@demlik/tea 0.12.0 → 0.14.0

package/dist/flow/index.d.ts

@@ -0,0 +1,1295 @@
+import { R as Runtime, C as CtxArg } from '../runtime-types-LWDoi943.js';
+import { C as Cmd, S as Sub, M as Machine, i as CmdValue, a as CmdOf, b as CmdDef } from '../core-CTzMJ82M.js';
+export { B as BatchWindow, b as BatchWindowConfig, c as BatchWindowExpired, d as BatchWindowKnob, a as BatchWindowSub, e as addItem, f as batchWindowExpired, g as createBatchWindow, i as initBatchWindow, o as onWindow, s as subsFor, h as subscribeBatchWindow } from '../index-4vZzljCD.js';
+export { a as FanOutConfig, b as FanOutDone, c as FanOutFailed, d as FanOutPorts, F as FanOutState, e as createFanOut, i as initFanOut, f as isComplete } from '../index-6A7dB8f6.js';
+export { E as EndedRun, M as MonitoredRunCmd, b as MonitoredRunConfig, c as MonitoredRunPorts, a as MonitoredRunState, d as MonitoredRunTimerMsg, R as RunFailure, S as StageResult, e as createMonitoredRun, l as liftRun } from '../index-NjrT3fL2.js';
+import { RetryState, AnyRetryPolicy, RetryPolicy } from '../retry-backoff/index.js';
+import { I as IdempotencyStore } from '../index-Bc40JWVl.js';
+import { a as DeadlineSub, T as TtlCache } from '../index-q0hXFeZ0.js';
+export { D as DeadlineExceeded, b as deadlineSub, s as subscribeDeadline } from '../index-q0hXFeZ0.js';
+import { C as CircuitConfig, c as RateLimitConfig, D as DeadlineConfig, d as ResilientPorts, F as FailMsg, S as SucceedMsg } from '../index-B5BZ-_cT.js';
+import { PaginatedWalkState, PaginatedWalkTimerMsg, FetchPageCmd, PageErrMsg, PageOkMsg } from '../paginate/index.js';
+import { Q as QueueItem } from '../index-DJWIER_3.js';
+export { E as EnqueueInput } from '../index-DJWIER_3.js';
+import { D as DeliveryId, E as EffectLedgerEvent } from '../durable-effects-B0-qGQDy.js';
+export { a as EffectConfirmed, b as EffectOwed, e as emptyLedger } from '../durable-effects-B0-qGQDy.js';
+export { D as Debounced, d as debounce } from '../index-DHSUmQTR.js';
+export { c as SnapshotSavedMsg, S as SnapshotWriteCmd } from '../index-DMCeMPMJ.js';
+import 'better-result';
+import 'zod';
+import '../types-DP3f5NIl.js';
+
+/**
+ * internal/flow/await-terminal — run a ONE-SHOT / decision-procedure machine to a
+ * terminal state and hand the caller a `Promise<State>` that resolves the moment
+ * the machine FIRST enters a terminal state.
+ *
+ * This is the ~10 lines both audit suitability probes hand-wired at their
+ * integration seam: a one-shot decision machine (a credibility check, an auth
+ * mint, a validation pass — run to a terminal state, then throw-or-proceed at the
+ * caller boundary) has no built-in "await the terminal", so each consumer re-wires
+ * a promise off `observe` that resolves when the state is terminal. This helper
+ * lifts that boilerplate into `@demlik/tea` once.
+ *
+ * It rides the EXISTING observation surface (`packages/tea/src/index.ts`) and adds
+ * NO new runtime capability:
+ *   - `runtime.getState()` (total on a booted `Runtime`) covers the
+ *     already-terminal-at-attach case — resolve synchronously rather than wait for
+ *     a transition that may never come.
+ *   - `runtime.observe((msg, state) => void): () => void` fires on EVERY transition
+ *     and returns an unsubscribe — the "first terminal transition" signal, detached
+ *     the instant it resolves (no leak, no busy-wait / polling loop).
+ *   - `runtime.stop()` is the teardown the fire-and-await `runToTerminal` owns.
+ *
+ * `isTerminal` is caller-supplied — tea has no built-in terminal-set concept and
+ * this helper does NOT invent one; the caller names their own terminal states.
+ *
+ * The optional `timeoutMs` is a plain caller-boundary timer (not an in-loop
+ * progress deadline — see `../deadline` / `../with-deadline` for that shape): it
+ * clears on resolve and REJECTS with the `instanceof`-checkable
+ * {@link TerminalTimeoutError} if the deadline elapses first, never silently
+ * resolving.
+ */
+
+/**
+ * Raised when `awaitTerminal` / `runToTerminal` is wired with a `timeoutMs` and
+ * the deadline elapses before any terminal state is reached. Follows the tea
+ * error dialect (`override readonly name`) and carries a `_tag` discriminant, so
+ * a caller can branch on it either by `instanceof` or on the tag — the timeout is
+ * a distinct, checkable rejection, never a silent resolve.
+ */
+declare class TerminalTimeoutError extends Error {
+    readonly timeoutMs: number;
+    readonly name = "TerminalTimeoutError";
+    readonly _tag: "TerminalTimeoutError";
+    constructor(timeoutMs: number);
+}
+/** Options shared by `awaitTerminal` and `runToTerminal`. */
+interface AwaitTerminalOptions {
+    /**
+     * Optional bounded deadline in milliseconds. When set, the returned promise
+     * REJECTS with {@link TerminalTimeoutError} if no terminal state is reached
+     * within the window; the timer is cleared on the resolve path so a resolved
+     * await never later rejects or leaves a dangling timer. Omit for an unbounded
+     * await (never rejects for time).
+     */
+    readonly timeoutMs?: number;
+}
+/**
+ * Attach to an ALREADY-RUNNING `Runtime<S, M, E>` and resolve with the terminal
+ * `S` on the first transition for which `isTerminal(state)` is true.
+ *
+ * If the runtime is ALREADY terminal at attach time (`isTerminal(getState())`),
+ * resolves immediately — it never hangs waiting for a transition that will not
+ * come. Otherwise it subscribes via `observe` and detaches that subscription the
+ * instant it resolves (or times out), so there is no observer leak and no
+ * further callbacks fire.
+ *
+ * @param runtime    a booted `Runtime` (from `await run(machine, opts).ready`).
+ * @param isTerminal caller-supplied terminal predicate over the machine's state.
+ * @param opts       optional bounded `timeoutMs` deadline (see {@link AwaitTerminalOptions}).
+ */
+declare function awaitTerminal<S, M extends {
+    type: string;
+}, E extends {
+    type: string;
+} = never>(runtime: Runtime<S, M, E>, isTerminal: (state: S) => boolean, opts?: AwaitTerminalOptions): Promise<S>;
+/**
+ * Fire-and-await convenience: `run()` the machine, dispatch the seed `msgs`, and
+ * resolve with the terminal state — then tear the runtime down (`runtime.stop()`)
+ * on BOTH the resolve and reject paths. Wraps {@link awaitTerminal}.
+ *
+ * The seed carries the machine's `ctx` (conditionally optional, exactly as
+ * `run`'s `ctx` — a pure machine omits it) and the `msgs` to dispatch once
+ * booted. A `timeoutMs` in `opts` bounds the await identically to `awaitTerminal`.
+ *
+ * @param machine    the machine to boot.
+ * @param seed       `{ ctx?, msgs }` — the boot context and the seed messages.
+ * @param isTerminal caller-supplied terminal predicate over the machine's state.
+ * @param opts       optional bounded `timeoutMs` deadline (see {@link AwaitTerminalOptions}).
+ */
+declare function runToTerminal<S, M extends {
+    type: string;
+}, C extends Cmd, U extends Sub, Ctx>(machine: Machine<S, M, C, U, Ctx>, seed: CtxArg<Ctx> & {
+    readonly msgs: readonly M[];
+}, isTerminal: (state: S) => boolean, opts?: AwaitTerminalOptions): Promise<S>;
+
+/**
+ * internal/flow/poller — "poll a source every N ms until a predicate holds, with
+ * backoff on failure" as a TEA knob: one config object + a few pre-wired hooks
+ * you spread into your machine.
+ *
+ * The recipe (which bricks it composes):
+ *
+ *   - `../deadline`        — the recurring tick is an ABSOLUTE-deadline Sub.
+ *                            Each successful tick computes the NEXT absolute
+ *                            fire time (`at + everyMs`) and the knob re-arms a
+ *                            deadline against it. Absolute (not relative) so a
+ *                            poller resumed after a DO eviction / page reload
+ *                            fires at the correct wall-clock moment, not
+ *                            `everyMs` after the reload (`../deadline`'s late-
+ *                            subscribe property).
+ *   - `../retry-backoff`   — a failed tick does NOT reschedule on the steady
+ *                            cadence; it backs off. The next attempt is armed
+ *                            `nextDelayMs(retry, policy)` from now, the retry
+ *                            counter advances, and `shouldRetry` decides whether
+ *                            the poller keeps trying or gives up. The bound may
+ *                            be a COUNT or a wall-clock OUTAGE DURATION — see
+ *                            `PollerConfig.retry`; `tickErr`'s `at` is the
+ *                            streak clock, so both flow through unchanged.
+ *   - `../idempotency`     — successive ticks against a flaky source can deliver
+ *                            the SAME observation twice (a retried fetch, a
+ *                            duplicate webhook the poll re-reads). `dedupeKey`
+ *                            lets the consumer key each tick result; a duplicate
+ *                            key is recorded but emits no fresh `onTick` follow-
+ *                            up Cmd, so the side effect runs once per distinct
+ *                            observation.
+ *
+ * Typical wiring (spread the knob's hooks into your machine):
+ *
+ *   const poll = createPoller<MyState, MyResult>({
+ *     everyMs: 5_000,
+ *     until: (s) => s.poll.lastResult?.status === "ready",
+ *     onTick: () => ({ type: "fetch_status" }),
+ *     retry: { ...defaultRetryPolicy, maxAttempts: 4 },
+ *   });
+ *
+ *   // Model slice:
+ *   init: (loaded) => [loaded ?? { poll: poll.init(), ... }, []],
+ *
+ *   // The deadline Sub fires `deadline_exceeded` on the cadence/backoff target;
+ *   // route it to `tick`, the ONLY place the `onTick` fetch is emitted:
+ *   deadline_exceeded: (s) => {
+ *     const [slice, cmds] = poll.tick(s.poll);
+ *     return [{ ...s, poll: slice }, cmds];
+ *   },
+ *
+ *   // update cells (thread `at` in from the firing Msg / the runtime clock):
+ *   poll_result: (s, m) => {
+ *     const untilHeld = config.until({ ...s, ...folded });
+ *     const [slice, cmds] = poll.tickResult(s.poll, m.result, m.at, untilHeld);
+ *     return [{ ...s, poll: slice }, cmds];
+ *   },
+ *   poll_error: (s, m) => {
+ *     const [slice, cmds] = poll.tickErr(s.poll, m.error, m.at);
+ *     return [{ ...s, poll: slice }, cmds];
+ *   },
+ *
+ *   // Subs — the knob owns the interval/backoff deadline:
+ *   subscriptions: (s) => poll.subs(s.poll),
+ *
+ * The cadence has exactly ONE source: the `everyMs` deadline Sub. `start`,
+ * `tickResult`, and `tickErr` only RE-ARM the deadline (they emit no cadence
+ * Cmd); the fetch fires solely from `tick`, which the consumer routes the
+ * deadline's `deadline_exceeded` Msg to. No verb performs an immediate
+ * "fire now" observation, so the poller never polls faster than `everyMs`.
+ *
+ * The two non-negotiables every knob preserves hold here:
+ *   - **Durable** — `tick`, `lastResult`, `retry`, and the next-fire target all
+ *     live in the Model slice, so a poller survives eviction and resumes its
+ *     cadence from the persisted target.
+ *   - **Replayable** — every transition is a pure verb returning new state; the
+ *     clock is never read inside a verb (the firing Msg carries `at`), and the
+ *     retry RNG is injected ONCE at `createPoller` and threaded internally (no
+ *     verb body names the global RNG). `replay` reconstructs a poll run exactly.
+ *
+ * NOT a substrate primitive: it depends only on sibling subpaths
+ * (`../deadline`, `../retry-backoff`, `../idempotency`) and the core `Cmd` /
+ * `Sub` types. Internal since #48 — not published on any subpath; reached from
+ * inside the package as `internal/flow/poller`. The L1 escape hatch is those
+ * three siblings threaded by hand.
+ */
+
+/**
+ * The poller knob's config — the single object you hand `createPoller`.
+ *
+ * `State` is the consumer's WHOLE Model (so `until` can read any field), `R` is
+ * the shape of one tick observation (`lastResult` carries it forward).
+ */
+interface PollerConfig<State, R> {
+    /**
+     * The steady cadence, in milliseconds, between successful ticks. The next
+     * tick is armed at the absolute target `at + everyMs` (computed from the
+     * `at` the prior tick's Msg carried), NOT `everyMs` from when the Sub
+     * happens to be reconciled — so the cadence does not drift across resumes.
+     */
+    readonly everyMs: number;
+    /**
+     * The stop predicate, read against the consumer's whole Model. When it
+     * returns `true`, the poller is DONE: `subs` returns `[]` (the timer
+     * disarms) and no further tick is scheduled. Pure — it must not read the
+     * clock or mutate; the substrate calls it inside `subscriptions(state)`.
+     */
+    readonly until: (state: State) => boolean;
+    /**
+     * The effect to run on each tick — the actual "go observe the source" Cmd
+     * (a fetch, a status read, a list call). The knob returns it from
+     * `tickResult` when the run continues; the consumer's `interpret` performs
+     * it and routes the observation back as the next tick-result Msg.
+     *
+     * Nullary by contract: a tick carries no per-call argument (the poller
+     * re-reads the same source every cadence). Capture any target in the Cmd
+     * literal the consumer's `onTick` returns.
+     */
+    readonly onTick: () => Cmd;
+    /**
+     * Backoff policy for FAILED ticks. Omit to use `defaultRetryPolicy`
+     * (full-jitter, 5 attempts). A success resets the retry counter, so the
+     * policy only governs consecutive failures.
+     *
+     * Any bound the `../retry-backoff` union admits: a count (`RetryPolicy`), a
+     * wall-clock outage budget (`DurationRetryPolicy`), or explicit
+     * `unbounded: true`. The duration bound needs no extra wiring here — every
+     * failure already arrives through `tickErr(state, error, at)` carrying the
+     * instant it was observed, so the streak clock is fed from the Msg's own
+     * data and the poller never reads a clock of its own (invariant 2).
+     */
+    readonly retry?: AnyRetryPolicy;
+    /**
+     * Optional dedupe key derived from a tick result. When provided, a result
+     * whose key was already `seen` records the observation but emits NO fresh
+     * `onTick` follow-up — the side effect runs once per distinct observation.
+     * Omit to treat every tick result as fresh (no dedupe). The dedupe store is
+     * bounded by `dedupeTtlMs` if set; otherwise it grows with distinct keys.
+     */
+    readonly dedupeKey?: (result: R) => string;
+    /**
+     * TTL for the dedupe store, in milliseconds. Only meaningful when
+     * `dedupeKey` is set. An observation older than `dedupeTtlMs` is forgotten,
+     * so a key seen long ago is treated as fresh again. Omit for an unbounded
+     * dedupe window (every distinct key remembered for the poller's lifetime).
+     */
+    readonly dedupeTtlMs?: number;
+}
+/**
+ * The bookkeeping every poller phase carries in common, split out so each arm of
+ * the `PollerState` discriminated union names only what it adds (`nextAtMs` on
+ * `polling`) — the same discipline the sibling `PaginatorState` uses.
+ *
+ * - `tick`       — count of ticks recorded so far (success or failure). Doubles
+ *                  as an observability cursor and a stable per-tick discriminant.
+ * - `lastResult` — the most recent successful observation, or `undefined`
+ *                  before the first success. `until` typically reads it (via the
+ *                  consumer's Model), but the knob never interprets it.
+ * - `retry`      — the `../retry-backoff` counter for consecutive failures.
+ *                  Reset to `initRetry()` on every success. Once a failure has
+ *                  been recorded it is a `TimedRetryState` (it carries the
+ *                  streak's `firstFailureAtMs`, minted from `tickErr`'s `at`);
+ *                  the field is typed at the `RetryState` supertype because a
+ *                  poller that has never failed has no streak, and a slice
+ *                  persisted before the origin existed rehydrates without one.
+ * - `dedupe`     — the `../idempotency` store backing `dedupeKey`. An empty,
+ *                  unbounded store when `dedupeKey` is unset (never written).
+ */
+interface PollerCore<R> {
+    readonly tick: number;
+    readonly lastResult?: R;
+    readonly retry: RetryState;
+    readonly dedupe: IdempotencyStore<true>;
+}
+/**
+ * The Model field the poller knob owns — its visible slice (the knob principle:
+ * managed state lives in the Model, never a closure, so it is durable and
+ * replayable). A discriminated union on `phase` so the armed-timer target lives
+ * ONLY where it is meaningful and impossible combinations are unrepresentable
+ * (pattern 11), the sibling `PaginatorState` idiom:
+ *
+ * - `polling`  — ticks are scheduled. Carries `nextAtMs`, the ABSOLUTE target
+ *                the interval/backoff timer is armed against (persisted so a
+ *                resumed poller re-arms the same moment), or `null` before the
+ *                first `start` primes it.
+ * - `done`     — `until` held; the poll is finished. Carries NO `nextAtMs` — a
+ *                finished poll can never sit on an armed target.
+ * - `gave_up`  — backoff exhausted `maxAttempts`. Carries NO `nextAtMs` either.
+ *
+ * Because only `polling` carries `nextAtMs`, `subs` guards on `phase` alone to
+ * decide whether a timer is desired — a `done`/`gave_up` state with a live target
+ * (the old flat record's hazard) simply cannot be built.
+ */
+type PollerState<R> = (PollerCore<R> & {
+    readonly phase: "polling";
+    readonly nextAtMs: number | null;
+}) | (PollerCore<R> & {
+    readonly phase: "done";
+}) | (PollerCore<R> & {
+    readonly phase: "gave_up";
+});
+/**
+ * The three arms, named — so a verb can DECLARE the phases it can actually
+ * reach instead of the whole union.
+ *
+ * A verb whose return type is the full `PollerState<R>` tells a caller nothing
+ * about where the poller went, and a caller that needs to know (an exhaustive
+ * `switch`, say) has to re-derive it by reading the verb's body. Every one of these narrowings is already true of the
+ * implementation — `start` only ever builds a `polling` arm, `tickResult` never
+ * builds `gave_up`, `tickErr` never builds `done` — so naming them costs
+ * nothing at runtime and moves a fact out of the source and into the signature.
+ */
+type PollerPolling<R> = Extract<PollerState<R>, {
+    phase: "polling";
+}>;
+type PollerDone<R> = Extract<PollerState<R>, {
+    phase: "done";
+}>;
+type PollerGaveUp<R> = Extract<PollerState<R>, {
+    phase: "gave_up";
+}>;
+/**
+ * The poller Sub type — a `../deadline` Sub under a fixed id family. One id per
+ * knob instance keeps the reconcile pass from churning the timer: the same id
+ * across transitions means "same armed deadline", even as `nextAtMs` advances.
+ */
+type PollerSub = DeadlineSub;
+/**
+ * The knob handle returned by `createPoller`. Spread its hooks into your
+ * machine: `init()` seeds the slice, `start(...)` arms the first tick,
+ * `tickResult` / `tickErr` are the two update verbs, and `subs(...)` returns the
+ * timer Sub while the poller is live.
+ *
+ * Pure-ops + subs module: there is no `handlers(ports)` cell. The poller's I/O
+ * is the consumer's own `onTick` Cmd run by the consumer's `interpret` — the
+ * knob never owns a port. (Compare `../deadline`, which ships a `subscribe`
+ * cell; the poller reuses `../deadline`'s, so it has nothing of its own to
+ * splice into `interpret`.)
+ */
+interface Poller<State, R> {
+    /** Seed the Model slice. Idle until `start(...)` arms the first tick. */
+    init(): PollerPolling<R>;
+    /**
+     * Arm the first tick. `at` is the current clock (carried in from the Msg /
+     * runtime that kicks the poller off — never read inside the verb). Returns
+     * the slice with the first deadline target set to `at + everyMs` and emits NO
+     * Cmd. The cadence has ONE source — the deadline Sub — so `start` does not
+     * perform the first observation itself (an immediate `onTick` here would race
+     * the timer and poll as fast as the source responds). The first observation
+     * fires when the deadline crosses `at + everyMs` and the consumer routes
+     * `deadline_exceeded` → `tick`.
+     */
+    start(state: PollerState<R>, at: number): readonly [PollerPolling<R>, readonly Cmd[]];
+    /**
+     * Perform one observation — the cadence verb. The consumer routes the
+     * deadline Sub's `deadline_exceeded` Msg here; `tick` emits the single
+     * `config.onTick()` Cmd that goes and reads the source. This is the ONLY
+     * next-tick mechanism: the timer fires, the consumer calls `tick`, the fetch
+     * runs, and the observation comes back through `tickResult` / `tickErr`
+     * (which re-arm the next deadline). A no-op on a finished poller — a stale
+     * deadline fire racing a terminal transition the reconcile pass has not yet
+     * retired emits nothing.
+     *
+     * Takes no `at`: `tick` does not touch the schedule (the just-fired deadline
+     * is exhausted; the next target is set when the result lands), so it needs no
+     * clock — keeping it trivially pure.
+     */
+    tick(state: PollerState<R>): readonly [PollerState<R>, readonly Cmd[]];
+    /**
+     * Record a successful tick observation at clock `at`.
+     *
+     * - Resets the retry counter (a success clears consecutive-failure state).
+     * - Stores `result` as `lastResult` and bumps `tick`.
+     * - Re-arms the next tick at the absolute target `at + everyMs` (the steady
+     *   cadence). It emits NO cadence `onTick` — the next observation fires from
+     *   the deadline Sub via `tick`, never immediately from a result.
+     * - Dedupe (opt-in, orthogonal to cadence): when `dedupeKey` is set, a FRESH
+     *   observation emits one `onTick` FOLLOW-UP (the consumer's "run the
+     *   downstream side effect once per distinct observation" hook) and a
+     *   DUPLICATE key records the sighting but suppresses the follow-up. With no
+     *   `dedupeKey`, `tickResult` emits nothing — the cadence `tick` is the only
+     *   `onTick`, so an unconfigured poller never double-fetches.
+     * - UNLESS `untilHeld` is `true` (the consumer evaluated `config.until`
+     *   against the post-result Model) — then the poller enters `"done"`,
+     *   disarms (`nextAtMs: null`), and emits no Cmd, dedupe or otherwise.
+     *
+     * `untilHeld` is passed in rather than computed here because `until` reads
+     * the consumer's WHOLE Model, which this verb does not hold — the consumer
+     * evaluates it at the call site after folding `result` into its Model and
+     * passes the boolean. (`subs` re-checks `phase` to decide arming, so a
+     * mis-passed `untilHeld` cannot leave a "done" poller arming timers.)
+     */
+    tickResult(state: PollerState<R>, result: R, at: number, untilHeld: boolean): readonly [PollerPolling<R> | PollerDone<R>, readonly Cmd[]];
+    /**
+     * Record a FAILED tick at clock `at`. Backs off instead of holding the
+     * steady cadence:
+     *
+     * - Advances the retry counter (`recordFailure`).
+     * - If `shouldRetry` still permits another attempt, arms the next tick at
+     *   `at + nextDelayMs(retry, policy)` (the backoff curve) and emits NO Cmd —
+     *   the retry observation fires when that backoff deadline crosses and the
+     *   consumer routes `deadline_exceeded` → `tick`. The timer is the single
+     *   next-tick mechanism, on the backoff curve here instead of `everyMs`.
+     * - If backoff is exhausted (`!shouldRetry`), enters `"gave_up"`, disarms
+     *   (`nextAtMs: null`), and emits no Cmd.
+     *
+     * `at` is both the backoff anchor AND the streak clock: it is passed to
+     * `recordFailure` (starting / preserving `firstFailureAtMs`) and to
+     * `shouldRetry`, so a `DurationRetryPolicy` on `config.retry` is honoured
+     * with no extra wiring. Under a duration bound the poller keeps retrying
+     * however many attempts the outage takes, and stops at the declared
+     * wall-clock budget measured from the streak's FIRST failure.
+     *
+     * The backoff jitter uses the `rng` injected ONCE at `createPoller` (default
+     * `Math.random` at the effect boundary, a fixed value in tests); the verb
+     * body never names the global RNG, so a poller built with a fixed `rng`
+     * replays a failure-and-backoff run bit-for-bit.
+     */
+    tickErr(state: PollerState<R>, error: unknown, at: number): readonly [PollerPolling<R> | PollerGaveUp<R>, readonly Cmd[]];
+    /**
+     * The pre-wired subscriptions cell. Returns the single tick-deadline Sub
+     * while the poller is `"polling"` with an armed `nextAtMs`; returns `[]`
+     * once `"done"` / `"gave_up"` (the timer disarms) or before `start`. Assign
+     * directly: `subscriptions: (s) => poll.subs(s.poll)`.
+     *
+     * The `DeadlineSub` it returns is consumed by `../deadline`'s
+     * `subscribeDeadline` cell, which the consumer wires into `subscribe` —
+     * the poller does not redraw the timer lifecycle.
+     */
+    subs(state: PollerState<R>): readonly Sub[];
+}
+/**
+ * Build a poller knob from `config`. Returns the hook bag to spread into a
+ * machine (see the module doc-comment for the wiring). Pure factory — no clock
+ * read, no timer; everything happens when the consumer calls the returned
+ * verbs / `subs` with an injected `at`.
+ *
+ * `rng` is injected ONCE here (default `Math.random` at the effect boundary, a
+ * fixed value in tests) and threaded internally into the backoff jitter. No
+ * verb body ever names the global RNG, so a poller built with a fixed `rng`
+ * replays a failure-and-backoff run bit-for-bit (invariant 2: the verbs are
+ * pure given the injected `rng`).
+ */
+declare function createPoller<State, R>(config: PollerConfig<State, R>, rng?: () => number): Poller<State, R>;
+
+/**
+ * The reconciler knob. Generic in:
+ *   - `Actual`  — one item of the ACTUAL world (a fleet node, an audited page, a
+ *                 table row). The scan accumulates these.
+ *   - `Desired` — the DESIRED spec value the diff converges toward. Opaque to
+ *                 this module; only `diff` reads it.
+ *   - `Page`    — the shape one actual-list page fetch resolves with.
+ *   - `Change`  — one unit of remediation the diff produces and `apply` realizes.
+ *   - `ApplyCmd`— the Cmd `apply(change)` yields (the effect that mutates the
+ *                 actual world toward desired).
+ *
+ * `diff` / `apply` / `idOf` / `nextCursor` / `itemsOf` are PURE config functions
+ * applied at the verb boundary, never stored in the slice or in a Cmd (Cmds are
+ * plain data, not closures). The resilience bricks (`retry` / `circuit` /
+ * `rateLimit` / `deadline`) are the SAME optional knobs `paginated-walk` /
+ * `resilient-call` expose — reconciler extends them; `rateLimit` keeps the scan
+ * from 429-ing the upstream listing API.
+ */
+interface ReconcilerConfig<Actual, Desired, Page, Change, ApplyCmd extends Cmd, Cursor = number> {
+    /**
+     * The DESIRED spec to converge on. Held verbatim and handed to `diff` once the
+     * scan completes. Any JSON-serializable value — a list of specs, a target map,
+     * a single target object — `diff` alone interprets it.
+     */
+    readonly desired: Desired;
+    /**
+     * Compute the remediation plan: the ordered `Change[]` that moves `actual` to
+     * `desired`. Called once when the scan finishes (the full actual snapshot is in
+     * hand). An empty plan means "already in sync — nothing to apply". PURE +
+     * consumer-specific (only the consumer knows the domain's reconcile rules).
+     */
+    readonly diff: (desired: Desired, actual: readonly Actual[]) => readonly Change[];
+    /**
+     * Realize one `Change` as the Cmd that mutates the actual world. Returns plain
+     * data (a `{ type, ... }` Cmd the consumer's interpret handler performs).
+     * PURE — the side effect happens when the runtime performs the emitted Cmd,
+     * never here.
+     */
+    readonly apply: (change: Change) => ApplyCmd;
+    /**
+     * Stable identity for a `Change` — the applied-ledger cache key. A re-`applyNext`
+     * after eviction (or after a re-plan) skips a change whose id is already in the
+     * ledger (idempotent re-apply). MUST be a property of the change itself, NOT its
+     * position in the plan: the ledger has to survive re-planning. When omitted the
+     * default keys by the change's serialized CONTENT (`JSON.stringify(change)`) —
+     * a stable per-change identity that is unchanged by where the change sits in the
+     * plan. Supply a domain id (the target node id, the resource key) when one
+     * exists; it is cheaper than serializing and dedupes two changes that differ
+     * only in fields irrelevant to identity. PURE.
+     *
+     * Why NOT positional: keying by index silently drops changes on the documented
+     * re-plan path. After applying the index-0 change, its `"0"` ledger entry would
+     * match WHATEVER different, never-applied change lands at index 0 in the next
+     * plan — the apply loop skips it as "already done". Identity must be intrinsic
+     * to the change so the ledger means "this change settled", not "slot N settled".
+     */
+    readonly idOf?: (change: Change) => string;
+    /**
+     * The cursor the actual-list scan fetches first. For an offset API typically
+     * `0`; for a token API whatever sentinel the API treats as page one.
+     */
+    readonly firstPage: Cursor;
+    /**
+     * Extract the next scan cursor from a fetched page — a `Cursor` to keep
+     * scanning, or `null` when the actual listing is exhausted (scan finishes,
+     * plan computed). PURE + consumer-specific.
+     */
+    readonly nextCursor: (page: Page) => Cursor | null;
+    /**
+     * Extract the actual items from one fetched page. Each page's items are
+     * appended to the running `actual` accumulator. PURE.
+     */
+    readonly itemsOf: (page: Page) => readonly Actual[];
+    /** Exponential-backoff retry policy for a transient scan-page failure. */
+    readonly retry?: RetryPolicy;
+    /** Circuit breaker around the scan fetch (one upstream → one breaker). */
+    readonly circuit?: CircuitConfig;
+    /** Token-bucket rate limit on the scan — the "don't 429 the listing API" knob. */
+    readonly rateLimit?: RateLimitConfig;
+    /** Overall wall-clock deadline per individual scan-page fetch. */
+    readonly deadline?: DeadlineConfig;
+}
+/**
+ * Reconcile lifecycle phase. Discriminated on `phase`:
+ *
+ *   - `idle`     — created, never scanned. `scan` starts the actual-world walk.
+ *   - `scanning` — the paginated-walk is traversing the actual listing; pages
+ *                  fold into `actual` as they arrive. The scan owns the `walk`
+ *                  sub-slice; this phase ends when the walk finishes.
+ *   - `applying` — the scan finished, `diff` produced the `plan`, and changes are
+ *                  being applied one at a time. `appliedCursor` is the index of
+ *                  the next change to apply.
+ *   - `done`     — every planned change applied (or an empty plan: already in
+ *                  sync). Terminal.
+ *   - `failed`   — the scan failed terminally (the page-fetch retries were
+ *                  exhausted / a deadline fired). `error` carries why. Terminal.
+ */
+type ReconcilePhase = "idle" | "scanning" | "applying" | "done" | "failed";
+/**
+ * The slice. Plain data end to end:
+ *   - `phase`         — the lifecycle discriminant.
+ *   - `walk`          — the `../paginated-walk` scan slice (cursor + resilience).
+ *                       Drives the actual-world traversal; POSITION survives
+ *                       eviction.
+ *   - `actual`        — the accumulated actual items, appended page by page during
+ *                       the scan. The full snapshot `diff` is computed against.
+ *   - `plan`          — the `Change[]` `diff` produced. Empty until the scan
+ *                       finishes; the apply loop walks it by `appliedCursor`.
+ *   - `appliedCursor` — index of the NEXT change to apply (0 ≤ cursor ≤ plan.length).
+ *                       `cursor === plan.length` means every change applied.
+ *   - `applied`       — the applied-ledger cache: `idOf(change) → change`, written
+ *                       as each change settles. The idempotency memory the apply
+ *                       loop reads to skip already-applied changes after eviction.
+ */
+interface ReconcilerState<Actual, Change, Page, Cursor = number> {
+    readonly phase: ReconcilePhase;
+    readonly walk: PaginatedWalkState<Cursor, Page>;
+    readonly actual: readonly Actual[];
+    readonly plan: readonly Change[];
+    readonly appliedCursor: number;
+    readonly applied: TtlCache<Change>;
+}
+/**
+ * The actual-list page-fetch effect: the inherited `resilient_run` Cmd from
+ * paginated-walk, whose `input` is the `Cursor` to fetch and whose `key` is the
+ * fixed `PAGE_KEY`. The consumer's `handlers(ports)` interprets it.
+ */
+type ScanPageCmd<Cursor> = FetchPageCmd<Cursor>;
+/** Page-settled Msgs the scan `handlers` port dispatches back (inherited verbatim). */
+type ScanPageOkMsg<Page> = PageOkMsg<Page>;
+type ScanPageErrMsg = PageErrMsg;
+/** The scan retry / deadline timer Msg — inherited from paginated-walk. */
+type ReconcilerTimerMsg = PaginatedWalkTimerMsg;
+/**
+ * Ports the consumer supplies to `handlers`. `run(cursor)` fetches ONE page of
+ * the ACTUAL listing for the given cursor; throwing routes to `pageErr` (and
+ * thus the scan backoff). Same shape as paginated-walk's port.
+ */
+interface ReconcilerPorts<Cursor, Page> extends ResilientPorts<Cursor, Page> {
+}
+/**
+ * Build a reconciler knob from `config`. `rng` is injected for the underlying
+ * scan-retry jitter — pass a fixed `() => 0` in tests to pin backoff; defaults
+ * to `Math.random` (read at the verb boundary inside resilient-call, never in a
+ * reconciler verb). Inherited straight from paginated-walk.
+ *
+ * Returns the uniform L2 knob contract: `init()`, the verbs `scan` / `pageOk` /
+ * `pageErr` / `planned` / `applyNext` / `applied` / `onTimer`, the derived
+ * `isComplete`, `subs(state)`, and `handlers(ports)`.
+ */
+declare function createReconciler<Actual, Desired, Page, Change, ApplyCmd extends Cmd = Cmd, Cursor = number>(config: ReconcilerConfig<Actual, Desired, Page, Change, ApplyCmd, Cursor>, rng?: () => number): {
+    init: () => ReconcilerState<Actual, Change, Page, Cursor>;
+    scan: (s: ReconcilerState<Actual, Change, Page, Cursor>, at: number) => readonly [ReconcilerState<Actual, Change, Page, Cursor>, readonly (ApplyCmd | ScanPageCmd<Cursor>)[]];
+    pageOk: (s: ReconcilerState<Actual, Change, Page, Cursor>, page: Page, at: number) => readonly [ReconcilerState<Actual, Change, Page, Cursor>, readonly (ApplyCmd | ScanPageCmd<Cursor>)[]];
+    pageErr: (s: ReconcilerState<Actual, Change, Page, Cursor>, error: unknown, at: number) => readonly [ReconcilerState<Actual, Change, Page, Cursor>, readonly (ApplyCmd | ScanPageCmd<Cursor>)[]];
+    planned: (s: ReconcilerState<Actual, Change, Page, Cursor>, at: number, changes?: readonly Change[]) => readonly [ReconcilerState<Actual, Change, Page, Cursor>, readonly (ApplyCmd | ScanPageCmd<Cursor>)[]];
+    applyNext: (s: ReconcilerState<Actual, Change, Page, Cursor>, at: number) => readonly [ReconcilerState<Actual, Change, Page, Cursor>, readonly (ApplyCmd | ScanPageCmd<Cursor>)[]];
+    applied: (s: ReconcilerState<Actual, Change, Page, Cursor>, change: Change, at: number) => readonly [ReconcilerState<Actual, Change, Page, Cursor>, readonly (ApplyCmd | ScanPageCmd<Cursor>)[]];
+    onTimer: (s: ReconcilerState<Actual, Change, Page, Cursor>, msg: ReconcilerTimerMsg) => readonly [ReconcilerState<Actual, Change, Page, Cursor>, readonly (ApplyCmd | ScanPageCmd<Cursor>)[]];
+    isComplete: (s: ReconcilerState<Actual, Change, Page, Cursor>) => boolean;
+    subs: (s: ReconcilerState<Actual, Change, Page, Cursor>) => readonly DeadlineSub[];
+    handlers: (ports: ReconcilerPorts<Cursor, Page>) => {
+        resilient_run: (cmd: CmdValue<"resilient_run", {
+            readonly key: string;
+            readonly input: Cursor;
+        }, {
+            readonly [detail: string]: unknown;
+            readonly _tag: "deadline_exceeded";
+        } | {
+            readonly [detail: string]: unknown;
+            readonly _tag: "port_rejected";
+        }, unknown>, ctx: Readonly<Record<never, never>>) => Promise<FailMsg | SucceedMsg<Page>>;
+    };
+};
+/**
+ * Lift a knob result `[slice, cmds]` into a host `[State, cmds]` where the slice
+ * lives at `state.rec`. Convenience for the common single-slice host; hosts with
+ * a differently-named field spread by hand. PURE — a thin record rebuild, no
+ * clock / RNG.
+ */
+declare function liftReconciler<S extends {
+    rec: ReconcilerState<Actual, Change, Page, Cursor>;
+}, Actual, Change, Page, Cursor, C extends Cmd>(state: S, [slice, cmds]: readonly [
+    ReconcilerState<Actual, Change, Page, Cursor>,
+    readonly C[]
+]): readonly [S, readonly C[]];
+
+/**
+ * @packageDocumentation
+ * internal/flow/saga — a forward-then-compensate transaction over an ordered list
+ * of reversible steps.
+ *
+ * The Level-2 combinator for "run these N steps in order; if any step fails,
+ * undo the steps that already succeeded, in reverse." It is the distributed-
+ * transaction / compensation knob: each step is a `{ do, undo }` pair of Cmds,
+ * the saga drives `do` forward one step at a time, and on the first failure it
+ * pivots and drives `undo` backward over exactly the steps that completed.
+ *
+ * **Boundary with the workflow module (`../workflow/`) — the compensation
+ * test.** Both drive
+ * an ordered multi-step transaction with reverse-order compensation; the line
+ * between them is whether every step carries a true inverse. Here
+ * `SagaStep<D, U>` REQUIRES both `do` and `undo` — a step without its inverse
+ * is unrepresentable, so full reversibility is a type-level guarantee.
+ * Workflow's `WorkflowStep.compensation` is OPTIONAL — an irreversible step (a
+ * sent email) is skipped during the unwind. Pick by the test: **every step
+ * must be reversible → saga; some steps are irreversible but the run must
+ * finish → workflow.** Cross to workflow when the transaction includes steps
+ * that can't be undone (or when you want each activity recorded as a durable
+ * owed effect on the `../do` ledger); stay here when the type system should
+ * enforce that every step can be undone.
+ *
+ * The recipe (which bricks it composes):
+ *   - `../work-queue/adapter` — the saga's forward progress IS a work-queue
+ *     lifecycle. Each step's record carries the same `{ id, status, input }`
+ *     vocabulary (`pending → running → done | failed | cancelled`), so the step
+ *     taxonomy is the substrate's status enum rather than a parallel invention.
+ *     We reuse the pure `QueueItem` / `QueueItemStatus` types AND delegate every
+ *     status flip to the `QueueAdapter` verbs: `wq.enqueue` stamps each fresh
+ *     ledger record, and `wq.patch` performs every
+ *     `pending → running → done | failed | cancelled` transition. The status
+ *     transitions are NOT re-rolled here — they live in exactly one place
+ *     behind the adapter, per the package's one-shape rule. The async
+ *     `createQueue(store)` adapter is NOT used: its `load → mutate → save` reads
+ *     the clock and lives at an I/O boundary, while a combinator's verbs must be
+ *     pure (invariant 2). We bind the same ops to the in-Model ledger instead —
+ *     durable + replayable, the two non-negotiables every knob preserves.
+ *
+ * The compensation log is the spec's `done: StepId[]` — the indices of the
+ * steps that completed forward, in the order they completed. On `stepErr` the
+ * saga walks that log in reverse, emitting one `undo` per `undoOk`, so the
+ * unwind is the exact mirror of the wind. If an `undo` ITSELF fails, `undoErr`
+ * pivots to the terminal `compensation_failed` phase: a failed compensation is
+ * a real-world fact (a refund that bounced, a hold that won't release) that the
+ * consumer must see and reconcile by hand — never a saga wedged in
+ * `compensating` forever.
+ *
+ * Typical wiring (combinator form — splice the hooks into your machine):
+ *
+ *   const saga = createSaga<BookFlight | ChargeCard | ..., Cancel | Refund | ...>({
+ *     steps: [
+ *       { do: { type: "book_flight" },  undo: { type: "cancel_flight" } },
+ *       { do: { type: "charge_card" },  undo: { type: "refund_card" } },
+ *       { do: { type: "reserve_hotel" },undo: { type: "release_hotel" } },
+ *     ],
+ *   });
+ *
+ *   // in `update`:
+ *   begin:    (s)    => lift(s, saga.start(s.saga)),
+ *   step_ok:  (s)    => lift(s, saga.stepOk(s.saga)),
+ *   step_err: (s, m) => lift(s, saga.stepErr(s.saga, m.error)),
+ *   undo_ok:  (s)    => lift(s, saga.undoOk(s.saga)),
+ *   undo_err: (s, m) => lift(s, saga.undoErr(s.saga, m.error)),
+ *
+ * Every verb is PURE: it returns a NEW slice plus the Cmds to perform (the next
+ * `do` going forward, or the next `undo` rolling back). The reducer never reads
+ * a clock or RNG — step identity is positional (the index into `config.steps`),
+ * so progress survives a round-trip through the durable slice and resumes
+ * exactly where it left off after a DO eviction.
+ *
+ * There is no `subs` and no `handlers`: a saga runs no timers, and the `do` /
+ * `undo` Cmds are fully caller-defined (the consumer's own `interpret` performs
+ * each effect and routes Ok/Err back to the `stepOk` / `stepErr` / `undoOk`
+ * verbs — the same shape `resilient-fetch` uses with `tryInterpret`). The saga
+ * owns the ORDER; the consumer owns the I/O. Pure-ops module, like
+ * `retry-backoff`.
+ *
+ * NOT a substrate primitive: it depends only on `../work-queue`'s pure types
+ * and the core `Cmd` type. Internal since #48 — not published on any subpath;
+ * reached from inside the package as `internal/flow/saga`.
+ */
+
+/**
+ * A step's stable identity. Positional: the 0-based index into
+ * `config.steps`. Positional ids are PURE (no clock, no RNG) and survive a
+ * round-trip through the durable slice, so `done` can be replayed to resume an
+ * interrupted saga exactly. The compensation log is a list of these.
+ */
+type StepId = number;
+/**
+ * One step of the saga: the forward effect and its compensating inverse, both
+ * as data (plain Cmds). `do` runs while winding forward; `undo` runs while
+ * unwinding after a failure. The pair is the unit of reversibility — a step
+ * that completed (`do` succeeded) is exactly a step whose `undo` must run if a
+ * later step fails.
+ */
+interface SagaStep<D extends Cmd, U extends Cmd> {
+    /** The forward effect, performed while the saga winds forward. */
+    readonly do: D;
+    /** The compensating inverse, performed (in reverse) while the saga unwinds. */
+    readonly undo: U;
+}
+/**
+ * The knob. The ordered list of reversible steps. The list is fixed for the
+ * life of one saga instance (a saga drives a known transaction); per-run inputs
+ * ride on the consumer's Msgs, not here.
+ */
+interface SagaConfig<D extends Cmd, U extends Cmd> {
+    /** The steps, in forward order. `do` runs `0 → n-1`; `undo` runs the completed prefix `n-1 → 0`. */
+    readonly steps: readonly SagaStep<D, U>[];
+}
+/**
+ * The lifecycle phase of a saga, narrowed at the type level so a consumer can
+ * branch on `state.phase` (and a Transitions-table reducer can key on it).
+ *
+ *   - `"idle"`         — created, not started. No step has run.
+ *   - `"running"`      — winding forward; `position` is the in-flight step.
+ *   - `"compensating"` — a step failed; unwinding `done` in reverse.
+ *   - `"committed"`    — every step completed forward. Terminal success.
+ *   - `"aborted"`      — compensation finished (every completed step undone, or
+ *                        the first step itself failed with nothing to undo).
+ *                        Terminal failure, fully unwound.
+ *   - `"compensation_failed"` — an `undo` itself failed mid-rollback. Terminal
+ *                        failure, PARTIALLY unwound: the steps still in `done`
+ *                        were never compensated and must be reconciled by hand.
+ *                        Distinguished from `aborted` precisely so a stuck
+ *                        rollback is visible state, not a saga wedged in
+ *                        `compensating` forever.
+ */
+type SagaPhase = "idle" | "running" | "compensating" | "committed" | "aborted" | "compensation_failed";
+/**
+ * The slice this knob owns.
+ *
+ * The spec's three fields are load-bearing:
+ *   - `position` — the index of the step currently in flight while `running`,
+ *     or the index being compensated while `compensating`. Survives eviction,
+ *     so `boot` resumes mid-saga from the durable slice.
+ *   - `done` — the compensation log: the ids of steps that completed forward,
+ *     in completion order. `undo` walks this in reverse. This is the single
+ *     source of truth for what must be unwound.
+ *   - `compensating` — the direction bit. `false` while winding forward, `true`
+ *     once a failure has pivoted the saga into rollback.
+ *
+ * Plus:
+ *   - `phase` — the derived lifecycle tag (see `SagaPhase`). Kept in the slice
+ *     (not recomputed) so a consumer's view and Transitions reducer can key on
+ *     `state.phase` directly, and the terminal states (`committed` / `aborted`)
+ *     are explicit facts rather than "position past the end" arithmetic.
+ *   - `error` — the forward failure that triggered compensation, carried
+ *     forward verbatim (`unknown`) for the consumer to read, never interpreted
+ *     (same discipline as `retry-backoff`'s `lastError` and `fan-out`'s
+ *     `error`).
+ *   - `compensationError` — the failure of an `undo` itself, set only when the
+ *     saga reaches `compensation_failed`. Kept distinct from `error` (the
+ *     forward failure) so a consumer reconciling a stuck rollback can read both
+ *     "what broke the transaction" and "which compensation then bounced".
+ *     Carried verbatim, never interpreted, same as `error`.
+ *   - `items` — the work-queue ledger, one `QueueItem` per step, keyed by the
+ *     step's positional id. The single source of truth for each step's status;
+ *     `phase` / `position` / `done` are the projection the verbs keep in
+ *     lockstep with it.
+ *
+ * Every field is `readonly` and JSON-serializable (plain numbers, arrays, and
+ * the work-queue's plain `QueueItem` records), so the slice round-trips through
+ * a consumer's `Store<S>` unchanged — durable across DO eviction.
+ */
+interface SagaState<I = StepId> {
+    /** The step in flight (`running`) or being compensated (`compensating`). */
+    readonly position: number;
+    /** The compensation log: ids of completed-forward steps, in completion order. */
+    readonly done: readonly StepId[];
+    /** Direction bit: `false` winding forward, `true` unwinding. */
+    readonly compensating: boolean;
+    /** The derived lifecycle tag (see `SagaPhase`). */
+    readonly phase: SagaPhase;
+    /** The forward failure that triggered compensation, if any. Carried, never interpreted. */
+    readonly error?: unknown;
+    /** The failure of an `undo` itself (only when `compensation_failed`). Carried, never interpreted. */
+    readonly compensationError?: unknown;
+    /** The work-queue ledger: one record per step, keyed by positional id. */
+    readonly items: readonly QueueItem<I>[];
+}
+/** Whether the saga has terminated successfully (every step committed). */
+declare function isCommitted<I>(state: SagaState<I>): boolean;
+/** Whether the saga has terminated in failure, fully unwound (every completed step undone). */
+declare function isAborted<I>(state: SagaState<I>): boolean;
+/**
+ * Whether the saga has terminated in failure with an UNFINISHED rollback: an
+ * `undo` itself failed, so some completed steps were never compensated and need
+ * hand reconciliation. Terminal, but distinct from `aborted` (fully unwound).
+ */
+declare function isCompensationFailed<I>(state: SagaState<I>): boolean;
+/**
+ * Whether the saga has reached a terminal phase (success, fully-unwound
+ * failure, or compensation-failed). Derived — reads the slice, never mutates.
+ * Consumers branch their own phase off this; no further verb has any effect
+ * once it holds (the verbs guard on phase and no-op).
+ */
+declare function isSettled<I>(state: SagaState<I>): boolean;
+/**
+ * The starting slice: idle, nothing run, winding-forward direction. `items` is
+ * empty until `start` stamps one ledger record per configured step — the slice
+ * is generic in the ledger payload `I`, defaulting to the positional `StepId`
+ * since a saga's "input" per step is just its index (the consumer's real inputs
+ * ride on its own Msgs).
+ */
+declare function initSaga<I = StepId>(): SagaState<I>;
+/**
+ * Build the saga knob from `config`. Returns the uniform combinator contract:
+ * `init` for the owned slice and the five lifecycle verbs (`start`, `stepOk`,
+ * `stepErr`, `undoOk`, `undoErr`).
+ *
+ * No `subs` and no `handlers` — a saga runs no timers, and each step's `do` /
+ * `undo` effect is owned by the consumer's `interpret` (the saga emits the Cmd;
+ * the consumer performs it and routes the outcome back to a verb). The saga's
+ * sole job is the ORDER: which Cmd to emit next, and when to pivot from winding
+ * to unwinding (and when a failed `undo` ends the rollback). Pure-ops module —
+ * matches `retry-backoff`'s shape.
+ */
+declare function createSaga<D extends Cmd, U extends Cmd>(config: SagaConfig<D, U>): {
+    init: () => SagaState<number>;
+    start: (state: SagaState<StepId>) => readonly [SagaState<StepId>, readonly D[]];
+    stepOk: (state: SagaState<StepId>) => readonly [SagaState<StepId>, readonly D[]];
+    stepErr: (state: SagaState<StepId>, error: unknown) => readonly [SagaState<StepId>, readonly U[]];
+    undoOk: (state: SagaState<StepId>) => readonly [SagaState<StepId>, readonly U[]];
+    undoErr: (state: SagaState<StepId>, error: unknown) => readonly [SagaState<StepId>, readonly U[]];
+    isCommitted: typeof isCommitted;
+    isAborted: typeof isAborted;
+    isCompensationFailed: typeof isCompensationFailed;
+    isSettled: typeof isSettled;
+};
+
+declare function routeWorkflowMsg<A, R, F>(wf: Workflow<A, R, F>, state: WorkflowState<A, R, F>, msg: WorkflowMsg<R, F>): WorkflowReducerStep<A, R, F>;
+
+/**
+ * One step of a workflow: a named activity descriptor. `A` is the opaque
+ * payload the consumer's interpret cell knows how to perform (an HTTP call, a
+ * sibling-grain message, a tool round-trip). The reducer never inspects
+ * `activity` — it only sequences the steps and correlates results.
+ *
+ * A step may declare a **compensation** — the inverse activity that undoes the
+ * forward one (cancel the reservation, refund the charge). Compensation is the
+ * `{ do, undo }` pair of `../saga/` mapped onto the workflow: the step's
+ * `activity` is the `do`, its `compensation` is the `undo`. The pair is the unit
+ * of reversibility — a step that completed (its forward activity succeeded) is
+ * exactly a step whose `compensation` must run, in reverse order, if a LATER
+ * step fails (#125). A step WITHOUT a compensation contributes nothing to the
+ * unwind: it is skipped during the reverse walk (an irreversible step — a sent
+ * email — that the saga model treats as a no-op `undo`).
+ */
+interface WorkflowStep<A> {
+    /** Stable, human-readable step name — appears in the completed-step record. */
+    readonly name: string;
+    /** The opaque activity this step performs. Interpreted by the consumer. */
+    readonly activity: A;
+    /**
+     * The opaque compensating (inverse) activity, performed in reverse order on a
+     * downstream failure (#125). Optional: a step with no compensation is skipped
+     * during the unwind. Interpreted by the consumer's interpret cell, exactly
+     * like {@link activity}.
+     */
+    readonly compensation?: A;
+}
+/**
+ * A workflow's step sequence at construction — a NON-EMPTY tuple. A workflow
+ * with nothing to do reaches `completed` only by carrying a final result, and an
+ * empty sequence produces none, so "≥ 1 step" is a precondition. Encoding it as
+ * `readonly [WorkflowStep<A>, ...WorkflowStep<A>[]]` makes the empty case a
+ * COMPILE error at every construction boundary (`init`, `foldWorkflow`,
+ * `workflowGrain`) — parse-don't-validate, so the reducer never needs a runtime
+ * throw to reject a resultless workflow.
+ */
+type WorkflowSteps<A> = readonly [WorkflowStep<A>, ...WorkflowStep<A>[]];
+/**
+ * A completed step: the step that ran plus the result its activity produced.
+ * The `running` state accumulates these in execution order, so the full
+ * forward history is available to the consumer (and to #125's compensation,
+ * which will walk it in reverse).
+ */
+interface CompletedStep<A, R> {
+    readonly step: WorkflowStep<A>;
+    readonly result: R;
+}
+/** The activity currently in flight on a `running` workflow. */
+interface InFlightActivity<A> {
+    /** The 0-based index of this step in the workflow's step sequence. */
+    readonly index: number;
+    /** The step whose activity is in flight. */
+    readonly step: WorkflowStep<A>;
+    /** The #67 ledger delivery id this activity was owed under (the dedup key). */
+    readonly id: DeliveryId;
+}
+/**
+ * The compensation currently in flight on a `compensating` workflow (#125). The
+ * mirror of {@link InFlightActivity} for the reverse walk: exactly one
+ * compensation is owed at a time, on the SAME #67 ledger, with its own monotonic
+ * delivery id. `index` is the index (into `completed`/`steps`) of the step being
+ * undone — the unwind walks these from high to low (strict reverse order).
+ */
+interface InFlightCompensation<A> {
+    /** The 0-based index (into the step sequence) of the step being compensated. */
+    readonly index: number;
+    /** The step whose compensation is in flight. */
+    readonly step: WorkflowStep<A>;
+    /** The #67 ledger delivery id this compensation was owed under (the dedup key). */
+    readonly id: DeliveryId;
+}
+/**
+ * A workflow in progress. Carries the ordered `completed` steps (forward
+ * history), the `steps` it is sequencing, and the `current` in-flight activity
+ * (with its ledger delivery id). `completed.length === current.index` always
+ * holds — the current activity is the next step after the last completed one.
+ */
+interface RunningWorkflow<A, R> {
+    readonly status: "running";
+    /** The full, static step sequence this workflow runs. */
+    readonly steps: readonly WorkflowStep<A>[];
+    /** Steps that have produced a result, in execution order. */
+    readonly completed: readonly CompletedStep<A, R>[];
+    /** The single activity in flight right now. */
+    readonly current: InFlightActivity<A>;
+}
+/**
+ * A workflow that ran every step to completion. `output` is the result of the
+ * final step — the workflow's overall output. No activity is in flight.
+ */
+interface CompletedWorkflow<A, R> {
+    readonly status: "completed";
+    readonly steps: readonly WorkflowStep<A>[];
+    /** Every step, in execution order, with its result. */
+    readonly completed: readonly CompletedStep<A, R>[];
+    /** The final step's result — the workflow's output. */
+    readonly output: R;
+}
+/**
+ * A workflow that failed on an activity with NOTHING to compensate — the
+ * forward failure happened with zero completed steps (the first activity
+ * failed). `failedStep` is the step whose activity reported the failure;
+ * `failure` is the opaque failure payload. `completed` is empty by construction:
+ * a failure WITH completed steps pivots into {@link CompensatingWorkflow}
+ * instead, so `failed` is precisely the empty-rollback terminal (the analogue
+ * of saga's `aborted` reached straight from the first step). No activity is in
+ * flight; this is terminal (#125 acceptance criterion 3).
+ */
+interface FailedWorkflow<A, R, F> {
+    readonly status: "failed";
+    readonly steps: readonly WorkflowStep<A>[];
+    /** Empty by construction — a failure with completed steps compensates instead. */
+    readonly completed: readonly CompletedStep<A, R>[];
+    /** The step whose activity failed. */
+    readonly failedStep: WorkflowStep<A>;
+    /** The opaque failure the activity reported. */
+    readonly failure: F;
+}
+/**
+ * A workflow unwinding after a forward failure (#125): the compensations of the
+ * `completed` steps are being emitted in STRICT REVERSE order, one at a time, on
+ * the same #67 ledger. The analogue of saga's `compensating` phase.
+ *
+ * `current` is the single compensation in flight (the mirror of `running`'s
+ * in-flight activity). `compensated` records, in unwind order, the completed
+ * steps whose compensation has confirmed — the reverse-walk's progress log, so
+ * a cold wake resumes mid-rollback exactly. `failedStep`/`failure` carry the
+ * forward failure that triggered the unwind (verbatim, never interpreted),
+ * preserved for the consumer to read and to fold onto the terminal state.
+ *
+ * Invariant: the unwind walks `completed` from its tail toward index 0, skipping
+ * steps with no compensation, so `current.index` is strictly below the index of
+ * every entry in `compensated`.
+ */
+interface CompensatingWorkflow<A, R, F> {
+    readonly status: "compensating";
+    readonly steps: readonly WorkflowStep<A>[];
+    /** The completed forward steps, in execution order — the history being unwound. */
+    readonly completed: readonly CompletedStep<A, R>[];
+    /** The step whose forward activity failed, triggering the unwind. */
+    readonly failedStep: WorkflowStep<A>;
+    /** The opaque forward failure that triggered the unwind. Carried, never interpreted. */
+    readonly failure: F;
+    /** The single compensation in flight right now. */
+    readonly current: InFlightCompensation<A>;
+    /** Completed steps whose compensation has confirmed, in unwind (reverse) order. */
+    readonly compensated: readonly CompletedStep<A, R>[];
+}
+/**
+ * A workflow that failed forward and then fully unwound: every completed step's
+ * compensation confirmed, in reverse order. Terminal. The analogue of saga's
+ * `aborted` (fully unwound) — named `failed_compensated` to align with #125's
+ * vocabulary. No activity or compensation is in flight.
+ */
+interface FailedCompensatedWorkflow<A, R, F> {
+    readonly status: "failed_compensated";
+    readonly steps: readonly WorkflowStep<A>[];
+    /** The forward steps that completed (and were each compensated), in execution order. */
+    readonly completed: readonly CompletedStep<A, R>[];
+    /** The step whose forward activity failed, triggering the (now-finished) unwind. */
+    readonly failedStep: WorkflowStep<A>;
+    /** The opaque forward failure that triggered compensation. Carried, never interpreted. */
+    readonly failure: F;
+}
+/**
+ * A workflow whose ROLLBACK itself failed: a compensation activity reported a
+ * failure mid-unwind. Terminal, PARTIALLY unwound — the analogue of saga's
+ * `compensation_failed`. A failed compensation is a real-world fact (a refund
+ * that bounced, a hold that won't release) that must become visible terminal
+ * state, never a workflow wedged in `compensating` forever.
+ *
+ * `compensated` is left intact (the steps already rolled back); `uncompensated`
+ * is the step whose compensation bounced PLUS the steps still owed a
+ * compensation behind it — exactly what the consumer must reconcile by hand.
+ * `compensationFailure` is the rollback failure (distinct from `failure`, the
+ * forward failure that started the unwind), carried verbatim.
+ */
+interface CompensationFailedWorkflow<A, R, F> {
+    readonly status: "compensation_failed";
+    readonly steps: readonly WorkflowStep<A>[];
+    /** The full completed-forward history, in execution order. */
+    readonly completed: readonly CompletedStep<A, R>[];
+    /** The step whose forward activity failed, triggering the unwind. */
+    readonly failedStep: WorkflowStep<A>;
+    /** The opaque forward failure that triggered compensation. Carried, never interpreted. */
+    readonly failure: F;
+    /** Completed steps successfully compensated before the rollback broke, in unwind order. */
+    readonly compensated: readonly CompletedStep<A, R>[];
+    /** The step whose compensation bounced. Its forward effect stands un-reversed. */
+    readonly failedCompensationStep: WorkflowStep<A>;
+    /** The opaque rollback failure (distinct from {@link failure}). Carried, never interpreted. */
+    readonly compensationFailure: F;
+}
+/**
+ * The workflow's state — a discriminated union on `status`. The current
+ * in-flight activity is reachable ONLY through `running`, and the in-flight
+ * compensation ONLY through `compensating`, making "an in-flight effect exists
+ * only while the workflow is actively driving one" unrepresentable to violate.
+ */
+type WorkflowState<A, R, F> = RunningWorkflow<A, R> | CompletedWorkflow<A, R> | FailedWorkflow<A, R, F> | CompensatingWorkflow<A, R, F> | FailedCompensatedWorkflow<A, R, F> | CompensationFailedWorkflow<A, R, F>;
+/** Every `status` discriminant of the {@link WorkflowState} union. */
+type WorkflowStatus = WorkflowState<unknown, unknown, unknown>["status"];
+/**
+ * The runtime accept-set of every {@link WorkflowStatus} — the single source of
+ * truth the boundary snapshot parse keys off (see `do.ts`). Built from an
+ * exhaustive `Record<WorkflowStatus, true>`, so adding a variant to the union
+ * above without listing it here is a COMPILE error: the set can never silently
+ * drift from the union again (the #312 regression, where the #125 compensation
+ * statuses were missing and evicted-mid-rollback grains re-seeded fresh).
+ */
+declare const WORKFLOW_STATUSES: ReadonlySet<string>;
+/**
+ * Dispatch the in-flight activity. Routed through the consumer's `interpret`
+ * over an injected activity port. The reducer emits this record; it performs
+ * no side effect. The result MUST be dispatched back as a Msg carrying `id`.
+ */
+declare function workflowActivityDef<A>(): CmdDef<"workflow_activity", {
+    /** The 0-based step index this activity belongs to. */
+    readonly index: number;
+    /** The #67 delivery id the result Msg must echo (the dedup key). */
+    readonly id: DeliveryId;
+    /** The opaque activity to perform. */
+    readonly activity: A;
+}, void, never, unknown>;
+type ActivityCmd<A> = CmdOf<ReturnType<typeof workflowActivityDef<A>>>;
+/**
+ * Dispatch a compensation (#125). Same shape + ledger discipline as
+ * {@link ActivityCmd} — a compensation is just another durable owed effect on
+ * the same #67 ledger, with its own delivery id — but the consumer's interpret
+ * cell performs the inverse `compensation` payload, and the result is dispatched
+ * back as a {@link CompensationOk}/{@link CompensationErr} carrying the SAME id.
+ * Distinguished by `type` so the consumer routes forward vs. inverse work to the
+ * right port, and the re-emit-on-wake stays type-correct.
+ */
+declare function workflowCompensationDef<A>(): CmdDef<"workflow_compensation", {
+    /** The 0-based step index whose compensation this is. */
+    readonly index: number;
+    /** The #67 delivery id the result Msg must echo (the dedup key). */
+    readonly id: DeliveryId;
+    /** The opaque compensating (inverse) activity to perform. */
+    readonly compensation: A;
+}, void, never, unknown>;
+type CompensationCmd<A> = CmdOf<ReturnType<typeof workflowCompensationDef<A>>>;
+/** The Cmd union this module emits: forward activity dispatches AND (#125)
+ *  reverse compensation dispatches. The owed/confirmed ledger events are not
+ *  `WorkflowCmd`s — they are Msg variants persisted into the event log (see
+ *  {@link EffectLedgerEvent}); the {@link WorkflowReducerStep} tuple carries them out
+ *  alongside the dispatch Cmd so the host persists owed-before-dispatch. Both
+ *  Cmd kinds are owed effects on the same ledger, so `survivingActivities`
+ *  re-emits either kind on cold wake. */
+type WorkflowCmd<A> = ActivityCmd<A> | CompensationCmd<A>;
+/** An activity succeeded: `id` echoes the {@link ActivityCmd} it answers; the
+ *  reducer matches it against `current.id`, records the completed step, and
+ *  advances. */
+interface ActivityOk<R> {
+    readonly type: "activity_ok";
+    readonly id: DeliveryId;
+    readonly result: R;
+}
+/** An activity failed (retries already exhausted by the consumer's interpret
+ *  cell — this module does not retry). `id` echoes the {@link ActivityCmd};
+ *  the reducer begins compensation (or settles `failed` when nothing has
+ *  completed). */
+interface ActivityErr<F> {
+    readonly type: "activity_err";
+    readonly id: DeliveryId;
+    readonly failure: F;
+}
+/** A compensation succeeded (#125): the inverse activity took. `id` echoes the
+ *  {@link CompensationCmd} it answers; the reducer matches it against the
+ *  in-flight compensation's id, records the step as compensated, and either
+ *  emits the next compensation (continuing in reverse) or settles
+ *  `failed_compensated` when the unwind is complete. A compensation produces no
+ *  result the workflow carries — its only signal is "the undo took". */
+interface CompensationOk {
+    readonly type: "compensation_ok";
+    readonly id: DeliveryId;
+}
+/** A compensation itself failed (#125): the inverse activity bounced (a refund
+ *  that won't go through). `id` echoes the {@link CompensationCmd}; the reducer
+ *  halts the rollback at the terminal `compensation_failed` state — never wedged
+ *  in `compensating` forever. */
+interface CompensationErr<F> {
+    readonly type: "compensation_err";
+    readonly id: DeliveryId;
+    readonly failure: F;
+}
+/** The Msg union the reducer folds: forward activity results AND (#125) reverse
+ *  compensation results. */
+type WorkflowMsg<R, F> = ActivityOk<R> | ActivityErr<F> | CompensationOk | CompensationErr<F>;
+/** Every `type` discriminant tag of the {@link WorkflowMsg} union. */
+type WorkflowMsgType = WorkflowMsg<unknown, unknown>["type"];
+/**
+ * The runtime accept-set of every {@link WorkflowMsgType} — the single source of
+ * truth the boundary replay parse keys off (see `do.ts`). Built from an
+ * exhaustive `Record<WorkflowMsgType, true>`, so adding a Msg variant to the
+ * union above without listing it here is a COMPILE error: the set can never
+ * silently drift from the union again (the #312 regression, where the #125
+ * compensation result tags were missing and dropped from replay).
+ */
+declare const WORKFLOW_MSG_TYPES: ReadonlySet<string>;
+/** A workflow reducer step: the next state, the ledger events to persist
+ *  (owed-before-dispatch), and the activity Cmds to dispatch. */
+interface WorkflowReducerStep<A, R, F> {
+    readonly state: WorkflowState<A, R, F>;
+    /** Ledger events to persist into the event log, in order, BEFORE `cmds`. */
+    readonly ledger: readonly EffectLedgerEvent<WorkflowCmd<A>>[];
+    /** Activity dispatch Cmds, after the ledger events are durable. */
+    readonly cmds: readonly WorkflowCmd<A>[];
+}
+/** The hook bag returned by {@link createWorkflow}. Spread its verbs into a
+ *  machine; `init(steps)` seeds a fresh workflow and emits the first activity,
+ *  the verbs fold results and advance, and `survivingActivities` re-emits the
+ *  owed-but-unconfirmed dispatch on cold wake (idempotent by delivery id). */
+interface Workflow<A, R, F> {
+    /**
+     * Seed a fresh workflow over `steps` (a NON-EMPTY {@link WorkflowSteps}) and
+     * dispatch its first activity → `running` with `current` = step 0, owed on the
+     * ledger. The "≥ 1 step" precondition is carried by the tuple type: an empty
+     * sequence is a compile error at the call site, not a runtime throw here — a
+     * workflow with nothing to do could never reach `completed` (no final result
+     * to carry), so it is unrepresentable by construction.
+     */
+    init(steps: WorkflowSteps<A>): WorkflowReducerStep<A, R, F>;
+    /**
+     * Fold an activity success. If `msg.id` does not match the in-flight
+     * activity's id (a stale/duplicate result from re-emit-on-wake, or a result
+     * for an already-advanced step), the state is returned UNCHANGED with no
+     * effects — idempotent by delivery id (acceptance criterion 3). Otherwise:
+     * record the completed step, confirm the owed activity on the ledger, and
+     * either advance to the next step (owing its activity) or transition to
+     * `completed` carrying the final result.
+     *
+     * Only meaningful on `running`; a result arriving for a terminal workflow is
+     * a no-op (the workflow is done — at-least-once tolerates the late echo).
+     */
+    onActivityOk(state: WorkflowState<A, R, F>, msg: ActivityOk<R>): WorkflowReducerStep<A, R, F>;
+    /**
+     * Fold an activity failure (#125). Same id-match idempotency guard as
+     * {@link onActivityOk}. On a match: confirm the owed activity on the ledger,
+     * then PIVOT into compensation — walk the completed-step history in strict
+     * reverse and owe the first declared compensation as a durable effect on the
+     * same ledger, transitioning to `compensating`. If NO completed step declares
+     * a compensation (the empty-rollback edge — the first activity failed, or
+     * every completed step is irreversible), settle `failed` directly with
+     * nothing to unwind.
+     */
+    onActivityErr(state: WorkflowState<A, R, F>, msg: ActivityErr<F>): WorkflowReducerStep<A, R, F>;
+    /**
+     * Fold a compensation success (#125). Same id-match idempotency guard against
+     * the in-flight compensation. On a match: confirm the owed compensation,
+     * record the step as compensated, and continue the reverse walk — owe the
+     * next declared compensation strictly below the step just undone, or settle
+     * `failed_compensated` when the unwind is complete. Only meaningful on
+     * `compensating`; a result for a terminal/forward workflow is a no-op.
+     */
+    onCompensationOk(state: WorkflowState<A, R, F>, msg: CompensationOk): WorkflowReducerStep<A, R, F>;
+    /**
+     * Fold a compensation failure (#125). Same id-match idempotency guard. On a
+     * match: confirm the owed compensation and HALT the rollback at the terminal
+     * `compensation_failed` state — a bounced compensation is visible terminal
+     * state to reconcile by hand, never a workflow wedged in `compensating`
+     * forever. Mirrors `../saga/`'s `undoErr`.
+     */
+    onCompensationErr(state: WorkflowState<A, R, F>, msg: CompensationErr<F>): WorkflowReducerStep<A, R, F>;
+    /**
+     * The owed-but-unconfirmed dispatch(es) to re-emit on activation — a forward
+     * activity OR (#125) a compensation, rebuilt by folding the persisted ledger
+     * events. On a fresh / fully-settled workflow this is empty. The re-fired Cmd
+     * carries the SAME delivery id, so a duplicate result is a no-op at the
+     * reducer (the id-match guard). This is the cold-wake re-emit that makes both
+     * activities AND compensations exactly-once-observable despite the
+     * at-least-once transport (acceptance criterion 2 & 3) — including a
+     * compensation owed mid-rollback when the actor was evicted.
+     */
+    survivingActivities(ledgerEvents: Iterable<EffectLedgerEvent<WorkflowCmd<A>>>): readonly WorkflowCmd<A>[];
+}
+/**
+ * Build a workflow hook bag. The factory captures NO clock and NO RNG — pure
+ * bookkeeping over the injected #67 recorder, exactly like
+ * `pendingEffectsLedger`. `restore` rehydrates the monotonic delivery-id
+ * counter from the persisted ledger events on cold wake, so re-dispatched
+ * activities resume their ids without gaps.
+ *
+ * @param restore - the persisted ledger events (read back from the log) and/or
+ *   the last issued delivery id, so the id counter resumes gap-free. Omit for a
+ *   fresh workflow.
+ */
+declare function createWorkflow<A, R, F>(restore?: {
+    readonly events?: Iterable<EffectLedgerEvent<WorkflowCmd<A>>>;
+    readonly lastId?: DeliveryId;
+}): Workflow<A, R, F>;
+/**
+ * Replay a workflow from its event log: seed over `steps`, then fold each
+ * activity-result `Msg` in order. Returns the final {@link WorkflowState}.
+ *
+ * Determinism: a freshly-constructed {@link createWorkflow} reissues delivery
+ * ids monotonically from 0, and the reducer reads no ambient state — so two
+ * calls with the same `steps` + `msgs` return deeply-equal states (and equal
+ * `JSON.stringify`). This is the byte-identity property #124 pins.
+ *
+ * Note this folds ONLY the result Msgs; the `init` dispatch + per-step
+ * owe/confirm ledger events are an internal effect channel reconstructed by the
+ * fresh recorder, not part of the replayed Msg log — exactly as the activity
+ * results are the only thing the consumer records and replays.
+ */
+declare function foldWorkflow<A, R, F>(steps: WorkflowSteps<A>, msgs: Iterable<WorkflowMsg<R, F>>): WorkflowState<A, R, F>;
+
+export { type ActivityCmd, type ActivityErr, type ActivityOk, type AwaitTerminalOptions, type CompensatingWorkflow, type CompensationCmd, type CompensationErr, type CompensationFailedWorkflow, type CompensationOk, type CompletedStep, type CompletedWorkflow, DeadlineSub, DeliveryId, EffectLedgerEvent, type FailedCompensatedWorkflow, type FailedWorkflow, type InFlightActivity, type InFlightCompensation, type Poller, type PollerConfig, type PollerDone, type PollerGaveUp, type PollerPolling, type PollerState, type PollerSub, type ReconcilePhase, type ReconcilerConfig, type ReconcilerPorts, type ReconcilerState, type ReconcilerTimerMsg, type RunningWorkflow, type SagaConfig, type SagaPhase, type SagaState, type SagaStep, type ScanPageCmd, type ScanPageErrMsg, type ScanPageOkMsg, type StepId, TerminalTimeoutError, WORKFLOW_MSG_TYPES, WORKFLOW_STATUSES, type Workflow, type WorkflowCmd, type WorkflowMsg, type WorkflowMsgType, type WorkflowReducerStep, type WorkflowState, type WorkflowStatus, type WorkflowStep, type WorkflowSteps, awaitTerminal, createPoller, createReconciler, createSaga, createWorkflow, foldWorkflow, initSaga, isAborted, isCommitted, isCompensationFailed, isSettled, liftReconciler, routeWorkflowMsg, runToTerminal, workflowActivityDef, workflowCompensationDef };