Read-only preflight for retry. Never throws on Temporal being
unreachable — it degrades to run: "unknown", because a recovery the
operator may urgently need shouldn't be blocked by an unrelated outage.
Every organization of a customer, with whether its RouteFusion entity can be
onboarded now. programActive is surfaced so the page can warn when the
customer has no active RouteFusion program (which makes every org
ineligible).
Starts the onboarding workflow for each requested org, one at a time so a
failure on one doesn't abort the rest. Each org's result is reported
independently. Starting the workflow reports "onboarding started"; the
terminal KYB status (VERIFIED/REJECTED) lands later via the RouteFusion
entity webhook. idempotentStartWorkflow (keyed on the org id) makes a
re-run after partial failure safe.
TWO AUTHORITIES, deliberately split. The SERVER decides eligibility —
an org runs only when it classifies eligible, or when a manual override
supplies its missing incorporation date, and never when it is already
onboarded. The CALLER decides scope — organizationIds names which of
those the operator actually selected.
organizationIds is required rather than optional. It was previously
absent entirely, so the panel's checkboxes, select-all, range-select, and
"Onboard N organizations" button were decorative: selecting one org of nine
started nine live RouteFusion workflows, and the operator only discovered it
afterwards. Making the parameter mandatory means no caller can silently fall
back to "everything" — omitting it is a compile error, not a fan-out.
The orgs the operator selected. Intersected with the server-derived runnable set: an id here that isn't runnable is skipped (it can't confer eligibility), and a runnable org absent from here is not started.
Optionaloverrides?: Record<string, string>orgId → incorporation date (ISO-8601) to persist before onboarding.
Re-drive a stalled onboarding run: terminate whatever is live at the org's workflow id, then start a fresh run with the same args. Every activity is stamped and idempotent, so a re-run against a fully-stamped org performs no RouteFusion mutations — it replays straight through to the steps that never completed.
Terminate, not cancel: cancellation is cooperative, and a run wedged on a replay/non-determinism error isn't executing workflow code, so it has nothing to observe a cancel with.
Backfills RouteFusion business entities for the organizations of a RouteFusion customer that missed the automatic verification trigger (or need a retry). Onboarding mints the RF entity exactly once per org and is idempotent, so it runs through the shared
onboardRouteFusionOrganizationWorkflow(org-keyed) — the same code path the AiPrise verification webhook drives — rather than calling RouteFusion directly (RF creds stay worker-only).Admin-only — the operator backfill page in
admin-dashboardis the sole consumer, so it lives here rather than in the shared entity domain package.