AbstractProtectedtenantThe tenant this host serves, recovered from its OWN idFromName identity —
id.name is the bare tenantId. It is pattern-validated and
fail-closed: a name carrying no valid tenant cannot scope a store.
DO alarm: poll, then re-arm regardless (availability — a failed poll must not stop polling).
Protected AbstractbuildBuild the tenant-bound wiring from env + the asserted tenant. Memoized.
Run one poll cycle across this tenant's poll-capable providers, rehydrating each provider's subscriptions from D1 first (the eviction-survivable path). PER-PROVIDER isolation: a provider whose poll throws is logged and skipped, the rest still run; PER-DELIVERY isolation: a failing/tampered delivery is logged and skipped, the batch continues. Public so a host or test can drive it directly.
The provider host DO base. Subclass it, supply
build()(the tenant-bound subscription store + thread topology + provider list from env), and bind the subclass under a wrangler namespace addressedidFromName(tenantId).Routes:
POST /armboots and arms the alarm;POST /pollruns one poll cycle directly for deterministic health checks that do not depend on the alarm timer.alarm()polls and then re-arms.