Reconcile the membership mirror from WorkOS events

[RhysSullivan]

Layer 3 of 5. Cloud only. Sits directly on the feeders so the mirror is reconciled before anything reads it. Replaces #2006, which GitHub auto-closed when the stack was reordered; nothing from it reached main.

• syncWorkOsEvents replays user, organization_membership, and organization events from the WorkOS Events API after a persisted cursor, starting from the backfill's replay boundary. Each page is planned first, then applied in one transaction where the cursor compare-and-set runs before the writes, so overlapping runs cannot double-apply or resurrect a deleted row. A run stops after 20 pages and the next tick continues. Each run records drained_at.
• A membership created event for a user the mirror has no profile for fetches the profile in the same write. A membership event for an org WorkOS has since deleted is skipped with a warning. organization.updated is a pure rename. organization.deleted marks the org deleted, minting a tombstone row if the mirror never saw it.
• Every-minute cron (triggers.crons plus a scheduled export on the worker). Migration 0020 adds drained_at.
• POST /api/webhooks/workos verifies the signature and pokes the same reconciler. It never applies the webhook payload. Answers 503 until the secret is set.
• The replay loop is a plain module over explicit ports, so scripts/drain-workos-events.ts runs it out of band under bun.

Ops steps (cloud): wrangler secret put WORKOS_WEBHOOK_SECRET, then register https://executor.sh/api/webhooks/workos in the WorkOS dashboard for user.*, organization_membership.*, organization.updated, and organization.deleted.

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@2024

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@2024

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@2024

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@2024

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@2024

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@2024

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@2024

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@2024

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@2024

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@2024

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@2024

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@2024

executor

npm i https://pkg.pr.new/executor@2024

commit: f4d9475

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	f4d9475	Commit Preview URL Branch Preview URL	Sep 16 2026, 06:04 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	f4d9475	Sep 16 2026, 06:05 PM