@dudousxd/nestjs-durable-core 0.33.0 → 0.35.0

package/dist/index.d.cts

@@ -209,7 +209,15 @@ declare function workflowName(ref: WorkflowRef): string;
  */
 type RunStatus = 
 /** Created + enqueued by `start`, not yet picked up — a worker will lease and execute it. */
-'pending' | 'running' | 'suspended' | 'completed' | 'failed' | 'cancelled'
+'pending' | 'running' | 'suspended'
+/**
+ * Compensating cancel in progress: `cancel(runId, { compensate: true })` has been requested and the
+ * saga undo is running in the background. NON-TERMINAL — the run is still in-flight (counted by the
+ * admission gate, re-driven by recovery if the engine crashes mid-compensation), and flips to
+ * `cancelled` once compensation completes. A non-compensating cancel skips this and goes straight to
+ * `cancelled`.
+ */
+ | 'cancelling' | 'completed' | 'failed' | 'cancelled'
 /** Dead-letter: recovery gave up after `maxRecoveryAttempts` (a poison pill). Terminal; inspect it. */
  | 'dead';
 /** One execution of a workflow. The unit of durability and the unit shown in the dashboard. */
@@ -577,7 +585,13 @@ interface StepResult {
 interface Heartbeat {
     runId: string;
     seq: number;
-    stepId: string;
+    /**
+     * The in-flight step this beat keeps alive. ABSENT for a RUN-scoped (workflow-turn) heartbeat: a
+     * worker replaying a long workflow turn beats for its `runId` so the engine rearms the run's
+     * `advance` deadline (see `WorkflowEngineDeps.remoteAdvanceSilenceMs`). The engine then keys the
+     * liveness reset by `runId` instead of `stepId`.
+     */
+    stepId?: string | undefined;
     group: string;
 }
 /** engine → workflow worker: advance this run one turn by replaying the function against `history`. */
@@ -1291,6 +1305,18 @@ interface WorkflowEngineDeps {
      * Omit for unlimited (the default — recovery always retries).
      */
     maxRecoveryAttempts?: number | undefined;
+    /**
+     * Opt-in liveness deadline (ms) for a remote workflow `advance`. If the worker neither returns a
+     * decision NOR sends a run-scoped {@link Heartbeat} within this window, the engine presumes it dead:
+     * it rejects the advance with {@link RemoteWorkflowTimeout}, releases the lease, and lets recovery
+     * re-drive (replaying completed steps from history). Each beat REARMS the window, so a worker still
+     * legitimately replaying a long turn (it keeps beating) is never re-driven — closing the duplicate-
+     * side-effect hazard a fixed {@link RemoteWorkflowExecutor} `timeoutMs` cannot avoid. Omit (default)
+     * for the prior unbounded await — byte-identical behavior when unset. If a `RemoteWorkflowExecutor` is
+     * ALSO constructed with its own `timeoutMs`, the shorter of the two deadlines wins; prefer setting only
+     * one (this rearmed window for heartbeat-aware workers, or the fixed `timeoutMs` otherwise).
+     */
+    remoteAdvanceSilenceMs?: number | undefined;
     /**
      * Build the public callback URL for a `ctx.webhook()` token (e.g.
      * ``(t) => `https://api.example.com/durable/webhooks/${t}` ``). Populates
@@ -1364,6 +1390,7 @@ declare class WorkflowEngine {
     private readonly instanceId;
     private readonly leaseMs;
     private readonly maxRecoveryAttempts?;
+    private readonly remoteAdvanceSilenceMs?;
     private readonly webhookUrl?;
     private readonly traceparent?;
     private readonly context?;
@@ -1388,7 +1415,9 @@ declare class WorkflowEngine {
     private readonly accumulators;
     /** In-flight remote steps awaiting a worker result, keyed by stepId. */
     private readonly pending;
-    /** Per-step "reset the liveness timer" callbacks, called when a heartbeat arrives. */
+    /** "Reset the liveness timer" callbacks keyed by the beat's target — a stepId (in-flight remote step)
+     *  or a runId (in-flight remote workflow turn) — invoked when a matching heartbeat arrives. The two id
+     *  shapes don't collide in practice: a stepId is `${runId}:${seq}`, a run key is the bare runId. */
     private readonly heartbeatResets;
     private readonly listeners;
     /** Step interceptors (onion middleware around real local-step execution), first = outermost. */
@@ -1730,6 +1759,13 @@ declare class WorkflowEngine {
     /** Apply a turn's commands: persist recorded local steps, dispatch remote calls, schedule timers.
      *  Returns the earliest timer deadline to suspend on (or undefined — suspended on a result). */
     private applyCommands;
+    /**
+     * Undo the registered saga compensations in reverse and settle the run `cancelled`. Shared by EVERY
+     * exit path of a run with a compensating cancel in flight — whether the resumed replay returned,
+     * suspended, hit continue-as-new, or threw — so a cancel is never lost just because the body didn't
+     * stop at a suspension point. Clears the in-memory cancel flag.
+     */
+    private compensateAndCancel;
     /** The run body, lease held + renewed by {@link execute}. */
     private runExecution;
     /**
@@ -1785,10 +1821,15 @@ declare class WorkflowEngine {
     /** In-memory await path for a remote step with a liveness `timeoutMs` (re-dispatch on timeout). */
     private callRemoteInMemory;
     /**
-     * Await a remote result, but reject with `RemoteStepTimeout` if neither the result nor a heartbeat
-     * arrives within `timeoutMs`. Each heartbeat (delivered via `transport.onHeartbeat`) rearms the
-     * window, so a worker that keeps beating stays alive past `timeoutMs`.
+     * Await `resultPromise`, but reject with `onTimeout()` if neither it settles nor a heartbeat for `id`
+     * arrives within `timeoutMs`. Each heartbeat (delivered via `transport.onHeartbeat`, looked up in
+     * `heartbeatResets` by `id`) REARMS the window, so a worker that keeps beating stays alive past
+     * `timeoutMs`. Shared by the remote-STEP liveness (keyed by stepId) and the remote-WORKFLOW advance
+     * liveness (keyed by runId); the caller supplies the timeout error and any extra cleanup via `onTimeout`.
      */
+    private awaitWithLivenessDeadline;
+    /** Remote-STEP liveness: await a worker result, timing out (with the step's pending-map cleanup) to
+     *  `RemoteStepTimeout` if it neither lands nor beats within `timeoutMs`. See {@link awaitWithLivenessDeadline}. */
     private awaitWithHeartbeat;
 }
 /** Raised inside the workflow when a remote worker reports a step failure. */
@@ -2301,13 +2342,16 @@ declare class InMemoryStateStore implements StateStore {
 declare class InMemoryTransport implements Transport, ControlPlane {
     private readonly handlers;
     private resultHandler?;
+    private heartbeatHandler?;
     private stepEventHandler?;
     private readonly controlHandlers;
     /** Register a fake worker handler for a step name. */
     handle(name: string, fn: StepHandler): void;
     dispatch(task: RemoteTask): Promise<void>;
     onResult(handler: (result: StepResult) => Promise<void>): void;
-    onHeartbeat(_handler: (beat: Heartbeat) => Promise<void>): void;
+    onHeartbeat(handler: (beat: Heartbeat) => Promise<void>): void;
+    /** Test hook: deliver a liveness heartbeat to the engine, as a real broker would on its channel. */
+    emitHeartbeat(beat: Heartbeat): Promise<void>;
     /** Workflow step lifecycle: deliver to the engine's handler (async, mirroring a real broker). */
     dispatchStepEvent(event: WorkflowStepEvent): Promise<void>;
     onStepEvent(handler: (event: WorkflowStepEvent) => Promise<void>): void;

package/dist/index.d.ts

@@ -209,7 +209,15 @@ declare function workflowName(ref: WorkflowRef): string;
  */
 type RunStatus = 
 /** Created + enqueued by `start`, not yet picked up — a worker will lease and execute it. */
-'pending' | 'running' | 'suspended' | 'completed' | 'failed' | 'cancelled'
+'pending' | 'running' | 'suspended'
+/**
+ * Compensating cancel in progress: `cancel(runId, { compensate: true })` has been requested and the
+ * saga undo is running in the background. NON-TERMINAL — the run is still in-flight (counted by the
+ * admission gate, re-driven by recovery if the engine crashes mid-compensation), and flips to
+ * `cancelled` once compensation completes. A non-compensating cancel skips this and goes straight to
+ * `cancelled`.
+ */
+ | 'cancelling' | 'completed' | 'failed' | 'cancelled'
 /** Dead-letter: recovery gave up after `maxRecoveryAttempts` (a poison pill). Terminal; inspect it. */
  | 'dead';
 /** One execution of a workflow. The unit of durability and the unit shown in the dashboard. */
@@ -577,7 +585,13 @@ interface StepResult {
 interface Heartbeat {
     runId: string;
     seq: number;
-    stepId: string;
+    /**
+     * The in-flight step this beat keeps alive. ABSENT for a RUN-scoped (workflow-turn) heartbeat: a
+     * worker replaying a long workflow turn beats for its `runId` so the engine rearms the run's
+     * `advance` deadline (see `WorkflowEngineDeps.remoteAdvanceSilenceMs`). The engine then keys the
+     * liveness reset by `runId` instead of `stepId`.
+     */
+    stepId?: string | undefined;
     group: string;
 }
 /** engine → workflow worker: advance this run one turn by replaying the function against `history`. */
@@ -1291,6 +1305,18 @@ interface WorkflowEngineDeps {
      * Omit for unlimited (the default — recovery always retries).
      */
     maxRecoveryAttempts?: number | undefined;
+    /**
+     * Opt-in liveness deadline (ms) for a remote workflow `advance`. If the worker neither returns a
+     * decision NOR sends a run-scoped {@link Heartbeat} within this window, the engine presumes it dead:
+     * it rejects the advance with {@link RemoteWorkflowTimeout}, releases the lease, and lets recovery
+     * re-drive (replaying completed steps from history). Each beat REARMS the window, so a worker still
+     * legitimately replaying a long turn (it keeps beating) is never re-driven — closing the duplicate-
+     * side-effect hazard a fixed {@link RemoteWorkflowExecutor} `timeoutMs` cannot avoid. Omit (default)
+     * for the prior unbounded await — byte-identical behavior when unset. If a `RemoteWorkflowExecutor` is
+     * ALSO constructed with its own `timeoutMs`, the shorter of the two deadlines wins; prefer setting only
+     * one (this rearmed window for heartbeat-aware workers, or the fixed `timeoutMs` otherwise).
+     */
+    remoteAdvanceSilenceMs?: number | undefined;
     /**
      * Build the public callback URL for a `ctx.webhook()` token (e.g.
      * ``(t) => `https://api.example.com/durable/webhooks/${t}` ``). Populates
@@ -1364,6 +1390,7 @@ declare class WorkflowEngine {
     private readonly instanceId;
     private readonly leaseMs;
     private readonly maxRecoveryAttempts?;
+    private readonly remoteAdvanceSilenceMs?;
     private readonly webhookUrl?;
     private readonly traceparent?;
     private readonly context?;
@@ -1388,7 +1415,9 @@ declare class WorkflowEngine {
     private readonly accumulators;
     /** In-flight remote steps awaiting a worker result, keyed by stepId. */
     private readonly pending;
-    /** Per-step "reset the liveness timer" callbacks, called when a heartbeat arrives. */
+    /** "Reset the liveness timer" callbacks keyed by the beat's target — a stepId (in-flight remote step)
+     *  or a runId (in-flight remote workflow turn) — invoked when a matching heartbeat arrives. The two id
+     *  shapes don't collide in practice: a stepId is `${runId}:${seq}`, a run key is the bare runId. */
     private readonly heartbeatResets;
     private readonly listeners;
     /** Step interceptors (onion middleware around real local-step execution), first = outermost. */
@@ -1730,6 +1759,13 @@ declare class WorkflowEngine {
     /** Apply a turn's commands: persist recorded local steps, dispatch remote calls, schedule timers.
      *  Returns the earliest timer deadline to suspend on (or undefined — suspended on a result). */
     private applyCommands;
+    /**
+     * Undo the registered saga compensations in reverse and settle the run `cancelled`. Shared by EVERY
+     * exit path of a run with a compensating cancel in flight — whether the resumed replay returned,
+     * suspended, hit continue-as-new, or threw — so a cancel is never lost just because the body didn't
+     * stop at a suspension point. Clears the in-memory cancel flag.
+     */
+    private compensateAndCancel;
     /** The run body, lease held + renewed by {@link execute}. */
     private runExecution;
     /**
@@ -1785,10 +1821,15 @@ declare class WorkflowEngine {
     /** In-memory await path for a remote step with a liveness `timeoutMs` (re-dispatch on timeout). */
     private callRemoteInMemory;
     /**
-     * Await a remote result, but reject with `RemoteStepTimeout` if neither the result nor a heartbeat
-     * arrives within `timeoutMs`. Each heartbeat (delivered via `transport.onHeartbeat`) rearms the
-     * window, so a worker that keeps beating stays alive past `timeoutMs`.
+     * Await `resultPromise`, but reject with `onTimeout()` if neither it settles nor a heartbeat for `id`
+     * arrives within `timeoutMs`. Each heartbeat (delivered via `transport.onHeartbeat`, looked up in
+     * `heartbeatResets` by `id`) REARMS the window, so a worker that keeps beating stays alive past
+     * `timeoutMs`. Shared by the remote-STEP liveness (keyed by stepId) and the remote-WORKFLOW advance
+     * liveness (keyed by runId); the caller supplies the timeout error and any extra cleanup via `onTimeout`.
      */
+    private awaitWithLivenessDeadline;
+    /** Remote-STEP liveness: await a worker result, timing out (with the step's pending-map cleanup) to
+     *  `RemoteStepTimeout` if it neither lands nor beats within `timeoutMs`. See {@link awaitWithLivenessDeadline}. */
     private awaitWithHeartbeat;
 }
 /** Raised inside the workflow when a remote worker reports a step failure. */
@@ -2301,13 +2342,16 @@ declare class InMemoryStateStore implements StateStore {
 declare class InMemoryTransport implements Transport, ControlPlane {
     private readonly handlers;
     private resultHandler?;
+    private heartbeatHandler?;
     private stepEventHandler?;
     private readonly controlHandlers;
     /** Register a fake worker handler for a step name. */
     handle(name: string, fn: StepHandler): void;
     dispatch(task: RemoteTask): Promise<void>;
     onResult(handler: (result: StepResult) => Promise<void>): void;
-    onHeartbeat(_handler: (beat: Heartbeat) => Promise<void>): void;
+    onHeartbeat(handler: (beat: Heartbeat) => Promise<void>): void;
+    /** Test hook: deliver a liveness heartbeat to the engine, as a real broker would on its channel. */
+    emitHeartbeat(beat: Heartbeat): Promise<void>;
     /** Workflow step lifecycle: deliver to the engine's handler (async, mirroring a real broker). */
     dispatchStepEvent(event: WorkflowStepEvent): Promise<void>;
     onStepEvent(handler: (event: WorkflowStepEvent) => Promise<void>): void;

package/dist/index.js

@@ -733,7 +733,8 @@ var SingletonGate = class {
       statuses: [
         "pending",
         "running",
-        "suspended"
+        "suspended",
+        "cancelling"
       ]
     });
     if (queued.length >= cap) {
@@ -751,7 +752,8 @@ var SingletonGate = class {
       workflow: run.workflow,
       statuses: [
         "running",
-        "suspended"
+        "suspended",
+        "cancelling"
       ]
     })).sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime() || a.id.localeCompare(b.id));
     const idx = inflight.findIndex((r) => r.id === run.id);
@@ -1431,6 +1433,7 @@ var WorkflowEngine = class {
   instanceId;
   leaseMs;
   maxRecoveryAttempts;
+  remoteAdvanceSilenceMs;
   webhookUrl;
   traceparent;
   context;
@@ -1455,7 +1458,9 @@ var WorkflowEngine = class {
   accumulators;
   /** In-flight remote steps awaiting a worker result, keyed by stepId. */
   pending = /* @__PURE__ */ new Map();
-  /** Per-step "reset the liveness timer" callbacks, called when a heartbeat arrives. */
+  /** "Reset the liveness timer" callbacks keyed by the beat's target — a stepId (in-flight remote step)
+  *  or a runId (in-flight remote workflow turn) — invoked when a matching heartbeat arrives. The two id
+  *  shapes don't collide in practice: a stepId is `${runId}:${seq}`, a run key is the bare runId. */
   heartbeatResets = /* @__PURE__ */ new Map();
   listeners = /* @__PURE__ */ new Set();
   /** Step interceptors (onion middleware around real local-step execution), first = outermost. */
@@ -1494,6 +1499,7 @@ var WorkflowEngine = class {
     this.instanceId = deps.instanceId ?? globalThis.crypto.randomUUID();
     this.leaseMs = deps.leaseMs ?? 3e4;
     this.maxRecoveryAttempts = deps.maxRecoveryAttempts;
+    this.remoteAdvanceSilenceMs = deps.remoteAdvanceSilenceMs;
     this.webhookUrl = deps.webhookUrl;
     this.traceparent = deps.traceparent;
     this.context = deps.context;
@@ -1530,9 +1536,11 @@ var WorkflowEngine = class {
         }
         await this.completeRemoteResult(result);
       },
-      // A heartbeat for an in-flight long step resets its liveness window (see callRemote).
+      // A heartbeat resets the liveness window for whatever it targets: an in-flight long STEP (keyed
+      // by stepId, see callRemote) or — when stepId is absent — the in-flight workflow TURN (keyed by
+      // runId, see runRemoteExecution's heartbeat-rearmed advance).
       async (beat) => {
-        this.heartbeatResets.get(beat.stepId)?.();
+        this.heartbeatResets.get(beat.stepId ?? beat.runId)?.();
       },
       // A remote workflow worker streams each local step's lifecycle (running → completed/failed) so
       // it's checkpointed live, not all-at-once when the long turn ends.
@@ -1894,14 +1902,16 @@ var WorkflowEngine = class {
         continue;
       }
       await this.store.releaseRunLock(run.id);
-      await this.store.updateRun(run.id, {
-        status: "pending",
-        updatedAt: /* @__PURE__ */ new Date()
-      });
+      if (run.status !== "cancelling") {
+        await this.store.updateRun(run.id, {
+          status: "pending",
+          updatedAt: /* @__PURE__ */ new Date()
+        });
+      }
       await this.runDispatcher.dispatch(run.id);
       results.push({
         runId: run.id,
-        status: "pending"
+        status: run.status === "cancelling" ? "cancelling" : "pending"
       });
     }
     return results;
@@ -2020,7 +2030,7 @@ var WorkflowEngine = class {
   * `start` when a call site needs the outcome — `await start(...); const r = await waitForRun(id)`.
   */
   waitForRun(runId, opts) {
-    const isSettled = /* @__PURE__ */ __name((s) => s !== "pending" && s !== "running", "isSettled");
+    const isSettled = /* @__PURE__ */ __name((s) => s !== "pending" && s !== "running" && s !== "cancelling", "isSettled");
     const toResult = /* @__PURE__ */ __name((run) => ({
       runId,
       status: run.status,
@@ -2184,8 +2194,19 @@ var WorkflowEngine = class {
         error: run.error
       };
     }
+    if (run.status === "cancelling") {
+      return {
+        runId,
+        status: "cancelling"
+      };
+    }
     if (opts?.compensate && (run.status === "suspended" || run.status === "running")) {
       this.cancelRequested.add(runId);
+      await this.store.updateRun(runId, {
+        status: "cancelling",
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      run.status = "cancelling";
       if (this.controlPlane) {
         void this.controlPlane.publishControl({
           kind: "cancel",
@@ -2199,7 +2220,7 @@ var WorkflowEngine = class {
       await this.cancelChildren(runId, opts);
       return {
         runId,
-        status: run.status
+        status: "cancelling"
       };
     }
     const error = {
@@ -2590,6 +2611,36 @@ var WorkflowEngine = class {
     };
   }
   async runRemoteExecution(run, registered) {
+    if (run.status === "cancelling") {
+      const error = {
+        message: "cancelled"
+      };
+      await this.store.updateRun(run.id, {
+        status: "cancelled",
+        error,
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      this.emit({
+        type: "run.failed",
+        runId: run.id,
+        workflow: run.workflow,
+        error
+      });
+      this.notifyCancelled(run.id);
+      if (this.controlPlane) {
+        void this.controlPlane.publishControl({
+          kind: "cancel",
+          runId: run.id,
+          from: this.instanceId
+        }).catch(() => void 0);
+      }
+      await this.store.releaseRunLock(run.id);
+      return {
+        runId: run.id,
+        status: "cancelled",
+        error
+      };
+    }
     const remote = registered.remote;
     if (run.status === "pending") {
       await this.store.updateRun(run.id, {
@@ -2624,7 +2675,9 @@ var WorkflowEngine = class {
     const history = await this.remoteHistory(run.id);
     let decision;
     try {
-      decision = await remote.executor.advance(run, history);
+      const silenceMs = this.remoteAdvanceSilenceMs;
+      const advance = remote.executor.advance(run, history);
+      decision = silenceMs != null ? await this.awaitWithLivenessDeadline(run.id, advance, silenceMs, () => new RemoteWorkflowTimeout(run.id, silenceMs)) : await advance;
     } catch (err) {
       if (err instanceof RemoteWorkflowTimeout) {
         await this.store.releaseRunLock(run.id);
@@ -2681,6 +2734,15 @@ var WorkflowEngine = class {
         status: "cancelled"
       };
     }
+    const fresh = await this.store.getRun(run.id);
+    if (fresh && (fresh.status === "cancelled" || fresh.status === "completed" || fresh.status === "dead")) {
+      return {
+        runId: run.id,
+        status: fresh.status,
+        output: fresh.output,
+        error: fresh.error
+      };
+    }
     const wakeAt = await this.applyCommands(run, decision.commands);
     return this.settleRun(run, {
       kind: "suspended",
@@ -2848,8 +2910,41 @@ var WorkflowEngine = class {
     }
     return wakeAt;
   }
+  /**
+  * Undo the registered saga compensations in reverse and settle the run `cancelled`. Shared by EVERY
+  * exit path of a run with a compensating cancel in flight — whether the resumed replay returned,
+  * suspended, hit continue-as-new, or threw — so a cancel is never lost just because the body didn't
+  * stop at a suspension point. Clears the in-memory cancel flag.
+  */
+  async compensateAndCancel(run, compensations) {
+    this.cancelRequested.delete(run.id);
+    for (let i = compensations.length - 1; i >= 0; i -= 1) {
+      const comp = compensations[i];
+      if (comp) await this.runCompensation(run, comp);
+    }
+    const error = {
+      message: "cancelled"
+    };
+    await this.store.updateRun(run.id, {
+      status: "cancelled",
+      error,
+      updatedAt: /* @__PURE__ */ new Date()
+    });
+    this.emit({
+      type: "run.failed",
+      runId: run.id,
+      workflow: run.workflow,
+      error
+    });
+    return {
+      runId: run.id,
+      status: "cancelled",
+      error
+    };
+  }
   /** The run body, lease held + renewed by {@link execute}. */
   async runExecution(run, fn, registered) {
+    if (run.status === "cancelling") this.cancelRequested.add(run.id);
     if (run.status === "pending") {
       await this.store.updateRun(run.id, {
         status: "running",
@@ -2862,7 +2957,7 @@ var WorkflowEngine = class {
         workflow: run.workflow
       });
     }
-    if (registered?.singleton && !await this.singletons.admit(run, registered.singleton)) {
+    if (run.status !== "cancelling" && registered?.singleton && !await this.singletons.admit(run, registered.singleton)) {
       const wakeAt = this.singletons.retryWakeAt();
       await this.store.updateRun(run.id, {
         status: "suspended",
@@ -2887,12 +2982,14 @@ var WorkflowEngine = class {
     const ctx = createWorkflowCtx(this.ctxHostFor(replay), run.id, compensations, run.workflow);
     try {
       const output = await fn(ctx, run.input);
+      if (this.cancelRequested.has(run.id)) return this.compensateAndCancel(run, compensations);
       return this.settleRun(run, {
         kind: "completed",
         output
       });
     } catch (err) {
       if (err instanceof ContinueAsNew) {
+        if (this.cancelRequested.has(run.id)) return this.compensateAndCancel(run, compensations);
         await this.store.updateRun(run.id, {
           status: "completed",
           output: void 0,
@@ -2916,37 +3013,13 @@ var WorkflowEngine = class {
         };
       }
       if (err instanceof WorkflowSuspended) {
-        if (this.cancelRequested.has(run.id)) {
-          this.cancelRequested.delete(run.id);
-          for (let i = compensations.length - 1; i >= 0; i -= 1) {
-            const comp = compensations[i];
-            if (comp) await this.runCompensation(run, comp);
-          }
-          const error2 = {
-            message: "cancelled"
-          };
-          await this.store.updateRun(run.id, {
-            status: "cancelled",
-            error: error2,
-            updatedAt: /* @__PURE__ */ new Date()
-          });
-          this.emit({
-            type: "run.failed",
-            runId: run.id,
-            workflow: run.workflow,
-            error: error2
-          });
-          return {
-            runId: run.id,
-            status: "cancelled",
-            error: error2
-          };
-        }
+        if (this.cancelRequested.has(run.id)) return this.compensateAndCancel(run, compensations);
         return this.settleRun(run, {
           kind: "suspended",
           wakeAt: err.wakeAt
         });
       }
+      if (this.cancelRequested.has(run.id)) return this.compensateAndCancel(run, compensations);
       const error = {
         message: err instanceof Error ? err.message : String(err),
         stack: err instanceof Error ? err.stack : void 0
@@ -3285,11 +3358,13 @@ var WorkflowEngine = class {
     }
   }
   /**
-  * Await a remote result, but reject with `RemoteStepTimeout` if neither the result nor a heartbeat
-  * arrives within `timeoutMs`. Each heartbeat (delivered via `transport.onHeartbeat`) rearms the
-  * window, so a worker that keeps beating stays alive past `timeoutMs`.
+  * Await `resultPromise`, but reject with `onTimeout()` if neither it settles nor a heartbeat for `id`
+  * arrives within `timeoutMs`. Each heartbeat (delivered via `transport.onHeartbeat`, looked up in
+  * `heartbeatResets` by `id`) REARMS the window, so a worker that keeps beating stays alive past
+  * `timeoutMs`. Shared by the remote-STEP liveness (keyed by stepId) and the remote-WORKFLOW advance
+  * liveness (keyed by runId); the caller supplies the timeout error and any extra cleanup via `onTimeout`.
   */
-  awaitWithHeartbeat(id, resultPromise, timeoutMs) {
+  awaitWithLivenessDeadline(id, resultPromise, timeoutMs, onTimeout) {
     return new Promise((resolve, reject) => {
       let timer;
       const cleanup = /* @__PURE__ */ __name(() => {
@@ -3299,8 +3374,7 @@ var WorkflowEngine = class {
       const arm = /* @__PURE__ */ __name(() => {
         timer = setTimeout(() => {
           cleanup();
-          this.pending.delete(id);
-          reject(new RemoteStepTimeout(id, timeoutMs));
+          reject(onTimeout());
         }, timeoutMs);
         timer.unref?.();
       }, "arm");
@@ -3318,6 +3392,14 @@ var WorkflowEngine = class {
       });
     });
   }
+  /** Remote-STEP liveness: await a worker result, timing out (with the step's pending-map cleanup) to
+  *  `RemoteStepTimeout` if it neither lands nor beats within `timeoutMs`. See {@link awaitWithLivenessDeadline}. */
+  awaitWithHeartbeat(id, resultPromise, timeoutMs) {
+    return this.awaitWithLivenessDeadline(id, resultPromise, timeoutMs, () => {
+      this.pending.delete(id);
+      return new RemoteStepTimeout(id, timeoutMs);
+    });
+  }
 };
 var RemoteStepError = class extends Error {
   static {
@@ -3891,7 +3973,7 @@ var InMemoryStateStore = class {
   async listIncompleteRuns() {
     return [
       ...this.runs.values()
-    ].filter((r) => r.status === "running").map((r) => ({
+    ].filter((r) => r.status === "running" || r.status === "cancelling").map((r) => ({
       ...r
     }));
   }
@@ -4083,6 +4165,7 @@ var InMemoryTransport = class {
   }
   handlers = /* @__PURE__ */ new Map();
   resultHandler;
+  heartbeatHandler;
   stepEventHandler;
   controlHandlers = /* @__PURE__ */ new Set();
   /** Register a fake worker handler for a step name. */
@@ -4097,7 +4180,12 @@ var InMemoryTransport = class {
   onResult(handler) {
     this.resultHandler = handler;
   }
-  onHeartbeat(_handler) {
+  onHeartbeat(handler) {
+    this.heartbeatHandler = handler;
+  }
+  /** Test hook: deliver a liveness heartbeat to the engine, as a real broker would on its channel. */
+  async emitHeartbeat(beat) {
+    await this.heartbeatHandler?.(beat);
   }
   /** Workflow step lifecycle: deliver to the engine's handler (async, mirroring a real broker). */
   async dispatchStepEvent(event) {