an operation is about, from its `input`. */
+export declare function memberRequestIdOf(operation: Pick<TenantOperation, "input">): string | undefined;
+export interface RunTenantMembersRequestParams {
+    operation: Pick<TenantOperation, "id" | "tenant_id" | "input">;
+    store: TenantMemberRequestStore;
+    /** The control-plane team backend, built without a request in hand. */
+    getBackend: () => TenantMembersBackend | Promise<TenantMembersBackend>;
+    recorder: Pick<OperationRecorder, "setResult">;
+    executeOptions?: ExecuteTenantMemberRequestOptions;
+}
+/**
+ * The step both executors run. Reads the request, carries it out against the
+ * tenant's team (which checks the tenant and the requester again), and writes
+ * the outcome back to the request.
+ *
+ * - A request that cannot or must not run (the requester left the team, the
+ *   payload is wrong) is a legitimate outcome: the request is reported
+ *   `failed` with the reason and the operation `succeeded`, because the
+ *   control plane did its job. Nothing retries it.
+ * - Any other error (the database, the team backend, the write-back) fails the
+ *   operation and leaves the request `pending`, so a later run or the
+ *   reconcile sweep tries again. That is safe: the work is idempotent.
+ */
+export declare function runTenantMembersRequestStep(params: RunTenantMembersRequestParams): Promise<Record<string, unknown>>;
+/** How many failed runs a request gets before the sweep gives up on it. */
+export declare const MAX_MEMBER_REQUEST_ATTEMPTS = 5;
+/**
+ * Enqueues the operation for one request, once. A notification can arrive
+ * twice and the sweep can race it, so an operation that is already pending,
+ * running or succeeded for the request is returned instead of a new one.
+ */
+export declare function enqueueTenantMemberRequest(deps: {
+    stores: TenantOperationStores;
+    executor: TenantOperationExecutor;
+}, tenantId: string, requestId: string, options?: {
+    initiatedBy?: string;
+}): Promise<TenantOperation>;
+export interface ReconcileTenantMemberRequestsDeps {
+    stores: TenantOperationStores;
+    executor: TenantOperationExecutor;
+    store: TenantMemberRequestStore;
+    /** The tenants to look at, for example the ones with their own database. */
+    tenantIds: () => Promise<string[]> | string[];
+    /** Requests younger than this are left to the notification. Default 5 minutes. */
+    graceMs?: number;
+    maxAttempts?: number;
+    now?: () => Date;
+}
+export interface ReconcileTenantMemberRequestsResult {
+    checked: number;
+    enqueued: number;
+    gaveUp: number;
+    /** Tenants whose requests could not be read, for example an unreachable shard. */
+    unreachable: string[];
+}
+/**
+ * Sweep for requests the control plane never ran: the notification was lost,
+ * or the run failed. A tenant worker cannot run a cron, so this runs on the
+ * control plane. It enqueues the operation for a `pending` request that has
+ * none in flight, and after `maxAttempts` failed runs reports the request
+ * `failed` so it does not stay pending forever.
+ */
+export declare function reconcileTenantMemberRequests(deps: ReconcileTenantMemberRequestsDeps): Promise<ReconcileTenantMemberRequestsResult>;
+//# sourceMappingURL=tenant-members-request.d.ts.map

package/dist/types/operations/tenant-members-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-members-request.d.ts","sourceRoot":"","sources":["../../../src/operations/tenant-members-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACrB,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAGpD,OAAO,KAAK,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAE9E;;;;;;;;;;GAUG;AAEH,mEAAmE;AACnE,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACvE;;;OAGG;IACH,MAAM,CACJ,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QACP,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;QAC/B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACxC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,GACA,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,0EAA0E;IAC1E,WAAW,CACT,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;CACnC;AAED,6DAA6D;AAC7D,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,sBAAsB,CAAC,GACnD,wBAAwB,CA+B1B;AAED,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,GACxC,MAAM,GAAG,SAAS,CAGpB;AAKD,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,CAAC,CAAC;IAC/D,KAAK,EAAE,wBAAwB,CAAC;IAChC,uEAAuE;IACvE,UAAU,EAAE,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvE,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAC/C,cAAc,CAAC,EAAE,iCAAiC,CAAC;CACpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAqDlC;AAED,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IACJ,MAAM,EAAE,qBAAqB,CAAC;IAC9B,QAAQ,EAAE,uBAAuB,CAAC;CACnC,EACD,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACrC,OAAO,CAAC,eAAe,CAAC,CA4B1B;AAED,MAAM,WAAW,iCAAiC;IAChD,MAAM,EAAE,qBAAqB,CAAC;IAC9B,QAAQ,EAAE,uBAAuB,CAAC;IAClC,KAAK,EAAE,wBAAwB,CAAC;IAChC,4EAA4E;IAC5E,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC;IAC9C,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,mCAAmC;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,iCAAiC,GACtC,OAAO,CAAC,mCAAmC,CAAC,CAwE9C"}

package/dist/types/operations/types.d.ts

@@ -34,6 +34,8 @@ export interface EnqueueTenantOperationParams {
     initiated_by?: string;
     target_worker_version?: string;
     target_database_version?: string;
+    /** Kind-specific parameters, fixed at creation. Never contains secrets. */
+    input?: Record<string, unknown>;
 }
 /**
  * Executes an already-persisted operation row. Row-first contract: the

package/dist/types/operations/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/operations/types.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,UAAU,CAAC;AAElB;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;QACvB,OAAO,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,aAAa,CAAC;KACjD,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtD,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC3E;AAED,mEAAmE;AACnE,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,qBAAqB,EAAE,4BAA4B,CAAC;CACrD;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,mBAAmB,CAAC;IAC1B,sDAAsD;IACtD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,sBAAsB,CAAC;IACnD,KAAK,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,EAC3C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,OAAO,CAAC,IAAI,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/operations/types.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,UAAU,CAAC;AAElB;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;QACvB,OAAO,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,aAAa,CAAC;KACjD,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtD,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC3E;AAED,mEAAmE;AACnE,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,qBAAqB,EAAE,4BAA4B,CAAC;CACrD;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,mBAAmB,CAAC;IAC1B,sDAAsD;IACtD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,sBAAsB,CAAC;IACnD,KAAK,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,EAC3C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/types/rollout/index.d.ts

@@ -3,6 +3,8 @@ export type { DefaultsProjectionConfig, DefaultsProjectionEntities, DefaultsProj
 export { projectControlPlaneDefaults } from "./defaults-projection";
 export type { ControlPlaneDefaultsPayload, ControlPlaneDefaultsApplyResult, ControlPlaneTenantSeed, DefaultsPayloadEntities, } from "./payload";
 export { buildControlPlaneDefaultsPayload, applyControlPlaneDefaultsPayload, } from "./payload";
+export type { ApplyResolvedBlockOptions, ApplyResolvedBlockResult, BuildResolvedBlockOptions, ResolvedConfigBlock, SyncEntity, SyncEntityOutcome, } from "./resolved-sync";
+export { applyResolvedConfigBlock, buildResolvedConfigBlock, findUndecryptableKeyIds, syncedRowId, } from "./resolved-sync";
 /**
  * A control plane rollout applies the control plane's state to one or more
  * tenant databases. `syncDefaults` is the only operation today; schema

package/dist/types/rollout/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rollout/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE,YAAY,EACV,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,WAAW,CAAC;AAEnB;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAExE;;;OAGG;IACH,qBAAqB,CACnB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,wBAAwB,GAC/B,0BAA0B,CAa5B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rollout/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE,YAAY,EACV,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,UAAU,EACV,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAExE;;;OAGG;IACH,qBAAqB,CACnB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,wBAAwB,GAC/B,0BAA0B,CAa5B"}

package/dist/types/rollout/payload.d.ts

@@ -1,5 +1,6 @@
 import { DataAdapters, SigningKey } from "authhero";
 import { DefaultsProjectionEntities, DefaultsProjectionResult, EntityProjectionOutcome, ProjectableDefaults } from "./defaults-projection";
+import { ApplyResolvedBlockOptions, ApplyResolvedBlockResult, ResolvedConfigBlock } from "./resolved-sync";
 /**
  * Entity flags for the wire payload — the six default entities plus signing
  * keys and tenant rows, which only flow through the payload (build + apply),
@@ -56,11 +57,18 @@ export interface ControlPlaneDefaultsPayload extends ProjectableDefaults {
      * {@link ControlPlaneTenantSeed}.
      */
     tenants: ControlPlaneTenantSeed[];
+    /**
+     * The tenant's resolved parent-chain config, materialised under the tenant's
+     * own id. Optional and opt-in on apply; see {@link ResolvedConfigBlock}.
+     */
+    resolved?: ResolvedConfigBlock;
 }
 /** Result of applying a payload — the projection result plus the key/tenant outcomes. */
 export interface ControlPlaneDefaultsApplyResult extends DefaultsProjectionResult {
     signingKeys: EntityProjectionOutcome;
     tenants: EntityProjectionOutcome;
+    /** Present when a `resolved` block was applied (or dry-run). */
+    resolved?: ApplyResolvedBlockResult;
 }
 /**
  * Reads the control plane's defaults + public signing keys off a control-plane
@@ -87,5 +95,12 @@ export declare function buildControlPlaneDefaultsPayload(controlPlaneAdapters: D
 export declare function applyControlPlaneDefaultsPayload(payload: ControlPlaneDefaultsPayload, targetAdapters: DataAdapters, controlPlaneTenantId: string, options?: {
     continueOnError?: boolean;
     entities?: DefaultsPayloadEntities;
+    /**
+     * Also apply the payload's `resolved` block to `tenantId`. Without this the
+     * block is ignored, so existing callers are unaffected.
+     */
+    resolved?: ApplyResolvedBlockOptions & {
+        tenantId: string;
+    };
 }): Promise<ControlPlaneDefaultsApplyResult>;
 //# sourceMappingURL=payload.d.ts.map

package/dist/types/rollout/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../src/rollout/payload.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,UAAU,EAKX,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EAQpB,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,0BAA0B,GAAG;IACjE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE;;;;;OAKG;IACH,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B;;;;OAIG;IACH,OAAO,EAAE,sBAAsB,EAAE,CAAC;CACnC;AAED,yFAAyF;AACzF,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAC/E,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAkBD;;;;;;;;GAQG;AACH,wBAAsB,gCAAgC,CACpD,oBAAoB,EAAE,YAAY,EAClC,oBAAoB,EAAE,MAAM,EAC5B,QAAQ,GAAE,uBAA4B,EACtC,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,2BAA2B,CAAC,CAqCtC;AA0FD;;;;;;;;;;;GAWG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,2BAA2B,EACpC,cAAc,EAAE,YAAY,EAC5B,oBAAoB,EAAE,MAAM,EAC5B,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CAC/B,GACL,OAAO,CAAC,+BAA+B,CAAC,CAoD1C"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../src/rollout/payload.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,UAAU,EAKX,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EAQpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,mBAAmB,EAEpB,MAAM,iBAAiB,CAAC;AAEzB;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,0BAA0B,GAAG;IACjE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE;;;;;OAKG;IACH,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B;;;;OAIG;IACH,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC;AAED,yFAAyF;AACzF,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAC/E,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;IACjC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,wBAAwB,CAAC;CACrC;AAkBD;;;;;;;;GAQG;AACH,wBAAsB,gCAAgC,CACpD,oBAAoB,EAAE,YAAY,EAClC,oBAAoB,EAAE,MAAM,EAC5B,QAAQ,GAAE,uBAA4B,EACtC,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,2BAA2B,CAAC,CAqCtC;AA0FD;;;;;;;;;;;GAWG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,2BAA2B,EACpC,cAAc,EAAE,YAAY,EAC5B,oBAAoB,EAAE,MAAM,EAC5B,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,uBAAuB,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,EAAE,yBAAyB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACxD,GACL,OAAO,CAAC,+BAA+B,CAAC,CA+D1C"}

package/dist/types/rollout/resolved-sync.d.ts

@@ -0,0 +1,112 @@
+import { Action, Branding, Connection, DataAdapters, EmailProvider, Hook, HookCode, KeyRing, PromptSetting, ResourceServer } from "authhero";
+/**
+ * Sync of a tenant's resolved config (docs/design/tenant-config-inheritance.md,
+ * section 4.1). The block is the tenant's parent chain merged with
+ * `mergeConfig` and materialised under the **tenant's own id**. It carries only
+ * what is inherited, never the tenant's own rows.
+ *
+ * Rows get deterministic ids derived from the target tenant, the entity and
+ * the stable key, so a re-sync finds its rows by id and never touches a row the
+ * tenant owns. Secrets are copied as stored (ciphertext).
+ */
+export type SyncEntity = "connection" | "resourceServer" | "hook" | "hookCode" | "action";
+export declare const SYNC_ENTITIES: readonly ["connection", "resourceServer", "hookCode", "action", "hook"];
+export interface ResolvedConfigBlock {
+    version: 1;
+    /** Ancestors the block was resolved from, nearest first. */
+    chain: string[];
+    connections: Connection[];
+    resourceServers: ResourceServer[];
+    hookCode: HookCode[];
+    actions: Action[];
+    hooks: Hook[];
+    emailProvider: EmailProvider | null;
+    branding: Branding | null;
+    promptSettings: PromptSetting | null;
+    /** `<entity>:<key>` of rows from `platform`-scoped ancestor rows. */
+    hidden: string[];
+    /** Explicit deletes. Only executed when the apply asks for `deletes`. */
+    deletes: Array<{
+        entity: SyncEntity;
+        key: string;
+    }>;
+    /** Content hash of everything above; equal hash means nothing to apply. */
+    hash: string;
+}
+export interface BuildResolvedBlockOptions {
+    /** Control plane used as implicit parent for tenants without `parent_tenant_id`. */
+    legacyControlPlane?: string;
+    maxDepth?: number;
+    deletes?: ResolvedConfigBlock["deletes"];
+}
+/**
+ * Deterministic id of a synced row: the type prefix, a `sy` marker and 15 hex
+ * characters of a hash of (tenant, entity, key). 17 characters after the
+ * prefix, the same shape as the ids each adapter generates.
+ */
+export declare function syncedRowId(entity: SyncEntity, tenantId: string, key: string): Promise<string>;
+/** The stable key a row is synced by (matches `mergeConfig`). */
+export declare function keyOf(entity: SyncEntity, row: unknown): string;
+/**
+ * Resolves `tenantId`'s parent chain into the block to push. Reads from
+ * `adapters`, which should be the layer that returns secrets as stored
+ * (ciphertext), so they are copied without being decrypted.
+ */
+export declare function buildResolvedConfigBlock(adapters: DataAdapters, tenantId: string, options?: BuildResolvedBlockOptions): Promise<ResolvedConfigBlock>;
+/**
+ * Checks that `ring` can decrypt every ciphertext in the block. Returns the
+ * key ids it cannot (never the values).
+ */
+export declare function findUndecryptableKeyIds(block: ResolvedConfigBlock, ring: KeyRing): Promise<string[]>;
+export interface ApplyResolvedBlockOptions {
+    /** Compute the diff and report it; write nothing. */
+    dryRun?: boolean;
+    /** Execute the block's explicit `deletes`. @default false */
+    deletes?: boolean;
+    /**
+     * Remove synced copies (`sy` ids) the block no longer carries, e.g. a row the
+     * parent stopped sharing. The tenant's own rows are never touched. A dry run
+     * lists them as `delete ...` whether or not this is set. @default false
+     */
+    prune?: boolean;
+    /** Apply even when the stored hash equals the block hash. */
+    force?: boolean;
+    /**
+     * The tenant's key ring. When given, the apply is refused before any write if
+     * it cannot decrypt a key id the block carries.
+     */
+    keyRing?: KeyRing;
+    /** Keep going after a failed row instead of throwing. @default true */
+    continueOnError?: boolean;
+}
+export interface SyncEntityOutcome {
+    added: number;
+    changed: number;
+    unchanged: number;
+    deleted: number;
+    errors: string[];
+}
+export interface ApplyResolvedBlockResult {
+    status: "applied" | "up-to-date" | "dry-run";
+    hash: string;
+    entities: Record<SyncEntity | "emailProvider" | "branding" | "promptSettings", SyncEntityOutcome>;
+    /** `<entity>:<key>` of rows that would be/were added, changed or deleted. */
+    changes: string[];
+    /**
+     * The same changes as structured rows, so a reader can tell an added row from
+     * a changed one, and a kept one from a removed one. Older senders omit it.
+     */
+    rows: SyncChangeRow[];
+}
+export interface SyncChangeRow {
+    entity: keyof ApplyResolvedBlockResult["entities"];
+    /** The row's key (`strategy:name`, identifier, name, `singleton`, ...). */
+    key: string;
+    /**
+     * `skipped`: the tenant has its own row with this key. `delete`: a copy that
+     * is or would be removed (removed only when the apply asked for it).
+     */
+    action: "added" | "changed" | "skipped" | "delete";
+}
+export declare function applyResolvedConfigBlock(block: ResolvedConfigBlock, target: DataAdapters, tenantId: string, options?: ApplyResolvedBlockOptions): Promise<ApplyResolvedBlockResult>;
+//# sourceMappingURL=resolved-sync.d.ts.map

package/dist/types/rollout/resolved-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolved-sync.d.ts","sourceRoot":"","sources":["../../../src/rollout/resolved-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,aAAa,EACb,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,aAAa,EACb,cAAc,EAYf,MAAM,UAAU,CAAC;AAMlB;;;;;;;;;GASG;AAEH,MAAM,MAAM,UAAU,GAClB,YAAY,GACZ,gBAAgB,GAChB,MAAM,GACN,UAAU,GACV,QAAQ,CAAC;AAEb,eAAO,MAAM,aAAa,yEAMgB,CAAC;AAE3C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,CAAC,CAAC;IACX,4DAA4D;IAC5D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,qEAAqE;IACrE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yEAAyE;IACzE,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,yBAAyB;IACxC,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;CAC1C;AAoCD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,iEAAiE;AACjE,wBAAgB,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,CAc9D;AAMD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,mBAAmB,CAAC,CA6B9B;AAuBD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CAQnB;AAMD,MAAM,WAAW,yBAAyB;IACxC,qDAAqD;IACrD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CACd,UAAU,GAAG,eAAe,GAAG,UAAU,GAAG,gBAAgB,EAC5D,iBAAiB,CAClB,CAAC;IACF,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,IAAI,EAAE,aAAa,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACnD,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;CACpD;AAYD,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,mBAAmB,EAC1B,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAicnC"}

package/dist/types/rollouts/advance.d.ts

@@ -0,0 +1,44 @@
+import type { Rollout } from "authhero";
+import type { RolloutDeps } from "./types";
+export type RolloutTickOutcome = "skipped" | "waiting" | "planned-empty" | "paused" | "started" | "running" | "done";
+export interface RolloutTickResult {
+    rolloutId: string;
+    outcome: RolloutTickOutcome;
+    /** Operations started by this tick. */
+    started: number;
+    /** The wave being worked on, when there is one. */
+    wave?: number;
+}
+/**
+ * Advances one rollout by one step. Stateless and idempotent: all state is the
+ * rollout row and its operations, so a tick can run from a cron, after a
+ * request, or twice at once.
+ *
+ *  1. A write-triggered rollout waits out its debounce, then is planned.
+ *  2. The current wave is the lowest one with unfinished operations. Before it
+ *     starts, the previous wave is checked: the canary pauses the rollout on any
+ *     failure, later waves when the failed fraction exceeds the threshold.
+ *  3. Up to `max_concurrent` pending operations of the current wave are started.
+ *  4. When every operation is finished the rollout is `done`.
+ */
+export declare function advanceRollout(deps: RolloutDeps, rolloutOrId: Rollout | string): Promise<RolloutTickResult>;
+export interface AdvanceRolloutsOptions {
+    /** Most rollouts to advance in one call. @default 20 */
+    limit?: number;
+    logger?: Pick<Console, "warn">;
+}
+/**
+ * Advances every open `config-sync` rollout one step. Meant for a host's
+ * scheduled handler (every few minutes). A rollout that throws does not stop
+ * the others.
+ */
+export declare function advanceRollouts(deps: RolloutDeps, options?: AdvanceRolloutsOptions): Promise<RolloutTickResult[]>;
+/** Pauses a rollout; nothing further is started until it is resumed. */
+export declare function pauseRollout(deps: RolloutDeps, rolloutId: string, reason?: string): Promise<Rollout | null>;
+/**
+ * Resumes a paused rollout, accepting the failures that paused it: the waves
+ * finished so far are no longer checked, and the next wave starts on the next
+ * tick. Tenants that failed are picked up again by the next drift reconcile.
+ */
+export declare function resumeRollout(deps: RolloutDeps, rolloutId: string): Promise<Rollout | null>;
+//# sourceMappingURL=advance.d.ts.map

package/dist/types/rollouts/advance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advance.d.ts","sourceRoot":"","sources":["../../../src/rollouts/advance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAmB,MAAM,UAAU,CAAC;AAUzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,SAAS,GACT,eAAe,GACf,QAAQ,GACR,SAAS,GACT,SAAS,GACT,MAAM,CAAC;AAEX,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAiCD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,OAAO,GAAG,MAAM,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CA6G5B;AAED,MAAM,WAAW,sBAAsB;IACrC,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,WAAW,EACjB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAiB9B;AAED,wEAAwE;AACxE,wBAAsB,YAAY,CAChC,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,SAA0B,GAC/B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAOzB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAoBzB"}

package/dist/types/rollouts/config.d.ts

@@ -0,0 +1,54 @@
+import type { Rollout } from "authhero";
+/**
+ * Settings of a `config-sync` rollout, stored in the rollout's `config` column.
+ * Waves are cumulative percentages of the rolled-out tenants; the canary is a
+ * count that goes first. A wave is checked when it finishes: the canary pauses
+ * the rollout on any failure, later waves when the failed fraction exceeds
+ * `failure_threshold`.
+ */
+export interface ConfigSyncRolloutConfig {
+    /** Tenants synced first, on their own. */
+    canary: number;
+    /** Cumulative percentages, ascending, ending at 100. */
+    waves: number[];
+    /** Failed fraction of a wave (0..1) above which the rollout pauses. */
+    failure_threshold: number;
+    /** Operations started per tick. */
+    max_concurrent: number;
+    /** Quiet time after the last write before a write-triggered rollout plans. */
+    debounce_ms: number;
+    /** What started it. */
+    trigger: "write" | "reconcile" | "manual";
+    /** The tenant whose descendants are rolled out to. */
+    root_tenant_id: string;
+    /** The tenant whose write requested it (write trigger). */
+    origin_tenant_id?: string;
+    /** Sync nothing, only report the diff. */
+    dry_run?: boolean;
+    /** Apply even when a tenant's stored hash matches. */
+    force?: boolean;
+    /** False while a write-triggered request waits out its debounce. */
+    planned?: boolean;
+    /** Tenants in the rollout, set when planned. */
+    tenant_count?: number;
+    /** Waves up to and including this one have been accepted by an operator. */
+    accepted_through?: number;
+}
+export declare const DEFAULT_ROLLOUT_WAVES: number[];
+export declare const DEFAULT_ROLLOUT_SETTINGS: {
+    readonly canary: 1;
+    readonly waves: number[];
+    readonly failure_threshold: 0.1;
+    readonly max_concurrent: 25;
+    readonly debounce_ms: 60000;
+};
+/** Reads a rollout's config, filling defaults for anything missing. */
+export declare function readRolloutConfig(rollout: Pick<Rollout, "config">): ConfigSyncRolloutConfig;
+/**
+ * Assigns each of `count` tenants (already in rollout order) to a wave: wave 0
+ * is the canary, then one wave per percentage step. Boundaries are
+ * `ceil(count * pct / 100)`; empty waves are dropped and the last wave always
+ * reaches the end.
+ */
+export declare function assignWaves(count: number, canary: number, waves: number[]): number[];
+//# sourceMappingURL=config.d.ts.map

package/dist/types/rollouts/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/rollouts/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IAEpB,uBAAuB;IACvB,OAAO,EAAE,OAAO,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC1C,sDAAsD;IACtD,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0CAA0C;IAC1C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sDAAsD;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,qBAAqB,UAAgB,CAAC;AAEnD,eAAO,MAAM,wBAAwB;;;;;;CAM3B,CAAC;AAEX,uEAAuE;AACvE,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAC/B,uBAAuB,CAYzB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,GACd,MAAM,EAAE,CA0BV"}

package/dist/types/rollouts/controller.d.ts

@@ -0,0 +1,29 @@
+import type { Rollout } from "authhero";
+import type { RolloutDeps } from "./types";
+export interface CreateRolloutParams {
+    /** Roll out to the synced descendants of this tenant. Defaults to the control plane. */
+    rootTenantId?: string;
+    /** Limit the rollout to these tenants (those that are synced descendants). */
+    tenantIds?: string[];
+    canary?: number;
+    waves?: number[];
+    failureThreshold?: number;
+    /** Operations started per tick. */
+    maxConcurrent?: number;
+    dryRun?: boolean;
+    force?: boolean;
+    initiatedBy?: string;
+}
+export interface RolloutController {
+    /** Plans a manual rollout and starts its canary. */
+    create(params: CreateRolloutParams): Promise<Rollout>;
+    pause(id: string, reason?: string): Promise<Rollout | null>;
+    resume(id: string): Promise<Rollout | null>;
+}
+/**
+ * The operations a management API needs on rollouts that go beyond reading and
+ * updating rows. Wired by `initMultiTenant`, like the tenant operation
+ * executor.
+ */
+export declare function createRolloutController(deps: RolloutDeps): RolloutController;
+//# sourceMappingURL=controller.d.ts.map

package/dist/types/rollouts/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/rollouts/controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAOxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,MAAM,WAAW,mBAAmB;IAClC,wFAAwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,WAAW,GAAG,iBAAiB,CAgC5E"}

package/dist/types/rollouts/enumerate.d.ts

@@ -0,0 +1,25 @@
+import { type DataAdapters } from "authhero";
+export interface FleetTenant {
+    tenantId: string;
+    /** Levels below the root; 1 for a direct child. */
+    depth: number;
+    /** The content hash last applied to the tenant, if any. */
+    appliedHash: string | null;
+}
+export interface EnumerateOptions {
+    /**
+     * The control plane a tenant without a `parent_tenant_id` inherits from, as
+     * `resolveTenantChain` uses it (`undefined` when the tenant opts out).
+     */
+    resolveLegacyParent: (tenantId: string) => Promise<string | undefined>;
+    /** Longest chain to follow before giving up on a tenant (cycle guard). */
+    maxDepth?: number;
+}
+/**
+ * The tenants below `rootId` that receive pushes (`config_sync: "synced"`),
+ * ordered by depth and then id, so a parent is always rolled out before its
+ * children. Parents are resolved like `resolveTenantChain`: `parent_tenant_id`,
+ * else the legacy control plane. Reads every tenant once.
+ */
+export declare function listSyncedDescendants(adapters: Pick<DataAdapters, "tenants">, rootId: string, options: EnumerateOptions): Promise<FleetTenant[]>;
+//# sourceMappingURL=enumerate.d.ts.map

package/dist/types/rollouts/enumerate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enumerate.d.ts","sourceRoot":"","sources":["../../../src/rollouts/enumerate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,YAAY,EAAe,MAAM,UAAU,CAAC;AAEpE,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACvE,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,EACvC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,WAAW,EAAE,CAAC,CA4CxB"}

package/dist/types/rollouts/hashes.d.ts

@@ -0,0 +1,10 @@
+import type { RolloutDeps } from "./types";
+/** The tenant the sync would treat as the implicit parent of `tenantId`. */
+export declare function resolveLegacyParent(deps: Pick<RolloutDeps, "controlPlaneTenantId" | "resolveControlPlane">, tenantId: string): Promise<string | undefined>;
+/**
+ * The hash a sync of `tenantId` would store right now. The hash depends on the
+ * chain and its content, not on the tenant, so tenants that share a chain share
+ * one computation (memoised for the life of the returned function).
+ */
+export declare function createExpectedHash(deps: Pick<RolloutDeps, "adapters" | "controlPlaneTenantId" | "resolveControlPlane" | "maxDepth">): (tenantId: string) => Promise<string>;
+//# sourceMappingURL=hashes.d.ts.map

package/dist/types/rollouts/hashes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashes.d.ts","sourceRoot":"","sources":["../../../src/rollouts/hashes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,4EAA4E;AAC5E,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,sBAAsB,GAAG,qBAAqB,CAAC,EACvE,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAG7B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,IAAI,CACR,WAAW,EACX,UAAU,GAAG,sBAAsB,GAAG,qBAAqB,GAAG,UAAU,CACzE,GACA,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAuBvC"}

package/dist/types/rollouts/index.d.ts

@@ -0,0 +1,21 @@
+export { DEFAULT_ROLLOUT_SETTINGS, DEFAULT_ROLLOUT_WAVES, assignWaves, readRolloutConfig, } from "./config";
+export type { ConfigSyncRolloutConfig } from "./config";
+export { listSyncedDescendants } from "./enumerate";
+export type { EnumerateOptions, FleetTenant } from "./enumerate";
+export { createExpectedHash } from "./hashes";
+export { listRolloutOperations, planRollout } from "./plan";
+export type { PlanResult } from "./plan";
+export { advanceRollout, advanceRollouts, pauseRollout, resumeRollout, } from "./advance";
+export type { AdvanceRolloutsOptions, RolloutTickOutcome, RolloutTickResult, } from "./advance";
+export { verifyTenantConfig } from "./verify";
+export type { ConfigSyncDifference, ConfigSyncVerification, VerifyConfigSyncDeps, } from "./verify";
+export { getConfigSyncStatus } from "./status";
+export type { ConfigSyncStatus, ConfigSyncStatusDeps } from "./status";
+export { reconcileConfigDrift } from "./reconcile";
+export type { ReconcileConfigDriftOptions, ReconcileConfigDriftResult, } from "./reconcile";
+export { createRolloutWriteHooks, isPublishedRow, requestRollout, } from "./trigger";
+export type { PublishableEntity, RolloutWriteHooks } from "./trigger";
+export { createRolloutController } from "./controller";
+export type { CreateRolloutParams, RolloutController } from "./controller";
+export type { RolloutDeps } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/rollouts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rollouts/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC5D,YAAY,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EACL,cAAc,EACd,eAAe,EACf,YAAY,EACZ,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,YAAY,EACV,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,YAAY,EACV,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC"}

package/dist/types/rollouts/plan.d.ts

@@ -0,0 +1,29 @@
+import type { Rollout, TenantOperation } from "authhero";
+import type { RolloutDeps } from "./types";
+export declare const OPEN_ROLLOUT_STATUSES: readonly ["pending", "canary", "rolling", "paused"];
+export declare function storesOf(deps: RolloutDeps): {
+    tenantOperations: import("authhero").TenantOperationsAdapter;
+    tenantOperationEvents: import("authhero").TenantOperationEventsAdapter;
+};
+export declare function rolloutsOf(deps: RolloutDeps): import("authhero").RolloutsAdapter;
+export interface PlanResult {
+    /** Tenants that get a sync operation. */
+    planned: number;
+    /** Candidates left out because they are already up to date. */
+    upToDate: number;
+}
+/**
+ * Turns a rollout into per-tenant `sync-defaults` operations: lists the synced
+ * descendants of the rollout's root (parents before children), leaves out the
+ * ones whose stored hash already matches (unless `force`), splits the rest into
+ * a canary and percentage waves, and creates one `pending` operation each. The
+ * rollout's `config` records the result. A rollout with nothing to do ends
+ * `done` (a write-triggered one, which exists only because something was
+ * written, is removed instead of leaving noise).
+ */
+export declare function planRollout(deps: RolloutDeps, rollout: Rollout, options?: {
+    tenantIds?: string[];
+}): Promise<PlanResult>;
+/** Every operation of a rollout, oldest first. */
+export declare function listRolloutOperations(deps: RolloutDeps, rolloutId: string): Promise<TenantOperation[]>;
+//# sourceMappingURL=plan.d.ts.map

package/dist/types/rollouts/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../../src/rollouts/plan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAKzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,eAAO,MAAM,qBAAqB,qDAKxB,CAAC;AAEX,wBAAgB,QAAQ,CAAC,IAAI,EAAE,WAAW;;;EAMzC;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,sCAK3C;AAED,MAAM,WAAW,UAAU;IACzB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GACrC,OAAO,CAAC,UAAU,CAAC,CAyErB;AAED,kDAAkD;AAClD,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,EAAE,CAAC,CAsB5B"}

package/dist/types/rollouts/reconcile.d.ts

@@ -0,0 +1,38 @@
+import type { RolloutDeps } from "./types";
+export interface ReconcileConfigDriftOptions {
+    /** The tenant whose descendants are checked. Defaults to the control plane. */
+    rootTenantId?: string;
+    /** Most tenants to report and roll out in one call. @default 500 */
+    limit?: number;
+    /**
+     * A tenant whose latest sync failed less than this long ago is reported but
+     * not rolled out again, so a tenant that keeps failing does not get a new
+     * rollout on every run. @default 3600000 (one hour)
+     */
+    retryAfterMs?: number;
+    logger?: Pick<Console, "warn">;
+}
+export interface ReconcileConfigDriftResult {
+    /** Synced tenants compared. */
+    checked: number;
+    /** Tenants whose applied hash differs from what their chain publishes. */
+    drifted: number;
+    /** Drifted tenants a running rollout already covers. */
+    alreadyCovered: number;
+    /** Drifted tenants left out because their latest sync failed recently. */
+    recentlyFailed: number;
+    /** The rollout created for the rest, if any. */
+    rolloutId?: string;
+}
+/**
+ * The safety net for lost triggers (design 4.3): compares every synced
+ * tenant's applied hash with the hash its chain would produce now. Drifted
+ * tenants get a `cfgdrift` log (queryable per tenant) and, unless an open
+ * rollout already covers them, one new rollout. Idempotent: running it again
+ * before the rollout finishes creates nothing, and once the tenants are synced
+ * there is nothing left to find.
+ *
+ * Run it from a scheduled handler, followed by `advanceRollouts`.
+ */
+export declare function reconcileConfigDrift(deps: RolloutDeps, options?: ReconcileConfigDriftOptions): Promise<ReconcileConfigDriftResult>;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/types/rollouts/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../../src/rollouts/reconcile.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAG3C,MAAM,WAAW,2BAA2B;IAC1C,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,0BAA0B;IACzC,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,cAAc,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,WAAW,EACjB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,0BAA0B,CAAC,CA0IrC"}