@pithy-sh/cloudflare 0.2.3 → 0.3.1

package/dist/secrets/secretsStoreManager.d.ts

@@ -19,6 +19,8 @@ export declare const CfSecretEntry: z.ZodObject<{
     modified: z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>, z.ZodDate>;
 }, z.core.$strip>;
 export type CfSecretEntry = z.output<typeof CfSecretEntry>;
+/** What {@link CloudflareSecretsStoreManager.createSecretIfAbsent} did — see it for each value. */
+export type CreateSecretOutcome = "created" | "present" | "unconfirmed";
 /** Config for the Secrets Store manager: the shared client config plus the store it targets. */
 export interface SecretsStoreManagerConfig extends CloudflareManagerConfig {
     /** The CF Secrets Store id (the REST API addresses stores by id). */
@@ -48,6 +50,23 @@ export declare class CloudflareSecretsStoreManager extends CloudflareManager {
      * Scopes are re-sent so an entry converges on the same shape whichever branch wrote it.
      */
     putSecret(name: string, value: string): Promise<void>;
+    /**
+     * Create a secret only if no entry of that name is there, and say what happened — never "somebody else did"
+     * when this call cannot know that.
+     *
+     * - `created` — this call's create landed, and no older entry of the name exists beside it.
+     * - `present` — an entry of the name was there before this call, or appeared beside this one's and is older;
+     *   in the second case this call's own entry is deleted, so exactly one entry of the name remains.
+     * - `unconfirmed` — the create threw, and an entry of the name is there now. It may be this call's own, landed
+     *   server-side before the response was lost, or another run's. Nothing can tell which (F1 of #643's review), so
+     *   the answer says so rather than guess, and a caller must not make correctness depend on who created it.
+     *
+     * **Never an overwrite, even in a race (#643)**, and **never reliant on the store refusing a duplicate name**:
+     * Cloudflare does not document that it does. So after a create lands, the entries of that name are listed, and
+     * if another is older this one is the loser and removes itself. The oldest wins, deterministically, whichever
+     * run looks. A failure with no entry there afterwards — an outage, a refused token — is thrown as it came.
+     */
+    createSecretIfAbsent(name: string, value: string): Promise<CreateSecretOutcome>;
     /** Delete a secret by name. Resolves the id via `listSecrets`, then issues DELETE by id. */
     deleteSecret(name: string): Promise<void>;
     /**
@@ -77,8 +96,14 @@ export declare class CloudflareSecretsStoreManager extends CloudflareManager {
         storeId: string;
         accountId: string;
     };
-    /** Create a single secret with the default scopes. */
+    /** Create a single secret with the default scopes, and return the id Cloudflare gave it when it says one. */
     private createSecret;
+    /**
+     * The entry of this name, or `undefined`. **A `deleted` entry is not one** (#643): Cloudflare lists a secret's
+     * lifecycle status as `pending`, `active` or `deleted` without saying what each means, and a deleted entry is
+     * the one reading that cannot be "there". `pending` is taken as there, since creating over it would duplicate
+     * it. Of several entries of one name, the oldest, which is the one {@link createSecretIfAbsent} leaves standing.
+     */
     private findByName;
 }
 //# sourceMappingURL=secretsStoreManager.d.ts.map

package/dist/secrets/secretsStoreManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secretsStoreManager.d.ts","sourceRoot":"","sources":["../../src/secrets/secretsStoreManager.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAKpF;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;iBAQqE,CAAC;AAChG,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D,gGAAgG;AAChG,MAAM,WAAW,yBAA0B,SAAQ,uBAAuB;IACxE,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,qBAAa,6BAA8B,SAAQ,iBAAiB;IAClE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC,YAAY,MAAM,EAAE,yBAAyB,EAM5C;IAED,cAAc,IAAI,MAAM,CAEvB;IAED,iEAAiE;IAC3D,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;IAED;;;;;;;;OAQG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAe1D;IAED,4FAA4F;IACtF,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc9C;IAED;;;;;;;;;;;;;OAaG;IACG,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU1D;IAED;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAU5C;IAED,0EAA0E;IACpE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3C;IAED,kEAAkE;IAClE,mBAAmB,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAE5D;IAED,sDAAsD;YACxC,YAAY;YASZ,UAAU;CAIzB"}
+{"version":3,"file":"secretsStoreManager.d.ts","sourceRoot":"","sources":["../../src/secrets/secretsStoreManager.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAKpF;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;iBAQqE,CAAC;AAChG,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D,mGAAmG;AACnG,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAOxE,gGAAgG;AAChG,MAAM,WAAW,yBAA0B,SAAQ,uBAAuB;IACxE,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,qBAAa,6BAA8B,SAAQ,iBAAiB;IAClE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC,YAAY,MAAM,EAAE,yBAAyB,EAM5C;IAED,cAAc,IAAI,MAAM,CAEvB;IAED,iEAAiE;IAC3D,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;IAED;;;;;;;;OAQG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAe1D;IAED;;;;;;;;;;;;;;;OAeG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoBpF;IAED,4FAA4F;IACtF,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc9C;IAED;;;;;;;;;;;;;OAaG;IACG,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU1D;IAED;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAU5C;IAED,0EAA0E;IACpE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3C;IAED,kEAAkE;IAClE,mBAAmB,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAE5D;IAED,6GAA6G;YAC/F,YAAY;IAiB1B;;;;;OAKG;YACW,UAAU;CAIzB"}

package/dist/secrets/secretsStoreManager.js

@@ -24,6 +24,10 @@ const CfSecretEntry = z.object({
 	created: JsonDate.describe("When the secret was created (ISO string on the wire, Date in app)."),
 	modified: JsonDate.describe("When the secret was last modified (ISO string on the wire, Date in app).")
 }).describe("A single Cloudflare Secrets Store secret's metadata (never its plaintext value).");
+/** The oldest of some entries by creation time, the smaller id breaking a tie — one answer whoever asks. */
+function oldestEntry(entries) {
+	return [...entries].sort((a, b) => a.created.getTime() - b.created.getTime() || a.id.localeCompare(b.id))[0];
+}
 /**
 * Out-of-Worker access to the account-level Cloudflare Secrets Store over the REST API: provisioning
 * and audit from a CLI/CI context. Inside a Worker, secret values resolve via bindings — this manager
@@ -73,6 +77,39 @@ var CloudflareSecretsStoreManager = class extends CloudflareManager {
 			scopes: [...DEFAULT_SCOPES]
 		}));
 	}
+	/**
+	* Create a secret only if no entry of that name is there, and say what happened — never "somebody else did"
+	* when this call cannot know that.
+	*
+	* - `created` — this call's create landed, and no older entry of the name exists beside it.
+	* - `present` — an entry of the name was there before this call, or appeared beside this one's and is older;
+	*   in the second case this call's own entry is deleted, so exactly one entry of the name remains.
+	* - `unconfirmed` — the create threw, and an entry of the name is there now. It may be this call's own, landed
+	*   server-side before the response was lost, or another run's. Nothing can tell which (F1 of #643's review), so
+	*   the answer says so rather than guess, and a caller must not make correctness depend on who created it.
+	*
+	* **Never an overwrite, even in a race (#643)**, and **never reliant on the store refusing a duplicate name**:
+	* Cloudflare does not document that it does. So after a create lands, the entries of that name are listed, and
+	* if another is older this one is the loser and removes itself. The oldest wins, deterministically, whichever
+	* run looks. A failure with no entry there afterwards — an outage, a refused token — is thrown as it came.
+	*/
+	async createSecretIfAbsent(name, value) {
+		if (await this.findByName(name)) return "present";
+		let ownId;
+		try {
+			ownId = await this.createSecret(name, value);
+		} catch (error) {
+			if (await this.findByName(name)) return "unconfirmed";
+			throw error;
+		}
+		const oldest = oldestEntry((await this.listSecrets()).filter((entry) => entry.name === name && entry.status !== "deleted"));
+		if (oldest === void 0 || ownId === void 0 || oldest.id === ownId) return "created";
+		await cloudflareRequest(`delete duplicate secret ${name}`, () => this.getClient().secretsStore.stores.secrets.delete(ownId, {
+			account_id: this.accountId,
+			store_id: this.storeId
+		}));
+		return "present";
+	}
 	/** Delete a secret by name. Resolves the id via `listSecrets`, then issues DELETE by id. */
 	async deleteSecret(name) {
 		const existing = await this.findByName(name);
@@ -130,19 +167,30 @@ var CloudflareSecretsStoreManager = class extends CloudflareManager {
 			accountId: this.accountId
 		};
 	}
-	/** Create a single secret with the default scopes. */
+	/** Create a single secret with the default scopes, and return the id Cloudflare gave it when it says one. */
 	async createSecret(name, value) {
-		await cloudflareRequest(`create secret ${name}`, () => this.getClient().secretsStore.stores.secrets.create(this.storeId, {
-			account_id: this.accountId,
-			body: [{
-				name,
-				value,
-				scopes: [...DEFAULT_SCOPES]
-			}]
-		}));
+		return cloudflareRequest(`create secret ${name}`, async () => {
+			const response = await this.getClient().secretsStore.stores.secrets.create(this.storeId, {
+				account_id: this.accountId,
+				body: [{
+					name,
+					value,
+					scopes: [...DEFAULT_SCOPES]
+				}]
+			});
+			const items = response?.result ?? response;
+			if (!Array.isArray(items)) return void 0;
+			for (const created of items) if (typeof created?.id === "string" && created.name === name) return created.id;
+		});
 	}
+	/**
+	* The entry of this name, or `undefined`. **A `deleted` entry is not one** (#643): Cloudflare lists a secret's
+	* lifecycle status as `pending`, `active` or `deleted` without saying what each means, and a deleted entry is
+	* the one reading that cannot be "there". `pending` is taken as there, since creating over it would duplicate
+	* it. Of several entries of one name, the oldest, which is the one {@link createSecretIfAbsent} leaves standing.
+	*/
 	async findByName(name) {
-		return (await this.listSecrets()).find((entry) => entry.name === name);
+		return oldestEntry((await this.listSecrets()).filter((entry) => entry.name === name && entry.status !== "deleted"));
 	}
 };
 //#endregion

package/dist/workers/workersManager.d.ts

@@ -109,8 +109,19 @@ export declare class CloudflareWorkersManager extends CloudflareManager {
     getWorkerVars(scriptName: string): Promise<Record<string, string> | null>;
     /** Edit a Worker's settings (observability, logpush, tags, …). */
     updateSettings(scriptName: string, settings: WorkerSettings): Promise<void>;
-    /** Delete a Worker script. */
-    deleteWorker(scriptName: string): Promise<void>;
+    /**
+     * Delete a Worker script.
+     *
+     * **Cloudflare refuses the delete while another Worker still binds the script** — as a service, a Durable
+     * Object namespace, or a dispatch outbound — unless it is forced. `force` sends that flag. It is the
+     * caller's to decide, because only the caller knows whether what binds the script is going too: a set of
+     * Workers that call each other can only be deleted forced, and one Worker another project still calls
+     * should not be. Forcing also removes what Cloudflare associates with the script, its Durable Objects
+     * included. wrangler's own `delete` forces only after a person has read the list of what will break.
+     */
+    deleteWorker(scriptName: string, options?: {
+        force?: boolean;
+    }): Promise<void>;
     /** List every version of a Worker script. */
     listVersions(scriptName: string): Promise<VersionListResponse[]>;
     /** Get one version of a Worker script. */

package/dist/workers/workersManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workersManager.d.ts","sourceRoot":"","sources":["../../src/workers/workersManager.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAClG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kDAAkD,CAAC;AAEnF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,8CAA8C,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AACvF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AAE7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAuBtD,uGAAuG;AACvG,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAEnE;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,oGAAoG;IACpG,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;CACd;AAKD;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,iBAAiB;IAC7D,+CAA+C;IACzC,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAQrC;IAED,oEAAoE;IAC9D,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAG1D;IAED;;;;OAIG;IACG,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU7D;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACG,YAAY,CAChB,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,QAAQ,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACtC,MAAM,GAAE,YAA0B,GACjC,OAAO,CAAC,MAAM,CAAC,CAsDjB;IAED;;;OAGG;IACG,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAQvG;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAmB9E;IAED,kEAAkE;IAC5D,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhF;IAED,8BAA8B;IACxB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIpD;IAED,6CAA6C;IACvC,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAUrE;IAED,0CAA0C;IACpC,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQnF;IAED,iEAAiE;IAC3D,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAS/D;IAED,6CAA6C;IACvC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAQjF;IAED,+DAA+D;IACzD,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAYjF;IAED,uCAAuC;IACjC,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ9E;IAED,4CAA4C;IACtC,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQxE;IAED,sCAAsC;IAChC,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAUnE;IAED;;;OAGG;IACG,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,mBAAmB,GAAG,iBAAiB,CAAC,CAMlD;IAED,qFAAqF;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAOjF;IAED,0CAA0C;IACpC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhE;IAED,oGAAoG;IAC9F,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOjE;IAED;;;;OAIG;IACG,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBvG;IAED;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAO/C;IAED,cAAc,IAAI,MAAM,CAEvB;IAED,mEAAmE;IAC7D,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;CACF"}
+{"version":3,"file":"workersManager.d.ts","sourceRoot":"","sources":["../../src/workers/workersManager.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAClG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kDAAkD,CAAC;AAEnF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,8CAA8C,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AACvF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AAE7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAuBtD,uGAAuG;AACvG,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAEnE;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,oGAAoG;IACpG,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;CACd;AAKD;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,iBAAiB;IAC7D,+CAA+C;IACzC,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAQrC;IAED,oEAAoE;IAC9D,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAG1D;IAED;;;;OAIG;IACG,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU7D;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACG,YAAY,CAChB,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,QAAQ,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACtC,MAAM,GAAE,YAA0B,GACjC,OAAO,CAAC,MAAM,CAAC,CAsDjB;IAED;;;OAGG;IACG,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAQvG;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAmB9E;IAED,kEAAkE;IAC5D,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhF;IAED;;;;;;;;;OASG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAQvF;IAED,6CAA6C;IACvC,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAUrE;IAED,0CAA0C;IACpC,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQnF;IAED,iEAAiE;IAC3D,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAS/D;IAED,6CAA6C;IACvC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAQjF;IAED,+DAA+D;IACzD,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAYjF;IAED,uCAAuC;IACjC,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ9E;IAED,4CAA4C;IACtC,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQxE;IAED,sCAAsC;IAChC,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAUnE;IAED;;;OAGG;IACG,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,mBAAmB,GAAG,iBAAiB,CAAC,CAMlD;IAED,qFAAqF;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAOjF;IAED,0CAA0C;IACpC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhE;IAED,oGAAoG;IAC9F,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOjE;IAED;;;;OAIG;IACG,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBvG;IAED;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAO/C;IAED,cAAc,IAAI,MAAM,CAEvB;IAED,mEAAmE;IAC7D,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;CACF"}

package/dist/workers/workersManager.js

@@ -186,9 +186,21 @@ var CloudflareWorkersManager = class extends CloudflareManager {
 			...settings
 		}));
 	}
-	/** Delete a Worker script. */
-	async deleteWorker(scriptName) {
-		await cloudflareRequest(`delete worker '${scriptName}'`, () => this.getClient().workers.scripts.delete(scriptName, { account_id: this.accountId }, requestOptions));
+	/**
+	* Delete a Worker script.
+	*
+	* **Cloudflare refuses the delete while another Worker still binds the script** — as a service, a Durable
+	* Object namespace, or a dispatch outbound — unless it is forced. `force` sends that flag. It is the
+	* caller's to decide, because only the caller knows whether what binds the script is going too: a set of
+	* Workers that call each other can only be deleted forced, and one Worker another project still calls
+	* should not be. Forcing also removes what Cloudflare associates with the script, its Durable Objects
+	* included. wrangler's own `delete` forces only after a person has read the list of what will break.
+	*/
+	async deleteWorker(scriptName, options = {}) {
+		await cloudflareRequest(`delete worker '${scriptName}'`, () => this.getClient().workers.scripts.delete(scriptName, {
+			account_id: this.accountId,
+			...options.force === true ? { force: true } : {}
+		}, requestOptions));
 	}
 	/** List every version of a Worker script. */
 	async listVersions(scriptName) {

package/dist/workflows/workflowsClient.d.ts

@@ -41,6 +41,12 @@ export declare const WorkflowInstance: z.ZodObject<{
     steps: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
 }, z.core.$strip>;
 export type WorkflowInstance = z.output<typeof WorkflowInstance>;
+/** One deployed Workflow definition — its name and the script that hosts it — from the account's list. */
+export declare const WorkflowDefinition: z.ZodObject<{
+    name: z.ZodString;
+    script_name: z.ZodString;
+}, z.core.$strip>;
+export type WorkflowDefinition = z.output<typeof WorkflowDefinition>;
 /**
  * A client over the Cloudflare Workflows API — the only sanctioned way to reach CF Workflows from
  * outside a Worker (CLAUDE.md: no hand-rolled CF `fetch` outside `@pithy-sh/cloudflare`). The
@@ -58,6 +64,17 @@ export declare class CloudflareWorkflowsClient extends CloudflareManager {
     getServiceType(): string;
     /** Prove reach by listing the account's Workflows; never throws. */
     validateServiceAccess(): Promise<boolean>;
+    /**
+     * Every Workflow definition on the account, validated at the wire boundary. What `pithy feature destroy` reads
+     * to find the Workflows a feature's scripts host, by exact script name (#643).
+     */
+    listWorkflows(): Promise<WorkflowDefinition[]>;
+    /**
+     * Delete a Workflow definition by name, resolving `false` when there was none (#643). Cloudflare's own
+     * reference says this deletes the Workflow and leaves the Worker script alone; whether deleting the script
+     * deletes its Workflows it does not say, so teardown deletes them explicitly rather than rely on either.
+     */
+    deleteWorkflow(workflowName: string): Promise<boolean>;
     /** Create (trigger) a Workflow instance and return its id. */
     createInstance(workflowName: string, params: unknown, instanceId?: string): Promise<string>;
     /** Fetch an instance's status. Returns `null` on a 404 (a just-created instance can briefly lag). */

package/dist/workflows/workflowsClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflowsClient.d.ts","sourceRoot":"","sources":["../../src/workflows/workflowsClient.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAGpF,gGAAgG;AAChG,MAAM,MAAM,OAAO,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEpD,MAAM,WAAW,+BAAgC,SAAQ,uBAAuB;IAC9E,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,eAAO,MAAM,sBAAsB;;;;;;;;;;;EAawD,CAAC;AAC5F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE7E,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;iBAqBuE,CAAC;AACrG,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAOjE;;;;;;;;;;GAUG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;;IAG9D,YAAY,MAAM,EAAE,+BAA+B,EAGlD;IAED,cAAc,IAAI,MAAM,CAEvB;IAED,oEAAoE;IAC9D,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;IAED,8DAA8D;IACxD,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYhG;IAED,qGAAqG;IAC/F,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAoBlG;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,eAAe,CACnB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,OAAO,EACf,OAAO,GAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAChF,OAAO,CAAC,OAAO,CAAC,CAmClB;CACF"}
+{"version":3,"file":"workflowsClient.d.ts","sourceRoot":"","sources":["../../src/workflows/workflowsClient.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAGpF,gGAAgG;AAChG,MAAM,MAAM,OAAO,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEpD,MAAM,WAAW,+BAAgC,SAAQ,uBAAuB;IAC9E,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,eAAO,MAAM,sBAAsB;;;;;;;;;;;EAawD,CAAC;AAC5F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE7E,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;iBAqBuE,CAAC;AACrG,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE,0GAA0G;AAC1G,eAAO,MAAM,kBAAkB;;;iBAKuF,CAAC;AACvH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAOrE;;;;;;;;;;GAUG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;;IAG9D,YAAY,MAAM,EAAE,+BAA+B,EAGlD;IAED,cAAc,IAAI,MAAM,CAEvB;IAED,oEAAoE;IAC9D,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;IAED;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAUnD;IAED;;;;OAIG;IACG,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU3D;IAED,8DAA8D;IACxD,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYhG;IAED,qGAAqG;IAC/F,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAoBlG;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,eAAe,CACnB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,OAAO,EACf,OAAO,GAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAChF,OAAO,CAAC,OAAO,CAAC,CAmClB;CACF"}

package/dist/workflows/workflowsClient.js

@@ -28,6 +28,11 @@ const WorkflowInstance = z.object({
 	]).optional().describe("The instance-level failure, present when `status` is `errored` or `terminated`."),
 	steps: z.array(z.unknown()).optional().describe("The instance's steps, each validated where it is read (`stepFailure`). Held as `unknown` here on purpose: the API has four step shapes, this client reads one field of one of them, and a shape nobody anticipated must not turn a failed Workflow into a parse error about the failure report.")
 }).describe("A Cloudflare Workflow instance's status, as returned by the instance-detail endpoint.");
+/** One deployed Workflow definition — its name and the script that hosts it — from the account's list. */
+const WorkflowDefinition = z.object({
+	name: z.string().describe("The Workflow's account-wide name, e.g. `acme-prod-email-send`."),
+	script_name: z.string().describe("The Worker script whose exported class runs the Workflow.")
+}).describe("A Workflow definition on the account, as far as teardown needs one: what it is called and who hosts it.");
 /** Terminal states a poll stops on. */
 const TERMINAL = /* @__PURE__ */ new Set([
 	"complete",
@@ -64,6 +69,37 @@ var CloudflareWorkflowsClient = class extends CloudflareManager {
 			return false;
 		}
 	}
+	/**
+	* Every Workflow definition on the account, validated at the wire boundary. What `pithy feature destroy` reads
+	* to find the Workflows a feature's scripts host, by exact script name (#643).
+	*/
+	async listWorkflows() {
+		return cloudflareRequest("list Workflows", async () => {
+			const out = [];
+			for await (const workflow of this.getClient().workflows.list({ account_id: this.accountId })) {
+				const parsed = WorkflowDefinition.safeParse(workflow);
+				if (!parsed.success) throw new CloudflareInvalidResponseError({ detail: "list Workflows: unexpected shape" });
+				out.push(parsed.data);
+			}
+			return out;
+		});
+	}
+	/**
+	* Delete a Workflow definition by name, resolving `false` when there was none (#643). Cloudflare's own
+	* reference says this deletes the Workflow and leaves the Worker script alone; whether deleting the script
+	* deletes its Workflows it does not say, so teardown deletes them explicitly rather than rely on either.
+	*/
+	async deleteWorkflow(workflowName) {
+		return cloudflareRequest(`delete Workflow ${workflowName}`, async () => {
+			try {
+				await this.getClient().workflows.delete(workflowName, { account_id: this.accountId });
+				return true;
+			} catch (error) {
+				if (isNotFoundError(error)) return false;
+				throw error;
+			}
+		});
+	}
 	/** Create (trigger) a Workflow instance and return its id. */
 	async createInstance(workflowName, params, instanceId) {
 		return cloudflareRequest(`create instance of ${workflowName}`, async () => {
@@ -155,4 +191,4 @@ function describeFailure(failure, error) {
 	return `${failure.step === void 0 ? "step" : `step '${failure.step}'`} raised${failure.code === void 0 ? "" : ` [${failure.code}]`} ${failure.raw} — instance error: ${instance}`;
 }
 //#endregion
-export { CloudflareWorkflowsClient, WorkflowInstance, WorkflowInstanceStatus };
+export { CloudflareWorkflowsClient, WorkflowDefinition, WorkflowInstance, WorkflowInstanceStatus };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/cloudflare",
-  "version": "0.2.3",
+  "version": "0.3.1",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "js-base64": "^3.9.2"
   },
   "peerDependencies": {
-    "@pithy-sh/core": "^0.6.1",
+    "@pithy-sh/core": "^0.7.4",
     "zod": "^4.4.0"
   },
   "devDependencies": {

package/src/secrets/secretsStoreManager.ts

@@ -26,6 +26,14 @@ export const CfSecretEntry = z
   .describe("A single Cloudflare Secrets Store secret's metadata (never its plaintext value).");
 export type CfSecretEntry = z.output<typeof CfSecretEntry>;
 
+/** What {@link CloudflareSecretsStoreManager.createSecretIfAbsent} did — see it for each value. */
+export type CreateSecretOutcome = "created" | "present" | "unconfirmed";
+
+/** The oldest of some entries by creation time, the smaller id breaking a tie — one answer whoever asks. */
+function oldestEntry(entries: readonly CfSecretEntry[]): CfSecretEntry | undefined {
+  return [...entries].sort((a, b) => a.created.getTime() - b.created.getTime() || a.id.localeCompare(b.id))[0];
+}
+
 /** Config for the Secrets Store manager: the shared client config plus the store it targets. */
 export interface SecretsStoreManagerConfig extends CloudflareManagerConfig {
   /** The CF Secrets Store id (the REST API addresses stores by id). */
@@ -91,6 +99,44 @@ export class CloudflareSecretsStoreManager extends CloudflareManager {
     );
   }
 
+  /**
+   * Create a secret only if no entry of that name is there, and say what happened — never "somebody else did"
+   * when this call cannot know that.
+   *
+   * - `created` — this call's create landed, and no older entry of the name exists beside it.
+   * - `present` — an entry of the name was there before this call, or appeared beside this one's and is older;
+   *   in the second case this call's own entry is deleted, so exactly one entry of the name remains.
+   * - `unconfirmed` — the create threw, and an entry of the name is there now. It may be this call's own, landed
+   *   server-side before the response was lost, or another run's. Nothing can tell which (F1 of #643's review), so
+   *   the answer says so rather than guess, and a caller must not make correctness depend on who created it.
+   *
+   * **Never an overwrite, even in a race (#643)**, and **never reliant on the store refusing a duplicate name**:
+   * Cloudflare does not document that it does. So after a create lands, the entries of that name are listed, and
+   * if another is older this one is the loser and removes itself. The oldest wins, deterministically, whichever
+   * run looks. A failure with no entry there afterwards — an outage, a refused token — is thrown as it came.
+   */
+  async createSecretIfAbsent(name: string, value: string): Promise<CreateSecretOutcome> {
+    if (await this.findByName(name)) return "present";
+    let ownId: string | undefined;
+    try {
+      ownId = await this.createSecret(name, value);
+    } catch (error) {
+      if (await this.findByName(name)) return "unconfirmed";
+      throw error;
+    }
+    const same = (await this.listSecrets()).filter((entry) => entry.name === name && entry.status !== "deleted");
+    const oldest = oldestEntry(same);
+    if (oldest === undefined || ownId === undefined || oldest.id === ownId) return "created";
+    // Another run's entry of the same name is older: it is the one that stands.
+    await cloudflareRequest(`delete duplicate secret ${name}`, () =>
+      this.getClient().secretsStore.stores.secrets.delete(ownId as string, {
+        account_id: this.accountId,
+        store_id: this.storeId,
+      }),
+    );
+    return "present";
+  }
+
   /** Delete a secret by name. Resolves the id via `listSecrets`, then issues DELETE by id. */
   async deleteSecret(name: string): Promise<void> {
     const existing = await this.findByName(name);
@@ -160,18 +206,32 @@ export class CloudflareSecretsStoreManager extends CloudflareManager {
     return { storeId: this.storeId, accountId: this.accountId };
   }
 
-  /** Create a single secret with the default scopes. */
-  private async createSecret(name: string, value: string): Promise<void> {
-    await cloudflareRequest(`create secret ${name}`, () =>
-      this.getClient().secretsStore.stores.secrets.create(this.storeId, {
+  /** Create a single secret with the default scopes, and return the id Cloudflare gave it when it says one. */
+  private async createSecret(name: string, value: string): Promise<string | undefined> {
+    return cloudflareRequest(`create secret ${name}`, async () => {
+      const response: unknown = await this.getClient().secretsStore.stores.secrets.create(this.storeId, {
         account_id: this.accountId,
         body: [{ name, value, scopes: [...DEFAULT_SCOPES] }],
-      }),
-    );
+      });
+      // The SDK hands back a page of what was created. Read defensively: an id is a convenience here, and a
+      // response without one leaves `createSecretIfAbsent` answering `created` as it would have before.
+      const items = (response as { result?: unknown })?.result ?? response;
+      if (!Array.isArray(items)) return undefined;
+      for (const created of items as { id?: unknown; name?: unknown }[]) {
+        if (typeof created?.id === "string" && created.name === name) return created.id;
+      }
+      return undefined;
+    });
   }
 
+  /**
+   * The entry of this name, or `undefined`. **A `deleted` entry is not one** (#643): Cloudflare lists a secret's
+   * lifecycle status as `pending`, `active` or `deleted` without saying what each means, and a deleted entry is
+   * the one reading that cannot be "there". `pending` is taken as there, since creating over it would duplicate
+   * it. Of several entries of one name, the oldest, which is the one {@link createSecretIfAbsent} leaves standing.
+   */
   private async findByName(name: string): Promise<CfSecretEntry | undefined> {
     const all = await this.listSecrets();
-    return all.find((entry) => entry.name === name);
+    return oldestEntry(all.filter((entry) => entry.name === name && entry.status !== "deleted"));
   }
 }

package/src/workers/workersManager.ts

@@ -259,10 +259,23 @@ export class CloudflareWorkersManager extends CloudflareManager {
     );
   }
 
-  /** Delete a Worker script. */
-  async deleteWorker(scriptName: string): Promise<void> {
+  /**
+   * Delete a Worker script.
+   *
+   * **Cloudflare refuses the delete while another Worker still binds the script** — as a service, a Durable
+   * Object namespace, or a dispatch outbound — unless it is forced. `force` sends that flag. It is the
+   * caller's to decide, because only the caller knows whether what binds the script is going too: a set of
+   * Workers that call each other can only be deleted forced, and one Worker another project still calls
+   * should not be. Forcing also removes what Cloudflare associates with the script, its Durable Objects
+   * included. wrangler's own `delete` forces only after a person has read the list of what will break.
+   */
+  async deleteWorker(scriptName: string, options: { force?: boolean } = {}): Promise<void> {
     await cloudflareRequest(`delete worker '${scriptName}'`, () =>
-      this.getClient().workers.scripts.delete(scriptName, { account_id: this.accountId }, requestOptions),
+      this.getClient().workers.scripts.delete(
+        scriptName,
+        { account_id: this.accountId, ...(options.force === true ? { force: true } : {}) },
+        requestOptions,
+      ),
     );
   }
 

package/src/workflows/workflowsClient.ts

@@ -55,6 +55,15 @@ export const WorkflowInstance = z
   .describe("A Cloudflare Workflow instance's status, as returned by the instance-detail endpoint.");
 export type WorkflowInstance = z.output<typeof WorkflowInstance>;
 
+/** One deployed Workflow definition — its name and the script that hosts it — from the account's list. */
+export const WorkflowDefinition = z
+  .object({
+    name: z.string().describe("The Workflow's account-wide name, e.g. `acme-prod-email-send`."),
+    script_name: z.string().describe("The Worker script whose exported class runs the Workflow."),
+  })
+  .describe("A Workflow definition on the account, as far as teardown needs one: what it is called and who hosts it.");
+export type WorkflowDefinition = z.output<typeof WorkflowDefinition>;
+
 /** Terminal states a poll stops on. */
 const TERMINAL: ReadonlySet<WorkflowInstanceStatus> = new Set(["complete", "errored", "terminated"]);
 
@@ -93,6 +102,39 @@ export class CloudflareWorkflowsClient extends CloudflareManager {
     }
   }
 
+  /**
+   * Every Workflow definition on the account, validated at the wire boundary. What `pithy feature destroy` reads
+   * to find the Workflows a feature's scripts host, by exact script name (#643).
+   */
+  async listWorkflows(): Promise<WorkflowDefinition[]> {
+    return cloudflareRequest("list Workflows", async () => {
+      const out: WorkflowDefinition[] = [];
+      for await (const workflow of this.getClient().workflows.list({ account_id: this.accountId })) {
+        const parsed = WorkflowDefinition.safeParse(workflow);
+        if (!parsed.success) throw new CloudflareInvalidResponseError({ detail: "list Workflows: unexpected shape" });
+        out.push(parsed.data);
+      }
+      return out;
+    });
+  }
+
+  /**
+   * Delete a Workflow definition by name, resolving `false` when there was none (#643). Cloudflare's own
+   * reference says this deletes the Workflow and leaves the Worker script alone; whether deleting the script
+   * deletes its Workflows it does not say, so teardown deletes them explicitly rather than rely on either.
+   */
+  async deleteWorkflow(workflowName: string): Promise<boolean> {
+    return cloudflareRequest(`delete Workflow ${workflowName}`, async () => {
+      try {
+        await this.getClient().workflows.delete(workflowName, { account_id: this.accountId });
+        return true;
+      } catch (error) {
+        if (isNotFoundError(error)) return false;
+        throw error;
+      }
+    });
+  }
+
   /** Create (trigger) a Workflow instance and return its id. */
   async createInstance(workflowName: string, params: unknown, instanceId?: string): Promise<string> {
     return cloudflareRequest(`create instance of ${workflowName}`, async () => {