@authhero/cloudflare-adapter 3.3.0 → 3.4.0

package/dist/wfp.mjs

@@ -1,17 +1,17 @@
-import { applyControlPlaneDefaultsPayload as e, applyResolvedConfigBlock as t, buildControlPlaneDefaultsPayload as n, buildResolvedConfigBlock as r, withRuntimeFallback as i } from "@authhero/multi-tenancy";
-import { Hono as a } from "hono";
-import { SigningCertificateRenewalError as o, TENANT_URI_PREFIX as s, createEncryptedDataAdapterWithKeyRing as c, ensureSigningKey as l, init as u, loadEncryptionKey as d, renewSigningCertificates as f } from "authhero";
+import { applyControlPlaneDefaultsPayload as e, applyResolvedConfigBlock as t, assertDetachEligible as n, buildControlPlaneDefaultsPayload as r, buildResolvedConfigBlock as i, createShadowReporter as a, detachTenantRows as o, emptyDetachResult as s, markTenantDetached as c, withRuntimeFallback as l } from "@authhero/multi-tenancy";
+import { Hono as u } from "hono";
+import { SigningCertificateRenewalError as d, TENANT_URI_PREFIX as f, createEncryptedDataAdapterWithKeyRing as p, ensureSigningKey as m, init as h, loadEncryptionKey as g, renewSigningCertificates as _ } from "authhero";
 //#region src/wfp/dispatch-sync-defaults.ts
-var p = "tenant-{tenant_id}-auth", m = 3e4, h = "/internal/sync-defaults";
-function g(e, t) {
+var v = "tenant-{tenant_id}-auth", y = 3e4, b = "/internal/sync-defaults";
+function x(e, t) {
 	return e.replace(/\{tenant_id\}/g, t);
 }
-function _(e) {
-	let { dispatcher: t, scriptNameTemplate: r = p, internalSecret: i, controlPlaneTenantId: a, controlPlaneAdapters: o, entities: s, timeoutMs: c = m } = e;
+function S(e) {
+	let { dispatcher: t, scriptNameTemplate: n = v, internalSecret: i, controlPlaneTenantId: a, controlPlaneAdapters: o, entities: s, timeoutMs: c = y } = e;
 	return async (e) => {
-		let l = await n(o, a, s, e), u = g(r, e), d = new AbortController(), f = setTimeout(() => d.abort(), c), p;
+		let l = await r(o, a, s, e), u = x(n, e), d = new AbortController(), f = setTimeout(() => d.abort(), c), p;
 		try {
-			p = await t.get(u).fetch(`https://tenant.internal${h}`, {
+			p = await t.get(u).fetch(`https://tenant.internal${b}`, {
 				method: "POST",
 				headers: {
 					"content-type": "application/json",
@@ -32,16 +32,54 @@ function _(e) {
 }
 //#endregion
 //#region src/wfp/dispatch-sync-config.ts
-var v = "/internal/sync-config";
-function y(e) {
-	let { dispatcher: t, scriptNameTemplate: n = p, internalSecret: i, controlPlaneTenantId: a, controlPlaneAdapters: o, maxDepth: s, timeoutMs: c = m } = e;
-	return async (e, { dryRun: l, force: u }) => {
-		let d = await r(o, e, {
+var C = "/internal/sync-config";
+function w(e) {
+	let { dispatcher: t, scriptNameTemplate: n = v, internalSecret: r, controlPlaneTenantId: a, controlPlaneAdapters: o, maxDepth: s, timeoutMs: c = y } = e;
+	return async (e, { dryRun: l, force: u, prune: d }) => {
+		if ((await o.tenants.get(e))?.config_sync === "detached") throw Error(`Tenant "${e}" is detached from its parent: set config_sync back to "inherit-on-read" or "synced" before syncing it`);
+		let f = await i(o, e, {
 			legacyControlPlane: a,
 			maxDepth: s
-		}), f = g(n, e), p = new AbortController(), m = setTimeout(() => p.abort(), c), h;
+		}), p = x(n, e), m = new AbortController(), h = setTimeout(() => m.abort(), c), g;
 		try {
-			h = await t.get(f).fetch(`https://tenant.internal${v}`, {
+			g = await t.get(p).fetch(`https://tenant.internal${C}`, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					authorization: `Bearer ${r}`
+				},
+				body: JSON.stringify({
+					tenantId: e,
+					resolved: f,
+					dryRun: l,
+					force: u,
+					prune: d
+				}),
+				signal: m.signal
+			});
+		} finally {
+			clearTimeout(h);
+		}
+		if (!g.ok) {
+			let e = await g.text().catch(() => ""), t = g.headers.get("x-authhero-error");
+			throw Error(`sync-config push to "${p}" failed: ${g.status}${t ? ` (${t})` : ""} ${e.slice(0, 256)}`);
+		}
+		return await g.json();
+	};
+}
+//#endregion
+//#region src/wfp/dispatch-detach.ts
+var T = "/internal/detach", E = 12e4;
+function D(e) {
+	let { dispatcher: t, scriptNameTemplate: r = v, internalSecret: i, controlPlaneAdapters: a, timeoutMs: o = E } = e;
+	return async (e, { dryRun: l, clean: u }) => {
+		let d = await a.tenants.get(e);
+		if (!d) throw Error(`Tenant "${e}" not found`);
+		if (d.config_sync === "detached") return s("already-detached");
+		n(e, d);
+		let f = x(r, e), p = new AbortController(), m = setTimeout(() => p.abort(), o), h;
+		try {
+			h = await t.get(f).fetch(`https://tenant.internal${T}`, {
 				method: "POST",
 				headers: {
 					"content-type": "application/json",
@@ -49,9 +87,8 @@ function y(e) {
 				},
 				body: JSON.stringify({
 					tenantId: e,
-					resolved: d,
 					dryRun: l,
-					force: u
+					clean: u
 				}),
 				signal: p.signal
 			});
@@ -60,20 +97,78 @@ function y(e) {
 		}
 		if (!h.ok) {
 			let e = await h.text().catch(() => ""), t = h.headers.get("x-authhero-error");
-			throw Error(`sync-config push to "${f}" failed: ${h.status}${t ? ` (${t})` : ""} ${e.slice(0, 256)}`);
+			throw Error(`detach push to "${f}" failed: ${h.status}${t ? ` (${t})` : ""} ${e.slice(0, 256)}`);
+		}
+		let g = await h.json();
+		return !l && g.status === "detached" && await c(a, e), g;
+	};
+}
+//#endregion
+//#region src/wfp/dispatch-tenant-member-requests.ts
+var O = "/internal/tenant-member-requests", k = 15e3;
+function A(e) {
+	let { dispatcher: t, scriptNameTemplate: n = v, internalSecret: r, timeoutMs: i = k } = e;
+	async function a(e, a) {
+		let o = x(n, e), s = new AbortController(), c = setTimeout(() => s.abort(), i);
+		try {
+			return await t.get(o).fetch(`https://tenant.internal${O}`, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					authorization: `Bearer ${r}`
+				},
+				body: JSON.stringify({
+					tenantId: e,
+					...a
+				}),
+				signal: s.signal
+			});
+		} finally {
+			clearTimeout(c);
+		}
+	}
+	async function o(e, t) {
+		let n = await t.text().catch(() => ""), r = t.headers.get("x-authhero-error");
+		return /* @__PURE__ */ Error(`tenant member requests of "${e}" answered ${t.status}${r ? ` (${r})` : ""} ${n.slice(0, 256)}`);
+	}
+	return {
+		async get(e, t) {
+			let n = await a(e, {
+				action: "get",
+				id: t
+			});
+			if (n.status === 404) return null;
+			if (!n.ok) throw await o(e, n);
+			return await n.json();
+		},
+		async report(e, t, n) {
+			let r = await a(e, {
+				action: "report",
+				id: t,
+				outcome: n
+			});
+			if (!r.ok) throw await o(e, r);
+			return (await r.json()).updated;
+		},
+		async listPending(e, { olderThan: t }) {
+			let n = await a(e, {
+				action: "list_pending",
+				olderThan: t
+			});
+			if (!n.ok) throw await o(e, n);
+			return (await n.json()).requests;
 		}
-		return await h.json();
 	};
 }
 //#endregion
 //#region src/wfp/dispatch-renew-signing-certificates.ts
-var b = "/internal/renew-signing-certificates";
-function x(e) {
-	let { dispatcher: t, scriptNameTemplate: n = p, internalSecret: r, timeoutMs: i = m } = e;
+var j = "/internal/renew-signing-certificates";
+function M(e) {
+	let { dispatcher: t, scriptNameTemplate: n = v, internalSecret: r, timeoutMs: i = y } = e;
 	return async (e) => {
-		let a = g(n, e), o = new AbortController(), s = setTimeout(() => o.abort(), i);
+		let a = x(n, e), o = new AbortController(), s = setTimeout(() => o.abort(), i);
 		try {
-			let e = await t.get(a).fetch(`https://tenant.internal${b}`, {
+			let e = await t.get(a).fetch(`https://tenant.internal${j}`, {
 				method: "POST",
 				headers: { authorization: `Bearer ${r}` },
 				signal: o.signal
@@ -83,7 +178,7 @@ function x(e) {
 				throw Error(`signing-certificate renewal for "${a}" failed: ${e.status}${n ? ` (${n})` : ""} ${t.slice(0, 512)}`);
 			}
 			let n = await e.json();
-			if (!S(n)) throw Error(`signing-certificate renewal for "${a}" returned an unexpected body`);
+			if (!N(n)) throw Error(`signing-certificate renewal for "${a}" returned an unexpected body`);
 			return {
 				renewed: n.renewed,
 				notDue: n.notDue
@@ -93,13 +188,13 @@ function x(e) {
 		}
 	};
 }
-function S(e) {
+function N(e) {
 	return typeof e == "object" && !!e && "renewed" in e && "notDue" in e && Array.isArray(e.renewed) && e.renewed.every((e) => typeof e == "string") && typeof e.notDue == "number";
 }
 //#endregion
 //#region src/wfp/tenant-app.ts
-var C = "cp", w = "/internal/sync-defaults", T = "/internal/sync-config", E = "/internal/renew-signing-certificates";
-function D(e, t, n, r) {
+var P = "cp", F = "/internal/sync-defaults", I = "/internal/sync-config", L = "/internal/detach", R = "/internal/tenant-member-requests", z = "/internal/renew-signing-certificates";
+function B(e, t, n, r) {
 	console.error(`[wfp-tenant] ${t}:`, n);
 	let i = n instanceof Error ? n.message : String(n);
 	return e.header("X-Authhero-Error", t), e.json({
@@ -108,60 +203,60 @@ function D(e, t, n, r) {
 		result: r
 	}, 500);
 }
-function O(e) {
-	let t = `${s}${e.tenantId}`;
+function V(e) {
+	let t = `${f}${e.tenantId}`;
 	return {
 		issuer: e.issuer,
 		validityDays: e.validityDays,
 		subjectUri: () => t
 	};
 }
-function k(e) {
+function H(e) {
 	return ({ tenant_id: t }) => t === e.CONTROL_PLANE_TENANT_ID ? [e.CONTROL_PLANE_ISSUER] : [];
 }
-async function A(n, r) {
-	let s = n.CONTROL_PLANE_TENANT_ID, p = await d(n.ENCRYPTION_KEY), m = n.CONTROL_PLANE_ENCRYPTION_KEY ? {
-		default: p,
-		keys: { [C]: await d(n.CONTROL_PLANE_ENCRYPTION_KEY) }
-	} : { default: p }, h = r.createDataAdapter(n), g = c(h, m, { resolveEncryptKeyId: (e) => e === s ? C : void 0 }), _ = i(g, { controlPlaneTenantId: s }), v = r.signingCertificateAuthority?.(n), y = v ? O(v) : void 0, b = {
-		dataAdapter: _,
-		...y ? { signingCertificateAuthority: y } : {},
-		additionalIssuers: (r.additionalIssuers ?? k)(n)
-	}, x = r.configure ? r.configure(b, n) : b, S = x.signingCertificateAuthority, { app: A } = u(x), j = new a();
-	return j.post(w, async (t) => {
-		let i = n.WFP_INTERNAL_SYNC_SECRET, a = t.req.header("authorization");
-		if (!i || a !== `Bearer ${i}`) return t.json({ error: "unauthorized" }, 401);
-		let o;
+async function U(n, r) {
+	let i = n.CONTROL_PLANE_TENANT_ID, s = await g(n.ENCRYPTION_KEY), f = n.CONTROL_PLANE_ENCRYPTION_KEY ? {
+		default: s,
+		keys: { [P]: await g(n.CONTROL_PLANE_ENCRYPTION_KEY) }
+	} : { default: s }, v = r.createDataAdapter(n), y = p(v, f, { resolveEncryptKeyId: (e) => e === i ? P : void 0 }), b = l(y, { controlPlaneTenantId: i }), x = r.signingCertificateAuthority?.(n), S = x ? V(x) : void 0, C = {
+		dataAdapter: b,
+		...S ? { signingCertificateAuthority: S } : {},
+		additionalIssuers: (r.additionalIssuers ?? H)(n)
+	}, w = r.configure ? r.configure(C, n) : C, T = w.signingCertificateAuthority, { app: E } = h(w), D = new u();
+	if (D.post(F, async (t) => {
+		let a = n.WFP_INTERNAL_SYNC_SECRET, o = t.req.header("authorization");
+		if (!a || o !== `Bearer ${a}`) return t.json({ error: "unauthorized" }, 401);
+		let s;
 		try {
-			o = await t.req.json();
+			s = await t.req.json();
 		} catch {
 			return t.json({ error: "invalid JSON" }, 400);
 		}
 		let c;
 		try {
-			c = await e(o, g, s, { continueOnError: r.continueOnError ?? !0 });
+			c = await e(s, y, i, { continueOnError: r.continueOnError ?? !0 });
 		} catch (e) {
-			return D(t, "sync_defaults_apply_failed", e);
+			return B(t, "sync_defaults_apply_failed", e);
 		}
-		let u;
+		let l;
 		try {
-			u = { created: (await l(g.keys, {
+			l = { created: (await m(y.keys, {
 				name: n.ISSUER,
-				certificateAuthority: S
+				certificateAuthority: T
 			})).created };
 		} catch (e) {
-			return D(t, "sync_defaults_signing_key_failed", e, c);
+			return B(t, "sync_defaults_signing_key_failed", e, c);
 		}
 		if (r.onSyncResult) try {
 			await r.onSyncResult(c, n);
 		} catch (e) {
-			return D(t, "sync_defaults_on_result_failed", e, c);
+			return B(t, "sync_defaults_on_result_failed", e, c);
 		}
 		return t.json({
 			...c,
-			signingKey: u
+			signingKey: l
 		});
-	}), j.post(T, async (e) => {
+	}), D.post(I, async (e) => {
 		let i = n.WFP_INTERNAL_SYNC_SECRET, a = e.req.header("authorization");
 		if (!i || a !== `Bearer ${i}`) return e.json({ error: "unauthorized" }, 401);
 		let o;
@@ -173,10 +268,11 @@ async function A(n, r) {
 		if (!o.tenantId || !o.resolved) return e.json({ error: "tenantId and resolved are required" }, 400);
 		if (n.TENANT_ID && o.tenantId !== n.TENANT_ID) return console.error(`[wfp-tenant] sync_config_tenant_mismatch: push for "${o.tenantId}" reached the worker of "${n.TENANT_ID}"`), e.header("X-Authhero-Error", "sync_config_tenant_mismatch"), e.json({ error: "sync_config_tenant_mismatch" }, 403);
 		try {
-			let n = await t(o.resolved, h, o.tenantId, {
+			let n = await t(o.resolved, v, o.tenantId, {
 				dryRun: o.dryRun === !0,
 				force: o.force === !0,
-				keyRing: m,
+				prune: o.prune === !0,
+				keyRing: f,
 				continueOnError: r.continueOnError ?? !0
 			});
 			return e.json(n);
@@ -184,23 +280,87 @@ async function A(n, r) {
 			return t instanceof Error && /key ring cannot decrypt/.test(t.message) ? (console.error("[wfp-tenant] sync_config_key_ring:", t), e.header("X-Authhero-Error", "sync_config_key_ring"), e.json({
 				error: "sync_config_key_ring",
 				detail: t.message
-			}, 422)) : D(e, "sync_config_apply_failed", t);
+			}, 422)) : B(e, "sync_config_apply_failed", t);
+		}
+	}), D.post(L, async (e) => {
+		let t = n.WFP_INTERNAL_SYNC_SECRET, r = e.req.header("authorization");
+		if (!t || r !== `Bearer ${t}`) return e.json({ error: "unauthorized" }, 401);
+		let i;
+		try {
+			i = await e.req.json();
+		} catch {
+			return e.json({ error: "invalid JSON" }, 400);
+		}
+		if (!i.tenantId) return e.json({ error: "tenantId is required" }, 400);
+		if (n.TENANT_ID && i.tenantId !== n.TENANT_ID) return console.error(`[wfp-tenant] detach_tenant_mismatch: detach for "${i.tenantId}" reached the worker of "${n.TENANT_ID}"`), e.header("X-Authhero-Error", "detach_tenant_mismatch"), e.json({ error: "detach_tenant_mismatch" }, 403);
+		try {
+			let t = await o(v, i.tenantId, {
+				dryRun: i.dryRun === !0,
+				clean: i.clean === !0
+			});
+			return t.status === "detached" && await c(v, i.tenantId), e.json(t);
+		} catch (t) {
+			return B(e, "detach_failed", t);
 		}
-	}), j.post(E, async (e) => {
+	}), D.post(R, async (e) => {
 		let t = n.WFP_INTERNAL_SYNC_SECRET, r = e.req.header("authorization");
 		if (!t || r !== `Bearer ${t}`) return e.json({ error: "unauthorized" }, 401);
-		if (!S) return e.json({ error: "no signing certificate authority" }, 404);
+		let i;
+		try {
+			i = await e.req.json();
+		} catch {
+			return e.json({ error: "invalid JSON" }, 400);
+		}
+		if (!i.tenantId) return e.json({ error: "tenantId is required" }, 400);
+		if (n.TENANT_ID && i.tenantId !== n.TENANT_ID) return console.error(`[wfp-tenant] member_requests_tenant_mismatch: a request for "${i.tenantId}" reached the worker of "${n.TENANT_ID}"`), e.header("X-Authhero-Error", "member_requests_tenant_mismatch"), e.json({ error: "member_requests_tenant_mismatch" }, 403);
+		let a = v.tenantMemberRequests;
+		if (!a) return e.json({ error: "tenant member requests are not available" }, 501);
 		try {
-			let t = await f({
-				dataAdapter: { keys: g.keys },
-				certificateAuthority: S
+			switch (i.action) {
+				case "get": {
+					if (!i.id) return e.json({ error: "id is required" }, 400);
+					let t = await a.get(i.tenantId, i.id);
+					return t ? e.json(t) : e.json({ error: "not_found" }, 404);
+				}
+				case "report": {
+					let { status: t, result: n, error: r } = i.outcome ?? {};
+					if (!i.id || t !== "succeeded" && t !== "failed") return e.json({ error: "id and a final status are required" }, 400);
+					let o = await a.update(i.tenantId, i.id, {
+						status: t,
+						result: n ?? null,
+						error: r ?? null,
+						finished_at: (/* @__PURE__ */ new Date()).toISOString()
+					}, "pending");
+					return e.json({ updated: o });
+				}
+				case "list_pending": {
+					let t = await a.list(i.tenantId, {
+						status: "pending",
+						created_before: i.olderThan,
+						per_page: 100
+					});
+					return e.json({ requests: t.requests });
+				}
+				default: return e.json({ error: "unknown action" }, 400);
+			}
+		} catch (t) {
+			return B(e, "member_requests_failed", t);
+		}
+	}), D.post(z, async (e) => {
+		let t = n.WFP_INTERNAL_SYNC_SECRET, r = e.req.header("authorization");
+		if (!t || r !== `Bearer ${t}`) return e.json({ error: "unauthorized" }, 401);
+		if (!T) return e.json({ error: "no signing certificate authority" }, 404);
+		try {
+			let t = await _({
+				dataAdapter: { keys: y.keys },
+				certificateAuthority: T
 			});
 			return e.json({
 				renewed: t.renewed,
 				notDue: t.notDue
 			});
 		} catch (t) {
-			return t instanceof o ? (console.error("[wfp-tenant] signing_certificate_renewal_failed:", t), e.header("X-Authhero-Error", "signing_certificate_renewal_failed"), e.json({
+			return t instanceof d ? (console.error("[wfp-tenant] signing_certificate_renewal_failed:", t), e.header("X-Authhero-Error", "signing_certificate_renewal_failed"), e.json({
 				error: "signing_certificate_renewal_failed",
 				renewed: t.result.renewed,
 				notDue: t.result.notDue,
@@ -208,16 +368,38 @@ async function A(n, r) {
 					kid: e,
 					detail: t instanceof Error ? t.message : String(t)
 				}))
-			}, 500)) : D(e, "signing_certificate_renewal_failed", t);
+			}, 500)) : B(e, "signing_certificate_renewal_failed", t);
 		}
-	}), j.route("/", A), j;
+	}), D.route("/", E), r.inheritanceShadow) {
+		let e = a(y, r.inheritanceShadow === !0 ? {} : r.inheritanceShadow), t = n.TENANT_ID || new URL(n.ISSUER).hostname.split(".")[0], o, s = async () => {
+			let e = await y.tenants.get(t);
+			for (let t = 0; t < 5; t++) {
+				let t = e?.parent_tenant_id;
+				if (!t || t === i) return !0;
+				if (e = await y.tenants.get(t), !e) return !1;
+			}
+			return !1;
+		};
+		W.set(D, (n) => {
+			if (!new URL(n.url).pathname.startsWith("/internal/") && t !== i) return (async () => {
+				if (!await (o ??= s())) return;
+				let n = e.schedule(t, i);
+				n && await n;
+			})();
+		});
+	}
+	return D;
 }
-function j(e) {
+var W = /* @__PURE__ */ new WeakMap();
+function G(e) {
 	let t = /* @__PURE__ */ new WeakMap();
 	return { fetch(n, r, i) {
 		let a = t.get(r);
-		return a || (a = A(r, e), t.set(r, a)), a.then((e) => e.fetch(n, r, i));
+		return a || (a = U(r, e), t.set(r, a)), a.then(async (e) => {
+			let t = await e.fetch(n, r, i), a = W.get(e)?.(n);
+			return a && i.waitUntil(a), t;
+		});
 	} };
 }
 //#endregion
-export { x as createDispatchRenewSigningCertificates, y as createDispatchSyncConfig, _ as createDispatchSyncDefaults, j as createWfpTenantApp };
+export { O as TENANT_MEMBER_REQUESTS_PATH, D as createDispatchDetach, M as createDispatchRenewSigningCertificates, w as createDispatchSyncConfig, S as createDispatchSyncDefaults, A as createDispatchTenantMemberRequestStore, G as createWfpTenantApp };

package/dist/workflows.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./sync-defaults-errors-pnzkP88r.js");let t=require("@authhero/multi-tenancy");var n={retries:{limit:5,delay:`5 seconds`,backoff:`exponential`},timeout:`2 minutes`},r={retries:{limit:8,delay:`10 seconds`,backoff:`exponential`},timeout:`1 minute`};function i(e){return e instanceof Error?e.message:String(e)}async function a(a,o,s){let c=(0,t.createOperationRecorder)(a.stores),l=a.shouldProvision??(e=>e.deployment_type===`wfp`),u=e=>a.stepConfig?.[e]??(e===`verify`?r:n),d=o.operation_id,f=o.tenant_id,p=await s.do(`mark-running`,u(`mark-running`),async()=>{let e=await a.tenants.get(f);if(!e||!l(e))return await c.appendEvent(d,{step:`mark-running`,outcome:`skipped`,detail:{reason:e?`tenant is not WFP-provisioned`:`tenant row missing (rolled back?)`}}),await c.markSucceeded(d),{skipped:!0,scriptName:``,databaseName:``};let t=a.steps.validate(),n=a.steps.names(f);return await c.markRunning(d,`mark-running`),await c.appendEvent(d,{step:`mark-running`,outcome:`succeeded`}),{skipped:!1,...n,...t}});if(p.skipped)return;let m={worker_script_name:p.scriptName,bundle_configuration:p.bundleConfiguration,worker_version:p.workerVersion,database_version:p.databaseVersion};try{let t=await s.do(`create-database`,u(`create-database`),async()=>{await c.setCurrentStep(d,`create-database`);let{id:e,created:t}=await a.steps.findOrCreateDatabase(p.databaseName);return await c.appendEvent(d,{step:`create-database`,outcome:`succeeded`,detail:{database_id:e,created:t}}),{databaseId:e,created:t}});if(m.d1_database_id=t.databaseId,await s.do(`apply-migrations`,u(`apply-migrations`),async()=>{await c.setCurrentStep(d,`apply-migrations`),await a.steps.applyMigrations(t.databaseId,t.created),await c.appendEvent(d,{step:`apply-migrations`,outcome:`succeeded`,detail:{database_version:p.databaseVersion}})}),await s.do(`upload-script`,u(`upload-script`),async()=>{await c.setCurrentStep(d,`upload-script`),await a.steps.uploadScript(p.scriptName,t.databaseId),await c.appendEvent(d,{step:`upload-script`,outcome:`succeeded`,detail:{worker_version:p.workerVersion}})}),await s.do(`upload-secrets`,u(`upload-secrets`),async()=>{await c.setCurrentStep(d,`upload-secrets`),await a.steps.uploadSecrets(p.scriptName,f),await c.appendEvent(d,{step:`upload-secrets`,outcome:`succeeded`})}),a.syncDefaults){let t=a.syncDefaults;await s.do(`seed-defaults`,u(`seed-defaults`),async()=>{await c.setCurrentStep(d,`seed-defaults`);let n=e.t(await t(f));if(n.length>0)throw Error(`sync-defaults seed reported ${n.length} error(s): ${n.join(`; `)}`);await c.appendEvent(d,{step:`seed-defaults`,outcome:`succeeded`})})}if(a.verify){let e=a.verify;await s.do(`verify`,u(`verify`),async()=>{await c.setCurrentStep(d,`verify`),await e(t.databaseId,f),await c.appendEvent(d,{step:`verify`,outcome:`succeeded`})})}await s.do(`mark-ready`,u(`mark-ready`),async()=>{await c.setCurrentStep(d,`mark-ready`),await a.tenants.update(f,{...m,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()}),await c.appendEvent(d,{step:`mark-ready`,outcome:`succeeded`}),await c.markSucceeded(d)})}catch(e){throw await s.do(`mark-failed`,u(`mark-failed`),async()=>{let t=i(e);try{await a.tenants.update(f,{...m,provisioning_state:`failed`,provisioning_error:t.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}catch(e){a.logger?.warn(`Failed to write provisioning_state="failed" for tenant ${f}:`,e)}await c.appendEvent(d,{step:`mark-failed`,outcome:`failed`,detail:{message:t}}),await c.markFailed(d,e)}),e}}var o={retries:{limit:3,delay:`5 seconds`,backoff:`exponential`},timeout:`2 minutes`};function s(e){return e instanceof Error?e.message:String(e)}async function c(e,n,r){let i=(0,t.createOperationRecorder)(e.stores),a=t=>e.stepConfig?.[t]??o,c=n.operation_id;try{await r.do(`mark-running`,a(`mark-running`),async()=>{await i.markRunning(c,`sync-defaults`)}),await r.do(`sync-defaults`,a(`sync-defaults`),async()=>{await i.setCurrentStep(c,`sync-defaults`);let n=await e.stores.tenantOperations.get(c);if(!n)throw Error(`Operation "${c}" not found`);let r=await(0,t.runSyncDefaultsStep)({operation:n,syncConfig:e.syncConfig,recorder:i});await i.appendEvent(c,{step:`sync-defaults`,outcome:`succeeded`,detail:r})}),await r.do(`mark-succeeded`,a(`mark-succeeded`),async()=>{await i.markSucceeded(c)})}catch(e){throw await r.do(`mark-failed`,a(`mark-failed`),async()=>{await i.appendEvent(c,{step:`mark-failed`,outcome:`failed`,detail:{message:s(e)}}),await i.markFailed(c,e)}),e}}var l=class extends Error{checks;constructor(e,t){super(e),this.name=`TenantProvisionVerificationError`,this.checks=t}};function u(e,t){for(let n of e)for(let e of n.results??[])if(!(!e||typeof e!=`object`)){for(let[n,r]of Object.entries(e))if(n===t){if(typeof r==`number`)return r;if(typeof r==`string`&&r!==``&&!isNaN(Number(r)))return Number(r)}}return 0}function d(t){let n=t.minKeys??1;return async(r,i)=>{let a=await t.client.execD1(r,`SELECT (SELECT COUNT(*) FROM keys) AS key_count, (SELECT COUNT(*) FROM tenants WHERE id = '${e.r(i)}') AS tenant_count;`),o=u(a,`key_count`),s=u(a,`tenant_count`),c=[];if(o<n&&c.push(`expected at least ${n} signing key(s) in "keys", found ${o}`),s<1&&c.push(`tenant row "${i}" missing from "tenants"`),c.length>0)throw new l(`Tenant D1 verification failed for "${i}": ${c.join(`; `)}`,{keyCount:o,tenantRowCount:s})}}function f(e){let t=e instanceof Error?e.message:String(e??``);return/already exists|already been created|duplicate/i.test(t)}function p(e){return{engine:`cloudflare-workflows`,async start(n){if(n.kind!==`provision`&&n.kind!==`sync-defaults`)throw Error(`The Cloudflare Workflows executor does not support "${n.kind}" operations yet (it runs provision and sync-defaults)`);if(!n.tenant_id)throw Error(`${n.kind} operations require a tenant_id`);let r=n.engine_instance_id??(0,t.buildEngineInstanceId)(n);try{await e.binding.create({id:r,params:{operation_id:n.id,tenant_id:n.tenant_id,kind:n.kind}})}catch(e){if(!f(e))throw e}}}}var m=`cloudflare-workflows`;async function h(e){let{stores:n,tenants:r,binding:i}=e,a=(0,t.createOperationRecorder)(n),o=e.minAgeMs??600*1e3,s=e.limit??100,c=new Date(Date.now()-o).toISOString(),{operations:l}=await n.tenantOperations.list({status:[`pending`,`running`],engine:m,updated_before:c,per_page:s}),u={scanned:l.length,markedFailed:0,markedSucceeded:0,stillRunning:0,instanceMissing:0,errors:0};for(let t of l)try{await f(t)}catch(n){u.errors++,e.logger?.warn(`Failed to reconcile tenant operation ${t.id}:`,n)}return u;async function d(e,t){await a.appendEvent(e.id,{step:e.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`failed`,reason:t}}),await a.markFailed(e.id,t),e.kind===`provision`&&e.tenant_id&&(await r.get(e.tenant_id))?.provisioning_state===`pending`&&await r.update(e.tenant_id,{provisioning_state:`failed`,provisioning_error:t.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}async function f(e){let o=await n.tenantOperations.get(e.id);if(!o||(0,t.isTerminalStatus)(o.status))return;let s=o.engine_instance_id??(0,t.buildEngineInstanceId)(o),c;try{c=await i.get(s)}catch{u.instanceMissing++,u.markedFailed++,await d(o,`engine instance "${s}" not found (expired past retention or never started)`);return}let l=await c.status();if(l.status===`errored`||l.status===`terminated`){let e=typeof l.error==`string`?l.error:l.error?.message??`engine reported ${l.status}`;u.markedFailed++,await d(o,e);return}if(l.status===`complete`){if(o.kind===`sync-defaults`){u.markedSucceeded++,await a.appendEvent(o.id,{step:o.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`succeeded`}}),await a.markSucceeded(o.id);return}(o.tenant_id?await r.get(o.tenant_id):null)?.provisioning_state===`ready`?(u.markedSucceeded++,await a.appendEvent(o.id,{step:o.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`succeeded`}}),await a.markSucceeded(o.id)):(u.markedFailed++,await d(o,`engine instance completed but the operation was never finalized and the tenant is not ready`));return}u.stillRunning++}}function g(e){let t=e.shouldProvision??(e=>e.deployment_type===`wfp`);return{async onProvision(n,r){let i=await e.tenants.get(n);i&&t(i)&&await e.enqueueOperation({kind:`provision`,tenant_id:n})},async onUpgrade(t,n){await e.inline.onUpgrade(t,n)},async onDeprovision(t){await e.inline.onDeprovision(t)}}}exports.TENANT_OPERATION_ENGINE=m,exports.TenantProvisionVerificationError=l,exports.createCloudflareWorkflowsExecutor=p,exports.createProvisionVerifier=d,exports.createWfpWorkflowProvisioningHook=g,exports.reconcileTenantOperations=h,exports.runProvisionOperation=a,exports.runSyncDefaultsOperation=c;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./sync-defaults-errors-pnzkP88r.js");let t=require("@authhero/multi-tenancy");var n={retries:{limit:5,delay:`5 seconds`,backoff:`exponential`},timeout:`2 minutes`},r={retries:{limit:8,delay:`10 seconds`,backoff:`exponential`},timeout:`1 minute`};function i(e){return e instanceof Error?e.message:String(e)}async function a(a,o,s){let c=(0,t.createOperationRecorder)(a.stores),l=a.shouldProvision??(e=>e.deployment_type===`wfp`),u=e=>a.stepConfig?.[e]??(e===`verify`?r:n),d=o.operation_id,f=o.tenant_id,p=await s.do(`mark-running`,u(`mark-running`),async()=>{let e=await a.tenants.get(f);if(!e||!l(e))return await c.appendEvent(d,{step:`mark-running`,outcome:`skipped`,detail:{reason:e?`tenant is not WFP-provisioned`:`tenant row missing (rolled back?)`}}),await c.markSucceeded(d),{skipped:!0,scriptName:``,databaseName:``};let t=a.steps.validate(),n=a.steps.names(f);return await c.markRunning(d,`mark-running`),await c.appendEvent(d,{step:`mark-running`,outcome:`succeeded`}),{skipped:!1,...n,...t}});if(p.skipped)return;let m={worker_script_name:p.scriptName,bundle_configuration:p.bundleConfiguration,worker_version:p.workerVersion,database_version:p.databaseVersion};try{let t=await s.do(`create-database`,u(`create-database`),async()=>{await c.setCurrentStep(d,`create-database`);let{id:e,created:t}=await a.steps.findOrCreateDatabase(p.databaseName);return await c.appendEvent(d,{step:`create-database`,outcome:`succeeded`,detail:{database_id:e,created:t}}),{databaseId:e,created:t}});if(m.d1_database_id=t.databaseId,await s.do(`apply-migrations`,u(`apply-migrations`),async()=>{await c.setCurrentStep(d,`apply-migrations`),await a.steps.applyMigrations(t.databaseId,t.created),await c.appendEvent(d,{step:`apply-migrations`,outcome:`succeeded`,detail:{database_version:p.databaseVersion}})}),await s.do(`upload-script`,u(`upload-script`),async()=>{await c.setCurrentStep(d,`upload-script`),await a.steps.uploadScript(p.scriptName,t.databaseId),await c.appendEvent(d,{step:`upload-script`,outcome:`succeeded`,detail:{worker_version:p.workerVersion}})}),await s.do(`upload-secrets`,u(`upload-secrets`),async()=>{await c.setCurrentStep(d,`upload-secrets`),await a.steps.uploadSecrets(p.scriptName,f),await c.appendEvent(d,{step:`upload-secrets`,outcome:`succeeded`})}),a.syncDefaults){let t=a.syncDefaults;await s.do(`seed-defaults`,u(`seed-defaults`),async()=>{await c.setCurrentStep(d,`seed-defaults`);let n=e.t(await t(f));if(n.length>0)throw Error(`sync-defaults seed reported ${n.length} error(s): ${n.join(`; `)}`);await c.appendEvent(d,{step:`seed-defaults`,outcome:`succeeded`})})}if(a.verify){let e=a.verify;await s.do(`verify`,u(`verify`),async()=>{await c.setCurrentStep(d,`verify`),await e(t.databaseId,f),await c.appendEvent(d,{step:`verify`,outcome:`succeeded`})})}await s.do(`mark-ready`,u(`mark-ready`),async()=>{await c.setCurrentStep(d,`mark-ready`),await a.tenants.update(f,{...m,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()}),await c.appendEvent(d,{step:`mark-ready`,outcome:`succeeded`}),await c.markSucceeded(d)})}catch(e){throw await s.do(`mark-failed`,u(`mark-failed`),async()=>{let t=i(e);try{await a.tenants.update(f,{...m,provisioning_state:`failed`,provisioning_error:t.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}catch(e){a.logger?.warn(`Failed to write provisioning_state="failed" for tenant ${f}:`,e)}await c.appendEvent(d,{step:`mark-failed`,outcome:`failed`,detail:{message:t}}),await c.markFailed(d,e)}),e}}var o={retries:{limit:3,delay:`5 seconds`,backoff:`exponential`},timeout:`2 minutes`};function s(e){return e instanceof Error?e.message:String(e)}async function c(e,n,r){let i=(0,t.createOperationRecorder)(e.stores),a=t=>e.stepConfig?.[t]??o,c=n.operation_id;try{await r.do(`mark-running`,a(`mark-running`),async()=>{await i.markRunning(c,`sync-defaults`)}),await r.do(`sync-defaults`,a(`sync-defaults`),async()=>{await i.setCurrentStep(c,`sync-defaults`);let n=await e.stores.tenantOperations.get(c);if(!n)throw Error(`Operation "${c}" not found`);let r=await(0,t.runSyncDefaultsStep)({operation:n,syncConfig:e.syncConfig,recorder:i});await i.appendEvent(c,{step:`sync-defaults`,outcome:`succeeded`,detail:r})}),await r.do(`mark-succeeded`,a(`mark-succeeded`),async()=>{await i.markSucceeded(c)})}catch(e){throw await r.do(`mark-failed`,a(`mark-failed`),async()=>{await i.appendEvent(c,{step:`mark-failed`,outcome:`failed`,detail:{message:s(e)}}),await i.markFailed(c,e)}),e}}var l={retries:{limit:3,delay:`5 seconds`,backoff:`exponential`},timeout:`2 minutes`},u={retries:{limit:0,delay:`5 seconds`},timeout:`5 minutes`};function d(e){return e instanceof Error?e.message:String(e)}async function f(e,n,r){let i=(0,t.createOperationRecorder)(e.stores),a=t=>e.stepConfig?.[t]??(t===`detach`?u:l),o=n.operation_id;try{await r.do(`mark-running`,a(`mark-running`),async()=>{await i.markRunning(o,`detach`)}),await r.do(`detach`,a(`detach`),async()=>{await i.setCurrentStep(o,`detach`);let n=await e.stores.tenantOperations.get(o);if(!n)throw Error(`Operation "${o}" not found`);let r=await(0,t.runDetachStep)({operation:n,detachTenant:e.detachTenant,recorder:i});await i.appendEvent(o,{step:`detach`,outcome:`succeeded`,detail:r})}),await r.do(`mark-succeeded`,a(`mark-succeeded`),async()=>{await i.markSucceeded(o)})}catch(e){throw await r.do(`mark-failed`,a(`mark-failed`),async()=>{await i.appendEvent(o,{step:`mark-failed`,outcome:`failed`,detail:{message:d(e)}}),await i.markFailed(o,e)}),e}}var p=class extends Error{checks;constructor(e,t){super(e),this.name=`TenantProvisionVerificationError`,this.checks=t}};function m(e,t){for(let n of e)for(let e of n.results??[])if(!(!e||typeof e!=`object`)){for(let[n,r]of Object.entries(e))if(n===t){if(typeof r==`number`)return r;if(typeof r==`string`&&r!==``&&!isNaN(Number(r)))return Number(r)}}return 0}function h(t){let n=t.minKeys??1;return async(r,i)=>{let a=await t.client.execD1(r,`SELECT (SELECT COUNT(*) FROM keys) AS key_count, (SELECT COUNT(*) FROM tenants WHERE id = '${e.r(i)}') AS tenant_count;`),o=m(a,`key_count`),s=m(a,`tenant_count`),c=[];if(o<n&&c.push(`expected at least ${n} signing key(s) in "keys", found ${o}`),s<1&&c.push(`tenant row "${i}" missing from "tenants"`),c.length>0)throw new p(`Tenant D1 verification failed for "${i}": ${c.join(`; `)}`,{keyCount:o,tenantRowCount:s})}}function g(e){let t=e instanceof Error?e.message:String(e??``);return/already exists|already been created|duplicate/i.test(t)}function _(e){return{engine:`cloudflare-workflows`,async start(n){if(n.kind!==`provision`&&n.kind!==`sync-defaults`&&n.kind!==`detach`)throw Error(`The Cloudflare Workflows executor does not support "${n.kind}" operations yet (it runs provision, sync-defaults and detach)`);if(!n.tenant_id)throw Error(`${n.kind} operations require a tenant_id`);let r=n.engine_instance_id??(0,t.buildEngineInstanceId)(n);try{await e.binding.create({id:r,params:{operation_id:n.id,tenant_id:n.tenant_id,kind:n.kind}})}catch(e){if(!g(e))throw e}}}}var v=`cloudflare-workflows`;async function y(e){let{stores:n,tenants:r,binding:i}=e,a=(0,t.createOperationRecorder)(n),o=e.minAgeMs??600*1e3,s=e.limit??100,c=new Date(Date.now()-o).toISOString(),{operations:l}=await n.tenantOperations.list({status:[`pending`,`running`],engine:v,updated_before:c,per_page:s}),u={scanned:l.length,markedFailed:0,markedSucceeded:0,stillRunning:0,instanceMissing:0,errors:0};for(let t of l)try{await f(t)}catch(n){u.errors++,e.logger?.warn(`Failed to reconcile tenant operation ${t.id}:`,n)}return u;async function d(e,t){await a.appendEvent(e.id,{step:e.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`failed`,reason:t}}),await a.markFailed(e.id,t),e.kind===`provision`&&e.tenant_id&&(await r.get(e.tenant_id))?.provisioning_state===`pending`&&await r.update(e.tenant_id,{provisioning_state:`failed`,provisioning_error:t.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}async function f(e){let o=await n.tenantOperations.get(e.id);if(!o||(0,t.isTerminalStatus)(o.status))return;let s=o.engine_instance_id??(0,t.buildEngineInstanceId)(o),c;try{c=await i.get(s)}catch{u.instanceMissing++,u.markedFailed++,await d(o,`engine instance "${s}" not found (expired past retention or never started)`);return}let l=await c.status();if(l.status===`errored`||l.status===`terminated`){let e=typeof l.error==`string`?l.error:l.error?.message??`engine reported ${l.status}`;u.markedFailed++,await d(o,e);return}if(l.status===`complete`){if(o.kind===`sync-defaults`||o.kind===`detach`){u.markedSucceeded++,await a.appendEvent(o.id,{step:o.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`succeeded`}}),await a.markSucceeded(o.id);return}(o.tenant_id?await r.get(o.tenant_id):null)?.provisioning_state===`ready`?(u.markedSucceeded++,await a.appendEvent(o.id,{step:o.current_step??`reconcile`,outcome:`reconciled`,detail:{resolution:`succeeded`}}),await a.markSucceeded(o.id)):(u.markedFailed++,await d(o,`engine instance completed but the operation was never finalized and the tenant is not ready`));return}u.stillRunning++}}function b(e){let t=e.shouldProvision??(e=>e.deployment_type===`wfp`);return{async onProvision(n,r){let i=await e.tenants.get(n);i&&t(i)&&await e.enqueueOperation({kind:`provision`,tenant_id:n})},async onUpgrade(t,n){await e.inline.onUpgrade(t,n)},async onDeprovision(t){await e.inline.onDeprovision(t)}}}exports.TENANT_OPERATION_ENGINE=v,exports.TenantProvisionVerificationError=p,exports.createCloudflareWorkflowsExecutor=_,exports.createProvisionVerifier=h,exports.createWfpWorkflowProvisioningHook=b,exports.reconcileTenantOperations=y,exports.runDetachOperation=f,exports.runProvisionOperation=a,exports.runSyncDefaultsOperation=c;

package/dist/workflows.d.ts

@@ -1,5 +1,5 @@
 import { TenantsDataAdapter, TenantOperation } from '@authhero/adapter-interfaces';
-import { TenantOperationStores, StepConfig, StepRunner, SyncConfigFn, TenantOperationExecutor } from '@authhero/multi-tenancy';
+import { TenantOperationStores, StepConfig, StepRunner, SyncConfigFn, DetachConfigFn, TenantOperationExecutor } from '@authhero/multi-tenancy';
 
 interface CfApiClientOptions {
     accountId: string;
@@ -134,7 +134,7 @@ interface TenantOperationWorkflowParams {
     operation_id: string;
     tenant_id: string;
     /** Widened beyond these in later phases (upgrade, backup, …). */
-    kind: "provision" | "sync-defaults";
+    kind: "provision" | "sync-defaults" | "detach";
 }
 /**
  * Instance status as reported by the engine. The exact value set has
@@ -247,6 +247,36 @@ interface SyncDefaultsOperationDeps {
  */
 declare function runSyncDefaultsOperation(deps: SyncDefaultsOperationDeps, params: TenantOperationWorkflowParams, step: StepRunner): Promise<void>;
 
+type DetachStepName = "mark-running" | "detach" | "mark-succeeded" | "mark-failed";
+interface DetachOperationDeps {
+    /** Control-plane operation log stores. */
+    stores: TenantOperationStores;
+    /**
+     * How the detach reaches the tenant's database, for example
+     * `createDispatchDetach(...)`.
+     */
+    detachTenant: DetachConfigFn;
+    /**
+     * Per-step overrides of the retry/timeout defaults. The `detach` step has no
+     * automatic retries unless a host sets them.
+     */
+    stepConfig?: Partial<Record<DetachStepName, StepConfig>>;
+}
+/**
+ * Durable `detach` operation: a synced tenant leaves its parent, as a Workflows
+ * instance that writes to the control-plane operation log at every step
+ * boundary (the same shape as {@link runSyncDefaultsOperation}, and the same
+ * step logic as the inline executor). The operation's `input` (`dry_run`,
+ * `clean`) is read from its row, so nothing but ids crosses the Workflows
+ * boundary.
+ *
+ * A dry run records what would change in the operation's `result` and writes
+ * nothing. Any failure runs `mark-failed` (event + failed row) and rethrows
+ * so the instance ends `errored`; if even that dies, the reconciler copies the
+ * engine's terminal state into the row.
+ */
+declare function runDetachOperation(deps: DetachOperationDeps, params: TenantOperationWorkflowParams, step: StepRunner): Promise<void>;
+
 interface ProvisionVerifierOptions {
     client: CloudflareApiClient;
     /** Minimum number of signing keys the tenant D1 must hold. Default 1. */
@@ -415,5 +445,5 @@ interface WfpWorkflowProvisioningHookOptions {
  */
 declare function createWfpWorkflowProvisioningHook(options: WfpWorkflowProvisioningHookOptions): WfpTenantProvisioningHook;
 
-export { TENANT_OPERATION_ENGINE, TenantProvisionVerificationError, createCloudflareWorkflowsExecutor, createProvisionVerifier, createWfpWorkflowProvisioningHook, reconcileTenantOperations, runProvisionOperation, runSyncDefaultsOperation };
-export type { CloudflareWorkflowsExecutorOptions, ProvisionOperationDeps, ProvisionStepName, ProvisionVerifierOptions, ReconcileTenantOperationsOptions, ReconcileTenantOperationsResult, SyncDefaultsOperationDeps, SyncDefaultsStepName, TenantOperationWorkflowParams, WfpWorkflowProvisioningHookOptions, WorkflowInstanceHandle, WorkflowInstanceStatus, WorkflowsBinding };
+export { TENANT_OPERATION_ENGINE, TenantProvisionVerificationError, createCloudflareWorkflowsExecutor, createProvisionVerifier, createWfpWorkflowProvisioningHook, reconcileTenantOperations, runDetachOperation, runProvisionOperation, runSyncDefaultsOperation };
+export type { CloudflareWorkflowsExecutorOptions, DetachOperationDeps, DetachStepName, ProvisionOperationDeps, ProvisionStepName, ProvisionVerifierOptions, ReconcileTenantOperationsOptions, ReconcileTenantOperationsResult, SyncDefaultsOperationDeps, SyncDefaultsStepName, TenantOperationWorkflowParams, WfpWorkflowProvisioningHookOptions, WorkflowInstanceHandle, WorkflowInstanceStatus, WorkflowsBinding };