Reconcile the membership mirror from WorkOS events

[RhysSullivan]

Layer 3 of 5 (stack #2008). Cloud only. Sits directly on the feeders so the mirror is reconciled before anything reads it.

• syncWorkOsEvents replays user, organization_membership, and organization events from the WorkOS Events API after a persisted cursor, starting from the backfill's replay boundary. Each page is planned first, then applied in one transaction where the cursor compare-and-set runs before the writes, so overlapping runs cannot double-apply or resurrect a deleted row. A run stops after 20 pages and the next tick continues. Each run records drained_at.
• A membership created event for a user the mirror has no profile for fetches the profile in the same write. A membership event for an org WorkOS has since deleted is skipped with a warning. organization.updated is a pure rename. organization.deleted marks the org deleted, minting a tombstone row if the mirror never saw it.
• Every-minute cron (triggers.crons plus a scheduled export on the worker). Migration 0020 adds drained_at.
• POST /api/webhooks/workos verifies the signature and pokes the same reconciler. It never applies the webhook payload. Answers 503 until the secret is set.
• The replay loop is a plain module over explicit ports, so scripts/drain-workos-events.ts runs it out of band under bun.

Ops steps (cloud): wrangler secret put WORKOS_WEBHOOK_SECRET, then register https://executor.sh/api/webhooks/workos in the WorkOS dashboard for user.*, organization_membership.*, organization.updated, and organization.deleted.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	6ca0929	Commit Preview URL Branch Preview URL	Sep 16 2026, 04:28 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	6ca0929	Sep 16 2026, 04:31 PM

[github-actions]

Cloudflare preview

Console	https://executor-preview-pr-2006.executor-e2e.workers.dev
MCP	https://executor-preview-pr-2006.executor-e2e.workers.dev/mcp
Deployed commit	6ca0929

Sign-in is Cloudflare Access (one-time PIN to an allowed email). The preview has its own database and encryption key; it is destroyed when this PR closes.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@2006

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@2006

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@2006

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@2006

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@2006

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@2006

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@2006

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@2006

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@2006

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@2006

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@2006

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@2006

executor

npm i https://pkg.pr.new/executor@2006

commit: d2d7740