@authhero/cloudflare-adapter 2.37.5 → 2.38.0

package/dist/workflows.d.ts

@@ -0,0 +1,392 @@
+import { TenantsDataAdapter, TenantOperation } from '@authhero/adapter-interfaces';
+import { TenantOperationStores, StepConfig, StepRunner, TenantOperationExecutor } from '@authhero/multi-tenancy';
+
+interface CfApiClientOptions {
+    accountId: string;
+    apiToken: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+    baseUrl?: string;
+}
+interface D1Database {
+    uuid: string;
+    name: string;
+}
+interface D1QueryResult {
+    success: boolean;
+    meta?: Record<string, unknown>;
+    results?: unknown[];
+}
+type ScriptBinding = {
+    type: "d1";
+    name: string;
+    id: string;
+} | {
+    type: "plain_text";
+    name: string;
+    text: string;
+} | {
+    type: "secret_text";
+    name: string;
+    text: string;
+} | {
+    type: "service";
+    name: string;
+    service: string;
+    environment?: string;
+};
+interface ScriptUploadOptions {
+    /** Script source (JavaScript ES module). */
+    script: string;
+    /** Main module filename (must match part name in form data). */
+    mainModule: string;
+    /** Compatibility date, ISO yyyy-mm-dd. */
+    compatibilityDate: string;
+    /** Compatibility flags (e.g. `["nodejs_compat"]`). */
+    compatibilityFlags?: string[];
+    /** Bindings to attach (D1, plain_text, etc.). Secrets go via setSecret(). */
+    bindings?: ScriptBinding[];
+    /** Optional tags, stored on the script for operator-side lookup. */
+    tags?: string[];
+}
+declare class CloudflareApiClient {
+    private readonly accountId;
+    private readonly apiToken;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    private readonly baseUrl;
+    constructor(options: CfApiClientOptions);
+    createD1Database(name: string): Promise<D1Database>;
+    listD1Databases(name?: string): Promise<D1Database[]>;
+    deleteD1Database(databaseId: string): Promise<void>;
+    /**
+     * Execute a single SQL statement (or batch of `;`-separated statements
+     * permitted by D1) against the given database. Use for applying
+     * migrations one file at a time — the per-call response size cap means
+     * very large single calls can fail; splitting per file keeps each call
+     * bounded by the migration author.
+     */
+    execD1(databaseId: string, sql: string): Promise<D1QueryResult[]>;
+    uploadNamespacedScript(namespace: string, scriptName: string, options: ScriptUploadOptions): Promise<void>;
+    deleteNamespacedScript(namespace: string, scriptName: string): Promise<void>;
+    /**
+     * Set a single secret on a namespaced script. The CF API replaces the
+     * value if a secret with that name already exists, so this is safely
+     * re-runnable.
+     */
+    setNamespacedScriptSecret(namespace: string, scriptName: string, secretName: string, secretValue: string): Promise<void>;
+    private request;
+}
+
+interface TenantProvisionNames {
+    scriptName: string;
+    databaseName: string;
+}
+/**
+ * Provider-agnostic contract for the individual, idempotent units of
+ * tenant provisioning. Deliberately free of Cloudflare/D1 terminology so
+ * the durable operation orchestration (issue #1026 phase 2) — and any
+ * future provider (e.g. Bunny with its SQLite databases) — can run against
+ * it. `createWfpProvisionerSteps` is the Cloudflare Workers-for-Platforms
+ * + D1 implementation.
+ */
+interface TenantProvisionerSteps {
+    names(tenantId: string): TenantProvisionNames;
+    /**
+     * Validate the version token persisted into `tenants.database_version`
+     * BEFORE any provider side effects. Returns the recorded versions.
+     */
+    validate(): {
+        databaseVersion?: string;
+        bundleConfiguration?: string;
+        workerVersion?: string;
+    };
+    findOrCreateDatabase(name: string): Promise<{
+        id: string;
+        created: boolean;
+    }>;
+    /**
+     * Reconcile migrations against the provisioner-owned tracking table
+     * (`_authhero_provisioner_migrations`), including the legacy backfill
+     * branch for pre-tracking databases.
+     */
+    applyMigrations(databaseId: string, created: boolean): Promise<void>;
+    uploadScript(scriptName: string, databaseId: string): Promise<void>;
+    uploadSecrets(scriptName: string, tenantId: string): Promise<void>;
+    /** Best-effort teardown of both resources; throws a combined error. */
+    deprovision(tenantId: string): Promise<void>;
+}
+
+/**
+ * Structural types for the Cloudflare Workflows engine. Deliberately NOT
+ * imported from `cloudflare:workers` / `@cloudflare/workers-types` — this
+ * package ships platform-agnostic bundles and the real runtime objects
+ * satisfy these shapes structurally (precedent: `@authhero/proxy`'s local
+ * binding types). Only the downstream worker's `WorkflowEntrypoint` shell
+ * touches `cloudflare:workers` (see `entrypoint.example.ts`).
+ */
+/**
+ * The ONLY data that crosses the enqueue boundary. Workflows persists
+ * params (and shows them in the dashboard), so never put secrets here —
+ * the workflow re-resolves everything else from its worker env.
+ */
+interface TenantOperationWorkflowParams {
+    operation_id: string;
+    tenant_id: string;
+    /** Widened beyond "provision" in later phases (upgrade, backup, …). */
+    kind: "provision";
+}
+/**
+ * Instance status as reported by the engine. The exact value set has
+ * drifted across Cloudflare releases; the reconciler only branches on the
+ * terminal values and treats anything unrecognized as still-running.
+ */
+interface WorkflowInstanceStatus {
+    status: "queued" | "running" | "paused" | "errored" | "terminated" | "complete" | "waiting" | "waitingForPause" | "unknown" | (string & {});
+    error?: {
+        name?: string;
+        message?: string;
+    } | string | null;
+    output?: unknown;
+}
+/** Structurally satisfied by the handles a `workflows` binding returns. */
+interface WorkflowInstanceHandle {
+    id: string;
+    status(): Promise<WorkflowInstanceStatus>;
+}
+/**
+ * Structurally satisfied by a Workflows binding
+ * (e.g. `env.TENANT_OPERATIONS_WORKFLOW`).
+ */
+interface WorkflowsBinding {
+    create(options: {
+        id: string;
+        params: TenantOperationWorkflowParams;
+    }): Promise<WorkflowInstanceHandle>;
+    get(id: string): Promise<WorkflowInstanceHandle>;
+}
+declare const TENANT_OPERATION_ENGINE = "cloudflare-workflows";
+
+type ProvisionStepName = "mark-running" | "create-database" | "apply-migrations" | "upload-script" | "upload-secrets" | "seed-defaults" | "verify" | "mark-ready" | "mark-failed";
+interface ProvisionOperationDeps {
+    /** Provider-agnostic provisioner steps (all idempotent) — e.g.
+     * `createWfpProvisionerSteps` for Cloudflare WFP + D1. */
+    steps: TenantProvisionerSteps;
+    /** Control-plane tenants adapter (snapshot writes). */
+    tenants: TenantsDataAdapter;
+    /** Control-plane operation log stores. */
+    stores: TenantOperationStores;
+    /**
+     * Defaults seed (`createDispatchSyncDefaults(...)`). Runs as a retried
+     * step BEFORE `ready`; per-entity errors in the resolved result fail the
+     * step. Optional only for parity with the inline hook — WFP control
+     * planes should always set it.
+     */
+    syncDefaults?: (tenantId: string) => Promise<unknown>;
+    /**
+     * Post-seed verification (`createProvisionVerifier(...)`). Throws until
+     * the tenant database actually holds keys + the tenant row; retried with backoff so a
+     * propagation race becomes a few retries instead of a bad `ready`.
+     */
+    verify?: (databaseId: string, tenantId: string) => Promise<void>;
+    /** Same gate + default as the inline hook: `deployment_type === "wfp"`. */
+    shouldProvision?: (tenant: {
+        id: string;
+        deployment_type?: string;
+        storage_kind?: string;
+    }) => boolean;
+    logger?: Pick<Console, "warn">;
+    /** Per-step overrides of the retry/timeout defaults. */
+    stepConfig?: Partial<Record<ProvisionStepName, StepConfig>>;
+}
+/**
+ * Durable provision-as-workflow (issue #1026 phase 2): the full provision
+ * sequence — resources, migrations, script, secrets, seed, verify — as one
+ * engine step per unit, writing back to the control-plane operation log at
+ * every step boundary. The DB write happens inside the same `step.do` as
+ * the side effect, so it is durable and retried with the step; all side
+ * effects are idempotent, which makes replay after a retry or eviction
+ * safe.
+ *
+ * Terminal writes: `mark-ready` flips the tenant snapshot to `ready` and
+ * the operation to `succeeded`; any failure runs `mark-failed` (persisting
+ * whatever resource ids exist, mirroring the inline hook's failed branch)
+ * and rethrows so the engine instance ends `errored`. If even `mark-failed`
+ * dies, the operation stays `running` and the reconciler sweep copies the
+ * engine's terminal state into the DB.
+ *
+ * Runs against any `StepRunner` — Cloudflare's `WorkflowStep` satisfies it
+ * structurally, and tests use fakes.
+ */
+declare function runProvisionOperation(deps: ProvisionOperationDeps, params: TenantOperationWorkflowParams, step: StepRunner): Promise<void>;
+
+interface ProvisionVerifierOptions {
+    client: CloudflareApiClient;
+    /** Minimum number of signing keys the tenant D1 must hold. Default 1. */
+    minKeys?: number;
+}
+/**
+ * Thrown when the freshly provisioned D1 fails the post-seed checks. The
+ * message is self-contained (it survives workflow step serialization) and
+ * names exactly which check failed — it ends up in
+ * `tenant_operation_events.detail` and, when retries exhaust, in
+ * `tenants.provisioning_error`.
+ */
+declare class TenantProvisionVerificationError extends Error {
+    readonly checks: {
+        keyCount: number;
+        tenantRowCount: number;
+    };
+    constructor(message: string, checks: {
+        keyCount: number;
+        tenantRowCount: number;
+    });
+}
+/**
+ * Post-provision verification (issue #1026): assert the tenant D1 actually
+ * contains signing keys and its own tenant row before the tenant is marked
+ * `ready`. Queries D1 over the same REST path the provisioner's migrations
+ * use — this is what turns the 2026-07-02 "ready but empty D1" incident
+ * class into a retried workflow step instead of a silent success.
+ *
+ * Limitation (accepted for v1): this proves the rows landed in D1 via the
+ * REST API, not that the tenant worker's binding observes them; a worker
+ * HTTP probe can be layered on later.
+ */
+declare function createProvisionVerifier(options: ProvisionVerifierOptions): (databaseId: string, tenantId: string) => Promise<void>;
+
+interface CloudflareWorkflowsExecutorOptions {
+    binding: WorkflowsBinding;
+}
+/**
+ * `TenantOperationExecutor` backed by a Cloudflare Workflows binding
+ * (issue #1026 phase 2). Row-first contract: `enqueueTenantOperation` has
+ * already persisted the operation (with its deterministic
+ * `engine_instance_id`) before `start` is called, so an instance can never
+ * exist without a tracking row.
+ *
+ * `start` resolves as soon as the instance is created — the workflow owns
+ * every subsequent write. Creating an instance whose id already exists is
+ * treated as success (idempotent re-enqueue after a crashed caller).
+ */
+declare function createCloudflareWorkflowsExecutor(options: CloudflareWorkflowsExecutorOptions): TenantOperationExecutor;
+
+interface ReconcileTenantOperationsOptions {
+    stores: TenantOperationStores;
+    tenants: TenantsDataAdapter;
+    binding: WorkflowsBinding;
+    /**
+     * Only touch operations whose `updated_at` is older than this — fresh
+     * runs write at every step boundary, so a recently-updated operation is
+     * alive. Default 10 minutes.
+     */
+    minAgeMs?: number;
+    /** Max stuck operations per sweep. Default 100. */
+    limit?: number;
+    logger?: Pick<Console, "warn">;
+}
+interface ReconcileTenantOperationsResult {
+    scanned: number;
+    markedFailed: number;
+    markedSucceeded: number;
+    stillRunning: number;
+    instanceMissing: number;
+    errors: number;
+}
+/**
+ * Sweep for operations stuck in `pending`/`running` whose engine instance
+ * died before reaching its own terminal write (issue #1026): resolve the
+ * instance (via the stored — or re-derived, it's deterministic — id), and
+ * copy terminal engine states into the control-plane DB.
+ *
+ * The engine retains completed-instance state for at most 30 days, so
+ * hosts must run this at least daily; every 15–60 minutes is recommended
+ * (wire it to the worker's `scheduled` handler). One operation's engine
+ * error never aborts the sweep.
+ *
+ * Decision table per stuck operation:
+ * - handle lookup throws (expired / never created) → `failed`
+ * - engine `errored` / `terminated` → `failed` (engine error copied)
+ * - engine `complete` but operation non-terminal (the final write raced or
+ *   was lost) → decided from the tenant snapshot, which is the source of
+ *   truth: `provisioning_state === "ready"` → `succeeded`, else `failed`
+ * - anything else → still running, left untouched
+ */
+declare function reconcileTenantOperations(options: ReconcileTenantOperationsOptions): Promise<ReconcileTenantOperationsResult>;
+
+/**
+ * Structural mirror of `@authhero/multi-tenancy`'s `StepReporter` — kept
+ * local so this module carries no multi-tenancy dependency. When the
+ * control plane records provisions as tenant operations (issue #1026),
+ * the hook receives this callback and surfaces coarse step boundaries
+ * (`provision-resources`, `seed-defaults`) in the operation history.
+ */
+type WfpProvisioningStepReporter = (step: string, outcome: "started" | "succeeded" | "failed", detail?: Record<string, unknown>) => Promise<void>;
+interface WfpTenantProvisioningHook {
+    onProvision(tenantId: string, report?: WfpProvisioningStepReporter): Promise<void>;
+    onDeprovision(tenantId: string): Promise<void>;
+    /**
+     * Re-run provisioning for an already-existing WFP tenant to pull it onto the
+     * current bundle + migrations — i.e. an upgrade. Re-uploads the worker
+     * script (an upload overwrites), reconciles any migrations not yet applied to
+     * the tenant D1, re-runs `syncDefaults`, then rewrites `worker_version`,
+     * `bundle_configuration`, and `database_version` so the recorded versions
+     * reflect what now runs. Marks `provisioning_state = "pending"` while the
+     * upgrade is in flight and `ready` on success (`failed` on error).
+     *
+     * Throws if the tenant doesn't exist or isn't WFP-provisioned — callers
+     * (e.g. a management-API redeploy endpoint) surface that as a 4xx.
+     */
+    onUpgrade(tenantId: string, report?: WfpProvisioningStepReporter): Promise<void>;
+}
+
+interface WfpWorkflowProvisioningHookOptions {
+    tenants: TenantsDataAdapter;
+    /**
+     * Enqueues a provision operation on the durable engine — typically
+     * `(input) => enqueueTenantOperation(stores, createCloudflareWorkflowsExecutor({ binding }), input)`.
+     * Resolves as soon as the engine instance is created.
+     */
+    enqueueOperation: (input: {
+        kind: "provision";
+        tenant_id: string;
+        initiated_by?: string;
+    }) => Promise<TenantOperation>;
+    /** Same gate + default as the inline hook: `deployment_type === "wfp"`. */
+    shouldProvision?: (tenant: {
+        id: string;
+        deployment_type?: string;
+        storage_kind?: string;
+    }) => boolean;
+    /**
+     * The existing inline hook (`createWfpTenantProvisioningHook(...)`).
+     * Upgrade and deprovision keep running inline until later phases make
+     * them durable.
+     */
+    inline: WfpTenantProvisioningHook;
+}
+/**
+ * Drop-in replacement for `createWfpTenantProvisioningHook` on control
+ * planes that run provisioning through Cloudflare Workflows (issue #1026
+ * phase 2): `onProvision` enqueues a durable provision operation and
+ * returns immediately, leaving the tenant `pending` — the workflow's
+ * `mark-ready` / `mark-failed` steps own the terminal snapshot writes, and
+ * the reconciler covers instances that die mid-run.
+ *
+ * Semantic change to plan for downstream: tenant-create now returns with
+ * `provisioning_state: "pending"`; clients poll the tenant row or the
+ * operations API. An enqueue failure still throws, so
+ * `createProvisioningHooks.afterCreate` rolls the tenant row back exactly
+ * like an inline provision failure does today. This also replaces any
+ * best-effort post-create seed — the seed is a durable step inside the
+ * workflow.
+ *
+ * Wire it with `databaseIsolation.recordProvisionOperations: false` — this
+ * hook's `enqueueOperation` creates the operation row itself, and the
+ * multi-tenancy recording wrapper would otherwise write a second row that
+ * gets marked succeeded while the engine run is still in flight.
+ */
+declare function createWfpWorkflowProvisioningHook(options: WfpWorkflowProvisioningHookOptions): WfpTenantProvisioningHook;
+
+export { TENANT_OPERATION_ENGINE, TenantProvisionVerificationError, createCloudflareWorkflowsExecutor, createProvisionVerifier, createWfpWorkflowProvisioningHook, reconcileTenantOperations, runProvisionOperation };
+export type { CloudflareWorkflowsExecutorOptions, ProvisionOperationDeps, ProvisionStepName, ProvisionVerifierOptions, ReconcileTenantOperationsOptions, ReconcileTenantOperationsResult, TenantOperationWorkflowParams, WfpWorkflowProvisioningHookOptions, WorkflowInstanceHandle, WorkflowInstanceStatus, WorkflowsBinding };

package/dist/workflows.mjs

@@ -0,0 +1,279 @@
+import { r as e, t } from "./sync-defaults-errors-BlLZh6Gt.mjs";
+import { buildEngineInstanceId as n, createOperationRecorder as r, isTerminalStatus as i } from "@authhero/multi-tenancy";
+//#region src/workflows/provision-operation.ts
+var a = {
+	retries: {
+		limit: 5,
+		delay: "5 seconds",
+		backoff: "exponential"
+	},
+	timeout: "2 minutes"
+}, o = {
+	retries: {
+		limit: 8,
+		delay: "10 seconds",
+		backoff: "exponential"
+	},
+	timeout: "1 minute"
+};
+function s(e) {
+	return e instanceof Error ? e.message : String(e);
+}
+async function c(e, n, i) {
+	let c = r(e.stores), l = e.shouldProvision ?? ((e) => e.deployment_type === "wfp"), u = (t) => e.stepConfig?.[t] ?? (t === "verify" ? o : a), d = n.operation_id, f = n.tenant_id, p = await i.do("mark-running", u("mark-running"), async () => {
+		let t = await e.tenants.get(f);
+		if (!t || !l(t)) return await c.appendEvent(d, {
+			step: "mark-running",
+			outcome: "skipped",
+			detail: { reason: t ? "tenant is not WFP-provisioned" : "tenant row missing (rolled back?)" }
+		}), await c.markSucceeded(d), {
+			skipped: !0,
+			scriptName: "",
+			databaseName: ""
+		};
+		let n = e.steps.validate(), r = e.steps.names(f);
+		return await c.markRunning(d, "mark-running"), await c.appendEvent(d, {
+			step: "mark-running",
+			outcome: "succeeded"
+		}), {
+			skipped: !1,
+			...r,
+			...n
+		};
+	});
+	if (p.skipped) return;
+	let m = {
+		worker_script_name: p.scriptName,
+		bundle_configuration: p.bundleConfiguration,
+		worker_version: p.workerVersion,
+		database_version: p.databaseVersion
+	};
+	try {
+		let n = await i.do("create-database", u("create-database"), async () => {
+			await c.setCurrentStep(d, "create-database");
+			let { id: t, created: n } = await e.steps.findOrCreateDatabase(p.databaseName);
+			return await c.appendEvent(d, {
+				step: "create-database",
+				outcome: "succeeded",
+				detail: {
+					database_id: t,
+					created: n
+				}
+			}), {
+				databaseId: t,
+				created: n
+			};
+		});
+		if (m.d1_database_id = n.databaseId, await i.do("apply-migrations", u("apply-migrations"), async () => {
+			await c.setCurrentStep(d, "apply-migrations"), await e.steps.applyMigrations(n.databaseId, n.created), await c.appendEvent(d, {
+				step: "apply-migrations",
+				outcome: "succeeded",
+				detail: { database_version: p.databaseVersion }
+			});
+		}), await i.do("upload-script", u("upload-script"), async () => {
+			await c.setCurrentStep(d, "upload-script"), await e.steps.uploadScript(p.scriptName, n.databaseId), await c.appendEvent(d, {
+				step: "upload-script",
+				outcome: "succeeded",
+				detail: { worker_version: p.workerVersion }
+			});
+		}), await i.do("upload-secrets", u("upload-secrets"), async () => {
+			await c.setCurrentStep(d, "upload-secrets"), await e.steps.uploadSecrets(p.scriptName, f), await c.appendEvent(d, {
+				step: "upload-secrets",
+				outcome: "succeeded"
+			});
+		}), e.syncDefaults) {
+			let n = e.syncDefaults;
+			await i.do("seed-defaults", u("seed-defaults"), async () => {
+				await c.setCurrentStep(d, "seed-defaults");
+				let e = t(await n(f));
+				if (e.length > 0) throw Error(`sync-defaults seed reported ${e.length} error(s): ${e.join("; ")}`);
+				await c.appendEvent(d, {
+					step: "seed-defaults",
+					outcome: "succeeded"
+				});
+			});
+		}
+		if (e.verify) {
+			let t = e.verify;
+			await i.do("verify", u("verify"), async () => {
+				await c.setCurrentStep(d, "verify"), await t(n.databaseId, f), await c.appendEvent(d, {
+					step: "verify",
+					outcome: "succeeded"
+				});
+			});
+		}
+		await i.do("mark-ready", u("mark-ready"), async () => {
+			await c.setCurrentStep(d, "mark-ready"), await e.tenants.update(f, {
+				...m,
+				provisioning_state: "ready",
+				provisioning_error: void 0,
+				provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
+			}), await c.appendEvent(d, {
+				step: "mark-ready",
+				outcome: "succeeded"
+			}), await c.markSucceeded(d);
+		});
+	} catch (t) {
+		throw await i.do("mark-failed", u("mark-failed"), async () => {
+			let n = s(t);
+			try {
+				await e.tenants.update(f, {
+					...m,
+					provisioning_state: "failed",
+					provisioning_error: n.slice(0, 2048),
+					provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
+				});
+			} catch (t) {
+				e.logger?.warn(`Failed to write provisioning_state="failed" for tenant ${f}:`, t);
+			}
+			await c.appendEvent(d, {
+				step: "mark-failed",
+				outcome: "failed",
+				detail: { message: n }
+			}), await c.markFailed(d, t);
+		}), t;
+	}
+}
+//#endregion
+//#region src/workflows/verify.ts
+var l = class extends Error {
+	checks;
+	constructor(e, t) {
+		super(e), this.name = "TenantProvisionVerificationError", this.checks = t;
+	}
+};
+function u(e, t) {
+	for (let n of e) for (let e of n.results ?? []) if (!(!e || typeof e != "object")) {
+		for (let [n, r] of Object.entries(e)) if (n === t) {
+			if (typeof r == "number") return r;
+			if (typeof r == "string" && r !== "" && !isNaN(Number(r))) return Number(r);
+		}
+	}
+	return 0;
+}
+function d(t) {
+	let n = t.minKeys ?? 1;
+	return async (r, i) => {
+		let a = await t.client.execD1(r, `SELECT (SELECT COUNT(*) FROM keys) AS key_count, (SELECT COUNT(*) FROM tenants WHERE id = '${e(i)}') AS tenant_count;`), o = u(a, "key_count"), s = u(a, "tenant_count"), c = [];
+		if (o < n && c.push(`expected at least ${n} signing key(s) in "keys", found ${o}`), s < 1 && c.push(`tenant row "${i}" missing from "tenants"`), c.length > 0) throw new l(`Tenant D1 verification failed for "${i}": ${c.join("; ")}`, {
+			keyCount: o,
+			tenantRowCount: s
+		});
+	};
+}
+//#endregion
+//#region src/workflows/executor.ts
+function f(e) {
+	let t = e instanceof Error ? e.message : String(e ?? "");
+	return /already exists|already been created|duplicate/i.test(t);
+}
+function p(e) {
+	return {
+		engine: "cloudflare-workflows",
+		async start(t) {
+			if (t.kind !== "provision") throw Error(`The Cloudflare Workflows executor does not support "${t.kind}" operations yet (phase 2 covers provision only)`);
+			if (!t.tenant_id) throw Error("provision operations require a tenant_id");
+			let r = t.engine_instance_id ?? n(t);
+			try {
+				await e.binding.create({
+					id: r,
+					params: {
+						operation_id: t.id,
+						tenant_id: t.tenant_id,
+						kind: t.kind
+					}
+				});
+			} catch (e) {
+				if (!f(e)) throw e;
+			}
+		}
+	};
+}
+//#endregion
+//#region src/workflows/types.ts
+var m = "cloudflare-workflows";
+//#endregion
+//#region src/workflows/reconcile.ts
+async function h(e) {
+	let { stores: t, tenants: a, binding: o } = e, s = r(t), c = e.minAgeMs ?? 600 * 1e3, l = e.limit ?? 100, u = new Date(Date.now() - c).toISOString(), { operations: d } = await t.tenantOperations.list({
+		status: ["pending", "running"],
+		engine: m,
+		updated_before: u,
+		per_page: l
+	}), f = {
+		scanned: d.length,
+		markedFailed: 0,
+		markedSucceeded: 0,
+		stillRunning: 0,
+		instanceMissing: 0,
+		errors: 0
+	};
+	for (let t of d) try {
+		await h(t);
+	} catch (n) {
+		f.errors++, e.logger?.warn(`Failed to reconcile tenant operation ${t.id}:`, n);
+	}
+	return f;
+	async function p(e, t) {
+		await s.appendEvent(e.id, {
+			step: e.current_step ?? "reconcile",
+			outcome: "reconciled",
+			detail: {
+				resolution: "failed",
+				reason: t
+			}
+		}), await s.markFailed(e.id, t), e.kind === "provision" && e.tenant_id && (await a.get(e.tenant_id))?.provisioning_state === "pending" && await a.update(e.tenant_id, {
+			provisioning_state: "failed",
+			provisioning_error: t.slice(0, 2048),
+			provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	}
+	async function h(e) {
+		let r = await t.tenantOperations.get(e.id);
+		if (!r || i(r.status)) return;
+		let c = r.engine_instance_id ?? n(r), l;
+		try {
+			l = await o.get(c);
+		} catch {
+			f.instanceMissing++, f.markedFailed++, await p(r, `engine instance "${c}" not found (expired past retention or never started)`);
+			return;
+		}
+		let u = await l.status();
+		if (u.status === "errored" || u.status === "terminated") {
+			let e = typeof u.error == "string" ? u.error : u.error?.message ?? `engine reported ${u.status}`;
+			f.markedFailed++, await p(r, e);
+			return;
+		}
+		if (u.status === "complete") {
+			(r.tenant_id ? await a.get(r.tenant_id) : null)?.provisioning_state === "ready" ? (f.markedSucceeded++, await s.appendEvent(r.id, {
+				step: r.current_step ?? "reconcile",
+				outcome: "reconciled",
+				detail: { resolution: "succeeded" }
+			}), await s.markSucceeded(r.id)) : (f.markedFailed++, await p(r, "engine instance completed but the operation was never finalized and the tenant is not ready"));
+			return;
+		}
+		f.stillRunning++;
+	}
+}
+//#endregion
+//#region src/workflows/enqueue-hook.ts
+function g(e) {
+	let t = e.shouldProvision ?? ((e) => e.deployment_type === "wfp");
+	return {
+		async onProvision(n, r) {
+			let i = await e.tenants.get(n);
+			i && t(i) && await e.enqueueOperation({
+				kind: "provision",
+				tenant_id: n
+			});
+		},
+		async onUpgrade(t, n) {
+			await e.inline.onUpgrade(t, n);
+		},
+		async onDeprovision(t) {
+			await e.inline.onDeprovision(t);
+		}
+	};
+}
+//#endregion
+export { m as TENANT_OPERATION_ENGINE, l as TenantProvisionVerificationError, p as createCloudflareWorkflowsExecutor, d as createProvisionVerifier, g as createWfpWorkflowProvisioningHook, h as reconcileTenantOperations, c as runProvisionOperation };