@astrale-os/sdk 0.6.0-beta.39 → 0.6.0-beta.40

package/dist/application/workflow/authoring.d.ts

@@ -1,5 +1,5 @@
 export { defineWorkflow } from './define.js';
 export type { InlineWorkflowContext, WorkflowContext } from './context.js';
-export type { DurableCallable, DurableExecution, DurableStep, DurableStepAuthority, DurableStepDeclaration, DurableStepId, DurableStepRetry, DurableWorkflowContext, SignalOutcome, } from './durable.js';
+export type { DurableCallable, DurableExecution, DurableParallelOutputs, DurableParallelStep, DurableParallelSteps, DurableStep, DurableStepAuthority, DurableStepDeclaration, DurableStepId, DurableStepRetry, DurableWorkflowContext, SignalOutcome, } from './durable.js';
 export type { Workflow, WorkflowAddress, WorkflowDefinition, WorkflowOptions } from './workflow.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';

package/dist/application/workflow/durable.d.ts

@@ -110,7 +110,31 @@ export interface DurableStep<DomainValue extends Domain = Domain, Definitions ex
      * from the Kernel's receipt instead of writing again.
      */
     mutate<Input, Output>(step: DurableStepId, mutation: Mutation<DomainValue, Input, Output>, input: Input): Promise<Output>;
+    /**
+     * Run the Steps `declare` declares together, in one round trip to the engine, the one way to await
+     * several Steps at once. Each keeps its id, retry budget, timeout and keys. Once every Step has
+     * settled, resolves with their outputs in declaration order, or throws the failure of the first
+     * failed Step in that order, as that Step alone would throw it; the other Steps' effects stand.
+     * An empty list resolves with `[]`.
+     */
+    parallel<const Steps extends readonly [] | readonly DurableParallelStep<unknown>[]>(declare: (steps: DurableParallelSteps<DomainValue, Definitions>) => Steps): Promise<DurableParallelOutputs<Steps>>;
+}
+declare const PARALLEL_STEP: unique symbol;
+/** A Step `step.parallel` starts with its siblings. It runs nothing on its own and is never awaited. */
+export interface DurableParallelStep<out Output> {
+    readonly [PARALLEL_STEP]: Output;
 }
+/** The Steps one `step.parallel` declares, with the arguments of `step.run`, `query` and `mutate`. */
+export interface DurableParallelSteps<DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>> {
+    run<Output>(step: DurableStepId, execute: (authority: DurableStepAuthority<DomainValue, Definitions>) => Output | Promise<Output>): DurableParallelStep<Output>;
+    query<Output>(step: DurableStepId, query: QueryDefinition<DomainValue, void, Output>): DurableParallelStep<Output>;
+    query<Input, Output>(step: DurableStepId, query: QueryDefinition<DomainValue, Input, Output>, input: Input): DurableParallelStep<Output>;
+    mutate<Input, Output>(step: DurableStepId, mutation: Mutation<DomainValue, Input, Output>, input: Input): DurableParallelStep<Output>;
+}
+/** The outputs of parallel Steps, in their declaration order. */
+export type DurableParallelOutputs<Steps extends readonly DurableParallelStep<unknown>[]> = {
+    -readonly [Index in keyof Steps]: Steps[Index] extends DurableParallelStep<infer Output> ? Output : never;
+};
 type DurableSelfOf<Callable> = Callable extends ResolvedMethod<unknown, unknown, false> ? {
     readonly self: NodeId;
 } : {

package/dist/application/workflow/index.d.ts

@@ -1,6 +1,6 @@
 export { defineWorkflow, isWorkflow } from './define.js';
 export type { InlineWorkflowContext, WorkflowContext } from './context.js';
-export type { DurableCallable, DurableExecution, DurableStep, DurableStepAuthority, DurableStepDeclaration, DurableStepId, DurableStepRetry, DurableWorkflowContext, SignalOutcome, } from './durable.js';
+export type { DurableCallable, DurableExecution, DurableParallelOutputs, DurableParallelStep, DurableParallelSteps, DurableStep, DurableStepAuthority, DurableStepDeclaration, DurableStepId, DurableStepRetry, DurableWorkflowContext, SignalOutcome, } from './durable.js';
 export type { CallableAtWorkflowAddress, Workflow, WorkflowAddress, WorkflowCallable, WorkflowDefinition, WorkflowOptions, } from './workflow.js';
 export * as step from './step/index.js';
 export * as runner from './runner/index.js';

package/dist/execution/index.d.ts

@@ -3,5 +3,5 @@ export type { ExecutionContext, ServedDomain, ServeInput } from './serve.js';
 export { DEFAULT_MEMORY_CACHE_ENTRIES, memoryCache, type DeploymentCache, type MemoryCacheOptions, } from './cache/index.js';
 export { createIdentity, maximumExchangeTtl, type ExchangeOptions, type Identity, type IdentityInput, } from './identity/index.js';
 export type { DurableEngine, DurableServing, DurableServingProvider } from './workflows/index.js';
-export { DURABLE_ENGINE_EXPORTS } from './workflows/options.js';
+export { DURABLE_ENGINE_EXPORTS, isDurableEngine } from './workflows/options.js';
 export { isCanonicalDurableRequest } from './workflows/route.js';

package/dist/execution/index.js

@@ -1,5 +1,5 @@
 export { serve } from './serve.js';
 export { DEFAULT_MEMORY_CACHE_ENTRIES, memoryCache, } from './cache/index.js';
 export { createIdentity, maximumExchangeTtl, } from './identity/index.js';
-export { DURABLE_ENGINE_EXPORTS } from './workflows/options.js';
+export { DURABLE_ENGINE_EXPORTS, isDurableEngine } from './workflows/options.js';
 export { isCanonicalDurableRequest } from './workflows/route.js';

package/dist/execution/workflows/engine.d.ts

@@ -22,6 +22,15 @@ export interface DurableEngine {
     }) => Error;
     /** The rejection of `orTimeout` once its duration elapses first. */
     readonly TimeoutError: abstract new (...input: never[]) => Error;
+    /**
+     * The engine's own combinators, the one way to await several journaled operations together: the
+     * engine then follows them as one operation, and a replay settles them as the first run did.
+     */
+    readonly RestatePromise: EngineCombinators;
+}
+export interface EngineCombinators {
+    /** Settle once every one of `values`, promises of this engine's `run`, has settled. */
+    allSettled(values: readonly PromiseLike<unknown>[]): PromiseLike<readonly PromiseSettledResult<unknown>[]>;
 }
 export interface EngineWorkflowDefinition {
     readonly name: string;

package/dist/execution/workflows/index.d.ts

@@ -1,4 +1,4 @@
-export type { DurableEngine, EnginePromise, EngineRetryPolicy, EngineRunOptions, EngineSharedContext, EngineWorkflowContext, EngineWorkflowDefinition, } from './engine.js';
-export { DURABLE_ENGINE_EXPORTS, durableServing, type AdmittedDurableServing, type DurableServing, type DurableServingProvider, } from './options.js';
+export type { DurableEngine, EnginePromise, EngineRetryPolicy, EngineCombinators, EngineRunOptions, EngineSharedContext, EngineWorkflowContext, EngineWorkflowDefinition, } from './engine.js';
+export { DURABLE_ENGINE_EXPORTS, durableServing, isDurableEngine, type AdmittedDurableServing, type DurableServing, type DurableServingProvider, } from './options.js';
 export { createDurableReceiver, type DurableReceiver } from './receiver.js';
 export { isDurableRequest, isCanonicalDurableRequest } from './route.js';

package/dist/execution/workflows/index.js

@@ -1,3 +1,3 @@
-export { DURABLE_ENGINE_EXPORTS, durableServing, } from './options.js';
+export { DURABLE_ENGINE_EXPORTS, durableServing, isDurableEngine, } from './options.js';
 export { createDurableReceiver } from './receiver.js';
 export { isDurableRequest, isCanonicalDurableRequest } from './route.js';

package/dist/execution/workflows/options.d.ts

@@ -42,7 +42,12 @@ export interface StepServing {
  * The members of the Restate SDK Fetch entrypoint the durable receiver uses, which a platform's
  * engine module must export.
  */
-export declare const DURABLE_ENGINE_EXPORTS: readonly ["createEndpointHandler", "workflow", "TerminalError", "CancelledError", "RetryableError", "TimeoutError"];
+export declare const DURABLE_ENGINE_EXPORTS: readonly ["createEndpointHandler", "workflow", "TerminalError", "CancelledError", "RetryableError", "TimeoutError", "RestatePromise"];
+/**
+ * Whether `module` exports the members of the Restate SDK Fetch entrypoint the durable receiver
+ * uses: each a function, but `RestatePromise`, the namespace of its combinators.
+ */
+export declare function isDurableEngine(module: unknown): boolean;
 /**
  * How long the engine lets an attempt run without progress before it aborts it, declared on every
  * Workflow service. Restate's own default is ten minutes, which a ten-minute Step would race: the

package/dist/execution/workflows/options.js

@@ -9,7 +9,24 @@ export const DURABLE_ENGINE_EXPORTS = Object.freeze([
     'CancelledError',
     'RetryableError',
     'TimeoutError',
+    'RestatePromise',
 ]);
+/**
+ * Whether `module` exports the members of the Restate SDK Fetch entrypoint the durable receiver
+ * uses: each a function, but `RestatePromise`, the namespace of its combinators.
+ */
+export function isDurableEngine(module) {
+    if (module === null || typeof module !== 'object')
+        return false;
+    return DURABLE_ENGINE_EXPORTS.every((member) => {
+        const value = Reflect.get(module, member);
+        if (member !== 'RestatePromise')
+            return typeof value === 'function';
+        return (typeof value === 'object' &&
+            value !== null &&
+            typeof Reflect.get(value, 'allSettled') === 'function');
+    });
+}
 const HOUR_MS = 60 * 60_000;
 const DAY_MS = 24 * HOUR_MS;
 const DEFAULT_ATTEMPTS = 20;
@@ -40,9 +57,7 @@ export function durableServing(input) {
         invalid('Durable serving options are invalid.');
     }
     const engine = input.engine;
-    if (engine === null ||
-        typeof engine !== 'object' ||
-        DURABLE_ENGINE_EXPORTS.some((member) => typeof engine[member] !== 'function')) {
+    if (!isDurableEngine(engine)) {
         invalid('Durable serving requires the Restate SDK Fetch entrypoint of this platform.');
     }
     const fetch = input.fetch ?? globalThis.fetch.bind(globalThis);
@@ -57,6 +72,9 @@ export function durableServing(input) {
             CancelledError: engine.CancelledError,
             RetryableError: engine.RetryableError,
             TimeoutError: engine.TimeoutError,
+            RestatePromise: Object.freeze({
+                allSettled: engine.RestatePromise.allSettled.bind(engine.RestatePromise),
+            }),
         }),
         fetch,
         retentionMs: bounded(input.retentionMs, 7 * DAY_MS, HOUR_MS, 365 * DAY_MS, 'retentionMs'),

package/dist/execution/workflows/run.js

@@ -72,14 +72,40 @@ function durableContext(input, context, envelope) {
     const execution = envelope.execution;
     const signal = context.request().attemptCompletedSignal;
     const steps = new Set();
+    let running;
+    /**
+     * Starts one durable operation, a Step or a wait, once the previous one has settled. The engine
+     * follows one awaited operation at a time: operations awaited together through `Promise` combinators
+     * make it lose track of the run, which then pauses.
+     */
+    const sequenced = (operation, start) => {
+        if (running !== undefined) {
+            return Promise.reject(new TypeError(`Workflow ${operation} started while ${running} runs: durable Steps and waits run one after another.`));
+        }
+        running = operation;
+        let started;
+        try {
+            started = start();
+        }
+        catch (cause) {
+            running = undefined;
+            return Promise.reject(cause);
+        }
+        return started.finally(() => {
+            running = undefined;
+        });
+    };
     /**
      * One journaled unit of work holding the capabilities of an Action as the Domain alone. Its
      * Mutations, durable calls and Integration calls share one key sequence derived from its name.
      * With a `retry` budget, the engine retries a failed attempt within it, after its backoff or the
      * delay the failure prescribes, and the Step throws `StepExhausted` once it is spent; without
      * one, a failed attempt fails the run's attempt, which the engine retries until it pauses.
+     *
+     * The engine promise is returned unawaited: awaiting it is what tells the engine the run waits on
+     * it, so parallel Steps hand theirs to the engine's own combinator instead.
      */
-    const journal = (id, name, timeoutMs, retry, execute) => Promise.resolve(context.run(name, async () => {
+    const journaled = (id, name, timeoutMs, retry, execute) => context.run(name, async () => {
         const expiry = new AbortController();
         const timer = setTimeout(() => expiry.abort(new Error(`Workflow Step ${id} exceeded its ${timeoutMs} ms timeout.`)), timeoutMs);
         let step;
@@ -110,7 +136,9 @@ function durableContext(input, context, envelope) {
             clearTimeout(timer);
             step?.close();
         }
-    }, retry)).catch((cause) => {
+    }, retry);
+    /** One Step, awaited alone; its failure reaches the Workflow as `replayedFailure` reads it. */
+    const journal = (id, name, timeoutMs, retry, execute) => Promise.resolve(journaled(id, name, timeoutMs, retry, execute)).catch((cause) => {
         throw replayedFailure(engine, cause, definition, id) ?? cause;
     });
     const step = (declared, execute) => {
@@ -125,7 +153,63 @@ function durableContext(input, context, envelope) {
         }
         steps.add(accepted.id);
         const { held } = accepted;
-        return journal(accepted.id, `step:${accepted.id}`, held.timeoutMs, held.retry, execute);
+        return sequenced(`Step ${accepted.id}`, () => journal(accepted.id, `step:${accepted.id}`, held.timeoutMs, held.retry, execute));
+    };
+    /**
+     * The Steps `declare` declares, started together and awaited through the engine's combinator as
+     * one operation. Once all have settled, their outputs in declaration order, or the failure of the
+     * first failed one in that order, as that Step alone fails.
+     */
+    const parallel = (declare) => {
+        const declared = new Map();
+        const declaration = (id, execute) => {
+            const accepted = stepDeclaration(id, serving.step);
+            const token = Object.freeze({});
+            declared.set(token, { ...accepted, execute });
+            return token;
+        };
+        let group;
+        try {
+            if (typeof declare !== 'function') {
+                throw new TypeError('step.parallel takes a function declaring its Steps.');
+            }
+            const returned = declare(Object.freeze({
+                run: (id, execute) => declaration(id, execute),
+                query: (id, query, value) => declaration(id, (authority) => authority.query(query, value)),
+                mutate: (id, mutation, value) => declaration(id, (authority) => authority.mutate(mutation, value)),
+            }));
+            if (!Array.isArray(returned) ||
+                returned.length !== declared.size ||
+                new Set(returned).size !== returned.length ||
+                returned.some((entry) => !declared.has(entry))) {
+                throw new TypeError('step.parallel takes exactly the Steps its function declares, each once, as an array.');
+            }
+            group = returned.map((entry) => declared.get(entry));
+            const ids = new Set();
+            for (const { id } of group) {
+                if (steps.has(id) || ids.has(id)) {
+                    throw new TypeError(`Workflow Step ${id} occurs more than once.`);
+                }
+                ids.add(id);
+            }
+        }
+        catch (cause) {
+            return Promise.reject(cause);
+        }
+        if (group.length === 0)
+            return Promise.resolve([]);
+        for (const { id } of group)
+            steps.add(id);
+        return sequenced(`parallel Steps ${group.map(({ id }) => id).join(', ')}`, async () => {
+            const started = group.map(({ id, held, execute }) => journaled(id, `step:${id}`, held.timeoutMs, held.retry, execute));
+            const settled = await engine.RestatePromise.allSettled(started);
+            const failed = settled.findIndex(({ status }) => status === 'rejected');
+            if (failed === -1) {
+                return settled.map((result) => result.value);
+            }
+            const cause = settled[failed].reason;
+            throw replayedFailure(engine, cause, definition, group[failed].id) ?? cause;
+        });
     };
     return Object.freeze({
         domain,
@@ -136,26 +220,28 @@ function durableContext(input, context, envelope) {
             run: step,
             query: (id, query, value) => step(id, (authority) => authority.query(query, value)),
             mutate: (id, mutation, value) => step(id, (authority) => authority.mutate(mutation, value)),
+            parallel,
         }),
         async sleep(durationMs) {
             if (!Number.isSafeInteger(durationMs) || durationMs < 0 || durationMs > MAXIMUM_SLEEP_MS) {
                 throw new TypeError(`Durable sleep must be an integer between 0 and ${MAXIMUM_SLEEP_MS} ms.`);
             }
-            await context.sleep(durationMs);
+            await sequenced('sleep', () => Promise.resolve(context.sleep(durationMs)));
         },
         async awaitSignal(name, options) {
             if (typeof name !== 'string' || name.length === 0 || name.length > MAXIMUM_SIGNAL_NAME) {
                 throw new TypeError('Durable signal name must have 1 to 128 characters.');
             }
-            if (options === undefined)
-                return (await context.promise(name).get());
+            if (options === undefined) {
+                return (await sequenced(`wait for signal ${name}`, () => Promise.resolve(context.promise(name).get())));
+            }
             const timeoutMs = options?.timeoutMs;
             if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 0 || timeoutMs > MAXIMUM_SLEEP_MS) {
                 throw new TypeError(`Durable signal timeout must be an integer between 0 and ${MAXIMUM_SLEEP_MS} ms.`);
             }
             // The engine journals the race between the signal and the timer: a replay settles it alike.
             try {
-                const value = await context.promise(name).get().orTimeout(timeoutMs);
+                const value = await sequenced(`wait for signal ${name}`, () => Promise.resolve(context.promise(name).get().orTimeout(timeoutMs)));
                 return Object.freeze({ kind: 'signal', value });
             }
             catch (cause) {
@@ -167,7 +253,7 @@ function durableContext(input, context, envelope) {
         cancelled: (error) => error instanceof engine.CancelledError,
         exhausted: (error) => error instanceof StepExhausted,
         retryAfter: (delayMs, cause) => new StepRetryAfter(delayMs, cause),
-        async awaitExecution(target) {
+        awaitExecution: (target) => sequenced(`wait for Execution ${target.id}`, async () => {
             for (let poll = 1;; poll++) {
                 // A poll is no Step of the author's: it has no budget, so an outage pauses the run instead.
                 const name = `await:${target.id}:${poll}`;
@@ -189,7 +275,7 @@ function durableContext(input, context, envelope) {
                     return polled.outcome;
                 await context.sleep(Math.min(AWAIT_MAXIMUM_PAUSE_MS, 1_000 * 2 ** Math.min(poll, 16)));
             }
-        },
+        }),
         ...(execution.receiver === undefined ? {} : { self: execution.receiver }),
     });
 }

package/dist/testing/durable/engine.js

@@ -59,6 +59,8 @@ class JournalMismatch extends Error {
         this.name = 'JournalMismatch';
     }
 }
+/** The promises the test engine's `run` returned: the only ones its combinator accepts. */
+const RUNS = new WeakSet();
 const ENGINE = Object.freeze({
     createEndpointHandler: () => () => Promise.reject(new Error('A test engine serves no HTTP.')),
     workflow: (definition) => definition,
@@ -66,6 +68,17 @@ const ENGINE = Object.freeze({
     CancelledError,
     RetryableError,
     TimeoutError,
+    RestatePromise: Object.freeze({
+        allSettled(values) {
+            // As the engine refuses a promise it did not create: only its own runs combine.
+            values.forEach((value, index) => {
+                if (!RUNS.has(value)) {
+                    throw new TypeError(`Promise index ${index} used inside the combinator is not a run.`);
+                }
+            });
+            return Promise.allSettled(values);
+        },
+    }),
 });
 /** Create an in-memory workflow engine for tests. */
 export function createTestEngine(options = {}) {
@@ -299,7 +312,11 @@ class Attempt {
         this.run = run;
         this.mode = mode;
         this.context = Object.freeze({
-            run: (name, action, options) => this.journalRun(name, action, options),
+            run: (name, action, options) => {
+                const run = this.journalRun(name, action, options);
+                RUNS.add(run);
+                return run;
+            },
             sleep: (durationMs) => this.sleep(durationMs),
             promise: (name) => ({ get: () => this.promise(name) }),
             request: () => ({ attemptCompletedSignal: this.controller.signal }),
@@ -396,6 +413,9 @@ class Attempt {
         return (async () => {
             try {
                 const value = await action();
+                // A Step that completes once its attempt ended, as a parallel sibling may, is lost with it.
+                if (this.done)
+                    return this.block();
                 if (this.run.interruptions.delete(name)) {
                     // A crash after the effect: the run is attempted again, and the Step with it.
                     this.end({ kind: 'failed', error: new Interruption(name.replace(/^step:/u, '')) });
@@ -406,6 +426,8 @@ class Attempt {
                 return value;
             }
             catch (cause) {
+                if (this.done)
+                    return this.block();
                 if (cause instanceof TerminalError) {
                     entry.settled = true;
                     entry.error = cause;

package/dist/tooling/linter/implementations/source/shared.d.ts

@@ -38,6 +38,11 @@ export declare function hasForbiddenGlobalCall(file: SourceFile): Array<{
 }>;
 /** The global a call reaches, as `name(…)` with no import or local binding, or `globalThis.name(…)`. */
 export declare function globalCallName(file: SourceFile, node: ts.CallExpression): string | undefined;
+/**
+ * The member path an expression reads from a global: `Date.now` when no import or local binding
+ * names `Date`, the same through `globalThis.Date.now`.
+ */
+export declare function globalPath(file: SourceFile, input: ts.Expression): readonly string[] | undefined;
 /**
  * Resolve the path of `input` from the first parameter of `run`, or of a durable Step callback in
  * it, through one immutable local alias, without following arbitrary helpers.

package/dist/tooling/linter/implementations/source/shared.js

@@ -223,18 +223,26 @@ export function hasForbiddenGlobalCall(file) {
 }
 /** The global a call reaches, as `name(…)` with no import or local binding, or `globalThis.name(…)`. */
 export function globalCallName(file, node) {
-    const expression = unwrap(node.expression);
-    if (ts.isIdentifier(expression)) {
-        const name = expression.text;
-        return importedSymbol(file, expression) || isLocallyBound(expression, name) ? undefined : name;
-    }
+    const path = globalPath(file, node.expression);
+    return path?.length === 1 ? path[0] : undefined;
+}
+/**
+ * The member path an expression reads from a global: `Date.now` when no import or local binding
+ * names `Date`, the same through `globalThis.Date.now`.
+ */
+export function globalPath(file, input) {
+    const expression = unwrap(input);
     const chain = propertyChain(expression);
-    if (chain?.length !== 2 || chain[0] !== 'globalThis')
+    if (!chain)
         return undefined;
     let root = expression;
     while (ts.isPropertyAccessExpression(root))
         root = unwrap(root.expression);
-    return ts.isIdentifier(root) && isLocallyBound(root, root.text) ? undefined : chain[1];
+    if (!ts.isIdentifier(root) || isLocallyBound(root, root.text))
+        return undefined;
+    if (chain[0] === 'globalThis')
+        return chain.length > 1 ? chain.slice(1) : undefined;
+    return importedSymbol(file, root) ? undefined : chain;
 }
 /**
  * Resolve the path of `input` from the first parameter of `run`, or of a durable Step callback in

package/dist/tooling/linter/implementations/source/workflows.js

@@ -1,6 +1,6 @@
 import ts from 'typescript';
 import { expressionType, propertyChain, unwrap, visit, visitOwnBody, } from '../../adapters/typescript/index.js';
-import { ambiguity, calls, contextPath, globalCallName, production, propertyExpression, staticId, violation, } from './shared.js';
+import { ambiguity, calls, contextPath, globalCallName, globalPath, production, propertyExpression, staticId, violation, } from './shared.js';
 // `query` and `mutate` are the durable Step sugar over `run`; each is one Step too.
 const STEP_METHODS = new Set(['run', 'query', 'mutate']);
 // Members only a durable Workflow context has: using one proves the Workflow durable.
@@ -15,6 +15,14 @@ const DURABLE_CONTEXT_MEMBERS = new Set([
 const AUTHORITIES = new Set(['caller', 'self']);
 // Raw Kernel graph reads a Step's `kernel` offers beside `mutate`.
 const KERNEL_READS = new Set(['query', 'get', 'getOrThrow', 'neighbors']);
+// Global reads a replay answers anew: the clock and randomness.
+const REPLAY_VALUES = new Set([
+    'Date.now',
+    'Math.random',
+    'crypto.randomUUID',
+    'crypto.getRandomValues',
+    'performance.now',
+]);
 // Array methods that run their callback once per element.
 const ITERATING_METHODS = new Set([
     'every',
@@ -191,14 +199,31 @@ export const workflowRules = [
             return evidence;
         },
     },
+    {
+        id: 'FNC-REPLAY-VALUES',
+        ruleRevision: 'ddadc9e08be8faa36c38fd47d82d6c7815f68ffcac8806af958b13df3872b995',
+        evaluate(project) {
+            const evidence = [];
+            for (const workflow of durableWorkflows(project, evidence)) {
+                for (const { node, name } of replayValues(workflow.file, workflow.run)) {
+                    evidence.push(violation(workflow.file, node, `Durable Workflow reads ${name} outside its steps; a replay reads another value and can take another path. Read it in a step.`));
+                }
+            }
+            return evidence;
+        },
+    },
 ];
+/** The `step.run` callbacks of every Workflow its source proves durable. */
+function durableSteps(project, evidence) {
+    return durableWorkflows(project, evidence).flatMap(({ steps }) => steps);
+}
 /**
- * The `step.run` callbacks of every Workflow its source proves durable: it uses a member only the
+ * Every Workflow its source proves durable, with its `step.run` callbacks: it uses a member only the
  * durable context has, `step.query` or `step.mutate`, or a Step callback that receives
- * capabilities. An inline Workflow never retries a step and is not inspected.
+ * capabilities. An inline Workflow never replays nor retries a step and is not inspected.
  */
-function durableSteps(project, evidence) {
-    const steps = [];
+function durableWorkflows(project, evidence) {
+    const workflows = [];
     for (const file of production(project, 'functions')) {
         const helpers = localFunctions(file.source);
         for (const definition of workflowDefinitions(file)) {
@@ -232,10 +257,55 @@ function durableSteps(project, evidence) {
                 runs.push({ file, call: node, label: id ?? 'with a dynamic id', callback });
             });
             if (durable)
-                steps.push(...runs);
+                workflows.push({ file, run, steps: runs });
         }
     }
-    return steps;
+    return workflows;
+}
+/**
+ * Reads of the clock and randomness in the code a replay runs again: the run's own body, and the
+ * functions it invokes there at once, immediately invoked or as an iterating Array callback. Step
+ * callbacks and every other nested function run at a time the source does not prove, and are
+ * skipped.
+ */
+function replayValues(file, run) {
+    const found = [];
+    const walk = (node) => {
+        if (ts.isFunctionLike(node) && !invokedAtOnce(node))
+            return;
+        const name = replayValue(file, node);
+        if (name)
+            found.push({ node, name });
+        node.forEachChild(walk);
+    };
+    if (run.body)
+        walk(run.body);
+    return found;
+}
+/** The clock or random value `node` reads from a global, as the rule names it. */
+function replayValue(file, node) {
+    if (ts.isNewExpression(node)) {
+        const path = globalPath(file, node.expression);
+        return path?.join('.') === 'Date' && (node.arguments?.length ?? 0) === 0
+            ? 'new Date()'
+            : undefined;
+    }
+    if (!ts.isCallExpression(node))
+        return undefined;
+    const name = globalPath(file, node.expression)?.join('.');
+    // `Date` called as a function answers the current time, whatever it receives.
+    if (name === 'Date')
+        return 'Date()';
+    return name !== undefined && REPLAY_VALUES.has(name) ? `${name}()` : undefined;
+}
+/** A function the code around it runs at once: immediately invoked, or an iterating Array callback. */
+function invokedAtOnce(fn) {
+    if (!ts.isArrowFunction(fn) && !ts.isFunctionExpression(fn))
+        return false;
+    let site = fn;
+    while (ts.isParenthesizedExpression(site.parent))
+        site = site.parent;
+    return ((ts.isCallExpression(site.parent) && site.parent.expression === site) || iteratingCallback(fn));
 }
 /** Only a durable Step takes a declaration, `{ id, retry, timeoutMs }`, in place of its id. */
 function declaredStep(argument) {